patchstack / patchstack.php

patchstack.php in Patchstack – WordPress & Plugins Security 2.2.11, at patchstack.php

391 lines 11.8 KB

Raw Download Zip

1	<?php
2	/**
3	* Plugin Name: Patchstack Security
4	* Plugin URI: https://patchstack.com/?utm_medium=wp&utm_source=dashboard&utm_campaign=patchstack%20plugin
5	* Author URI: https://patchstack.com/?utm_medium=wp&utm_source=dashboard&utm_campaign=patchstack%20plugin
6	* Description: Patchstack identifies security vulnerabilities in WordPress plugins, themes, and core.
7	* Version: 2.2.11
8	* Author: Patchstack
9	* License: GPLv3
10	* Text Domain: patchstack
11	* Domain Path: /languages
12	* Requires at least: 4.4
13	* Requires PHP: 5.6
14	*/
15
16	// Do not allow the file to be called directly.
17	if ( ! defined( 'ABSPATH' ) ) {
18	exit;
19	}
20
21	if ( ! function_exists( 'patchstack_autoload_classes' ) ) {
22	/**
23	* Autoloads the Patchstack classes when called.
24	*
25	* @param string $class_name The class name to autoload.
26	* @return void
27	*/
28	function patchstack_autoload_classes( $class_name ) {
29	// If the requested class doesn't have our prefix, don't load it.
30	if ( strpos( $class_name, 'P_' ) !== 0 ) {
31	return;
32	}
33
34	// Set up our filename.
35	$file_name = strtolower( str_replace( '_', '-', substr( $class_name, strlen( 'P_' ) ) ) );
36	$dir = trailingslashit( dirname( __FILE__ ) ) . 'includes/';
37	$target = [ $dir . $file_name . '.php', $dir . 'admin/' . str_replace( 'admin-', '', $file_name ) . '.php' ];
38
39	// Attempt each target and load if it exists.
40	foreach ( $target as $file ) {
41	if ( file_exists( $file ) ) {
42	include_once $file;
43	}
44	}
45	}
46	}
47	spl_autoload_register( 'patchstack_autoload_classes' );
48
49	if ( ! class_exists( 'patchstack' ) ) {
50
51	/**
52	* This is the main Patchstack class used for all Patchstack related features and to launch
53	* the Patchstack plugin.
54	*/
55	class Patchstack {
56
57	/**
58	* The plugin version.
59	*
60	* @var string
61	*/
62	const VERSION = '2.2.11';
63
64	/**
65	* API URL of Patchstack to communicate with.
66	*
67	* @var string
68	*/
69	const API_URL = 'https://api.patchstack.com';
70
71	/**
72	* API Auth URL of Patchstack to communicate with.
73	*
74	* @var string
75	*/
76	const AUTH_URL = 'https://auth.patchstack.com';
77
78	/**
79	* Client ID, this is only set when freshly downloaded from the app.
80	*
81	* @var string
82	*/
83	const CLIENT_ID = 'PATCHSTACK_CLIENT_ID';
84
85	/**
86	* Client private key, this is only set when freshly downloaded from the app.
87	*
88	* @var string
89	*/
90	const PRIVATE_KEY = 'PATCHSTACK_PRIVATE_KEY';
91
92	/**
93	* URL of the plugin directory.
94	*
95	* @var string
96	*/
97	protected $url = '';
98
99	/**
100	* Plugin basename.
101	*
102	* @var string
103	*/
104	protected $basename = '';
105
106	/**
107	* Plugin name.
108	*
109	* @var string
110	*/
111	protected $name = '';
112
113	/**
114	* Detailed activation error messages.
115	*
116	* @var array
117	*/
118	protected $activation_errors = [];
119
120	/**
121	* Singleton instance of plugin.
122	*
123	* @var Patchstack
124	*/
125	protected static $single_instance = null;
126
127	/**
128	* Define all the variables that will hold the Patchstack classes.
129	* These must be defined because it allows us to communicate from one class to the other.
130	*/
131	protected $firewall;
132	protected $firewall_base;
133	protected $activation;
134	protected $cron;
135	protected $api;
136	protected $login;
137	protected $ban;
138	protected $hardening;
139	protected $htaccess;
140	protected $hacker_log;
141	protected $upload;
142	protected $rules;
143	protected $hide_login;
144	protected $listener;
145	protected $event_log;
146	protected $multisite;
147	protected $admin_ajax;
148	protected $admin_general;
149	protected $admin_menu;
150	protected $admin_options;
151
152	/**
153	* Setup a few base variables for the plugin.
154	* Also make sure certain constants are defined.
155	*
156	* @return void
157	*/
158	protected function __construct() {
159	// Set the permission constants if not already set.
160	if ( ! defined( 'FS_CHMOD_DIR' ) ) {
161	define( 'FS_CHMOD_DIR', ( fileperms( ABSPATH ) & 0777 \| 0755 ) );
162	}
163
164	if ( ! defined( 'FS_CHMOD_FILE' ) ) {
165	define( 'FS_CHMOD_FILE', ( fileperms( ABSPATH . 'index.php' ) & 0777 \| 0644 ) );
166	}
167
168	// Define local variables.
169	$this->basename = plugin_basename( __FILE__ );
170	$this->url = plugin_dir_url( __FILE__ );
171	$names = explode( '/', $this->basename );
172	$this->name = $names[0];
173
174	// Define WP_CLI command.
175	if ( defined( 'WP_CLI' ) && WP_CLI && method_exists('\WP_CLI', 'add_command')) {
176	\WP_CLI::add_command( 'patchstack activate', [ $this, 'cli_activate' ] );
177	}
178	}
179
180	/**
181	* Call the constructor of all the Patchstack related classes.
182	*
183	* @return void
184	*/
185	public function plugin_classes() {
186	// Define the array of the classes.
187	foreach ( [
188	'admin_options' => 'P_Admin_Options',
189	'cron' => 'P_Cron',
190	'api' => 'P_Api',
191	'login' => 'P_Login',
192	'ban' => 'P_Ban',
193	'hardening' => 'P_Hardening',
194	'htaccess' => 'P_Htaccess',
195	'hacker_log' => 'P_Hacker_Log',
196	'upload' => 'P_Upload',
197	'rules' => 'P_Rules',
198	'hide_login' => 'P_Hide_Login',
199	'event_log' => 'P_Event_Log',
200	'activation' => 'P_Activation',
201	'listener' => 'P_Listener',
202	'multisite' => 'P_Multisite',
203	'admin_ajax' => 'P_Admin_Ajax',
204	'admin_general' => 'P_Admin_General',
205	'admin_menu' => 'P_Admin_Menu',
206	] as $var => $class ) {
207	$this->$var = new $class( $this );
208	}
209
210	// Load firewall base functionality.
211	$this->firewall_base = new P_Firewall( true, $this, true );
212	}
213
214	/**
215	* Activate the plugin.
216	*
217	* @return void
218	*/
219	public function activate() {
220	$this->plugin_classes();
221	$this->activation->activate( $this );
222	}
223
224	/**
225	* Connects the Patchstack plugin to the API with the license id and secret key.
226	*
227	* Returns an error if the connection was not successful.
228	*
229	* ## OPTIONS
230	*
231	* [<id>]
232	* : The API client id.
233	*
234	* [<secret>]
235	* : The API secret key.
236	*
237	* <secret-id>
238	* : The API client id and secret key merged together, found in the App. E.g. 2b072e8b60402e30d481df351fc08183906254e0-123456
239	*
240	* ## EXAMPLES
241	*
242	* $ wp patchstack activate 123456 2b072e8b60402e30d481df351fc08183906254e0
243	* Success: The Patchstack plugin has been successfully connected.
244	*
245	* or
246	*
247	* $ wp patchstack activate 2b072e8b60402e30d481df351fc08183906254e0-123456
248	* Success: The Patchstack plugin has been successfully connected.
249	*/
250	public function cli_activate( $args ) {
251	// Handle both ways to activate the plugin.
252	if ( count( $args ) === 1 && strpos( $args[0], '-' ) !== false ) {
253	list( $secret, $id ) = explode( '-', $args[0] );
254	} else {
255	$id = isset( $args[0] ) ? trim( $args[0] ) : '';
256	$secret = isset( $args[1] ) ? trim( $args[1] ) : '';
257	}
258
259	$result = $this->activation->alter_license( $id, $secret, 'activate' );
260	if ( $result['result'] == 'error' ) {
261	\WP_CLI::error( 'The Patchstack plugin could not be connected. Make sure the id and secret key are valid and that api.patchstack.com is not blocked.' );
262	return;
263	}
264
265	\WP_CLI::success( 'The Patchstack plugin has been successfully connected.' );
266	}
267
268	/**
269	* Deactivate the plugin.
270	*
271	* @return void
272	*/
273	public function deactivate() {
274	$this->plugin_classes();
275	$this->activation->deactivate();
276	}
277
278	/**
279	* Boot Patchstack.
280	*
281	* @return void
282	*/
283	public function init() {
284	// Load translated strings for plugin.
285	load_plugin_textdomain( 'patchstack', false, dirname( $this->basename ) . '/languages/' );
286
287	// Initialize plugin classes.
288	$this->plugin_classes();
289
290	// Perform migrations if necessary.
291	$this->activation->migrate_check();
292
293	// If license expiration has not been fetched yet while the plugin is active, update it.
294	if ( get_option( 'patchstack_api_token', '' ) == '' && get_option( 'patchstack_license_expiry', '' ) == '' ) {
295	$this->api->update_license_status();
296	}
297
298	// Run firewall if not disabled and license activated.
299	if ( get_option( 'patchstack_license_activated', 0 ) == 1 && get_option( 'patchstack_basic_firewall', 0 ) == 1 && get_option( 'patchstack_license_free', 0 ) == 0 ) {
300	$this->firewall = new P_Firewall( true, $this );
301	}
302	}
303
304	/**
305	* Creates or returns an instance of this class.
306	*
307	* @return Patchstack
308	*/
309	public static function get_instance() {
310	if ( null === self::$single_instance ) {
311	self::$single_instance = new self();
312	}
313
314	return self::$single_instance;
315	}
316
317	/**
318	* Magic getter.
319	*
320	* @param string $field The field to magically get.
321	* @return mixed
322	*/
323	public function __get( $field ) {
324	switch ( $field ) {
325	case 'version':
326	return self::VERSION;
327	case 'api_url':
328	return self::API_URL;
329	case 'auth_url':
330	return self::AUTH_URL;
331	case 'client_id':
332	return self::CLIENT_ID;
333	case 'private_key':
334	return self::PRIVATE_KEY;
335	default:
336	try {
337	return $this->$field;
338	} catch ( \Exception $e ) {
339	return null;
340	}
341	}
342	}
343	}
344	}
345
346	if ( ! function_exists( 'patchstack_uninstall' ) ) {
347	/**
348	* Called when the plugin is uninstalled/removed from the site.
349	* This is not the same as deactivation, where the plugin still resides on the site.
350	*
351	* @return void
352	*/
353	function patchstack_uninstall() {
354	// Delete most of the Patchstack options.
355	$options = [ 'patchstack_eventlog_lastid', 'patchstack_api_token', 'patchstack_dashboardlock', 'patchstack_pluginedit', 'patchstack_move_logs', 'patchstack_userenum', 'patchstack_basicscanblock', 'patchstack_hidewpcontent', 'patchstack_hidewpversionk', 'patchstack_prevent_default_file_access', 'patchstack_basic_firewall', 'patchstack_known_blacklist', 'patchstack_block_debug_log_access', 'patchstack_block_fake_bots', 'patchstack_index_views', 'patchstack_proxy_comment_posting', 'patchstack_bad_query_strings', 'patchstack_advanced_character_string_filter', 'patchstack_advanced_blacklist_firewall', 'patchstack_forbid_rfi', 'patchstack_image_hotlinking', 'patchstack_add_security_headers', 'patchstack_firewall_log_lastid', 'patchstack_user_log_lastid', 'patchstack_captcha_public_key', 'patchstack_captcha_private_key', 'patchstack_scan_interval', 'patchstack_scan_day', 'patchstack_scan_time', 'patchstack_hackers_log', 'patchstack_users_log', 'patchstack_visitors_log', 'external_updates-webarx', 'patchstack_wp_stats', 'patchstack_captcha_login_form', 'patchstack_license_activated', 'patchstack_license_expiry', 'patchstack_software_data_hash', 'patchstack_mv_wp_login', 'patchstack_rename_wp_login', 'patchstack_googledrive_backup_is_running', 'patchstack_googledrive_upload_state', 'patchstack_googledrive_access_token', 'patchstack_googledrive_refresh_token', 'patchstack_cron_offset', 'patchstack_htaccess_rules_hash' ];
356	foreach ( $options as $option ) {
357	delete_option( $option );
358
359	if ( is_multisite() ) {
360	delete_site_option( $option );
361	}
362	}
363
364	// Drop all Patchstack tables.
365	global $wpdb;
366	$tables = [ 'patchstack_user_log', 'patchstack_visitor_log', 'patchstack_firewall_log', 'patchstack_file_hashes', 'patchstack_logic', 'patchstack_ip', 'patchstack_event_log' ];
367	foreach ( $tables as $table ) {
368	$wpdb->query( 'DROP TABLE IF EXISTS ' . $wpdb->prefix . $table );
369	}
370	}
371	}
372
373	if ( ! function_exists( 'patchstack' ) ) {
374	/**
375	* Grab the Patchstack object and return it.
376	*
377	* @return Patchstack
378	*/
379	function patchstack() {
380	return patchstack::get_instance();
381	}
382	}
383
384	// Kick it off.
385	add_action( 'plugins_loaded', [ patchstack(), 'init' ] );
386
387	// Activation and deactivation hooks.
388	register_activation_hook( __FILE__, [ patchstack(), 'activate' ] );
389	register_deactivation_hook( __FILE__, [ patchstack(), 'deactivate' ] );
390	register_uninstall_hook( __FILE__, 'patchstack_uninstall' );
391