wpremote / callback / wings / security.php

security.php in The WP Remote WordPress Plugin 6.47, at callback/wings/security.php

178 lines 5.4 KB

Raw Download Zip

1	<?php
2	if (!defined('ABSPATH')) exit;
3	if (!class_exists('WPRSecurityCallback')) :
4	class WPRSecurityCallback extends WPRCallbackBase {
5	private $settings;
6
7	public function __construct() {
8	$this->settings = new WPRWPSettings();
9	}
10
11	// phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_fread
12	// Here we need fread as we are using popen which returns a handler
13	function getCrontab() {
14	$resp = array();
15
16	if (function_exists('exec')) {
17	$output = array();
18	$retval = -1;
19	$execRes = exec('crontab -l', $output, $retval);
20	if ($execRes !== false && $execRes !== null) {
21	$resp["content"] = implode("\n", $output);
22	$resp["status"] = "success";
23	$resp["code"] = $retval;
24	}
25	}
26	if (empty($resp) && function_exists('popen')) {
27	$handle = popen('crontab -l', 'rb');
28	if ($handle) {
29	$output = '';
30	while (!feof($handle)) {
31	$output .= fread($handle, 8192);
32	}
33	$resp["content"] = $output;
34	$resp["status"] = "success";
35	pclose($handle);
36	} else {
37	$resp["status"] = "failed";
38	}
39	}
40
41	return $resp;
42	}
43	// phpcs:enable WordPress.WP.AlternativeFunctions.file_system_operations_fread
44
45	public function setupWP2FA($secrets_by_uids, $to_encrypt, $cipher_algo, $enabled) {
46	if (!is_array($secrets_by_uids)) {
47	return array("status" => false, "message" => "secrets_by_uids is not an array.");
48	}
49
50	$result = array();
51	foreach ($secrets_by_uids as $user_id => $secret) {
52	if (empty($user_id) \|\| !is_string($secret)) {
53	continue;
54	}
55
56	if ($to_encrypt === true) {
57	if (empty($cipher_algo)) {
58	$cipher_algo = WPRWP2FA::$cipher_algo;
59	}
60
61	if (defined('SECURE_AUTH_KEY')) {
62	$encryption_result = WPRHelper::opensslEncrypt($secret, $cipher_algo, SECURE_AUTH_KEY);
63	if ($encryption_result[0] === false) {
64	return array("status" => false, "message" => $encryption_result[1]);
65	}
66	$secret = $encryption_result[1];
67	} else {
68	return array("status" => false, "message" => "Encryption key not found.");
69	}
70	}
71
72	$secret_info = array(
73	"secret" => base64_encode($secret),
74	"is_encrypted" => $to_encrypt
75	);
76
77	$result[$user_id][WPRWP2FA::SECRET_META_KEY] = update_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, $secret_info);
78	$result[$user_id][WPRWP2FA::FLAG_META_KEY] = update_user_meta($user_id, WPRWP2FA::FLAG_META_KEY, true);
79	}
80
81	if (is_bool($enabled)) {
82	$config = array("enabled" => $enabled);
83	$result[WPRWP2FA::$wp_2fa_option] = $this->settings->updateOption(WPRWP2FA::$wp_2fa_option, $config);
84	}
85
86	return array("status" => true, "result" => $result);
87	}
88
89	public function verifyWP2FACode($user_id, $code, $cipher_algo = null) {
90	$encoded_secret_info = get_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, true);
91
92	$secret_info = WPRWP2FAUtils::getSecretInfo($encoded_secret_info);
93	$secret = $secret_info['secret'];
94	$is_secret_encrypted = $secret_info['is_encrypted'];
95
96	if (is_null($secret) \|\| is_null($is_secret_encrypted)) {
97	return array("status" => false, "message" => "Secret and encryption status not found.");
98	}
99
100	if ($is_secret_encrypted === true) {
101	if (empty($cipher_algo)) {
102	$cipher_algo = WPRWP2FA::$cipher_algo;
103	}
104
105	if (defined('SECURE_AUTH_KEY')) {
106	$decryption_result = WPRHelper::opensslDecrypt($secret, $cipher_algo, SECURE_AUTH_KEY);
107	if ($decryption_result[0] === false) {
108	return array("status" => false, "message" => $decryption_result[1]);
109	}
110	$secret = $decryption_result[1];
111	} else {
112	return array("status" => false, "message" => "Decryption key not found.");
113	}
114	}
115
116	return array("status" => WPRWP2FAAuthenticator::verifyCode($secret, $code, 2));
117	}
118
119	public function readWP2FAKeys($user_id) {
120	$secret = get_user_meta($user_id, WPRWP2FA::SECRET_META_KEY, true);
121	$enabled = get_user_meta($user_id, WPRWP2FA::FLAG_META_KEY, true);
122	return array(
123	"secret" => $secret,
124	"enabled" => $enabled
125	);
126	}
127
128	public function deleteWP2FAKeys($user_ids, $is_disable = false) {
129	$result = array();
130
131	foreach ($user_ids as $user_id) {
132	$secret_deleted = delete_user_meta($user_id, WPRWP2FA::SECRET_META_KEY);
133	$flag_deleted = delete_user_meta($user_id, WPRWP2FA::FLAG_META_KEY);
134	$result[$user_id] = array(
135	WPRWP2FA::SECRET_META_KEY => $secret_deleted,
136	WPRWP2FA::FLAG_META_KEY => $flag_deleted
137	);
138	}
139
140	if ($is_disable === true) {
141	$result[WPRWP2FA::$wp_2fa_option] = $this->settings->deleteOption(WPRWP2FA::$wp_2fa_option);
142	}
143
144	return array("status" => true, "result" => $result);
145	}
146
147	public function process($request) {
148	$params = $request->params;
149
150	switch ($request->method) {
151	case "gtcrntb":
152	$resp = $this->getCrontab();
153	break;
154	case "stupwp2fa":
155	$enable_wp_2fa = null;
156	if (array_key_exists('enable_wp_2fa', $request->params)) {
157	$enable_wp_2fa = $request->params['enable_wp_2fa'];
158	}
159
160	$resp = $this->setupWP2FA($params['secrets_by_uids'], $params['to_encrypt'], $params['cipher_algo'], $enable_wp_2fa);
161	break;
162	case "vrfywp2fa":
163	$resp = $this->verifyWP2FACode($params['user_id'], $params['code'], $params['cipher_algo']);
164	break;
165	case "rdwp2fa":
166	$resp = $this->readWP2FAKeys($params['user_id']);
167	break;
168	case "dltewp2fa":
169	$resp = $this->deleteWP2FAKeys($params['user_ids'], $params['is_disable']);
170	break;
171	default:
172	$resp = false;
173	}
174
175	return $resp;
176	}
177	}
178	endif;