← All changes | plugin.php +81 -47 4.97 → 5.93 View file →

		@@ -4,10 +4,12 @@
4	4	Plugin URI: https://wpremote.com
5	5	Description: Manage your WordPress site with <a href="https://wpremote.com/">WP Remote</a>.
6	6	Author: WP Remote
7	7	Author URI: https://wpremote.com
8		-Version: 4.97
	8	+Version: 5.93
9	9	Network: True
	10	+License: GPLv2 or later
	11	+License URI: [http://www.gnu.org/licenses/gpl-2.0.html](http://www.gnu.org/licenses/gpl-2.0.html)
10	12	*/
11	13
12	14	/* Copyright 2017 WP Remote (email : support@wpremote.com)
13	15
		@@ -36,8 +38,14 @@
36	38	require_once dirname( __FILE__ ) . '/wp_api.php';
37	39	require_once dirname( __FILE__ ) . '/wp_actions.php';
38	40	require_once dirname( __FILE__ ) . '/info.php';
39	41	require_once dirname( __FILE__ ) . '/account.php';
	42	+require_once dirname( __FILE__ ) . '/helper.php';
	43	+require_once dirname( __FILE__ ) . '/wp_file_system.php';
	44	+require_once dirname( __FILE__ ) . '/wp_2fa/wp_2fa.php';
	45	+
	46	+require_once dirname( __FILE__ ) . '/wp_login_whitelabel.php';
	47	+
40	48	##WPCACHEMODULE##
41	49
42	50
43	51	$bvsettings = new WPRWPSettings();
		@@ -52,10 +60,12 @@
52	60	register_uninstall_hook(__FILE__, array('WPRWPAction', 'uninstall'));
53	61	register_activation_hook(__FILE__, array($wp_action, 'activate'));
54	62	register_deactivation_hook(__FILE__, array($wp_action, 'deactivate'));
55	63
	64	+
56	65	add_action('wp_footer', array($wp_action, 'footerHandler'), 100);
57		-add_action('clear_bv_services_config', array($wp_action, 'clear_bv_services_config'));
	66	+add_action('wpr_clear_bv_services_config', array($wp_action, 'clear_bv_services_config'));
	67	+
58	68	##SOADDUNINSTALLACTION##
59	69
60	70	##DISABLE_OTHER_OPTIMIZATION_PLUGINS##
61	71
		@@ -63,9 +73,9 @@
63	73	if (is_admin()) {
64	74	require_once dirname( __FILE__ ) . '/wp_admin.php';
65	75	$wpadmin = new WPRWPAdmin($bvsettings, $bvsiteinfo);
66	76	add_action('admin_init', array($wpadmin, 'initHandler'));
67		- add_filter('all_plugins', array($wpadmin, 'initBranding'));
	77	+ add_filter('all_plugins', array($wpadmin, 'initWhitelabel'));
68	78	add_filter('plugin_row_meta', array($wpadmin, 'hidePluginDetails'), 10, 2);
69	79	add_filter('debug_information', array($wpadmin, 'handlePluginHealthInfo'), 10, 1);
70	80	if ($bvsiteinfo->isMultisite()) {
71	81	add_action('network_admin_menu', array($wpadmin, 'menu'));
		@@ -73,8 +83,9 @@
73	83	add_action('admin_menu', array($wpadmin, 'menu'));
74	84	}
75	85	add_filter('plugin_action_links', array($wpadmin, 'settingsLink'), 10, 2);
76	86	add_action('admin_head', array($wpadmin, 'removeAdminNotices'), 3);
	87	+ ##POPUP_ON_DEACTIVATION##
77	88	add_action('admin_notices', array($wpadmin, 'activateWarning'));
78	89	add_action('admin_enqueue_scripts', array($wpadmin, 'wprsecAdminMenu'));
79	90	##ALPURGECACHEFUNCTION##
80	91	##ALADMINMENU##
		@@ -79,12 +90,20 @@
79	90	##ALPURGECACHEFUNCTION##
80	91	##ALADMINMENU##
81	92	}
82	93
83		-if ((array_key_exists('bvreqmerge', $_POST)) || (array_key_exists('bvreqmerge', $_GET))) {
84		- $_REQUEST = array_merge($_GET, $_POST);
	94	+if ((array_key_exists('bvreqmerge', $_POST)) || (array_key_exists('bvreqmerge', $_GET))) { // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
	95	+ $_REQUEST = array_merge($_GET, $_POST); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
85	96	}
86	97
	98	+#Service active check
	99	+if ($bvinfo->config != false) {
	100	+ add_action('wpr_remove_bv_preload_include', array($wp_action, 'removeBVPreload'));
	101	+}
	102	+
	103	+require_once dirname( __FILE__ ) . '/php_error_monitoring/monitoring.php';
	104	+WPRWPPHPErrorMonitoring::init();
	105	+
87	106	if ($bvinfo->hasValidDBVersion()) {
88	107	if ($bvinfo->isServiceActive('activity_log')) {
89	108	require_once dirname( __FILE__ ) . '/wp_actlog.php';
90	109	$bvconfig = $bvinfo->config;
		@@ -91,74 +110,76 @@
91	110	$actlog = new BVWPActLog($bvdb, $bvsettings, $bvinfo, $bvconfig['activity_log']);
92	111	$actlog->init();
93	112	}
94	113
	114	+ ##MAINTENANCEMODULE##
95	115	}
96	116
97		-if ((array_key_exists('bvplugname', $_REQUEST)) && ($_REQUEST['bvplugname'] == "wpremote")) {
	117	+if (WPRHelper::getRawParam('REQUEST', 'bvplugname') == "wpremote") {
98	118	require_once dirname( __FILE__ ) . '/callback/base.php';
99	119	require_once dirname( __FILE__ ) . '/callback/response.php';
100	120	require_once dirname( __FILE__ ) . '/callback/request.php';
101	121	require_once dirname( __FILE__ ) . '/recover.php';
102	122
103		- $pubkey = WPRAccount::sanitizeKey($_REQUEST['pubkey']);
	123	+ $pubkey = WPRHelper::getRawParam('REQUEST', 'pubkey');
	124	+ $pubkey = isset($pubkey) ? WPRAccount::sanitizeKey($pubkey) : '';
	125	+ $rcvracc = WPRHelper::getRawParam('REQUEST', 'rcvracc');
104	126
105		- if (array_key_exists('rcvracc', $_REQUEST)) {
	127	+ if (isset($rcvracc)) {
106	128	$account = WPRRecover::find($bvsettings, $pubkey);
107	129	} else {
108	130	$account = WPRAccount::find($bvsettings, $pubkey);
109	131	}
110	132
111		- $request = new BVCallbackRequest($account, $_REQUEST);
	133	+ $request = new BVCallbackRequest($account, $_REQUEST, $bvsettings); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
112	134	$response = new BVCallbackResponse($request->bvb64cksize);
113	135
114		- if ($account && (1 === $account->authenticate($request))) {
115		- define('WPRBASEPATH', plugin_dir_path(__FILE__));
	136	+ if ($request->authenticate() === 1) {
	137	+ $bv_frm_tstng = WPRHelper::getRawParam('REQUEST', 'bv_frm_tstng');
	138	+ if (isset($bv_frm_tstng)) {
	139	+ require_once dirname(__FILE__) . '/form_testing/form_testing.php';
	140	+ $form_testing = new BVFormTesting($_REQUEST); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	141	+ $form_testing->init();
116	142
	143	+ } else {
	144	+ define('WPRBASEPATH', plugin_dir_path(__FILE__));
117	145
118		- require_once dirname( __FILE__ ) . '/callback/handler.php';
119	146
120		- $params = $request->processParams($_REQUEST);
121		- if ($params === false) {
122		- $resp = array(
123		- "account_info" => $account->info(),
124		- "request_info" => $request->info(),
125		- "bvinfo" => $bvinfo->info(),
126		- "statusmsg" => "BVPRMS_CORRUPTED"
127		- );
128		- $response->terminate($resp);
	147	+ require_once dirname( __FILE__ ) . '/callback/handler.php';
	148	+
	149	+ $params = $request->processParams($_REQUEST); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	150	+ if ($params === false) {
	151	+ $response->terminate($request->corruptedParamsResp());
	152	+ }
	153	+ $request->params = $params;
	154	+ $callback_handler = new BVCallbackHandler($bvdb, $bvsettings, $bvsiteinfo, $request, $account, $response);
	155	+ if ($request->is_afterload) {
	156	+ add_action('wp_loaded', array($callback_handler, 'execute'));
	157	+ } else if ($request->is_admin_ajax) {
	158	+ add_action('wp_ajax_bvadm', array($callback_handler, 'bvAdmExecuteWithUser'));
	159	+ add_action('wp_ajax_nopriv_bvadm', array($callback_handler, 'bvAdmExecuteWithoutUser'));
	160	+ } else {
	161	+ $callback_handler->execute();
	162	+ }
129	163	}
130		- $request->params = $params;
131		- $callback_handler = new BVCallbackHandler($bvdb, $bvsettings, $bvsiteinfo, $request, $account, $response);
132		- if ($request->is_afterload) {
133		- add_action('wp_loaded', array($callback_handler, 'execute'));
134		- } else if ($request->is_admin_ajax) {
135		- add_action('wp_ajax_bvadm', array($callback_handler, 'bvAdmExecuteWithUser'));
136		- add_action('wp_ajax_nopriv_bvadm', array($callback_handler, 'bvAdmExecuteWithoutUser'));
137		- } else {
138		- $callback_handler->execute();
139		- }
140	164	} else {
141		- $resp = array(
142		- "account_info" => $account ? $account->info() : array("error" => "ACCOUNT_NOT_FOUND"),
143		- "request_info" => $request->info(),
144		- "bvinfo" => $bvinfo->info(),
145		- "statusmsg" => "FAILED_AUTH",
146		- "api_pubkey" => substr(WPRAccount::getApiPublicKey($bvsettings), 0, 8),
147		- "def_sigmatch" => substr(WPRAccount::getSigMatch($request, WPRRecover::getDefaultSecret($bvsettings)), 0, 8)
148		- );
149		- $response->terminate($resp);
	165	+ $response->terminate($request->authFailedResp());
150	166	}
151	167	} else {
152	168	if ($bvinfo->hasValidDBVersion()) {
153	169	if ($bvinfo->isProtectModuleEnabled()) {
154		- require_once dirname( __FILE__ ) . '/protect/wp/protect.php';
155		- $bvprotect = new BVProtect($bvdb, $bvsettings);
156		- $bvprotect->init();
157		- if ($bvinfo->isActivePlugin() && !(defined( 'WP_CLI' ) && WP_CLI)) {
158		- $bvprotect->run();
	170	+ require_once dirname( __FILE__ ) . '/protect/protect.php';
	171	+ //For backward compatibility.
	172	+ WPRProtect_V593::$settings = new WPRWPSettings();
	173	+ WPRProtect_V593::$db = new WPRWPDb();
	174	+ WPRProtect_V593::$info = new WPRInfo(WPRProtect_V593::$settings);
	175	+
	176	+ add_action('wpr_clear_pt_config', array('WPRProtect_V593', 'uninstall'));
	177	+
	178	+ if ($bvinfo->isActivePlugin()) {
	179	+ WPRProtect_V593::init(WPRProtect_V593::MODE_WP);
	180	+ }
159	181	}
160		- }
161	182
162	183	if ($bvinfo->isDynSyncModuleEnabled()) {
163	184	require_once dirname( __FILE__ ) . '/wp_dynsync.php';
164	185	$bvconfig = $bvinfo->config;
		@@ -191,5 +212,18 @@
191	212	if (is_admin()) {
192	213	add_filter('site_transient_update_plugins', array($wpadmin, 'hidePluginUpdate'));
193	214	}
194	215
195		-}
	216	+ ##THIRDPARTYCACHINGMODULE##
	217	+}
	218	+
	219	+if (WPRWP2FA::isEnabled($bvsettings)) {
	220	+ $wp_2fa = new WPRWP2FA();
	221	+ $wp_2fa->init();
	222	+}
	223	+
	224	+if (!empty($bvinfo->getLPWhitelabelInfo())) {
	225	+ $wp_login_whitelabel = new WPRWPLoginWhitelabel();
	226	+ $wp_login_whitelabel->init();
	227	+}
	228	+
	229	+add_action('wpr_clear_wp_2fa_config', array($wp_action, 'clear_wp_2fa_config'));