wt-security / lib / Interface.php

Interface.php in WebTotem Security 2.4.12, at lib/Interface.php

330 lines 9.2 KB

Raw Download Zip

1	<?php
2
3	if (!defined('WEBTOTEM_INIT') \|\| WEBTOTEM_INIT !== true) {
4	if (!headers_sent()) {
5	header('HTTP/1.1 403 Forbidden');
6	}
7	die("Protected By WebTotem!");
8	}
9
10	/**
11	* Plugin initializer.
12	*
13	*/
14	class WebTotemInterface extends WebTotem {
15
16	/**
17	* Execute pre-checks before every page.
18	*
19	* @return void
20	*/
21	public static function startupChecks() {
22
23	if (WebTotemOption::getPluginSettings('hide_wp_version')) {
24	WebTotemOption::hideWPVersion();
25
26	add_filter('style_loader_src', 'WebTotemOption::replaceVersion');
27	add_filter('script_loader_src', 'WebTotemOption::replaceVersion');
28
29	}
30	$_page = WebTotemRequest::get('page');
31	if(strpos($_page, 'wtotem') === 0) {
32	$composer_autoload = WEBTOTEM_PLUGIN_PATH . '/vendor/autoload.php';
33	if ( file_exists( $composer_autoload ) ) {
34	require_once $composer_autoload;
35	}
36	}
37
38	$_page = WebTotemRequest::get('page');
39	if(strpos($_page, 'wtotem') === 0){
40
41	if(!WebTotemOption::isActivated()){
42	// Checking the old version of options.
43	WebTotemOption::checkOldOptions();
44	}
45
46	WebTotemOption::multisiteCheck();
47
48	if(!WebTotemOption::isActivated() and $_page !== 'wtotem_activation') {
49	// If the plugin is not activated by the API key, then redirect to the activation page.
50	wp_safe_redirect( WebTotem::adminURL('admin.php?page=wtotem_activation') );
51	exit;
52	}
53	elseif (WebTotemOption::isActivated() and ($_page === 'wtotem_activation' or $_page === 'wtotem')){
54	// If the plugin is activated by the API key, then redirect to the main page.
55	if(self::isMultiSite() and is_super_admin()){
56	// Main page is all sites page.
57	wp_safe_redirect( WebTotem::adminURL('admin.php?page=wtotem_all_sites') );
58	} else {
59	// Main page is dashboard page.
60	wp_safe_redirect( WebTotem::adminURL('admin.php?page=wtotem_dashboard') );
61	}
62	exit;
63	}
64	elseif(WebTotemOption::isActivated()) {
65	// Checking whether agents are installed, if they are not installed, then install.
66	self::checkAgents();
67	}
68	}
69
70	$sapi = @php_sapi_name();
71	if( ! current_user_can( 'publish_posts' ) and $sapi != "cli" ) {
72	if ($waf = WebTotemOption::getOption(("waf_installed_file"))) {
73	$include_waf_file = ABSPATH . '/_include_' . $waf;
74
75	if (is_file($include_waf_file) && is_readable($include_waf_file)) {
76	include_once $include_waf_file;
77	}
78	}
79	}
80	}
81
82	/**
83	* Checking whether agents are installed, if they are not installed, then install.
84	*/
85	private static function checkAgents(){
86
87	$api_key = WebTotemOption::getOption('api_key');
88
89	// Check if the plugin version has changed.
90	WebTotemAgentManager::checkVersion();
91
92	$host = WebTotemAPI::siteInfo();
93
94	if ($api_key && array_key_exists('id', $host)) {
95
96	// Install Agent Manager if it was not previously installed.
97	$am_installed = WebTotemAgentManager::checkInstalledService('am');
98	if (!$am_installed['file_status']) {
99
100	$am_was_installed = WebTotemAgentManager::amInstall();
101
102	if (!$am_was_installed) {
103	WebTotemOption::setOptions(['am_installed' => FALSE]);
104	}
105	}
106
107	}
108	}
109
110	/**
111	* When adding a new site, add it to the WebTotem platform.
112	*/
113	public static function addNewSite($new_site){
114	$domain = untrailingslashit($new_site->domain . $new_site->path);
115
116	WebTotemAPI::addMultiSiteNewSites([$domain]);
117	}
118
119	/**
120	* Verify the nonce of the previous page after a form submission.
121	*
122	* @return bool True if the nonce is valid, false otherwise.
123	*/
124	public static function checkNonce() {
125	if (!empty($_POST)) {
126	$name = 'wtotem_page_nonce';
127	$value = WebTotemRequest::post($name);
128
129	if (!$value \|\| !wp_verify_nonce($value, $name)) {
130	WebTotemOption::setNotification('error', __('The WordPress CSRF check failed. The submitted form is missing an important unique code. Go back and try again.', 'wtotem'));
131	return false;
132	}
133	}
134
135	return true;
136	}
137
138
139	/**
140	* Authentication.
141	*
142	* @return mixed
143	*/
144	public static function wt_authenticate($user, $username = null, $password = null) {
145
146	if(WebTotemCaptcha::isEnabled()) {
147	if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
148	return $user;
149	}
150	$token = WebTotemCaptcha::get_token();
151	$score = WebTotemCaptcha::score($token, WebTotemOption::getPluginSettings('recaptcha_v3_secret'));
152
153	if($score < 0.5) {
154	return new WP_Error('authentication_failed', __('<strong>ERROR</strong> : Please check the ReCaptcha box or try to reload page.','wtotem')) . ' score = ' .$score;
155	}
156	}
157
158	if(isset($_POST['wtotem-token']) && is_string($_POST['wtotem-token']) && !empty($_POST['wtotem-token'])){
159	if ( is_object( $user ) && ( $user instanceof \WP_User ) ) {
160	if ( WebTotemLogin::hasUser2faActivated( $user ) ) {
161	$check2faCode = WebTotemLogin::check2faCode( $user, $_POST['wtotem-token']);
162
163	if ( ! $check2faCode ) {
164	return new \WP_Error( 'wtotem_two_factor_failed', wp_kses( __( '<strong>CODE INVALID</strong>: The 2FA code provided is either expired or invalid. Please try again.', 'wtotem' ), array( 'strong' => array() ) ) );
165	}
166	}
167	}
168	}
169
170	return $user;
171	}
172
173	/**
174	* Restore and then hide the readme file when updating the WordPress.
175	*
176	* @param string $string
177	* @return string
178	*/
179	public static function restoreReadmeWhenUpdating($string) {
180	static $didRun;
181	if (!isset($didRun)) {
182	$didRun = true;
183	WebTotemOption::restoreReadme();
184	register_shutdown_function('WebTotemOption::hideReadme');
185	}
186
187	return $string;
188	}
189
190	/**
191	* Login Page
192	*/
193	public static function loginEnqueueScripts() {
194
195	$recaptcha_enabled = WebTotemCaptcha::isEnabled();
196	if ($recaptcha_enabled) {
197	$recaptcha_site_key = WebTotemOption::getPluginSettings('recaptcha_v3_site_key');
198	wp_enqueue_script('wtotem_recaptcha', 'https://www.google.com/recaptcha/api.js?render=' . $recaptcha_site_key);
199	}
200
201	wp_register_script(
202	'wtotem_login',
203	WEBTOTEM_URL . '/includes/js/login.js',
204	['jquery'],
205	WebTotem::fileVersion('includes/js/login.js'),
206	false
207	);
208	wp_enqueue_script('wtotem_login');
209
210	wp_register_style(
211	'wtotem_login',
212	WEBTOTEM_URL . '/includes/css/login.css',
213	[],
214	WebTotem::fileVersion('includes/css/login.css')
215	);
216	wp_enqueue_style('wtotem_login');
217
218	wp_localize_script('wtotem_login', 'wtotem_login_vars', [
219	'recaptcha_site_key' => WebTotemCaptcha::_siteKey(),
220	'recaptcha_is_enabled' => $recaptcha_enabled,
221	'ajaxurl' => admin_url('admin-ajax.php'),
222	]);
223
224	}
225
226
227	/**
228	* A safe way to add JavaScript and css files to a WordPress-managed page
229	*
230	* @return void
231	*/
232	public static function enqueueScripts() {
233
234	$_page = WebTotemRequest::get('page');
235	if(strpos($_page, 'wtotem') === 0){
236	// Adding CSS files.
237	wp_register_style(
238	'wtotem_flatpickr',
239	WEBTOTEM_URL . '/includes/css/flatpickr.min.css',
240	[],
241	WebTotem::fileVersion('includes/css/flatpickr.min.css')
242	);
243	wp_enqueue_style('wtotem_flatpickr');
244
245	wp_register_style(
246	'wtotem_main_css',
247	WEBTOTEM_URL . '/includes/css/main.css',
248	[],
249	WebTotem::fileVersion('includes/css/main.css')
250	);
251	wp_enqueue_style('wtotem_main_css');
252
253	// Adding JS files.
254	wp_register_script(
255	'wtotem_amplitude',
256	WEBTOTEM_URL . '/includes/js/amplitude.js',
257	[ 'jquery' ],
258	WebTotem::fileVersion('includes/js/amplitude.js'),
259	false
260	);
261	wp_enqueue_script('wtotem_amplitude');
262
263	wp_register_script(
264	'wtotem_d3',
265	WEBTOTEM_URL . '/includes/js/d3.v4.js',
266	['jquery'],
267	WebTotem::fileVersion('includes/js/d3.v4.js'),
268	true
269	);
270	wp_enqueue_script('wtotem_d3');
271
272	wp_register_script(
273	'wtotem_chart',
274	WEBTOTEM_URL . '/includes/js/chart.js',
275	['jquery', 'wtotem_d3', 'wtotem_jsdelivr'],
276	WebTotem::fileVersion('includes/js/chart.js'),
277	true
278	);
279	wp_enqueue_script('wtotem_chart');
280
281	wp_register_script(
282	'wtotem_flatpickr_js',
283	WEBTOTEM_URL . '/includes/js/flatpickr.js',
284	[ 'jquery', 'wp-i18n' ],
285	WebTotem::fileVersion('includes/js/flatpickr.js'),
286	true
287	);
288	wp_enqueue_script('wtotem_flatpickr_js');
289	wp_set_script_translations( 'wtotem_flatpickr_js', 'wtotem' );
290
291	wp_register_script(
292	'wtotem_jsdelivr',
293	WEBTOTEM_URL . '/includes/js/jsdelivr_chart.js',
294	[ 'jquery' ],
295	WebTotem::fileVersion('includes/js/jsdelivr_chart.js'),
296	true
297	);
298	wp_enqueue_script('wtotem_jsdelivr');
299
300	wp_register_script(
301	'wtotem_jquery_qrcode',
302	WEBTOTEM_URL . '/includes/js/jquery.qrcode.min.js',
303	[ 'jquery' ],
304	WebTotem::fileVersion('includes/js/jquery.qrcode.min.js'),
305	true
306	);
307	wp_enqueue_script('wtotem_jquery_qrcode');
308
309	wp_register_script(
310	'wtotem_progress_bar',
311	WEBTOTEM_URL . '/includes/js/progress_bar.js',
312	[],
313	WebTotem::fileVersion('includes/js/progress_bar.js'),
314	true
315	);
316	wp_enqueue_script('wtotem_progress_bar');
317
318	wp_register_script(
319	'wtotem_main',
320	WEBTOTEM_URL . '/includes/js/main.js',
321	['jquery'],
322	WebTotem::fileVersion('includes/js/main.js'),
323	true
324	);
325	wp_enqueue_script('wtotem_main');
326	}
327	}
328
329	}
330