← All changes | plugin.php +48 -84 6.48 → 5.09 View file →

		@@ -4,12 +4,10 @@
4	4	Plugin URI: https://wpremote.com
5	5	Description: Manage your WordPress site with <a href="https://wpremote.com/">WP Remote</a>.
6	6	Author: WP Remote
7	7	Author URI: https://wpremote.com
8		-Version: 6.48
	8	+Version: 5.09
9	9	Network: True
10		-License: GPLv2 or later
11		-License URI: [http://www.gnu.org/licenses/gpl-2.0.html](http://www.gnu.org/licenses/gpl-2.0.html)
12	10	*/
13	11
14	12	/* Copyright 2017 WP Remote (email : support@wpremote.com)
15	13
		@@ -39,13 +37,8 @@
39	37	require_once dirname( __FILE__ ) . '/wp_actions.php';
40	38	require_once dirname( __FILE__ ) . '/info.php';
41	39	require_once dirname( __FILE__ ) . '/account.php';
42	40	require_once dirname( __FILE__ ) . '/helper.php';
43		-require_once dirname( __FILE__ ) . '/wp_file_system.php';
44		-require_once dirname( __FILE__ ) . '/wp_2fa/wp_2fa.php';
45		-
46		-require_once dirname( __FILE__ ) . '/wp_login_whitelabel.php';
47		-
48	41	##WPCACHEMODULE##
49	42
50	43
51	44	$bvsettings = new WPRWPSettings();
		@@ -60,12 +53,10 @@
60	53	register_uninstall_hook(__FILE__, array('WPRWPAction', 'uninstall'));
61	54	register_activation_hook(__FILE__, array($wp_action, 'activate'));
62	55	register_deactivation_hook(__FILE__, array($wp_action, 'deactivate'));
63	56
64		-
65	57	add_action('wp_footer', array($wp_action, 'footerHandler'), 100);
66		-add_action('wpr_clear_bv_services_config', array($wp_action, 'clear_bv_services_config'));
67		-
	58	+add_action('clear_bv_services_config', array($wp_action, 'clear_bv_services_config'));
68	59	##SOADDUNINSTALLACTION##
69	60
70	61	##DISABLE_OTHER_OPTIMIZATION_PLUGINS##
71	62
		@@ -73,9 +64,9 @@
73	64	if (is_admin()) {
74	65	require_once dirname( __FILE__ ) . '/wp_admin.php';
75	66	$wpadmin = new WPRWPAdmin($bvsettings, $bvsiteinfo);
76	67	add_action('admin_init', array($wpadmin, 'initHandler'));
77		- add_filter('all_plugins', array($wpadmin, 'initWhitelabel'));
	68	+ add_filter('all_plugins', array($wpadmin, 'initBranding'));
78	69	add_filter('plugin_row_meta', array($wpadmin, 'hidePluginDetails'), 10, 2);
79	70	add_filter('debug_information', array($wpadmin, 'handlePluginHealthInfo'), 10, 1);
80	71	if ($bvsiteinfo->isMultisite()) {
81	72	add_action('network_admin_menu', array($wpadmin, 'menu'));
		@@ -83,11 +74,8 @@
83	74	add_action('admin_menu', array($wpadmin, 'menu'));
84	75	}
85	76	add_filter('plugin_action_links', array($wpadmin, 'settingsLink'), 10, 2);
86	77	add_action('admin_head', array($wpadmin, 'removeAdminNotices'), 3);
87		-
88		- ##MG_AJAX_ACTIONS##
89		- ##POPUP_ON_DEACTIVATION##
90	78	add_action('admin_notices', array($wpadmin, 'activateWarning'));
91	79	add_action('admin_enqueue_scripts', array($wpadmin, 'wprsecAdminMenu'));
92	80	##ALPURGECACHEFUNCTION##
93	81	##ALADMINMENU##
		@@ -92,20 +80,12 @@
92	80	##ALPURGECACHEFUNCTION##
93	81	##ALADMINMENU##
94	82	}
95	83
96		-if ((array_key_exists('bvreqmerge', $_POST)) || (array_key_exists('bvreqmerge', $_GET))) { // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
97		- $_REQUEST = array_merge($_GET, $_POST); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
	84	+if ((array_key_exists('bvreqmerge', $_POST)) || (array_key_exists('bvreqmerge', $_GET))) {
	85	+ $_REQUEST = array_merge($_GET, $_POST);
98	86	}
99	87
100		-#Service active check
101		-if ($bvinfo->config != false) {
102		- add_action('wpr_remove_bv_preload_include', array($wp_action, 'removeBVPreload'));
103		-}
104		-
105		-require_once dirname( __FILE__ ) . '/php_error_monitoring/monitoring.php';
106		-WPRWPPHPErrorMonitoring::init();
107		-
108	88	if ($bvinfo->hasValidDBVersion()) {
109	89	if ($bvinfo->isServiceActive('activity_log')) {
110	90	require_once dirname( __FILE__ ) . '/wp_actlog.php';
111	91	$bvconfig = $bvinfo->config;
		@@ -112,76 +92,74 @@
112	92	$actlog = new BVWPActLog($bvdb, $bvsettings, $bvinfo, $bvconfig['activity_log']);
113	93	$actlog->init();
114	94	}
115	95
116		- ##MAINTENANCEMODULE##
117	96	}
118	97
119		-if (WPRHelper::getRawParam('REQUEST', 'bvplugname') == "wpremote") {
	98	+if ((array_key_exists('bvplugname', $_REQUEST)) && ($_REQUEST['bvplugname'] == "wpremote")) {
120	99	require_once dirname( __FILE__ ) . '/callback/base.php';
121	100	require_once dirname( __FILE__ ) . '/callback/response.php';
122	101	require_once dirname( __FILE__ ) . '/callback/request.php';
123	102	require_once dirname( __FILE__ ) . '/recover.php';
124	103
125		- $pubkey = WPRHelper::getRawParam('REQUEST', 'pubkey');
126		- $pubkey = isset($pubkey) ? WPRAccount::sanitizeKey($pubkey) : '';
127		- $rcvracc = WPRHelper::getRawParam('REQUEST', 'rcvracc');
	104	+ $pubkey = WPRAccount::sanitizeKey($_REQUEST['pubkey']);
128	105
129		- if (isset($rcvracc)) {
	106	+ if (array_key_exists('rcvracc', $_REQUEST)) {
130	107	$account = WPRRecover::find($bvsettings, $pubkey);
131	108	} else {
132	109	$account = WPRAccount::find($bvsettings, $pubkey);
133	110	}
134	111
135		- $request = new WPRCallbackRequest($account, $_REQUEST, $bvsettings); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
136		- $response = new WPRCallbackResponse($request->bvb64cksize);
	112	+ $request = new BVCallbackRequest($account, $_REQUEST);
	113	+ $response = new BVCallbackResponse($request->bvb64cksize);
137	114
138		- if ($request->authenticate() === 1) {
139		- $bv_frm_tstng = WPRHelper::getRawParam('REQUEST', 'bv_frm_tstng');
140		- if (isset($bv_frm_tstng)) {
141		- require_once dirname(__FILE__) . '/form_testing/form_testing.php';
142		- $form_testing = new BVFormTesting($_REQUEST); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
143		- $form_testing->init();
	115	+ if ($account && (1 === $account->authenticate($request))) {
	116	+ define('WPRBASEPATH', plugin_dir_path(__FILE__));
144	117
145		- } else {
146		- define('WPRBASEPATH', plugin_dir_path(__FILE__));
147	118
	119	+ require_once dirname( __FILE__ ) . '/callback/handler.php';
148	120
149		- require_once dirname( __FILE__ ) . '/callback/handler.php';
150		-
151		- $params = $request->processParams($_REQUEST); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
152		- if ($params === false) {
153		- $response->terminate($request->corruptedParamsResp());
154		- }
155		- $request->params = $params;
156		- $callback_handler = new WPRCallbackHandler($bvdb, $bvsettings, $bvsiteinfo, $request, $account, $response);
157		- if ($request->is_afterload) {
158		- add_action('wp_loaded', array($callback_handler, 'execute'));
159		- } else if ($request->is_admin_ajax) {
160		- add_action('wp_ajax_bvadm', array($callback_handler, 'bvAdmExecuteWithUser'));
161		- add_action('wp_ajax_nopriv_bvadm', array($callback_handler, 'bvAdmExecuteWithoutUser'));
162		- } else {
163		- $callback_handler->execute();
164		- }
	121	+ $params = $request->processParams($_REQUEST);
	122	+ if ($params === false) {
	123	+ $resp = array(
	124	+ "account_info" => $account->info(),
	125	+ "request_info" => $request->info(),
	126	+ "bvinfo" => $bvinfo->info(),
	127	+ "statusmsg" => "BVPRMS_CORRUPTED"
	128	+ );
	129	+ $response->terminate($resp);
165	130	}
	131	+ $request->params = $params;
	132	+ $callback_handler = new BVCallbackHandler($bvdb, $bvsettings, $bvsiteinfo, $request, $account, $response);
	133	+ if ($request->is_afterload) {
	134	+ add_action('wp_loaded', array($callback_handler, 'execute'));
	135	+ } else if ($request->is_admin_ajax) {
	136	+ add_action('wp_ajax_bvadm', array($callback_handler, 'bvAdmExecuteWithUser'));
	137	+ add_action('wp_ajax_nopriv_bvadm', array($callback_handler, 'bvAdmExecuteWithoutUser'));
	138	+ } else {
	139	+ $callback_handler->execute();
	140	+ }
166	141	} else {
167		- $response->terminate($request->authFailedResp());
	142	+ $resp = array(
	143	+ "account_info" => $account ? $account->info() : array("error" => "ACCOUNT_NOT_FOUND"),
	144	+ "request_info" => $request->info(),
	145	+ "bvinfo" => $bvinfo->info(),
	146	+ "statusmsg" => "FAILED_AUTH",
	147	+ "api_pubkey" => substr(WPRAccount::getApiPublicKey($bvsettings), 0, 8),
	148	+ "def_sigmatch" => substr(WPRAccount::getSigMatch($request, WPRRecover::getDefaultSecret($bvsettings)), 0, 8)
	149	+ );
	150	+ $response->terminate($resp);
168	151	}
169	152	} else {
170	153	if ($bvinfo->hasValidDBVersion()) {
171	154	if ($bvinfo->isProtectModuleEnabled()) {
172		- require_once dirname( __FILE__ ) . '/protect/protect.php';
173		- //For backward compatibility.
174		- WPRProtect_V648::$settings = new WPRWPSettings();
175		- WPRProtect_V648::$db = new WPRWPDb();
176		- WPRProtect_V648::$info = new WPRInfo(WPRProtect_V648::$settings);
177		-
178		- add_action('wpr_clear_pt_config', array('WPRProtect_V648', 'uninstall'));
179		-
180		- if ($bvinfo->isActivePlugin()) {
181		- WPRProtect_V648::init(WPRProtect_V648::MODE_WP);
182		- }
	155	+ require_once dirname( __FILE__ ) . '/protect/wp/protect.php';
	156	+ $bvprotect = new BVProtect($bvdb, $bvsettings);
	157	+ $bvprotect->init();
	158	+ if ($bvinfo->isActivePlugin() && !(defined( 'WP_CLI' ) && WP_CLI)) {
	159	+ $bvprotect->run();
183	160	}
	161	+ }
184	162
185	163	if ($bvinfo->isDynSyncModuleEnabled()) {
186	164	require_once dirname( __FILE__ ) . '/wp_dynsync.php';
187	165	$bvconfig = $bvinfo->config;
		@@ -214,19 +192,5 @@
214	192	if (is_admin()) {
215	193	add_filter('site_transient_update_plugins', array($wpadmin, 'hidePluginUpdate'));
216	194	}
217	195
218		- ##THIRDPARTYCACHINGMODULE##
219		-}
220		-
221		-if (WPRWP2FA::isEnabled($bvsettings)) {
222		- $wp_2fa = new WPRWP2FA();
223		- $wp_2fa->init();
224		-}
225		-
226		-if (!empty($bvinfo->getLPWhitelabelInfo())) {
227		- $wp_login_whitelabel = new WPRWPLoginWhitelabel();
228		- $wp_login_whitelabel->init();
229		-}
230		-
231		-add_action('wpr_clear_wp_2fa_config', array($wp_action, 'clear_wp_2fa_config'));
232		-##PLUGIN_LOADED_MODULE##
	196	+}