wt-security / lib / Interface.php

Interface.php in WebTotem Security 2.4.14, at lib/Interface.php

339 lines 9.4 KB

Raw Download Zip

1	<?php
2
3	if (!defined('WEBTOTEM_INIT') \|\| WEBTOTEM_INIT !== true) {
4	if (!headers_sent()) {
5	header('HTTP/1.1 403 Forbidden');
6	}
7	die("Protected By WebTotem!");
8	}
9
10	/**
11	* Plugin initializer.
12	*
13	*/
14	class WebTotemInterface extends WebTotem {
15
16	/**
17	* Execute pre-checks before every page.
18	*
19	* @return void
20	*/
21	public static function startupChecks() {
22
23	if (WebTotemOption::getPluginSettings('hide_wp_version')) {
24	WebTotemOption::hideWPVersion();
25
26	add_filter('style_loader_src', 'WebTotemOption::replaceVersion');
27	add_filter('script_loader_src', 'WebTotemOption::replaceVersion');
28
29	}
30	$_page = WebTotemRequest::get('page');
31	if(strpos($_page, 'wtotem') === 0) {
32	$composer_autoload = WEBTOTEM_PLUGIN_PATH . '/vendor/autoload.php';
33	if ( file_exists( $composer_autoload ) ) {
34	require_once $composer_autoload;
35	}
36	}
37
38	$_page = WebTotemRequest::get('page');
39	if(strpos($_page, 'wtotem') === 0){
40
41	if(!WebTotemOption::isActivated()){
42	// Checking the old version of options.
43	WebTotemOption::checkOldOptions();
44	}
45
46	WebTotemOption::multisiteCheck();
47
48	if(!WebTotemOption::isActivated() and $_page !== 'wtotem_activation') {
49	// If the plugin is not activated by the API key, then redirect to the activation page.
50	wp_safe_redirect( WebTotem::adminURL('admin.php?page=wtotem_activation') );
51	exit;
52	}
53	elseif (WebTotemOption::isActivated() and ($_page === 'wtotem_activation' or $_page === 'wtotem')){
54	// If the plugin is activated by the API key, then redirect to the main page.
55	if(self::isMultiSite() and is_super_admin()){
56	// Main page is all sites page.
57	wp_safe_redirect( WebTotem::adminURL('admin.php?page=wtotem_all_sites') );
58	} else {
59	// Main page is dashboard page.
60	wp_safe_redirect( WebTotem::adminURL('admin.php?page=wtotem_dashboard') );
61	}
62	exit;
63	}
64	elseif(WebTotemOption::isActivated()) {
65	// Checking whether agents are installed, if they are not installed, then install.
66	self::checkAgents();
67	}
68	}
69
70	$sapi = @php_sapi_name();
71	if( ! current_user_can( 'publish_posts' ) and $sapi != "cli" ) {
72	if ($waf = WebTotemOption::getOption(("waf_installed_file"))) {
73	$include_waf_file = ABSPATH . '/_include_' . $waf;
74
75	if (is_file($include_waf_file) && is_readable($include_waf_file)) {
76	include_once $include_waf_file;
77	}
78	}
79	}
80	}
81
82	/**
83	* Checking whether agents are installed, if they are not installed, then install.
84	*/
85	private static function checkAgents(){
86
87	$api_key = WebTotemOption::getOption('api_key');
88
89	// Check if the plugin version has changed.
90	WebTotemAgentManager::checkVersion();
91
92	$host = WebTotemAPI::siteInfo();
93
94	if ($api_key && array_key_exists('id', $host)) {
95
96	// Install Agent Manager if it was not previously installed.
97	$am_installed = WebTotemAgentManager::checkInstalledService('am');
98	if (!$am_installed['file_status']) {
99
100	$am_was_installed = WebTotemAgentManager::amInstall();
101
102	if (!$am_was_installed) {
103	WebTotemOption::setOptions(['am_installed' => FALSE]);
104	}
105	}
106
107	}
108	}
109
110	/**
111	* When adding a new site, add it to the WebTotem platform.
112	*/
113	public static function addNewSite($new_site){
114	$domain = untrailingslashit($new_site->domain . $new_site->path);
115
116	WebTotemAPI::addMultiSiteNewSites([$domain]);
117	}
118
119	/**
120	* Verify the nonce of the previous page after a form submission.
121	*
122	* @return bool True if the nonce is valid, false otherwise.
123	*/
124	public static function checkNonce() {
125	if (!empty($_POST)) {
126	$name = 'wtotem_page_nonce';
127	$value = WebTotemRequest::post($name);
128
129	if (!$value \|\| !wp_verify_nonce($value, $name)) {
130	WebTotemOption::setNotification('error', __('The WordPress CSRF check failed. The submitted form is missing an important unique code. Go back and try again.', 'wtotem'));
131	return false;
132	}
133	}
134
135	return true;
136	}
137
138
139	/**
140	* Authentication.
141	*
142	* @return mixed
143	*/
144	public static function wt_authenticate($user, $username = null, $password = null) {
145
146	if(WebTotemCaptcha::isEnabled()) {
147	if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
148	return $user;
149	}
150	$token = WebTotemCaptcha::get_token();
151	$score = WebTotemCaptcha::score($token, WebTotemOption::getPluginSettings('recaptcha_v3_secret'));
152
153	if($score < 0.5) {
154	return new WP_Error('authentication_failed', __('<strong>ERROR</strong> : Please check the ReCaptcha box or try to reload page.','wtotem'));
155	}
156	}
157
158	if(isset($_POST['wtotem-token']) && is_string($_POST['wtotem-token']) && !empty($_POST['wtotem-token'])){
159	if ( is_object( $user ) && ( $user instanceof \WP_User ) ) {
160	if ( WebTotemLogin::hasUser2faActivated( $user ) ) {
161	$check2faCode = WebTotemLogin::check2faCode( $user, $_POST['wtotem-token']);
162
163	if ( ! $check2faCode ) {
164	return new \WP_Error( 'wtotem_two_factor_failed', wp_kses( __( '<strong>CODE INVALID</strong>: The 2FA code provided is either expired or invalid. Please try again.', 'wtotem' ), array( 'strong' => array() ) ) );
165	}
166	}
167	}
168	}
169
170	return $user;
171	}
172
173	/**
174	* Authentication.
175	*
176	* @return mixed
177	*/
178	public static function wt_lost_password($errors = null, $user_data = null) {
179	return WebTotemBFProtection::lostPassword($errors);
180	}
181
182	/**
183	* Restore and then hide the readme file when updating the WordPress.
184	*
185	* @param string $string
186	* @return string
187	*/
188	public static function restoreReadmeWhenUpdating($string) {
189	static $didRun;
190	if (!isset($didRun)) {
191	$didRun = true;
192	WebTotemOption::restoreReadme();
193	register_shutdown_function('WebTotemOption::hideReadme');
194	}
195
196	return $string;
197	}
198
199	/**
200	* Login Page
201	*/
202	public static function loginEnqueueScripts() {
203
204	$recaptcha_enabled = WebTotemCaptcha::isEnabled();
205	if ($recaptcha_enabled) {
206	$recaptcha_site_key = WebTotemOption::getPluginSettings('recaptcha_v3_site_key');
207	wp_enqueue_script('wtotem_recaptcha', 'https://www.google.com/recaptcha/api.js?render=' . $recaptcha_site_key);
208	}
209
210	wp_register_script(
211	'wtotem_login',
212	WEBTOTEM_URL . '/includes/js/login.js',
213	['jquery'],
214	WebTotem::fileVersion('includes/js/login.js'),
215	false
216	);
217	wp_enqueue_script('wtotem_login');
218
219	wp_register_style(
220	'wtotem_login',
221	WEBTOTEM_URL . '/includes/css/login.css',
222	[],
223	WebTotem::fileVersion('includes/css/login.css')
224	);
225	wp_enqueue_style('wtotem_login');
226
227	wp_localize_script('wtotem_login', 'wtotem_login_vars', [
228	'recaptcha_site_key' => WebTotemCaptcha::_siteKey(),
229	'recaptcha_is_enabled' => $recaptcha_enabled,
230	'ajaxurl' => admin_url('admin-ajax.php'),
231	]);
232
233	}
234
235
236	/**
237	* A safe way to add JavaScript and css files to a WordPress-managed page
238	*
239	* @return void
240	*/
241	public static function enqueueScripts() {
242
243	$_page = WebTotemRequest::get('page');
244	if(strpos($_page, 'wtotem') === 0){
245	// Adding CSS files.
246	wp_register_style(
247	'wtotem_flatpickr',
248	WEBTOTEM_URL . '/includes/css/flatpickr.min.css',
249	[],
250	WebTotem::fileVersion('includes/css/flatpickr.min.css')
251	);
252	wp_enqueue_style('wtotem_flatpickr');
253
254	wp_register_style(
255	'wtotem_main_css',
256	WEBTOTEM_URL . '/includes/css/main.css',
257	[],
258	WebTotem::fileVersion('includes/css/main.css')
259	);
260	wp_enqueue_style('wtotem_main_css');
261
262	// Adding JS files.
263	wp_register_script(
264	'wtotem_amplitude',
265	WEBTOTEM_URL . '/includes/js/amplitude.js',
266	[ 'jquery' ],
267	WebTotem::fileVersion('includes/js/amplitude.js'),
268	false
269	);
270	wp_enqueue_script('wtotem_amplitude');
271
272	wp_register_script(
273	'wtotem_d3',
274	WEBTOTEM_URL . '/includes/js/d3.v4.js',
275	['jquery'],
276	WebTotem::fileVersion('includes/js/d3.v4.js'),
277	true
278	);
279	wp_enqueue_script('wtotem_d3');
280
281	wp_register_script(
282	'wtotem_chart',
283	WEBTOTEM_URL . '/includes/js/chart.js',
284	['jquery', 'wtotem_d3', 'wtotem_jsdelivr'],
285	WebTotem::fileVersion('includes/js/chart.js'),
286	true
287	);
288	wp_enqueue_script('wtotem_chart');
289
290	wp_register_script(
291	'wtotem_flatpickr_js',
292	WEBTOTEM_URL . '/includes/js/flatpickr.js',
293	[ 'jquery', 'wp-i18n' ],
294	WebTotem::fileVersion('includes/js/flatpickr.js'),
295	true
296	);
297	wp_enqueue_script('wtotem_flatpickr_js');
298	wp_set_script_translations( 'wtotem_flatpickr_js', 'wtotem' );
299
300	wp_register_script(
301	'wtotem_jsdelivr',
302	WEBTOTEM_URL . '/includes/js/jsdelivr_chart.js',
303	[ 'jquery' ],
304	WebTotem::fileVersion('includes/js/jsdelivr_chart.js'),
305	true
306	);
307	wp_enqueue_script('wtotem_jsdelivr');
308
309	wp_register_script(
310	'wtotem_jquery_qrcode',
311	WEBTOTEM_URL . '/includes/js/jquery.qrcode.min.js',
312	[ 'jquery' ],
313	WebTotem::fileVersion('includes/js/jquery.qrcode.min.js'),
314	true
315	);
316	wp_enqueue_script('wtotem_jquery_qrcode');
317
318	wp_register_script(
319	'wtotem_progress_bar',
320	WEBTOTEM_URL . '/includes/js/progress_bar.js',
321	[],
322	WebTotem::fileVersion('includes/js/progress_bar.js'),
323	true
324	);
325	wp_enqueue_script('wtotem_progress_bar');
326
327	wp_register_script(
328	'wtotem_main',
329	WEBTOTEM_URL . '/includes/js/main.js',
330	['jquery'],
331	WebTotem::fileVersion('includes/js/main.js'),
332	true
333	);
334	wp_enqueue_script('wtotem_main');
335	}
336	}
337
338	}
339