wfScan.php — Wordfence Security – Firewall, Malware Scan, and Login Security 6.1.3

wordfence / lib / wfScan.php

wordfence / lib Last commit date

wfScan.php

198 lines

1	<?php
2	class wfScan {
3	public static $debugMode = false;
4	public static $errorHandlingOn = true;
5	private static $peakMemAtStart = 0;
6	public static function wfScanMain(){
7	self::$peakMemAtStart = memory_get_peak_usage();
8	$db = new wfDB();
9	if($db->errorMsg){
10	self::errorExit("Could not connect to database to start scan: " . $db->errorMsg);
11	}
12	if(! wordfence::wfSchemaExists()){
13	self::errorExit("Looks like the Wordfence database tables have been deleted. You can fix this by de-activating and re-activating the Wordfence plugin from your Plugins menu.");
14	}
15	if( isset( $_GET['test'] ) && $_GET['test'] == '1'){
16	echo "WFCRONTESTOK:" . wfConfig::get('cronTestID');
17	self::status(4, 'info', "Cron test received and message printed");
18	exit();
19	}
20	/* ----------Starting cronkey check -------- */
21	self::status(4, 'info', "Scan engine received request.");
22	self::status(4, 'info', "Checking cronkey");
23	if(! $_GET['cronKey']){
24	self::status(4, 'error', "Wordfence scan script accessed directly, or WF did not receive a cronkey.");
25	echo "If you see this message it means Wordfence is working correctly. You should not access this URL directly. It is part of the Wordfence security plugin and is designed for internal use only.";
26	exit();
27	}
28	self::status(4, 'info', "Fetching stored cronkey for comparison.");
29	$currentCronKey = wfConfig::get('currentCronKey', false);
30	wfConfig::set('currentCronKey', '');
31	if(! $currentCronKey){
32	wordfence::status(4, 'error', "Wordfence could not find a saved cron key to start the scan so assuming it started and exiting.");
33	exit();
34	}
35	self::status(4, 'info', "Exploding stored cronkey");
36	$savedKey = explode(',',$currentCronKey);
37	if(time() - $savedKey[0] > 86400){
38	self::errorExit("The key used to start a scan expired. The value is: " . $savedKey[0] . " and split is: " . $currentCronKey . " and time is: " . time());
39	} //keys only last 60 seconds and are used within milliseconds of creation
40	self::status(4, 'info', "Checking saved cronkey against cronkey param");
41	if($savedKey[1] != $_GET['cronKey']){
42	self::errorExit("Wordfence could not start a scan because the cron key does not match the saved key. Saved: " . $savedKey[1] . " Sent: " . $_GET['cronKey'] . " Current unexploded: " . $currentCronKey);
43	}
44	/* --------- end cronkey check ---------- */
45
46	self::status(4, 'info', "Becoming admin for scan");
47	self::becomeAdmin();
48	self::status(4, 'info', "Done become admin");
49
50	$isFork = ($_GET['isFork'] == '1' ? true : false);
51
52	if(! $isFork){
53	self::status(4, 'info', "Checking if scan is already running");
54	if(! wfUtils::getScanLock()){
55	self::errorExit("There is already a scan running.");
56	}
57	}
58	self::status(4, 'info', "Requesting max memory");
59	wfUtils::requestMaxMemory();
60	self::status(4, 'info', "Setting up error handling environment");
61	set_error_handler('wfScan::error_handler', E_ALL);
62	register_shutdown_function('wfScan::shutdown');
63	if(! self::$debugMode){
64	ob_start('wfScan::obHandler');
65	}
66	@error_reporting(E_ALL);
67	wfUtils::iniSet('display_errors','On');
68	self::status(4, 'info', "Setting up scanRunning and starting scan");
69	if($isFork){
70	$scan = wfConfig::get_ser('wfsd_engine', false, true);
71	if($scan){
72	self::status(4, 'info', "Got a true deserialized value back from 'wfsd_engine' with type: " . gettype($scan));
73	wfConfig::set('wfsd_engine', '', true);
74	} else {
75	self::status(2, 'error', "Scan can't continue - stored data not found after a fork. Got type: " . gettype($scan));
76	wfConfig::set('wfsd_engine', '', true);
77	exit();
78	}
79	} else {
80	wordfence::statusPrep(); //Re-initializes all status counters
81	$scan = new wfScanEngine();
82	$scan->deleteNewIssues();
83	}
84	try {
85	$scan->go();
86	} catch (Exception $e){
87	wfUtils::clearScanLock();
88	self::status(2, 'error', "Scan terminated with error: " . $e->getMessage());
89	self::status(10, 'info', "SUM_KILLED:Previous scan terminated with an error. See below.");
90	exit();
91	}
92	wfUtils::clearScanLock();
93	self::logPeakMemory();
94	self::status(2, 'info', "Wordfence used " . sprintf('%.2f', (wfConfig::get('wfPeakMemory') - self::$peakMemAtStart) / 1024 / 1024) . "MB of memory for scan. Server peak memory usage was: " . sprintf('%.2f', wfConfig::get('wfPeakMemory') / 1024 / 1024) . "MB");
95	}
96	private static function logPeakMemory(){
97	$oldPeak = wfConfig::get('wfPeakMemory', 0);
98	$peak = memory_get_peak_usage();
99	if($peak > $oldPeak){
100	wfConfig::set('wfPeakMemory', $peak);
101	}
102	}
103	public static function obHandler($buf){
104	if(strlen($buf) > 1000){
105	$buf = substr($buf, 0, 255);
106	}
107	if(empty($buf) === false && preg_match('/[a-zA-Z0-9]+/', $buf)){
108	self::status(1, 'error', $buf);
109	}
110	}
111	public static function error_handler($errno, $errstr, $errfile, $errline){
112	if(self::$errorHandlingOn){
113	if(preg_match('/wordfence\//', $errfile)){
114	$level = 1; //It's one of our files, so level 1
115	} else {
116	$level = 4; //It's someone elses plugin so only show if debug is enabled
117	}
118	self::status($level, 'error', "$errstr ($errno) File: $errfile Line: $errline");
119	}
120	return false;
121	}
122	public static function shutdown(){
123	self::logPeakMemory();
124	}
125	private static function errorExit($msg){
126	wordfence::status(1, 'error', "Scan Engine Error: $msg");
127	exit();
128	}
129	public static function becomeAdmin(){
130	$db = new wfDB();
131	global $wpdb;
132	$userSource = '';
133	if(is_multisite()){
134	$users = get_users('role=super&fields=ID');
135	if(sizeof($users) < 1){
136	$supers = get_super_admins();
137	if(sizeof($supers) > 0){
138	foreach($supers as $superLogin){
139	$superDat = get_user_by('login', $superLogin);
140	if($superDat){
141	$users = array($superDat->ID);
142	$userSource = 'multisite get_super_admins() function';
143	break;
144	}
145	}
146	}
147	} else {
148	$userSource = 'multisite get_users() function';
149	}
150	} else {
151	$users = get_users('role=administrator&fields=ID');
152	if(sizeof($users) < 1){
153	$supers = get_super_admins();
154	if(sizeof($supers) > 0){
155	foreach($supers as $superLogin){
156	$superDat = get_user_by('login', $superLogin);
157	if($superDat){
158	$users = array($superDat->ID);
159	$userSource = 'singlesite get_super_admins() function';
160	break;
161	}
162	}
163	}
164	} else {
165	$userSource = 'singlesite get_users() function';
166	}
167	}
168	if(sizeof($users) > 0){
169	sort($users, SORT_NUMERIC);
170	$adminUserID = $users[0];
171	} else {
172	//Last ditch attempt
173	$adminUserID = $db->querySingle("select user_id from " . $wpdb->usermeta . " where meta_key='" . $wpdb->base_prefix . "user_level' order by meta_value desc, user_id asc limit 1");
174	if(! $adminUserID){
175	//One final attempt for those who have changed their table prefixes but the meta_key is still wp_ prefixed...
176	$adminUserID = $db->querySingle("select user_id from " . $wpdb->usermeta . " where meta_key='wp_user_level' order by meta_value desc, user_id asc limit 1");
177	if(! $adminUserID){
178	self::status(1, 'error', "Could not get the administrator's user ID. Scan can't continue.");
179	exit();
180	}
181	}
182	$userSource = 'manual DB query';
183	}
184	$adminUsername = $db->querySingle("select user_login from " . $wpdb->users . " where ID=%d", $adminUserID);
185	self::status(4, 'info', "Scan will run as admin user '$adminUsername' with ID '$adminUserID' sourced from: $userSource");
186	wp_set_current_user($adminUserID);
187	if(! is_user_logged_in()){
188	self::status(1, 'error', "Scan could not sign in as user '$adminUsername' with ID '$adminUserID' from source '$userSource'. Scan can't continue.");
189	exit();
190	}
191	self::status(4, 'info', "Scan authentication complete.");
192	}
193	private static function status($level, $type, $msg){
194	wordfence::status($level, $type, $msg);
195	}
196	}
197	?>
198