PluginProbe
The WP Remote WordPress Plugin / 6.76
The WP Remote WordPress Plugin v6.76
6.76 6.72 6.69 6.65 6.62 6.48 6.47 4.87 4.97 5.05 5.09 5.16 5.22 5.24 5.25 5.38 5.41 5.42 5.45 5.47 5.53 5.56 5.65 5.68 5.72 All 54 releases
← All changes | protect/fw.php +502 -122 5.42 → 6.76 View file →
@@ -1,13 +1,13 @@
1 1 <?php
2 2 if (!defined('ABSPATH') && !defined('MCDATAPATH')) exit;
3 3
4 -if (!class_exists('WPRProtectFW_V542')) :
4 +if (!class_exists('WPRProtectFW_V676')) :
5 5 require_once dirname( __FILE__ ) . '/fw/rule/errors.php';
6 6 require_once dirname( __FILE__ ) . '/fw/rule/engine.php';
7 7 require_once dirname( __FILE__ ) . '/fw/rule.php';
8 8
9 -class WPRProtectFW_V542 {
9 +class WPRProtectFW_V676 {
10 10 private $brand_name;
11 11 private $protect_mode;
12 12 private $request;
13 13 private $ipstore;
@@ -19,30 +19,33 @@
19 19 private $is_ip_cookie_set = false;
20 20 private $is_request_profiled = false;
21 21 private $is_on_boot_rules_executed = false;
22 22 private $is_ip_checked_for_blacklisted = false;
23 + private $is_ip_whitelisted = null;
23 24 private $has_valid_bypass_cookie;
24 25
25 - private $mode = WPRProtectFW_V542::MODE_DISABLED;
26 - private $ip_cookie_mode = WPRProtectFW_V542::IP_COOKIE_MODE_DISABLED;
27 - private $admin_cookie_mode = WPRProtectFW_V542::ADMIN_COOKIE_MODE_DISABLED;
28 - private $bypass_level = WPRProtectFW_V542::WP_USER_ROLE_LEVEL_CONTRIBUTOR;
29 - private $wpf_rule_init_mode = WPRProtectFW_V542::WPF_RULE_INIT_MODE_WP;
26 + private $mode = WPRProtectFW_V676::MODE_DISABLED;
27 + private $ip_cookie_mode = WPRProtectFW_V676::IP_COOKIE_MODE_DISABLED;
28 + private $admin_cookie_mode = WPRProtectFW_V676::ADMIN_COOKIE_MODE_DISABLED;
29 + private $bypass_level = WPRProtectFW_V676::WP_USER_ROLE_LEVEL_CONTRIBUTOR;
30 + private $wpf_rule_init_mode = WPRProtectFW_V676::WPF_RULE_INIT_MODE_WP;
30 31 private $custom_roles = array();
31 32 private $cookie_key = "";
32 33 private $cookie_path = "";
33 34 private $cookie_domain = "";
35 + private $cookie_validity = 2592000;
34 36 private $can_set_cache_prevention_cookie = false;
35 - private $rules_mode = WPRProtectFW_V542::RULES_MODE_DISABLED;
37 + private $rules_mode = WPRProtectFW_V676::RULES_MODE_DISABLED;
36 38 private $is_geo_blocking = false;
37 39 private $is_wp_user_cookie_enabled = false;
38 40 private $log_config = array();
39 - private $request_profiling_mode = WPRProtectFW_V542::REQ_PROFILING_MODE_DISABLED;
40 - private $logging_mode = WPRProtectFW_V542::LOGGING_MODE_VISITOR;
41 + private $request_profiling_mode = WPRProtectFW_V676::REQ_PROFILING_MODE_DISABLED;
42 + private $logging_mode = WPRProtectFW_V676::LOGGING_MODE_VISITOR;
41 43 private $skip_log_config = array();
42 44 private $skip_log_cookies = array();
43 45 private $skip_log_headers = array();
44 46 private $skip_log_post_params = array();
47 + private $skip_log_json_params = array();
45 48 private $wp_user_caps_to_consider = array();
46 49
47 50 private $request_profiled_data = array();
48 51 private $rules = array();
@@ -49,8 +52,10 @@
49 52 private $wpf_rules = array();
50 53 private $rule_log = array();
51 54 private $matched_rules = array();
52 55 private $break_rule_matching = false;
56 + private $can_log_raw_body = false;
57 + private $log_slice_size = WPRProtectFW_V676::LOG_SLICE_SIZE;
53 58
54 59 private static $instance = null;
55 60
56 61 const MODE_DISABLED = 1;
@@ -94,18 +99,18 @@
94 99 const LOGGING_MODE_COMPLETE = 2;
95 100 const LOGGING_MODE_DISABLED = 3;
96 101
97 102 const DEFAULT_WP_USER_ROLE_LEVELS = array(
98 - 'administrator' => WPRProtectFW_V542::WP_USER_ROLE_LEVEL_ADMIN,
99 - 'editor' => WPRProtectFW_V542::WP_USER_ROLE_LEVEL_EDITOR,
100 - 'author' => WPRProtectFW_V542::WP_USER_ROLE_LEVEL_AUTHOR,
101 - 'contributor' => WPRProtectFW_V542::WP_USER_ROLE_LEVEL_CONTRIBUTOR,
102 - 'subscriber' => WPRProtectFW_V542::WP_USER_ROLE_LEVEL_SUBSCRIBER
103 + 'administrator' => WPRProtectFW_V676::WP_USER_ROLE_LEVEL_ADMIN,
104 + 'editor' => WPRProtectFW_V676::WP_USER_ROLE_LEVEL_EDITOR,
105 + 'author' => WPRProtectFW_V676::WP_USER_ROLE_LEVEL_AUTHOR,
106 + 'contributor' => WPRProtectFW_V676::WP_USER_ROLE_LEVEL_CONTRIBUTOR,
107 + 'subscriber' => WPRProtectFW_V676::WP_USER_ROLE_LEVEL_SUBSCRIBER
103 108 );
104 109
105 110 const EXTRA_WP_USER_ROLE_LEVELS = array(
106 - 'custom' => WPRProtectFW_V542::WP_USER_ROLE_LEVEL_CUSTOM,
107 - 'unknown' => WPRProtectFW_V542::WP_USER_ROLE_LEVEL_UNKNOWN
111 + 'custom' => WPRProtectFW_V676::WP_USER_ROLE_LEVEL_CUSTOM,
112 + 'unknown' => WPRProtectFW_V676::WP_USER_ROLE_LEVEL_UNKNOWN
108 113 );
109 114
110 115 const TABLE_NAME = "fw_requests";
111 116 const IP_COOKIE_NAME = "mcfw-ip-cookie";
@@ -111,8 +116,10 @@
111 116 const IP_COOKIE_NAME = "mcfw-ip-cookie";
112 117 const BYPASS_COOKIE_NAME = "mcfw-bypass-cookie";
113 118 const PREVENT_CACHE_COOKIE_NAME = "wp-mcfw-prevent-cache-cookie";
114 119
120 + const LOG_SLICE_SIZE = 1024;
121 +
115 122 private function __construct($protect_mode, $request, $config, $brand_name) {
116 123 $this->request = $request;
117 124 $this->brand_name = $brand_name;
118 125 $this->protect_mode = $protect_mode;
@@ -164,8 +171,12 @@
164 171 if (array_key_exists('cookiedomain', $config) && is_string($config['cookiedomain'])) {
165 172 $this->cookie_domain = $config['cookiedomain'];
166 173 }
167 174
175 + if (array_key_exists('cookievalidity', $config) && is_int($config['cookievalidity'])) {
176 + $this->cookie_validity = $config['cookievalidity'];
177 + }
178 +
168 179 if (array_key_exists('cansetcachepreventioncookie', $config) &&
169 180 is_bool($config['cansetcachepreventioncookie'])) {
170 181
171 182 $this->can_set_cache_prevention_cookie = $config['cansetcachepreventioncookie'];
@@ -182,8 +193,20 @@
182 193 if (array_key_exists('logconfig', $config) && is_array($config['logconfig'])) {
183 194 $this->log_config = $config['logconfig'];
184 195 }
185 196
197 + if (array_key_exists('canlograwbody', $this->log_config) &&
198 + is_bool($this->log_config['canlograwbody'])) {
199 +
200 + $this->can_log_raw_body = $this->log_config['canlograwbody'];
201 + }
202 +
203 + if (array_key_exists('logslicesize', $this->log_config) &&
204 + is_int($this->log_config['logslicesize'])) {
205 +
206 + $this->log_slice_size = $this->log_config['logslicesize'];
207 + }
208 +
186 209 if (array_key_exists('reqprofilingmode', $this->log_config) &&
187 210 is_int($this->log_config['reqprofilingmode'])) {
188 211
189 212 $this->request_profiling_mode = $this->log_config['reqprofilingmode'];
@@ -216,15 +239,21 @@
216 239
217 240 $this->skip_log_post_params = $this->skip_log_config['post'];
218 241 }
219 242
243 + if (array_key_exists('json', $this->skip_log_config) &&
244 + is_array($this->skip_log_config['json'])) {
245 +
246 + $this->skip_log_json_params = $this->skip_log_config['json'];
247 + }
248 +
220 249 if ($this->isPrependMode()) {
221 250 $log_file = MCDATAPATH . MCCONFKEY . '-mc.log';
222 - $this->ipstore = new WPRProtectIpstore_V542(WPRProtectIpstore_V542::STORAGE_TYPE_FS);
223 - $this->logger = new WPRProtectLogger_V542($log_file, WPRProtectLogger_V542::TYPE_FS);
251 + $this->ipstore = new WPRProtectIpstore_V676(WPRProtectIpstore_V676::STORAGE_TYPE_FS);
252 + $this->logger = new WPRProtectLogger_V676($log_file, WPRProtectLogger_V676::TYPE_FS);
224 253 } else {
225 - $this->ipstore = new WPRProtectIpstore_V542(WPRProtectIpstore_V542::STORAGE_TYPE_DB);
226 - $this->logger = new WPRProtectLogger_V542(WPRProtectFW_V542::TABLE_NAME, WPRProtectLogger_V542::TYPE_DB);
254 + $this->ipstore = new WPRProtectIpstore_V676(WPRProtectIpstore_V676::STORAGE_TYPE_DB);
255 + $this->logger = new WPRProtectLogger_V676(WPRProtectFW_V676::TABLE_NAME, WPRProtectLogger_V676::TYPE_DB);
227 256 }
228 257
229 258 if ($this->is_wp_user_cookie_enabled) {
230 259 $this->loadWPUser();
@@ -235,12 +264,12 @@
235 264
236 265 public static function getInstance($protect_mode, $request, $config, $brand_name) {
237 266 if (!isset(self::$instance)) {
238 267 self::$instance = new self($protect_mode, $request, $config, $brand_name);
239 - } elseif (self::$instance->protect_mode != $protect_mode && $protect_mode == WPRProtect_V542::MODE_WP) {
268 + } elseif (self::$instance->protect_mode != $protect_mode && $protect_mode == WPRProtect_V676::MODE_WP) {
240 269 self::$instance->protect_mode = $protect_mode;
241 270 self::$instance->brand_name = $brand_name;
242 - self::$instance->ipstore = new WPRProtectIpstore_V542(WPRProtectIpstore_V542::STORAGE_TYPE_DB);
271 + self::$instance->ipstore = new WPRProtectIpstore_V676(WPRProtectIpstore_V676::STORAGE_TYPE_DB);
243 272 self::$instance->initRules();
244 273 }
245 274
246 275 return self::$instance;
@@ -246,9 +275,9 @@
246 275 return self::$instance;
247 276 }
248 277
249 278 public static function uninstall() {
250 - WPRProtect_V542::$db->dropBVTable(WPRProtectFW_V542::TABLE_NAME);
279 + WPRProtect_V676::$db->dropBVTable(WPRProtectFW_V676::TABLE_NAME);
251 280 }
252 281
253 282 public function init() {
254 283 if (!$this->isModeDisabled()) {
@@ -266,42 +295,42 @@
266 295 }
267 296 }
268 297
269 298 private function isPrependMode() {
270 - return ($this->protect_mode === WPRProtect_V542::MODE_PREPEND);
299 + return ($this->protect_mode === WPRProtect_V676::MODE_PREPEND);
271 300 }
272 301
273 302 private function isWPMode() {
274 - return ($this->protect_mode === WPRProtect_V542::MODE_WP);
303 + return ($this->protect_mode === WPRProtect_V676::MODE_WP);
275 304 }
276 305
277 306 private function isModeDisabled() {
278 - return ($this->mode === WPRProtectFW_V542::MODE_DISABLED);
307 + return ($this->mode === WPRProtectFW_V676::MODE_DISABLED);
279 308 }
280 309
281 310 private function isModeProtect() {
282 - return ($this->mode === WPRProtectFW_V542::MODE_PROTECT);
311 + return ($this->mode === WPRProtectFW_V676::MODE_PROTECT);
283 312 }
284 313
285 314 private function isAdminCookieEnabled() {
286 - return ($this->admin_cookie_mode === WPRProtectFW_V542::ADMIN_COOKIE_MODE_ENABLED);
315 + return ($this->admin_cookie_mode === WPRProtectFW_V676::ADMIN_COOKIE_MODE_ENABLED);
287 316 }
288 317
289 318 private function isIPCookieEnabled() {
290 - return ($this->ip_cookie_mode === WPRProtectFW_V542::IP_COOKIE_MODE_ENABLED);
319 + return ($this->ip_cookie_mode === WPRProtectFW_V676::IP_COOKIE_MODE_ENABLED);
291 320 }
292 321
293 322 private function isRequestProfilingDisabled() {
294 - return ($this->request_profiling_mode === WPRProtectFW_V542::REQ_PROFILING_MODE_DISABLED);
323 + return ($this->request_profiling_mode === WPRProtectFW_V676::REQ_PROFILING_MODE_DISABLED);
295 324 }
296 325
297 326 private function isRequestProfilingModeDebug() {
298 - return ($this->request_profiling_mode === WPRProtectFW_V542::REQ_PROFILING_MODE_DEBUG);
327 + return ($this->request_profiling_mode === WPRProtectFW_V676::REQ_PROFILING_MODE_DEBUG);
299 328 }
300 329
301 330 private function isRequestHasValidBypassCookie() {
302 331 if (!isset($this->has_valid_bypass_cookie)) {
303 - $cookie = (string) $this->request->getCookies(WPRProtectFW_V542::BYPASS_COOKIE_NAME);
332 + $cookie = (string) $this->request->getCookies(WPRProtectFW_V676::BYPASS_COOKIE_NAME);
304 333 $new_cookie = $this->generateBypassCookie();
305 334 $is_valid = ($this->isAdminCookieEnabled() && $new_cookie && ($cookie === $new_cookie));
306 335 $this->has_valid_bypass_cookie = $is_valid;
307 336 }
@@ -309,17 +338,17 @@
309 338 return $this->has_valid_bypass_cookie;
310 339 }
311 340
312 341 private function isRulesModeProtect() {
313 - return ($this->rules_mode === WPRProtectFW_V542::RULES_MODE_PROTECT);
342 + return ($this->rules_mode === WPRProtectFW_V676::RULES_MODE_PROTECT);
314 343 }
315 344
316 345 public function isLoggingModeComplete() {
317 - return ($this->logging_mode === WPRProtectFW_V542::LOGGING_MODE_COMPLETE);
346 + return ($this->logging_mode === WPRProtectFW_V676::LOGGING_MODE_COMPLETE);
318 347 }
319 348
320 349 public function isLoggingModeVisitor() {
321 - return ($this->logging_mode === WPRProtectFW_V542::LOGGING_MODE_VISITOR);
350 + return ($this->logging_mode === WPRProtectFW_V676::LOGGING_MODE_VISITOR);
322 351 }
323 352
324 353 public function isGeoBlockingEnabled() {
325 354 return ($this->is_geo_blocking === true);
@@ -325,13 +354,13 @@
325 354 return ($this->is_geo_blocking === true);
326 355 }
327 356
328 357 private function isWPFRuleInitModePrepend() {
329 - return ($this->wpf_rule_init_mode === WPRProtectFW_V542::WPF_RULE_INIT_MODE_PREPEND);
358 + return ($this->wpf_rule_init_mode === WPRProtectFW_V676::WPF_RULE_INIT_MODE_PREPEND);
330 359 }
331 360
332 361 private function isWPFRuleInitModeWP() {
333 - return ($this->wpf_rule_init_mode === WPRProtectFW_V542::WPF_RULE_INIT_MODE_WP);
362 + return ($this->wpf_rule_init_mode === WPRProtectFW_V676::WPF_RULE_INIT_MODE_WP);
334 363 }
335 364
336 365 private function canInitWPFRules() {
337 366 if (!$this->isWPFRuleInitModePrepend() && $this->isPrependMode()) {
@@ -341,9 +370,9 @@
341 370 return true;
342 371 }
343 372
344 373 private function generateBypassCookie() {
345 - $time = floor(time() / 43200);
374 + $time = floor(time() / $this->cookie_validity);
346 375
347 376 return hash('sha256', $this->bypass_level . $time . $this->cookie_key);
348 377 }
349 378
@@ -358,18 +387,18 @@
358 387 if (function_exists('is_user_logged_in') && is_user_logged_in()) {
359 388 $current_wp_user = $this->getCurrentWPUser();
360 389
361 390 if (!$current_wp_user->isIdentical($this->request->wp_user)) {
362 - $serialized_wp_user = WPRProtectWPUser_V542::_serialize($current_wp_user);
391 + $serialized_wp_user = WPRProtectWPUser_V676::_serialize($current_wp_user);
363 392 $cookie_val = $serialized_wp_user . '_' .
364 - WPRProtectUtils_V542::signMessage($serialized_wp_user, $this->cookie_key);
393 + WPRProtectUtils_V676::signMessage($serialized_wp_user, $this->cookie_key);
365 394 $cookie_val = base64_encode($cookie_val);
366 395
367 - $this->setcookie(WPRProtectWPUser_V542::COOKIE_NAME, $cookie_val, time() + 43200);
396 + $this->setCookie(WPRProtectWPUser_V676::COOKIE_NAME, $cookie_val);
368 397 }
369 398 } elseif ($this->request->wp_user->isLoggedIn()) {
370 - $this->request->wp_user = WPRProtectWPUser_V542::defaultUser();
371 - $this->unsetCookie(WPRProtectWPUser_V542::COOKIE_NAME);
399 + $this->request->wp_user = WPRProtectWPUser_V676::defaultUser();
400 + $this->unsetCookie(WPRProtectWPUser_V676::COOKIE_NAME);
372 401 }
373 402 }
374 403
375 404 private function getCurrentWPUser() {
@@ -375,9 +404,9 @@
375 404 private function getCurrentWPUser() {
376 405 $id = 0;
377 406 $role_level = 0;
378 407 $capabilities = array();
379 - $time = (int) floor(time() / 43200);
408 + $time = (int) floor(time() / $this->cookie_validity);
380 409
381 410 if (function_exists('wp_get_current_user')) {
382 411 $user = wp_get_current_user();
383 412 $id = $user->ID;
@@ -384,9 +413,9 @@
384 413 $role_level = $this->getCurrentWPUserRoleLevel();
385 414 $capabilities = $this->getCurrentWPUserCapabilities();
386 415 }
387 416
388 - return (new WPRProtectWPUser_V542($id, $role_level, $capabilities, $time));
417 + return (new WPRProtectWPUser_V676($id, $role_level, $capabilities, $time));
389 418 }
390 419
391 420 private function getCurrentWPUserCapabilities() {
392 421 $capabilities = array();
@@ -403,11 +432,11 @@
403 432 return $capabilities;
404 433 }
405 434
406 435 private function loadWPUser() {
407 - $this->request->wp_user = WPRProtectWPUser_V542::defaultUser();
436 + $this->request->wp_user = WPRProtectWPUser_V676::defaultUser();
408 437
409 - $cookie_val = $this->request->getCookies(WPRProtectWPUser_V542::COOKIE_NAME);
438 + $cookie_val = $this->request->getCookies(WPRProtectWPUser_V676::COOKIE_NAME);
410 439 if (!is_string($cookie_val)) {
411 440 return;
412 441 }
413 442
@@ -421,12 +450,12 @@
421 450 return;
422 451 }
423 452 list($serialized_user, $signature) = $cookie_val_array;
424 453
425 - if (WPRProtectUtils_V542::verifyMessage($serialized_user, $signature, $this->cookie_key) === true) {
426 - $wp_user = WPRProtectWPUser_V542::_unserialize($serialized_user);
454 + if (WPRProtectUtils_V676::verifyMessage($serialized_user, $signature, $this->cookie_key) === true) {
455 + $wp_user = WPRProtectWPUser_V676::_unserialize($serialized_user);
427 456
428 - if (!isset($wp_user) || $wp_user->time !== (int) floor(time() / 43200)) {
457 + if (!isset($wp_user) || $wp_user->time !== (int) floor(time() / $this->cookie_validity)) {
429 458 return;
430 459 }
431 460
432 461 $this->request->wp_user = $wp_user;
@@ -437,10 +466,10 @@
437 466 $this->request->wp_user->capability_names[] = $capability_names[$capability];
438 467 }
439 468 }
440 469
441 - $role_by_level = array_flip(array_merge(WPRProtectFW_V542::DEFAULT_WP_USER_ROLE_LEVELS,
442 - WPRProtectFW_V542::EXTRA_WP_USER_ROLE_LEVELS));
470 + $role_by_level = array_flip(array_merge(WPRProtectFW_V676::DEFAULT_WP_USER_ROLE_LEVELS,
471 + WPRProtectFW_V676::EXTRA_WP_USER_ROLE_LEVELS));
443 472 $this->request->wp_user->role = $role_by_level[$this->request->wp_user->role_level];
444 473 }
445 474 }
446 475
@@ -462,11 +491,11 @@
462 491 }
463 492
464 493 if ($this->isPrependMode()) {
465 494 $rules_file = MCDATAPATH . MCCONFKEY . '-' . 'mc_rules.json';
466 - $rule_arrays = WPRProtectUtils_V542::parseFile($rules_file);
495 + $rule_arrays = WPRProtectUtils_V676::parseFile($rules_file);
467 496 } else {
468 - $rule_arrays = WPRProtect_V542::$settings->getOption('bvruleset');
497 + $rule_arrays = WPRProtect_V676::$settings->getOption('bvruleset');
469 498 if(!is_array($rule_arrays)) {
470 499 $rule_arrays = array();
471 500 }
472 501 }
@@ -476,9 +505,9 @@
476 505 return;
477 506 }
478 507
479 508 foreach($rule_arrays as $rule_array) {
480 - $rule = WPRProtectFWRule_V542::init($rule_array);
509 + $rule = WPRProtectFWRule_V676::init($rule_array);
481 510
482 511 if ($rule) {
483 512 if (!$this->is_rule_initialized && $rule->isExeOnBoot()) {
484 513 if (!$this->isRequestHasValidBypassCookie()) {
@@ -500,40 +529,108 @@
500 529 $this->rules[] = $rule;
501 530 }
502 531
503 532 private function initWPFRule($rule) {
504 - if ($rule->isExeOnPreUpdateOption()) {
533 + switch ($rule->execute_on) {
534 + case WPRProtectFWRule_V676::EXE_ON_PRE_UPDATE_OPTION:
505 535 $this->addWPHook($rule, 'pre_update_option', 'handleRequestOnPreUpdateOption', 3);
506 - } elseif ($rule->isExeOnPreDeletePost()) {
536 + break;
537 + case WPRProtectFWRule_V676::EXE_ON_PRE_DELETE_POST:
507 538 $this->addWPHook($rule, 'pre_delete_post', 'handleRequestOnPreDeletePost', 3);
508 - } elseif ($rule->isExeOnWPInsertPostEmptyContent()) {
509 - $this->addWPHook($rule, 'wp_insert_post_empty_content', 'handleRequestOnWPInsertPostEmptyContent', 2);
510 - } elseif ($rule->isExeOnInsertUserMeta()) {
539 + break;
540 + case WPRProtectFWRule_V676::EXE_ON_WP_INSERT_POST_EMPTY_CONTENT:
541 + $this->addWPHook($rule, 'wp_insert_post_empty_content',
542 + 'handleRequestOnWPInsertPostEmptyContent', 2);
543 + break;
544 + case WPRProtectFWRule_V676::EXE_ON_INSERT_USER_META:
511 545 $this->addWPHook($rule, 'insert_user_meta', 'handleRequestOnInsertUserMeta', 4);
512 - } elseif ($rule->isExeOnDeleteOption()) {
546 + break;
547 + case WPRProtectFWRule_V676::EXE_ON_DELETE_OPTION:
513 548 $this->addWPHook($rule, 'delete_option', 'handleRequestOnDeleteOption', 1, 'action');
514 - } elseif ($rule->isExeOnDeleteUser()) {
549 + break;
550 + case WPRProtectFWRule_V676::EXE_ON_DELETE_USER:
515 551 $this->addWPHook($rule, 'delete_user', 'handleRequestOnDeleteUser', 3, 'action');
516 - } elseif ($rule->isExeOnPasswordReset()) {
552 + break;
553 + case WPRProtectFWRule_V676::EXE_ON_PASSWORD_RESET:
517 554 $this->addWPHook($rule, 'password_reset', 'handleRequestOnPasswordReset', 2, 'action');
518 - } elseif ($rule->isExeOnSendAuthCookies()) {
555 + break;
556 + case WPRProtectFWRule_V676::EXE_ON_SEND_AUTH_COOKIES:
519 557 $this->addWPHook($rule, 'send_auth_cookies', 'handleRequestOnSendAuthCookies', 6);
520 - } elseif ($rule->isExeOnSetAuthCookie()) {
558 + break;
559 + case WPRProtectFWRule_V676::EXE_ON_SET_AUTH_COOKIE:
521 560 $this->addWPHook($rule, 'set_auth_cookie', 'handleRequestOnSetAuthCookie', 6, 'action');
522 - } elseif ($rule->isExeOnInit()) {
561 + break;
562 + case WPRProtectFWRule_V676::EXE_ON_INIT:
523 563 $this->addWPHook($rule, 'init', 'handleRequestOnInit', 0, 'action');
524 - } elseif ($rule->isExeOnUserRegister()) {
564 + break;
565 + case WPRProtectFWRule_V676::EXE_ON_USER_REGISTER:
525 566 $this->addWPHook($rule, 'user_register', 'handleRequestOnUserRegister', 2, 'action');
526 - } elseif ($rule->isExeOnAddUserMeta()) {
567 + break;
568 + case WPRProtectFWRule_V676::EXE_ON_ADD_USER_META:
527 569 $this->addWPHook($rule, 'add_user_meta', 'handleRequestOnAddUserMeta', 3, 'action');
528 - } elseif ($rule->isExeOnUpdateUserMetadata()) {
570 + break;
571 + case WPRProtectFWRule_V676::EXE_ON_UPDATE_USER_METADATA:
529 572 $this->addWPHook($rule, 'update_user_metadata', 'handleRequestOnUpdateUserMetadata', 5);
530 - } elseif ($rule->isExeOnUpdateUserMeta()) {
573 + break;
574 + case WPRProtectFWRule_V676::EXE_ON_UPDATE_USER_META:
531 575 $this->addWPHook($rule, 'update_user_meta', 'handleRequestOnUpdateUserMeta', 4, 'action');
532 - } elseif ($rule->isExeOnAddOption()) {
576 + break;
577 + case WPRProtectFWRule_V676::EXE_ON_ADD_OPTION:
533 578 $this->addWPHook($rule, 'add_option', 'handleRequestOnAddOption', 2, 'action');
534 - } elseif ($rule->isExeOnWPPreInsertUserData()) {
579 + break;
580 + case WPRProtectFWRule_V676::EXE_ON_WP_PRE_INSERT_USER_DATA:
535 581 $this->addWPHook($rule, 'wp_pre_insert_user_data', 'handleRequestOnWPPreInsertUserData', 4);
582 + break;
583 + case WPRProtectFWRule_V676::EXE_ON_REST_REQUEST_BEFORE_CALLBACKS:
584 + $this->addWPHook($rule, 'rest_request_before_callbacks',
585 + 'handleRequestOnRestRequestBeforeCallbacks', 3);
586 + break;
587 + case WPRProtectFWRule_V676::EXE_ON_ADMIN_INIT:
588 + $this->addWPHook($rule, 'admin_init', 'handleRequestOnAdminInit', 0, 'action');
589 + break;
590 + case WPRProtectFWRule_V676::EXE_ON_WP_HANDLE_UPLOAD_PREFILTER:
591 + $this->addWPHook($rule, 'wp_handle_upload_prefilter',
592 + 'handleRequestOnWPHandleUploadPrefilter', 1);
593 + break;
594 + case WPRProtectFWRule_V676::EXE_ON_TEMPLATE_REDIRECT:
595 + $this->addWPHook($rule, 'template_redirect', 'handleRequestOnTemplateRedirect', 0, 'action');
596 + break;
597 + case WPRProtectFWRule_V676::EXE_ON_WP_LOADED:
598 + $this->addWPHook($rule, 'wp_loaded', 'handleRequestOnWPLoaded', 0, 'action');
599 + break;
600 + case WPRProtectFWRule_V676::EXE_ON_ADD_POST_METADATA:
601 + $this->addWPHook($rule, 'add_post_metadata', 'handleRequestOnAddPostMetadata', 5);
602 + break;
603 + case WPRProtectFWRule_V676::EXE_ON_UPDATE_POST_METADATA:
604 + $this->addWPHook($rule, 'update_post_metadata', 'handleRequestOnUpdatePostMetadata', 5);
605 + break;
606 + case WPRProtectFWRule_V676::EXE_ON_DELETE_POST_METADATA:
607 + $this->addWPHook($rule, 'delete_post_metadata', 'handleRequestOnDeletePostMetadata', 5);
608 + break;
609 + case WPRProtectFWRule_V676::EXE_ON_ADD_TERM_METADATA:
610 + $this->addWPHook($rule, 'add_term_metadata', 'handleRequestOnAddTermMetadata', 5);
611 + break;
612 + case WPRProtectFWRule_V676::EXE_ON_UPDATE_TERM_METADATA:
613 + $this->addWPHook($rule, 'update_term_metadata', 'handleRequestOnUpdateTermMetadata', 5);
614 + break;
615 + case WPRProtectFWRule_V676::EXE_ON_DELETE_TERM_METADATA:
616 + $this->addWPHook($rule, 'delete_term_metadata', 'handleRequestOnDeleteTermMetadata', 5);
617 + break;
618 + case WPRProtectFWRule_V676::EXE_ON_ADD_COMMENT_METADATA:
619 + $this->addWPHook($rule, 'add_comment_metadata', 'handleRequestOnAddCommentMetadata', 5);
620 + break;
621 + case WPRProtectFWRule_V676::EXE_ON_UPDATE_COMMENT_METADATA:
622 + $this->addWPHook($rule, 'update_comment_metadata', 'handleRequestOnUpdateCommentMetadata', 5);
623 + break;
624 + case WPRProtectFWRule_V676::EXE_ON_DELETE_COMMENT_METADATA:
625 + $this->addWPHook($rule, 'delete_comment_metadata', 'handleRequestOnDeleteCommentMetadata', 5);
626 + break;
627 + case WPRProtectFWRule_V676::EXE_ON_ADD_USER_METADATA:
628 + $this->addWPHook($rule, 'add_user_metadata', 'handleRequestOnAddUserMetadata', 5);
629 + break;
630 + case WPRProtectFWRule_V676::EXE_ON_DELETE_USER_METADATA:
631 + $this->addWPHook($rule, 'delete_user_metadata', 'handleRequestOnDeleteUserMetadata', 5);
632 + break;
536 633 }
537 634 }
538 635
539 636 private function addWPHook($rule, $hook_name, $function_name, $accepted_args, $hook_type = 'filter') {
@@ -547,9 +644,9 @@
547 644 } else {
548 645 add_filter($hook_name, $callback, -9999999, $accepted_args);
549 646 }
550 647 } else {
551 - WPRProtectUtils_V542::preInitWPHook($hook_name, $callback, -9999999, $accepted_args);
648 + WPRProtectUtils_V676::preInitWPHook($hook_name, $callback, -9999999, $accepted_args);
552 649 }
553 650 }
554 651
555 652 $this->pushWPFRule($function_name, $rule);
@@ -872,8 +969,199 @@
872 969 $this->handleRequestOnRuleMatch($rules, $variables, $log_data);
873 970 }
874 971 }
875 972
973 + private function handleRequestOnLifecycleHook($function_name, $hook_name) {
974 + $rules = $this->getWPFRules($function_name);
975 +
976 + if (!empty($rules)) {
977 + $variables = $this->getLifecycleHookVariables($hook_name);
978 + $this->handleRequestOnRuleMatch($rules, $variables, $variables);
979 + }
980 + }
981 +
982 + private function getLifecycleHookVariables($hook_name) {
983 + $variables = array('hook' => $hook_name);
984 +
985 + if (function_exists('is_admin')) {
986 + $variables['is_admin'] = is_admin();
987 + }
988 +
989 + if (function_exists('wp_doing_ajax')) {
990 + $variables['is_ajax'] = wp_doing_ajax();
991 + } else {
992 + $variables['is_ajax'] = (defined('DOING_AJAX') && DOING_AJAX);
993 + }
994 +
995 + $variables['is_cron'] = (defined('DOING_CRON') && DOING_CRON);
996 + $variables['is_rest_request'] = (defined('REST_REQUEST') && REST_REQUEST);
997 +
998 + return $variables;
999 + }
1000 +
1001 + public function handleRequestOnAdminInit() {
1002 + $this->handleRequestOnLifecycleHook('handleRequestOnAdminInit', 'admin_init');
1003 + }
1004 +
1005 + public function handleRequestOnTemplateRedirect() {
1006 + $this->handleRequestOnLifecycleHook('handleRequestOnTemplateRedirect', 'template_redirect');
1007 + }
1008 +
1009 + public function handleRequestOnWPLoaded() {
1010 + $this->handleRequestOnLifecycleHook('handleRequestOnWPLoaded', 'wp_loaded');
1011 + }
1012 +
1013 + public function handleRequestOnRestRequestBeforeCallbacks($response, $handler, $request) {
1014 + $rules = $this->getWPFRules('handleRequestOnRestRequestBeforeCallbacks');
1015 +
1016 + if (!empty($rules)) {
1017 + $this->handleRequestOnRuleMatch($rules);
1018 + }
1019 +
1020 + return $response;
1021 + }
1022 +
1023 + private function getSafeUploadFileData($file) {
1024 + $data = array();
1025 +
1026 + if (!is_array($file)) {
1027 + return $data;
1028 + }
1029 +
1030 + foreach (array('name', 'type', 'size', 'error') as $key) {
1031 + if (array_key_exists($key, $file) && (is_scalar($file[$key]) || is_null($file[$key]))) {
1032 + $data[$key] = $file[$key];
1033 + }
1034 + }
1035 +
1036 + if (array_key_exists('name', $data) && is_string($data['name'])) {
1037 + $data['extension'] = strtolower(pathinfo($data['name'], PATHINFO_EXTENSION));
1038 + }
1039 +
1040 + return $data;
1041 + }
1042 +
1043 + private function getMetadataValueLogData($key, $value) {
1044 + $data = array(
1045 + $key . '_type' => gettype($value),
1046 + $key . '_size' => null
1047 + );
1048 +
1049 + if (is_null($value)) {
1050 + $data[$key . '_size'] = 0;
1051 + } elseif (is_scalar($value)) {
1052 + $data[$key . '_size'] = strlen((string) $value);
1053 + } elseif (is_array($value)) {
1054 + $data[$key . '_count'] = count($value);
1055 + } elseif (is_object($value)) {
1056 + $data[$key . '_count'] = count(get_object_vars($value));
1057 + }
1058 +
1059 + return $data;
1060 + }
1061 +
1062 + public function handleRequestOnWPHandleUploadPrefilter($file) {
1063 + $rules = $this->getWPFRules('handleRequestOnWPHandleUploadPrefilter');
1064 +
1065 + if (!empty($rules)) {
1066 + $safe_file = $this->getSafeUploadFileData($file);
1067 + $variables = array('file' => $safe_file);
1068 + $this->handleRequestOnRuleMatch($rules, $variables, $variables);
1069 + }
1070 +
1071 + return $file;
1072 + }
1073 +
1074 + private function handleRequestOnMetadataFilter($function_name, $meta_type, $operation, $check,
1075 + $object_id, $meta_key, $meta_value, $extra = array()) {
1076 +
1077 + $rules = $this->getWPFRules($function_name);
1078 +
1079 + if (!empty($rules)) {
1080 + $variables = array_merge(array(
1081 + 'check' => $check,
1082 + 'meta_type' => $meta_type,
1083 + 'operation' => $operation,
1084 + 'object_id' => $object_id,
1085 + 'meta_key' => $meta_key,
1086 + 'meta_value' => $meta_value
1087 + ), $extra);
1088 +
1089 + $log_extra = $extra;
1090 + if (array_key_exists('prev_value', $log_extra)) {
1091 + $prev_value = $log_extra['prev_value'];
1092 + unset($log_extra['prev_value']);
1093 + $log_extra = array_merge($log_extra, $this->getMetadataValueLogData('prev_value', $prev_value));
1094 + }
1095 +
1096 + $log_data = array_merge(array(
1097 + 'meta_type' => $meta_type,
1098 + 'operation' => $operation,
1099 + 'object_id' => $object_id,
1100 + 'meta_key' => $meta_key
1101 + ), $this->getMetadataValueLogData('meta_value', $meta_value), $log_extra);
1102 +
1103 + $this->handleRequestOnRuleMatch($rules, $variables, $log_data);
1104 + }
1105 +
1106 + return $check;
1107 + }
1108 +
1109 + public function handleRequestOnAddPostMetadata($check, $object_id, $meta_key, $meta_value, $unique) {
1110 + return $this->handleRequestOnMetadataFilter('handleRequestOnAddPostMetadata',
1111 + 'post', 'add', $check, $object_id, $meta_key, $meta_value, array('unique' => $unique));
1112 + }
1113 +
1114 + public function handleRequestOnUpdatePostMetadata($check, $object_id, $meta_key, $meta_value, $prev_value) {
1115 + return $this->handleRequestOnMetadataFilter('handleRequestOnUpdatePostMetadata',
1116 + 'post', 'update', $check, $object_id, $meta_key, $meta_value, array('prev_value' => $prev_value));
1117 + }
1118 +
1119 + public function handleRequestOnDeletePostMetadata($check, $object_id, $meta_key, $meta_value, $delete_all) {
1120 + return $this->handleRequestOnMetadataFilter('handleRequestOnDeletePostMetadata',
1121 + 'post', 'delete', $check, $object_id, $meta_key, $meta_value, array('delete_all' => $delete_all));
1122 + }
1123 +
1124 + public function handleRequestOnAddTermMetadata($check, $object_id, $meta_key, $meta_value, $unique) {
1125 + return $this->handleRequestOnMetadataFilter('handleRequestOnAddTermMetadata',
1126 + 'term', 'add', $check, $object_id, $meta_key, $meta_value, array('unique' => $unique));
1127 + }
1128 +
1129 + public function handleRequestOnUpdateTermMetadata($check, $object_id, $meta_key, $meta_value, $prev_value) {
1130 + return $this->handleRequestOnMetadataFilter('handleRequestOnUpdateTermMetadata',
1131 + 'term', 'update', $check, $object_id, $meta_key, $meta_value, array('prev_value' => $prev_value));
1132 + }
1133 +
1134 + public function handleRequestOnDeleteTermMetadata($check, $object_id, $meta_key, $meta_value, $delete_all) {
1135 + return $this->handleRequestOnMetadataFilter('handleRequestOnDeleteTermMetadata',
1136 + 'term', 'delete', $check, $object_id, $meta_key, $meta_value, array('delete_all' => $delete_all));
1137 + }
1138 +
1139 + public function handleRequestOnAddCommentMetadata($check, $object_id, $meta_key, $meta_value, $unique) {
1140 + return $this->handleRequestOnMetadataFilter('handleRequestOnAddCommentMetadata',
1141 + 'comment', 'add', $check, $object_id, $meta_key, $meta_value, array('unique' => $unique));
1142 + }
1143 +
1144 + public function handleRequestOnUpdateCommentMetadata($check, $object_id, $meta_key, $meta_value, $prev_value) {
1145 + return $this->handleRequestOnMetadataFilter('handleRequestOnUpdateCommentMetadata',
1146 + 'comment', 'update', $check, $object_id, $meta_key, $meta_value, array('prev_value' => $prev_value));
1147 + }
1148 +
1149 + public function handleRequestOnDeleteCommentMetadata($check, $object_id, $meta_key, $meta_value, $delete_all) {
1150 + return $this->handleRequestOnMetadataFilter('handleRequestOnDeleteCommentMetadata',
1151 + 'comment', 'delete', $check, $object_id, $meta_key, $meta_value, array('delete_all' => $delete_all));
1152 + }
1153 +
1154 + public function handleRequestOnAddUserMetadata($check, $object_id, $meta_key, $meta_value, $unique) {
1155 + return $this->handleRequestOnMetadataFilter('handleRequestOnAddUserMetadata',
1156 + 'user', 'add', $check, $object_id, $meta_key, $meta_value, array('unique' => $unique));
1157 + }
1158 +
1159 + public function handleRequestOnDeleteUserMetadata($check, $object_id, $meta_key, $meta_value, $delete_all) {
1160 + return $this->handleRequestOnMetadataFilter('handleRequestOnDeleteUserMetadata',
1161 + 'user', 'delete', $check, $object_id, $meta_key, $meta_value, array('delete_all' => $delete_all));
1162 + }
1163 +
876 1164 private function setShutdownCallback() {
877 1165 if (!$this->is_shutdown_cb_set) {
878 1166 register_shutdown_function(array($this, 'log'));
879 1167 $this->is_shutdown_cb_set = true;
@@ -879,9 +1167,13 @@
879 1167 $this->is_shutdown_cb_set = true;
880 1168 }
881 1169 }
882 1170
883 - private function setCookie($name, $value, $expire) {
1171 + private function setCookie($name, $value, $expire = null) {
1172 + if ($expire === null) {
1173 + $expire = time() + $this->cookie_validity;
1174 + }
1175 +
884 1176 $path = $this->cookie_path;
885 1177 $cookie_domain = $this->cookie_domain;
886 1178
887 1179 if (version_compare(PHP_VERSION, '5.2.0') >= 0) {
@@ -910,14 +1202,14 @@
910 1202 }
911 1203
912 1204 private function setIPCookie() {
913 1205 if (!$this->is_ip_cookie_set && $this->isIPCookieEnabled() &&
914 - !$this->request->getCookies(WPRProtectFW_V542::IP_COOKIE_NAME)) {
1206 + !$this->request->getCookies(WPRProtectFW_V676::IP_COOKIE_NAME)) {
915 1207
916 1208 $time = floor(time() / 86400);
917 1209 $cookie = hash('sha256', $this->request->ip . $time . $this->cookie_key);
918 1210 if ($cookie) {
919 - $this->setCookie(WPRProtectFW_V542::IP_COOKIE_NAME, $cookie, time() + 86400);
1211 + $this->setCookie(WPRProtectFW_V676::IP_COOKIE_NAME, $cookie, time() + 86400);
920 1212 }
921 1213 }
922 1214 }
923 1215
@@ -923,18 +1215,18 @@
923 1215
924 1216 private function getCurrentWPUserRoleLevel() {
925 1217 if (function_exists('current_user_can')) {
926 1218 if (function_exists('is_super_admin') && is_super_admin()) {
927 - return WPRProtectFW_V542::WP_USER_ROLE_LEVEL_ADMIN;
1219 + return WPRProtectFW_V676::WP_USER_ROLE_LEVEL_ADMIN;
928 1220 }
929 1221
930 1222 foreach ($this->custom_roles as $role) {
931 1223 if (current_user_can($role)) {
932 - return WPRProtectFW_V542::WP_USER_ROLE_LEVEL_CUSTOM;
1224 + return WPRProtectFW_V676::WP_USER_ROLE_LEVEL_CUSTOM;
933 1225 }
934 1226 }
935 1227
936 - foreach (WPRProtectFW_V542::DEFAULT_WP_USER_ROLE_LEVELS as $role => $level) {
1228 + foreach (WPRProtectFW_V676::DEFAULT_WP_USER_ROLE_LEVELS as $role => $level) {
937 1229 if (current_user_can($role)) {
938 1230 return $level;
939 1231 }
940 1232 }
@@ -961,12 +1253,17 @@
961 1253 }
962 1254 }
963 1255
964 1256 private function canLogValue($key, $prefix) {
965 - if ($prefix === 'BODY[') {
966 - return $this->canLogPostValue($key);
967 - } elseif ($prefix === 'COOKIES[') {
968 - return $this->canLogCookieValue($key);
1257 + switch ($prefix) {
1258 + case 'BODY[':
1259 + return $this->canLogPostValue($key);
1260 + case 'COOKIES[':
1261 + return $this->canLogCookieValue($key);
1262 + case 'JSON[':
1263 + return $this->canLogJsonValue($key);
1264 + case 'HEADERS[':
1265 + return $this->canLogHeaderValue($key);
969 1266 }
970 1267
971 1268 return true;
972 1269 }
@@ -994,26 +1291,34 @@
994 1291
995 1292 return true;
996 1293 }
997 1294
998 - private function getPostParamsToLog($params) {
1295 + private function canLogJsonValue($key) {
1296 + return $this->canLogKeyValue($key, $this->skip_log_json_params);
1297 + }
1298 +
1299 + private function canLogKeyValue($key, $skip_params) {
1300 + if (is_string($key) && in_array($key, $skip_params)) {
1301 + return false;
1302 + }
1303 +
1304 + return true;
1305 + }
1306 +
1307 + private function getParamsToLog($params, $type) {
999 1308 $loggable_params = array();
1000 1309
1001 1310 if (is_array($params)) {
1002 1311 foreach ($params as $key => $value) {
1003 1312 if (is_array($value)) {
1004 - $loggable_params[$key] = $this->getPostParamsToLog($value);
1313 + $loggable_params[$key] = $this->getParamsToLog($value, $type);
1005 1314 } else {
1006 - if (!$this->canLogPostValue($key)) {
1315 + if ($type == "POST" && !$this->canLogPostValue($key)) {
1007 1316 $loggable_params[$key] = "Sensitive Data";
1317 + } else if ($type == "JSON" && !$this->canLogJsonValue($key)) {
1318 + $loggable_params[$key] = "Sensitive Data";
1008 1319 } else {
1009 - $valsize = $this->getLength($value);
1010 - if ($valsize > 1024) {
1011 - $value = substr($value, 0, 1024);
1012 - $loggable_params[$key] = "Data too long: {$valsize} : {$value}";
1013 - } else {
1014 - $loggable_params[$key] = $value;
1015 - }
1320 + $loggable_params[$key] = $this->getSlicedValueToLog($value);
1016 1321 }
1017 1322 }
1018 1323 }
1019 1324 }
@@ -1020,14 +1325,18 @@
1020 1325
1021 1326 return $loggable_params;
1022 1327 }
1023 1328
1329 + private function getRawBodyToLog($content) {
1330 + return $this->getSlicedValueToLog($content);
1331 + }
1332 +
1024 1333 private function getBVCookies() {
1025 1334 $cookies = array();
1026 1335
1027 - if ($this->request->getCookies(WPRProtectFW_V542::IP_COOKIE_NAME) !== NULL) {
1028 - $cookie_val = (string) $this->request->getCookies(WPRProtectFW_V542::IP_COOKIE_NAME);
1029 - $cookies[WPRProtectFW_V542::IP_COOKIE_NAME] = $cookie_val;
1336 + if ($this->request->getCookies(WPRProtectFW_V676::IP_COOKIE_NAME) !== NULL) {
1337 + $cookie_val = (string) $this->request->getCookies(WPRProtectFW_V676::IP_COOKIE_NAME);
1338 + $cookies[WPRProtectFW_V676::IP_COOKIE_NAME] = $cookie_val;
1030 1339 }
1031 1340
1032 1341 return $cookies;
1033 1342 }
@@ -1063,8 +1372,30 @@
1063 1372
1064 1373 return $loggable_headers;
1065 1374 }
1066 1375
1376 + private function getSlicedValueToLog($value, $size = null) {
1377 + if (!is_scalar($value)) {
1378 + return "Logging of " . gettype($value) . " is not supported.";
1379 + }
1380 +
1381 + if ($size === null) {
1382 + $size = $this->log_slice_size;
1383 + }
1384 +
1385 + $loggable_value = '';
1386 +
1387 + $valsize = $this->getLength($value);
1388 + if ($valsize > $size) {
1389 + $value = substr((string) $value, 0, $size);
1390 + $loggable_value = "Data too long: {$valsize} : {$value}";
1391 + } else {
1392 + $loggable_value = $value;
1393 + }
1394 +
1395 + return $loggable_value;
1396 + }
1397 +
1067 1398 private function getRequestDataToLog() {
1068 1399 $referer = $this->request->getHeader('Referer') ? $this->request->getHeader('Referer') : '';
1069 1400 $user_agent = $this->request->getHeader('User-Agent')
1070 1401 ? $this->request->getHeader('User-Agent') : '';
@@ -1148,21 +1479,28 @@
1148 1479 $this->rule_log[$category] = $category_data;
1149 1480 }
1150 1481
1151 1482 private function inspectRequest() {
1152 - $this->updateRuleLog('inspect', "headers", $this->getHeadersToLog($this->request->getHeaders()));
1153 -
1154 1483 if (isset($this->request->wp_user)) {
1155 1484 $this->updateRuleLog('inspect', "wpUserInfo", $this->request->wp_user->getInfo());
1156 1485 }
1157 1486
1487 + $this->updateRuleLog('inspect', "headers", $this->getHeadersToLog($this->request->getHeaders()));
1488 + $this->updateRuleLog('inspect', "cookies", $this->getCookiesToLog($this->request->getCookies()));
1158 1489 $this->updateRuleLog('inspect', "getParams", $this->request->getGetParams());
1159 - $this->updateRuleLog('inspect', "postParams", $this->getPostParamsToLog($this->request->getPostParams()));
1160 - $this->updateRuleLog('inspect', "cookies", $this->getCookiesToLog($this->request->getCookies()));
1490 + $this->updateRuleLog('inspect', "postParams", $this->getParamsToLog($this->request->getPostParams(), "POST"));
1491 + $this->updateRuleLog('inspect', "jsonParams", $this->getParamsToLog($this->request->getJsonParams(), "JSON"));
1492 + $this->updateRuleLog('inspect', "bodyParserStatus", $this->request->getBodyParserStatus());
1493 + if ($this->can_log_raw_body) {
1494 + $raw_body = $this->request->getRawBody();
1495 + if (!empty($raw_body)) {
1496 + $this->updateRuleLog('inspect', "rawBody", $this->getRawBodyToLog($raw_body));
1497 + }
1498 + }
1161 1499 }
1162 1500
1163 1501 private function getUserBy($attribute, $value) {
1164 - if (isset($value) && function_exists('get_user_by') && WPRProtectUtils_V542::havePluginsLoaded()) {
1502 + if (isset($value) && function_exists('get_user_by') && WPRProtectUtils_V676::havePluginsLoaded()) {
1165 1503 return get_user_by($attribute, $value);
1166 1504 }
1167 1505 }
1168 1506
@@ -1264,9 +1602,9 @@
1264 1602 xlsx|psd|mp3|m4a|ogg|wav|mp4|m4v|mov|wmv|avi|mpg|ogv|3gp|3g2|php|html|phtml|js|css)/ix', $value)) {
1265 1603 $profiled_data[$key]["file"] = true;
1266 1604 }
1267 1605
1268 - if ($this->matchCount(WPRProtectFWRule_V542::SQLIREGEX, $value) > 2) {
1606 + if ($this->matchCount(WPRProtectFWRule_V676::SQLIREGEX, $value) > 2) {
1269 1607 $profiled_data[$key]["sql"] = true;
1270 1608 }
1271 1609
1272 1610 if (WPRHelper::safePregMatch('/(?:\.{2}[\/]+)/', $value)) {
@@ -1285,17 +1623,27 @@
1285 1623
1286 1624 private function profileRequest() {
1287 1625 if (!$this->is_request_profiled && !$this->isRequestProfilingDisabled()) {
1288 1626 $profiled_data = array();
1627 + $log_raw_body = true;
1289 1628
1290 1629 $is_debug_mode = $this->isRequestProfilingModeDebug();
1291 - $cookies = $is_debug_mode ? $this->request->getCookies() : $this->getBVCookies();
1292 - $cookies = $this->getCookiesToLog($cookies);
1293 1630
1631 + $content_type = $this->request->getContentType();
1632 + if (is_string($content_type)) {
1633 + $profiled_data += array("CONTENT_TYPE" => $this->getSlicedValueToLog($content_type));
1634 + }
1635 +
1636 + $content_length = $this->request->getContentLength();
1637 + if (is_string($content_length)) {
1638 + $profiled_data += array("CONTENT_LENGTH" => $this->getSlicedValueToLog($content_length));
1639 + }
1640 +
1294 1641 $action = $this->request->getAction();
1295 1642 if (isset($action)) {
1296 1643 $profiled_data += $this->profileRequestData(array("action" => $action), true, 'ACTION[');
1297 1644 }
1645 +
1298 1646 if (isset($this->request->wp_user)) {
1299 1647 $wp_user_info = array(
1300 1648 'id' => $this->request->wp_user->id
1301 1649 );
@@ -1300,13 +1648,36 @@
1300 1648 'id' => $this->request->wp_user->id
1301 1649 );
1302 1650 $profiled_data += $this->profileRequestData($wp_user_info, true, 'WP_USER[');
1303 1651 }
1304 - $profiled_data += $this->profileRequestData($this->request->getPostParams(), $is_debug_mode, 'BODY[');
1652 +
1305 1653 $profiled_data += $this->profileRequestData($this->request->getGetParams(), true, 'GET[');
1306 1654 $profiled_data += $this->profileRequestData($this->request->getFiles(), true, 'FILES[');
1655 +
1656 + $cookies = $is_debug_mode ? $this->request->getCookies() : $this->getBVCookies();
1307 1657 $profiled_data += $this->profileRequestData($cookies, true, 'COOKIES[');
1308 1658
1659 + if (!empty($this->request->getPostParams())) {
1660 + $profiled_data += $this->profileRequestData($this->request->getPostParams(), $is_debug_mode, 'BODY[');
1661 + $log_raw_body = false;
1662 + }
1663 +
1664 + $json_params = $this->request->getJsonParams();
1665 + if (!empty($json_params) && !empty($json_params['JSON'])) {
1666 + $profiled_data += $this->profileRequestData($json_params, $is_debug_mode, 'JSON[');
1667 + $log_raw_body = false;
1668 + }
1669 +
1670 + if ($this->can_log_raw_body && $is_debug_mode && $log_raw_body && !empty($this->request->getRawBody())) {
1671 + $profiled_data += array("RAW_BODY" => $this->getRawBodyToLog($this->request->getRawBody()));
1672 + }
1673 +
1674 + $body_parser_status = $this->request->getBodyParserStatus();
1675 + $profiled_data = array(
1676 + "BODY_RAW_STATUS" => $body_parser_status['raw_body_status'],
1677 + "JSON_PARAMS_STATUS" => $body_parser_status['json_params_status']
1678 + ) + $profiled_data;
1679 +
1309 1680 $this->request_profiled_data = $profiled_data;
1310 1681 $this->is_request_profiled = true;
1311 1682 }
1312 1683 }
@@ -1311,20 +1682,24 @@
1311 1682 }
1312 1683 }
1313 1684
1314 1685 private function isRequestIPWhitelisted() {
1315 - return $this->ipstore->isFWIPWhitelisted($this->request->ip);
1686 + if (!isset($this->is_ip_whitelisted)) {
1687 + $this->is_ip_whitelisted = $this->ipstore->isFWIPWhitelisted($this->request->ip);
1688 + }
1689 +
1690 + return $this->is_ip_whitelisted;
1316 1691 }
1317 1692
1318 1693 private function canRequestBypassFirewall() {
1319 1694 if ($this->isRequestIPWhitelisted() || $this->isRequestHasValidBypassCookie()) {
1320 - $this->request->category = WPRProtectRequest_V542::CATEGORY_WHITELISTED;
1321 - $this->request->status = WPRProtectRequest_V542::STATUS_BYPASSED;
1695 + $this->request->category = WPRProtectRequest_V676::CATEGORY_WHITELISTED;
1696 + $this->request->status = WPRProtectRequest_V676::STATUS_BYPASSED;
1322 1697
1323 1698 return true;
1324 - } elseif (WPRProtectUtils_V542::isPrivateIP($this->request->ip)) {
1325 - $this->request->category = WPRProtectRequest_V542::CATEGORY_PRIVATEIP;
1326 - $this->request->status = WPRProtectRequest_V542::STATUS_BYPASSED;
1699 + } elseif (WPRProtectUtils_V676::isPrivateIP($this->request->ip)) {
1700 + $this->request->category = WPRProtectRequest_V676::CATEGORY_PRIVATEIP;
1701 + $this->request->status = WPRProtectRequest_V676::STATUS_BYPASSED;
1327 1702
1328 1703 return true;
1329 1704 }
1330 1705
@@ -1346,19 +1721,22 @@
1346 1721 }
1347 1722 }
1348 1723
1349 1724 private function handleRequestOnRuleMatch($rules, $engine_vars = array(), $log_data = array()) {
1725 + $normalized_engine_vars = WPRProtectFWRuleEngine_V676::normalizeVariables($engine_vars);
1726 +
1350 1727 foreach ($rules as $rule) {
1351 1728 if ($this->break_rule_matching) {
1352 1729 break;
1353 1730 }
1354 1731
1355 - $_engine_vars = $engine_vars;
1732 + $_engine_vars = $normalized_engine_vars;
1356 1733 if (array_key_exists('variables', $rule->opts)) {
1357 - $_engine_vars = array_merge($_engine_vars, $rule->opts['variables']);
1734 + $_engine_vars = array_merge($_engine_vars,
1735 + WPRProtectFWRuleEngine_V676::normalizeVariables($rule->opts['variables']));
1358 1736 }
1359 1737
1360 - $rule_engine = new WPRProtectFWRuleEngine_V542($this->request, $_engine_vars);
1738 + $rule_engine = new WPRProtectFWRuleEngine_V676($this->request, $_engine_vars);
1361 1739
1362 1740 if ($rule_engine->evaluate($rule) && !$rule_engine->hasError()) {
1363 1741 if (!empty($log_data)) {
1364 1742 $this->updateRuleLog("info", (string) $rule->id, $log_data);
@@ -1369,13 +1747,13 @@
1369 1747 foreach($rule->actions as $action) {
1370 1748 switch ($action["type"]) {
1371 1749 case "ALLOW":
1372 1750 $this->break_rule_matching = true;
1373 - $this->request->category = WPRProtectRequest_V542::CATEGORY_RULE_ALLOWED;
1751 + $this->request->category = WPRProtectRequest_V676::CATEGORY_RULE_ALLOWED;
1374 1752 return;
1375 1753 case "BLOCK":
1376 1754 if ($this->isModeProtect()) {
1377 - $this->terminateRequest(WPRProtectRequest_V542::CATEGORY_RULE_BLOCKED);
1755 + $this->terminateRequest(WPRProtectRequest_V676::CATEGORY_RULE_BLOCKED);
1378 1756 }
1379 1757 return;
1380 1758 case "INSPECT":
1381 1759 $this->inspectRequest();
@@ -1389,15 +1767,15 @@
1389 1767 }
1390 1768
1391 1769 private function terminateRequest($category) {
1392 1770 $this->request->category = $category;
1393 - $this->request->status = WPRProtectRequest_V542::STATUS_BLOCKED;
1771 + $this->request->status = WPRProtectRequest_V676::STATUS_BLOCKED;
1394 1772 $this->request->setRespCode(403);
1395 1773
1396 1774 if ($this->can_set_cache_prevention_cookie &&
1397 - !$this->request->getCookies(WPRProtectFW_V542::PREVENT_CACHE_COOKIE_NAME)) {
1775 + !$this->request->getCookies(WPRProtectFW_V676::PREVENT_CACHE_COOKIE_NAME)) {
1398 1776 $value = "Prevent Caching Response.";
1399 - $this->setCookie(WPRProtectFW_V542::PREVENT_CACHE_COOKIE_NAME, $value, time() + 43200);
1777 + $this->setCookie(WPRProtectFW_V676::PREVENT_CACHE_COOKIE_NAME, $value, time() + 43200);
1400 1778 }
1401 1779
1402 1780 header("Cache-Control: no-cache, no-store, must-revalidate");
1403 1781 header("Pragma: no-cache");
@@ -1402,8 +1780,9 @@
1402 1780 header("Cache-Control: no-cache, no-store, must-revalidate");
1403 1781 header("Pragma: no-cache");
1404 1782 header("Expires: 0");
1405 1783 header('HTTP/1.0 403 Forbidden');
1784 + // phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped
1406 1785 die("
1407 1786 <div style='height: 98vh;'>
1408 1787 <div style='text-align: center; padding: 10% 0; font-family: Arial, Helvetica, sans-serif;'>
1409 1788 <div><p>" . $this->brand_name . " Firewall</p></div>
@@ -1411,8 +1790,9 @@
1411 1790 <p>Reference ID: " . $this->request->getRequestID() . "</p>
1412 1791 </div>
1413 1792 </div>
1414 1793 ");
1794 + // phpcs:enable WordPress.Security.EscapeOutput.OutputNotEscaped
1415 1795 }
1416 1796
1417 1797 public function setBypassCookie() {
1418 1798 if (function_exists('is_user_logged_in') && is_user_logged_in() &&
@@ -1421,11 +1801,11 @@
1421 1801 $role_level = $this->getCurrentWPUserRoleLevel();
1422 1802 if ($role_level >= $this->bypass_level) {
1423 1803 $cookie = $this->generateBypassCookie();
1424 1804 if ($cookie) {
1425 - $this->setCookie(WPRProtectFW_V542::BYPASS_COOKIE_NAME, $cookie, time() + 43200);
1805 + $this->setCookie(WPRProtectFW_V676::BYPASS_COOKIE_NAME, $cookie);
1426 1806 }
1427 1807 }
1428 1808 }
1429 1809 }
1430 1810 }
1431 -endif;
1811 +endif;