| @@ -44,9 +44,9 @@ | ||
| 44 | 44 | * |
| 45 | 45 | * @return boolean |
| 46 | 46 | */ |
| 47 | 47 | private function is_custom_whitelisted() { |
| 48 | - $whitelist = str_replace( '<?php exit; ?>', '', get_option( 'patchstack_whitelist', '' ) ); | |
| 48 | + $whitelist = str_replace( '<?php exit; ?>', '', get_option( 'patchstack_custom_whitelist_rules', '' ) ); | |
| 49 | 49 | if ( empty( $whitelist ) ) { |
| 50 | 50 | return false; |
| 51 | 51 | } |
| 52 | 52 | |
| @@ -201,9 +201,9 @@ | ||
| 201 | 201 | * |
| 202 | 202 | * @return array |
| 203 | 203 | */ |
| 204 | 204 | private function get_file_upload_data() { |
| 205 | - if ( ! isset( $_FILES ) || ! is_array( $_FILES ) || count( $_FILES ) == 0 ) { | |
| 205 | + if ( ! is_array( $_FILES ) || count( $_FILES ) == 0 ) { | |
| 206 | 206 | return ''; |
| 207 | 207 | } |
| 208 | 208 | |
| 209 | 209 | // Extract the information we need from $_FILES. |
| @@ -236,10 +236,10 @@ | ||
| 236 | 236 | private function capture_request() { |
| 237 | 237 | $data = $this->capture_keys(); |
| 238 | 238 | |
| 239 | 239 | // Get the method and URL. |
| 240 | - $method = isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : 'GET'; | |
| 241 | - $rulesUri = isset( $_SERVER['REQUEST_URI'] ) ? $_SERVER['REQUEST_URI'] : ''; | |
| 240 | + $method = $_SERVER['REQUEST_METHOD']; | |
| 241 | + $rulesUri = $_SERVER['REQUEST_URI']; | |
| 242 | 242 | |
| 243 | 243 | // Store the header values in different formats. |
| 244 | 244 | $rulesHeadersKeys = array(); |
| 245 | 245 | $rulesHeadersValues = array(); |
| @@ -320,10 +320,10 @@ | ||
| 320 | 320 | */ |
| 321 | 321 | private function capture_keys() { |
| 322 | 322 | // Data we want to go through. |
| 323 | 323 | $data = array( |
| 324 | - 'POST' => isset( $_POST ) ? $_POST : array(), | |
| 325 | - 'GET' => isset( $_GET ) ? $_GET : array(), | |
| 324 | + 'POST' => $_POST, | |
| 325 | + 'GET' => $_GET, | |
| 326 | 326 | ); |
| 327 | 327 | |
| 328 | 328 | // Determine if there are any keys we should remove from the data set. |
| 329 | 329 | if ( get_option( 'patchstack_whitelist_keys_rules', '' ) == '' ) { |
| @@ -659,15 +659,10 @@ | ||
| 659 | 659 | if ( $bypass || ! is_user_logged_in() ) { |
| 660 | 660 | return false; |
| 661 | 661 | } |
| 662 | 662 | |
| 663 | - // Get the whitelisted roles. | |
| 663 | + // Special scenario for super admins on a multisite environment. | |
| 664 | 664 | $roles = $this->get_option( 'patchstack_basic_firewall_roles', array( 'administrator', 'editor', 'author' ) ); |
| 665 | - if ( ! is_array ( $roles ) ) { | |
| 666 | - return false; | |
| 667 | - } | |
| 668 | - | |
| 669 | - // Special scenario for super admins on a multisite environment. | |
| 670 | 665 | if ( in_array( 'administrator', $roles ) && is_multisite() && is_super_admin() ) { |
| 671 | 666 | return true; |
| 672 | 667 | } |
| 673 | 668 | |
| @@ -692,9 +687,9 @@ | ||
| 692 | 687 | * @return void |
| 693 | 688 | */ |
| 694 | 689 | private function log_hacker( $fid = 1, $post_data = '', $block_type = 'BLOCK' ) { |
| 695 | 690 | global $wpdb; |
| 696 | - if ( ! $wpdb || $fid == 22 || $fid == 23 ) { | |
| 691 | + if ( ! $wpdb || $fid == 22 ) { | |
| 697 | 692 | return; |
| 698 | 693 | } |
| 699 | 694 | |
| 700 | 695 | // Insert into the logs. |
| @@ -732,21 +727,15 @@ | ||
| 732 | 727 | * @param integer $fid |
| 733 | 728 | * @return void |
| 734 | 729 | */ |
| 735 | 730 | public function display_error_page( $fid = 1 ) { |
| 736 | - if ( $fid != 22 && $fid != 23 && $fid != 'login' ) { | |
| 731 | + if ( $fid != 22 ) { | |
| 737 | 732 | $this->log_hacker( $fid ); |
| 738 | 733 | } |
| 739 | 734 | |
| 740 | - status_header(403); | |
| 741 | - send_nosniff_header(); | |
| 742 | - nocache_headers(); | |
| 743 | - | |
| 744 | - if ($fid == 'login' ) { | |
| 745 | - require_once dirname( __FILE__ ) . '/views/access-denied-login.php'; | |
| 746 | - } else { | |
| 747 | - require_once dirname( __FILE__ ) . '/views/access-denied.php'; | |
| 748 | - } | |
| 749 | - | |
| 735 | + header( 'Cache-Control: no-store' ); | |
| 736 | + header( 'Pragma: no-cache' ); | |
| 737 | + http_response_code( 403 ); | |
| 738 | + require_once dirname( __FILE__ ) . '/views/access-denied.php'; | |
| 750 | 739 | exit; |
| 751 | 740 | } |
| 752 | 741 | } |
