| 1 |
<?php |
| 2 |
/** |
| 3 |
* AJAX handlers for the Security Headers settings recovery |
| 4 |
* |
| 5 |
* Mixed into Vigilante_Admin via `use Vigilante_Admin_Recovery_Ajax;`. |
| 6 |
* Kept apart so class-admin-ajax.php does not grow further. |
| 7 |
* |
| 8 |
* All handlers require `manage_options` and a valid vigilante_admin_nonce. |
| 9 |
* |
| 10 |
* @package Vigilante |
| 11 |
* @since 2.10.0 |
| 12 |
*/ |
| 13 |
|
| 14 |
// Prevent direct access |
| 15 |
if ( ! defined( 'ABSPATH' ) ) { |
| 16 |
exit; |
| 17 |
} |
| 18 |
|
| 19 |
/** |
| 20 |
* Trait Vigilante_Admin_Recovery_Ajax |
| 21 |
*/ |
| 22 |
trait Vigilante_Admin_Recovery_Ajax { |
| 23 |
|
| 24 |
/** |
| 25 |
* Shared gate for the three handlers. |
| 26 |
*/ |
| 27 |
private function recovery_ajax_gate() { |
| 28 |
check_ajax_referer( 'vigilante_admin_nonce', 'nonce' ); |
| 29 |
|
| 30 |
if ( ! current_user_can( 'manage_options' ) ) { |
| 31 |
wp_send_json_error( __( 'Permission denied.', 'vigilante' ) ); |
| 32 |
} |
| 33 |
|
| 34 |
// On a network the .htaccess belongs to the whole network, and only the |
| 35 |
// main site decides what goes in it. |
| 36 |
if ( ! Vigilante_Settings::can_write_shared_files() ) { |
| 37 |
wp_send_json_error( Vigilante_Settings::get_shared_files_notice() ); |
| 38 |
} |
| 39 |
} |
| 40 |
|
| 41 |
/** |
| 42 |
* Write the recovered header settings. |
| 43 |
*/ |
| 44 |
public function ajax_headers_recovery_restore() { |
| 45 |
$this->recovery_ajax_gate(); |
| 46 |
|
| 47 |
$result = Vigilante_Htaccess_Recovery::restore( $this->settings ); |
| 48 |
|
| 49 |
if ( is_wp_error( $result ) ) { |
| 50 |
wp_send_json_error( $result->get_error_message() ); |
| 51 |
} |
| 52 |
|
| 53 |
if ( $this->activity_log ) { |
| 54 |
$this->activity_log->log( |
| 55 |
'system', |
| 56 |
'headers_settings_restored', |
| 57 |
__( 'The Security Headers settings were restored from the .htaccess snapshot taken before an update reset them.', 'vigilante' ), |
| 58 |
array(), |
| 59 |
'info' |
| 60 |
); |
| 61 |
} |
| 62 |
|
| 63 |
wp_send_json_success( __( 'Settings restored. The .htaccess rules were rewritten to match.', 'vigilante' ) ); |
| 64 |
} |
| 65 |
|
| 66 |
/** |
| 67 |
* Put the settings back as they were before restoring. |
| 68 |
*/ |
| 69 |
public function ajax_headers_recovery_undo() { |
| 70 |
$this->recovery_ajax_gate(); |
| 71 |
|
| 72 |
$result = Vigilante_Htaccess_Recovery::undo( $this->settings ); |
| 73 |
|
| 74 |
if ( is_wp_error( $result ) ) { |
| 75 |
wp_send_json_error( $result->get_error_message() ); |
| 76 |
} |
| 77 |
|
| 78 |
wp_send_json_success( __( 'The restore was undone.', 'vigilante' ) ); |
| 79 |
} |
| 80 |
|
| 81 |
/** |
| 82 |
* Stop offering the recovery, changing nothing. |
| 83 |
*/ |
| 84 |
public function ajax_headers_recovery_dismiss() { |
| 85 |
$this->recovery_ajax_gate(); |
| 86 |
|
| 87 |
Vigilante_Htaccess_Recovery::dismiss(); |
| 88 |
|
| 89 |
wp_send_json_success( __( 'Dismissed. No setting was changed.', 'vigilante' ) ); |
| 90 |
} |
| 91 |
} |
| 92 |
|
