PluginProbe
Patchstack – WordPress & Plugins Security / 2.3.6
Patchstack – WordPress & Plugins Security v2.3.6
2.3.7 trunk 2.1.0 2.1.1 2.1.10 2.1.11 2.1.12 2.1.13 2.1.14 2.1.15 2.1.16 2.1.17 2.1.18 2.1.19 2.1.2 2.1.20 2.1.21 2.1.22 2.1.23 2.1.24 2.1.25 2.1.3 2.1.4 2.1.5 2.1.6 All 49 releases
← All changes | includes/upload.php +14 -27 trunk2.3.6 View file →
@@ -55,9 +55,9 @@
55 55 return;
56 56 }
57 57
58 58 // Make sure to not keep calling this function.
59 - update_option( 'patchstack_software_upload_attempted', 1 );
59 + update_option( 'patchstack_software_upload_attempted', true );
60 60
61 61 // Synchronize the software list with the API.
62 62 $results = $this->plugin->api->upload_software( [ 'software' => json_encode( $data ) ] );
63 63 if ( isset( $results['success'] ) ) {
@@ -115,9 +115,9 @@
115 115 if ( get_option( 'patchstack_firewall_log_processing', false ) ) {
116 116 return;
117 117 }
118 118
119 - update_option( 'patchstack_firewall_log_processing', 1 );
119 + update_option( 'patchstack_firewall_log_processing', true );
120 120
121 121 // Attempt to fetch data, if any.
122 122 $lastId = get_option( 'patchstack_firewall_log_lastid', 0 );
123 123 $successId = $lastId;
@@ -140,17 +140,14 @@
140 140
141 141 // Construct the array to be uploaded to our API.
142 142 $logs = [];
143 143 foreach ( $items as $item ) {
144 -
145 - // Always advance the cursor so filtered rows don't stall the batch.
146 - $lastId = $item->id;
147 -
144 +
148 145 // Entries that we don't want to store on the API side.
149 146 if ( stripos( $item->request_uri, 'wp-comments-post' ) !== false ) {
150 147 continue;
151 148 }
152 -
149 +
153 150 // Push to entries to be uploaded.
154 151 $logs[] = [
155 152 'ip' => $item->ip,
156 153 'fid' => $item->fid,
@@ -159,8 +156,10 @@
159 156 'method' => $item->method,
160 157 'log_date' => $item->log_date,
161 158 'post_data' => $item->post_data,
162 159 ];
160 +
161 + $lastId = $item->id;
163 162 }
164 163
165 164 // JSON encode the logs and upload.
166 165 $logs = json_encode( $logs );
@@ -170,11 +169,9 @@
170 169 'type' => 'firewall',
171 170 ]
172 171 );
173 172
174 - // A failed upload returns a status code or null instead of an array;
175 - // bail without advancing so the logs are not deleted before they reach the API.
176 - if ( ! is_array( $results ) || isset( $results['errors'] ) ) {
173 + if ( isset( $results['errors'] ) ) {
177 174 update_option( 'patchstack_firewall_log_lastid', $successId );
178 175 break;
179 176 }
180 177
@@ -185,9 +182,9 @@
185 182 // Delete the logs.
186 183 $wpdb->query( 'DELETE FROM ' . $wpdb->prefix . 'patchstack_firewall_log WHERE id <= ' . (int) $successId );
187 184
188 185 // No longer processing.
189 - update_option( 'patchstack_firewall_log_processing', 0 );
186 + update_option( 'patchstack_firewall_log_processing', false );
190 187 }
191 188
192 189 /**
193 190 * Synchronize the activity logs with our API.
@@ -206,9 +203,9 @@
206 203 if ( get_option( 'patchstack_eventlog_processing', false ) ) {
207 204 return;
208 205 }
209 206
210 - update_option( 'patchstack_eventlog_processing', 1 );
207 + update_option( 'patchstack_eventlog_processing', true );
211 208
212 209 // Determine if we should upload failed logins to the app.
213 210 $where = " AND action != 'failed login' ";
214 211 if ( $this->get_option( 'patchstack_activity_log_failed_logins_db', 0 ) == 1 ) {
@@ -241,12 +238,9 @@
241 238
242 239 // Send to the API.
243 240 $logs = json_encode( $items );
244 241 $results = $this->plugin->api->upload_activity_logs( [ 'logs' => $logs ] );
245 -
246 - // A failed upload returns a status code or null instead of an array;
247 - // bail without advancing so the logs are not deleted before they reach the API.
248 - if ( ! is_array( $results ) || isset( $results['errors'] ) ) {
242 + if ( isset( $results['errors'] ) ) {
249 243 update_option( 'patchstack_eventlog_lastid', $successId );
250 244 break;
251 245 }
252 246
@@ -257,9 +251,9 @@
257 251 // Delete the logs.
258 252 $wpdb->query( 'DELETE FROM ' . $wpdb->prefix . 'patchstack_event_log WHERE id <= ' . (int) $successId );
259 253
260 254 // No longer processing.
261 - update_option( 'patchstack_eventlog_processing', 0 );
255 + update_option( 'patchstack_eventlog_processing', false );
262 256 }
263 257
264 258 /**
265 259 * Obtain information about the software that the user has installed.
@@ -390,8 +384,10 @@
390 384 if ( get_option( 'patchstack_firewall_log_ap_processing', false ) ) {
391 385 return;
392 386 }
393 387
388 + update_option( 'patchstack_firewall_log_ap_processing', true );
389 +
394 390 // Attempt to load config file.
395 391 $logs = __DIR__ . '/../../../pslogs/logs.php';
396 392 if ( ! file_exists( $logs ) ) {
397 393 return;
@@ -401,12 +397,8 @@
401 397 if ( ! file_exists( __DIR__ . '/../lib/patchstack/vendor/autoload.php' ) ) {
402 398 return;
403 399 }
404 400
405 - // Set the processing lock only once we know there is work to do, otherwise an
406 - // early return above would leave the lock stuck and block all future imports.
407 - update_option( 'patchstack_firewall_log_ap_processing', 1 );
408 -
409 401 global $wpdb;
410 402
411 403 require_once __DIR__ . '/../lib/patchstack/vendor/autoload.php';
412 404 $extension = new Patchstack\Extensions\WordPress\Extension( [], $this );
@@ -428,13 +420,8 @@
428 420 if ( ! $data || ! is_array( $data ) ) {
429 421 continue;
430 422 }
431 423
432 - // Skip malformed entries that are missing the fields we rely on below.
433 - if ( ! isset( $data['site_id'], $data['ip'], $data['request_uri'], $data['user_agent'], $data['method'], $data['fid'], $data['post_data'] ) ) {
434 - continue;
435 - }
436 -
437 424 // Insert into the logs.
438 425 $wpdb->insert(
439 426 $wpdb->get_blog_prefix( $data['site_id'] ) . 'patchstack_firewall_log',
440 427 [
@@ -461,7 +448,7 @@
461 448 $file = null;
462 449 file_put_contents( $logs, '<?php exit; ?>' . PHP_EOL );
463 450
464 451 // Update processing state.
465 - update_option( 'patchstack_firewall_log_ap_processing', 0 );
452 + update_option( 'patchstack_firewall_log_ap_processing', false );
466 453 }
467 454 }