patchstack / patchstack.php

patchstack.php in Patchstack – WordPress & Plugins Security 2.1.25, at patchstack.php

387 lines 11.4 KB

Raw Download Zip

1	<?php
2	/**
3	* Plugin Name: Patchstack Security
4	* Plugin URI: https://patchstack.com
5	* Description: Patchstack identifies security vulnerabilities in WordPress plugins, themes, and core.
6	* Version: 2.1.25
7	* Author: Patchstack
8	* License: GPLv3
9	* Text Domain: patchstack
10	* Domain Path: /languages
11	* Requires at least: 4.4
12	* Requires PHP: 5.6
13	*/
14
15	// Do not allow the file to be called directly.
16	if ( ! defined( 'ABSPATH' ) ) {
17	exit;
18	}
19
20	if ( ! function_exists( 'patchstack_autoload_classes' ) ) {
21	/**
22	* Autoloads the Patchstack classes when called.
23	*
24	* @param string $class_name The class name to autoload.
25	* @return void
26	*/
27	function patchstack_autoload_classes( $class_name ) {
28	// If the requested class doesn't have our prefix, don't load it.
29	if ( strpos( $class_name, 'P_' ) !== 0 ) {
30	return;
31	}
32
33	// Set up our filename.
34	$file_name = strtolower( str_replace( '_', '-', substr( $class_name, strlen( 'P_' ) ) ) );
35	$dir = trailingslashit( dirname( __FILE__ ) ) . 'includes/';
36	$target = array( $dir . $file_name . '.php', $dir . 'admin/' . str_replace( 'admin-', '', $file_name ) . '.php' );
37
38	// Attempt each target and load if it exists.
39	foreach ( $target as $file ) {
40	if ( file_exists( $file ) ) {
41	include_once $file;
42	}
43	}
44	}
45	}
46	spl_autoload_register( 'patchstack_autoload_classes' );
47
48	if ( ! class_exists( 'patchstack' ) ) {
49
50	/**
51	* This is the main Patchstack class used for all Patchstack related features and to launch
52	* the Patchstack plugin.
53	*/
54	class Patchstack {
55
56	/**
57	* The plugin version.
58	*
59	* @var string
60	*/
61	const VERSION = '2.1.25';
62
63	/**
64	* API URL of Patchstack to communicate with.
65	*
66	* @var string
67	*/
68	const API_URL = 'https://api.patchstack.com';
69
70	/**
71	* API Auth URL of Patchstack to communicate with.
72	*
73	* @var string
74	*/
75	const AUTH_URL = 'https://auth.patchstack.com';
76
77	/**
78	* Client ID, this is only set when freshly downloaded from the app.
79	*
80	* @var string
81	*/
82	const CLIENT_ID = 'PATCHSTACK_CLIENT_ID';
83
84	/**
85	* Client private key, this is only set when freshly downloaded from the app.
86	*
87	* @var string
88	*/
89	const PRIVATE_KEY = 'PATCHSTACK_PRIVATE_KEY';
90
91	/**
92	* URL of the plugin directory.
93	*
94	* @var string
95	*/
96	protected $url = '';
97
98	/**
99	* Plugin basename.
100	*
101	* @var string
102	*/
103	protected $basename = '';
104
105	/**
106	* Plugin name.
107	*
108	* @var string
109	*/
110	protected $name = '';
111
112	/**
113	* Detailed activation error messages.
114	*
115	* @var array
116	*/
117	protected $activation_errors = array();
118
119	/**
120	* Singleton instance of plugin.
121	*
122	* @var Patchstack
123	*/
124	protected static $single_instance = null;
125
126	/**
127	* Define all the variables that will hold the Patchstack classes.
128	* These must be defined because it allows us to communicate from one class to the other.
129	*/
130	protected $firewall;
131	protected $firewall_base;
132	protected $activation;
133	protected $cron;
134	protected $api;
135	protected $login;
136	protected $ban;
137	protected $hardening;
138	protected $htaccess;
139	protected $hacker_log;
140	protected $upload;
141	protected $rules;
142	protected $hide_login;
143	protected $listener;
144	protected $event_log;
145	protected $multisite;
146	protected $notice;
147	protected $admin_ajax;
148	protected $admin_general;
149	protected $admin_menu;
150	protected $admin_options;
151
152	/**
153	* Setup a few base variables for the plugin.
154	* Also make sure certain constants are defined.
155	*
156	* @return void
157	*/
158	protected function __construct() {
159	// Set the permission constants if not already set.
160	if ( ! defined( 'FS_CHMOD_DIR' ) ) {
161	define( 'FS_CHMOD_DIR', ( fileperms( ABSPATH ) & 0777 \| 0755 ) );
162	}
163
164	if ( ! defined( 'FS_CHMOD_FILE' ) ) {
165	define( 'FS_CHMOD_FILE', ( fileperms( ABSPATH . 'index.php' ) & 0777 \| 0644 ) );
166	}
167
168	// Define local variables.
169	$this->basename = plugin_basename( __FILE__ );
170	$this->url = plugin_dir_url( __FILE__ );
171	$names = explode( '/', $this->basename );
172	$this->name = $names[0];
173
174	// Define WP_CLI command.
175	if ( defined( 'WP_CLI' ) && WP_CLI && method_exists('\WP_CLI', 'add_command')) {
176	\WP_CLI::add_command( 'patchstack activate', [ $this, 'cli_activate' ] );
177	}
178	}
179
180	/**
181	* Call the constructor of all the Patchstack related classes.
182	*
183	* @return void
184	*/
185	public function plugin_classes() {
186	// Define the array of the classes.
187	foreach ( array(
188	'admin_options' => 'P_Admin_Options',
189	'cron' => 'P_Cron',
190	'api' => 'P_Api',
191	'login' => 'P_Login',
192	'ban' => 'P_Ban',
193	'hardening' => 'P_Hardening',
194	'htaccess' => 'P_Htaccess',
195	'hacker_log' => 'P_Hacker_Log',
196	'upload' => 'P_Upload',
197	'rules' => 'P_Rules',
198	'hide_login' => 'P_Hide_Login',
199	'listener' => 'P_Listener',
200	'event_log' => 'P_Event_Log',
201	'activation' => 'P_Activation',
202	'multisite' => 'P_Multisite',
203	'notice' => 'P_Cookie_Notice',
204	'admin_ajax' => 'P_Admin_Ajax',
205	'admin_general' => 'P_Admin_General',
206	'admin_menu' => 'P_Admin_Menu',
207	) as $var => $class ) {
208	$this->$var = new $class( $this );
209	}
210
211	$this->firewall_base = new P_Firewall( true, $this, true );
212	}
213
214	/**
215	* Activate the plugin.
216	*
217	* @return void
218	*/
219	public function activate() {
220	$this->plugin_classes();
221	$this->activation->activate( $this );
222	}
223
224	/**
225	* Connects the Patchstack plugin to the API with the license id and secret key.
226	*
227	* Returns an error if the connection was not successful.
228	*
229	* ## OPTIONS
230	*
231	* <id>
232	* : The API client id.
233	*
234	* <secret>
235	* : The API secret key.
236	*
237	* ## EXAMPLES
238	*
239	* $ wp patchstack activate 123456 2b072e8b60402e30d481df351fc08183906254e0
240	* Success: The Patchstack plugin has been successfully connected.
241	*/
242	public function cli_activate( $args ) {
243	$id = isset( $args[0] ) ? trim( $args[0] ) : '';
244	$secret = isset( $args[1] ) ? trim( $args[1] ) : '';
245
246	$result = $this->activation->alter_license( $id, $secret, 'activate' );
247	if ( $result['result'] == 'error' ) {
248	\WP_CLI::error( 'The Patchstack plugin could not be connected. Make sure the id and secret key are valid and that api.patchstack.com is not blocked.' );
249	return;
250	}
251
252	\WP_CLI::success( 'The Patchstack plugin has been successfully connected.' );
253	}
254
255	/**
256	* Deactivate the plugin.
257	*
258	* @return void
259	*/
260	public function deactivate() {
261	$this->plugin_classes();
262	$this->activation->deactivate();
263	}
264
265	/**
266	* Boot Patchstack and its classes.
267	*
268	* @return void
269	*/
270	public function hooks() {
271	add_action( 'init', array( $this, 'init' ), ~PHP_INT_MAX );
272	}
273
274	/**
275	* Boot Patchstack
276	*
277	* @return void
278	*/
279	public function init() {
280	// Load translated strings for plugin.
281	load_plugin_textdomain( 'patchstack', false, dirname( $this->basename ) . '/languages/' );
282
283	// Initialize plugin classes.
284	$this->plugin_classes();
285
286	// Perform migrations if necessary.
287	$this->activation->migrate_check();
288
289	// If license expiration has not been fetched yet while the plugin is active, update it.
290	if ( get_option( 'patchstack_api_token', '' ) == '' && get_option( 'patchstack_license_expiry', '' ) == '' ) {
291	$this->api->update_license_status();
292	}
293
294	// Determine if the license is activated and not expired.
295	if ( get_option( 'patchstack_license_activated', 0 ) == 1 && get_option( 'patchstack_basic_firewall', 0 ) == 1 && get_option( 'patchstack_license_free', 0 ) == 0 ) {
296	$this->firewall = new P_Firewall( true, $this );
297	}
298	}
299
300	/**
301	* Creates or returns an instance of this class.
302	*
303	* @return Patchstack
304	*/
305	public static function get_instance() {
306	if ( null === self::$single_instance ) {
307	self::$single_instance = new self();
308	}
309
310	return self::$single_instance;
311	}
312
313	/**
314	* Magic getter.
315	*
316	* @param string $field The field to magically get.
317	* @return mixed
318	*/
319	public function __get( $field ) {
320	switch ( $field ) {
321	case 'version':
322	return self::VERSION;
323	case 'api_url':
324	return self::API_URL;
325	case 'auth_url':
326	return self::AUTH_URL;
327	case 'client_id':
328	return self::CLIENT_ID;
329	case 'private_key':
330	return self::PRIVATE_KEY;
331	default:
332	try {
333	return $this->$field;
334	} catch ( \Exception $e ) {
335	return null;
336	}
337	}
338	}
339	}
340	}
341
342	if ( ! function_exists( 'patchstack_uninstall' ) ) {
343	/**
344	* Called when the plugin is uninstalled/removed from the site.
345	* This is not the same as deactivation, where the plugin still resides on the site.
346	*
347	* @return void
348	*/
349	function patchstack_uninstall() {
350	// Delete most of the Patchstack options.
351	$options = array( 'patchstack_eventlog_lastid', 'patchstack_api_token', 'patchstack_dashboardlock', 'patchstack_pluginedit', 'patchstack_move_logs', 'patchstack_userenum', 'patchstack_basicscanblock', 'patchstack_hidewpcontent', 'patchstack_hidewpversionk', 'patchstack_prevent_default_file_access', 'patchstack_basic_firewall', 'patchstack_known_blacklist', 'patchstack_block_debug_log_access', 'patchstack_block_fake_bots', 'patchstack_index_views', 'patchstack_proxy_comment_posting', 'patchstack_bad_query_strings', 'patchstack_advanced_character_string_filter', 'patchstack_advanced_blacklist_firewall', 'patchstack_forbid_rfi', 'patchstack_image_hotlinking', 'patchstack_add_security_headers', 'patchstack_firewall_log_lastid', 'patchstack_user_log_lastid', 'patchstack_captcha_public_key', 'patchstack_captcha_private_key', 'patchstack_scan_interval', 'patchstack_scan_day', 'patchstack_scan_time', 'patchstack_hackers_log', 'patchstack_users_log', 'patchstack_visitors_log', 'external_updates-webarx', 'patchstack_wp_stats', 'patchstack_captcha_login_form', 'patchstack_license_activated', 'patchstack_license_expiry', 'patchstack_software_data_hash', 'patchstack_mv_wp_login', 'patchstack_rename_wp_login', 'patchstack_googledrive_backup_is_running', 'patchstack_googledrive_upload_state', 'patchstack_googledrive_access_token', 'patchstack_googledrive_refresh_token', 'patchstack_cron_offset', 'patchstack_htaccess_rules_hash' );
352	foreach ( $options as $option ) {
353	delete_option( $option );
354
355	if ( is_multisite() ) {
356	delete_site_option( $option );
357	}
358	}
359
360	// Drop all Patchstack tables.
361	global $wpdb;
362	$tables = array( 'patchstack_user_log', 'patchstack_visitor_log', 'patchstack_firewall_log', 'patchstack_file_hashes', 'patchstack_logic', 'patchstack_ip', 'patchstack_event_log' );
363	foreach ( $tables as $table ) {
364	$wpdb->query( 'DROP TABLE IF EXISTS ' . $wpdb->prefix . $table );
365	}
366	}
367	}
368
369	if ( ! function_exists( 'patchstack' ) ) {
370	/**
371	* Grab the Patchstack object and return it.
372	*
373	* @return Patchstack
374	*/
375	function patchstack() {
376	return patchstack::get_instance();
377	}
378	}
379
380	// Kick it off.
381	add_action( 'plugins_loaded', array( patchstack(), 'hooks' ) );
382
383	// Activation and deactivation hooks.
384	register_activation_hook( __FILE__, array( patchstack(), 'activate' ) );
385	register_deactivation_hook( __FILE__, array( patchstack(), 'deactivate' ) );
386	register_uninstall_hook( __FILE__, 'patchstack_uninstall' );
387