← All changes | includes/rules.php +50 -62 trunk → 2.2.8 View file →

		@@ -18,8 +18,9 @@
18	18	*/
19	19	public function __construct( $core ) {
20	20	parent::__construct( $core );
21	21	add_action( 'patchstack_post_firewall_rules', [ $this, 'post_firewall_rules' ] );
	22	+ add_action( 'patchstack_post_firewall_htaccess_rules', [ $this, 'post_firewall_htaccess_rules' ] );
22	23	add_action( 'patchstack_post_dynamic_firewall_rules', [ $this, 'dynamic_firewall_rules' ] );
23	24	}
24	25
25	26	/**
		@@ -32,22 +33,15 @@
32	33	if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
33	34	return;
34	35	}
35	36
36		- // Check if server is supported and if htaccess modifications are disabled.
37		- if ( get_site_option( 'patchstack_disable_htaccess', 0 ) || ( defined( 'PS_DISABLE_HTACCESS' ) && PS_DISABLE_HTACCESS ) ) {
38		- return;
39		- }
40		-
41	37	$rules = $this->plugin->htaccess->get_firewall_rule_settings();
42	38	$settings = json_encode( $rules );
43	39	$results = $this->plugin->api->post_firewall_rule( [ 'settings' => $settings ] );
44	40
45		- // If no rules returned (empty, or a status code/null from a failed request),
46		- // we assume all settings are turned off. Guard against assigning to a string
47		- // offset, which is a fatal error on PHP 7.1+.
48		- if ( ! is_array( $results ) ) {
49		- $results = [ 'rules' => '' ];
	41	+ // If no rules returned, we assume all settings are turned off.
	42	+ if ( empty( $results ) ) {
	43	+ $results['rules'] = '';
50	44	}
51	45
52	46	// We have rules so apply it to the .htaccess file.
53	47	if ( isset( $results['rules'] ) ) {
		@@ -56,8 +50,32 @@
56	50	}
57	51	}
58	52
59	53	/**
	54	+ * Pull the firewall .htaccess rules from the API.
	55	+ * Then apply it to the .htaccess file after we create a backup.
	56	+ *
	57	+ * @return void
	58	+ */
	59	+ public function post_firewall_htaccess_rules() {
	60	+ if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
	61	+ return;
	62	+ }
	63	+
	64	+ $results = $this->plugin->api->post_firewall_htaccess_rule();
	65	+ $rules = ! isset( $results['rules'] ) || empty( $results ) ? '' : $results['rules'];
	66	+
	67	+ // Check if we have to update anything at all.
	68	+ $hash = sha1( $rules );
	69	+ if ( get_option( 'patchstack_firewall_htaccess_hash', '' ) == $hash || ( get_option( 'patchstack_firewall_htaccess_hash', '' ) == '' && $rules == '' ) ) {
	70	+ return;
	71	+ }
	72	+
	73	+ // We have rules so apply it to the .htaccess file.
	74	+ update_option( 'patchstack_firewall_htaccess_hash', $hash );
	75	+ }
	76	+
	77	+ /**
60	78	* Pull the firewall/whitelist rules from the API.
61	79	*
62	80	* @return void
63	81	*/
		@@ -72,73 +90,43 @@
72	90	return;
73	91	}
74	92
75	93	// Separate the new firewall engine rules from the old ones.
	94	+ $rules = $results['firewall'];
76	95	$newRules = [];
77		- $newRulesAP = [];
78	96	$oldRules = [];
79		-
80		- // Counters for displaying purposes on the API key page.
81		- $vPatchCount = 0;
82		- $ruleCount = 0;
83		-
84		- // Parse the rules.
85		- foreach ( $results['firewall'] as $rule ) {
	97	+ foreach ( $rules as $rule ) {
86	98	if ( isset( $rule['rule_v2'] ) ) {
87	99	$rule['rules'] = $rule['rule_v2'];
88		- unset( $rule['rule_v2'] );
89		-
90		- // Mark vPatches based on substring.
91		- if ( stripos( $rule['title'], ' vulnerabilit' ) !== false && stripos( $rule['title'], 'block ' ) !== false ) {
92		- $vPatchCount++;
93		- } else {
94		- $ruleCount++;
95		- }
96		-
97		- // Differentiate between auto prepend rules and regular ones.
98		- if ( isset( $rule['ap'] ) && !empty( $rule['ap'] ) ) {
99		- $newRulesAP[] = $rule;
100		- } else {
101		- $newRules[] = $rule;
102		- }
	100	+ unset($rule['rule_v2']);
	101	+ $newRules[] = $rule;
103	102	} else {
104		- $ruleCount++;
105	103	$oldRules[] = $rule;
106	104	}
107	105	}
108	106
109	107	// Update firewall rules.
110		- update_option( 'patchstack_firewall_rules', json_encode( $oldRules ), true );
111		- update_option( 'patchstack_firewall_rules_v3', json_encode( $newRules ), true );
112		- update_option( 'patchstack_firewall_rules_v3_ap', json_encode( $newRulesAP ), true );
	108	+ update_option( 'patchstack_firewall_rules', json_encode( $oldRules ) );
	109	+ update_option( 'patchstack_firewall_rules_v3', json_encode( $newRules ) );
113	110
114		- // Update the counters.
115		- update_option( 'patchstack_vpatches_present', $vPatchCount );
116		- update_option( 'patchstack_non_vpatches_present', $ruleCount );
117		-
118		- // Separate the new firewall engine rules from the old ones. Only touch the
119		- // stored whitelists when the API actually returned them, otherwise a partial
120		- // response would wipe the existing whitelist rules.
121		- if ( isset( $results['whitelists'] ) && is_array( $results['whitelists'] ) ) {
122		- $newRules = [];
123		- $oldRules = [];
124		- foreach ( $results['whitelists'] as $rule ) {
125		- if ( isset( $rule['rule_v2'] ) ) {
126		- $rule['rules'] = $rule['rule_v2'];
127		- unset( $rule['rule_v2'] );
128		- $newRules[] = $rule;
129		- } else {
130		- $oldRules[] = $rule;
131		- }
	111	+ // Separate the new firewall engine rules from the old ones.
	112	+ $rules = $results['whitelists'];
	113	+ $newRules = [];
	114	+ $oldRules = [];
	115	+ foreach ( $rules as $rule ) {
	116	+ if ( isset( $rule['rule_v2'] ) ) {
	117	+ $rule['rules'] = $rule['rule_v2'];
	118	+ unset($rule['rule_v2']);
	119	+ $newRules[] = $rule;
	120	+ } else {
	121	+ $oldRules[] = $rule;
132	122	}
	123	+ }
133	124
134		- // Update whitelist rules.
135		- update_option( 'patchstack_whitelist_rules', json_encode( $oldRules ), true );
136		- update_option( 'patchstack_whitelist_rules_v3', json_encode( $newRules ), true );
137		- }
	125	+ // Update whitelist rules.
	126	+ update_option( 'patchstack_whitelist_rules', json_encode( $oldRules ) );
	127	+ update_option( 'patchstack_whitelist_rules_v3', json_encode( $newRules ) );
138	128
139	129	// Update the whitelisted keys.
140		- if ( isset( $results['whitelist_keys'] ) ) {
141		- update_option( 'patchstack_whitelist_keys_rules', json_encode( $results['whitelist_keys'] ), true );
142		- }
	130	+ update_option( 'patchstack_whitelist_keys_rules', json_encode( $results['whitelist_keys'] ) );
143	131	}
144	132	}