patchstack / lib / patchstack / src / Extensions / WordPress / ExtensionAP.php

ExtensionAP.php in Patchstack – WordPress & Plugins Security 2.3.7, at lib/patchstack/src/Extensions/WordPress/ExtensionAP.php

167 lines 4.8 KB

Raw Download Zip

1	<?php
2
3	namespace Patchstack\Extensions\WordPress;
4
5	use Patchstack\Extensions\ExtensionInterface;
6
7	class ExtensionAP implements ExtensionInterface
8	{
9	/**
10	* WordPress specific options that we need to remember.
11	*
12	* @var array
13	*/
14	public $options = [
15	'patchstack_firewall_ip_header' => 'REMOTE_ADDR'
16	];
17
18	/**
19	* Creates a new extension instance.
20	*/
21	public function __construct($options)
22	{
23	$this->options = array_merge($this->options, $options);
24	}
25
26	/**
27	* Log the HTTP request.
28	*
29	* @param int $ruleId
30	* @param array $request
31	* @param string $logType
32	* @return void
33	*/
34	public function logRequest($ruleId, $request, $logType = 'BLOCK')
35	{
36	// Transform raw payload.
37	if (is_array($request) && array_key_exists('raw', $request)) {
38	$request['raw'] = isset($request['raw']) && is_array($request['raw']) ? $request['raw'][0] : $request['raw'];
39
40	// Remove raw payload if not present.
41	if ((is_array($request['raw']) && count($request['raw']) == 0) \|\| empty($request['raw'])) {
42	unset($request['raw']);
43	}
44	}
45
46	// Remove files payload if not present.
47	if (isset($request['files']) && is_array($request['files']) && count($request['files']) == 0) {
48	unset($request['files']);
49	}
50
51	// Remove post payload if not present.
52	if (isset($request['post']) && is_array($request['post']) && count($request['post']) == 0) {
53	unset($request['post']);
54	}
55
56	if (!defined('PS_LOGS')) {
57	return;
58	}
59
60	@file_put_contents(PS_LOGS . 'logs.php', base64_encode(json_encode([
61	'ip' => $this->getIpAddress(),
62	'request_uri' => isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '',
63	'user_agent' => isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '',
64	'method' => isset($_SERVER['REQUEST_METHOD']) ? $_SERVER['REQUEST_METHOD'] : '',
65	'fid' => '55' . $ruleId,
66	'post_data' => json_encode($request),
67	'site_id' => $this->options['site_id'],
68	'log_date' => date('Y-m-d H:i:s')
69	])) . PHP_EOL, FILE_APPEND \| LOCK_EX);
70	}
71
72	/**
73	* Determine if the current visitor can bypass the firewall.
74	* If $isMuCall is true, we MUST avoid any function calls that checks the current authorization of the user,
75	* this includes current_user_can. Otherwise, a fatal error is thrown.
76	*
77	* @param bool $isMuCall
78	* @return bool
79	*/
80	public function canBypass($isMuCall)
81	{
82	return false;
83	}
84
85	/**
86	* Determine if the visitor is blocked from the website.
87	*
88	* @param int $minutes
89	* @param int $blockTime
90	* @param int $attempts
91	* @return bool
92	*/
93	public function isBlocked($minutes, $blockTime, $attempts)
94	{
95	return false;
96	}
97
98	/**
99	* The response to return when a request has been blocked.
100	*
101	* @param int $fid
102	* @return void
103	*/
104	public function forceExit($fid)
105	{
106	header( 'HTTP/1.0 403 Forbidden' );
107	header( 'X-Content-Type-Options: nosniff' );
108	header( 'Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private' );
109	header( 'Expires: Wed, 11 Jan 1984 05:00:00 GMT' );
110
111	// Supported by a number of popular caching plugins.
112	if (!defined( 'DONOTCACHEPAGE')) {
113	define('DONOTCACHEPAGE', true);
114	}
115
116	include_once PS_PATH . 'includes/views/access-denied-ap.php';
117	exit;
118	}
119
120	/**
121	* Get the IP address of the request.
122	*
123	* @return string
124	*/
125	public function getIpAddress()
126	{
127	if (isset($_SERVER[$this->options['patchstack_firewall_ip_header']])) {
128	return $_SERVER[$this->options['patchstack_firewall_ip_header']];
129	}
130
131	return $_SERVER['REMOTE_ADDR'];
132	}
133
134	/**
135	* Get the hostname of the environment.
136	* This is only used for open redirect vulnerabilities.
137	*
138	* @return string
139	*/
140	public function getHostName()
141	{
142	return $_SERVER['HTTP_HOST'];
143	}
144
145	/**
146	* Determine if the request is whitelisted.
147	*
148	* @param array $whitelistRules
149	* @param array $request
150	* @return boolean
151	*/
152	public function isWhitelisted($whitelistRules, $request)
153	{
154	return false;
155	}
156
157	/**
158	* Determine if the current request is a file upload request.
159	*
160	* @return boolean
161	*/
162	public function isFileUploadRequest()
163	{
164	return isset($_FILES) && count($_FILES) > 0;
165	}
166	}
167