| 1 |
<?php |
| 2 |
/** |
| 3 |
* Settings Class |
| 4 |
* |
| 5 |
* Centralized settings management with default values |
| 6 |
* |
| 7 |
* @package Vigilante |
| 8 |
*/ |
| 9 |
|
| 10 |
// Prevent direct access |
| 11 |
if ( ! defined( 'ABSPATH' ) ) { |
| 12 |
exit; |
| 13 |
} |
| 14 |
|
| 15 |
/** |
| 16 |
* Class Vigilante_Settings |
| 17 |
* |
| 18 |
* Handles all plugin settings with defaults, getters and setters |
| 19 |
*/ |
| 20 |
class Vigilante_Settings { |
| 21 |
|
| 22 |
/** |
| 23 |
* Option name in database |
| 24 |
*/ |
| 25 |
const OPTION_NAME = 'vigilante_options'; |
| 26 |
|
| 27 |
/** |
| 28 |
* Cached options |
| 29 |
* |
| 30 |
* @var array|null |
| 31 |
*/ |
| 32 |
private $options = null; |
| 33 |
|
| 34 |
/** |
| 35 |
* Default options structure |
| 36 |
* |
| 37 |
* @var array |
| 38 |
*/ |
| 39 |
private $defaults; |
| 40 |
|
| 41 |
/** |
| 42 |
* Constructor |
| 43 |
*/ |
| 44 |
public function __construct() { |
| 45 |
$this->defaults = $this->get_default_options(); |
| 46 |
} |
| 47 |
|
| 48 |
/** |
| 49 |
* Get all default options |
| 50 |
* |
| 51 |
* @return array Complete default options array |
| 52 |
*/ |
| 53 |
public function get_default_options() { |
| 54 |
return array( |
| 55 |
// Module toggles - 8 modules that match tabs |
| 56 |
'modules' => array( |
| 57 |
'firewall' => true, |
| 58 |
'security_headers' => true, |
| 59 |
'login_security' => true, |
| 60 |
'rest_api_security'=> true, |
| 61 |
'user_security' => true, |
| 62 |
'wp_hardening' => true, |
| 63 |
'file_integrity' => true, |
| 64 |
'activity_log' => true, |
| 65 |
), |
| 66 |
|
| 67 |
// Firewall settings (includes htaccess, rate limiting, file protection) |
| 68 |
'firewall' => array( |
| 69 |
// Request filtering (PHP-based) |
| 70 |
'block_bad_query_strings' => true, |
| 71 |
'block_sql_injection' => true, |
| 72 |
'block_xss_attacks' => true, |
| 73 |
'block_file_inclusion' => true, |
| 74 |
'block_directory_traversal' => true, |
| 75 |
|
| 76 |
// Bot protection |
| 77 |
'block_bad_bots' => true, |
| 78 |
'block_empty_user_agent' => false, |
| 79 |
|
| 80 |
// Rate limiting |
| 81 |
'rate_limiting' => array( |
| 82 |
'enabled' => true, |
| 83 |
'requests_per_minute' => 120, |
| 84 |
'block_duration' => 300, |
| 85 |
'progressive' => false, |
| 86 |
'max_block_duration' => 86400, |
| 87 |
), |
| 88 |
|
| 89 |
// IP management |
| 90 |
'ip_whitelist' => array(), |
| 91 |
'ip_blacklist' => array(), |
| 92 |
|
| 93 |
// Proxy / CDN: forwarded header to trust for the visitor IP. |
| 94 |
// Empty = trust only REMOTE_ADDR (the real connection, unspoofable). |
| 95 |
'trusted_proxy_header' => '', |
| 96 |
|
| 97 |
// Proxy / CDN: IPs or CIDR ranges the forwarded header is accepted |
| 98 |
// from. Empty = accept it only from your own network, and, for |
| 99 |
// CF-Connecting-IP, Cloudflare's own ranges. Since 2.11.9, so a |
| 100 |
// header cannot be forged by a visitor reaching the origin directly. |
| 101 |
'trusted_proxies' => array(), |
| 102 |
|
| 103 |
// User-Agent management |
| 104 |
'ua_whitelist' => array(), |
| 105 |
'ua_blacklist' => array(), |
| 106 |
|
| 107 |
// File protection (htaccess-based) |
| 108 |
'disable_directory_browsing' => true, |
| 109 |
'protect_wp_config' => true, |
| 110 |
'protect_wp_includes' => true, |
| 111 |
'protect_uploads_php' => true, |
| 112 |
'protect_sensitive_files' => true, |
| 113 |
// Off by default — only safe when host has a real server-side cron job |
| 114 |
// calling wp-cron.php; otherwise scheduled tasks stop running silently. |
| 115 |
'protect_wp_cron' => false, |
| 116 |
'block_php_in_plugins' => false, |
| 117 |
'block_php_in_themes' => false, |
| 118 |
'limit_http_methods' => true, |
| 119 |
// All methods needed for WordPress core, Gutenberg, REST API, and page builders |
| 120 |
'allowed_http_methods' => array( 'GET', 'POST', 'HEAD', 'OPTIONS', 'PUT', 'PATCH', 'DELETE' ), |
| 121 |
), |
| 122 |
|
| 123 |
// Security Headers settings (includes HTTPS enforcer) |
| 124 |
'security_headers' => array( |
| 125 |
'enabled' => true, |
| 126 |
|
| 127 |
// Basic headers |
| 128 |
'x_frame_options' => 'SAMEORIGIN', |
| 129 |
'x_content_type_options' => true, |
| 130 |
'referrer_policy' => 'strict-origin-when-cross-origin', |
| 131 |
|
| 132 |
// HSTS |
| 133 |
'hsts' => array( |
| 134 |
'enabled' => false, |
| 135 |
'max_age' => 31536000, |
| 136 |
'include_subdomains' => false, |
| 137 |
'preload' => false, |
| 138 |
), |
| 139 |
|
| 140 |
// Permissions Policy |
| 141 |
'permissions_policy' => array( |
| 142 |
'enabled' => true, |
| 143 |
'geolocation' => '()', |
| 144 |
'microphone' => '()', |
| 145 |
'camera' => '()', |
| 146 |
'payment' => '(self)', |
| 147 |
'usb' => '()', |
| 148 |
), |
| 149 |
|
| 150 |
// CSP - WordPress/Gutenberg compatible defaults |
| 151 |
// Note: blob: is required in frame-src and worker-src for the block editor, |
| 152 |
// and in connect-src for the client-side media processing WordPress 7.1 |
| 153 |
// introduced: @wordpress/vips puts its WebAssembly binary in a blob: URL and |
| 154 |
// fetches it, and fetch() is governed by connect-src, where 'self' does not |
| 155 |
// cover blob:. Without it the editor cannot process images before upload. |
| 156 |
'csp' => array( |
| 157 |
'enabled' => true, |
| 158 |
'report_only' => false, |
| 159 |
'report_uri' => '', |
| 160 |
'directives' => array( |
| 161 |
'default-src' => "'self'", |
| 162 |
'script-src' => "'self' 'unsafe-inline' 'unsafe-eval' https:", |
| 163 |
'style-src' => "'self' 'unsafe-inline' https:", |
| 164 |
'img-src' => "'self' data: https: blob:", |
| 165 |
'font-src' => "'self' data: https:", |
| 166 |
'connect-src' => "'self' https: wss: blob:", |
| 167 |
'media-src' => "'self' https: blob:", |
| 168 |
'frame-src' => "'self' https: blob:", |
| 169 |
'frame-ancestors' => "'self'", |
| 170 |
'base-uri' => "'self'", |
| 171 |
'form-action' => "'self' https:", |
| 172 |
'object-src' => "'none'", |
| 173 |
'worker-src' => "'self' blob:", |
| 174 |
'upgrade-insecure-requests'=> true, |
| 175 |
), |
| 176 |
), |
| 177 |
|
| 178 |
// Cross-origin policies |
| 179 |
'cross_origin_policies' => array( |
| 180 |
'embedder_policy' => 'unsafe-none', |
| 181 |
'opener_policy' => 'same-origin-allow-popups', |
| 182 |
'resource_policy' => 'cross-origin', |
| 183 |
), |
| 184 |
|
| 185 |
// HTTPS Enforcer (moved from separate module) |
| 186 |
// |
| 187 |
// force_https rewrites siteurl/home to https on activation, so it |
| 188 |
// ships off: a site without working HTTPS would end up pointing at |
| 189 |
// an address that does not answer. It is an opt-in decision per |
| 190 |
// site, made from the Security Headers tab. Sites whose URLs a |
| 191 |
// previous version already rewrote keep them; nothing reverts them. |
| 192 |
'force_https' => false, |
| 193 |
// Off by default for the same reason as force_https above: the |
| 194 |
// plugin does not decide that a site is on HTTPS. It only |
| 195 |
// redirects when the site's own home URL already says https, so |
| 196 |
// shipping it on was harmless in practice, but it is still a |
| 197 |
// decision that belongs to the site owner, not to us. Sites that |
| 198 |
// already have it on keep it. |
| 199 |
'redirect_http_to_https' => false, |
| 200 |
// Rewrites http:// URLs of this same site to https://, and only |
| 201 |
// on a site already served over HTTPS, so it cannot reach a third |
| 202 |
// party and cannot make a resource fail. It still ships off: a |
| 203 |
// setting whose own description says it rewrites http to https |
| 204 |
// does not belong in the factory configuration of a plugin that |
| 205 |
// deliberately does not decide whether a site is on HTTPS. Every |
| 206 |
// https-related setting here is the owner's call, and this one is |
| 207 |
// one click away for anyone who has just migrated and wants their |
| 208 |
// old content rewritten. |
| 209 |
'fix_mixed_content' => false, |
| 210 |
// The Content-Security-Policy directive that tells the browser to |
| 211 |
// upgrade every http:// request, including the ones pointing at |
| 212 |
// other people's servers. If any of those has no HTTPS the |
| 213 |
// resource simply stops loading, so this is the one piece of |
| 214 |
// mixed content handling that can break a page, and it is off by |
| 215 |
// default like everything else here that forces HTTPS. It used to |
| 216 |
// ride along with fix_mixed_content with no way to separate them. |
| 217 |
'upgrade_insecure_requests' => false, |
| 218 |
|
| 219 |
// Server Protection (moved from firewall in v2.0.0) |
| 220 |
'hide_server_signature' => true, |
| 221 |
'remove_fingerprinting_headers' => true, |
| 222 |
), |
| 223 |
|
| 224 |
// Login Security settings |
| 225 |
'login_security' => array( |
| 226 |
'enabled' => true, |
| 227 |
'max_attempts' => 5, |
| 228 |
'lockout_duration' => 1800, |
| 229 |
'lockout_increment' => true, |
| 230 |
'max_lockout_duration' => 86400, |
| 231 |
'hide_login_errors' => true, |
| 232 |
// XML-RPC se movio a wp_hardening en la 2.9.7; lo resuelve |
| 233 |
// Vigilante_Comment_Security::resolve_xmlrpc_mode(), que |
| 234 |
// sustituye a las dos casillas anteriores (disable_xmlrpc y |
| 235 |
// disable_xmlrpc_pingback), que podian estar activas a la vez y |
| 236 |
// contradecirse. A proposito NO se declara aqui ningun default: si se |
| 237 |
// declarara, el merge con los defaults lo rellenaria siempre y taparia el |
| 238 |
// respaldo que lee el ajuste antiguo de los sitios que aun no han vuelto a |
| 239 |
// guardar la pestana. Sin nada guardado, el resolutor devuelve 'full', que |
| 240 |
// es lo que hacia el default anterior. |
| 241 |
'disable_application_passwords' => false, |
| 242 |
'notify_on_lockout' => false, |
| 243 |
'notify_on_admin_login' => false, |
| 244 |
'ip_whitelist' => array(), |
| 245 |
'custom_login_url' => '', |
| 246 |
'notify_on_login_url_change' => true, |
| 247 |
// Two-Factor Authentication |
| 248 |
'two_factor' => array( |
| 249 |
'enabled' => false, |
| 250 |
'method' => 'email', |
| 251 |
'enforced_roles' => array( 'administrator', 'editor' ), |
| 252 |
'excluded_users' => array(), |
| 253 |
'remember_device_days' => 30, |
| 254 |
'allow_remember_device' => false, |
| 255 |
'code_expiry_minutes' => 10, |
| 256 |
'max_attempts' => 3, |
| 257 |
'email_from_name' => '', |
| 258 |
'notify_on_enable' => true, |
| 259 |
'grace_period_days' => 3, |
| 260 |
), |
| 261 |
), |
| 262 |
|
| 263 |
// REST API Security settings |
| 264 |
'rest_api_security' => array( |
| 265 |
'enabled' => true, |
| 266 |
'mode' => 'selective', |
| 267 |
'block_user_enumeration' => true, |
| 268 |
'disable_jsonp' => true, |
| 269 |
// Empty by default: /wp/v2/users used to live here, but that |
| 270 |
// duplicated the dedicated "Block user enumeration" toggle. |
| 271 |
// Now there is one knob = one behaviour. If you want to |
| 272 |
// protect additional endpoints in selective mode, add them |
| 273 |
// explicitly via this setting (or via a filter). |
| 274 |
'protected_endpoints' => array(), |
| 275 |
'allowed_public_endpoints' => array( |
| 276 |
'/wp/v2/posts', |
| 277 |
'/wp/v2/pages', |
| 278 |
'/wp/v2/categories', |
| 279 |
'/wp/v2/tags', |
| 280 |
'/oembed/', |
| 281 |
), |
| 282 |
'plugin_compatibility' => array( |
| 283 |
'woocommerce' => true, |
| 284 |
'contact_form_7' => true, |
| 285 |
'elementor' => true, |
| 286 |
), |
| 287 |
), |
| 288 |
|
| 289 |
// User Security settings |
| 290 |
'user_security' => array( |
| 291 |
'enabled' => true, |
| 292 |
'block_insecure_usernames'=> true, |
| 293 |
'insecure_usernames' => array( |
| 294 |
'admin', 'administrator', 'user', 'test', 'guest', |
| 295 |
'info', 'root', 'adm', 'sysadmin', 'support', |
| 296 |
'webmaster', 'master', 'owner', 'manager', 'demo', |
| 297 |
), |
| 298 |
'block_author_scanning' => true, |
| 299 |
'force_strong_passwords' => true, |
| 300 |
'min_password_length' => 12, |
| 301 |
|
| 302 |
// Granular password policy. Applies only while |
| 303 |
// force_strong_passwords is on. The defaults follow current |
| 304 |
// guidance (NIST SP 800-63B): what makes a password weak is being |
| 305 |
// guessable, not lacking a symbol, and composition rules push |
| 306 |
// people towards predictable substitutions and towards writing |
| 307 |
// the password down. So out of the box only the two rules that |
| 308 |
// block genuinely guessable passwords are on, and the four |
| 309 |
// character-class requirements ship off for anyone to turn on. |
| 310 |
// Existing sites keep whatever they have stored. |
| 311 |
// affected_roles empty = all roles. |
| 312 |
'password_policy' => array( |
| 313 |
'require_uppercase' => false, |
| 314 |
'require_lowercase' => false, |
| 315 |
'require_number' => false, |
| 316 |
'require_special' => false, |
| 317 |
'block_common' => true, |
| 318 |
'block_username' => true, |
| 319 |
'affected_roles' => array(), |
| 320 |
), |
| 321 |
|
| 322 |
'prevent_display_name_login_match' => true, |
| 323 |
|
| 324 |
// Admin monitoring |
| 325 |
// The two alerts that report someone gaining power ship on: a |
| 326 |
// new administrator and a role being raised are the signature of |
| 327 |
// an account takeover, and they are rare enough not to be noise. |
| 328 |
// The other two are ordinary admin housekeeping and stay opt-in. |
| 329 |
'admin_monitoring' => array( |
| 330 |
'alert_new_admin' => true, |
| 331 |
'alert_admin_email_change' => false, |
| 332 |
'alert_permission_elevation' => true, |
| 333 |
'alert_admin_password_change' => false, |
| 334 |
), |
| 335 |
|
| 336 |
// Force password reset (no options, uses native WordPress flow) |
| 337 |
|
| 338 |
// Registration approval |
| 339 |
'registration_approval' => array( |
| 340 |
'enabled' => false, |
| 341 |
'notify_admin' => false, |
| 342 |
'auto_reject_days' => 0, |
| 343 |
'affected_roles' => array( 'subscriber' ), |
| 344 |
), |
| 345 |
|
| 346 |
// Session management |
| 347 |
'session_management' => array( |
| 348 |
'enabled' => true, |
| 349 |
'show_in_profile' => true, |
| 350 |
), |
| 351 |
|
| 352 |
// Session limits |
| 353 |
'session_limits' => array( |
| 354 |
'enabled' => true, |
| 355 |
'max_sessions' => 3, |
| 356 |
'behavior' => 'close_oldest', |
| 357 |
'exclude_admins' => false, |
| 358 |
), |
| 359 |
|
| 360 |
// Password expiration ships OFF. Forced rotation is no longer |
| 361 |
// recommended (NIST SP 800-63B advises against it) and it is by |
| 362 |
// far the biggest source of support here: people locked out mid |
| 363 |
// task, cron reminders that never arrive, roles nobody meant to |
| 364 |
// include. The feature stays for anyone who has to comply with a |
| 365 |
// policy that still demands it, and the Configuration Score keeps |
| 366 |
// pointing at it, which is what that score is for. |
| 367 |
'password_expiration' => array( |
| 368 |
'enabled' => false, |
| 369 |
'expire_days' => 90, |
| 370 |
'warning_days' => 14, |
| 371 |
'affected_roles' => array( 'administrator', 'editor' ), |
| 372 |
'excluded_users' => array(), |
| 373 |
'password_history' => 3, |
| 374 |
'send_reminder' => false, |
| 375 |
), |
| 376 |
|
| 377 |
// Email verification |
| 378 |
'email_verification' => array( |
| 379 |
'enabled' => false, |
| 380 |
'token_expiry_hours' => 24, |
| 381 |
'allow_resend' => true, |
| 382 |
'auto_delete_days' => 7, |
| 383 |
), |
| 384 |
), |
| 385 |
|
| 386 |
// WordPress Hardening (combines wp-config, comments, feeds, head cleaner) |
| 387 |
'wp_hardening' => array( |
| 388 |
'enabled' => true, |
| 389 |
|
| 390 |
// wp-config security |
| 391 |
'disallow_file_edit' => true, |
| 392 |
'disallow_file_mods' => false, |
| 393 |
// Off by default. This one writes FORCE_SSL_ADMIN into |
| 394 |
// wp-config.php, and it used to do so on activation with no |
| 395 |
// check that the site answers over HTTPS at all, which locks the |
| 396 |
// owner out of their own admin. Forcing HTTPS is an opt-in |
| 397 |
// decision per site, consistent with force_https and with HSTS, |
| 398 |
// both of which already ship off. |
| 399 |
'force_ssl_admin' => false, |
| 400 |
'wp_debug' => true, |
| 401 |
// Off by default — only safe when host has a real server-side cron job; |
| 402 |
// pairs with firewall.protect_wp_cron to block both internal triggering |
| 403 |
// (this constant) and external HTTP abuse (the .htaccess rule). |
| 404 |
'disable_wp_cron' => false, |
| 405 |
|
| 406 |
// Comment security |
| 407 |
'disable_pingbacks' => true, |
| 408 |
'disable_trackbacks' => true, |
| 409 |
'require_comment_moderation' => true, |
| 410 |
'close_old_comments' => false, |
| 411 |
'close_comments_after_days' => 30, |
| 412 |
'honeypot_comments' => true, |
| 413 |
|
| 414 |
// Head cleaner |
| 415 |
'remove_wp_generator' => true, |
| 416 |
'remove_wp_version_assets' => false, |
| 417 |
'remove_rsd_link' => true, |
| 418 |
'remove_wlw_manifest' => true, |
| 419 |
'remove_shortlink' => true, |
| 420 |
'remove_rest_api_link' => false, |
| 421 |
|
| 422 |
// Feed manager |
| 423 |
'disable_feeds' => false, |
| 424 |
'disable_if_no_content' => true, |
| 425 |
'remove_feed_version' => true, |
| 426 |
), |
| 427 |
|
| 428 |
// File Integrity settings |
| 429 |
'file_integrity' => array( |
| 430 |
'enabled' => true, |
| 431 |
'scan_core' => true, |
| 432 |
'scan_plugins' => true, |
| 433 |
'scan_themes' => true, |
| 434 |
'scan_uploads' => true, |
| 435 |
'scan_critical_config' => true, |
| 436 |
'check_closed_plugins' => true, |
| 437 |
'auto_scan' => true, |
| 438 |
'scan_frequency' => 'daily', |
| 439 |
'notify_level' => 'suspicious_only', |
| 440 |
'instant_alert' => false, |
| 441 |
'excluded_paths' => array( |
| 442 |
'wp-content/cache', |
| 443 |
), |
| 444 |
'excluded_extensions' => array( |
| 445 |
// Translations (regenerated per-locale, never in checksums). |
| 446 |
'.po', '.mo', '.pot', |
| 447 |
// Binary images (cosmetic, not executable; often rewritten by image-optimizer plugins). |
| 448 |
'.jpg', '.jpeg', '.png', '.gif', '.ico', '.webp', '.avif', |
| 449 |
// Stylesheets: frequently rewritten by themes and optimizer |
| 450 |
// plugins, a common source of post-update false positives. |
| 451 |
// Strict-mode users can remove it (CSS injection is still a |
| 452 |
// vector, defended primarily by CSP in the headers module). |
| 453 |
'.css', |
| 454 |
), |
| 455 |
), |
| 456 |
|
| 457 |
// Activity Log settings |
| 458 |
'activity_log' => array( |
| 459 |
'retention_days' => 30, |
| 460 |
'max_entries' => 10000, |
| 461 |
'log_logins' => true, |
| 462 |
'log_failed_logins' => true, |
| 463 |
'log_user_changes' => true, |
| 464 |
'log_post_changes' => true, |
| 465 |
'log_plugin_changes' => true, |
| 466 |
'log_theme_changes' => true, |
| 467 |
'log_option_changes' => false, |
| 468 |
'log_file_changes' => true, |
| 469 |
'log_comments' => true, |
| 470 |
'log_media' => true, |
| 471 |
'excluded_users' => array(), |
| 472 |
'excluded_ips' => array(), |
| 473 |
'tracked_options' => array(), |
| 474 |
), |
| 475 |
|
| 476 |
// Backup settings |
| 477 |
'backup' => array( |
| 478 |
'keep_backups' => 5, |
| 479 |
), |
| 480 |
|
| 481 |
// Notification settings (centralized recipients for all admin emails) |
| 482 |
'email' => array( |
| 483 |
'send_to_admin_email' => true, |
| 484 |
'additional_recipients' => array(), |
| 485 |
'send_deactivation_email' => true, |
| 486 |
), |
| 487 |
|
| 488 |
// Advanced settings |
| 489 |
'advanced' => array( |
| 490 |
'remove_readme' => true, |
| 491 |
'remove_license' => true, |
| 492 |
), |
| 493 |
|
| 494 |
// Security Analyzer (v2.1.0) — on-demand + weekly Security Check |
| 495 |
'security_analyzer' => array( |
| 496 |
'weekly_scan_enabled' => true, |
| 497 |
'email_on_regression' => false, |
| 498 |
), |
| 499 |
|
| 500 |
// Audit Alerts (v2.8.0) — alerting layer on top of Security Audit. |
| 501 |
// The engine subscribes to logged events and only runs when the |
| 502 |
// Security Audit (activity_log) module is enabled. Opt-in: both |
| 503 |
// legs start OFF so it never duplicates the per-module emails that |
| 504 |
// already exist (User Security admin monitoring, Plugin Status...). |
| 505 |
'audit_alerts' => array( |
| 506 |
// Shared anti-repeat cooldown (minutes). After an alert, do not |
| 507 |
// send another about the same thing (same event type for |
| 508 |
// immediate, same category for threshold) until this passes. |
| 509 |
// Prevents a flood during a sustained attack. |
| 510 |
'cooldown_minutes' => 60, |
| 511 |
// #38 Immediate alerts: selected event types email right away. |
| 512 |
'immediate' => array( |
| 513 |
'enabled' => false, |
| 514 |
// Alert on any logged event at or above this severity. A new |
| 515 |
// admin, a closed plugin or a privilege escalation are all |
| 516 |
// logged as "critical", so "critical" already covers them. |
| 517 |
'min_severity' => 'critical', // 'critical' | 'warning' |
| 518 |
), |
| 519 |
// #10 Threshold alerts: N events of a category within a window. |
| 520 |
'threshold' => array( |
| 521 |
'enabled' => false, |
| 522 |
'window' => '1h', // 30m | 1h | 6h | 24h |
| 523 |
// Per-category trigger counts (warning/critical events only); |
| 524 |
// 0 disables that category. Covers every event type that can |
| 525 |
// log a warning or critical. Keep in sync with |
| 526 |
// Vigilante_Audit_Alerts::category_labels(). |
| 527 |
'categories' => array( |
| 528 |
'firewall' => 50, |
| 529 |
'login' => 20, |
| 530 |
'user' => 5, |
| 531 |
'plugin' => 0, |
| 532 |
'file' => 0, |
| 533 |
'security' => 0, |
| 534 |
'system' => 0, |
| 535 |
'settings' => 0, |
| 536 |
'theme' => 0, |
| 537 |
'content' => 0, |
| 538 |
'comment' => 0, |
| 539 |
'media' => 0, |
| 540 |
), |
| 541 |
), |
| 542 |
), |
| 543 |
); |
| 544 |
} |
| 545 |
|
| 546 |
/** |
| 547 |
* Get all options (merged with defaults) |
| 548 |
* |
| 549 |
* @return array All options |
| 550 |
*/ |
| 551 |
public function get_all_options() { |
| 552 |
if ( null === $this->options ) { |
| 553 |
$saved = get_option( self::OPTION_NAME, array() ); |
| 554 |
$this->options = $this->array_merge_deep( $this->get_default_options(), $saved ); |
| 555 |
} |
| 556 |
return $this->options; |
| 557 |
} |
| 558 |
|
| 559 |
/** |
| 560 |
* Deep merge arrays |
| 561 |
* |
| 562 |
* Associative arrays are merged key by key, because that is what lets a |
| 563 |
* saved option keep working when a release adds a setting. Lists are |
| 564 |
* replaced whole, and that part is not cosmetic: merging a list key by key |
| 565 |
* means index by index, so a stored list shorter than the default came back |
| 566 |
* with the default's tail glued to it. Saving "administrator" alone into |
| 567 |
* enforced_roles (default administrator, editor) was read back as |
| 568 |
* administrator, editor, and unchecking every role was read back as the two |
| 569 |
* defaults, so three role pickers could not be narrowed at all. It is the |
| 570 |
* same bug merge_preset() was given its own merge for in 2.9.8; the fix |
| 571 |
* never reached this one or the one in the admin save. |
| 572 |
* |
| 573 |
* An empty saved list therefore means empty, not "fall back to the default". |
| 574 |
* That is the honest reading of what was saved, and the save path is what |
| 575 |
* makes sure a list only becomes empty when somebody emptied it: a list the |
| 576 |
* form did not carry is left alone rather than blanked. |
| 577 |
* |
| 578 |
* Which of the two happens is decided by the DEFAULT, never by what was |
| 579 |
* saved. Deciding by what was saved looks equivalent and is not: an empty |
| 580 |
* array is a list by any definition, so a section stored as array() would |
| 581 |
* have replaced a whole group of settings instead of merging into it, and |
| 582 |
* every key of that group would have come back missing. Found by the third |
| 583 |
* cross review of this release, measured on rest_api_security (7 keys to 0) |
| 584 |
* and on registration_approval (4 to 0, including its enabled flag). |
| 585 |
* |
| 586 |
* @since 3.0.1 Lists replace instead of merging index by index. |
| 587 |
* |
| 588 |
* @param array $defaults Default values. |
| 589 |
* @param array $saved Saved values. |
| 590 |
* @return array Merged array. |
| 591 |
*/ |
| 592 |
private function array_merge_deep( $defaults, $saved ) { |
| 593 |
$result = $defaults; |
| 594 |
|
| 595 |
foreach ( $saved as $key => $value ) { |
| 596 |
if ( is_array( $value ) && isset( $result[ $key ] ) && is_array( $result[ $key ] ) && ! self::is_list( $result[ $key ] ) ) { |
| 597 |
$result[ $key ] = $this->array_merge_deep( $result[ $key ], $value ); |
| 598 |
} else { |
| 599 |
$result[ $key ] = $value; |
| 600 |
} |
| 601 |
} |
| 602 |
|
| 603 |
return $result; |
| 604 |
} |
| 605 |
|
| 606 |
/** |
| 607 |
* Get a specific section |
| 608 |
* |
| 609 |
* @param string $section Section name. |
| 610 |
* @return array Section options. |
| 611 |
*/ |
| 612 |
public function get_section( $section ) { |
| 613 |
$options = $this->get_all_options(); |
| 614 |
return isset( $options[ $section ] ) ? $options[ $section ] : array(); |
| 615 |
} |
| 616 |
|
| 617 |
/** |
| 618 |
* Get a specific option |
| 619 |
* |
| 620 |
* @param string $section Section name. |
| 621 |
* @param string $key Option key. |
| 622 |
* @param mixed $default Default value. |
| 623 |
* @return mixed Option value. |
| 624 |
*/ |
| 625 |
public function get_option( $section, $key, $default = null ) { |
| 626 |
$options = $this->get_all_options(); |
| 627 |
|
| 628 |
if ( isset( $options[ $section ][ $key ] ) ) { |
| 629 |
return $options[ $section ][ $key ]; |
| 630 |
} |
| 631 |
|
| 632 |
return $default; |
| 633 |
} |
| 634 |
|
| 635 |
/** |
| 636 |
* Check if a module is enabled |
| 637 |
* |
| 638 |
* @param string $module Module name. |
| 639 |
* @return bool Whether module is enabled. |
| 640 |
*/ |
| 641 |
public function is_module_enabled( $module ) { |
| 642 |
$options = $this->get_all_options(); |
| 643 |
return ! empty( $options['modules'][ $module ] ); |
| 644 |
} |
| 645 |
|
| 646 |
/** |
| 647 |
* Save options |
| 648 |
* |
| 649 |
* @param array $options Options to save. |
| 650 |
* @return bool Success status. |
| 651 |
*/ |
| 652 |
public function save_options( $options ) { |
| 653 |
$this->options = null; |
| 654 |
return update_option( self::OPTION_NAME, $options ); |
| 655 |
} |
| 656 |
|
| 657 |
/** |
| 658 |
* Update a section |
| 659 |
* |
| 660 |
* @param string $section Section name. |
| 661 |
* @param array $data Section data. |
| 662 |
* @return bool Success status. |
| 663 |
*/ |
| 664 |
public function update_section( $section, $data ) { |
| 665 |
$options = get_option( self::OPTION_NAME, array() ); |
| 666 |
$options[ $section ] = $data; |
| 667 |
$this->options = null; |
| 668 |
return update_option( self::OPTION_NAME, $options ); |
| 669 |
} |
| 670 |
|
| 671 |
/** |
| 672 |
* Update multiple sections at once |
| 673 |
* |
| 674 |
* @param array $sections Associative array of section => data. |
| 675 |
* @return bool Success status. |
| 676 |
*/ |
| 677 |
public function update_options( $sections ) { |
| 678 |
$options = get_option( self::OPTION_NAME, array() ); |
| 679 |
|
| 680 |
foreach ( $sections as $section => $data ) { |
| 681 |
$options[ $section ] = $data; |
| 682 |
} |
| 683 |
|
| 684 |
$this->options = null; |
| 685 |
return update_option( self::OPTION_NAME, $options ); |
| 686 |
} |
| 687 |
|
| 688 |
/** |
| 689 |
* Clear the options cache |
| 690 |
*/ |
| 691 |
public function clear_cache() { |
| 692 |
$this->options = null; |
| 693 |
wp_cache_delete( self::OPTION_NAME, 'options' ); |
| 694 |
} |
| 695 |
|
| 696 |
/** |
| 697 |
* Whether this context is allowed to write the files a network shares |
| 698 |
* |
| 699 |
* wp-config.php and the root .htaccess are single files for the whole |
| 700 |
* network, while Vigilant's settings are per site. Without a gate, every |
| 701 |
* save, activation and deactivation from any site rewrites those files from |
| 702 |
* that site's own options, so the last one to save wins and silently undoes |
| 703 |
* the rest. Measured on a real network: the main site enables "disable file |
| 704 |
* editing", a subsite admin presses Save on their own screen without |
| 705 |
* touching it, and the constant disappears from wp-config.php while the main |
| 706 |
* site's screen keeps showing the box ticked. |
| 707 |
* |
| 708 |
* So on a network only the main site decides, and only a network |
| 709 |
* administrator. WP-CLI on the main site counts too: there is no user to ask |
| 710 |
* there, but the site is the right one, and a network admin running |
| 711 |
* `wp plugin activate --network` expects the files to be written. |
| 712 |
* |
| 713 |
* On a single site this is always true and nothing changes. |
| 714 |
* |
| 715 |
* @since 2.9.8 |
| 716 |
* |
| 717 |
* @return bool |
| 718 |
*/ |
| 719 |
/** |
| 720 |
* Whether this site is the one that owns the files a network shares. |
| 721 |
* |
| 722 |
* Pure site identity, with no capability in it, and that is the point. A |
| 723 |
* refresh that Vigilant performs by itself, such as rewriting its own |
| 724 |
* .htaccess block after an update, decides nothing: the content comes from |
| 725 |
* this site's own options whoever happens to be visiting. What must not |
| 726 |
* happen is a *different* site writing the shared file, and that is exactly |
| 727 |
* what this answers. |
| 728 |
* |
| 729 |
* can_write_shared_files() below adds the capability on top, and is the |
| 730 |
* right question for anything a person initiates from a settings screen. |
| 731 |
* |
| 732 |
* @since 2.10.1 |
| 733 |
* @return bool |
| 734 |
*/ |
| 735 |
public static function owns_shared_files() { |
| 736 |
// One wp-config.php and one root .htaccess per installation, even with |
| 737 |
// several networks in it: is_main_site() alone is true on the main site |
| 738 |
// of every network. Since 2.11.8, found by the audit of the network. |
| 739 |
return ! is_multisite() || ( is_main_site() && is_main_network() ); |
| 740 |
} |
| 741 |
|
| 742 |
public static function can_write_shared_files() { |
| 743 |
if ( ! is_multisite() ) { |
| 744 |
return true; |
| 745 |
} |
| 746 |
|
| 747 |
// See owns_shared_files(): the main site of a secondary network, and |
| 748 |
// its network administrator, do not own the installation's files. |
| 749 |
if ( ! is_main_site() || ! is_main_network() ) { |
| 750 |
return false; |
| 751 |
} |
| 752 |
|
| 753 |
// WP-CLI with nobody logged in: there is no user to ask, and the site is |
| 754 |
// the right one, so a network admin running `wp plugin activate --network` |
| 755 |
// gets the files written. With a user set (wp --user=...) the capability |
| 756 |
// is checked like anywhere else, so the gate cannot be side-stepped by |
| 757 |
// running as a subsite administrator. |
| 758 |
if ( defined( 'WP_CLI' ) && WP_CLI && ! get_current_user_id() ) { |
| 759 |
return true; |
| 760 |
} |
| 761 |
|
| 762 |
return current_user_can( 'manage_network_options' ); |
| 763 |
} |
| 764 |
|
| 765 |
/** |
| 766 |
* The one message shown wherever a shared-file setting is out of reach |
| 767 |
* |
| 768 |
* Deliberately a single string reused by every section, instead of one per |
| 769 |
* section: it says the same thing everywhere and there is no reason to make |
| 770 |
* translators write it four times. |
| 771 |
* |
| 772 |
* @since 2.9.8 |
| 773 |
* |
| 774 |
* @return string |
| 775 |
*/ |
| 776 |
public static function get_shared_files_notice() { |
| 777 |
return __( 'These settings are written to wp-config.php and .htaccess, files the whole network shares. So that one site cannot overwrite another, they are managed from the main site of the network by a network administrator.', 'vigilante' ); |
| 778 |
} |
| 779 |
|
| 780 |
/** |
| 781 |
* Apply the tweaks a brand new installation gets on top of the raw defaults |
| 782 |
* |
| 783 |
* A few keys are deliberately missing from get_default_options() because |
| 784 |
* declaring them would break something else. XML-RPC is the one case today: |
| 785 |
* declaring wp_hardening.xmlrpc_mode would make the defaults merge fill it in |
| 786 |
* always and hide the fallback that reads the old pair of settings on sites |
| 787 |
* that have not re-saved the tab. With nothing stored the resolver answers |
| 788 |
* 'full', which blocks XML-RPC completely, and that is not what we want a new |
| 789 |
* site to get. |
| 790 |
* |
| 791 |
* Everything that seeds a clean configuration has to run this: the activation |
| 792 |
* hook, the per-section reset and the global reset to defaults. Otherwise the |
| 793 |
* defaults you get by pressing a button are not the defaults you get by |
| 794 |
* installing the plugin, which is exactly what happened until 2.9.8. |
| 795 |
* |
| 796 |
* @since 2.9.8 |
| 797 |
* |
| 798 |
* @param array $options Options array to adjust. |
| 799 |
* @return array |
| 800 |
*/ |
| 801 |
public static function apply_install_tweaks( $options ) { |
| 802 |
if ( ! isset( $options['wp_hardening'] ) || ! is_array( $options['wp_hardening'] ) ) { |
| 803 |
$options['wp_hardening'] = array(); |
| 804 |
} |
| 805 |
|
| 806 |
$options['wp_hardening']['xmlrpc_mode'] = 'pingback'; |
| 807 |
|
| 808 |
return $options; |
| 809 |
} |
| 810 |
|
| 811 |
/** |
| 812 |
* Keys that hold what the site owner typed in, never wiped by a restore |
| 813 |
* |
| 814 |
* Putting the security posture back to its defaults is one thing; deleting |
| 815 |
* an IP whitelist, the secret login address, the two factor setup or the |
| 816 |
* addresses that receive the alerts is another, and nobody presses a button |
| 817 |
* called "restore defaults" expecting that. Both the Standard preset and the |
| 818 |
* two reset buttons leave these alone. |
| 819 |
* |
| 820 |
* Read from outside the plugin: the third-party network plugin Vigilante |
| 821 |
* Network Sync calls this from its 2.0.3 to decide what NOT to copy between |
| 822 |
* the sites of a network, so a key it does not know about is preserved per |
| 823 |
* site instead of overwritten. Adding keys here is safe and helps it; |
| 824 |
* renaming or removing the method, or changing the shape of what it returns, |
| 825 |
* silently changes what that plugin replicates across a whole network. |
| 826 |
* |
| 827 |
* @since 2.9.8 |
| 828 |
* |
| 829 |
* @return array<string,string[]> |
| 830 |
*/ |
| 831 |
public static function get_user_data_keys() { |
| 832 |
return array( |
| 833 |
'firewall' => array( 'ip_whitelist', 'ip_blacklist', 'ua_whitelist', 'ua_blacklist', 'trusted_proxy_header', 'trusted_proxies' ), |
| 834 |
'login_security' => array( 'ip_whitelist', 'custom_login_url', 'two_factor' ), |
| 835 |
'user_security' => array( 'insecure_usernames' ), |
| 836 |
'file_integrity' => array( 'excluded_paths', 'excluded_extensions' ), |
| 837 |
'email' => array( 'additional_recipients' ), |
| 838 |
); |
| 839 |
} |
| 840 |
|
| 841 |
/** |
| 842 |
* Settings whose only effect is written to a file the network shares |
| 843 |
* |
| 844 |
* true for a whole section, or the list of keys inside it. Used to keep a |
| 845 |
* subsite from resetting settings it does not control: the file is written |
| 846 |
* from the main site, so resetting the local copy would only make the two |
| 847 |
* disagree. |
| 848 |
* |
| 849 |
* Note this is not every setting that reaches .htaccess. Blocking bad bots |
| 850 |
* or empty user agents also runs in PHP, per site, so those stay editable on |
| 851 |
* a subsite: the PHP half protects that site and the .htaccess half is |
| 852 |
* refused, leaving the main site's rules standing. On the main site they |
| 853 |
* are locked too, see get_main_site_file_settings(). |
| 854 |
* |
| 855 |
* The PHP blocks for plugins and themes have no field on the settings |
| 856 |
* screen, but an imported file carries them, and readme.html and |
| 857 |
* license.txt are removed from the root the whole network shares. |
| 858 |
* |
| 859 |
* @since 2.9.8 |
| 860 |
* |
| 861 |
* @return array<string,true|string[]> |
| 862 |
*/ |
| 863 |
public static function get_shared_file_settings() { |
| 864 |
return array( |
| 865 |
'security_headers' => true, |
| 866 |
'wp_hardening' => array( 'disallow_file_edit', 'disallow_file_mods', 'force_ssl_admin', 'force_ssl_login', 'wp_debug', 'disable_wp_cron' ), |
| 867 |
'firewall' => array( 'disable_directory_browsing', 'protect_wp_config', 'protect_wp_includes', 'protect_uploads_php', 'protect_sensitive_files', 'protect_wp_cron', 'limit_http_methods', 'block_php_in_plugins', 'block_php_in_themes' ), |
| 868 |
'advanced' => array( 'remove_readme', 'remove_license' ), |
| 869 |
); |
| 870 |
} |
| 871 |
|
| 872 |
/** |
| 873 |
* Settings the shared files are built from that also act on the site storing them |
| 874 |
* |
| 875 |
* get_shared_file_settings() lists what does nothing but end up in a shared |
| 876 |
* file. These do both: blocking bad bots and bad query strings, the visitor |
| 877 |
* IP detection and the two whitelists run in PHP for the site that stores |
| 878 |
* them, and on the main site of a network they are also what the .htaccess |
| 879 |
* rules of every site are generated from; the three writing module switches |
| 880 |
* (firewall, security_headers, wp_hardening) decide whether the .htaccess |
| 881 |
* blocks and the wp-config.php constants exist at all. |
| 882 |
* |
| 883 |
* Since 2.11.8 it also locks what decides whether the shared files are |
| 884 |
* WATCHED, not built: the File Integrity module and its scan_critical_config |
| 885 |
* switch. On the main site the critical-file scan is the network's canary |
| 886 |
* for a change to wp-config.php or the root .htaccess, which only a network |
| 887 |
* administrator can approve, so a main-site administrator without network |
| 888 |
* rights must not be able to silence it by turning either one off. Closing |
| 889 |
* the ignore list and the clear-results button in 2.11.8 left these two as |
| 890 |
* the remaining routes; found by the audit of the admin surface. |
| 891 |
* |
| 892 |
* Since 3.0.0 the self-check has no setting at all, so there is nothing to lock: Vigilant's own |
| 893 |
* files are shared by every site, and on the main site the self-check is |
| 894 |
* the one that reports a change to them for the whole network. |
| 895 |
* |
| 896 |
* On a subsite all of them only act on that site, so they stay editable |
| 897 |
* there (get_locked_file_settings() adds this set only when owns_shared_files()). |
| 898 |
* |
| 899 |
* Until 2.11.6 an administrator of the main site without network rights |
| 900 |
* could change any of them, and the file-only ones too: the write to the |
| 901 |
* file was refused at that moment, but the value stayed stored, and the |
| 902 |
* refresh after the next update, or the next save by a network |
| 903 |
* administrator, published it to the whole network. |
| 904 |
* |
| 905 |
* @since 2.11.6 |
| 906 |
* @since 2.11.8 The file_integrity module and scan_critical_config. |
| 907 |
* |
| 908 |
* @return array<string,string[]> |
| 909 |
*/ |
| 910 |
/** |
| 911 |
* The two factor policy that governs this installation |
| 912 |
* |
| 913 |
* On a network the answer must not depend on which site the login happens to |
| 914 |
* arrive at, because the cookie WordPress issues does not: COOKIEHASH comes |
| 915 |
* from the network siteurl (wp-includes/default-constants.php) and |
| 916 |
* COOKIE_DOMAIN covers every host of the network |
| 917 |
* (wp-includes/ms-default-constants.php). Until 2.11.10 the settings, the |
| 918 |
* enforced roles and the TOTP table were all read per site, so somebody |
| 919 |
* holding the password of an administrator protected by 2FA on the main site |
| 920 |
* posted the login to a subsite where that account has no role, was never |
| 921 |
* asked for a code, and came out with a session valid across the network. |
| 922 |
* Measured on the Multisite install on 12 sep 2026 (user_requires_2fa true on |
| 923 |
* the main site, false on demo2 for the same account) and found by the |
| 924 |
* file-by-file review of 2.11.10. |
| 925 |
* |
| 926 |
* So the policy of the main site governs the whole network. On a single site |
| 927 |
* this is the site's own configuration and nothing changes. |
| 928 |
* |
| 929 |
* @since 2.11.10 |
| 930 |
* |
| 931 |
* @return array The two_factor section that applies. |
| 932 |
*/ |
| 933 |
public static function two_factor_policy() { |
| 934 |
$options = is_multisite() |
| 935 |
? get_blog_option( get_main_site_id(), self::OPTION_NAME, array() ) |
| 936 |
: get_option( self::OPTION_NAME, array() ); |
| 937 |
|
| 938 |
if ( ! is_array( $options ) ) { |
| 939 |
return array(); |
| 940 |
} |
| 941 |
|
| 942 |
$login = isset( $options['login_security'] ) && is_array( $options['login_security'] ) |
| 943 |
? $options['login_security'] |
| 944 |
: array(); |
| 945 |
|
| 946 |
return ( isset( $login['two_factor'] ) && is_array( $login['two_factor'] ) ) ? $login['two_factor'] : array(); |
| 947 |
} |
| 948 |
|
| 949 |
/** |
| 950 |
* Whether two factor is required for this account, anywhere in the network |
| 951 |
* |
| 952 |
* Union, and deliberately so. Reading the policy only from the main site, |
| 953 |
* which is what this release did at first, would have switched two factor off |
| 954 |
* for every network that has it configured per subsite, which until now was |
| 955 |
* the only way it could be configured at all: a silent downgrade of the very |
| 956 |
* protection being fixed. Found by the cross review of 2.11.10. So the |
| 957 |
* question is asked of every site the account belongs to, plus the main site, |
| 958 |
* each with its own enforced roles and exclusions, and one yes is enough. |
| 959 |
* |
| 960 |
* That also closes the bypass: the settings, the roles and the enrolment used |
| 961 |
* to be read from whichever site the login arrived at, while the cookie |
| 962 |
* WordPress issues is valid across the whole network (COOKIEHASH comes from |
| 963 |
* the network siteurl and COOKIE_DOMAIN covers every host of it), so an |
| 964 |
* account protected on one site could log in through another and come out |
| 965 |
* with a session valid everywhere. |
| 966 |
* |
| 967 |
* @since 2.11.10 |
| 968 |
* |
| 969 |
* @param WP_User $user User being authenticated. |
| 970 |
* @return bool |
| 971 |
*/ |
| 972 |
public static function two_factor_required_for( $user ) { |
| 973 |
return array() !== self::two_factor_demands_for( $user ); |
| 974 |
} |
| 975 |
|
| 976 |
/** |
| 977 |
* Which second factor methods this account is asked for, across the network |
| 978 |
* |
| 979 |
* Empty when nothing asks. On a network there can be more than one, because |
| 980 |
* each site keeps its own settings and the requirement is the union of them. |
| 981 |
* |
| 982 |
* @since 2.11.10 |
| 983 |
* |
| 984 |
* @param WP_User $user User being authenticated. |
| 985 |
* @return string[] Methods asked for, without repeats. |
| 986 |
*/ |
| 987 |
public static function two_factor_methods_for( $user ) { |
| 988 |
$methods = array(); |
| 989 |
|
| 990 |
foreach ( self::two_factor_demands_for( $user ) as $settings ) { |
| 991 |
$method = isset( $settings['method'] ) ? (string) $settings['method'] : 'email'; |
| 992 |
|
| 993 |
// A method this version does not know is read as the default rather |
| 994 |
// than left to fall through. Registering nothing at all is how the |
| 995 |
// second factor of a whole network went quiet in silence: a saved |
| 996 |
// value of '' (which validate_section() lets through on an import, |
| 997 |
// since only the tab has an allowlist) matched neither class, so no |
| 998 |
// filter was registered anywhere while every screen still said two |
| 999 |
// factor was on. Found by the third cross review of 2.11.10. |
| 1000 |
$methods[] = in_array( $method, array( 'email', 'totp' ), true ) ? $method : 'email'; |
| 1001 |
} |
| 1002 |
|
| 1003 |
return array_values( array_unique( $methods ) ); |
| 1004 |
} |
| 1005 |
|
| 1006 |
/** |
| 1007 |
* Which of the two second factor classes handles this login |
| 1008 |
* |
| 1009 |
* The method cannot be read from one site's settings, and reading it from the |
| 1010 |
* main site was the hole the third cross review of 2.11.10 found: with the |
| 1011 |
* main site on totp and a subsite asking for a code by email, the class that |
| 1012 |
* registered was TOTP, the account had no enrolment, and the "not set up yet" |
| 1013 |
* branch let the login through. In 2.11.9 that same login was asked for its |
| 1014 |
* emailed code. So the question is asked per account, not per site. |
| 1015 |
* |
| 1016 |
* The order is what keeps it closed at both ends: |
| 1017 |
* |
| 1018 |
* 1. An enrolment already made wins while some site asking for a second |
| 1019 |
* factor asks for an authenticator app. It is the strongest factor the |
| 1020 |
* account has and it is ready to use, wherever in the network it was set |
| 1021 |
* up. |
| 1022 |
* 2. Otherwise, if any site asking for a second factor asks for email, email |
| 1023 |
* handles it. Email needs no enrolment, so it can never fall into the |
| 1024 |
* branch that lets a login through for lack of one. |
| 1025 |
* 3. Only when every site asking wants an authenticator app does TOTP handle |
| 1026 |
* it, which is the case the grace period was written for. |
| 1027 |
* |
| 1028 |
* The condition on the first step came in 2.11.11. Without it an enrolment |
| 1029 |
* left from a time when the site asked for an app outranked the method the |
| 1030 |
* site asks for now: a single site set to email asked those accounts for an |
| 1031 |
* authenticator code, which 2.11.9 never did and which locks out whoever |
| 1032 |
* removed the app after the switch. Dropping that enrolment opens nothing, |
| 1033 |
* because the account then goes to email, which needs no enrolment. |
| 1034 |
* |
| 1035 |
* @since 2.11.10 |
| 1036 |
* @since 2.11.11 An enrolment only wins while an authenticator app is asked for. |
| 1037 |
* |
| 1038 |
* @param WP_User $user User being authenticated. |
| 1039 |
* @param bool $enrolled Whether the account has a TOTP enrolment anywhere. |
| 1040 |
* @return string 'email', 'totp', or '' when nothing asks. |
| 1041 |
*/ |
| 1042 |
public static function two_factor_handler_for( $user, $enrolled ) { |
| 1043 |
$methods = self::two_factor_methods_for( $user ); |
| 1044 |
|
| 1045 |
if ( ! $methods ) { |
| 1046 |
return ''; |
| 1047 |
} |
| 1048 |
|
| 1049 |
if ( $enrolled && in_array( 'totp', $methods, true ) ) { |
| 1050 |
return 'totp'; |
| 1051 |
} |
| 1052 |
|
| 1053 |
return in_array( 'email', $methods, true ) ? 'email' : 'totp'; |
| 1054 |
} |
| 1055 |
|
| 1056 |
/** |
| 1057 |
* The two factor settings of every site that asks this account for one |
| 1058 |
* |
| 1059 |
* @since 2.11.10 |
| 1060 |
* |
| 1061 |
* @param WP_User $user User being authenticated. |
| 1062 |
* @return array[] The two_factor section of each site that asks. |
| 1063 |
*/ |
| 1064 |
private static function two_factor_demands_for( $user ) { |
| 1065 |
if ( empty( $user->ID ) ) { |
| 1066 |
return array(); |
| 1067 |
} |
| 1068 |
|
| 1069 |
if ( ! is_multisite() ) { |
| 1070 |
$roles = ( isset( $user->roles ) && is_array( $user->roles ) ) ? $user->roles : array(); |
| 1071 |
$policy = self::two_factor_policy(); |
| 1072 |
|
| 1073 |
return self::two_factor_site_requires( $policy, $user, $roles ) ? array( $policy ) : array(); |
| 1074 |
} |
| 1075 |
|
| 1076 |
$demands = array(); |
| 1077 |
$blog_ids = array( (int) get_main_site_id() ); |
| 1078 |
|
| 1079 |
/* |
| 1080 |
* A super administrator is a member of almost no site (measured on the |
| 1081 |
* Multisite install: of three sites, the network owner belongs to one), |
| 1082 |
* yet can log in through any of them and the cookie is valid everywhere. |
| 1083 |
* Asking only the sites they belong to left the account with the most |
| 1084 |
* power in the network outside the policy, which is the bypass upside |
| 1085 |
* down. So for them every site of the network is consulted. There are |
| 1086 |
* few super administrators. It does not only run at login, though, which |
| 1087 |
* this note claimed until 2.11.11: the dashboard hooks of the TOTP class |
| 1088 |
* ask it on every admin screen of every site of a network, at least once |
| 1089 |
* per hook. |
| 1090 |
*/ |
| 1091 |
if ( is_super_admin( $user->ID ) ) { |
| 1092 |
$blog_ids = array_merge( $blog_ids, get_sites( array( 'fields' => 'ids', 'number' => 200 ) ) ); |
| 1093 |
} |
| 1094 |
|
| 1095 |
foreach ( get_blogs_of_user( $user->ID ) as $blog ) { |
| 1096 |
if ( ! empty( $blog->userblog_id ) ) { |
| 1097 |
$blog_ids[] = (int) $blog->userblog_id; |
| 1098 |
} |
| 1099 |
} |
| 1100 |
|
| 1101 |
foreach ( array_unique( $blog_ids ) as $blog_id ) { |
| 1102 |
$options = get_blog_option( $blog_id, self::OPTION_NAME, array() ); |
| 1103 |
|
| 1104 |
if ( ! is_array( $options ) || empty( $options['login_security']['two_factor'] ) ) { |
| 1105 |
continue; |
| 1106 |
} |
| 1107 |
|
| 1108 |
/* |
| 1109 |
* A site whose Login Security module is off asks for nothing, and |
| 1110 |
* reading only the sub-setting made it ask anyway: a subsite that had |
| 1111 |
* switched the whole module off, leaving an orphan two_factor.enabled |
| 1112 |
* behind, imposed a second factor on every account of the network, |
| 1113 |
* with no screen anywhere explaining why. It is the two-level toggle |
| 1114 |
* trap of this plugin read upside down. Found by the third cross |
| 1115 |
* review of 2.11.10. |
| 1116 |
*/ |
| 1117 |
if ( empty( $options['modules']['login_security'] ) ) { |
| 1118 |
continue; |
| 1119 |
} |
| 1120 |
|
| 1121 |
$elsewhere = new WP_User( $user->ID ); |
| 1122 |
$elsewhere->for_site( $blog_id ); |
| 1123 |
|
| 1124 |
// A super administrator can hold no role row anywhere, and is judged |
| 1125 |
// as an administrator so the strictest policy of the network reaches |
| 1126 |
// the account with the most power in it. |
| 1127 |
$roles = ( isset( $elsewhere->roles ) && is_array( $elsewhere->roles ) && $elsewhere->roles ) |
| 1128 |
? $elsewhere->roles |
| 1129 |
: ( is_super_admin( $user->ID ) ? array( 'administrator' ) : array() ); |
| 1130 |
|
| 1131 |
if ( self::two_factor_site_requires( $options['login_security']['two_factor'], $user, $roles ) ) { |
| 1132 |
$demands[] = $options['login_security']['two_factor']; |
| 1133 |
} |
| 1134 |
} |
| 1135 |
|
| 1136 |
return $demands; |
| 1137 |
} |
| 1138 |
|
| 1139 |
/** |
| 1140 |
* Whether one site's two factor settings cover this account |
| 1141 |
* |
| 1142 |
* @since 2.11.10 |
| 1143 |
* |
| 1144 |
* @param array $settings The two_factor section of one site. |
| 1145 |
* @param WP_User $user User being authenticated. |
| 1146 |
* @param string[] $roles Roles the account holds on that site. |
| 1147 |
* @return bool |
| 1148 |
*/ |
| 1149 |
private static function two_factor_site_requires( $settings, $user, $roles ) { |
| 1150 |
if ( ! is_array( $settings ) || empty( $settings['enabled'] ) ) { |
| 1151 |
return false; |
| 1152 |
} |
| 1153 |
|
| 1154 |
$excluded = isset( $settings['excluded_users'] ) ? array_map( 'absint', (array) $settings['excluded_users'] ) : array(); |
| 1155 |
|
| 1156 |
if ( in_array( (int) $user->ID, $excluded, true ) ) { |
| 1157 |
return false; |
| 1158 |
} |
| 1159 |
|
| 1160 |
$enforced = isset( $settings['enforced_roles'] ) ? (array) $settings['enforced_roles'] : array( 'administrator', 'editor' ); |
| 1161 |
|
| 1162 |
return (bool) array_intersect( (array) $roles, $enforced ); |
| 1163 |
} |
| 1164 |
|
| 1165 |
/** |
| 1166 |
* Settings that only a network administrator may change on the main site |
| 1167 |
* |
| 1168 |
* @return array<string,string[]> |
| 1169 |
*/ |
| 1170 |
public static function get_main_site_file_settings() { |
| 1171 |
return array( |
| 1172 |
'modules' => array( 'firewall', 'security_headers', 'wp_hardening', 'file_integrity' ), |
| 1173 |
// trusted_proxies goes with trusted_proxy_header, and leaving it out |
| 1174 |
// was a hole: the header decides which address the firewall of the |
| 1175 |
// whole installation acts on, and this list decides which peers may |
| 1176 |
// set that header. An administrator of the main site without network |
| 1177 |
// rights who could edit only this half turned every visitor into a |
| 1178 |
// trusted proxy. Found by the file-by-file review of 2.11.10. |
| 1179 |
'firewall' => array( 'block_bad_bots', 'block_bad_query_strings', 'trusted_proxy_header', 'trusted_proxies', 'ip_whitelist', 'ua_whitelist' ), |
| 1180 |
'file_integrity' => array( 'scan_critical_config' ), |
| 1181 |
); |
| 1182 |
} |
| 1183 |
|
| 1184 |
/** |
| 1185 |
* Shared file settings the current user may not change on this site |
| 1186 |
* |
| 1187 |
* Empty when the user can write the shared files. Otherwise the file-only |
| 1188 |
* settings on every site, plus, on the main site, the ones it also builds |
| 1189 |
* the shared files from. |
| 1190 |
* |
| 1191 |
* @since 2.11.6 |
| 1192 |
* |
| 1193 |
* @return array<string,true|string[]> |
| 1194 |
*/ |
| 1195 |
public static function get_locked_file_settings() { |
| 1196 |
if ( self::can_write_shared_files() ) { |
| 1197 |
return array(); |
| 1198 |
} |
| 1199 |
|
| 1200 |
$locked = self::get_shared_file_settings(); |
| 1201 |
|
| 1202 |
if ( self::owns_shared_files() ) { |
| 1203 |
foreach ( self::get_main_site_file_settings() as $section => $keys ) { |
| 1204 |
if ( ! isset( $locked[ $section ] ) ) { |
| 1205 |
$locked[ $section ] = $keys; |
| 1206 |
} elseif ( is_array( $locked[ $section ] ) ) { |
| 1207 |
$locked[ $section ] = array_values( array_unique( array_merge( $locked[ $section ], $keys ) ) ); |
| 1208 |
} |
| 1209 |
} |
| 1210 |
} |
| 1211 |
|
| 1212 |
return $locked; |
| 1213 |
} |
| 1214 |
|
| 1215 |
/** |
| 1216 |
* Put back the stored value of every shared file setting the user may not change |
| 1217 |
* |
| 1218 |
* For every writer of the whole configuration: saving a tab, importing a |
| 1219 |
* file, applying a preset, restoring the defaults. Hiding a field on the |
| 1220 |
* screen decides nothing, because the request can carry the key anyway. A |
| 1221 |
* key that was not stored is dropped, so its default keeps applying. |
| 1222 |
* |
| 1223 |
* @since 2.11.6 |
| 1224 |
* |
| 1225 |
* @param array $options Configuration about to be stored. |
| 1226 |
* @param array $stored Configuration stored now, as read from the option. |
| 1227 |
* @return array |
| 1228 |
*/ |
| 1229 |
public static function keep_locked_file_settings( $options, $stored ) { |
| 1230 |
$options = is_array( $options ) ? $options : array(); |
| 1231 |
$stored = is_array( $stored ) ? $stored : array(); |
| 1232 |
$locked = self::get_locked_file_settings(); |
| 1233 |
|
| 1234 |
if ( ! $locked ) { |
| 1235 |
return $options; |
| 1236 |
} |
| 1237 |
|
| 1238 |
/* |
| 1239 |
* A key that was never stored takes its default, which is what it was |
| 1240 |
* worth before. Until 2.11.8 it was dropped instead, and the sanitize |
| 1241 |
* callback of the option filled it in again, but validate_options() |
| 1242 |
* fills a missing module switch with false, not with its default. |
| 1243 |
*/ |
| 1244 |
$instance = new self(); |
| 1245 |
$defaults = $instance->get_default_options(); |
| 1246 |
|
| 1247 |
foreach ( $locked as $section => $keys ) { |
| 1248 |
if ( true === $keys ) { |
| 1249 |
if ( array_key_exists( $section, $stored ) ) { |
| 1250 |
$options[ $section ] = $stored[ $section ]; |
| 1251 |
} elseif ( isset( $defaults[ $section ] ) ) { |
| 1252 |
$options[ $section ] = $defaults[ $section ]; |
| 1253 |
} else { |
| 1254 |
unset( $options[ $section ] ); |
| 1255 |
} |
| 1256 |
continue; |
| 1257 |
} |
| 1258 |
|
| 1259 |
$stored_section = ( isset( $stored[ $section ] ) && is_array( $stored[ $section ] ) ) ? $stored[ $section ] : array(); |
| 1260 |
$default_section = ( isset( $defaults[ $section ] ) && is_array( $defaults[ $section ] ) ) ? $defaults[ $section ] : array(); |
| 1261 |
|
| 1262 |
foreach ( $keys as $key ) { |
| 1263 |
if ( array_key_exists( $key, $stored_section ) ) { |
| 1264 |
$value = $stored_section[ $key ]; |
| 1265 |
} elseif ( array_key_exists( $key, $default_section ) ) { |
| 1266 |
$value = $default_section[ $key ]; |
| 1267 |
} else { |
| 1268 |
if ( isset( $options[ $section ] ) && is_array( $options[ $section ] ) ) { |
| 1269 |
unset( $options[ $section ][ $key ] ); |
| 1270 |
} |
| 1271 |
continue; |
| 1272 |
} |
| 1273 |
|
| 1274 |
if ( ! isset( $options[ $section ] ) || ! is_array( $options[ $section ] ) ) { |
| 1275 |
$options[ $section ] = array(); |
| 1276 |
} |
| 1277 |
$options[ $section ][ $key ] = $value; |
| 1278 |
} |
| 1279 |
} |
| 1280 |
|
| 1281 |
return $options; |
| 1282 |
} |
| 1283 |
|
| 1284 |
/** |
| 1285 |
* Take a lock kept as a row of the options table, or report that another request holds it |
| 1286 |
* |
| 1287 |
* add_option() cannot be a lock: it runs INSERT ... ON DUPLICATE KEY UPDATE |
| 1288 |
* (wp-includes/option.php:1142 in WP 7.1), so two requests that both find |
| 1289 |
* the option missing both "create" it and both believe they hold it. INSERT |
| 1290 |
* IGNORE creates the row for exactly one of them, which is what core does in |
| 1291 |
* WP_Upgrader::create_lock() (wp-admin/includes/class-wp-upgrader.php:1065). |
| 1292 |
* A lock older than the timeout counts as abandoned, by a fatal error between |
| 1293 |
* taking and releasing it, and only one request takes it over. |
| 1294 |
* |
| 1295 |
* @since 2.11.8 |
| 1296 |
* |
| 1297 |
* @param string $name Option name of the lock, in the current site's table. |
| 1298 |
* @param int $timeout Seconds after which a held lock counts as abandoned. |
| 1299 |
* @return bool True if this request now holds the lock. |
| 1300 |
*/ |
| 1301 |
public static function acquire_option_lock( $name, $timeout ) { |
| 1302 |
global $wpdb; |
| 1303 |
|
| 1304 |
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- an atomic lock needs INSERT IGNORE, which the options API does not offer; same query as WP_Upgrader::create_lock(). |
| 1305 |
if ( $wpdb->query( $wpdb->prepare( "INSERT IGNORE INTO {$wpdb->options} ( option_name, option_value, autoload ) VALUES ( %s, %s, 'no' )", $name, (string) time() ) ) ) { |
| 1306 |
wp_cache_delete( $name, 'options' ); |
| 1307 |
return true; |
| 1308 |
} |
| 1309 |
|
| 1310 |
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- the lock row as stored right now, not a cached copy. |
| 1311 |
$held = $wpdb->get_var( $wpdb->prepare( "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s", $name ) ); |
| 1312 |
|
| 1313 |
if ( null === $held || ( time() - (int) $held ) < $timeout ) { |
| 1314 |
return false; |
| 1315 |
} |
| 1316 |
|
| 1317 |
// Abandoned: the delete only matches the value that was read, and only one |
| 1318 |
// request wins the insert that follows. |
| 1319 |
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- removes an abandoned lock row. |
| 1320 |
$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->options} WHERE option_name = %s AND option_value = %s", $name, $held ) ); |
| 1321 |
|
| 1322 |
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- same atomic insert as above. |
| 1323 |
return (bool) $wpdb->query( $wpdb->prepare( "INSERT IGNORE INTO {$wpdb->options} ( option_name, option_value, autoload ) VALUES ( %s, %s, 'no' )", $name, (string) time() ) ); |
| 1324 |
} |
| 1325 |
|
| 1326 |
/** |
| 1327 |
* Release a lock taken with acquire_option_lock() |
| 1328 |
* |
| 1329 |
* @since 2.11.8 |
| 1330 |
* |
| 1331 |
* @param string $name Option name of the lock. |
| 1332 |
*/ |
| 1333 |
public static function release_option_lock( $name ) { |
| 1334 |
global $wpdb; |
| 1335 |
|
| 1336 |
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- removes the row acquire_option_lock() inserted. |
| 1337 |
$wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->options} WHERE option_name = %s", $name ) ); |
| 1338 |
wp_cache_delete( $name, 'options' ); |
| 1339 |
} |
| 1340 |
|
| 1341 |
/** |
| 1342 |
* Put a configuration back to the defaults without deleting what the owner typed |
| 1343 |
* |
| 1344 |
* @since 2.9.8 |
| 1345 |
* |
| 1346 |
* @param array $current Configuration being replaced. |
| 1347 |
* @return array |
| 1348 |
*/ |
| 1349 |
public static function get_defaults_preserving_user_data( $current ) { |
| 1350 |
$instance = new self(); |
| 1351 |
$defaults = self::apply_install_tweaks( $instance->get_default_options() ); |
| 1352 |
|
| 1353 |
foreach ( self::get_user_data_keys() as $section => $keys ) { |
| 1354 |
foreach ( $keys as $key ) { |
| 1355 |
if ( isset( $current[ $section ] ) && array_key_exists( $key, (array) $current[ $section ] ) ) { |
| 1356 |
$defaults[ $section ][ $key ] = $current[ $section ][ $key ]; |
| 1357 |
} |
| 1358 |
} |
| 1359 |
} |
| 1360 |
|
| 1361 |
return $defaults; |
| 1362 |
} |
| 1363 |
|
| 1364 |
/** |
| 1365 |
* The values the Standard preset applies |
| 1366 |
* |
| 1367 |
* Standard is the configuration a new installation gets, with every module |
| 1368 |
* on. It is built from the defaults rather than written out by hand, because |
| 1369 |
* a hand-written copy drifts: until 2.9.8 Standard named a dozen fields and |
| 1370 |
* left everything else alone, so applying it after Maximum kept Maximum's |
| 1371 |
* password rules, its administrator alerts, its session limits and its |
| 1372 |
* password expiry, and the preset that says it applies sensible defaults |
| 1373 |
* applied almost none of them. |
| 1374 |
* |
| 1375 |
* The only thing it does not touch is what the site owner typed in: IP and |
| 1376 |
* user agent lists, the custom login address, two factor configuration, the |
| 1377 |
* integrity scan exclusions and the extra notification recipients. Putting |
| 1378 |
* the security posture back to the defaults is one thing, throwing away |
| 1379 |
* someone's whitelist is another, and "Reset to Defaults" is right there for |
| 1380 |
* that. |
| 1381 |
* |
| 1382 |
* @since 2.9.8 |
| 1383 |
* |
| 1384 |
* @return array |
| 1385 |
*/ |
| 1386 |
private function get_standard_preset_values() { |
| 1387 |
$values = self::apply_install_tweaks( $this->get_default_options() ); |
| 1388 |
|
| 1389 |
foreach ( array_keys( $values['modules'] ) as $module ) { |
| 1390 |
$values['modules'][ $module ] = true; |
| 1391 |
} |
| 1392 |
|
| 1393 |
foreach ( self::get_user_data_keys() as $section => $keys ) { |
| 1394 |
foreach ( $keys as $key ) { |
| 1395 |
unset( $values[ $section ][ $key ] ); |
| 1396 |
} |
| 1397 |
} |
| 1398 |
|
| 1399 |
unset( $values['user_security']['password_expiration']['excluded_users'] ); |
| 1400 |
|
| 1401 |
return $values; |
| 1402 |
} |
| 1403 |
|
| 1404 |
/** |
| 1405 |
* Merge a preset over a configuration |
| 1406 |
* |
| 1407 |
* Not array_replace_recursive(), which is wrong for this in two ways. A list |
| 1408 |
* of roles in the preset is merged position by position instead of replacing |
| 1409 |
* the stored one, so applying Standard over Maximum turned the two roles |
| 1410 |
* Standard expires passwords for into Maximum's five with the first two |
| 1411 |
* overwritten. And an empty list in the preset clears nothing at all, |
| 1412 |
* because there is no element to replace with. |
| 1413 |
* |
| 1414 |
* So: associative arrays are merged key by key, and lists and scalars are |
| 1415 |
* replaced outright. |
| 1416 |
* |
| 1417 |
* @since 2.9.8 |
| 1418 |
* |
| 1419 |
* @param array $base Current configuration. |
| 1420 |
* @param array $overlay Preset values. |
| 1421 |
* @return array |
| 1422 |
*/ |
| 1423 |
public static function merge_preset( $base, $overlay ) { |
| 1424 |
foreach ( $overlay as $key => $value ) { |
| 1425 |
if ( is_array( $value ) && isset( $base[ $key ] ) && is_array( $base[ $key ] ) && ! self::is_list( $value ) ) { |
| 1426 |
$base[ $key ] = self::merge_preset( $base[ $key ], $value ); |
| 1427 |
continue; |
| 1428 |
} |
| 1429 |
|
| 1430 |
$base[ $key ] = $value; |
| 1431 |
} |
| 1432 |
|
| 1433 |
return $base; |
| 1434 |
} |
| 1435 |
|
| 1436 |
/** |
| 1437 |
* A stored list, or the shipped one when it arrives empty |
| 1438 |
* |
| 1439 |
* For the four lists that have NO field on any screen: the allowed HTTP |
| 1440 |
* methods, the insecure usernames, the public REST endpoints and the roles |
| 1441 |
* of registration approval. Nobody can empty those from the interface, so |
| 1442 |
* an empty one is a leftover, and every version up to 3.0.0 produced them: |
| 1443 |
* saving any tab wrote array() over every list of that section whose key the |
| 1444 |
* form did not carry, which for these four was always. Reading the settings |
| 1445 |
* hid it by merging the shipped values on top, and 3.0.1 stops doing that, |
| 1446 |
* because a stored empty list is what makes unticking every role work. |
| 1447 |
* |
| 1448 |
* The migration in vigilante.php removes those keys once. This is the line |
| 1449 |
* of defence for every other route, including Under Attack, which |
| 1450 |
* photographs the raw option when it is switched on and puts it back whole |
| 1451 |
* when it expires, after the migration has already marked itself done. |
| 1452 |
* |
| 1453 |
* It goes through every reader of those four lists, the ones that enforce |
| 1454 |
* and the ones that only report, because a screen that says "no insecure |
| 1455 |
* user" while the check is blocking them is its own kind of wrong. The |
| 1456 |
* shipped value is read from get_default_options() rather than written out |
| 1457 |
* again here: a second copy of a list drifts from the first. |
| 1458 |
* |
| 1459 |
* @since 3.0.1 |
| 1460 |
* |
| 1461 |
* @param mixed $value Stored value, as the caller already has it. |
| 1462 |
* @param string[] $path Path of the setting in the options array. |
| 1463 |
* @return array |
| 1464 |
*/ |
| 1465 |
public static function list_or_shipped( $value, $path ) { |
| 1466 |
if ( is_array( $value ) && array() !== $value ) { |
| 1467 |
return $value; |
| 1468 |
} |
| 1469 |
|
| 1470 |
$instance = new self(); |
| 1471 |
$shipped = $instance->get_default_options(); |
| 1472 |
|
| 1473 |
foreach ( (array) $path as $key ) { |
| 1474 |
if ( ! is_array( $shipped ) || ! array_key_exists( $key, $shipped ) ) { |
| 1475 |
return array(); |
| 1476 |
} |
| 1477 |
$shipped = $shipped[ $key ]; |
| 1478 |
} |
| 1479 |
|
| 1480 |
return is_array( $shipped ) ? $shipped : array(); |
| 1481 |
} |
| 1482 |
|
| 1483 |
/** |
| 1484 |
* Whether an array is a plain list (0..n-1 keys) |
| 1485 |
* |
| 1486 |
* array_is_list() is PHP 8.1 and this plugin supports 7.4. |
| 1487 |
* |
| 1488 |
* @since 2.9.8 |
| 1489 |
* |
| 1490 |
* Public since 3.0.1 because the admin save path needs the same answer: the |
| 1491 |
* two places that used to merge lists index by index have to agree on what |
| 1492 |
* a list is, or they disagree on a different subset of the settings. |
| 1493 |
* |
| 1494 |
* @param array $value Array to inspect. |
| 1495 |
* @return bool |
| 1496 |
*/ |
| 1497 |
public static function is_list( $value ) { |
| 1498 |
if ( array() === $value ) { |
| 1499 |
return true; |
| 1500 |
} |
| 1501 |
|
| 1502 |
return array_keys( $value ) === range( 0, count( $value ) - 1 ); |
| 1503 |
} |
| 1504 |
|
| 1505 |
/** |
| 1506 |
* Get presets with descriptions |
| 1507 |
* |
| 1508 |
* @return array Presets configuration. |
| 1509 |
*/ |
| 1510 |
public function get_presets() { |
| 1511 |
return array( |
| 1512 |
'standard' => array_merge( |
| 1513 |
array( |
| 1514 |
'name' => __( 'Standard', 'vigilante' ), |
| 1515 |
'description' => __( 'Balanced security suitable for most websites. Enables every module and puts every setting back to the value a new installation gets.', 'vigilante' ), |
| 1516 |
), |
| 1517 |
$this->get_standard_preset_values() |
| 1518 |
), |
| 1519 |
|
| 1520 |
'maximum' => array( |
| 1521 |
'name' => __( 'Maximum Security', 'vigilante' ), |
| 1522 |
'description' => __( 'Strictest settings for high-security sites. CSP is set to report-only mode to prevent breaking the admin interface.', 'vigilante' ), |
| 1523 |
'modules' => array( |
| 1524 |
'firewall' => true, |
| 1525 |
'security_headers' => true, |
| 1526 |
'login_security' => true, |
| 1527 |
'rest_api_security'=> true, |
| 1528 |
'user_security' => true, |
| 1529 |
'wp_hardening' => true, |
| 1530 |
'file_integrity' => true, |
| 1531 |
'activity_log' => true, |
| 1532 |
), |
| 1533 |
'firewall' => array( |
| 1534 |
'block_bad_query_strings' => true, |
| 1535 |
'block_sql_injection' => true, |
| 1536 |
'block_xss_attacks' => true, |
| 1537 |
'block_file_inclusion' => true, |
| 1538 |
'block_directory_traversal' => true, |
| 1539 |
'block_bad_bots' => true, |
| 1540 |
'block_empty_user_agent' => true, |
| 1541 |
'rate_limiting' => array( |
| 1542 |
'enabled' => true, |
| 1543 |
'requests_per_minute' => 60, |
| 1544 |
'block_duration' => 600, |
| 1545 |
'progressive' => true, |
| 1546 |
'max_block_duration' => 86400, |
| 1547 |
), |
| 1548 |
), |
| 1549 |
'security_headers' => array( |
| 1550 |
'x_frame_options' => 'DENY', |
| 1551 |
// HSTS is intentionally NOT enabled by Maximum: forcing HSTS on a site |
| 1552 |
// that doesn't have a healthy HTTPS setup (or temporarily falls back to |
| 1553 |
// HTTP) locks visitors out for the full max_age. Leaving HSTS off keeps |
| 1554 |
// it as an explicit opt-in decision per site. |
| 1555 |
'csp' => array( |
| 1556 |
'enabled' => true, |
| 1557 |
'report_only' => false, |
| 1558 |
'directives' => array( |
| 1559 |
'default-src' => "'self'", |
| 1560 |
'script-src' => "'self' 'unsafe-inline' 'unsafe-eval'", |
| 1561 |
'style-src' => "'self' 'unsafe-inline'", |
| 1562 |
'img-src' => "'self' data: https: blob:", |
| 1563 |
'font-src' => "'self' data:", |
| 1564 |
'connect-src' => "'self' https: blob:", |
| 1565 |
'frame-src' => "'self' blob:", |
| 1566 |
'frame-ancestors' => "'none'", |
| 1567 |
'worker-src' => "'self' blob:", |
| 1568 |
'object-src' => "'none'", |
| 1569 |
'base-uri' => "'self'", |
| 1570 |
), |
| 1571 |
), |
| 1572 |
), |
| 1573 |
'rest_api_security' => array( |
| 1574 |
'mode' => 'authenticated_only', |
| 1575 |
), |
| 1576 |
'login_security' => array( |
| 1577 |
'max_attempts' => 3, |
| 1578 |
'lockout_duration' => 3600, |
| 1579 |
'lockout_increment' => true, |
| 1580 |
'notify_on_lockout' => true, |
| 1581 |
'notify_on_admin_login' => true, |
| 1582 |
), |
| 1583 |
'wp_hardening' => array( |
| 1584 |
'xmlrpc_mode' => 'full', |
| 1585 |
'disallow_file_edit' => true, |
| 1586 |
'disallow_file_mods' => true, |
| 1587 |
// close_old_comments is intentionally NOT touched by Maximum: |
| 1588 |
// it would unilaterally close discussion on every old post, |
| 1589 |
// which is a content decision, not a security one. |
| 1590 |
), |
| 1591 |
'user_security' => array( |
| 1592 |
'prevent_display_name_login_match' => true, |
| 1593 |
'min_password_length' => 16, |
| 1594 |
'password_policy' => array( |
| 1595 |
'require_uppercase' => true, |
| 1596 |
'require_lowercase' => true, |
| 1597 |
'require_number' => true, |
| 1598 |
'require_special' => true, |
| 1599 |
'block_common' => true, |
| 1600 |
'block_username' => true, |
| 1601 |
'affected_roles' => array(), |
| 1602 |
), |
| 1603 |
'admin_monitoring' => array( |
| 1604 |
'alert_new_admin' => true, |
| 1605 |
'alert_admin_email_change' => true, |
| 1606 |
'alert_permission_elevation' => true, |
| 1607 |
'alert_admin_password_change' => true, |
| 1608 |
), |
| 1609 |
'registration_approval' => array( |
| 1610 |
'enabled' => true, |
| 1611 |
'notify_admin' => true, |
| 1612 |
'auto_reject_days' => 7, |
| 1613 |
'affected_roles' => array( 'subscriber', 'contributor', 'author', 'editor' ), |
| 1614 |
), |
| 1615 |
'session_limits' => array( |
| 1616 |
'enabled' => true, |
| 1617 |
'max_sessions' => 1, |
| 1618 |
'behavior' => 'close_oldest', |
| 1619 |
'exclude_admins' => false, |
| 1620 |
), |
| 1621 |
'password_expiration' => array( |
| 1622 |
'enabled' => true, |
| 1623 |
'expire_days' => 30, |
| 1624 |
'warning_days' => 7, |
| 1625 |
'affected_roles' => array( 'administrator', 'editor', 'author', 'contributor', 'subscriber' ), |
| 1626 |
'password_history' => 5, |
| 1627 |
'send_reminder' => true, |
| 1628 |
), |
| 1629 |
'email_verification' => array( |
| 1630 |
'enabled' => true, |
| 1631 |
'token_expiry_hours' => 24, |
| 1632 |
'allow_resend' => true, |
| 1633 |
'auto_delete_days' => 3, |
| 1634 |
), |
| 1635 |
), |
| 1636 |
'file_integrity' => array( |
| 1637 |
'scan_core' => true, |
| 1638 |
'scan_plugins' => true, |
| 1639 |
'scan_themes' => true, |
| 1640 |
'scan_uploads' => true, |
| 1641 |
'scan_critical_config' => true, |
| 1642 |
'auto_scan' => true, |
| 1643 |
'scan_frequency' => 'daily', |
| 1644 |
'notify_level' => 'all', |
| 1645 |
'instant_alert' => true, |
| 1646 |
), |
| 1647 |
// A configuration called Maximum Security that never tells you |
| 1648 |
// anything happened is half a product, so the audit alerts ship |
| 1649 |
// on with it. The shared cooldown keeps a sustained attack from |
| 1650 |
// turning into a flood. Under Attack mode builds on this preset, |
| 1651 |
// so it inherits them for as long as it is on and gives them back |
| 1652 |
// when it is switched off. |
| 1653 |
'audit_alerts' => array( |
| 1654 |
'immediate' => array( |
| 1655 |
'enabled' => true, |
| 1656 |
'min_severity' => 'critical', |
| 1657 |
), |
| 1658 |
'threshold' => array( |
| 1659 |
'enabled' => true, |
| 1660 |
), |
| 1661 |
), |
| 1662 |
'activity_log' => array( |
| 1663 |
'log_logins' => true, |
| 1664 |
'log_failed_logins' => true, |
| 1665 |
'log_user_changes' => true, |
| 1666 |
'log_post_changes' => true, |
| 1667 |
'log_plugin_changes' => true, |
| 1668 |
'log_theme_changes' => true, |
| 1669 |
'log_option_changes' => true, |
| 1670 |
'log_file_changes' => true, |
| 1671 |
'log_comments' => true, |
| 1672 |
'log_media' => true, |
| 1673 |
), |
| 1674 |
), |
| 1675 |
); |
| 1676 |
} |
| 1677 |
|
| 1678 |
/** |
| 1679 |
* Get module labels for display |
| 1680 |
* |
| 1681 |
* @return array Module labels. |
| 1682 |
*/ |
| 1683 |
public function get_module_labels() { |
| 1684 |
return array( |
| 1685 |
'firewall' => __( 'Firewall', 'vigilante' ), |
| 1686 |
'security_headers' => __( 'Security Headers', 'vigilante' ), |
| 1687 |
'login_security' => __( 'Login Security', 'vigilante' ), |
| 1688 |
'rest_api_security'=> __( 'REST API Security', 'vigilante' ), |
| 1689 |
'user_security' => __( 'User Security', 'vigilante' ), |
| 1690 |
'wp_hardening' => __( 'WordPress Hardening', 'vigilante' ), |
| 1691 |
'file_integrity' => __( 'File Integrity', 'vigilante' ), |
| 1692 |
'activity_log' => __( 'Security Audit', 'vigilante' ), |
| 1693 |
); |
| 1694 |
} |
| 1695 |
|
| 1696 |
/** |
| 1697 |
* Get module descriptions for display |
| 1698 |
* |
| 1699 |
* @return array Module descriptions. |
| 1700 |
*/ |
| 1701 |
public function get_module_descriptions() { |
| 1702 |
return array( |
| 1703 |
'firewall' => __( 'Blocks malicious requests, SQL injection, XSS attacks, and bad bots. Includes rate limiting and file protection.', 'vigilante' ), |
| 1704 |
'security_headers' => __( 'Adds HTTP security headers like CSP, HSTS, X-Frame-Options. Forces HTTPS and fixes mixed content.', 'vigilante' ), |
| 1705 |
'login_security' => __( 'Brute force protection, 2FA, login attempt limits, XML-RPC control, and notifications.', 'vigilante' ), |
| 1706 |
'rest_api_security'=> __( 'Controls REST API access, blocks user enumeration, and protects sensitive endpoints.', 'vigilante' ), |
| 1707 |
'user_security' => __( 'Blocks insecure usernames, enforces strong passwords, and prevents author scanning.', 'vigilante' ), |
| 1708 |
'wp_hardening' => __( 'Hardens wp-config.php, manages comments, cleans header output, and controls feeds.', 'vigilante' ), |
| 1709 |
'file_integrity' => __( 'Scans WordPress core, plugins, and themes for unauthorized changes and suspicious code.', 'vigilante' ), |
| 1710 |
'activity_log' => __( 'Records user actions, logins, content changes, and security events for security auditing.', 'vigilante' ), |
| 1711 |
); |
| 1712 |
} |
| 1713 |
|
| 1714 |
/** |
| 1715 |
* The settings that hold a list of file paths, by section |
| 1716 |
* |
| 1717 |
* A path is read by what it is. sanitize_text_field() deletes every %XX octet |
| 1718 |
* and, when it finds one, collapses repeated spaces, so an exclusion written |
| 1719 |
* for a folder called foto%20x was saved as fotox and excluded nothing: the |
| 1720 |
* scan compares what is stored with the paths it finds, one by one (measured |
| 1721 |
* on 1 oct 2026 against 3.0.1). Every other list in the options is a list of |
| 1722 |
* addresses, names or extensions, where nothing meaningful is lost, and keeps |
| 1723 |
* its reader. |
| 1724 |
* |
| 1725 |
* @since 3.0.2 |
| 1726 |
* |
| 1727 |
* @return array<string,string[]> |
| 1728 |
*/ |
| 1729 |
public static function path_list_keys() { |
| 1730 |
return array( |
| 1731 |
'file_integrity' => array( 'excluded_paths' ), |
| 1732 |
); |
| 1733 |
} |
| 1734 |
|
| 1735 |
/** |
| 1736 |
* One path as it was typed: invalid UTF-8 out, the ends trimmed, and nothing |
| 1737 |
* else touched. Invalid UTF-8 has to go because the option would not be |
| 1738 |
* written with it. |
| 1739 |
* |
| 1740 |
* A line that has tags (or a stray <) is dropped whole, not cut. A path has |
| 1741 |
* none, and wp_strip_all_tags() would cut it at the < and leave a shorter path |
| 1742 |
* than the one written, which excludes more than anyone asked: a folder |
| 1743 |
* called a<b would exclude a. Until 3.0.1 the < was kept as an entity, which |
| 1744 |
* matched nothing, and dropping the line has the same effect. |
| 1745 |
* |
| 1746 |
* A line with a line break inside is dropped too. The textarea is read line by |
| 1747 |
* line, so only an element of a list can have one (an export edited by hand), |
| 1748 |
* and the next save of the tab would show it as two lines and store two paths: |
| 1749 |
* a, a line break and wp-content would end up excluding all of wp-content. |
| 1750 |
* 3.0.1 turned the break into a space, which matched nothing, and dropping the |
| 1751 |
* line has the same effect (fourth cross review, 1 oct 2026). |
| 1752 |
* |
| 1753 |
* @since 3.0.2 |
| 1754 |
* |
| 1755 |
* @param mixed $line Entry. |
| 1756 |
* @return string |
| 1757 |
*/ |
| 1758 |
public static function sanitize_path_line( $line ) { |
| 1759 |
if ( ! is_scalar( $line ) ) { |
| 1760 |
return ''; |
| 1761 |
} |
| 1762 |
|
| 1763 |
$line = trim( wp_check_invalid_utf8( (string) $line, true ) ); |
| 1764 |
|
| 1765 |
if ( false !== strpbrk( $line, "\r\n" ) ) { |
| 1766 |
return ''; |
| 1767 |
} |
| 1768 |
|
| 1769 |
return wp_strip_all_tags( $line ) === $line ? $line : ''; |
| 1770 |
} |
| 1771 |
|
| 1772 |
/** |
| 1773 |
* The text of a textarea of paths, one per line, each line read as one path. |
| 1774 |
* |
| 1775 |
* Line by line, because a stray < in one line would take the lines after it |
| 1776 |
* with it if the whole text went through wp_strip_all_tags(). |
| 1777 |
* |
| 1778 |
* @since 3.0.2 |
| 1779 |
* |
| 1780 |
* @param mixed $text Text. |
| 1781 |
* @return string |
| 1782 |
*/ |
| 1783 |
public static function sanitize_path_text( $text ) { |
| 1784 |
$lines = preg_split( '/\r\n|\r|\n/', (string) $text ); |
| 1785 |
|
| 1786 |
return implode( "\n", array_map( array( __CLASS__, 'sanitize_path_line' ), (array) $lines ) ); |
| 1787 |
} |
| 1788 |
|
| 1789 |
/** |
| 1790 |
* Take the lists of paths out of a settings tree before the generic sanitizer reads it |
| 1791 |
* |
| 1792 |
* Known limits (fourth cross review, 1 oct 2026), none reachable from the |
| 1793 |
* settings screen and all on the side of watching more: process_section_data() |
| 1794 |
* reads the entries of a list posted as an array (excluded_paths[]=) with |
| 1795 |
* sanitize_text_field() and applies sanitize_key() to the keys, so a key |
| 1796 |
* written with another spelling is not found here, and a form posted as an |
| 1797 |
* array instead of a string goes through a generic sanitizer. In those three |
| 1798 |
* the %XX are lost, as they were in 3.0.1. |
| 1799 |
* |
| 1800 |
* @since 3.0.2 |
| 1801 |
* |
| 1802 |
* @param mixed $data Settings tree: section => key => value. |
| 1803 |
* @return array Only the path lists that are present, in the same shape, each already read as paths. |
| 1804 |
*/ |
| 1805 |
public static function take_path_lists( $data ) { |
| 1806 |
$taken = array(); |
| 1807 |
|
| 1808 |
if ( ! is_array( $data ) ) { |
| 1809 |
return $taken; |
| 1810 |
} |
| 1811 |
|
| 1812 |
foreach ( self::path_list_keys() as $section => $keys ) { |
| 1813 |
if ( ! isset( $data[ $section ] ) || ! is_array( $data[ $section ] ) ) { |
| 1814 |
continue; |
| 1815 |
} |
| 1816 |
|
| 1817 |
foreach ( $keys as $key ) { |
| 1818 |
if ( ! isset( $data[ $section ][ $key ] ) ) { |
| 1819 |
continue; |
| 1820 |
} |
| 1821 |
|
| 1822 |
$value = $data[ $section ][ $key ]; |
| 1823 |
|
| 1824 |
if ( is_array( $value ) ) { |
| 1825 |
$taken[ $section ][ $key ] = array_map( array( __CLASS__, 'sanitize_path_line' ), array_values( array_filter( $value, 'is_scalar' ) ) ); |
| 1826 |
} elseif ( is_scalar( $value ) ) { |
| 1827 |
$taken[ $section ][ $key ] = self::sanitize_path_text( $value ); |
| 1828 |
} |
| 1829 |
} |
| 1830 |
} |
| 1831 |
|
| 1832 |
return $taken; |
| 1833 |
} |
| 1834 |
|
| 1835 |
/** |
| 1836 |
* Put back the lists of paths take_path_lists() took out, over what the generic sanitizer left |
| 1837 |
* |
| 1838 |
* @since 3.0.2 |
| 1839 |
* |
| 1840 |
* @param mixed $data Sanitized settings tree. |
| 1841 |
* @param array $taken What take_path_lists() returned for the same tree. |
| 1842 |
* @return mixed The tree, with the path lists as they were read. |
| 1843 |
*/ |
| 1844 |
public static function restore_path_lists( $data, $taken ) { |
| 1845 |
if ( ! is_array( $data ) ) { |
| 1846 |
return $data; |
| 1847 |
} |
| 1848 |
|
| 1849 |
foreach ( $taken as $section => $values ) { |
| 1850 |
if ( ! isset( $data[ $section ] ) || ! is_array( $data[ $section ] ) ) { |
| 1851 |
continue; |
| 1852 |
} |
| 1853 |
|
| 1854 |
foreach ( $values as $key => $value ) { |
| 1855 |
$data[ $section ][ $key ] = $value; |
| 1856 |
} |
| 1857 |
} |
| 1858 |
|
| 1859 |
return $data; |
| 1860 |
} |
| 1861 |
|
| 1862 |
/** |
| 1863 |
* Whether a position in the options, as section.key, is a list of paths |
| 1864 |
* |
| 1865 |
* @since 3.0.2 |
| 1866 |
* |
| 1867 |
* @param string $trail Section and key joined by a dot. |
| 1868 |
* @return bool |
| 1869 |
*/ |
| 1870 |
private static function is_path_list( $trail ) { |
| 1871 |
$parts = explode( '.', (string) $trail, 2 ); |
| 1872 |
$paths = self::path_list_keys(); |
| 1873 |
|
| 1874 |
return 2 === count( $parts ) && isset( $paths[ $parts[0] ] ) && in_array( $parts[1], $paths[ $parts[0] ], true ); |
| 1875 |
} |
| 1876 |
|
| 1877 |
/** |
| 1878 |
* Validate options before saving |
| 1879 |
* |
| 1880 |
* @param array $input Raw input to validate. |
| 1881 |
* @return array Validated options. |
| 1882 |
*/ |
| 1883 |
public function validate_options( $input ) { |
| 1884 |
$validated = array(); |
| 1885 |
$defaults = $this->get_default_options(); |
| 1886 |
|
| 1887 |
// Validate each section that exists in input |
| 1888 |
foreach ( $input as $section => $data ) { |
| 1889 |
if ( ! is_array( $data ) ) { |
| 1890 |
continue; |
| 1891 |
} |
| 1892 |
|
| 1893 |
if ( 'modules' === $section ) { |
| 1894 |
// Validate modules (booleans) |
| 1895 |
foreach ( $defaults['modules'] as $module => $default_value ) { |
| 1896 |
$validated['modules'][ $module ] = isset( $data[ $module ] ) |
| 1897 |
? (bool) $data[ $module ] |
| 1898 |
: false; |
| 1899 |
} |
| 1900 |
} elseif ( isset( $defaults[ $section ] ) ) { |
| 1901 |
// Validate other sections using generic validator |
| 1902 |
$validated[ $section ] = $this->validate_section( $data, $defaults[ $section ], $section ); |
| 1903 |
|
| 1904 |
// The few keys that live outside get_default_options() on |
| 1905 |
// purpose (see apply_install_tweaks()) survive with their own |
| 1906 |
// validation, or an import would silently lose them and the |
| 1907 |
// XML-RPC resolver would fall back to blocking everything. |
| 1908 |
foreach ( self::undeclared_keys( $section ) as $key => $type ) { |
| 1909 |
if ( ! array_key_exists( $key, $data ) ) { |
| 1910 |
continue; |
| 1911 |
} |
| 1912 |
if ( 'bool' === $type ) { |
| 1913 |
$validated[ $section ][ $key ] = (bool) $data[ $key ]; |
| 1914 |
} elseif ( is_array( $type ) && in_array( $data[ $key ], $type, true ) ) { |
| 1915 |
$validated[ $section ][ $key ] = $data[ $key ]; |
| 1916 |
} |
| 1917 |
} |
| 1918 |
} |
| 1919 |
} |
| 1920 |
|
| 1921 |
/* |
| 1922 |
* The lock on the settings the shared files are built from is NOT applied |
| 1923 |
* here, and that is a decision, not an oversight. The second cross review |
| 1924 |
* of 2.11.10 raised that register_setting( 'vigilante_options', ... ) |
| 1925 |
* declares this as its sanitize callback with no lock in it, so anything |
| 1926 |
* reaching options.php with that option group would write the whole |
| 1927 |
* option. The chain does not close: the plugin prints no settings_fields() |
| 1928 |
* for that group anywhere, so the nonce it would need is not obtainable, |
| 1929 |
* and the five places that do save (saving a tab, importing, a preset, |
| 1930 |
* restoring the defaults, resetting a section) all apply |
| 1931 |
* keep_locked_file_settings() themselves. |
| 1932 |
* |
| 1933 |
* Putting it here instead would be worse than the door it closes. A |
| 1934 |
* register_setting() callback runs on EVERY update_option() of this |
| 1935 |
* option, so it would also lock the writes with no user behind them: the |
| 1936 |
* expiry of Under Attack restoring what it hardened, WP-CLI and cron. |
| 1937 |
* Those are already covered by matriz-red-ajustes-compartidos.sh, which |
| 1938 |
* is where such a change would show up as a row that stopped passing. |
| 1939 |
*/ |
| 1940 |
|
| 1941 |
return apply_filters( 'vigilante_validate_options', $validated, $input ); |
| 1942 |
} |
| 1943 |
|
| 1944 |
/** |
| 1945 |
* Keys deliberately absent from get_default_options(), with how to validate them |
| 1946 |
* |
| 1947 |
* Declaring them as defaults would break the fallback they exist for (see |
| 1948 |
* apply_install_tweaks()), but the validator still has to know them, or a |
| 1949 |
* settings import drops them (found in the 2.11.0 cross review). |
| 1950 |
* |
| 1951 |
* @since 2.11.0 |
| 1952 |
* |
| 1953 |
* @param string $section Section name. |
| 1954 |
* @return array key => 'bool' or list of allowed values. |
| 1955 |
*/ |
| 1956 |
private static function undeclared_keys( $section ) { |
| 1957 |
$keys = array( |
| 1958 |
'wp_hardening' => array( 'xmlrpc_mode' => array( 'full', 'pingback', 'none' ) ), |
| 1959 |
'login_security' => array( |
| 1960 |
'disable_xmlrpc' => 'bool', |
| 1961 |
'disable_xmlrpc_pingback' => 'bool', |
| 1962 |
), |
| 1963 |
); |
| 1964 |
|
| 1965 |
return isset( $keys[ $section ] ) ? $keys[ $section ] : array(); |
| 1966 |
} |
| 1967 |
|
| 1968 |
/** |
| 1969 |
* Whether a default value describes a free list rather than a schema |
| 1970 |
* |
| 1971 |
* An empty array or sequential numeric keys (an IP whitelist, a list of |
| 1972 |
* roles) is a list: every entry the user typed is kept. Anything else is a |
| 1973 |
* schema: only its keys survive validation. |
| 1974 |
* |
| 1975 |
* @since 2.11.0 |
| 1976 |
* |
| 1977 |
* @param array $defaults Default value of a setting. |
| 1978 |
* @return bool |
| 1979 |
*/ |
| 1980 |
private function is_list_default( $defaults ) { |
| 1981 |
if ( array() === $defaults ) { |
| 1982 |
return true; |
| 1983 |
} |
| 1984 |
|
| 1985 |
return array_keys( $defaults ) === range( 0, count( $defaults ) - 1 ); |
| 1986 |
} |
| 1987 |
|
| 1988 |
/** |
| 1989 |
* Validate a section based on defaults |
| 1990 |
* |
| 1991 |
* Since 2.11.0 the result only holds keys the defaults know. The loop that |
| 1992 |
* used to reincorporate unknown keys "sanitized" meant a settings import |
| 1993 |
* could merge any key it liked into vigilante_options (S7 of the 28 Aug |
| 1994 |
* 2026 audit). Lists are the exception, handled first: their entries are |
| 1995 |
* data, not keys. |
| 1996 |
* |
| 1997 |
* @param array $input Input values. |
| 1998 |
* @param array $defaults Default values. |
| 1999 |
* @param string $trail Where this is in the options, as section.key, so a list of paths is read as paths. |
| 2000 |
* @return array Validated values. |
| 2001 |
*/ |
| 2002 |
private function validate_section( $input, $defaults, $trail = '' ) { |
| 2003 |
$validated = array(); |
| 2004 |
|
| 2005 |
if ( $this->is_list_default( $defaults ) ) { |
| 2006 |
if ( ! is_array( $input ) ) { |
| 2007 |
return array(); |
| 2008 |
} |
| 2009 |
|
| 2010 |
$is_paths = self::is_path_list( $trail ); |
| 2011 |
$list = array(); |
| 2012 |
foreach ( $input as $value ) { |
| 2013 |
if ( is_scalar( $value ) ) { |
| 2014 |
$list[] = $is_paths ? self::sanitize_path_line( $value ) : sanitize_text_field( (string) $value ); |
| 2015 |
} elseif ( is_array( $value ) ) { |
| 2016 |
$list[] = map_deep( $value, 'sanitize_text_field' ); |
| 2017 |
} |
| 2018 |
} |
| 2019 |
|
| 2020 |
return $list; |
| 2021 |
} |
| 2022 |
|
| 2023 |
foreach ( $defaults as $key => $default_value ) { |
| 2024 |
if ( ! isset( $input[ $key ] ) ) { |
| 2025 |
$validated[ $key ] = $default_value; |
| 2026 |
continue; |
| 2027 |
} |
| 2028 |
|
| 2029 |
$value = $input[ $key ]; |
| 2030 |
|
| 2031 |
if ( is_bool( $default_value ) ) { |
| 2032 |
$validated[ $key ] = (bool) $value; |
| 2033 |
} elseif ( is_int( $default_value ) ) { |
| 2034 |
$validated[ $key ] = intval( $value ); |
| 2035 |
} elseif ( is_array( $default_value ) ) { |
| 2036 |
if ( is_array( $value ) ) { |
| 2037 |
$validated[ $key ] = $this->validate_section( $value, $default_value, '' === $trail ? (string) $key : $trail . '.' . $key ); |
| 2038 |
} else { |
| 2039 |
$validated[ $key ] = $default_value; |
| 2040 |
} |
| 2041 |
} else { |
| 2042 |
$validated[ $key ] = sanitize_text_field( $value ); |
| 2043 |
} |
| 2044 |
} |
| 2045 |
|
| 2046 |
// Keys the defaults do not declare are dropped on purpose (S7). |
| 2047 |
|
| 2048 |
return $validated; |
| 2049 |
} |
| 2050 |
} |
