patchstack / includes / rules.php

rules.php in Patchstack – WordPress & Plugins Security 2.3.4, at includes/rules.php

132 lines 3.7 KB

Raw Download Zip

1	<?php
2
3	// Do not allow the file to be called directly.
4	if ( ! defined( 'ABSPATH' ) ) {
5	exit;
6	}
7
8	/**
9	* This class is used to pull the firewall/whitelist rules from our API.
10	*/
11	class P_Rules extends P_Core {
12
13	/**
14	* Add the actions required to pull the rules.
15	*
16	* @param Patchstack $core
17	* @return void
18	*/
19	public function __construct( $core ) {
20	parent::__construct( $core );
21	add_action( 'patchstack_post_firewall_rules', [ $this, 'post_firewall_rules' ] );
22	add_action( 'patchstack_post_dynamic_firewall_rules', [ $this, 'dynamic_firewall_rules' ] );
23	}
24
25	/**
26	* Pull the hardening .htaccess rules from the API.
27	* Then apply it to the .htaccess file after we create a backup.
28	*
29	* @return void
30	*/
31	public function post_firewall_rules() {
32	if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
33	return;
34	}
35
36	$rules = $this->plugin->htaccess->get_firewall_rule_settings();
37	$settings = json_encode( $rules );
38	$results = $this->plugin->api->post_firewall_rule( [ 'settings' => $settings ] );
39
40	// If no rules returned, we assume all settings are turned off.
41	if ( empty( $results ) ) {
42	$results['rules'] = '';
43	}
44
45	// We have rules so apply it to the .htaccess file.
46	if ( isset( $results['rules'] ) ) {
47	$this->plugin->htaccess->write_to_htaccess( $results['rules'] );
48	return;
49	}
50	}
51
52	/**
53	* Pull the firewall/whitelist rules from the API.
54	*
55	* @return void
56	*/
57	public function dynamic_firewall_rules() {
58	if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
59	return;
60	}
61
62	// Get the firewall and whitelist rules.
63	$results = $this->plugin->api->post_firewall_rule_json();
64	if ( ! isset( $results['firewall'] ) ) {
65	return;
66	}
67
68	// Separate the new firewall engine rules from the old ones.
69	$newRules = [];
70	$newRulesAP = [];
71	$oldRules = [];
72
73	// Counters for displaying purposes on the API key page.
74	$vPatchCount = 0;
75	$ruleCount = 0;
76
77	// Parse the rules.
78	foreach ( $results['firewall'] as $rule ) {
79	if ( isset( $rule['rule_v2'] ) ) {
80	$rule['rules'] = $rule['rule_v2'];
81	unset( $rule['rule_v2'] );
82
83	// Mark vPatches based on substring.
84	if ( stripos( $rule['title'], ' vulnerabilit' ) !== false && stripos( $rule['title'], 'block ' ) !== false ) {
85	$vPatchCount++;
86	} else {
87	$ruleCount++;
88	}
89
90	// Differentiate between auto prepend rules and regular ones.
91	if ( isset( $rule['ap'] ) && !empty( $rule['ap'] ) ) {
92	$newRulesAP[] = $rule;
93	} else {
94	$newRules[] = $rule;
95	}
96	} else {
97	$ruleCount++;
98	$oldRules[] = $rule;
99	}
100	}
101
102	// Update firewall rules.
103	update_option( 'patchstack_firewall_rules', json_encode( $oldRules ), true );
104	update_option( 'patchstack_firewall_rules_v3', json_encode( $newRules ), true );
105	update_option( 'patchstack_firewall_rules_v3_ap', json_encode( $newRulesAP ), true );
106
107	// Update the counters.
108	update_option( 'patchstack_vpatches_present', $vPatchCount );
109	update_option( 'patchstack_non_vpatches_present', $ruleCount );
110
111	// Separate the new firewall engine rules from the old ones.
112	$newRules = [];
113	$oldRules = [];
114	foreach ( $results['whitelists'] as $rule ) {
115	if ( isset( $rule['rule_v2'] ) ) {
116	$rule['rules'] = $rule['rule_v2'];
117	unset( $rule['rule_v2'] );
118	$newRules[] = $rule;
119	} else {
120	$oldRules[] = $rule;
121	}
122	}
123
124	// Update whitelist rules.
125	update_option( 'patchstack_whitelist_rules', json_encode( $oldRules ), true );
126	update_option( 'patchstack_whitelist_rules_v3', json_encode( $newRules ), true );
127
128	// Update the whitelisted keys.
129	update_option( 'patchstack_whitelist_keys_rules', json_encode( $results['whitelist_keys'] ), true );
130	}
131	}
132