← All changes | includes/class-activator.php +59 -30 2.9.7 → 2.11.8 View file →

		@@ -58,12 +58,9 @@
58	58	* whatever they had: the activation hook does not run on an update, and
59	59	* Vigilante_Comment_Security::resolve_xmlrpc_mode() answers 'full' when
60	60	* nothing is stored, which is what every version since 1.0.0 did.
61	61	*/
62		- if ( ! isset( $first_run['wp_hardening'] ) || ! is_array( $first_run['wp_hardening'] ) ) {
63		- $first_run['wp_hardening'] = array();
64		- }
65		- $first_run['wp_hardening']['xmlrpc_mode'] = 'pingback';
	62	+ $first_run = Vigilante_Settings::apply_install_tweaks( $first_run );
66	63
67	64	update_option( Vigilante_Settings::OPTION_NAME, $first_run );
68	65	// Refresh settings instance to get new values
69	66	$settings->clear_cache();
		@@ -75,11 +72,8 @@
75	72	$settings = new Vigilante_Settings();
76	73	}
77	74	}
78	75
79		- // Create backup of current files FIRST (before any modifications)
80		- self::create_activation_backup( $settings );
81		-
82	76	// Apply htaccess protection (part of firewall module)
83	77	if ( $settings->is_module_enabled( 'firewall' ) ) {
84	78	self::apply_htaccess_protection( $settings );
85	79	}
		@@ -229,25 +223,8 @@
229	223	return true;
230	224	}
231	225
232	226	/**
233		- * Create backup of important files
234		- *
235		- * @param Vigilante_Settings $settings Settings instance.
236		- */
237		- private static function create_activation_backup( $settings ) {
238		- require_once VIGILANTE_INCLUDES_DIR . 'class-backup-manager.php';
239		-
240		- $backup_manager = new Vigilante_Backup_Manager();
241		- $result = $backup_manager->create_backups();
242		-
243		- if ( is_wp_error( $result ) ) {
244		- // Store error for admin notice
245		- set_transient( 'vigilante_backup_error', $result->get_error_message(), 60 );
246		- }
247		- }
248		-
249		- /**
250	227	* Apply htaccess protection
251	228	*
252	229	* @param Vigilante_Settings $settings Settings instance.
253	230	*/
		@@ -253,8 +230,9 @@
253	230	*/
254	231	private static function apply_htaccess_protection( $settings ) {
255	232	// Only apply if Apache server
256	233	if ( ! self::is_apache() ) {
	234	+ self::mark_server_files_pending();
257	235	return;
258	236	}
259	237
260	238	require_once VIGILANTE_INCLUDES_DIR . 'class-htaccess-protection.php';
		@@ -270,8 +248,9 @@
270	248	*/
271	249	private static function apply_security_headers( $settings ) {
272	250	// Only apply if Apache server
273	251	if ( ! self::is_apache() ) {
	252	+ self::mark_server_files_pending();
274	253	return;
275	254	}
276	255
277	256	require_once VIGILANTE_INCLUDES_DIR . 'class-security-headers.php';
		@@ -335,8 +314,14 @@
335	314	*
336	315	* @param Vigilante_Settings $settings Settings instance.
337	316	*/
338	317	private static function remove_sensitive_files( $settings ) {
	318	+ // They sit in the root every site of a network shares. Until 2.11.6 the
	319	+ // activation on any site removed them.
	320	+ if ( ! Vigilante_Settings::can_write_shared_files() ) {
	321	+ return;
	322	+ }
	323	+
339	324	$advanced = $settings->get_section( 'advanced' );
340	325
341	326	// Remove readme.html
342	327	if ( ! empty( $advanced['remove_readme'] ) ) {
		@@ -376,9 +361,15 @@
376	361	$database = new Vigilante_Database();
377	362	$activity_log = null; // Not needed for baseline generation
378	363
379	364	$fi = new Vigilante_File_Integrity( $settings, $database, $activity_log );
380		- $fi->regenerate_all_baselines();
	365	+
	366	+ // Same care as the migration: reactivating the plugin on a site that
	367	+ // already has an approved baseline must not throw it away and adopt
	368	+ // whatever the files say today.
	369	+ if ( ! $fi->get_critical_files_baseline() ) {
	370	+ $fi->regenerate_all_baselines();
	371	+ }
381	372	}
382	373
383	374	/**
384	375	* Schedule cron events
		@@ -474,12 +465,50 @@
474	465	*
475	466	* @return bool
476	467	*/
477	468	private static function is_apache() {
478		- if ( ! function_exists( 'apache_get_modules' ) ) {
479		- // Check server software
480		- $server = isset( $_SERVER['SERVER_SOFTWARE'] ) ? sanitize_text_field( wp_unslash( $_SERVER['SERVER_SOFTWARE'] ) ) : '';
481		- return stripos( $server, 'apache' ) !== false || stripos( $server, 'litespeed' ) !== false;
	469	+ require_once VIGILANTE_INCLUDES_DIR . 'class-htaccess-manager.php';
	470	+
	471	+ // One detection for the whole plugin. This used to be a second copy of
	472	+ // the same logic, so fixing one never fixed the other.
	473	+ return Vigilante_Htaccess_Manager::get_instance()->is_apache();
	474	+ }
	475	+
	476	+ /**
	477	+ * Leave the server layer pending when the server could not be identified
	478	+ *
	479	+ * An activation from WP-CLI has no request to read the server software
	480	+ * from, so before 2.9.9 the two apply_* guards below simply returned and
	481	+ * the site was left without the .htaccess layer, with every switch showing
	482	+ * as on. Now it is written down, so the first web request applies it, and
	483	+ * it is logged, so it is visible that it happened.
	484	+ *
	485	+ * @since 2.9.9
	486	+ */
	487	+ private static function mark_server_files_pending() {
	488	+ require_once VIGILANTE_INCLUDES_DIR . 'class-htaccess-manager.php';
	489	+
	490	+ // On a server known not to be Apache there is nothing to write, ever.
	491	+ if ( ! Vigilante_Htaccess_Manager::get_instance()->server_is_unknown() ) {
	492	+ return;
482	493	}
483		- return true;
	494	+
	495	+ update_option( 'vigilante_server_files_pending', 1 );
	496	+
	497	+ // The activation runs before the plugin has loaded its own files, so
	498	+ // every link of the chain has to be pulled in: the log asks the database
	499	+ // for the client IP, and that resolves it through the IP helper.
	500	+ require_once VIGILANTE_INCLUDES_DIR . 'class-ip-utils.php';
	501	+ require_once VIGILANTE_INCLUDES_DIR . 'class-database.php';
	502	+ require_once VIGILANTE_INCLUDES_DIR . 'class-activity-log.php';
	503	+
	504	+ $settings = new Vigilante_Settings();
	505	+ $activity_log = new Vigilante_Activity_Log( $settings, new Vigilante_Database() );
	506	+ $activity_log->log(
	507	+ 'system',
	508	+ 'server_rules_pending',
	509	+ __( 'The server type could not be identified from this request, so the .htaccess rules were left pending and will be written on the first web request.', 'vigilante' ),
	510	+ array( 'sapi' => PHP_SAPI ),
	511	+ 'warning'
	512	+ );
484	513	}
485	514	}