wpremote / callback / wings / security.php

security.php in The WP Remote WordPress Plugin 5.81, at callback/wings/security.php

175 lines 5.1 KB

Raw Download Zip

1	<?php
2	if (!defined('ABSPATH')) exit;
3	if (!class_exists('BVSecurityCallback')) :
4	class BVSecurityCallback extends BVCallbackBase {
5	private $settings;
6
7	public function __construct() {
8	$this->settings = new WPRWPSettings();
9	}
10
11	function getCrontab() {
12	$resp = array();
13
14	if (function_exists('exec')) {
15	$output = array();
16	$retval = -1;
17	$execRes = exec('crontab -l', $output, $retval);
18	if ($execRes !== false && $execRes !== null) {
19	$resp["content"] = implode("\n", $output);
20	$resp["status"] = "success";
21	$resp["code"] = $retval;
22	}
23	}
24	if (empty($resp) && function_exists('popen')) {
25	$handle = popen('crontab -l', 'rb');
26	if ($handle) {
27	$output = '';
28	while (!feof($handle)) {
29	$output .= fread($handle, 8192);
30	}
31	$resp["content"] = $output;
32	$resp["status"] = "success";
33	pclose($handle);
34	} else {
35	$resp["status"] = "failed";
36	}
37	}
38
39	return $resp;
40	}
41
42	public function setupWP2FA($secrets_by_uids, $to_encrypt, $cipher_algo, $enabled) {
43	if (!is_array($secrets_by_uids)) {
44	return array("status" => false, "message" => "secrets_by_uids is not an array.");
45	}
46
47	$result = array();
48	foreach ($secrets_by_uids as $user_id => $secret) {
49	if (empty($user_id) \|\| !is_string($secret)) {
50	continue;
51	}
52
53	if ($to_encrypt === true) {
54	if (empty($cipher_algo)) {
55	$cipher_algo = WPRWP2FA::$cipher_algo;
56	}
57
58	if (defined('SECURE_AUTH_KEY')) {
59	$encryption_result = WPRHelper::opensslEncrypt($secret, $cipher_algo, SECURE_AUTH_KEY);
60	if ($encryption_result[0] === false) {
61	return array("status" => false, "message" => $encryption_result[1]);
62	}
63	$secret = $encryption_result[1];
64	} else {
65	return array("status" => false, "message" => "Encryption key not found.");
66	}
67	}
68
69	$secret_info = array(
70	"secret" => base64_encode($secret),
71	"is_encrypted" => $to_encrypt
72	);
73
74	$result[$user_id][WPRWP2FA::SECRET_META_KEY] = update_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, $secret_info);
75	$result[$user_id][WPRWP2FA::FLAG_META_KEY] = update_user_meta($user_id, WPRWP2FA::FLAG_META_KEY, true);
76	}
77
78	if (is_bool($enabled)) {
79	$config = array("enabled" => $enabled);
80	$result[WPRWP2FA::$wp_2fa_option] = $this->settings->updateOption(WPRWP2FA::$wp_2fa_option, $config);
81	}
82
83	return array("status" => true, "result" => $result);
84	}
85
86	public function verifyWP2FACode($user_id, $code, $cipher_algo = null) {
87	$encoded_secret_info = get_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, true);
88
89	$secret_info = WPRWP2FAUtils::getSecretInfo($encoded_secret_info);
90	$secret = $secret_info['secret'];
91	$is_secret_encrypted = $secret_info['is_encrypted'];
92
93	if (is_null($secret) \|\| is_null($is_secret_encrypted)) {
94	return array("status" => false, "message" => "Secret and encryption status not found.");
95	}
96
97	if ($is_secret_encrypted === true) {
98	if (empty($cipher_algo)) {
99	$cipher_algo = WPRWP2FA::$cipher_algo;
100	}
101
102	if (defined('SECURE_AUTH_KEY')) {
103	$decryption_result = WPRHelper::opensslDecrypt($secret, $cipher_algo, SECURE_AUTH_KEY);
104	if ($decryption_result[0] === false) {
105	return array("status" => false, "message" => $decryption_result[1]);
106	}
107	$secret = $decryption_result[1];
108	} else {
109	return array("status" => false, "message" => "Decryption key not found.");
110	}
111	}
112
113	return array("status" => WPRWP2FAAuthenticator::verifyCode($secret, $code, 2));
114	}
115
116	public function readWP2FAKeys($user_id) {
117	$secret = get_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, true);
118	$enabled = get_user_meta($user_id, WPRWP2FA::FLAG_META_KEY, true);
119	return array(
120	"secret" => $secret,
121	"enabled" => $enabled
122	);
123	}
124
125	public function deleteWP2FAKeys($user_ids, $is_disable = false) {
126	$result = array();
127
128	foreach ($user_ids as $user_id) {
129	$secret_deleted = delete_user_meta($user_id, WPRWP2FA::SECRET_META_KEY);
130	$flag_deleted = delete_user_meta($user_id, WPRWP2FA::FLAG_META_KEY);
131	$result[$user_id] = array(
132	WPRWP2FA::SECRET_META_KEY => $secret_deleted,
133	WPRWP2FA::FLAG_META_KEY => $flag_deleted
134	);
135	}
136
137	if ($is_disable === true) {
138	$result[WPRWP2FA::$wp_2fa_option] = $this->settings->deleteOption(WPRWP2FA::$wp_2fa_option);
139	}
140
141	return array("status" => true, "result" => $result);
142	}
143
144	public function process($request) {
145	$params = $request->params;
146
147	switch ($request->method) {
148	case "gtcrntb":
149	$resp = $this->getCrontab();
150	break;
151	case "stupwp2fa":
152	$enable_wp_2fa = null;
153	if (array_key_exists('enable_wp_2fa', $request->params)) {
154	$enable_wp_2fa = $request->params['enable_wp_2fa'];
155	}
156
157	$resp = $this->setupWP2FA($params['secrets_by_uids'], $params['to_encrypt'], $params['cipher_algo'], $enable_wp_2fa);
158	break;
159	case "vrfywp2fa":
160	$resp = $this->verifyWP2FACode($params['user_id'], $params['code'], $params['cipher_algo']);
161	break;
162	case "rdwp2fa":
163	$resp = $this->readWP2FAKeys($params['user_id']);
164	break;
165	case "dltewp2fa":
166	$resp = $this->deleteWP2FAKeys($params['user_ids'], $params['is_disable']);
167	break;
168	default:
169	$resp = false;
170	}
171
172	return $resp;
173	}
174	}
175	endif;