vigilante / includes / class-backup-manager.php

class-backup-manager.php in Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… 2.11.8, at includes/class-backup-manager.php

335 lines 12.0 KB

Raw Download Zip

1	<?php
2	/**
3	* Backup Manager Class
4	*
5	* Builds the downloadable archive of the configuration files, and cleans up
6	* the copies of those files that earlier versions kept: on disk under the web
7	* root until 2.7.0, and in the options table until 2.11.6.
8	*
9	* @package Vigilante
10	*/
11
12	// Prevent direct access
13	if ( ! defined( 'ABSPATH' ) ) {
14	exit;
15	}
16
17	/**
18	* Class Vigilante_Backup_Manager
19	*
20	* Configuration file archive and cleanup of stored copies.
21	*/
22	class Vigilante_Backup_Manager {
23
24	/**
25	* Option recording that the stored copies are gone
26	*
27	* 1 once this site is clean, 2 once the walk over the network has finished
28	* as well, so the site stops asking the network. Autoloaded, because it is
29	* read on every request.
30	*
31	* @since 2.11.6
32	*/
33	const COPIES_PURGED_OPTION = 'vigilante_config_copies_purged';
34
35	/**
36	* Network option holding the last site the walk cleaned, or 'done'
37	*
38	* @since 2.11.6
39	*/
40	const COPIES_SWEEP_OPTION = 'vigilante_config_copies_sweep';
41
42	/**
43	* Sites the walk cleans per request
44	*
45	* @since 2.11.6
46	*/
47	const COPIES_SWEEP_BATCH = 50;
48
49	/**
50	* Lock that keeps two requests from walking the network at once
51	*
52	* @since 2.11.8
53	*/
54	const COPIES_SWEEP_LOCK = 'vigilante_config_copies_sweep_lock';
55
56	/**
57	* Legacy on-disk backup directory (kept only to clean it up on upgrade).
58	*
59	* @var string
60	*/
61	private $backup_dir;
62
63	/**
64	* Configuration files the archive carries
65	*
66	* @var array
67	*/
68	private $backup_files = array();
69
70	/**
71	* Constructor
72	*/
73	public function __construct() {
74	$this->backup_dir = VIGILANTE_BACKUP_DIR;
75	$this->setup_backup_files();
76	}
77
78	/**
79	* Setup list of files to backup
80	*/
81	private function setup_backup_files() {
82	$this->backup_files = array(
83	'htaccess' => array(
84	'source' => ABSPATH . '.htaccess',
85	'name' => 'htaccess',
86	),
87	'wpconfig' => array(
88	'source' => ABSPATH . 'wp-config.php',
89	'name' => 'wpconfig',
90	),
91	'robots' => array(
92	'source' => ABSPATH . 'robots.txt',
93	'name' => 'robots',
94	),
95	);
96	}
97
98	/**
99	* Delete the copies of the configuration files kept in this site's options
100	*
101	* Until 2.11.6 activating Vigilant copied wp-config.php, .htaccess and
102	* robots.txt into vigilante_backup_info_<date>, up to five of them, and
103	* writing the constants block kept one more copy of wp-config.php in
104	* vigilante_wpconfig_backup. Nothing read them back: the method that
105	* restored the files had no caller. wp-config.php carries the database
106	* password and the authentication keys and salts, so every copy put them in
107	* the options table, within reach of anyone who can read the database or a
108	* dump of it. 2.7.0 moved the copies there from files under the web root,
109	* which changed where they lived and not whether they should exist.
110	*
111	* @since 2.11.6
112	*/
113	public static function purge_stored_copies() {
114	global $wpdb;
115
116	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- one-off cleanup of our own dated option names, which the options API cannot list.
117	$names = $wpdb->get_col( "SELECT option_name FROM {$wpdb->options} WHERE option_name LIKE 'vigilante\\_backup\\_info\\_%'" );
118
119	foreach ( (array) $names as $name ) {
120	delete_option( $name );
121	}
122
123	delete_option( 'vigilante_backup_timestamp' );
124	delete_option( 'vigilante_wpconfig_backup' );
125	}
126
127	/**
128	* Run purge_stored_copies() once on this site, and once over the network
129	*
130	* The walk exists for the sites where Vigilant no longer runs: a copy made
131	* by a per-site activation stays in that site's options after the plugin is
132	* deactivated there, and nothing on that site would ever clean it. It
133	* advances one batch of sites per request, from whichever site runs
134	* Vigilant, remembers the last site it cleaned, and only visits this
135	* network.
136	*
137	* @since 2.11.6
138	*/
139	public static function maybe_purge_stored_copies() {
140	$state = (int) get_option( self::COPIES_PURGED_OPTION, 0 );
141
142	if ( $state >= 2 ) {
143	return;
144	}
145
146	if ( $state < 1 ) {
147	self::purge_stored_copies();
148	update_option( self::COPIES_PURGED_OPTION, 1, true );
149	}
150
151	if ( ! is_multisite() ) {
152	update_option( self::COPIES_PURGED_OPTION, 2, true );
153	return;
154	}
155
156	if ( 'done' !== get_site_option( self::COPIES_SWEEP_OPTION, 0 ) ) {
157	/*
158	* One request walks at a time. Right after an update every request
159	* gets here, and until 2.11.8 each of them repeated the same batch of
160	* sites. The lock lives in the options table of the main site, which
161	* every site of the network reaches the same way.
162	*/
163	switch_to_blog( get_main_site_id() );
164	$locked = Vigilante_Settings::acquire_option_lock( self::COPIES_SWEEP_LOCK, MINUTE_IN_SECONDS );
165	restore_current_blog();
166
167	if ( ! $locked ) {
168	return;
169	}
170
171	try {
172	self::sweep_next_batch();
173	} finally {
174	switch_to_blog( get_main_site_id() );
175	Vigilante_Settings::release_option_lock( self::COPIES_SWEEP_LOCK );
176	restore_current_blog();
177	}
178	}
179
180	if ( 'done' === get_site_option( self::COPIES_SWEEP_OPTION, 0 ) ) {
181	update_option( self::COPIES_PURGED_OPTION, 2, true );
182	}
183	}
184
185	/**
186	* Clean the next batch of sites of the network, with the walk lock held
187	*
188	* @since 2.11.8
189	*/
190	private static function sweep_next_batch() {
191	global $wpdb;
192
193	// Read again inside the lock: the request that held it before may have
194	// moved the walk on.
195	// The core caches network options under "$network_id:$option", and absent
196	// ones in "$network_id:notoptions" (wp-includes/option.php:2091 and :2065).
197	wp_cache_delete( get_current_network_id() . ':' . self::COPIES_SWEEP_OPTION, 'site-options' );
198	wp_cache_delete( get_current_network_id() . ':notoptions', 'site-options' );
199	$sweep = get_site_option( self::COPIES_SWEEP_OPTION, 0 );
200
201	if ( 'done' === $sweep ) {
202	return;
203	}
204
205	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- the walk needs the sites after the last one it cleaned, in id order, and get_sites() cannot ask for ids greater than a value.
206	$site_ids = $wpdb->get_col(
207	$wpdb->prepare(
208	"SELECT blog_id FROM {$wpdb->blogs} WHERE site_id = %d AND blog_id > %d ORDER BY blog_id ASC LIMIT %d",
209	get_current_network_id(),
210	(int) $sweep,
211	self::COPIES_SWEEP_BATCH
212	)
213	);
214
215	foreach ( $site_ids as $site_id ) {
216	switch_to_blog( (int) $site_id );
217	self::purge_stored_copies();
218	restore_current_blog();
219	}
220
221	update_site_option( self::COPIES_SWEEP_OPTION, count( $site_ids ) < self::COPIES_SWEEP_BATCH ? 'done' : (int) end( $site_ids ) );
222	}
223
224	/**
225	* Get the legacy on-disk backup directory path.
226	*
227	* Backups no longer live there; this is used to clean up files left by
228	* older versions.
229	*
230	* @return string
231	*/
232	public function get_backup_dir() {
233	return $this->backup_dir;
234	}
235
236	/**
237	* Build a ZIP with the current config files and stream it to the browser.
238	*
239	* Used by the "Create Backup" tool: instead of leaving files under the web
240	* root, it hands the admin a downloadable archive of wp-config.php and
241	* .htaccess (and robots.txt if present). The temp ZIP is removed right after.
242	*
243	* @return void\|WP_Error WP_Error on failure; on success it streams and exits.
244	*/
245	public function stream_files_zip() {
246	// Second line of defence: the archive contains network-shared files, so
247	// no future caller can hand them to a subsite administrator by mistake.
248	if ( ! Vigilante_Settings::can_write_shared_files() ) {
249	return new WP_Error( 'shared_files_denied', Vigilante_Settings::get_shared_files_notice() );
250	}
251
252	if ( ! class_exists( 'ZipArchive' ) ) {
253	return new WP_Error( 'zip_unavailable', __( 'ZipArchive extension is not available on this server.', 'vigilante' ) );
254	}
255
256	$upload_dir = wp_upload_dir();
257	$temp_dir = trailingslashit( $upload_dir['basedir'] ) . 'vigilante-temp/';
258	if ( ! wp_mkdir_p( $temp_dir ) ) {
259	return new WP_Error( 'dir_error', __( 'Cannot create temporary directory.', 'vigilante' ) );
260	}
261	if ( ! file_exists( $temp_dir . '.htaccess' ) ) {
262	file_put_contents( $temp_dir . '.htaccess', "Deny from all\n" ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- protective deny rule, not user input.
263	}
264	if ( ! file_exists( $temp_dir . 'index.php' ) ) {
265	file_put_contents( $temp_dir . 'index.php', "<?php\n// Silence is golden.\n" ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- silence-is-golden index, not user input.
266	}
267
268	$token = wp_generate_password( 20, false );
269	$zip_name = 'vigilant-config-backup-' . gmdate( 'Y-m-d-His' ) . '-' . $token . '.zip';
270	$zip_path = $temp_dir . $zip_name;
271
272	$zip = new ZipArchive();
273	if ( true !== $zip->open( $zip_path, ZipArchive::CREATE \| ZipArchive::OVERWRITE ) ) {
274	return new WP_Error( 'zip_create_error', __( 'Failed to create ZIP file.', 'vigilante' ) );
275	}
276
277	$added = 0;
278	foreach ( $this->backup_files as $file ) {
279	if ( file_exists( $file['source'] ) ) {
280	$zip->addFile( $file['source'], basename( $file['source'] ) );
281	$added++;
282	}
283	}
284	$zip->close();
285
286	if ( 0 === $added \|\| ! file_exists( $zip_path ) ) {
287	return new WP_Error( 'zip_empty', __( 'No configuration files were found to back up.', 'vigilante' ) );
288	}
289
290	while ( ob_get_level() ) {
291	ob_end_clean();
292	}
293	nocache_headers();
294	header( 'Content-Type: application/zip' );
295	header( 'Content-Disposition: attachment; filename="' . $zip_name . '"' );
296	header( 'Content-Length: ' . filesize( $zip_path ) );
297	// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_readfile -- streaming a freshly built archive to the browser.
298	readfile( $zip_path );
299	wp_delete_file( $zip_path );
300	exit;
301	}
302
303	/**
304	* Remove backup files written under the web root by versions before 2.7.0.
305	*
306	* Config backups now live in the database, so the legacy on-disk directory
307	* and any leftover database dumps are deleted. Best-effort.
308	*
309	* @return void
310	*/
311	public static function cleanup_legacy_files() {
312	global $wp_filesystem;
313	if ( ! function_exists( 'WP_Filesystem' ) ) {
314	require_once ABSPATH . 'wp-admin/includes/file.php';
315	}
316	WP_Filesystem();
317	if ( ! $wp_filesystem ) {
318	return;
319	}
320
321	$dir = defined( 'VIGILANTE_BACKUP_DIR' ) ? VIGILANTE_BACKUP_DIR : WP_CONTENT_DIR . '/vigilante-backups/';
322	if ( $wp_filesystem->is_dir( $dir ) ) {
323	$wp_filesystem->rmdir( $dir, true );
324	}
325
326	$upload_dir = wp_upload_dir();
327	if ( ! empty( $upload_dir['basedir'] ) ) {
328	$temp = trailingslashit( $upload_dir['basedir'] ) . 'vigilante-temp/';
329	if ( $wp_filesystem->is_dir( $temp ) ) {
330	$wp_filesystem->rmdir( $temp, true );
331	}
332	}
333	}
334	}
335