PluginProbe
The WP Remote WordPress Plugin / 6.36
The WP Remote WordPress Plugin v6.36
6.72 6.69 6.65 6.62 6.48 6.47 4.87 4.97 5.05 5.09 5.16 5.22 5.24 5.25 5.38 5.41 5.42 5.45 5.47 5.53 5.56 5.65 5.68 5.72 5.73 All 53 releases
← All changes | protect/fw.php +202 -101 5.47 → 6.36 View file →
@@ -1,13 +1,13 @@
1 1 <?php
2 2 if (!defined('ABSPATH') && !defined('MCDATAPATH')) exit;
3 3
4 -if (!class_exists('WPRProtectFW_V547')) :
4 +if (!class_exists('WPRProtectFW_V636')) :
5 5 require_once dirname( __FILE__ ) . '/fw/rule/errors.php';
6 6 require_once dirname( __FILE__ ) . '/fw/rule/engine.php';
7 7 require_once dirname( __FILE__ ) . '/fw/rule.php';
8 8
9 -class WPRProtectFW_V547 {
9 +class WPRProtectFW_V636 {
10 10 private $brand_name;
11 11 private $protect_mode;
12 12 private $request;
13 13 private $ipstore;
@@ -21,28 +21,30 @@
21 21 private $is_on_boot_rules_executed = false;
22 22 private $is_ip_checked_for_blacklisted = false;
23 23 private $has_valid_bypass_cookie;
24 24
25 - private $mode = WPRProtectFW_V547::MODE_DISABLED;
26 - private $ip_cookie_mode = WPRProtectFW_V547::IP_COOKIE_MODE_DISABLED;
27 - private $admin_cookie_mode = WPRProtectFW_V547::ADMIN_COOKIE_MODE_DISABLED;
28 - private $bypass_level = WPRProtectFW_V547::WP_USER_ROLE_LEVEL_CONTRIBUTOR;
29 - private $wpf_rule_init_mode = WPRProtectFW_V547::WPF_RULE_INIT_MODE_WP;
25 + private $mode = WPRProtectFW_V636::MODE_DISABLED;
26 + private $ip_cookie_mode = WPRProtectFW_V636::IP_COOKIE_MODE_DISABLED;
27 + private $admin_cookie_mode = WPRProtectFW_V636::ADMIN_COOKIE_MODE_DISABLED;
28 + private $bypass_level = WPRProtectFW_V636::WP_USER_ROLE_LEVEL_CONTRIBUTOR;
29 + private $wpf_rule_init_mode = WPRProtectFW_V636::WPF_RULE_INIT_MODE_WP;
30 30 private $custom_roles = array();
31 31 private $cookie_key = "";
32 32 private $cookie_path = "";
33 33 private $cookie_domain = "";
34 + private $cookie_validity = 2592000;
34 35 private $can_set_cache_prevention_cookie = false;
35 - private $rules_mode = WPRProtectFW_V547::RULES_MODE_DISABLED;
36 + private $rules_mode = WPRProtectFW_V636::RULES_MODE_DISABLED;
36 37 private $is_geo_blocking = false;
37 38 private $is_wp_user_cookie_enabled = false;
38 39 private $log_config = array();
39 - private $request_profiling_mode = WPRProtectFW_V547::REQ_PROFILING_MODE_DISABLED;
40 - private $logging_mode = WPRProtectFW_V547::LOGGING_MODE_VISITOR;
40 + private $request_profiling_mode = WPRProtectFW_V636::REQ_PROFILING_MODE_DISABLED;
41 + private $logging_mode = WPRProtectFW_V636::LOGGING_MODE_VISITOR;
41 42 private $skip_log_config = array();
42 43 private $skip_log_cookies = array();
43 44 private $skip_log_headers = array();
44 45 private $skip_log_post_params = array();
46 + private $skip_log_json_params = array();
45 47 private $wp_user_caps_to_consider = array();
46 48
47 49 private $request_profiled_data = array();
48 50 private $rules = array();
@@ -49,8 +51,10 @@
49 51 private $wpf_rules = array();
50 52 private $rule_log = array();
51 53 private $matched_rules = array();
52 54 private $break_rule_matching = false;
55 + private $can_log_raw_body = false;
56 + private $log_slice_size = WPRProtectFW_V636::LOG_SLICE_SIZE;
53 57
54 58 private static $instance = null;
55 59
56 60 const MODE_DISABLED = 1;
@@ -94,18 +98,18 @@
94 98 const LOGGING_MODE_COMPLETE = 2;
95 99 const LOGGING_MODE_DISABLED = 3;
96 100
97 101 const DEFAULT_WP_USER_ROLE_LEVELS = array(
98 - 'administrator' => WPRProtectFW_V547::WP_USER_ROLE_LEVEL_ADMIN,
99 - 'editor' => WPRProtectFW_V547::WP_USER_ROLE_LEVEL_EDITOR,
100 - 'author' => WPRProtectFW_V547::WP_USER_ROLE_LEVEL_AUTHOR,
101 - 'contributor' => WPRProtectFW_V547::WP_USER_ROLE_LEVEL_CONTRIBUTOR,
102 - 'subscriber' => WPRProtectFW_V547::WP_USER_ROLE_LEVEL_SUBSCRIBER
102 + 'administrator' => WPRProtectFW_V636::WP_USER_ROLE_LEVEL_ADMIN,
103 + 'editor' => WPRProtectFW_V636::WP_USER_ROLE_LEVEL_EDITOR,
104 + 'author' => WPRProtectFW_V636::WP_USER_ROLE_LEVEL_AUTHOR,
105 + 'contributor' => WPRProtectFW_V636::WP_USER_ROLE_LEVEL_CONTRIBUTOR,
106 + 'subscriber' => WPRProtectFW_V636::WP_USER_ROLE_LEVEL_SUBSCRIBER
103 107 );
104 108
105 109 const EXTRA_WP_USER_ROLE_LEVELS = array(
106 - 'custom' => WPRProtectFW_V547::WP_USER_ROLE_LEVEL_CUSTOM,
107 - 'unknown' => WPRProtectFW_V547::WP_USER_ROLE_LEVEL_UNKNOWN
110 + 'custom' => WPRProtectFW_V636::WP_USER_ROLE_LEVEL_CUSTOM,
111 + 'unknown' => WPRProtectFW_V636::WP_USER_ROLE_LEVEL_UNKNOWN
108 112 );
109 113
110 114 const TABLE_NAME = "fw_requests";
111 115 const IP_COOKIE_NAME = "mcfw-ip-cookie";
@@ -111,8 +115,10 @@
111 115 const IP_COOKIE_NAME = "mcfw-ip-cookie";
112 116 const BYPASS_COOKIE_NAME = "mcfw-bypass-cookie";
113 117 const PREVENT_CACHE_COOKIE_NAME = "wp-mcfw-prevent-cache-cookie";
114 118
119 + const LOG_SLICE_SIZE = 1024;
120 +
115 121 private function __construct($protect_mode, $request, $config, $brand_name) {
116 122 $this->request = $request;
117 123 $this->brand_name = $brand_name;
118 124 $this->protect_mode = $protect_mode;
@@ -164,8 +170,12 @@
164 170 if (array_key_exists('cookiedomain', $config) && is_string($config['cookiedomain'])) {
165 171 $this->cookie_domain = $config['cookiedomain'];
166 172 }
167 173
174 + if (array_key_exists('cookievalidity', $config) && is_int($config['cookievalidity'])) {
175 + $this->cookie_validity = $config['cookievalidity'];
176 + }
177 +
168 178 if (array_key_exists('cansetcachepreventioncookie', $config) &&
169 179 is_bool($config['cansetcachepreventioncookie'])) {
170 180
171 181 $this->can_set_cache_prevention_cookie = $config['cansetcachepreventioncookie'];
@@ -182,8 +192,20 @@
182 192 if (array_key_exists('logconfig', $config) && is_array($config['logconfig'])) {
183 193 $this->log_config = $config['logconfig'];
184 194 }
185 195
196 + if (array_key_exists('canlograwbody', $this->log_config) &&
197 + is_bool($this->log_config['canlograwbody'])) {
198 +
199 + $this->can_log_raw_body = $this->log_config['canlograwbody'];
200 + }
201 +
202 + if (array_key_exists('logslicesize', $this->log_config) &&
203 + is_int($this->log_config['logslicesize'])) {
204 +
205 + $this->log_slice_size = $this->log_config['logslicesize'];
206 + }
207 +
186 208 if (array_key_exists('reqprofilingmode', $this->log_config) &&
187 209 is_int($this->log_config['reqprofilingmode'])) {
188 210
189 211 $this->request_profiling_mode = $this->log_config['reqprofilingmode'];
@@ -216,15 +238,21 @@
216 238
217 239 $this->skip_log_post_params = $this->skip_log_config['post'];
218 240 }
219 241
242 + if (array_key_exists('json', $this->skip_log_config) &&
243 + is_array($this->skip_log_config['json'])) {
244 +
245 + $this->skip_log_json_params = $this->skip_log_config['json'];
246 + }
247 +
220 248 if ($this->isPrependMode()) {
221 249 $log_file = MCDATAPATH . MCCONFKEY . '-mc.log';
222 - $this->ipstore = new WPRProtectIpstore_V547(WPRProtectIpstore_V547::STORAGE_TYPE_FS);
223 - $this->logger = new WPRProtectLogger_V547($log_file, WPRProtectLogger_V547::TYPE_FS);
250 + $this->ipstore = new WPRProtectIpstore_V636(WPRProtectIpstore_V636::STORAGE_TYPE_FS);
251 + $this->logger = new WPRProtectLogger_V636($log_file, WPRProtectLogger_V636::TYPE_FS);
224 252 } else {
225 - $this->ipstore = new WPRProtectIpstore_V547(WPRProtectIpstore_V547::STORAGE_TYPE_DB);
226 - $this->logger = new WPRProtectLogger_V547(WPRProtectFW_V547::TABLE_NAME, WPRProtectLogger_V547::TYPE_DB);
253 + $this->ipstore = new WPRProtectIpstore_V636(WPRProtectIpstore_V636::STORAGE_TYPE_DB);
254 + $this->logger = new WPRProtectLogger_V636(WPRProtectFW_V636::TABLE_NAME, WPRProtectLogger_V636::TYPE_DB);
227 255 }
228 256
229 257 if ($this->is_wp_user_cookie_enabled) {
230 258 $this->loadWPUser();
@@ -235,12 +263,12 @@
235 263
236 264 public static function getInstance($protect_mode, $request, $config, $brand_name) {
237 265 if (!isset(self::$instance)) {
238 266 self::$instance = new self($protect_mode, $request, $config, $brand_name);
239 - } elseif (self::$instance->protect_mode != $protect_mode && $protect_mode == WPRProtect_V547::MODE_WP) {
267 + } elseif (self::$instance->protect_mode != $protect_mode && $protect_mode == WPRProtect_V636::MODE_WP) {
240 268 self::$instance->protect_mode = $protect_mode;
241 269 self::$instance->brand_name = $brand_name;
242 - self::$instance->ipstore = new WPRProtectIpstore_V547(WPRProtectIpstore_V547::STORAGE_TYPE_DB);
270 + self::$instance->ipstore = new WPRProtectIpstore_V636(WPRProtectIpstore_V636::STORAGE_TYPE_DB);
243 271 self::$instance->initRules();
244 272 }
245 273
246 274 return self::$instance;
@@ -246,9 +274,9 @@
246 274 return self::$instance;
247 275 }
248 276
249 277 public static function uninstall() {
250 - WPRProtect_V547::$db->dropBVTable(WPRProtectFW_V547::TABLE_NAME);
278 + WPRProtect_V636::$db->dropBVTable(WPRProtectFW_V636::TABLE_NAME);
251 279 }
252 280
253 281 public function init() {
254 282 if (!$this->isModeDisabled()) {
@@ -266,42 +294,42 @@
266 294 }
267 295 }
268 296
269 297 private function isPrependMode() {
270 - return ($this->protect_mode === WPRProtect_V547::MODE_PREPEND);
298 + return ($this->protect_mode === WPRProtect_V636::MODE_PREPEND);
271 299 }
272 300
273 301 private function isWPMode() {
274 - return ($this->protect_mode === WPRProtect_V547::MODE_WP);
302 + return ($this->protect_mode === WPRProtect_V636::MODE_WP);
275 303 }
276 304
277 305 private function isModeDisabled() {
278 - return ($this->mode === WPRProtectFW_V547::MODE_DISABLED);
306 + return ($this->mode === WPRProtectFW_V636::MODE_DISABLED);
279 307 }
280 308
281 309 private function isModeProtect() {
282 - return ($this->mode === WPRProtectFW_V547::MODE_PROTECT);
310 + return ($this->mode === WPRProtectFW_V636::MODE_PROTECT);
283 311 }
284 312
285 313 private function isAdminCookieEnabled() {
286 - return ($this->admin_cookie_mode === WPRProtectFW_V547::ADMIN_COOKIE_MODE_ENABLED);
314 + return ($this->admin_cookie_mode === WPRProtectFW_V636::ADMIN_COOKIE_MODE_ENABLED);
287 315 }
288 316
289 317 private function isIPCookieEnabled() {
290 - return ($this->ip_cookie_mode === WPRProtectFW_V547::IP_COOKIE_MODE_ENABLED);
318 + return ($this->ip_cookie_mode === WPRProtectFW_V636::IP_COOKIE_MODE_ENABLED);
291 319 }
292 320
293 321 private function isRequestProfilingDisabled() {
294 - return ($this->request_profiling_mode === WPRProtectFW_V547::REQ_PROFILING_MODE_DISABLED);
322 + return ($this->request_profiling_mode === WPRProtectFW_V636::REQ_PROFILING_MODE_DISABLED);
295 323 }
296 324
297 325 private function isRequestProfilingModeDebug() {
298 - return ($this->request_profiling_mode === WPRProtectFW_V547::REQ_PROFILING_MODE_DEBUG);
326 + return ($this->request_profiling_mode === WPRProtectFW_V636::REQ_PROFILING_MODE_DEBUG);
299 327 }
300 328
301 329 private function isRequestHasValidBypassCookie() {
302 330 if (!isset($this->has_valid_bypass_cookie)) {
303 - $cookie = (string) $this->request->getCookies(WPRProtectFW_V547::BYPASS_COOKIE_NAME);
331 + $cookie = (string) $this->request->getCookies(WPRProtectFW_V636::BYPASS_COOKIE_NAME);
304 332 $new_cookie = $this->generateBypassCookie();
305 333 $is_valid = ($this->isAdminCookieEnabled() && $new_cookie && ($cookie === $new_cookie));
306 334 $this->has_valid_bypass_cookie = $is_valid;
307 335 }
@@ -309,17 +337,17 @@
309 337 return $this->has_valid_bypass_cookie;
310 338 }
311 339
312 340 private function isRulesModeProtect() {
313 - return ($this->rules_mode === WPRProtectFW_V547::RULES_MODE_PROTECT);
341 + return ($this->rules_mode === WPRProtectFW_V636::RULES_MODE_PROTECT);
314 342 }
315 343
316 344 public function isLoggingModeComplete() {
317 - return ($this->logging_mode === WPRProtectFW_V547::LOGGING_MODE_COMPLETE);
345 + return ($this->logging_mode === WPRProtectFW_V636::LOGGING_MODE_COMPLETE);
318 346 }
319 347
320 348 public function isLoggingModeVisitor() {
321 - return ($this->logging_mode === WPRProtectFW_V547::LOGGING_MODE_VISITOR);
349 + return ($this->logging_mode === WPRProtectFW_V636::LOGGING_MODE_VISITOR);
322 350 }
323 351
324 352 public function isGeoBlockingEnabled() {
325 353 return ($this->is_geo_blocking === true);
@@ -325,13 +353,13 @@
325 353 return ($this->is_geo_blocking === true);
326 354 }
327 355
328 356 private function isWPFRuleInitModePrepend() {
329 - return ($this->wpf_rule_init_mode === WPRProtectFW_V547::WPF_RULE_INIT_MODE_PREPEND);
357 + return ($this->wpf_rule_init_mode === WPRProtectFW_V636::WPF_RULE_INIT_MODE_PREPEND);
330 358 }
331 359
332 360 private function isWPFRuleInitModeWP() {
333 - return ($this->wpf_rule_init_mode === WPRProtectFW_V547::WPF_RULE_INIT_MODE_WP);
361 + return ($this->wpf_rule_init_mode === WPRProtectFW_V636::WPF_RULE_INIT_MODE_WP);
334 362 }
335 363
336 364 private function canInitWPFRules() {
337 365 if (!$this->isWPFRuleInitModePrepend() && $this->isPrependMode()) {
@@ -341,9 +369,9 @@
341 369 return true;
342 370 }
343 371
344 372 private function generateBypassCookie() {
345 - $time = floor(time() / 43200);
373 + $time = floor(time() / $this->cookie_validity);
346 374
347 375 return hash('sha256', $this->bypass_level . $time . $this->cookie_key);
348 376 }
349 377
@@ -358,18 +386,18 @@
358 386 if (function_exists('is_user_logged_in') && is_user_logged_in()) {
359 387 $current_wp_user = $this->getCurrentWPUser();
360 388
361 389 if (!$current_wp_user->isIdentical($this->request->wp_user)) {
362 - $serialized_wp_user = WPRProtectWPUser_V547::_serialize($current_wp_user);
390 + $serialized_wp_user = WPRProtectWPUser_V636::_serialize($current_wp_user);
363 391 $cookie_val = $serialized_wp_user . '_' .
364 - WPRProtectUtils_V547::signMessage($serialized_wp_user, $this->cookie_key);
392 + WPRProtectUtils_V636::signMessage($serialized_wp_user, $this->cookie_key);
365 393 $cookie_val = base64_encode($cookie_val);
366 394
367 - $this->setcookie(WPRProtectWPUser_V547::COOKIE_NAME, $cookie_val, time() + 43200);
395 + $this->setCookie(WPRProtectWPUser_V636::COOKIE_NAME, $cookie_val);
368 396 }
369 397 } elseif ($this->request->wp_user->isLoggedIn()) {
370 - $this->request->wp_user = WPRProtectWPUser_V547::defaultUser();
371 - $this->unsetCookie(WPRProtectWPUser_V547::COOKIE_NAME);
398 + $this->request->wp_user = WPRProtectWPUser_V636::defaultUser();
399 + $this->unsetCookie(WPRProtectWPUser_V636::COOKIE_NAME);
372 400 }
373 401 }
374 402
375 403 private function getCurrentWPUser() {
@@ -375,9 +403,9 @@
375 403 private function getCurrentWPUser() {
376 404 $id = 0;
377 405 $role_level = 0;
378 406 $capabilities = array();
379 - $time = (int) floor(time() / 43200);
407 + $time = (int) floor(time() / $this->cookie_validity);
380 408
381 409 if (function_exists('wp_get_current_user')) {
382 410 $user = wp_get_current_user();
383 411 $id = $user->ID;
@@ -384,9 +412,9 @@
384 412 $role_level = $this->getCurrentWPUserRoleLevel();
385 413 $capabilities = $this->getCurrentWPUserCapabilities();
386 414 }
387 415
388 - return (new WPRProtectWPUser_V547($id, $role_level, $capabilities, $time));
416 + return (new WPRProtectWPUser_V636($id, $role_level, $capabilities, $time));
389 417 }
390 418
391 419 private function getCurrentWPUserCapabilities() {
392 420 $capabilities = array();
@@ -403,11 +431,11 @@
403 431 return $capabilities;
404 432 }
405 433
406 434 private function loadWPUser() {
407 - $this->request->wp_user = WPRProtectWPUser_V547::defaultUser();
435 + $this->request->wp_user = WPRProtectWPUser_V636::defaultUser();
408 436
409 - $cookie_val = $this->request->getCookies(WPRProtectWPUser_V547::COOKIE_NAME);
437 + $cookie_val = $this->request->getCookies(WPRProtectWPUser_V636::COOKIE_NAME);
410 438 if (!is_string($cookie_val)) {
411 439 return;
412 440 }
413 441
@@ -421,12 +449,12 @@
421 449 return;
422 450 }
423 451 list($serialized_user, $signature) = $cookie_val_array;
424 452
425 - if (WPRProtectUtils_V547::verifyMessage($serialized_user, $signature, $this->cookie_key) === true) {
426 - $wp_user = WPRProtectWPUser_V547::_unserialize($serialized_user);
453 + if (WPRProtectUtils_V636::verifyMessage($serialized_user, $signature, $this->cookie_key) === true) {
454 + $wp_user = WPRProtectWPUser_V636::_unserialize($serialized_user);
427 455
428 - if (!isset($wp_user) || $wp_user->time !== (int) floor(time() / 43200)) {
456 + if (!isset($wp_user) || $wp_user->time !== (int) floor(time() / $this->cookie_validity)) {
429 457 return;
430 458 }
431 459
432 460 $this->request->wp_user = $wp_user;
@@ -437,10 +465,10 @@
437 465 $this->request->wp_user->capability_names[] = $capability_names[$capability];
438 466 }
439 467 }
440 468
441 - $role_by_level = array_flip(array_merge(WPRProtectFW_V547::DEFAULT_WP_USER_ROLE_LEVELS,
442 - WPRProtectFW_V547::EXTRA_WP_USER_ROLE_LEVELS));
469 + $role_by_level = array_flip(array_merge(WPRProtectFW_V636::DEFAULT_WP_USER_ROLE_LEVELS,
470 + WPRProtectFW_V636::EXTRA_WP_USER_ROLE_LEVELS));
443 471 $this->request->wp_user->role = $role_by_level[$this->request->wp_user->role_level];
444 472 }
445 473 }
446 474
@@ -462,11 +490,11 @@
462 490 }
463 491
464 492 if ($this->isPrependMode()) {
465 493 $rules_file = MCDATAPATH . MCCONFKEY . '-' . 'mc_rules.json';
466 - $rule_arrays = WPRProtectUtils_V547::parseFile($rules_file);
494 + $rule_arrays = WPRProtectUtils_V636::parseFile($rules_file);
467 495 } else {
468 - $rule_arrays = WPRProtect_V547::$settings->getOption('bvruleset');
496 + $rule_arrays = WPRProtect_V636::$settings->getOption('bvruleset');
469 497 if(!is_array($rule_arrays)) {
470 498 $rule_arrays = array();
471 499 }
472 500 }
@@ -476,9 +504,9 @@
476 504 return;
477 505 }
478 506
479 507 foreach($rule_arrays as $rule_array) {
480 - $rule = WPRProtectFWRule_V547::init($rule_array);
508 + $rule = WPRProtectFWRule_V636::init($rule_array);
481 509
482 510 if ($rule) {
483 511 if (!$this->is_rule_initialized && $rule->isExeOnBoot()) {
484 512 if (!$this->isRequestHasValidBypassCookie()) {
@@ -547,9 +575,9 @@
547 575 } else {
548 576 add_filter($hook_name, $callback, -9999999, $accepted_args);
549 577 }
550 578 } else {
551 - WPRProtectUtils_V547::preInitWPHook($hook_name, $callback, -9999999, $accepted_args);
579 + WPRProtectUtils_V636::preInitWPHook($hook_name, $callback, -9999999, $accepted_args);
552 580 }
553 581 }
554 582
555 583 $this->pushWPFRule($function_name, $rule);
@@ -879,9 +907,13 @@
879 907 $this->is_shutdown_cb_set = true;
880 908 }
881 909 }
882 910
883 - private function setCookie($name, $value, $expire) {
911 + private function setCookie($name, $value, $expire = null) {
912 + if ($expire === null) {
913 + $expire = time() + $this->cookie_validity;
914 + }
915 +
884 916 $path = $this->cookie_path;
885 917 $cookie_domain = $this->cookie_domain;
886 918
887 919 if (version_compare(PHP_VERSION, '5.2.0') >= 0) {
@@ -910,14 +942,14 @@
910 942 }
911 943
912 944 private function setIPCookie() {
913 945 if (!$this->is_ip_cookie_set && $this->isIPCookieEnabled() &&
914 - !$this->request->getCookies(WPRProtectFW_V547::IP_COOKIE_NAME)) {
946 + !$this->request->getCookies(WPRProtectFW_V636::IP_COOKIE_NAME)) {
915 947
916 948 $time = floor(time() / 86400);
917 949 $cookie = hash('sha256', $this->request->ip . $time . $this->cookie_key);
918 950 if ($cookie) {
919 - $this->setCookie(WPRProtectFW_V547::IP_COOKIE_NAME, $cookie, time() + 86400);
951 + $this->setCookie(WPRProtectFW_V636::IP_COOKIE_NAME, $cookie, time() + 86400);
920 952 }
921 953 }
922 954 }
923 955
@@ -923,18 +955,18 @@
923 955
924 956 private function getCurrentWPUserRoleLevel() {
925 957 if (function_exists('current_user_can')) {
926 958 if (function_exists('is_super_admin') && is_super_admin()) {
927 - return WPRProtectFW_V547::WP_USER_ROLE_LEVEL_ADMIN;
959 + return WPRProtectFW_V636::WP_USER_ROLE_LEVEL_ADMIN;
928 960 }
929 961
930 962 foreach ($this->custom_roles as $role) {
931 963 if (current_user_can($role)) {
932 - return WPRProtectFW_V547::WP_USER_ROLE_LEVEL_CUSTOM;
964 + return WPRProtectFW_V636::WP_USER_ROLE_LEVEL_CUSTOM;
933 965 }
934 966 }
935 967
936 - foreach (WPRProtectFW_V547::DEFAULT_WP_USER_ROLE_LEVELS as $role => $level) {
968 + foreach (WPRProtectFW_V636::DEFAULT_WP_USER_ROLE_LEVELS as $role => $level) {
937 969 if (current_user_can($role)) {
938 970 return $level;
939 971 }
940 972 }
@@ -961,12 +993,17 @@
961 993 }
962 994 }
963 995
964 996 private function canLogValue($key, $prefix) {
965 - if ($prefix === 'BODY[') {
966 - return $this->canLogPostValue($key);
967 - } elseif ($prefix === 'COOKIES[') {
968 - return $this->canLogCookieValue($key);
997 + switch ($prefix) {
998 + case 'BODY[':
999 + return $this->canLogPostValue($key);
1000 + case 'COOKIES[':
1001 + return $this->canLogCookieValue($key);
1002 + case 'JSON[':
1003 + return $this->canLogJsonValue($key);
1004 + case 'HEADERS[':
1005 + return $this->canLogHeaderValue($key);
969 1006 }
970 1007
971 1008 return true;
972 1009 }
@@ -994,26 +1031,34 @@
994 1031
995 1032 return true;
996 1033 }
997 1034
998 - private function getPostParamsToLog($params) {
1035 + private function canLogJsonValue($key) {
1036 + return $this->canLogKeyValue($key, $this->skip_log_json_params);
1037 + }
1038 +
1039 + private function canLogKeyValue($key, $skip_params) {
1040 + if (is_string($key) && in_array($key, $skip_params)) {
1041 + return false;
1042 + }
1043 +
1044 + return true;
1045 + }
1046 +
1047 + private function getParamsToLog($params, $type) {
999 1048 $loggable_params = array();
1000 1049
1001 1050 if (is_array($params)) {
1002 1051 foreach ($params as $key => $value) {
1003 1052 if (is_array($value)) {
1004 - $loggable_params[$key] = $this->getPostParamsToLog($value);
1053 + $loggable_params[$key] = $this->getParamsToLog($value, $type);
1005 1054 } else {
1006 - if (!$this->canLogPostValue($key)) {
1055 + if ($type == "POST" && !$this->canLogPostValue($key)) {
1007 1056 $loggable_params[$key] = "Sensitive Data";
1057 + } else if ($type == "JSON" && !$this->canLogJsonValue($key)) {
1058 + $loggable_params[$key] = "Sensitive Data";
1008 1059 } else {
1009 - $valsize = $this->getLength($value);
1010 - if ($valsize > 1024) {
1011 - $value = substr($value, 0, 1024);
1012 - $loggable_params[$key] = "Data too long: {$valsize} : {$value}";
1013 - } else {
1014 - $loggable_params[$key] = $value;
1015 - }
1060 + $loggable_params[$key] = $this->getSlicedValueToLog($value);
1016 1061 }
1017 1062 }
1018 1063 }
1019 1064 }
@@ -1020,14 +1065,18 @@
1020 1065
1021 1066 return $loggable_params;
1022 1067 }
1023 1068
1069 + private function getRawBodyToLog($content) {
1070 + return $this->getSlicedValueToLog($content);
1071 + }
1072 +
1024 1073 private function getBVCookies() {
1025 1074 $cookies = array();
1026 1075
1027 - if ($this->request->getCookies(WPRProtectFW_V547::IP_COOKIE_NAME) !== NULL) {
1028 - $cookie_val = (string) $this->request->getCookies(WPRProtectFW_V547::IP_COOKIE_NAME);
1029 - $cookies[WPRProtectFW_V547::IP_COOKIE_NAME] = $cookie_val;
1076 + if ($this->request->getCookies(WPRProtectFW_V636::IP_COOKIE_NAME) !== NULL) {
1077 + $cookie_val = (string) $this->request->getCookies(WPRProtectFW_V636::IP_COOKIE_NAME);
1078 + $cookies[WPRProtectFW_V636::IP_COOKIE_NAME] = $cookie_val;
1030 1079 }
1031 1080
1032 1081 return $cookies;
1033 1082 }
@@ -1063,8 +1112,30 @@
1063 1112
1064 1113 return $loggable_headers;
1065 1114 }
1066 1115
1116 + private function getSlicedValueToLog($value, $size = null) {
1117 + if (!is_scalar($value)) {
1118 + return "Logging of " . gettype($value) . " is not supported.";
1119 + }
1120 +
1121 + if ($size === null) {
1122 + $size = $this->log_slice_size;
1123 + }
1124 +
1125 + $loggable_value = '';
1126 +
1127 + $valsize = $this->getLength($value);
1128 + if ($valsize > $size) {
1129 + $value = substr((string) $value, 0, $size);
1130 + $loggable_value = "Data too long: {$valsize} : {$value}";
1131 + } else {
1132 + $loggable_value = $value;
1133 + }
1134 +
1135 + return $loggable_value;
1136 + }
1137 +
1067 1138 private function getRequestDataToLog() {
1068 1139 $referer = $this->request->getHeader('Referer') ? $this->request->getHeader('Referer') : '';
1069 1140 $user_agent = $this->request->getHeader('User-Agent')
1070 1141 ? $this->request->getHeader('User-Agent') : '';
@@ -1148,21 +1219,22 @@
1148 1219 $this->rule_log[$category] = $category_data;
1149 1220 }
1150 1221
1151 1222 private function inspectRequest() {
1152 - $this->updateRuleLog('inspect', "headers", $this->getHeadersToLog($this->request->getHeaders()));
1153 -
1154 1223 if (isset($this->request->wp_user)) {
1155 1224 $this->updateRuleLog('inspect', "wpUserInfo", $this->request->wp_user->getInfo());
1156 1225 }
1157 1226
1227 + $this->updateRuleLog('inspect', "headers", $this->getHeadersToLog($this->request->getHeaders()));
1228 + $this->updateRuleLog('inspect', "cookies", $this->getCookiesToLog($this->request->getCookies()));
1158 1229 $this->updateRuleLog('inspect', "getParams", $this->request->getGetParams());
1159 - $this->updateRuleLog('inspect', "postParams", $this->getPostParamsToLog($this->request->getPostParams()));
1160 - $this->updateRuleLog('inspect', "cookies", $this->getCookiesToLog($this->request->getCookies()));
1230 + $this->updateRuleLog('inspect', "postParams", $this->getParamsToLog($this->request->getPostParams(), "POST"));
1231 + $this->updateRuleLog('inspect', "jsonParams", $this->getParamsToLog($this->request->getJsonParams(), "JSON"));
1232 + $this->updateRuleLog('inspect', "rawBody", $this->getRawBodyToLog($this->request->getRawBody()));
1161 1233 }
1162 1234
1163 1235 private function getUserBy($attribute, $value) {
1164 - if (isset($value) && function_exists('get_user_by') && WPRProtectUtils_V547::havePluginsLoaded()) {
1236 + if (isset($value) && function_exists('get_user_by') && WPRProtectUtils_V636::havePluginsLoaded()) {
1165 1237 return get_user_by($attribute, $value);
1166 1238 }
1167 1239 }
1168 1240
@@ -1264,9 +1336,9 @@
1264 1336 xlsx|psd|mp3|m4a|ogg|wav|mp4|m4v|mov|wmv|avi|mpg|ogv|3gp|3g2|php|html|phtml|js|css)/ix', $value)) {
1265 1337 $profiled_data[$key]["file"] = true;
1266 1338 }
1267 1339
1268 - if ($this->matchCount(WPRProtectFWRule_V547::SQLIREGEX, $value) > 2) {
1340 + if ($this->matchCount(WPRProtectFWRule_V636::SQLIREGEX, $value) > 2) {
1269 1341 $profiled_data[$key]["sql"] = true;
1270 1342 }
1271 1343
1272 1344 if (WPRHelper::safePregMatch('/(?:\.{2}[\/]+)/', $value)) {
@@ -1285,17 +1357,27 @@
1285 1357
1286 1358 private function profileRequest() {
1287 1359 if (!$this->is_request_profiled && !$this->isRequestProfilingDisabled()) {
1288 1360 $profiled_data = array();
1361 + $log_raw_body = true;
1289 1362
1290 1363 $is_debug_mode = $this->isRequestProfilingModeDebug();
1291 - $cookies = $is_debug_mode ? $this->request->getCookies() : $this->getBVCookies();
1292 - $cookies = $this->getCookiesToLog($cookies);
1293 1364
1365 + $content_type = $this->request->getContentType();
1366 + if (is_string($content_type)) {
1367 + $profiled_data += array("CONTENT_TYPE" => $this->getSlicedValueToLog($content_type));
1368 + }
1369 +
1370 + $content_length = $this->request->getContentLength();
1371 + if (is_string($content_length)) {
1372 + $profiled_data += array("CONTENT_LENGTH" => $this->getSlicedValueToLog($content_length));
1373 + }
1374 +
1294 1375 $action = $this->request->getAction();
1295 1376 if (isset($action)) {
1296 1377 $profiled_data += $this->profileRequestData(array("action" => $action), true, 'ACTION[');
1297 1378 }
1379 +
1298 1380 if (isset($this->request->wp_user)) {
1299 1381 $wp_user_info = array(
1300 1382 'id' => $this->request->wp_user->id
1301 1383 );
@@ -1300,13 +1382,30 @@
1300 1382 'id' => $this->request->wp_user->id
1301 1383 );
1302 1384 $profiled_data += $this->profileRequestData($wp_user_info, true, 'WP_USER[');
1303 1385 }
1304 - $profiled_data += $this->profileRequestData($this->request->getPostParams(), $is_debug_mode, 'BODY[');
1386 +
1305 1387 $profiled_data += $this->profileRequestData($this->request->getGetParams(), true, 'GET[');
1306 1388 $profiled_data += $this->profileRequestData($this->request->getFiles(), true, 'FILES[');
1389 +
1390 + $cookies = $is_debug_mode ? $this->request->getCookies() : $this->getBVCookies();
1307 1391 $profiled_data += $this->profileRequestData($cookies, true, 'COOKIES[');
1308 1392
1393 + if (!empty($this->request->getPostParams())) {
1394 + $profiled_data += $this->profileRequestData($this->request->getPostParams(), $is_debug_mode, 'BODY[');
1395 + $log_raw_body = false;
1396 + }
1397 +
1398 + $json_params = $this->request->getJsonParams();
1399 + if (!empty($json_params) && !empty($json_params['JSON'])) {
1400 + $profiled_data += $this->profileRequestData($json_params, $is_debug_mode, 'JSON[');
1401 + $log_raw_body = false;
1402 + }
1403 +
1404 + if ($this->can_log_raw_body && $is_debug_mode && $log_raw_body && !empty($this->request->getRawBody())) {
1405 + $profiled_data += array("RAW_BODY" => $this->getRawBodyToLog($this->request->getRawBody()));
1406 + }
1407 +
1309 1408 $this->request_profiled_data = $profiled_data;
1310 1409 $this->is_request_profiled = true;
1311 1410 }
1312 1411 }
@@ -1316,15 +1415,15 @@
1316 1415 }
1317 1416
1318 1417 private function canRequestBypassFirewall() {
1319 1418 if ($this->isRequestIPWhitelisted() || $this->isRequestHasValidBypassCookie()) {
1320 - $this->request->category = WPRProtectRequest_V547::CATEGORY_WHITELISTED;
1321 - $this->request->status = WPRProtectRequest_V547::STATUS_BYPASSED;
1419 + $this->request->category = WPRProtectRequest_V636::CATEGORY_WHITELISTED;
1420 + $this->request->status = WPRProtectRequest_V636::STATUS_BYPASSED;
1322 1421
1323 1422 return true;
1324 - } elseif (WPRProtectUtils_V547::isPrivateIP($this->request->ip)) {
1325 - $this->request->category = WPRProtectRequest_V547::CATEGORY_PRIVATEIP;
1326 - $this->request->status = WPRProtectRequest_V547::STATUS_BYPASSED;
1423 + } elseif (WPRProtectUtils_V636::isPrivateIP($this->request->ip)) {
1424 + $this->request->category = WPRProtectRequest_V636::CATEGORY_PRIVATEIP;
1425 + $this->request->status = WPRProtectRequest_V636::STATUS_BYPASSED;
1327 1426
1328 1427 return true;
1329 1428 }
1330 1429
@@ -1356,9 +1455,9 @@
1356 1455 if (array_key_exists('variables', $rule->opts)) {
1357 1456 $_engine_vars = array_merge($_engine_vars, $rule->opts['variables']);
1358 1457 }
1359 1458
1360 - $rule_engine = new WPRProtectFWRuleEngine_V547($this->request, $_engine_vars);
1459 + $rule_engine = new WPRProtectFWRuleEngine_V636($this->request, $_engine_vars);
1361 1460
1362 1461 if ($rule_engine->evaluate($rule) && !$rule_engine->hasError()) {
1363 1462 if (!empty($log_data)) {
1364 1463 $this->updateRuleLog("info", (string) $rule->id, $log_data);
@@ -1369,13 +1468,13 @@
1369 1468 foreach($rule->actions as $action) {
1370 1469 switch ($action["type"]) {
1371 1470 case "ALLOW":
1372 1471 $this->break_rule_matching = true;
1373 - $this->request->category = WPRProtectRequest_V547::CATEGORY_RULE_ALLOWED;
1472 + $this->request->category = WPRProtectRequest_V636::CATEGORY_RULE_ALLOWED;
1374 1473 return;
1375 1474 case "BLOCK":
1376 1475 if ($this->isModeProtect()) {
1377 - $this->terminateRequest(WPRProtectRequest_V547::CATEGORY_RULE_BLOCKED);
1476 + $this->terminateRequest(WPRProtectRequest_V636::CATEGORY_RULE_BLOCKED);
1378 1477 }
1379 1478 return;
1380 1479 case "INSPECT":
1381 1480 $this->inspectRequest();
@@ -1389,15 +1488,15 @@
1389 1488 }
1390 1489
1391 1490 private function terminateRequest($category) {
1392 1491 $this->request->category = $category;
1393 - $this->request->status = WPRProtectRequest_V547::STATUS_BLOCKED;
1492 + $this->request->status = WPRProtectRequest_V636::STATUS_BLOCKED;
1394 1493 $this->request->setRespCode(403);
1395 1494
1396 1495 if ($this->can_set_cache_prevention_cookie &&
1397 - !$this->request->getCookies(WPRProtectFW_V547::PREVENT_CACHE_COOKIE_NAME)) {
1496 + !$this->request->getCookies(WPRProtectFW_V636::PREVENT_CACHE_COOKIE_NAME)) {
1398 1497 $value = "Prevent Caching Response.";
1399 - $this->setCookie(WPRProtectFW_V547::PREVENT_CACHE_COOKIE_NAME, $value, time() + 43200);
1498 + $this->setCookie(WPRProtectFW_V636::PREVENT_CACHE_COOKIE_NAME, $value, time() + 43200);
1400 1499 }
1401 1500
1402 1501 header("Cache-Control: no-cache, no-store, must-revalidate");
1403 1502 header("Pragma: no-cache");
@@ -1402,8 +1501,9 @@
1402 1501 header("Cache-Control: no-cache, no-store, must-revalidate");
1403 1502 header("Pragma: no-cache");
1404 1503 header("Expires: 0");
1405 1504 header('HTTP/1.0 403 Forbidden');
1505 + // phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped
1406 1506 die("
1407 1507 <div style='height: 98vh;'>
1408 1508 <div style='text-align: center; padding: 10% 0; font-family: Arial, Helvetica, sans-serif;'>
1409 1509 <div><p>" . $this->brand_name . " Firewall</p></div>
@@ -1411,8 +1511,9 @@
1411 1511 <p>Reference ID: " . $this->request->getRequestID() . "</p>
1412 1512 </div>
1413 1513 </div>
1414 1514 ");
1515 + // phpcs:enable WordPress.Security.EscapeOutput.OutputNotEscaped
1415 1516 }
1416 1517
1417 1518 public function setBypassCookie() {
1418 1519 if (function_exists('is_user_logged_in') && is_user_logged_in() &&
@@ -1421,9 +1522,9 @@
1421 1522 $role_level = $this->getCurrentWPUserRoleLevel();
1422 1523 if ($role_level >= $this->bypass_level) {
1423 1524 $cookie = $this->generateBypassCookie();
1424 1525 if ($cookie) {
1425 - $this->setCookie(WPRProtectFW_V547::BYPASS_COOKIE_NAME, $cookie, time() + 43200);
1526 + $this->setCookie(WPRProtectFW_V636::BYPASS_COOKIE_NAME, $cookie);
1426 1527 }
1427 1528 }
1428 1529 }
1429 1530 }