Diff
14 years ago
geshi
14 years ago
.htaccess
14 years ago
Diff.php
14 years ago
IPTraf.php
14 years ago
diffResult.php
14 years ago
dropAll.php
14 years ago
email_genericAlert.php
14 years ago
email_newIssues.php
14 years ago
geshi.php
14 years ago
menu_activity.php
14 years ago
menu_blockedIPs.php
14 years ago
menu_config.php
14 years ago
menu_options.php
14 years ago
menu_scan.php
14 years ago
sysinfo.php
14 years ago
wf503.php
14 years ago
wfAPI.php
14 years ago
wfAction.php
14 years ago
wfBrowscap.php
14 years ago
wfBrowscapCache.php
14 years ago
wfConfig.php
14 years ago
wfCrawl.php
14 years ago
wfDB.php
14 years ago
wfDict.php
14 years ago
wfIssues.php
14 years ago
wfLockedOut.php
14 years ago
wfLog.php
14 years ago
wfModTracker.php
14 years ago
wfRate.php
14 years ago
wfScanEngine.php
14 years ago
wfSchema.php
14 years ago
wfUtils.php
14 years ago
wfViewResult.php
14 years ago
wordfenceClass.php
14 years ago
wordfenceConstants.php
14 years ago
wordfenceHash.php
14 years ago
wordfenceScanner.php
14 years ago
wordfenceURLHoover.php
14 years ago
wfIssues.php
242 lines
| 1 | <?php |
| 2 | require_once('wfUtils.php'); |
| 3 | class wfIssues { |
| 4 | private $updateCalled = false; |
| 5 | public $lastError = ''; |
| 6 | private $issuesTable = ''; |
| 7 | private $newIssues = array(); |
| 8 | public $totalIssues = 0; |
| 9 | public $totalCriticalIssues = 0; |
| 10 | public $totalWarningIssues = 0; |
| 11 | public function __construct(){ |
| 12 | global $wpdb; |
| 13 | $this->issuesTable = $wpdb->base_prefix . 'wfIssues'; |
| 14 | } |
| 15 | public function addIssue($type, $severity, |
| 16 | |
| 17 | $ignoreP, /* some piece of data used for md5 for permanent ignores */ |
| 18 | $ignoreC, /* some piece of data used for md5 for ignoring until something changes */ |
| 19 | $shortMsg, $longMsg, $templateData |
| 20 | ){ |
| 21 | |
| 22 | |
| 23 | $ignoreP = md5($ignoreP); |
| 24 | $ignoreC = md5($ignoreC); |
| 25 | $rec = $this->getDB()->querySingleRec("select status, ignoreP, ignoreC from " . $this->issuesTable . " where (ignoreP='%s' OR ignoreC='%s')", $ignoreP, $ignoreC); |
| 26 | if($rec){ |
| 27 | if($rec['status'] == 'new' && ($rec['ignoreC'] == $ignoreC || $rec['ignoreP'] == $ignoreP)){ return; } |
| 28 | if($rec['status'] == 'ignoreC' && $rec['ignoreC'] == $ignoreC){ return; } |
| 29 | if($rec['status'] == 'ignoreP' && $rec['ignoreP'] == $ignoreP){ return; } |
| 30 | } |
| 31 | |
| 32 | $this->totalIssues++; |
| 33 | if($severity == 1){ |
| 34 | $this->totalCriticalIssues++; |
| 35 | } else if($severity == 2){ |
| 36 | $this->totalWarningIssues++; |
| 37 | } |
| 38 | $this->newIssues[] = array( |
| 39 | 'type' => $type, |
| 40 | 'severity' => $severity, |
| 41 | 'ignoreP' => $ignoreP, |
| 42 | 'ignoreC' => $ignoreC, |
| 43 | 'shortMsg' => $shortMsg, |
| 44 | 'longMsg' => $longMsg, |
| 45 | 'tmplData' => $templateData |
| 46 | ); |
| 47 | |
| 48 | $this->getDB()->query("insert into " . $this->issuesTable . " (time, status, type, severity, ignoreP, ignoreC, shortMsg, longMsg, data) values (unix_timestamp(), '%s', '%s', %d, '%s', '%s', '%s', '%s', '%s')", |
| 49 | 'new', |
| 50 | $type, |
| 51 | $severity, |
| 52 | $ignoreP, |
| 53 | $ignoreC, |
| 54 | $shortMsg, |
| 55 | $longMsg, |
| 56 | serialize($templateData) |
| 57 | ); |
| 58 | } |
| 59 | public function deleteIgnored(){ |
| 60 | $this->getDB()->query("delete from " . $this->issuesTable . " where status='ignoreP' or status='ignoreC'"); |
| 61 | } |
| 62 | public function deleteNew(){ |
| 63 | $this->getDB()->query("delete from " . $this->issuesTable . " where status='new'"); |
| 64 | } |
| 65 | public function ignoreAllNew(){ |
| 66 | $this->getDB()->query("update " . $this->issuesTable . " set status='ignoreC' where status='new'"); |
| 67 | } |
| 68 | public function emailNewIssues(){ |
| 69 | $level = wfConfig::getAlertLevel(); |
| 70 | $emails = wfConfig::getAlertEmails(); |
| 71 | $subject = "[Wordfence Alert] Problems found on " . get_bloginfo('name', 'raw'); |
| 72 | |
| 73 | if(sizeof($emails) < 1){ return; } |
| 74 | if($level < 1){ return; } |
| 75 | if($level == 2 && $this->totalCriticalIssues < 1 && $this->totalWarningIssues < 1){ return; } |
| 76 | if($level == 1 && $this->totalCriticalIssues < 1){ return; } |
| 77 | $emailedIssues = wfConfig::get_ser('emailedIssuesList', array()); |
| 78 | $finalIssues = array(); |
| 79 | foreach($this->newIssues as $newIssue){ |
| 80 | $alreadyEmailed = false; |
| 81 | foreach($emailedIssues as $emailedIssue){ |
| 82 | if($newIssue['ignoreP'] == $emailedIssue['ignoreP'] || $newIssue['ignoreC'] == $emailedIssue['ignoreC']){ |
| 83 | $alreadyEmailed = true; |
| 84 | break; |
| 85 | } |
| 86 | } |
| 87 | if(! $alreadyEmailed){ |
| 88 | $finalIssues[] = $newIssue; |
| 89 | } |
| 90 | } |
| 91 | if(sizeof($finalIssues) < 1){ return; } |
| 92 | |
| 93 | $totalWarningIssues = 0; |
| 94 | $totalCriticalIssues = 0; |
| 95 | foreach($finalIssues as $i){ |
| 96 | $emailedIssues[] = array( 'ignoreC' => $i['ignoreC'], 'ignoreP' => $i['ignoreP'] ); |
| 97 | if($i['severity'] == 1){ |
| 98 | $totalCriticalIssues++; |
| 99 | } else if($i['severity'] == 2){ |
| 100 | $totalWarningIssues++; |
| 101 | } |
| 102 | } |
| 103 | wfConfig::set_ser('emailedIssuesList', $emailedIssues); |
| 104 | if($level == 2 && $totalCriticalIssues < 1 && $totalWarningIssues < 1){ return; } |
| 105 | if($level == 1 && $totalCriticalIssues < 1){ return; } |
| 106 | $content = wfUtils::tmpl('email_newIssues.php', array( |
| 107 | 'issues' => $finalIssues, |
| 108 | 'totalCriticalIssues' => $totalCriticalIssues, |
| 109 | 'totalWarningIssues' => $totalWarningIssues, |
| 110 | 'level' => $level |
| 111 | )); |
| 112 | wp_mail(implode(',', $emails), $subject, $content); |
| 113 | } |
| 114 | public function deleteIssue($id){ |
| 115 | $this->getDB()->query("delete from " . $this->issuesTable . " where id=%d", $id); |
| 116 | } |
| 117 | public function updateIssue($id, $status){ //ignoreC, ignoreP, delete or new |
| 118 | $currentStatus = $this->getDB()->querySingle("select status from " . $this->issuesTable . " where id=%d", $id); |
| 119 | if($status == 'delete'){ |
| 120 | $this->getDB()->query("delete from " . $this->issuesTable . " where id=%d", $id); |
| 121 | } else if($status == 'ignoreC' || $status == 'ignoreP' || $status == 'new'){ |
| 122 | $this->getDB()->query("update " . $this->issuesTable . " set status='%s' where id=%d", $status, $id); |
| 123 | } |
| 124 | } |
| 125 | public function getIssueByID($id){ |
| 126 | $rec = $this->getDB()->querySingleRec("select * from " . $this->issuesTable . " where id=%d", $id); |
| 127 | $rec['data'] = unserialize($rec['data']); |
| 128 | return $rec; |
| 129 | } |
| 130 | public function getIssues(){ |
| 131 | $issues = wfConfig::get('wf_issues', array()); |
| 132 | $ret = array( |
| 133 | 'new' => array(), |
| 134 | 'ignored' => array() |
| 135 | ); |
| 136 | $q1 = $this->getDB()->query("select * from " . $this->issuesTable . " order by time desc"); |
| 137 | while($i = mysql_fetch_assoc($q1)){ |
| 138 | $i['data'] = unserialize($i['data']); |
| 139 | $i['timeAgo'] = wfUtils::makeTimeAgo(time() - $i['time']); |
| 140 | if($i['status'] == 'new'){ |
| 141 | $ret['new'][] = $i; |
| 142 | } else if($i['status'] == 'ignoreP' || $i['status'] == 'ignoreC'){ |
| 143 | $ret['ignored'][] = $i; |
| 144 | } else { |
| 145 | error_log("Issue has bad status: " . $i['status']); |
| 146 | continue; |
| 147 | } |
| 148 | } |
| 149 | foreach($ret as $status => &$issueList){ |
| 150 | for($i = 0; $i < sizeof($issueList); $i++){ |
| 151 | if($issueList[$i]['type'] == 'file'){ |
| 152 | $localFile = ABSPATH . '/' . preg_replace('/^[\.\/]+/', '', $issueList[$i]['data']['file']); |
| 153 | if(file_exists($localFile)){ |
| 154 | $issueList[$i]['data']['fileExists'] = true; |
| 155 | } else { |
| 156 | $issueList[$i]['data']['fileExists'] = ''; |
| 157 | } |
| 158 | } |
| 159 | $issueList[$i]['issueIDX'] = $i; |
| 160 | } |
| 161 | } |
| 162 | return $ret; //array of lists of issues by status |
| 163 | } |
| 164 | public function updateSummaryItem($key, $val){ |
| 165 | $arr = wfConfig::get_ser('wf_summaryItems', array()); |
| 166 | $arr[$key] = $val; |
| 167 | $arr['lastUpdate'] = time(); |
| 168 | wfConfig::set_ser('wf_summaryItems', $arr); |
| 169 | } |
| 170 | public function getSummaryItem($key){ |
| 171 | $arr = wfConfig::get_ser('wf_summaryItems', array()); |
| 172 | if(array_key_exists($key, $arr)){ |
| 173 | return $arr[$key]; |
| 174 | } else { return ''; } |
| 175 | } |
| 176 | public function summaryUpdateRequired(){ |
| 177 | $last = $this->getSummaryItem('lastUpdate'); |
| 178 | if( (! $last) || (time() - $last > (86400 * 7))){ |
| 179 | return true; |
| 180 | } |
| 181 | return false; |
| 182 | } |
| 183 | public function getSummaryItems(){ |
| 184 | if(! $this->updateCalled){ |
| 185 | $this->updateCalled = true; |
| 186 | $this->updateSummaryItems(); |
| 187 | } |
| 188 | $arr = wfConfig::get_ser('wf_summaryItems', array()); |
| 189 | $arr['scanTimeAgo'] = wfUtils::makeTimeAgo(sprintf('%.0f', time() - $arr['scanTime'])); |
| 190 | $arr['scanRunning'] = wfConfig::get('wf_scanRunning') ? '1' : '0'; |
| 191 | $arr['scheduledScansEnabled'] = wfConfig::get('scheduledScansEnabled'); |
| 192 | $secsToGo = wp_next_scheduled('wordfence_scheduled_scan') - time(); |
| 193 | if($secsToGo < 1){ |
| 194 | $nextRun = 'now'; |
| 195 | } else { |
| 196 | $nextRun = wfUtils::makeTimeAgo($secsToGo) . ' from now'; |
| 197 | } |
| 198 | $arr['nextRun'] = $nextRun; |
| 199 | |
| 200 | $arr['totalCritical'] = $this->getDB()->querySingle("select count(*) as cnt from " . $this->issuesTable . " where status='new' and severity=1"); |
| 201 | $arr['totalWarning'] = $this->getDB()->querySingle("select count(*) as cnt from " . $this->issuesTable . " where status='new' and severity=2"); |
| 202 | |
| 203 | return $arr; |
| 204 | } |
| 205 | private function updateSummaryItems(){ |
| 206 | global $wpdb; |
| 207 | $dat = array(); |
| 208 | $users = $wpdb->get_col($wpdb->prepare("SELECT $wpdb->users.ID FROM $wpdb->users")); |
| 209 | $dat['totalUsers'] = sizeof($users); |
| 210 | $res1 = $wpdb->get_col($wpdb->prepare("SELECT count(*) as cnt FROM $wpdb->posts where post_type='page' and post_status NOT IN ('auto-draft')")); $dat['totalPages'] = $res1['0']; |
| 211 | $res1 = $wpdb->get_col($wpdb->prepare("SELECT count(*) as cnt FROM $wpdb->posts where post_type='post' and post_status NOT IN ('auto-draft')")); $dat['totalPosts'] = $res1['0']; |
| 212 | $res1 = $wpdb->get_col($wpdb->prepare("SELECT count(*) as cnt FROM $wpdb->comments")); $dat['totalComments'] = $res1['0']; |
| 213 | $res1 = $wpdb->get_col($wpdb->prepare("SELECT count(*) as cnt FROM $wpdb->term_taxonomy where taxonomy='category'")); $dat['totalCategories'] = $res1['0']; |
| 214 | $res1 = $wpdb->get_col($wpdb->prepare("show tables")); $dat['totalTables'] = sizeof($res1); |
| 215 | $totalRows = 0; |
| 216 | foreach($res1 as $table){ |
| 217 | $res2 = $wpdb->get_col($wpdb->prepare("select count(*) from $table")); |
| 218 | $totalRows += $res2[0]; |
| 219 | } |
| 220 | $dat['totalRows'] = $totalRows; |
| 221 | $arr = wfConfig::get_ser('wf_summaryItems', array()); |
| 222 | foreach($dat as $key => $val){ |
| 223 | $arr[$key] = $val; |
| 224 | } |
| 225 | wfConfig::set_ser('wf_summaryItems', $arr); |
| 226 | } |
| 227 | public function setScanTimeNow(){ |
| 228 | $this->updateSummaryItem('scanTime', microtime(true)); |
| 229 | } |
| 230 | public function getScanTime(){ |
| 231 | return $this->getSummaryItem('scanTime'); |
| 232 | } |
| 233 | private function getDB(){ |
| 234 | if(! $this->db){ |
| 235 | $this->db = new wfDB(); |
| 236 | } |
| 237 | return $this->db; |
| 238 | } |
| 239 | } |
| 240 | |
| 241 | ?> |
| 242 |