patchstack / patchstack.php

patchstack.php in Patchstack – WordPress & Plugins Security 2.3.3, at patchstack.php

412 lines 11.1 KB

Raw Download Zip

1	<?php
2	/**
3	* Plugin Name: Patchstack Security
4	* Plugin URI: https://patchstack.com/?utm_medium=wp&utm_source=dashboard&utm_campaign=patchstack%20plugin
5	* Author URI: https://patchstack.com/?utm_medium=wp&utm_source=dashboard&utm_campaign=patchstack%20plugin
6	* Description: Patchstack identifies security vulnerabilities in WordPress plugins, themes, and core.
7	* Version: 2.3.3
8	* Author: Patchstack
9	* License: GPLv3
10	* Text Domain: patchstack
11	* Domain Path: /languages
12	* Requires at least: 4.4
13	* Requires PHP: 5.6
14	*/
15
16	// Do not allow the file to be called directly.
17	if ( ! defined( 'ABSPATH' ) ) {
18	exit;
19	}
20
21	if ( ! function_exists( 'patchstack_autoload_classes' ) ) {
22	/**
23	* Autoloads the Patchstack classes when called.
24	*
25	* @param string $class_name The class name to autoload.
26	* @return void
27	*/
28	function patchstack_autoload_classes( $class_name ) {
29	// If the requested class doesn't have our prefix, don't load it.
30	if ( strpos( $class_name, 'P_' ) !== 0 ) {
31	return;
32	}
33
34	// Set up our filename.
35	$file_name = strtolower( str_replace( '_', '-', substr( $class_name, strlen( 'P_' ) ) ) );
36	$dir = trailingslashit( dirname( __FILE__ ) ) . 'includes/';
37	$target = [ $dir . $file_name . '.php', $dir . 'admin/' . str_replace( 'admin-', '', $file_name ) . '.php' ];
38
39	// Attempt each target and load if it exists.
40	foreach ( $target as $file ) {
41	if ( file_exists( $file ) ) {
42	include_once $file;
43	}
44	}
45	}
46	}
47	spl_autoload_register( 'patchstack_autoload_classes' );
48
49	if ( ! class_exists( 'patchstack' ) ) {
50
51	/**
52	* This is the main Patchstack class used for all Patchstack related features and to launch
53	* the Patchstack plugin.
54	*/
55	class Patchstack {
56
57	/**
58	* The plugin version.
59	*
60	* @var string
61	*/
62	const VERSION = '2.3.3';
63
64	/**
65	* API URL of Patchstack to communicate with.
66	*
67	* @var string
68	*/
69	const API_URL = 'https://api.patchstack.com';
70
71	/**
72	* API Auth URL of Patchstack to communicate with.
73	*
74	* @var string
75	*/
76	const AUTH_URL = 'https://auth.patchstack.com';
77
78	/**
79	* Client ID, this is only set when freshly downloaded from the app.
80	*
81	* @var string
82	*/
83	const CLIENT_ID = 'PATCHSTACK_CLIENT_ID';
84
85	/**
86	* Client private key, this is only set when freshly downloaded from the app.
87	*
88	* @var string
89	*/
90	const PRIVATE_KEY = 'PATCHSTACK_PRIVATE_KEY';
91
92	/**
93	* URL of the plugin directory.
94	*
95	* @var string
96	*/
97	protected $url = '';
98
99	/**
100	* Plugin basename.
101	*
102	* @var string
103	*/
104	protected $basename = '';
105
106	/**
107	* Plugin name.
108	*
109	* @var string
110	*/
111	protected $name = '';
112
113	/**
114	* Detailed activation error messages.
115	*
116	* @var array
117	*/
118	protected $activation_errors = [];
119
120	/**
121	* Singleton instance of plugin.
122	*
123	* @var Patchstack
124	*/
125	protected static $single_instance = null;
126
127	/**
128	* Define all the variables that will hold the Patchstack classes.
129	* These must be defined because it allows us to communicate from one class to the other.
130	*/
131	protected $firewall;
132	protected $firewall_base;
133	protected $activation;
134	protected $cron;
135	protected $api;
136	protected $login;
137	protected $ban;
138	protected $hardening;
139	protected $htaccess;
140	protected $hacker_log;
141	protected $upload;
142	protected $rules;
143	protected $hide_login;
144	protected $listener;
145	protected $event_log;
146	protected $multisite;
147	protected $admin_ajax;
148	protected $admin_general;
149	protected $admin_menu;
150	protected $admin_options;
151
152	/**
153	* Setup a few base variables for the plugin.
154	* Also make sure certain constants are defined.
155	*
156	* @return void
157	*/
158	protected function __construct() {
159	// Set the permission constants if not already set.
160	if ( ! defined( 'FS_CHMOD_DIR' ) ) {
161	define( 'FS_CHMOD_DIR', ( fileperms( ABSPATH ) & 0777 \| 0755 ) );
162	}
163
164	if ( ! defined( 'FS_CHMOD_FILE' ) ) {
165	define( 'FS_CHMOD_FILE', ( fileperms( ABSPATH . 'index.php' ) & 0777 \| 0644 ) );
166	}
167
168	// Define local variables.
169	$this->basename = plugin_basename( __FILE__ );
170	$this->url = plugin_dir_url( __FILE__ );
171	$names = explode( '/', $this->basename );
172	$this->name = $names[0];
173
174	// Define WP_CLI command.
175	if ( defined( 'WP_CLI' ) && WP_CLI && method_exists('\WP_CLI', 'add_command')) {
176	\WP_CLI::add_command( 'patchstack activate', [ $this, 'cli_activate' ] );
177	}
178	}
179
180	/**
181	* Call the constructor of all the Patchstack related classes.
182	*
183	* @return void
184	*/
185	public function plugin_classes() {
186	// Define the array of the classes.
187	foreach ( [
188	'admin_options' => 'P_Admin_Options',
189	'cron' => 'P_Cron',
190	'api' => 'P_Api',
191	'login' => 'P_Login',
192	'ban' => 'P_Ban',
193	'hardening' => 'P_Hardening',
194	'htaccess' => 'P_Htaccess',
195	'hacker_log' => 'P_Hacker_Log',
196	'upload' => 'P_Upload',
197	'rules' => 'P_Rules',
198	'hide_login' => 'P_Hide_Login',
199	'event_log' => 'P_Event_Log',
200	'activation' => 'P_Activation',
201	'listener' => 'P_Listener',
202	'multisite' => 'P_Multisite',
203	'admin_ajax' => 'P_Admin_Ajax',
204	'admin_general' => 'P_Admin_General',
205	'admin_menu' => 'P_Admin_Menu',
206	] as $var => $class ) {
207	$this->$var = new $class( $this );
208	}
209
210	// Load firewall base functionality.
211	$this->firewall_base = new P_Firewall( true, $this, true );
212	}
213
214	/**
215	* Activate the plugin.
216	*
217	* @return void
218	*/
219	public function activate() {
220	$this->plugin_classes();
221	$this->activation->activate( $this );
222	}
223
224	/**
225	* Connects the Patchstack plugin to the API with the license id and secret key.
226	*
227	* Returns an error if the connection was not successful.
228	*
229	* ## OPTIONS
230	*
231	* [<id>]
232	* : The API client id.
233	*
234	* [<secret>]
235	* : The API secret key.
236	*
237	* <secret-id>
238	* : The API client id and secret key merged together, found in the App. E.g. 2b072e8b60402e30d481df351fc08183906254e0-123456
239	*
240	* ## EXAMPLES
241	*
242	* $ wp patchstack activate 123456 2b072e8b60402e30d481df351fc08183906254e0
243	* Success: The Patchstack plugin has been successfully connected.
244	*
245	* or
246	*
247	* $ wp patchstack activate 2b072e8b60402e30d481df351fc08183906254e0-123456
248	* Success: The Patchstack plugin has been successfully connected.
249	*/
250	public function cli_activate( $args ) {
251	// Handle both ways to activate the plugin.
252	if ( count( $args ) === 1 && strpos( $args[0], '-' ) !== false ) {
253	list( $secret, $id ) = explode( '-', $args[0] );
254	} else {
255	$id = isset( $args[0] ) ? trim( $args[0] ) : '';
256	$secret = isset( $args[1] ) ? trim( $args[1] ) : '';
257	}
258
259	$result = $this->activation->alter_license( $id, $secret, 'activate' );
260	if ( $result['result'] == 'error' ) {
261	\WP_CLI::error( "The Patchstack plugin could not be connected. Make sure the id and secret key are valid and that api.patchstack.com is not blocked. Additional information:\n" . $result['body'] );
262	return;
263	}
264
265	\WP_CLI::success( 'The Patchstack plugin has been successfully connected.' );
266	}
267
268	/**
269	* Deactivate the plugin.
270	*
271	* @return void
272	*/
273	public function deactivate() {
274	$this->plugin_classes();
275	$this->activation->deactivate();
276	}
277
278	/**
279	* Load translated strings for the plugin.
280	*
281	* @return void
282	*/
283	public function load_textdomain () {
284	load_plugin_textdomain( 'patchstack', false, dirname( $this->basename ) . '/languages/' );
285	}
286
287	/**
288	* Boot Patchstack.
289	*
290	* @return void
291	*/
292	public function init() {
293	add_action( 'init', [ $this, 'load_textdomain' ] );
294
295	// Initialize plugin classes.
296	$this->plugin_classes();
297
298	// Perform migrations if necessary.
299	$this->activation->migrate_check();
300
301	// If license expiration has not been fetched yet while the plugin is active, update it.
302	if ( get_option( 'patchstack_api_token', '' ) == '' && get_option( 'patchstack_license_expiry', '' ) == '' ) {
303	$this->api->update_license_status();
304	}
305
306	// Run firewall if not disabled and license activated.
307	if ( get_option( 'patchstack_license_activated', 0 ) == 1 && get_option( 'patchstack_basic_firewall', 0 ) == 1 && get_option( 'patchstack_license_free', 0 ) == 0 ) {
308	$this->firewall = new P_Firewall( true, $this );
309	}
310	}
311
312	/**
313	* Creates or returns an instance of this class.
314	*
315	* @return Patchstack
316	*/
317	public static function get_instance() {
318	if ( null === self::$single_instance ) {
319	self::$single_instance = new self();
320	}
321
322	return self::$single_instance;
323	}
324
325	/**
326	* Magic getter.
327	*
328	* @param string $field The field to magically get.
329	* @return mixed
330	*/
331	public function __get( $field ) {
332	switch ( $field ) {
333	case 'version':
334	return self::VERSION;
335	case 'api_url':
336	return self::API_URL;
337	case 'auth_url':
338	return self::AUTH_URL;
339	case 'client_id':
340	return self::CLIENT_ID;
341	case 'private_key':
342	return self::PRIVATE_KEY;
343	default:
344	try {
345	return $this->$field;
346	} catch ( \Exception $e ) {
347	return null;
348	}
349	}
350	}
351	}
352	}
353
354	if ( ! function_exists( 'patchstack_uninstall' ) ) {
355	/**
356	* Called when the plugin is uninstalled/removed from the site.
357	* This is not the same as deactivation, where the plugin still resides on the site.
358	*
359	* @return void
360	*/
361	function patchstack_uninstall() {
362	// Delete most of the Patchstack options.
363	global $wpdb;
364	$options = $wpdb->get_results( "SELECT option_name FROM $wpdb->options WHERE option_name LIKE 'patchstack_%'" );
365
366	// Few options we want to keep.
367	$keep = ['patchstack_hits_last_30', 'patchstack_hits_all_time', 'patchstack_clientid', 'patchstack_secretkey', 'patchstack_secretkey_nonce', 'patchstack_api_token'];
368
369	// Delete everything else.
370	foreach( $options as $option ) {
371	if ( in_array( $option->option_name, $keep ) \|\| stripos( $option->option_name, 'patchstack_captcha_' ) !== false ) {
372	continue;
373	}
374
375	delete_option( $option->option_name );
376
377	if ( is_multisite() ) {
378	delete_site_option( $option->option_name );
379	}
380	}
381
382	// Drop all tables.
383	global $wpdb;
384	$prefixes = ['patchstack_', 'webarx_'];
385	foreach ( $prefixes as $prefix ) {
386	$tables = [ 'user_log', 'visitor_log', 'firewall_log', 'file_hashes', 'logic', 'ip', 'event_log' ];
387	foreach ( $tables as $table ) {
388	$wpdb->query( 'DROP TABLE IF EXISTS ' . $wpdb->prefix . $prefix . $table );
389	}
390	}
391	}
392	}
393
394	if ( ! function_exists( 'patchstack' ) ) {
395	/**
396	* Grab the Patchstack object and return it.
397	*
398	* @return Patchstack
399	*/
400	function patchstack() {
401	return patchstack::get_instance();
402	}
403	}
404
405	// Kick it off.
406	add_action( 'plugins_loaded', [ patchstack(), 'init' ] );
407
408	// Activation and deactivation hooks.
409	register_activation_hook( __FILE__, [ patchstack(), 'activate' ] );
410	register_deactivation_hook( __FILE__, [ patchstack(), 'deactivate' ] );
411	register_uninstall_hook( __FILE__, 'patchstack_uninstall' );
412