wt-security / src / Common.php

Common.php in WebTotem Security trunk, at src/Common.php

274 lines 11.1 KB

Raw Download Zip

1	<?php
2
3	if (!defined('WEBTOTEM_INIT') \|\| WEBTOTEM_INIT !== true) {
4	if (!headers_sent()) {
5	header('HTTP/1.1 403 Forbidden');
6	}
7	die("Protected By WebTotem!");
8	}
9
10	add_action('upgrader_process_complete', 'wt_security_upgrade_complete', 10, 2);
11	function wt_security_upgrade_complete($upgrader, $options)
12	{
13	/**
14	* Creating a marker file after updating the plugin.
15	*/
16	if ($options['type'] === 'plugin' && $options['action'] === 'update' && $upgrader->result['destination_name'] == 'wt-security') {
17	WebTotemAgentManager::generateMarkerFile();
18	}
19
20	/**
21	* Check CVE list after install or update plugin.
22	*/
23	// if ($options['type'] === 'plugin' && ($options['action'] === 'update' \|\| $options['action'] === 'install')){
24	// WebTotem::updateCveDataByPluginName($upgrader->new_plugin_data);
25	// }
26	}
27
28	/**
29	* Remove CVE from list after plugin delete.
30	*/
31	//add_action( 'deleted_plugin', 'wt_security_deleted_plugin_action', 10, 2 );
32	//function wt_security_deleted_plugin_action( $plugin_file, $deleted ){
33	// if($deleted){
34	// $slug = str_replace('.php', '', basename($plugin_file));
35	// if($slug != 'wt-security'){
36	// WebTotemDB::deleteData(['slug' => $slug], 'plugins_cve_list');
37	// }
38	// }
39	//}
40
41	// WAF Include.
42	WebTotemAgentManager::wafInclude();
43
44	if (defined('WEBTOTEM')) {
45
46	/**
47	* Define which javascript and css files will be loaded in the header of the plugin pages.
48	*/
49	$_page = WebTotemRequest::get('page');
50	if (strpos($_page, 'wtotem') === 0) {
51	add_action('admin_enqueue_scripts', 'WebTotemInterface::enqueueScripts', 1);
52	}
53
54	add_filter('pre_current_active_plugins', 'WebTotemInterface::registerDeletePrompt');
55
56	/** Define role of current user */
57	add_action('init', 'WebTotem::getUserRole');
58
59	/** Execute pre-checks before every page */
60	add_action('init', 'WebTotemInterface::startupChecks');
61
62	/** Attach HTTP request handlers for the AJAX requests */
63	add_action('wp_ajax_nopriv_wtotem_ajax', 'wtotem_public_ajax_callback');
64	add_action('wp_ajax_wtotem_ajax', 'wtotem_ajax_callback');
65
66	if (WebTotemOption::isActivated()) {
67	if (WebTotemCaptcha::isEnabled() or WebTotemLogin::anyTwoFactorActivated()) {
68	/** Login Page */
69	add_action('login_enqueue_scripts', 'WebTotemInterface::loginEnqueueScripts');
70	}
71
72	/** Add authenticate filter */
73	add_filter('authenticate', 'WebTotemInterface::wt_authenticate', 25, 3);
74
75	/** Add lostpassword filter */
76	add_action('lostpassword_errors', 'WebTotemInterface::wt_lost_password', 1, 2);
77
78	/** Add site or new sites if it is multisite */
79	// add_action('wp_insert_site', 'WebTotemInterface::addNewSite');
80	}
81
82	if (WebTotemOption::getPluginSettings('hide_wp_version')) {
83	/** Restore readme file before WP update, then after update hide readme file */
84	add_filter('update_feedback', 'WebTotemInterface::restoreReadmeWhenUpdating');
85
86	/** Remove the WordPress generator meta-tag from the source code. */
87	remove_action('wp_head', 'wp_generator');
88	}
89
90	/** User Profile */
91	global $pagenow;
92	if ('profile.php' === $pagenow or 'user-edit.php' === $pagenow) {
93	add_action('admin_enqueue_scripts', 'WebTotemInterface::enqueueScripts', 1);
94	add_action('show_user_profile', 'WebTotemInterface::add2faProfileForm');
95	add_action('edit_user_profile', 'WebTotemInterface::add2faProfileForm');
96	}
97
98	/** Launch of the daily cron. */
99	add_action('wp', 'webtotem_add_cron_');
100	function webtotem_add_cron_()
101	{
102	if (!wp_next_scheduled('webtotem_daily_cron')) {
103	wp_schedule_event(time(), 'daily', 'webtotem_daily_cron');
104	}
105	}
106
107	add_action('webtotem_daily_cron', 'WtotemDailyCron');
108
109	function WtotemDailyCron()
110	{
111	WebTotemOption::setOptions(['scan_init' => 1]);
112	// WebTotem::updateCveData();
113	}
114
115	/** Launch of the minute cron. */
116	if (WebTotemOption::getOption('scan_init')) {
117
118	// Register the n minute interval
119	add_filter('cron_schedules', 'cron_add_some_min');
120	function cron_add_some_min($schedules)
121	{
122	$schedules['some_min'] = array(
123	'interval' => 60,
124	'display' => __('Every few minutes', 'wtotem'),
125	);
126	return $schedules;
127	}
128
129	// Registering an event
130	add_action('wp', 'wtotem_step_cron');
131	function wtotem_step_cron()
132	{
133	if (!wp_next_scheduled('wtotem_step_init_cron')) {
134	wp_schedule_event(time(), 'some_min', 'wtotem_step_init_cron');
135	}
136	}
137
138	// Linking the function to the cron event/task
139	add_action('wtotem_step_init_cron', 'WebTotemScan::initialize');
140	}
141
142	/**
143	* List an associative array with the sub-pages of this plugin.
144	*
145	* @return array List of sub-pages of this plugin.
146	*/
147	function wtotemPages()
148	{
149	// if (WebTotem::isMultiSite()) {
150	// $pages['wtotem_all_sites'] = ['title' => __('All sites', 'wtotem'), 'slug' => 'wtotem'];
151	// }
152	// $slug = WebTotem::isMultiSite() ? 'wtotem_' : 'wtotem';
153	$slug = 'wtotem';
154
155	$pages['wtotem_dashboard'] = ['title' => __('Dashboard', 'wtotem'), 'slug' => $slug];
156	$pages['wtotem_open_paths'] = ['title' => __('Open paths', 'wtotem'), 'slug' => $slug];
157	$pages['wtotem_firewall'] = ['title' => __('Firewall', 'wtotem'), 'slug' => $slug];
158
159	// if (!WebTotem::isMultiSite() or is_super_admin()) {
160	// $pages['wtotem_antivirus'] = ['title' => __('Antivirus', 'wtotem'), 'slug' => $slug];
161	// $pages['wtotem_settings'] = ['title' => __('Settings', 'wtotem'), 'slug' => $slug];
162	// }
163	$pages['wtotem_antivirus'] = ['title' => __('Antivirus', 'wtotem'), 'slug' => $slug];
164	$pages['wtotem_settings'] = ['title' => __('Settings', 'wtotem'), 'slug' => $slug];
165	// $pages['wtotem_reports'] = ['title' => __('Reports', 'wtotem'), 'slug' => $slug];
166	$pages['wtotem_documentation'] = ['title' => __('Documentation', 'wtotem'), 'slug' => 'wtotem'];
167	$pages['wtotem_wpscan'] = ['title' => __('WP scan', 'wtotem'), 'slug' => 'wtotem'];
168
169	return $pages;
170	}
171
172	if (function_exists('add_action')) {
173	/**
174	* Display extension menu and submenu items in the correct interface.
175	*
176	* @return void
177	*/
178	function wtotemAddMenu()
179	{
180
181	// $page = !WebTotemOption::isActivated() ? 'activation' : (WebTotem::isMultiSite() ? 'all_sites' : 'dashboard');
182	$page = !WebTotemOption::isActivated() ? 'activation' : 'dashboard';
183
184
185	add_menu_page(
186	__('WebTotem', 'wtotem'),
187	__('WebTotem', 'wtotem'),
188	'manage_options',
189	'wtotem',
190	'wtotem_' . $page . '_page',
191	WebTotem::getImagePath('logo_17x17_w.png')
192	);
193
194	if (WebTotemOption::isActivated()) {
195	$pages = wtotemPages();
196	foreach ($pages as $sub_page_function => $sub_page) {
197	add_submenu_page(
198	$sub_page['slug'],
199	$sub_page['title'],
200	$sub_page['title'],
201	'manage_options',
202	$sub_page_function,
203	$sub_page_function . '_page'
204	);
205	}
206
207	} else {
208	add_submenu_page(
209	'wtotem',
210	__('Activation', 'wtotem'),
211	__('Activation', 'wtotem'),
212	'manage_options',
213	'wtotem_activation',
214	'wtotem_activation_page'
215	);
216	}
217	}
218
219	/* Attach HTTP request handlers for the internal plugin pages */
220	if (WebTotem::isMultiSite()) {
221	add_action('network_admin_menu', 'wtotemAddMenu');
222	}
223	add_action('admin_menu', 'wtotemAddMenu');
224	}
225
226	/**
227	* Event hooks.
228	*
229	*/
230	if (class_exists('WebTotemEventListener')) {
231
232	add_action('add_user_to_blog', 'WebTotemEventListener::hookAddUserToBlog', 50, 4);
233
234	add_action('add_user_to_blog', 'WebTotemEventListener::hookAddUserToBlog', 50, 4);
235	add_action('remove_user_from_blog', 'WebTotemEventListener::hookRemoveUserFromBlog', 50, 2);
236	add_action('login_form_resetpass', 'WebTotemEventListener::hookLoginFormResetpass', 50, 5);
237	add_action('profile_update', 'WebTotemEventListener::hookProfileUpdate', 50, 5);
238	add_action('retrieve_password', 'WebTotemEventListener::hookRetrievePassword', 50, 5);
239	add_action('user_register', 'WebTotemEventListener::hookUserRegister', 50, 5);
240	add_action('deleted_user', 'WebTotemEventListener::hookUserDelete', 50, 3);
241	add_action('wp_login', 'WebTotemEventListener::hookLoginSuccess', 50, 5);
242	add_action('wp_login_failed', 'WebTotemEventListener::hookLoginFailure', 50, 5);
243	add_action('add_link', 'WebTotemEventListener::hookLinkAdd', 50, 5);
244	add_action('edit_link', 'WebTotemEventListener::hookLinkEdit', 50, 5);
245	add_action('create_category', 'WebTotemEventListener::hookCategoryCreate', 50, 5);
246	add_action('publish_post', 'WebTotemEventListener::hookPublishPost', 50, 5);
247	add_action('transition_post_status', 'WebTotemEventListener::hookPostStatus', 50, 3);
248	add_action('xmlrpc_publish_post', 'WebTotemEventListener::hookPublishPostXMLRPC', 50, 5);
249	add_action('before_delete_post', 'WebTotemEventListener::hookPostBeforeDelete', 50, 5);
250	add_action('delete_post', 'WebTotemEventListener::hookPostDelete', 50, 5);
251	add_action('wp_trash_post', 'WebTotemEventListener::hookPostTrash', 50, 5);
252	add_action('publish_page', 'WebTotemEventListener::hookPublishPage', 50, 5);
253	add_action('add_attachment', 'WebTotemEventListener::hookAttachmentAdd', 50, 5);
254	add_action('activated_plugin', 'WebTotemEventListener::hookPluginActivate', 50, 2);
255	add_action('deactivated_plugin', 'WebTotemEventListener::hookPluginDeactivate', 50, 2);
256	add_action('switch_theme', 'WebTotemEventListener::hookThemeSwitch', 50, 5);
257
258	add_action('admin_init', 'WebTotemEventListener::hookCoreUpdate');
259	add_action('admin_init', 'WebTotemEventListener::hookOptionsManagement');
260	add_action('admin_init', 'WebTotemEventListener::hookPluginDelete');
261	add_action('admin_init', 'WebTotemEventListener::hookPluginEditor');
262	add_action('admin_init', 'WebTotemEventListener::hookPluginInstall');
263	add_action('admin_init', 'WebTotemEventListener::hookPluginUpdate');
264	add_action('admin_init', 'WebTotemEventListener::hookThemeDelete');
265	add_action('admin_init', 'WebTotemEventListener::hookThemeEditor');
266	add_action('admin_init', 'WebTotemEventListener::hookThemeInstall');
267	add_action('admin_init', 'WebTotemEventListener::hookThemeUpdate');
268	add_action('admin_init', 'WebTotemEventListener::hookWidgetAdd');
269	add_action('admin_init', 'WebTotemEventListener::hookWidgetDelete');
270
271	}
272
273	}
274