| @@ -1,160 +1,210 @@ | ||
| 1 | -<?php | |
| 2 | -/** | |
| 3 | - * Plugin Name: WebTotem Security | |
| 4 | - * Description: The <a href="https://wtotem.com/" target="_blank">WebTotem</a> Security plugin monitors websites and prevents website attacks with the help of special internal and external utilities. | |
| 5 | - * Author URI: https://wtotem.com/ | |
| 6 | - * Author: WebTotem Team | |
| 7 | - * Text Domain: wtotem | |
| 8 | - * Domain Path: /lang | |
| 9 | - * Version: 3.0.0 | |
| 10 | - * License: GPL v2 or later | |
| 11 | - * License URI: http://www.gnu.org/licenses/gpl-2.0.txt | |
| 12 | - * PHP version 7.1 | |
| 13 | - * | |
| 14 | - * @copyright 2021 WebTotem | |
| 15 | - * @license GPL-2.0-or-later | |
| 16 | - * @link https://wordpress.org/plugins/wt-security | |
| 17 | - */ | |
| 18 | - | |
| 19 | -/** | |
| 20 | - * Main file to control the plugin. | |
| 21 | - */ | |
| 22 | -define('WEBTOTEM_INIT', true); | |
| 23 | - | |
| 24 | -/** | |
| 25 | - * Plugin dependencies. | |
| 26 | - * | |
| 27 | - * list of required WordPress functions for the plugin to work. | |
| 28 | - */ | |
| 29 | -$wtotem_dependencies = array( | |
| 30 | - 'wp', | |
| 31 | - 'wp_die', | |
| 32 | - 'add_action', | |
| 33 | - 'remove_action', | |
| 34 | - 'wp_remote_get', | |
| 35 | - 'wp_remote_post', | |
| 36 | -); | |
| 37 | - | |
| 38 | -// Stopping execution if dependencies are not met. | |
| 39 | -foreach ($wtotem_dependencies as $dependency) { | |
| 40 | - if (!function_exists($dependency)) { | |
| 41 | - // Report invalid access. | |
| 42 | - header('HTTP/1.1 403 Forbidden'); | |
| 43 | - die("Protected By WebTotem!"); | |
| 44 | - } | |
| 45 | -} | |
| 46 | - | |
| 47 | -// Stopping execution if the ABSPATH constant is not available | |
| 48 | -if (!defined('ABSPATH')) { | |
| 49 | - // Report invalid access. | |
| 50 | - header('HTTP/1.1 403 Forbidden'); | |
| 51 | - die("Protected By WebTotem!"); | |
| 52 | -} | |
| 53 | - | |
| 54 | -/** | |
| 55 | - * Current version of the plugin's code. | |
| 56 | - */ | |
| 57 | -define('WEBTOTEM_VERSION', '3.0.0'); | |
| 58 | - | |
| 59 | -/** | |
| 60 | - * The name of the folder where the plugin's files will be located. | |
| 61 | - */ | |
| 62 | -define("WEBTOTEM_PLUGIN_FOLDER", basename(dirname(__FILE__))); | |
| 63 | - | |
| 64 | -/** | |
| 65 | - * The fullpath where the plugin's files will be located. | |
| 66 | - */ | |
| 67 | -define('WEBTOTEM_PLUGIN_PATH', WP_PLUGIN_DIR . '/' . WEBTOTEM_PLUGIN_FOLDER); | |
| 68 | - | |
| 69 | -/** | |
| 70 | - * The local URL where the plugin's files and assets are served. | |
| 71 | - */ | |
| 72 | -define('WEBTOTEM_URL', rtrim(plugin_dir_url(__FILE__), '/')); | |
| 73 | - | |
| 74 | -/** | |
| 75 | - * The domain name of the current site, without protocol and www. | |
| 76 | - */ | |
| 77 | -define("WEBTOTEM_SITE_DOMAIN", str_replace(['http://', 'https://', '//', '://', 'www.'], '', get_site_url())); | |
| 78 | - | |
| 79 | -/** | |
| 80 | - * Unique name of the plugin through out all the code. | |
| 81 | - */ | |
| 82 | -define("WEBTOTEM", 'wtotem'); | |
| 83 | - | |
| 84 | -/* Load plugin translations */ | |
| 85 | -function wtotem_load_plugin_textdomain() { | |
| 86 | - load_plugin_textdomain('wtotem', false, basename(dirname(__FILE__)) . '/lang/'); | |
| 87 | -} | |
| 88 | -add_action('plugins_loaded', 'wtotem_load_plugin_textdomain'); | |
| 89 | - | |
| 90 | - | |
| 91 | -/* Load all classes before anything else. */ | |
| 92 | -require_once 'lib/Helper.php'; | |
| 93 | -require_once 'lib/API.php'; | |
| 94 | -require_once 'lib/DB.php'; | |
| 95 | -require_once 'lib/Cache.php'; | |
| 96 | -require_once 'lib/modules/login/Login.php'; | |
| 97 | -require_once 'lib/modules/logs/EventListener.php'; | |
| 98 | -require_once 'lib/modules/logs/Scan.php'; | |
| 99 | -require_once 'lib/modules/logs/Crawler.php'; | |
| 100 | -require_once 'lib/Request.php'; | |
| 101 | -require_once 'lib/Interface.php'; | |
| 102 | -require_once 'lib/AgentManager.php'; | |
| 103 | -require_once 'lib/Option.php'; | |
| 104 | -require_once 'lib/Template.php'; | |
| 105 | -require_once 'lib/Country.php'; | |
| 106 | -require_once 'lib/Ajax.php'; | |
| 107 | - | |
| 108 | -/* Load page and ajax handlers */ | |
| 109 | -require_once 'src/PageHandler.php'; | |
| 110 | - | |
| 111 | -/* Load common variables and triggers */ | |
| 112 | -require_once 'src/Common.php'; | |
| 113 | - | |
| 114 | -/** | |
| 115 | - * Uninstalled the plugin | |
| 116 | - * | |
| 117 | - * @return void | |
| 118 | - */ | |
| 119 | -function wtotemUninstall() { | |
| 120 | - | |
| 121 | - if (WebTotemOption::getPluginSettings('hide_wp_version')) { | |
| 122 | - WebTotemOption::restoreReadme(); | |
| 123 | - } | |
| 124 | - | |
| 125 | - if(WebTotem::isMultiSite()){ | |
| 126 | - WebTotemOption::clearAllHosts(); | |
| 127 | - } | |
| 128 | - | |
| 129 | - /* Delete settings from the database */ | |
| 130 | - WebTotemDB::uninstall(); | |
| 131 | - | |
| 132 | -} | |
| 133 | - | |
| 134 | -register_uninstall_hook(__FILE__, 'wtotemUninstall'); | |
| 135 | - | |
| 136 | -/** | |
| 137 | - * Deactivation plugin | |
| 138 | - * | |
| 139 | - * @return void | |
| 140 | - */ | |
| 141 | -function wtotemDeactivation() { | |
| 142 | - if (WebTotemOption::getPluginSettings('hide_wp_version')) { | |
| 143 | - WebTotemOption::restoreReadme(); | |
| 144 | - } | |
| 145 | -} | |
| 146 | -register_deactivation_hook( __FILE__, 'wtotemDeactivation' ); | |
| 147 | - | |
| 148 | -/** | |
| 149 | - * Deactivation plugin | |
| 150 | - * | |
| 151 | - * @return void | |
| 152 | - */ | |
| 153 | -function wtotemActivation() { | |
| 154 | - WebTotemDB::install(); | |
| 155 | - if (WebTotemOption::getPluginSettings('hide_wp_version')) { | |
| 156 | - WebTotemOption::hideReadme(); | |
| 157 | - } | |
| 158 | -} | |
| 159 | - | |
| 160 | -register_activation_hook( __FILE__, 'wtotemActivation' ); | |
| 1 | +<?php defined('ABSPATH') or die("Protected By WT!"); | |
| 2 | + | |
| 3 | +/* | |
| 4 | +Plugin Name: WT Security | |
| 5 | +Description: WT is a SaaS which provides powerful tools for securing and monitoring your website in one place in easy and flexible way. | |
| 6 | +Author: WT Security | |
| 7 | +Version: 2.3.14 | |
| 8 | +*/ | |
| 9 | + | |
| 10 | +define("WTSEC_PAGE_TITLE", 'Dashboard'); | |
| 11 | +define("WTSEC_MENU_TITLE", 'WT Security'); | |
| 12 | +define("WTSEC_PLUGIN_PATH", plugin_dir_path(__FILE__)); | |
| 13 | +define("WTSEC_PLUGIN_NAME", 'wt-security'); | |
| 14 | +define("WTSEC_PLUGIN_PREFIX", 'wtsec_'); | |
| 15 | +define("WTSEC_PAGE_PREFIX", WTSEC_PLUGIN_NAME . '-'); | |
| 16 | +define("WTSEC_FILE_URL", "https://api.wtotem.com/agent"); | |
| 17 | +define("WTSEC_ROOT", WP_PLUGIN_DIR . '/'); | |
| 18 | +define("WTSEC_MODULES_DIR", WTSEC_PLUGIN_PATH . 'uploads/'); | |
| 19 | +if (is_dir(WTSEC_MODULES_DIR) && is_writable(WTSEC_MODULES_DIR)) { | |
| 20 | + define("WTSEC_INSTALLATION_DIR", WTSEC_MODULES_DIR); | |
| 21 | + define("WTOTEMSEC_INSTALLATION_DIR", WTSEC_MODULES_DIR); | |
| 22 | +} else { | |
| 23 | + define("WTSEC_INSTALLATION_DIR", wp_upload_dir()['basedir'] . '/'); | |
| 24 | + define("WTOTEMSEC_INSTALLATION_DIR", wp_upload_dir()['basedir'] . '/'); | |
| 25 | +} | |
| 26 | +define("WTSEC_PLUGIN_URL", plugins_url("", __FILE__)); | |
| 27 | +define("WTSEC_SITE_URL", str_replace(['http://', 'https://', 'www.', '//', '://'], '', get_site_url())); | |
| 28 | + | |
| 29 | +define("WTSEC_PLUGIN_INFORMATION_VERSION", "2.3"); | |
| 30 | + | |
| 31 | +$curLang = substr(get_bloginfo('language'), 0,2); | |
| 32 | +$language = (in_array($curLang,['ru','en','pl'])) ? $curLang : 'en' ; | |
| 33 | +define("WTSEC_LANGUAGE", $language); | |
| 34 | + | |
| 35 | + | |
| 36 | +add_action( 'deactivated_plugin', 'wtsec_DeactivatedPlugin', 1 ); | |
| 37 | + | |
| 38 | +function wtsec_DeactivatedPlugin(){ | |
| 39 | + define("WTSEC_DEACTIVATED", true); | |
| 40 | + require_once WTSEC_PLUGIN_PATH . 'library/App.php'; | |
| 41 | + $app = new WTSEC_LIBRARY_App; | |
| 42 | + wtsec_DeleteAm(); | |
| 43 | + | |
| 44 | + $app::_set('am_installed', false); | |
| 45 | + $app::logout(); | |
| 46 | +} | |
| 47 | + | |
| 48 | +add_action('admin_init', 'wtsec_admin_init'); | |
| 49 | +add_action('wp_loaded', 'wtsec_init'); | |
| 50 | + | |
| 51 | +add_action( 'authenticate', 'wtsec_login_check' ); | |
| 52 | + | |
| 53 | +function wtsec_init() | |
| 54 | +{ | |
| 55 | + require_once WTSEC_PLUGIN_PATH . 'library/App.php'; | |
| 56 | + require_once WTSEC_PLUGIN_PATH . 'library/Request.php'; | |
| 57 | + | |
| 58 | + // WAF include (Если не админка и статус waf = "start", "uninstalled") | |
| 59 | + // && in_array(WTSEC_LIBRARY_App::getOption('waf_status'), ["start", "uninstalled"]) | |
| 60 | + if (!is_admin()) { | |
| 61 | + if ($waf = WTSEC_LIBRARY_App::getOption(("waf_installed_file"))) { | |
| 62 | + $path_to_waf = $_SERVER['DOCUMENT_ROOT'] . '/_include_' . $waf; | |
| 63 | + if (is_file($path_to_waf) && is_readable($path_to_waf)) { | |
| 64 | + include_once $path_to_waf; | |
| 65 | + } | |
| 66 | + } | |
| 67 | + } | |
| 68 | + | |
| 69 | + if (is_admin()) { | |
| 70 | + require_once WTSEC_PLUGIN_PATH . 'library/WT.php'; | |
| 71 | + require_once WTSEC_PLUGIN_PATH . 'library/Localization.php'; | |
| 72 | + require_once WTSEC_PLUGIN_PATH . 'library/Idn.php'; | |
| 73 | + require_once WTSEC_PLUGIN_PATH . 'library/Session.php'; | |
| 74 | + require_once WTSEC_PLUGIN_PATH . 'routes.php'; | |
| 75 | + require_once WTSEC_PLUGIN_PATH . 'services.php'; | |
| 76 | + require_once WTSEC_PLUGIN_PATH . 'helpers.php'; | |
| 77 | + | |
| 78 | + function wtsec_request() | |
| 79 | + { | |
| 80 | + return new WTSEC_LIBRARY_Request(); | |
| 81 | + } | |
| 82 | + function wtsec_app() | |
| 83 | + { | |
| 84 | + return new WTSEC_LIBRARY_App(); | |
| 85 | + } | |
| 86 | + function wtsec_filesystem_init($form_url, $method, $context, $fields = null) | |
| 87 | + { | |
| 88 | + global $wp_filesystem; | |
| 89 | + if (!$creds = request_filesystem_credentials($form_url, $method, false, $context, $fields)) { | |
| 90 | + return false; | |
| 91 | + } | |
| 92 | + if (!WP_Filesystem($creds)) { | |
| 93 | + request_filesystem_credentials($form_url, $method, true, $context); | |
| 94 | + return false; | |
| 95 | + } | |
| 96 | + return true; | |
| 97 | + } | |
| 98 | + function wtsec_locale($lmsg, $args = []) | |
| 99 | + { | |
| 100 | + return WTSEC_LIBRARY_Localization::lmsg($lmsg, $args); | |
| 101 | + } | |
| 102 | + function wtsec_getImagePath($image) | |
| 103 | + { | |
| 104 | + return plugins_url('/htdocs/img/' . $image, __FILE__); | |
| 105 | + } | |
| 106 | + function wtsec_SIS($arr, $key, $form = null) | |
| 107 | + { | |
| 108 | + $key = explode(".", $key); | |
| 109 | + foreach ($key as $_key) { | |
| 110 | + if (!isset($arr[$_key])) { | |
| 111 | + $arr = ""; | |
| 112 | + break; | |
| 113 | + } | |
| 114 | + $arr = $arr[$_key]; | |
| 115 | + } | |
| 116 | + return !empty($form) ? str_replace("$" . $key, $arr, $form) : $arr; | |
| 117 | + } | |
| 118 | + } | |
| 119 | +} | |
| 120 | + | |
| 121 | +function wtsec_admin_init() | |
| 122 | +{ | |
| 123 | + $rand = '?rand='.rand(); | |
| 124 | + if (is_admin() && stripos(wtsec_request()->page, WTSEC_PLUGIN_NAME) !== false) { | |
| 125 | + wp_enqueue_script('subscriber', plugins_url('/htdocs/js/wtsec_subscriber.js'.$rand, __FILE__), [], false, true); | |
| 126 | + wp_enqueue_script('d3-v4', plugins_url('/htdocs/js/wtsec_d3.v4.js', __FILE__), array( 'jquery' ), false, true); | |
| 127 | + wp_enqueue_script('jsdelivr', plugins_url('/htdocs/js/wtsec_jsdelivr_chart.js', __FILE__), array( 'jquery' ), false, true); | |
| 128 | + wp_enqueue_script('chart', plugins_url('/htdocs/js/wtsec_Chart.js'.$rand, __FILE__), [], false, true); | |
| 129 | + wp_enqueue_script('circle-progress', plugins_url('/htdocs/js/wtsec_circle-progress.js', __FILE__), [], false, true); | |
| 130 | + wp_enqueue_script('range-plugin', plugins_url('/htdocs/js/wtsec_rangePlugin.js', __FILE__), array( 'jquery' ), false, true); | |
| 131 | + wp_enqueue_script('flatpickr', plugins_url('/htdocs/js/wtsec_flatpickr.js', __FILE__), array( 'jquery' ), false, true); | |
| 132 | + wp_enqueue_script('filter-calendar', plugins_url('/htdocs/js/wtsec_filterCalendar.js', __FILE__), array( 'jquery' ), false, true); | |
| 133 | + wp_enqueue_script('line-progress', plugins_url('/htdocs/js/wtsec_line-progress.js', __FILE__), [], false, true); | |
| 134 | + wp_enqueue_script('main', plugins_url('/htdocs/js/wtsec_main.js'.$rand, __FILE__), [], false, true); | |
| 135 | + wp_enqueue_script('ajax', plugins_url( '/htdocs/js/wtsec_ajax.js'.$rand, __FILE__ ), array( 'jquery' ),false, true ); | |
| 136 | + wp_enqueue_script('subscriber'); | |
| 137 | + wp_enqueue_script('print'); | |
| 138 | + wp_enqueue_script('d3-v4'); | |
| 139 | + wp_enqueue_script('jsdelivr'); | |
| 140 | + wp_enqueue_script('chart'); | |
| 141 | + wp_enqueue_script('circle-progress'); | |
| 142 | + wp_enqueue_script('line-progress'); | |
| 143 | + wp_enqueue_script('range-plugin'); | |
| 144 | + wp_enqueue_script('flatpickr'); | |
| 145 | + wp_enqueue_script('filter-calendar'); | |
| 146 | + wp_enqueue_script('main'); | |
| 147 | + wp_enqueue_script('ajax'); | |
| 148 | + | |
| 149 | + wp_register_style('flatpickr-css', 'https://cdn.jsdelivr.net/npm/flatpickr/dist/flatpickr.min.css'); | |
| 150 | + wp_register_style('font', 'https://fonts.googleapis.com/css2?family=Inter:wght@400;500;700&display=swap'); | |
| 151 | + wp_register_style('main', plugins_url('/htdocs/css/wtsec_main.css'.$rand, __FILE__)); | |
| 152 | + wp_enqueue_style('flatpickr-css'); | |
| 153 | + wp_enqueue_style('font'); | |
| 154 | + wp_enqueue_style('print-css'); | |
| 155 | + wp_enqueue_style('main'); | |
| 156 | + | |
| 157 | + $page = wtsec_request()->page; | |
| 158 | + if ($page === wtsec_getRoute("login")) { | |
| 159 | + if (WTSEC_LIBRARY_App::authorized()) { | |
| 160 | + wp_safe_redirect(wtsec_getUrl('dashboard')); | |
| 161 | + } | |
| 162 | + } elseif ($page === wtsec_getRoute("logout")) { | |
| 163 | + WTSEC_LIBRARY_App::logout(); | |
| 164 | + if (!WTSEC_LIBRARY_App::authorized()) { | |
| 165 | + wp_safe_redirect(wtsec_getUrl('login')); | |
| 166 | + } | |
| 167 | + } elseif ($page === wtsec_getRoute("activate")) { | |
| 168 | + if (WTSEC_LIBRARY_App::authorized()) { | |
| 169 | + wp_safe_redirect(wtsec_getUrl('sites')); | |
| 170 | + } | |
| 171 | + } else { | |
| 172 | + if (!WTSEC_LIBRARY_App::authorized()) { | |
| 173 | + wp_safe_redirect(wtsec_getUrl('login')); | |
| 174 | + } | |
| 175 | + } | |
| 176 | + } | |
| 177 | +} | |
| 178 | + | |
| 179 | +function wtsec_login_check() { | |
| 180 | + require_once WTSEC_PLUGIN_PATH . 'library/App.php'; | |
| 181 | + require_once WTSEC_PLUGIN_PATH . 'library/Localization.php'; | |
| 182 | + $app = new WTSEC_LIBRARY_App; | |
| 183 | + | |
| 184 | + function wtsec_locale($lmsg, $args = []) | |
| 185 | + { | |
| 186 | + return WTSEC_LIBRARY_Localization::lmsg($lmsg, $args); | |
| 187 | + } | |
| 188 | + | |
| 189 | + $app->wtsec_login_check(); | |
| 190 | +} | |
| 191 | + | |
| 192 | + | |
| 193 | +add_action('init', 'wtsec_StartSession', 1); | |
| 194 | +add_action('wp_logout', 'wtsec_EndSession'); | |
| 195 | +add_action('wp_login', 'wtsec_EndSession'); | |
| 196 | + | |
| 197 | + | |
| 198 | +function wtsec_StartSession() { | |
| 199 | + if(!session_id()) { | |
| 200 | + session_start(); | |
| 201 | + } | |
| 202 | +} | |
| 203 | + | |
| 204 | +function wtsec_EndSession() { | |
| 205 | + require_once WTSEC_PLUGIN_PATH . 'library/App.php'; | |
| 206 | + session_destroy (); | |
| 207 | +} | |
| 208 | + | |
| 209 | + | |
| 210 | + | |
