patchstack / patchstack.php

patchstack.php in Patchstack – WordPress & Plugins Security 2.2.0, at patchstack.php

380 lines 11.4 KB

Raw Download Zip

1	<?php
2	/**
3	* Plugin Name: Patchstack Security
4	* Plugin URI: https://patchstack.com/?utm_medium=wp&utm_source=dashboard&utm_campaign=patchstack%20plugin
5	* Author URI: https://patchstack.com/?utm_medium=wp&utm_source=dashboard&utm_campaign=patchstack%20plugin
6	* Description: Patchstack identifies security vulnerabilities in WordPress plugins, themes, and core.
7	* Version: 2.2.0
8	* Author: Patchstack
9	* License: GPLv3
10	* Text Domain: patchstack
11	* Domain Path: /languages
12	* Requires at least: 4.4
13	* Requires PHP: 5.6
14	*/
15
16	// Do not allow the file to be called directly.
17	if ( ! defined( 'ABSPATH' ) ) {
18	exit;
19	}
20
21	if ( ! function_exists( 'patchstack_autoload_classes' ) ) {
22	/**
23	* Autoloads the Patchstack classes when called.
24	*
25	* @param string $class_name The class name to autoload.
26	* @return void
27	*/
28	function patchstack_autoload_classes( $class_name ) {
29	// If the requested class doesn't have our prefix, don't load it.
30	if ( strpos( $class_name, 'P_' ) !== 0 ) {
31	return;
32	}
33
34	// Set up our filename.
35	$file_name = strtolower( str_replace( '_', '-', substr( $class_name, strlen( 'P_' ) ) ) );
36	$dir = trailingslashit( dirname( __FILE__ ) ) . 'includes/';
37	$target = [ $dir . $file_name . '.php', $dir . 'admin/' . str_replace( 'admin-', '', $file_name ) . '.php' ];
38
39	// Attempt each target and load if it exists.
40	foreach ( $target as $file ) {
41	if ( file_exists( $file ) ) {
42	include_once $file;
43	}
44	}
45	}
46	}
47	spl_autoload_register( 'patchstack_autoload_classes' );
48
49	if ( ! class_exists( 'patchstack' ) ) {
50
51	/**
52	* This is the main Patchstack class used for all Patchstack related features and to launch
53	* the Patchstack plugin.
54	*/
55	class Patchstack {
56
57	/**
58	* The plugin version.
59	*
60	* @var string
61	*/
62	const VERSION = '2.2.0';
63
64	/**
65	* API URL of Patchstack to communicate with.
66	*
67	* @var string
68	*/
69	const API_URL = 'https://api.patchstack.com';
70
71	/**
72	* API Auth URL of Patchstack to communicate with.
73	*
74	* @var string
75	*/
76	const AUTH_URL = 'https://auth.patchstack.com';
77
78	/**
79	* Client ID, this is only set when freshly downloaded from the app.
80	*
81	* @var string
82	*/
83	const CLIENT_ID = 'PATCHSTACK_CLIENT_ID';
84
85	/**
86	* Client private key, this is only set when freshly downloaded from the app.
87	*
88	* @var string
89	*/
90	const PRIVATE_KEY = 'PATCHSTACK_PRIVATE_KEY';
91
92	/**
93	* URL of the plugin directory.
94	*
95	* @var string
96	*/
97	protected $url = '';
98
99	/**
100	* Plugin basename.
101	*
102	* @var string
103	*/
104	protected $basename = '';
105
106	/**
107	* Plugin name.
108	*
109	* @var string
110	*/
111	protected $name = '';
112
113	/**
114	* Detailed activation error messages.
115	*
116	* @var array
117	*/
118	protected $activation_errors = [];
119
120	/**
121	* Singleton instance of plugin.
122	*
123	* @var Patchstack
124	*/
125	protected static $single_instance = null;
126
127	/**
128	* Define all the variables that will hold the Patchstack classes.
129	* These must be defined because it allows us to communicate from one class to the other.
130	*/
131	protected $firewall;
132	protected $firewall_base;
133	protected $activation;
134	protected $cron;
135	protected $api;
136	protected $login;
137	protected $ban;
138	protected $hardening;
139	protected $htaccess;
140	protected $hacker_log;
141	protected $upload;
142	protected $rules;
143	protected $hide_login;
144	protected $listener;
145	protected $event_log;
146	protected $multisite;
147	protected $notice;
148	protected $admin_ajax;
149	protected $admin_general;
150	protected $admin_menu;
151	protected $admin_options;
152
153	/**
154	* Setup a few base variables for the plugin.
155	* Also make sure certain constants are defined.
156	*
157	* @return void
158	*/
159	protected function __construct() {
160	// Set the permission constants if not already set.
161	if ( ! defined( 'FS_CHMOD_DIR' ) ) {
162	define( 'FS_CHMOD_DIR', ( fileperms( ABSPATH ) & 0777 \| 0755 ) );
163	}
164
165	if ( ! defined( 'FS_CHMOD_FILE' ) ) {
166	define( 'FS_CHMOD_FILE', ( fileperms( ABSPATH . 'index.php' ) & 0777 \| 0644 ) );
167	}
168
169	// Define local variables.
170	$this->basename = plugin_basename( __FILE__ );
171	$this->url = plugin_dir_url( __FILE__ );
172	$names = explode( '/', $this->basename );
173	$this->name = $names[0];
174
175	// Define WP_CLI command.
176	if ( defined( 'WP_CLI' ) && WP_CLI && method_exists('\WP_CLI', 'add_command')) {
177	\WP_CLI::add_command( 'patchstack activate', [ $this, 'cli_activate' ] );
178	}
179	}
180
181	/**
182	* Call the constructor of all the Patchstack related classes.
183	*
184	* @return void
185	*/
186	public function plugin_classes() {
187	// Define the array of the classes.
188	foreach ( [
189	'admin_options' => 'P_Admin_Options',
190	'cron' => 'P_Cron',
191	'api' => 'P_Api',
192	'login' => 'P_Login',
193	'ban' => 'P_Ban',
194	'hardening' => 'P_Hardening',
195	'htaccess' => 'P_Htaccess',
196	'hacker_log' => 'P_Hacker_Log',
197	'upload' => 'P_Upload',
198	'rules' => 'P_Rules',
199	'hide_login' => 'P_Hide_Login',
200	'listener' => 'P_Listener',
201	'event_log' => 'P_Event_Log',
202	'activation' => 'P_Activation',
203	'multisite' => 'P_Multisite',
204	'notice' => 'P_Cookie_Notice',
205	'admin_ajax' => 'P_Admin_Ajax',
206	'admin_general' => 'P_Admin_General',
207	'admin_menu' => 'P_Admin_Menu',
208	] as $var => $class ) {
209	$this->$var = new $class( $this );
210	}
211
212	// Load firewall base functionality.
213	$this->firewall_base = new P_Firewall( true, $this, true );
214	}
215
216	/**
217	* Activate the plugin.
218	*
219	* @return void
220	*/
221	public function activate() {
222	$this->plugin_classes();
223	$this->activation->activate( $this );
224	}
225
226	/**
227	* Connects the Patchstack plugin to the API with the license id and secret key.
228	*
229	* Returns an error if the connection was not successful.
230	*
231	* ## OPTIONS
232	*
233	* <id>
234	* : The API client id.
235	*
236	* <secret>
237	* : The API secret key.
238	*
239	* ## EXAMPLES
240	*
241	* $ wp patchstack activate 123456 2b072e8b60402e30d481df351fc08183906254e0
242	* Success: The Patchstack plugin has been successfully connected.
243	*/
244	public function cli_activate( $args ) {
245	$id = isset( $args[0] ) ? trim( $args[0] ) : '';
246	$secret = isset( $args[1] ) ? trim( $args[1] ) : '';
247
248	$result = $this->activation->alter_license( $id, $secret, 'activate' );
249	if ( $result['result'] == 'error' ) {
250	\WP_CLI::error( 'The Patchstack plugin could not be connected. Make sure the id and secret key are valid and that api.patchstack.com is not blocked.' );
251	return;
252	}
253
254	\WP_CLI::success( 'The Patchstack plugin has been successfully connected.' );
255	}
256
257	/**
258	* Deactivate the plugin.
259	*
260	* @return void
261	*/
262	public function deactivate() {
263	$this->plugin_classes();
264	$this->activation->deactivate();
265	}
266
267	/**
268	* Boot Patchstack.
269	*
270	* @return void
271	*/
272	public function init() {
273	// Load translated strings for plugin.
274	load_plugin_textdomain( 'patchstack', false, dirname( $this->basename ) . '/languages/' );
275
276	// Initialize plugin classes.
277	$this->plugin_classes();
278
279	// Perform migrations if necessary.
280	$this->activation->migrate_check();
281
282	// If license expiration has not been fetched yet while the plugin is active, update it.
283	if ( get_option( 'patchstack_api_token', '' ) == '' && get_option( 'patchstack_license_expiry', '' ) == '' ) {
284	$this->api->update_license_status();
285	}
286
287	// Run firewall if not disabled and license activated.
288	if ( get_option( 'patchstack_license_activated', 0 ) == 1 && get_option( 'patchstack_basic_firewall', 0 ) == 1 && get_option( 'patchstack_license_free', 0 ) == 0 ) {
289	$this->firewall = new P_Firewall( true, $this );
290	}
291	}
292
293	/**
294	* Creates or returns an instance of this class.
295	*
296	* @return Patchstack
297	*/
298	public static function get_instance() {
299	if ( null === self::$single_instance ) {
300	self::$single_instance = new self();
301	}
302
303	return self::$single_instance;
304	}
305
306	/**
307	* Magic getter.
308	*
309	* @param string $field The field to magically get.
310	* @return mixed
311	*/
312	public function __get( $field ) {
313	switch ( $field ) {
314	case 'version':
315	return self::VERSION;
316	case 'api_url':
317	return self::API_URL;
318	case 'auth_url':
319	return self::AUTH_URL;
320	case 'client_id':
321	return self::CLIENT_ID;
322	case 'private_key':
323	return self::PRIVATE_KEY;
324	default:
325	try {
326	return $this->$field;
327	} catch ( \Exception $e ) {
328	return null;
329	}
330	}
331	}
332	}
333	}
334
335	if ( ! function_exists( 'patchstack_uninstall' ) ) {
336	/**
337	* Called when the plugin is uninstalled/removed from the site.
338	* This is not the same as deactivation, where the plugin still resides on the site.
339	*
340	* @return void
341	*/
342	function patchstack_uninstall() {
343	// Delete most of the Patchstack options.
344	$options = [ 'patchstack_eventlog_lastid', 'patchstack_api_token', 'patchstack_dashboardlock', 'patchstack_pluginedit', 'patchstack_move_logs', 'patchstack_userenum', 'patchstack_basicscanblock', 'patchstack_hidewpcontent', 'patchstack_hidewpversionk', 'patchstack_prevent_default_file_access', 'patchstack_basic_firewall', 'patchstack_known_blacklist', 'patchstack_block_debug_log_access', 'patchstack_block_fake_bots', 'patchstack_index_views', 'patchstack_proxy_comment_posting', 'patchstack_bad_query_strings', 'patchstack_advanced_character_string_filter', 'patchstack_advanced_blacklist_firewall', 'patchstack_forbid_rfi', 'patchstack_image_hotlinking', 'patchstack_add_security_headers', 'patchstack_firewall_log_lastid', 'patchstack_user_log_lastid', 'patchstack_captcha_public_key', 'patchstack_captcha_private_key', 'patchstack_scan_interval', 'patchstack_scan_day', 'patchstack_scan_time', 'patchstack_hackers_log', 'patchstack_users_log', 'patchstack_visitors_log', 'external_updates-webarx', 'patchstack_wp_stats', 'patchstack_captcha_login_form', 'patchstack_license_activated', 'patchstack_license_expiry', 'patchstack_software_data_hash', 'patchstack_mv_wp_login', 'patchstack_rename_wp_login', 'patchstack_googledrive_backup_is_running', 'patchstack_googledrive_upload_state', 'patchstack_googledrive_access_token', 'patchstack_googledrive_refresh_token', 'patchstack_cron_offset', 'patchstack_htaccess_rules_hash' ];
345	foreach ( $options as $option ) {
346	delete_option( $option );
347
348	if ( is_multisite() ) {
349	delete_site_option( $option );
350	}
351	}
352
353	// Drop all Patchstack tables.
354	global $wpdb;
355	$tables = [ 'patchstack_user_log', 'patchstack_visitor_log', 'patchstack_firewall_log', 'patchstack_file_hashes', 'patchstack_logic', 'patchstack_ip', 'patchstack_event_log' ];
356	foreach ( $tables as $table ) {
357	$wpdb->query( 'DROP TABLE IF EXISTS ' . $wpdb->prefix . $table );
358	}
359	}
360	}
361
362	if ( ! function_exists( 'patchstack' ) ) {
363	/**
364	* Grab the Patchstack object and return it.
365	*
366	* @return Patchstack
367	*/
368	function patchstack() {
369	return patchstack::get_instance();
370	}
371	}
372
373	// Kick it off.
374	add_action( 'plugins_loaded', [ patchstack(), 'init' ] );
375
376	// Activation and deactivation hooks.
377	register_activation_hook( __FILE__, [ patchstack(), 'activate' ] );
378	register_deactivation_hook( __FILE__, [ patchstack(), 'deactivate' ] );
379	register_uninstall_hook( __FILE__, 'patchstack_uninstall' );
380