PluginProbe
Patchstack – WordPress & Plugins Security / 2.3.2
Patchstack – WordPress & Plugins Security v2.3.2
2.3.7 trunk 2.1.0 2.1.1 2.1.10 2.1.11 2.1.12 2.1.13 2.1.14 2.1.15 2.1.16 2.1.17 2.1.18 2.1.19 2.1.2 2.1.20 2.1.21 2.1.22 2.1.23 2.1.24 2.1.25 2.1.3 2.1.4 2.1.5 2.1.6 All 49 releases
← All changes | includes/upload.php +14 -28 trunk2.3.2 View file →
@@ -55,9 +55,9 @@
55 55 return;
56 56 }
57 57
58 58 // Make sure to not keep calling this function.
59 - update_option( 'patchstack_software_upload_attempted', 1 );
59 + update_option( 'patchstack_software_upload_attempted', true );
60 60
61 61 // Synchronize the software list with the API.
62 62 $results = $this->plugin->api->upload_software( [ 'software' => json_encode( $data ) ] );
63 63 if ( isset( $results['success'] ) ) {
@@ -115,9 +115,9 @@
115 115 if ( get_option( 'patchstack_firewall_log_processing', false ) ) {
116 116 return;
117 117 }
118 118
119 - update_option( 'patchstack_firewall_log_processing', 1 );
119 + update_option( 'patchstack_firewall_log_processing', true );
120 120
121 121 // Attempt to fetch data, if any.
122 122 $lastId = get_option( 'patchstack_firewall_log_lastid', 0 );
123 123 $successId = $lastId;
@@ -140,17 +140,14 @@
140 140
141 141 // Construct the array to be uploaded to our API.
142 142 $logs = [];
143 143 foreach ( $items as $item ) {
144 -
145 - // Always advance the cursor so filtered rows don't stall the batch.
146 - $lastId = $item->id;
147 -
144 +
148 145 // Entries that we don't want to store on the API side.
149 146 if ( stripos( $item->request_uri, 'wp-comments-post' ) !== false ) {
150 147 continue;
151 148 }
152 -
149 +
153 150 // Push to entries to be uploaded.
154 151 $logs[] = [
155 152 'ip' => $item->ip,
156 153 'fid' => $item->fid,
@@ -159,8 +156,10 @@
159 156 'method' => $item->method,
160 157 'log_date' => $item->log_date,
161 158 'post_data' => $item->post_data,
162 159 ];
160 +
161 + $lastId = $item->id;
163 162 }
164 163
165 164 // JSON encode the logs and upload.
166 165 $logs = json_encode( $logs );
@@ -170,11 +169,9 @@
170 169 'type' => 'firewall',
171 170 ]
172 171 );
173 172
174 - // A failed upload returns a status code or null instead of an array;
175 - // bail without advancing so the logs are not deleted before they reach the API.
176 - if ( ! is_array( $results ) || isset( $results['errors'] ) ) {
173 + if ( isset( $results['errors'] ) ) {
177 174 update_option( 'patchstack_firewall_log_lastid', $successId );
178 175 break;
179 176 }
180 177
@@ -185,9 +182,9 @@
185 182 // Delete the logs.
186 183 $wpdb->query( 'DELETE FROM ' . $wpdb->prefix . 'patchstack_firewall_log WHERE id <= ' . (int) $successId );
187 184
188 185 // No longer processing.
189 - update_option( 'patchstack_firewall_log_processing', 0 );
186 + update_option( 'patchstack_firewall_log_processing', false );
190 187 }
191 188
192 189 /**
193 190 * Synchronize the activity logs with our API.
@@ -206,9 +203,9 @@
206 203 if ( get_option( 'patchstack_eventlog_processing', false ) ) {
207 204 return;
208 205 }
209 206
210 - update_option( 'patchstack_eventlog_processing', 1 );
207 + update_option( 'patchstack_eventlog_processing', true );
211 208
212 209 // Determine if we should upload failed logins to the app.
213 210 $where = " AND action != 'failed login' ";
214 211 if ( $this->get_option( 'patchstack_activity_log_failed_logins_db', 0 ) == 1 ) {
@@ -241,12 +238,9 @@
241 238
242 239 // Send to the API.
243 240 $logs = json_encode( $items );
244 241 $results = $this->plugin->api->upload_activity_logs( [ 'logs' => $logs ] );
245 -
246 - // A failed upload returns a status code or null instead of an array;
247 - // bail without advancing so the logs are not deleted before they reach the API.
248 - if ( ! is_array( $results ) || isset( $results['errors'] ) ) {
242 + if ( isset( $results['errors'] ) ) {
249 243 update_option( 'patchstack_eventlog_lastid', $successId );
250 244 break;
251 245 }
252 246
@@ -257,9 +251,9 @@
257 251 // Delete the logs.
258 252 $wpdb->query( 'DELETE FROM ' . $wpdb->prefix . 'patchstack_event_log WHERE id <= ' . (int) $successId );
259 253
260 254 // No longer processing.
261 - update_option( 'patchstack_eventlog_processing', 0 );
255 + update_option( 'patchstack_eventlog_processing', false );
262 256 }
263 257
264 258 /**
265 259 * Obtain information about the software that the user has installed.
@@ -370,9 +364,8 @@
370 364 'sw_new_ver' => ''
371 365 ];
372 366 }
373 367
374 - $software_list = apply_filters( 'patchstack_get_software_data', $software_list );
375 368 return $software_list;
376 369 }
377 370
378 371 /**
@@ -390,8 +383,10 @@
390 383 if ( get_option( 'patchstack_firewall_log_ap_processing', false ) ) {
391 384 return;
392 385 }
393 386
387 + update_option( 'patchstack_firewall_log_ap_processing', true );
388 +
394 389 // Attempt to load config file.
395 390 $logs = __DIR__ . '/../../../pslogs/logs.php';
396 391 if ( ! file_exists( $logs ) ) {
397 392 return;
@@ -401,12 +396,8 @@
401 396 if ( ! file_exists( __DIR__ . '/../lib/patchstack/vendor/autoload.php' ) ) {
402 397 return;
403 398 }
404 399
405 - // Set the processing lock only once we know there is work to do, otherwise an
406 - // early return above would leave the lock stuck and block all future imports.
407 - update_option( 'patchstack_firewall_log_ap_processing', 1 );
408 -
409 400 global $wpdb;
410 401
411 402 require_once __DIR__ . '/../lib/patchstack/vendor/autoload.php';
412 403 $extension = new Patchstack\Extensions\WordPress\Extension( [], $this );
@@ -428,13 +419,8 @@
428 419 if ( ! $data || ! is_array( $data ) ) {
429 420 continue;
430 421 }
431 422
432 - // Skip malformed entries that are missing the fields we rely on below.
433 - if ( ! isset( $data['site_id'], $data['ip'], $data['request_uri'], $data['user_agent'], $data['method'], $data['fid'], $data['post_data'] ) ) {
434 - continue;
435 - }
436 -
437 423 // Insert into the logs.
438 424 $wpdb->insert(
439 425 $wpdb->get_blog_prefix( $data['site_id'] ) . 'patchstack_firewall_log',
440 426 [
@@ -461,7 +447,7 @@
461 447 $file = null;
462 448 file_put_contents( $logs, '<?php exit; ?>' . PHP_EOL );
463 449
464 450 // Update processing state.
465 - update_option( 'patchstack_firewall_log_ap_processing', 0 );
451 + update_option( 'patchstack_firewall_log_ap_processing', false );
466 452 }
467 453 }