patchstack / patchstack.php

patchstack.php in Patchstack – WordPress & Plugins Security 2.2.9, at patchstack.php

393 lines 11.9 KB

Raw Download Zip

1	<?php
2	/**
3	* Plugin Name: Patchstack Security
4	* Plugin URI: https://patchstack.com/?utm_medium=wp&utm_source=dashboard&utm_campaign=patchstack%20plugin
5	* Author URI: https://patchstack.com/?utm_medium=wp&utm_source=dashboard&utm_campaign=patchstack%20plugin
6	* Description: Patchstack identifies security vulnerabilities in WordPress plugins, themes, and core.
7	* Version: 2.2.9
8	* Author: Patchstack
9	* License: GPLv3
10	* Text Domain: patchstack
11	* Domain Path: /languages
12	* Requires at least: 4.4
13	* Requires PHP: 5.6
14	*/
15
16	// Do not allow the file to be called directly.
17	if ( ! defined( 'ABSPATH' ) ) {
18	exit;
19	}
20
21	if ( ! function_exists( 'patchstack_autoload_classes' ) ) {
22	/**
23	* Autoloads the Patchstack classes when called.
24	*
25	* @param string $class_name The class name to autoload.
26	* @return void
27	*/
28	function patchstack_autoload_classes( $class_name ) {
29	// If the requested class doesn't have our prefix, don't load it.
30	if ( strpos( $class_name, 'P_' ) !== 0 ) {
31	return;
32	}
33
34	// Set up our filename.
35	$file_name = strtolower( str_replace( '_', '-', substr( $class_name, strlen( 'P_' ) ) ) );
36	$dir = trailingslashit( dirname( __FILE__ ) ) . 'includes/';
37	$target = [ $dir . $file_name . '.php', $dir . 'admin/' . str_replace( 'admin-', '', $file_name ) . '.php' ];
38
39	// Attempt each target and load if it exists.
40	foreach ( $target as $file ) {
41	if ( file_exists( $file ) ) {
42	include_once $file;
43	}
44	}
45	}
46	}
47	spl_autoload_register( 'patchstack_autoload_classes' );
48
49	if ( ! class_exists( 'patchstack' ) ) {
50
51	/**
52	* This is the main Patchstack class used for all Patchstack related features and to launch
53	* the Patchstack plugin.
54	*/
55	class Patchstack {
56
57	/**
58	* The plugin version.
59	*
60	* @var string
61	*/
62	const VERSION = '2.2.9';
63
64	/**
65	* API URL of Patchstack to communicate with.
66	*
67	* @var string
68	*/
69	const API_URL = 'https://api.patchstack.com';
70
71	/**
72	* API Auth URL of Patchstack to communicate with.
73	*
74	* @var string
75	*/
76	const AUTH_URL = 'https://auth.patchstack.com';
77
78	/**
79	* Client ID, this is only set when freshly downloaded from the app.
80	*
81	* @var string
82	*/
83	const CLIENT_ID = 'PATCHSTACK_CLIENT_ID';
84
85	/**
86	* Client private key, this is only set when freshly downloaded from the app.
87	*
88	* @var string
89	*/
90	const PRIVATE_KEY = 'PATCHSTACK_PRIVATE_KEY';
91
92	/**
93	* URL of the plugin directory.
94	*
95	* @var string
96	*/
97	protected $url = '';
98
99	/**
100	* Plugin basename.
101	*
102	* @var string
103	*/
104	protected $basename = '';
105
106	/**
107	* Plugin name.
108	*
109	* @var string
110	*/
111	protected $name = '';
112
113	/**
114	* Detailed activation error messages.
115	*
116	* @var array
117	*/
118	protected $activation_errors = [];
119
120	/**
121	* Singleton instance of plugin.
122	*
123	* @var Patchstack
124	*/
125	protected static $single_instance = null;
126
127	/**
128	* Define all the variables that will hold the Patchstack classes.
129	* These must be defined because it allows us to communicate from one class to the other.
130	*/
131	protected $firewall;
132	protected $firewall_base;
133	protected $activation;
134	protected $cron;
135	protected $api;
136	protected $login;
137	protected $ban;
138	protected $hardening;
139	protected $htaccess;
140	protected $hacker_log;
141	protected $upload;
142	protected $rules;
143	protected $hide_login;
144	protected $listener;
145	protected $event_log;
146	protected $multisite;
147	protected $notice;
148	protected $admin_ajax;
149	protected $admin_general;
150	protected $admin_menu;
151	protected $admin_options;
152
153	/**
154	* Setup a few base variables for the plugin.
155	* Also make sure certain constants are defined.
156	*
157	* @return void
158	*/
159	protected function __construct() {
160	// Set the permission constants if not already set.
161	if ( ! defined( 'FS_CHMOD_DIR' ) ) {
162	define( 'FS_CHMOD_DIR', ( fileperms( ABSPATH ) & 0777 \| 0755 ) );
163	}
164
165	if ( ! defined( 'FS_CHMOD_FILE' ) ) {
166	define( 'FS_CHMOD_FILE', ( fileperms( ABSPATH . 'index.php' ) & 0777 \| 0644 ) );
167	}
168
169	// Define local variables.
170	$this->basename = plugin_basename( __FILE__ );
171	$this->url = plugin_dir_url( __FILE__ );
172	$names = explode( '/', $this->basename );
173	$this->name = $names[0];
174
175	// Define WP_CLI command.
176	if ( defined( 'WP_CLI' ) && WP_CLI && method_exists('\WP_CLI', 'add_command')) {
177	\WP_CLI::add_command( 'patchstack activate', [ $this, 'cli_activate' ] );
178	}
179	}
180
181	/**
182	* Call the constructor of all the Patchstack related classes.
183	*
184	* @return void
185	*/
186	public function plugin_classes() {
187	// Define the array of the classes.
188	foreach ( [
189	'admin_options' => 'P_Admin_Options',
190	'cron' => 'P_Cron',
191	'api' => 'P_Api',
192	'login' => 'P_Login',
193	'ban' => 'P_Ban',
194	'hardening' => 'P_Hardening',
195	'htaccess' => 'P_Htaccess',
196	'hacker_log' => 'P_Hacker_Log',
197	'upload' => 'P_Upload',
198	'rules' => 'P_Rules',
199	'hide_login' => 'P_Hide_Login',
200	'listener' => 'P_Listener',
201	'event_log' => 'P_Event_Log',
202	'activation' => 'P_Activation',
203	'multisite' => 'P_Multisite',
204	'notice' => 'P_Cookie_Notice',
205	'admin_ajax' => 'P_Admin_Ajax',
206	'admin_general' => 'P_Admin_General',
207	'admin_menu' => 'P_Admin_Menu',
208	] as $var => $class ) {
209	$this->$var = new $class( $this );
210	}
211
212	// Load firewall base functionality.
213	$this->firewall_base = new P_Firewall( true, $this, true );
214	}
215
216	/**
217	* Activate the plugin.
218	*
219	* @return void
220	*/
221	public function activate() {
222	$this->plugin_classes();
223	$this->activation->activate( $this );
224	}
225
226	/**
227	* Connects the Patchstack plugin to the API with the license id and secret key.
228	*
229	* Returns an error if the connection was not successful.
230	*
231	* ## OPTIONS
232	*
233	* [<id>]
234	* : The API client id.
235	*
236	* [<secret>]
237	* : The API secret key.
238	*
239	* <secret-id>
240	* : The API client id and secret key merged together, found in the App. E.g. 2b072e8b60402e30d481df351fc08183906254e0-123456
241	*
242	* ## EXAMPLES
243	*
244	* $ wp patchstack activate 123456 2b072e8b60402e30d481df351fc08183906254e0
245	* Success: The Patchstack plugin has been successfully connected.
246	*
247	* or
248	*
249	* $ wp patchstack activate 2b072e8b60402e30d481df351fc08183906254e0-123456
250	* Success: The Patchstack plugin has been successfully connected.
251	*/
252	public function cli_activate( $args ) {
253	// Handle both ways to activate the plugin.
254	if ( count( $args ) === 1 && strpos( $args[0], '-' ) !== false ) {
255	list( $secret, $id ) = explode( '-', $args[0] );
256	} else {
257	$id = isset( $args[0] ) ? trim( $args[0] ) : '';
258	$secret = isset( $args[1] ) ? trim( $args[1] ) : '';
259	}
260
261	$result = $this->activation->alter_license( $id, $secret, 'activate' );
262	if ( $result['result'] == 'error' ) {
263	\WP_CLI::error( 'The Patchstack plugin could not be connected. Make sure the id and secret key are valid and that api.patchstack.com is not blocked.' );
264	return;
265	}
266
267	\WP_CLI::success( 'The Patchstack plugin has been successfully connected.' );
268	}
269
270	/**
271	* Deactivate the plugin.
272	*
273	* @return void
274	*/
275	public function deactivate() {
276	$this->plugin_classes();
277	$this->activation->deactivate();
278	}
279
280	/**
281	* Boot Patchstack.
282	*
283	* @return void
284	*/
285	public function init() {
286	// Load translated strings for plugin.
287	load_plugin_textdomain( 'patchstack', false, dirname( $this->basename ) . '/languages/' );
288
289	// Initialize plugin classes.
290	$this->plugin_classes();
291
292	// Perform migrations if necessary.
293	$this->activation->migrate_check();
294
295	// If license expiration has not been fetched yet while the plugin is active, update it.
296	if ( get_option( 'patchstack_api_token', '' ) == '' && get_option( 'patchstack_license_expiry', '' ) == '' ) {
297	$this->api->update_license_status();
298	}
299
300	// Run firewall if not disabled and license activated.
301	if ( get_option( 'patchstack_license_activated', 0 ) == 1 && get_option( 'patchstack_basic_firewall', 0 ) == 1 && get_option( 'patchstack_license_free', 0 ) == 0 ) {
302	$this->firewall = new P_Firewall( true, $this );
303	}
304	}
305
306	/**
307	* Creates or returns an instance of this class.
308	*
309	* @return Patchstack
310	*/
311	public static function get_instance() {
312	if ( null === self::$single_instance ) {
313	self::$single_instance = new self();
314	}
315
316	return self::$single_instance;
317	}
318
319	/**
320	* Magic getter.
321	*
322	* @param string $field The field to magically get.
323	* @return mixed
324	*/
325	public function __get( $field ) {
326	switch ( $field ) {
327	case 'version':
328	return self::VERSION;
329	case 'api_url':
330	return self::API_URL;
331	case 'auth_url':
332	return self::AUTH_URL;
333	case 'client_id':
334	return self::CLIENT_ID;
335	case 'private_key':
336	return self::PRIVATE_KEY;
337	default:
338	try {
339	return $this->$field;
340	} catch ( \Exception $e ) {
341	return null;
342	}
343	}
344	}
345	}
346	}
347
348	if ( ! function_exists( 'patchstack_uninstall' ) ) {
349	/**
350	* Called when the plugin is uninstalled/removed from the site.
351	* This is not the same as deactivation, where the plugin still resides on the site.
352	*
353	* @return void
354	*/
355	function patchstack_uninstall() {
356	// Delete most of the Patchstack options.
357	$options = [ 'patchstack_eventlog_lastid', 'patchstack_api_token', 'patchstack_dashboardlock', 'patchstack_pluginedit', 'patchstack_move_logs', 'patchstack_userenum', 'patchstack_basicscanblock', 'patchstack_hidewpcontent', 'patchstack_hidewpversionk', 'patchstack_prevent_default_file_access', 'patchstack_basic_firewall', 'patchstack_known_blacklist', 'patchstack_block_debug_log_access', 'patchstack_block_fake_bots', 'patchstack_index_views', 'patchstack_proxy_comment_posting', 'patchstack_bad_query_strings', 'patchstack_advanced_character_string_filter', 'patchstack_advanced_blacklist_firewall', 'patchstack_forbid_rfi', 'patchstack_image_hotlinking', 'patchstack_add_security_headers', 'patchstack_firewall_log_lastid', 'patchstack_user_log_lastid', 'patchstack_captcha_public_key', 'patchstack_captcha_private_key', 'patchstack_scan_interval', 'patchstack_scan_day', 'patchstack_scan_time', 'patchstack_hackers_log', 'patchstack_users_log', 'patchstack_visitors_log', 'external_updates-webarx', 'patchstack_wp_stats', 'patchstack_captcha_login_form', 'patchstack_license_activated', 'patchstack_license_expiry', 'patchstack_software_data_hash', 'patchstack_mv_wp_login', 'patchstack_rename_wp_login', 'patchstack_googledrive_backup_is_running', 'patchstack_googledrive_upload_state', 'patchstack_googledrive_access_token', 'patchstack_googledrive_refresh_token', 'patchstack_cron_offset', 'patchstack_htaccess_rules_hash' ];
358	foreach ( $options as $option ) {
359	delete_option( $option );
360
361	if ( is_multisite() ) {
362	delete_site_option( $option );
363	}
364	}
365
366	// Drop all Patchstack tables.
367	global $wpdb;
368	$tables = [ 'patchstack_user_log', 'patchstack_visitor_log', 'patchstack_firewall_log', 'patchstack_file_hashes', 'patchstack_logic', 'patchstack_ip', 'patchstack_event_log' ];
369	foreach ( $tables as $table ) {
370	$wpdb->query( 'DROP TABLE IF EXISTS ' . $wpdb->prefix . $table );
371	}
372	}
373	}
374
375	if ( ! function_exists( 'patchstack' ) ) {
376	/**
377	* Grab the Patchstack object and return it.
378	*
379	* @return Patchstack
380	*/
381	function patchstack() {
382	return patchstack::get_instance();
383	}
384	}
385
386	// Kick it off.
387	add_action( 'plugins_loaded', [ patchstack(), 'init' ] );
388
389	// Activation and deactivation hooks.
390	register_activation_hook( __FILE__, [ patchstack(), 'activate' ] );
391	register_deactivation_hook( __FILE__, [ patchstack(), 'deactivate' ] );
392	register_uninstall_hook( __FILE__, 'patchstack_uninstall' );
393