wordfence
Last commit date
css
14 years ago
images
14 years ago
js
14 years ago
lib
14 years ago
.htaccess
14 years ago
readme.txt
14 years ago
screenshot-1.png
14 years ago
screenshot-2.png
14 years ago
screenshot-3.png
14 years ago
screenshot-4.png
14 years ago
screenshot-5.png
14 years ago
visitor.php
14 years ago
wfscan.php
14 years ago
wordfence.php
14 years ago
wfscan.php
143 lines
| 1 | <?php |
| 2 | /* Don't remove this line. WFSOURCEVISIBLE */ |
| 3 | ignore_user_abort(true); |
| 4 | $wordfence_wp_version = false; |
| 5 | if ( !defined('ABSPATH') ) { |
| 6 | /** Set up WordPress environment */ |
| 7 | if($_SERVER['SCRIPT_FILENAME']){ |
| 8 | $wfBaseDir = preg_replace('/[^\/]+\/[^\/]+\/[^\/]+\/wfscan\.php$/', '', $_SERVER['SCRIPT_FILENAME']); |
| 9 | require_once($wfBaseDir . 'wp-load.php'); |
| 10 | global $wp_version; |
| 11 | global $wordfence_wp_version; |
| 12 | require($wfBaseDir . 'wp-includes/version.php'); |
| 13 | $wordfence_wp_version = $wp_version; |
| 14 | } else { |
| 15 | require_once('../../../wp-load.php'); |
| 16 | require_once('../../../wp-includes/version.php'); |
| 17 | } |
| 18 | } |
| 19 | require_once('lib/wordfenceConstants.php'); |
| 20 | require_once('lib/wfScanEngine.php'); |
| 21 | |
| 22 | class wfScan { |
| 23 | public static $debugMode = false; |
| 24 | public static function wfScanMain(){ |
| 25 | $db = new wfDB(); |
| 26 | if($db->errorMsg){ |
| 27 | self::errorExit("Could not connect to database to start scan: " . $db->errorMsg); |
| 28 | } |
| 29 | if(! wordfence::wfSchemaExists()){ |
| 30 | self::errorExit("Looks like the Wordfence database tables have been deleted. You can fix this by de-activating and re-activating the Wordfence plugin from your Plugins menu."); |
| 31 | } |
| 32 | if(wfUtils::isAdmin() && $_GET['debugMode'] == '1'){ |
| 33 | header('Content-type: text/plain'); |
| 34 | wordfence::status(1, 'info', "Running in debug mode and writing directly to browser."); |
| 35 | if(! wp_verify_nonce($_GET['nonce'], 'wp-ajax')){ |
| 36 | echo("The security key (nonce) provided for this debug scan is invalid. Please close this window, refresh your options page and try again."); |
| 37 | exit(); |
| 38 | } |
| 39 | self::$debugMode = true; |
| 40 | wordfence::$printStatus = true; |
| 41 | } else { |
| 42 | wordfence::status(4, 'info', "Scan engine received request."); |
| 43 | wordfence::status(4, 'info', "Checking cronkey header"); |
| 44 | if(! $_SERVER['HTTP_X_WORDFENCE_CRONKEY']){ |
| 45 | self::errorExit("The Wordfence scanner did not receive the x_wordfence_cronkey secure header."); |
| 46 | } |
| 47 | wordfence::status(4, 'info', "Fetching stored cronkey for comparison."); |
| 48 | $currentCronKey = wfConfig::get('currentCronKey', false); |
| 49 | if(! $currentCronKey){ |
| 50 | self::errorExit("Wordfence could not find a saved cron key to start the scan."); |
| 51 | } |
| 52 | |
| 53 | wordfence::status(4, 'info', "Exploding stored cronkey"); |
| 54 | $savedKey = explode(',',$currentCronKey); |
| 55 | if(time() - $savedKey[0] > 60){ |
| 56 | self::errorExit("The key used to start a scan has expired."); |
| 57 | } //keys only last 60 seconds and are used within milliseconds of creation |
| 58 | wordfence::status(4, 'info', "Checking saved cronkey against cronkey header"); |
| 59 | if($savedKey[1] != $_SERVER['HTTP_X_WORDFENCE_CRONKEY']){ |
| 60 | self::errorExit("Wordfence could not start a scan because the cron key does not match the saved key."); |
| 61 | } |
| 62 | wordfence::status(4, 'info', "Deleting stored cronkey"); |
| 63 | wfConfig::set('currentCronKey', ''); |
| 64 | } |
| 65 | |
| 66 | ini_set('max_execution_time', 1800); //30 mins |
| 67 | wordfence::status(4, 'info', "Becoming admin for scan"); |
| 68 | self::becomeAdmin(); |
| 69 | |
| 70 | wordfence::status(4, 'info', "Checking if scan is already running"); |
| 71 | if(! wfUtils::getScanLock()){ |
| 72 | self::errorExit("There is already a scan running."); |
| 73 | } |
| 74 | wordfence::status(4, 'info', "Requesting max memory"); |
| 75 | wfUtils::requestMaxMemory(); |
| 76 | wordfence::status(4, 'info', "Setting up error handling environment"); |
| 77 | set_error_handler('wfScan::error_handler', E_ALL); |
| 78 | register_shutdown_function('wfScan::shutdown'); |
| 79 | if(! self::$debugMode){ |
| 80 | ob_start('wfScan::obHandler'); |
| 81 | } |
| 82 | @error_reporting(E_ALL); |
| 83 | @ini_set('display_errors','On'); |
| 84 | wordfence::status(4, 'info', "Setting up scanRunning and starting scan"); |
| 85 | $isFork = ($_GET['isFork'] == '1' ? true : false); |
| 86 | $scan = wfConfig::get_ser('wfsd_engine', false); |
| 87 | if($scan){ |
| 88 | //Set false so that we don't get stuck in a loop where we're repeating scan stages. |
| 89 | wfConfig::set('wfsd_engine', ''); |
| 90 | } else { |
| 91 | if($isFork){ //We encountered an error so blank scan and exit |
| 92 | wordfence::status(2, 'error', "Scan could not continue because the stored data could not be retrieved after a fork."); |
| 93 | //wfConfig::set('wfsd_engine', ''); |
| 94 | exit(); |
| 95 | } else { |
| 96 | wordfence::statusPrep(); //Re-initializes all status counters |
| 97 | $scan = new wfScanEngine(); |
| 98 | } |
| 99 | } |
| 100 | $scan->go(); |
| 101 | wfUtils::clearScanLock(); |
| 102 | } |
| 103 | public static function obHandler($buf){ |
| 104 | if(strlen($buf) > 1000){ |
| 105 | $buf = substr($buf, 0, 255); |
| 106 | } |
| 107 | if(empty($buf) === false && preg_match('/[a-zA-Z0-9]+/', $buf)){ |
| 108 | wordfence::status(1, 'error', $buf); |
| 109 | } |
| 110 | } |
| 111 | public static function error_handler($errno, $errstr, $errfile, $errline){ |
| 112 | wordfence::status(1, 'error', "$errstr ($errno) File: $errfile Line: $errline"); |
| 113 | } |
| 114 | public static function shutdown(){ |
| 115 | wfUtils::clearScanLock(); |
| 116 | } |
| 117 | private static function errorExit($msg){ |
| 118 | echo json_encode(array('errorMsg' => $msg)); |
| 119 | exit(); |
| 120 | } |
| 121 | public static function becomeAdmin(){ |
| 122 | global $wpdb; |
| 123 | $ws = $wpdb->get_results("SELECT ID, user_login FROM $wpdb->users"); |
| 124 | $users = array(); |
| 125 | foreach($ws as $user){ |
| 126 | $userDat = get_userdata($user->ID); |
| 127 | array_push($users, array( |
| 128 | 'id' => $user->ID, |
| 129 | 'user_login' => $user->user_login, |
| 130 | 'level' => $userDat->user_level |
| 131 | )); |
| 132 | } |
| 133 | usort($users, 'wfScan::usort'); |
| 134 | wp_set_current_user($users[0]['id'], $users[0]['user_login']); |
| 135 | } |
| 136 | public static function usort($b, $a){ |
| 137 | if($a['level'] == $b['level']){ return 0; } |
| 138 | return ($a['level'] < $b['level']) ? -1 : 1; |
| 139 | } |
| 140 | } |
| 141 | wfScan::wfScanMain(); |
| 142 | ?> |
| 143 |