← All changes | admin/class-admin-ajax.php +134 -110 2.10.2 → 2.11.8 View file →

		@@ -22,95 +22,18 @@
22	22	* AJAX: Apply preset
23	23	*/
24	24	// ajax_apply_preset() is defined in class-admin.php directly (not in this trait)
25	25
26		- /**
27		- * AJAX: Clear lockouts
	26	+ /*
	27	+ * ajax_clear_lockouts(), ajax_clear_logs(), ajax_run_scan() and
	28	+ * ajax_test_headers() live in class-admin.php. Until 2.11.8 this trait
	29	+ * carried older copies of the four, and PHP runs the method of the class,
	30	+ * so the copies never ran: a fix written into one of them would have looked
	31	+ * applied and changed nothing. Removed after the audit of the admin surface
	32	+ * for 2.11.8 found them.
28	33	*/
29		- public function ajax_clear_lockouts() {
30		- check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );
31	34
32		- if ( ! current_user_can( 'manage_options' ) ) {
33		- wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
34		- }
35		-
36		- $ip = isset( $_POST['ip'] ) ? sanitize_text_field( wp_unslash( $_POST['ip'] ) ) : '';
37		-
38		- if ( ! empty( $ip ) ) {
39		- // Clear specific IP
40		- $result = $this->database->clear_lockout( $ip );
41		- } else {
42		- // Clear all
43		- $result = $this->database->clear_all_lockouts();
44		- }
45		-
46		- if ( $result ) {
47		- wp_send_json_success( __( 'Lockouts cleared.', 'vigilante' ) );
48		- } else {
49		- wp_send_json_error( __( 'Failed to clear lockouts.', 'vigilante' ) );
50		- }
51		- }
52		-
53	35	/**
54		- * AJAX: Clear logs
55		- */
56		- public function ajax_clear_logs() {
57		- check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );
58		-
59		- if ( ! current_user_can( 'manage_options' ) ) {
60		- wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
61		- }
62		-
63		- $result = $this->activity_log->clear_all_logs();
64		-
65		- if ( $result ) {
66		- wp_send_json_success( __( 'Logs cleared.', 'vigilante' ) );
67		- } else {
68		- wp_send_json_error( __( 'Failed to clear logs.', 'vigilante' ) );
69		- }
70		- }
71		-
72		- /**
73		- * AJAX: Run file integrity scan
74		- */
75		- public function ajax_run_scan() {
76		- check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );
77		-
78		- if ( ! current_user_can( 'manage_options' ) ) {
79		- wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
80		- }
81		-
82		- try {
83		- if ( ! class_exists( 'Vigilante_File_Integrity' ) ) {
84		- require_once VIGILANTE_PLUGIN_DIR . 'includes/class-file-integrity.php';
85		- }
86		-
87		- if ( ! $this->settings ) {
88		- wp_send_json_error( 'Settings not initialized' );
89		- }
90		-
91		- $activity_log = isset( $this->activity_log ) ? $this->activity_log : null;
92		- $database = isset( $this->database ) ? $this->database : null;
93		-
94		- $file_integrity = new Vigilante_File_Integrity( $this->settings, $database, $activity_log );
95		- $results = $file_integrity->run_scan();
96		-
97		- // Save results for display
98		- update_option( 'vigilante_last_integrity_scan', time() );
99		- update_option( 'vigilante_last_integrity_results', $results );
100		-
101		- wp_send_json_success( array(
102		- 'message' => __( 'Scan completed.', 'vigilante' ),
103		- 'results' => $results,
104		- ) );
105		- } catch ( Exception $e ) {
106		- wp_send_json_error( 'Exception: ' . $e->getMessage() );
107		- } catch ( Error $e ) {
108		- wp_send_json_error( 'PHP Error: ' . $e->getMessage() . ' in ' . $e->getFile() . ':' . $e->getLine() );
109		- }
110		- }
111		-
112		- /**
113	36	* AJAX: Approve a critical config file modification
114	37	*
115	38	* Updates the baseline hash for a single critical file (wp-config.php
116	39	* or .htaccess), accepting the current content as legitimate.
		@@ -117,9 +40,23 @@
117	40	*/
118	41	public function ajax_approve_critical_file() {
119	42	check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );
120	43
121		- if ( ! current_user_can( 'manage_options' ) ) {
	44	+ // Both approvable files, wp-config.php and the root .htaccess, belong
	45	+ // to the whole network, and since 2.11.3 so does the baseline that
	46	+ // records them. Approving a change to them is a network action, so on
	47	+ // a network it takes a network administrator: manage_options is held
	48	+ // by the administrator of every subsite.
	49	+ // Written with both calls in plain sight, following the recipe in
	50	+ // native-aeo-pack/trunk/includes/class-robots-txt.php:650, so the
	51	+ // surface inventory can read the capability. With the name in a
	52	+ // variable it can only say "check by hand", and an alert that says
	53	+ // that forever is an alert nobody reads.
	54	+ $allowed = is_multisite()
	55	+ ? current_user_can( 'manage_network_options' )
	56	+ : current_user_can( 'manage_options' );
	57	+
	58	+ if ( ! $allowed ) {
122	59	wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
123	60	}
124	61
125	62	// The request carries an opaque key instead of the file name: hosting
		@@ -326,8 +263,18 @@
326	263	$removed_from_opposite = true;
327	264	}
328	265	}
329	266
	267	+ // On the main site of a network the whitelists also build the .htaccess
	268	+ // rules every site shares, so a user without network rights cannot put
	269	+ // an entry in them or take one out (2.11.6).
	270	+ $locked = Vigilante_Settings::get_locked_file_settings();
	271	+ $locked_firewall = ( isset( $locked['firewall'] ) && is_array( $locked['firewall'] ) ) ? $locked['firewall'] : array();
	272	+
	273	+ if ( in_array( $option_key, $locked_firewall, true ) || ( $removed_from_opposite && in_array( $opposite_key, $locked_firewall, true ) ) ) {
	274	+ wp_send_json_error( Vigilante_Settings::get_shared_files_notice() );
	275	+ }
	276	+
330	277	wp_cache_delete( Vigilante_Settings::OPTION_NAME, 'options' );
331	278	update_option( Vigilante_Settings::OPTION_NAME, $all_options );
332	279	$this->settings->clear_cache();
333	280
		@@ -376,24 +323,8 @@
376	323	wp_send_json_success( $message );
377	324	}
378	325
379	326	/**
380		- * AJAX: Test security headers
381		- */
382		- public function ajax_test_headers() {
383		- check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );
384		-
385		- if ( ! current_user_can( 'manage_options' ) ) {
386		- wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
387		- }
388		-
389		- $security_headers = new Vigilante_Security_Headers( $this->settings );
390		- $results = $security_headers->test_headers();
391		-
392		- wp_send_json_success( $results );
393		- }
394		-
395		- /**
396	327	* Sanitize activity log data
397	328	*
398	329	* @param array $data Data to sanitize.
399	330	* @return array
		@@ -628,21 +559,45 @@
628	559	if ( ! class_exists( 'Vigilante_Two_Factor_TOTP' ) ) {
629	560	require_once VIGILANTE_INCLUDES_DIR . 'class-two-factor-totp.php';
630	561	}
631	562
632		- $totp = new Vigilante_Two_Factor_TOTP( $this->settings, $this->database, $this->activity_log );
633		- $count = 0;
	563	+ $totp = new Vigilante_Two_Factor_TOTP( $this->settings, $this->database, $this->activity_log );
	564	+ $count = 0;
	565	+ $skipped = 0;
634	566
635	567	foreach ( $user_ids as $uid ) {
636		- if ( $uid > 0 ) {
637		- $totp->reset_user_totp( $uid );
638		- $count++;
	568	+ if ( $uid < 1 ) {
	569	+ continue;
639	570	}
	571	+
	572	+ // Same gate as the rest of the TOTP handlers: resetting somebody's
	573	+ // second factor is editing their account, so ask for edit_user
	574	+ // rather than for manage_options, which on a network is per site.
	575	+ if ( ! current_user_can( 'edit_user', $uid ) ) {
	576	+ $skipped++;
	577	+ continue;
	578	+ }
	579	+
	580	+ $totp->reset_user_totp( $uid );
	581	+ $count++;
640	582	}
641	583
	584	+ $message = sprintf(
	585	+ /* translators: %d: Number of users reset */
	586	+ _n( 'TOTP reset for %d user.', 'TOTP reset for %d users.', $count, 'vigilante' ),
	587	+ $count
	588	+ );
	589	+
	590	+ if ( $skipped > 0 ) {
	591	+ $message .= ' ' . sprintf(
	592	+ /* translators: %d: Number of users skipped because the current user cannot edit them */
	593	+ __( '%d skipped: you cannot edit those users.', 'vigilante' ),
	594	+ $skipped
	595	+ );
	596	+ }
	597	+
642	598	wp_send_json_success( array(
643		- /* translators: %d: Number of users reset */
644		- 'message' => sprintf( _n( 'TOTP reset for %d user.', 'TOTP reset for %d users.', $count, 'vigilante' ), $count ),
	599	+ 'message' => $message,
645	600	'count' => $count,
646	601	) );
647	602	}
648	603
		@@ -662,10 +617,11 @@
662	617	if ( 0 === $user_id ) {
663	618	wp_send_json_error( __( 'Invalid user.', 'vigilante' ) );
664	619	}
665	620
666		- // Permission check: own profile or admin
667		- if ( get_current_user_id() !== $user_id && ! current_user_can( 'manage_options' ) ) {
	621	+ // Permission check: own profile, or a user this one may actually edit.
	622	+ // manage_options is held by every subsite administrator on a network.
	623	+ if ( get_current_user_id() !== $user_id && ! current_user_can( 'edit_user', $user_id ) ) {
668	624	wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
669	625	}
670	626
671	627	if ( ! class_exists( 'Vigilante_Two_Factor_TOTP' ) ) {
		@@ -880,8 +836,16 @@
880	836	$results['failed']
881	837	);
882	838	}
883	839
	840	+ if ( ! empty( $results['skipped'] ) ) {
	841	+ $message .= ' ' . sprintf(
	842	+ /* translators: %d: Number of users skipped because the current user cannot edit them */
	843	+ __( '%d skipped: you cannot edit those users.', 'vigilante' ),
	844	+ $results['skipped']
	845	+ );
	846	+ }
	847	+
884	848	wp_send_json_success( array(
885	849	'message' => $message,
886	850	'results' => $results,
887	851	'resetting_self' => $resetting_self,
		@@ -942,8 +906,16 @@
942	906	$results['failed']
943	907	);
944	908	}
945	909
	910	+ if ( ! empty( $results['skipped'] ) ) {
	911	+ $message .= ' ' . sprintf(
	912	+ /* translators: %d: Number of users skipped because the current user cannot edit them */
	913	+ __( '%d skipped: you cannot edit those users.', 'vigilante' ),
	914	+ $results['skipped']
	915	+ );
	916	+ }
	917	+
946	918	wp_send_json_success( array(
947	919	'message' => $message,
948	920	'results' => $results,
949	921	'resetting_self' => $include_self,
		@@ -1036,8 +1008,16 @@
1036	1008	$results['failed']
1037	1009	);
1038	1010	}
1039	1011
	1012	+ if ( ! empty( $results['skipped'] ) ) {
	1013	+ $message .= ' ' . sprintf(
	1014	+ /* translators: %d: Number of users skipped because the current user cannot edit them */
	1015	+ __( '%d skipped: you cannot edit those users.', 'vigilante' ),
	1016	+ $results['skipped']
	1017	+ );
	1018	+ }
	1019	+
1040	1020	// Check if current user was included via role membership.
1041	1021	$resetting_self = false;
1042	1022	if ( $include_self ) {
1043	1023	$current_user = wp_get_current_user();
		@@ -1066,8 +1046,16 @@
1066	1046	if ( ! $user_id ) {
1067	1047	wp_send_json_error( __( 'Invalid user ID.', 'vigilante' ) );
1068	1048	}
1069	1049
	1050	+ // The pending flag is a user meta, shared by every site of a network, and
	1051	+ // approving opens the login everywhere. Same rule the other account tools
	1052	+ // got in 2.10.3: permission over that user, which on a network only a
	1053	+ // network administrator has (2.11.8).
	1054	+ if ( ! current_user_can( 'edit_user', $user_id ) ) {
	1055	+ wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
	1056	+ }
	1057	+
1070	1058	$user_security = new Vigilante_User_Security( $this->settings, $this->activity_log );
1071	1059	$result = $user_security->approve_user( $user_id, get_current_user_id() );
1072	1060
1073	1061	if ( $result ) {
		@@ -1100,8 +1088,14 @@
1100	1088	if ( ! $user_id ) {
1101	1089	wp_send_json_error( __( 'Invalid user ID.', 'vigilante' ) );
1102	1090	}
1103	1091
	1092	+ // See ajax_approve_user(): the account and its pending flag belong to the
	1093	+ // whole network (2.11.8).
	1094	+ if ( ! current_user_can( 'edit_user', $user_id ) ) {
	1095	+ wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
	1096	+ }
	1097	+
1104	1098	$user = get_userdata( $user_id );
1105	1099	$username = $user ? $user->user_login : $user_id;
1106	1100
1107	1101	$user_security = new Vigilante_User_Security( $this->settings, $this->activity_log );
		@@ -1140,8 +1134,14 @@
1140	1134	if ( ! $user ) {
1141	1135	wp_send_json_error( __( 'User not found.', 'vigilante' ) );
1142	1136	}
1143	1137
	1138	+ // Sessions carry IP, User-Agent and login time. manage_options alone is
	1139	+ // not enough on a network, where it is held per subsite.
	1140	+ if ( ! current_user_can( 'edit_user', $user_id ) ) {
	1141	+ wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
	1142	+ }
	1143	+
1144	1144	$user_security = new Vigilante_User_Security( $this->settings, $this->activity_log );
1145	1145	$sessions = $user_security->get_user_sessions( $user_id );
1146	1146
1147	1147	wp_send_json_success( array(
		@@ -1170,8 +1170,12 @@
1170	1170	if ( ! $user_id || ! $token_hash ) {
1171	1171	wp_send_json_error( __( 'Invalid parameters.', 'vigilante' ) );
1172	1172	}
1173	1173
	1174	+ if ( ! current_user_can( 'edit_user', $user_id ) ) {
	1175	+ wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
	1176	+ }
	1177	+
1174	1178	$user_security = new Vigilante_User_Security( $this->settings, $this->activity_log );
1175	1179	$result = $user_security->revoke_session( $user_id, $token_hash );
1176	1180
1177	1181	if ( $result ) {
		@@ -1199,8 +1203,12 @@
1199	1203	if ( ! $user_id ) {
1200	1204	wp_send_json_error( __( 'Invalid user ID.', 'vigilante' ) );
1201	1205	}
1202	1206
	1207	+ if ( ! current_user_can( 'edit_user', $user_id ) ) {
	1208	+ wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
	1209	+ }
	1210	+
1203	1211	$user_security = new Vigilante_User_Security( $this->settings, $this->activity_log );
1204	1212	$count = $user_security->revoke_all_sessions( $user_id, $include_current );
1205	1213
1206	1214	wp_send_json_success( array(
		@@ -1298,8 +1306,16 @@
1298	1306	if ( ! current_user_can( 'manage_options' ) ) {
1299	1307	wp_send_json_error( __( 'Permission denied.', 'vigilante' ) );
1300	1308	}
1301	1309
	1310	+ // The dump is taken with $wpdb->prefix, which on the main site of a
	1311	+ // network matches every subsite table plus the global user tables, and
	1312	+ // the options it carries include the stored copy of wp-config.php. Same
	1313	+ // gate the rest of the network-shared operations use.
	1314	+ if ( ! Vigilante_Settings::can_write_shared_files() ) {
	1315	+ wp_send_json_error( Vigilante_Settings::get_shared_files_notice() );
	1316	+ }
	1317	+
1302	1318	$backup = new Vigilante_Database_Backup();
1303	1319	$tables = $backup->get_tables();
1304	1320
1305	1321	wp_send_json_success( $tables );
		@@ -1314,8 +1330,16 @@
1314	1330	check_ajax_referer( 'vigilante_admin_nonce', 'nonce' );
1315	1331
1316	1332	if ( ! current_user_can( 'manage_options' ) ) {
1317	1333	wp_die( esc_html__( 'Permission denied.', 'vigilante' ), 403 );
	1334	+ }
	1335	+
	1336	+ // The dump is taken with $wpdb->prefix, which on the main site of a
	1337	+ // network matches every subsite table plus the global user tables, and
	1338	+ // the options it carries include the stored copy of wp-config.php. Same
	1339	+ // gate the rest of the network-shared operations use.
	1340	+ if ( ! Vigilante_Settings::can_write_shared_files() ) {
	1341	+ wp_die( esc_html( Vigilante_Settings::get_shared_files_notice() ), 403 );
1318	1342	}
1319	1343
1320	1344	// phpcs:ignore WordPress.Security.ValidatedSanitizedInput
1321	1345	$tables_raw = isset( $_POST['tables'] ) ? wp_unslash( $_POST['tables'] ) : '';