patchstack / includes / upload.php

upload.php in Patchstack – WordPress & Plugins Security 2.1.2, at includes/upload.php

259 lines 8.8 KB

Raw Download Zip

1	<?php
2
3	// Do not allow the file to be called directly.
4	if ( ! defined( 'ABSPATH' ) ) {
5	exit;
6	}
7
8	/**
9	* This class is used to upload the local logs to our API so it can
10	* be shown on the app.
11	*/
12	class P_Upload extends P_Core {
13
14	/**
15	* Add the actions required to upload logs to our API.
16	*
17	* @param Patchstack $core
18	* @return void
19	*/
20	public function __construct( $core ) {
21	parent::__construct( $core );
22
23	// In case the software has never been synchronized, force it.
24	if ( ! get_option( 'patchstack_software_data_hash', false ) ) {
25	$this->upload_software();
26	}
27
28	// Register the actions.
29	add_action( 'patchstack_send_software_data', array( $this, 'upload_software' ) );
30	add_action( 'patchstack_send_hacker_logs', array( $this, 'upload_firewall_logs' ) );
31	add_action( 'patchstack_send_event_logs', array( $this, 'upload_activity_logs' ) );
32
33	// In case a plugin or upgrade has been performed, re-synchronize with the app.
34	add_action( 'activated_plugin', array( $this, 'upload_software' ) );
35	add_action( 'deactivated_plugin', array( $this, 'upload_software' ) );
36	add_action( 'upgrader_process_complete', array( $this, 'upload_software' ) );
37	add_action( '_core_updated_successfully', array( &$this, 'upload_software' ) );
38	}
39
40	/**
41	* Synchronize the software data with our API.
42	* This includes plugins, themes, WordPress and PHP version.
43	*
44	* @return void\|array
45	*/
46	public function upload_software() {
47	// Get the software data and hash.
48	$data = $this->get_software_data();
49	$hash = sha1( json_encode( $data ) );
50	if ( ! isset( $_POST['webarx_secret'] ) && get_option( 'patchstack_software_data_hash', false ) === $hash ) {
51	return;
52	}
53
54	// Synchronize the software list with the API.
55	$results = $this->plugin->api->upload_software( array( 'software' => json_encode( $data ) ) );
56	if ( isset( $results['success'] ) ) {
57	update_option( 'patchstack_software_data_hash', $hash );
58
59	// The result will also contain a list of all vulnerable plugins on the site that is returned by the API.
60	// If the auto update setting is enabled for vulnerable plugins, perform the update once the 15 minute
61	// scheduled task "patchstack_update_plugins" is executed.
62	$update = get_site_option( 'patchstack_auto_update', array() );
63	if ( isset( $results['vulnerable'] ) && is_array( $update ) && in_array( 'vulnerable', $update ) ) {
64	update_site_option( 'patchstack_vulnerable_plugins', $results['vulnerable'] );
65	}
66
67	return $results;
68	}
69
70	return;
71	}
72
73	/**
74	* Synchronize the firewall logs with our API.
75	*
76	* @return void
77	*/
78	public function upload_firewall_logs() {
79	global $wpdb;
80	$lastid = get_option( 'patchstack_firewall_log_lastid', 0, true );
81	$items = $wpdb->get_results( $wpdb->prepare( 'SELECT ip, log_date, request_uri, user_agent, fid, method, post_data FROM ' . $wpdb->prefix . 'patchstack_firewall_log WHERE id > %d ORDER BY id', $lastid ) );
82
83	// No need to synchronize if there are no new logs present.
84	if ( $wpdb->num_rows == 0 ) {
85	return;
86	}
87
88	// Construct the array to be uploaded to our API.
89	$logs = array();
90	foreach ( $items as $item ) {
91
92	// Entries that we don't want to store on the API side.
93	if ( stripos( $item->request_uri, 'wp-comments-post' ) !== false ) {
94	continue;
95	}
96
97	// Push to entries to be uploaded.
98	$logs[] = array(
99	'ip' => $item->ip,
100	'fid' => $item->fid,
101	'request_uri' => $item->request_uri,
102	'user_agent' => $item->user_agent,
103	'method' => $item->method,
104	'log_date' => $item->log_date,
105	'post_data' => $item->post_data,
106	);
107	}
108
109	// JSON encode the logs and upload.
110	$logs = json_encode( $logs );
111	$results = $this->plugin->api->upload_firewall_logs(
112	array(
113	'logs' => $logs,
114	'type' => 'firewall',
115	)
116	);
117	if ( isset( $results['errors'] ) ) {
118	return;
119	}
120
121	// Get the most recent id of the logs.
122	$lastid = $wpdb->get_var( 'SELECT id FROM ' . $wpdb->prefix . 'patchstack_firewall_log ORDER BY id DESC LIMIT 0, 1' );
123	update_option( 'patchstack_firewall_log_lastid', $lastid );
124
125	// Delete logs that are older than 2 weeks.
126	$wpdb->query( 'DELETE FROM ' . $wpdb->prefix . 'patchstack_firewall_log WHERE log_date < DATE_SUB(NOW(), INTERVAL 14 DAY)' );
127	}
128
129	/**
130	* Synchronize the activity logs with our API.
131	*
132	* @return void
133	*/
134	public function upload_activity_logs() {
135	global $wpdb;
136
137	// Determine if we should upload failed logins to the app.
138	$where = " AND action != 'failed login' ";
139	if ( $this->get_option( 'patchstack_activity_log_failed_logins_db', 0 ) == 1 ) {
140	$where = ' ';
141	}
142
143	// Do we have data to upload?
144	$lastid = get_option( 'patchstack_eventlog_lastid', 0 );
145	$items = $wpdb->get_results( $wpdb->prepare( 'SELECT author, ip, object, object_id, object_name, action, date FROM ' . $wpdb->prefix . 'patchstack_event_log WHERE id > %d' . $where . 'ORDER BY id', array( $lastid ) ) );
146	if ( $wpdb->num_rows == 0 ) {
147	return;
148	}
149
150	// Send to the API.
151	$logs = json_encode( $items );
152	$results = $this->plugin->api->upload_activity_logs( array( 'logs' => $logs ) );
153	if ( isset( $results['errors'] ) ) {
154	return;
155	}
156
157	// Get the most recent id of the logs.
158	$lastid = $wpdb->get_var( 'SELECT id FROM ' . $wpdb->prefix . 'patchstack_event_log ORDER BY id DESC LIMIT 0, 1' );
159	update_option( 'patchstack_eventlog_lastid', $lastid );
160
161	// Delete logs that are older than 2 weeks.
162	$wpdb->query( 'DELETE FROM ' . $wpdb->prefix . 'patchstack_event_log WHERE date < DATE_SUB(NOW(), INTERVAL 14 DAY)' );
163	}
164
165	/**
166	* Obtain information about the software that the user has installed.
167	* This includes plugins, themes, WordPress and PHP version.
168	*
169	* @return array
170	*/
171	public function get_software_data() {
172	if ( ! function_exists( 'get_plugins' ) ) {
173	require_once ABSPATH . 'wp-admin/includes/plugin.php';
174	}
175	if ( ! function_exists( 'get_plugin_updates' ) ) {
176	require_once ABSPATH . 'wp-admin/includes/update.php';
177	}
178
179	// Refetch updates data if we are performing a plugin listener related action.
180	if ( isset( $_POST['webarx_secret'] ) ) {
181	@require_once ABSPATH . 'wp-includes/update.php';
182	@wp_update_themes();
183	@wp_update_plugins();
184	}
185
186	// Fetch list of plugins.
187	$all_plugin = get_plugins();
188	$installed_plugins = array_keys( $all_plugin );
189	$updatable_plugins = get_plugin_updates();
190	$software_list = array();
191
192	foreach ( $installed_plugins as $plugin ) {
193	if ( ! file_exists( WP_PLUGIN_DIR . '/' . $plugin ) ) {
194	continue;
195	}
196
197	$plugin_data = get_plugin_data( WP_PLUGIN_DIR . '/' . $plugin );
198	$new_version = empty( $updatable_plugins[ $plugin ]->update->new_version ) ? '' : $updatable_plugins[ $plugin ]->update->new_version;
199	$plugin_name = empty( $plugin_data['Name'] ) ? '' : $plugin_data['Name'];
200	$plugin_version = empty( $plugin_data['Version'] ) ? '' : $plugin_data['Version'];
201
202	if ( ! empty( $plugin_name ) && ! empty( $plugin_version ) ) {
203	$software_list[] = array(
204	'sw_type' => 'plugin',
205	'sw_name' => $plugin_name,
206	'sw_cur_ver' => $plugin_version,
207	'sw_new_ver' => $new_version,
208	'sw_key' => $plugin,
209	'sw_active' => is_plugin_active( $plugin ),
210	);
211	}
212	}
213
214	// Fetch list of themes.
215	$themes = wp_get_themes();
216	$themes_keys = array_keys( $themes );
217	$updatable_themes = get_theme_updates();
218
219	foreach ( $themes_keys as $theme_key ) {
220	$themes_data = $themes[ $theme_key ];
221	$theme_temporary = empty( $updatable_themes[ $theme_key ] ) ? '' : $updatable_themes[ $theme_key ];
222	$theme_new_version = empty( $updatable_themes[ $theme_key ] ) \|\| ! isset( $theme_temporary->update, $theme_temporary->update['new_version'] ) ? '' : $theme_temporary->update['new_version'];
223	$theme_name = $themes_data->get( 'Name' );
224	$theme_version = $themes_data->get( 'Version' );
225
226	if ( ! empty( $theme_name ) && ! empty( $theme_version ) ) {
227	$software_list[] = array(
228	'sw_type' => 'theme',
229	'sw_name' => $theme_name,
230	'sw_cur_ver' => $theme_version,
231	'sw_new_ver' => $theme_new_version,
232	'sw_key' => $theme_key,
233	);
234	}
235	}
236
237	// Fetch WordPress version.
238	global $wp_version;
239	$core_updates = get_core_updates();
240	$new_wp_version = ( ! empty( $core_updates ) && $core_updates[0]->response == 'upgrade' ) ? $core_updates[0]->version : '';
241	$software_list[] = array(
242	'sw_type' => 'wordpress',
243	'sw_name' => 'WordPress',
244	'sw_cur_ver' => $wp_version,
245	'sw_new_ver' => $new_wp_version,
246	);
247
248	// Fetch PHP version.
249	$software_list[] = array(
250	'sw_type' => 'php',
251	'sw_name' => 'PHP',
252	'sw_cur_ver' => substr( phpversion(), 0, 5 ),
253	'sw_new_ver' => '',
254	);
255
256	return $software_list;
257	}
258	}
259