mirror of
https://gitlab.com/ArkHost/WP-Security-Pack.git
synced 2026-07-24 07:55:53 +02:00
v1.0
This commit is contained in:
Yuri Karamian
@@ -25,6 +25,7 @@ class WPSP_Admin {
|
||||
add_action( 'wp_dashboard_setup', array( $this, 'add_dashboard_widget' ) );
|
||||
add_filter( 'plugin_row_meta', array( $this, 'plugin_row_meta' ), 10, 2 );
|
||||
add_filter( 'plugin_action_links_' . WPSP_PLUGIN_BASENAME, array( $this, 'plugin_action_links' ) );
|
||||
add_filter( 'submenu_file', array( $this, 'highlight_submenu' ) );
|
||||
|
||||
// AJAX handlers.
|
||||
add_action( 'wp_ajax_wpsp_clear_logs', array( $this, 'ajax_clear_logs' ) );
|
||||
@@ -41,6 +42,10 @@ class WPSP_Admin {
|
||||
add_action( 'wp_ajax_wpsp_reset_settings', array( $this, 'ajax_reset_settings' ) );
|
||||
add_action( 'wp_ajax_wpsp_test_email', array( $this, 'ajax_test_email' ) );
|
||||
add_action( 'wp_ajax_wpsp_force_logout_all', array( $this, 'ajax_force_logout_all' ) );
|
||||
add_action( 'wp_ajax_wpsp_quarantine_file', array( $this, 'ajax_quarantine_file' ) );
|
||||
add_action( 'wp_ajax_wpsp_restore_file', array( $this, 'ajax_restore_file' ) );
|
||||
add_action( 'wp_ajax_wpsp_delete_quarantined', array( $this, 'ajax_delete_quarantined' ) );
|
||||
add_action( 'wp_ajax_wpsp_delete_wp_file', array( $this, 'ajax_delete_wp_file' ) );
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -83,6 +88,36 @@ class WPSP_Admin {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Highlight the correct submenu based on current tab.
|
||||
*
|
||||
* @param string $submenu_file The current submenu file.
|
||||
* @return string
|
||||
*/
|
||||
public function highlight_submenu( $submenu_file ) {
|
||||
global $pagenow;
|
||||
|
||||
if ( 'admin.php' !== $pagenow ) {
|
||||
return $submenu_file;
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
|
||||
$page = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : '';
|
||||
|
||||
if ( 'wp-security-pack' !== $page ) {
|
||||
return $submenu_file;
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
|
||||
$tab = isset( $_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : 'status';
|
||||
|
||||
if ( 'status' === $tab ) {
|
||||
return 'wp-security-pack';
|
||||
}
|
||||
|
||||
return 'wp-security-pack&tab=' . $tab;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add plugin action links (left side - Settings, Deactivate, etc.).
|
||||
*
|
||||
@@ -565,8 +600,129 @@ class WPSP_Admin {
|
||||
<?php endif; ?>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'Debug Mode', 'wp-security-pack' ); ?></th>
|
||||
<td>
|
||||
<?php if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) : ?>
|
||||
<span class="wpsp-status wpsp-status-warning"><?php esc_html_e( 'Enabled', 'wp-security-pack' ); ?></span>
|
||||
<span class="description"><?php esc_html_e( 'Disable WP_DEBUG in production', 'wp-security-pack' ); ?></span>
|
||||
<?php else : ?>
|
||||
<span class="wpsp-status wpsp-status-ok"><?php esc_html_e( 'Disabled', 'wp-security-pack' ); ?></span>
|
||||
<?php endif; ?>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'Database Prefix', 'wp-security-pack' ); ?></th>
|
||||
<td>
|
||||
<?php global $wpdb; ?>
|
||||
<?php if ( 'wp_' === $wpdb->prefix ) : ?>
|
||||
<span class="wpsp-status wpsp-status-warning"><code>wp_</code></span>
|
||||
<span class="description"><?php esc_html_e( 'Default prefix - consider changing for new installs', 'wp-security-pack' ); ?></span>
|
||||
<?php else : ?>
|
||||
<span class="wpsp-status wpsp-status-ok"><code><?php echo esc_html( $wpdb->prefix ); ?></code></span>
|
||||
<?php endif; ?>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'Admin Username', 'wp-security-pack' ); ?></th>
|
||||
<td>
|
||||
<?php if ( username_exists( 'admin' ) ) : ?>
|
||||
<span class="wpsp-status wpsp-status-warning"><?php esc_html_e( 'Exists', 'wp-security-pack' ); ?></span>
|
||||
<span class="description"><?php esc_html_e( '"admin" username is commonly targeted', 'wp-security-pack' ); ?></span>
|
||||
<?php else : ?>
|
||||
<span class="wpsp-status wpsp-status-ok"><?php esc_html_e( 'Not found', 'wp-security-pack' ); ?></span>
|
||||
<?php endif; ?>
|
||||
</td>
|
||||
</tr>
|
||||
<?php
|
||||
$custom_login = WP_Security_Pack::get_setting( 'custom_login_url', '' );
|
||||
if ( ! empty( $custom_login ) ) :
|
||||
?>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'Custom Login URL', 'wp-security-pack' ); ?></th>
|
||||
<td>
|
||||
<code><?php echo esc_url( home_url( '/' . $custom_login . '/' ) ); ?></code>
|
||||
<span class="description"><?php esc_html_e( 'Bookmark this!', 'wp-security-pack' ); ?></span>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endif; ?>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<?php
|
||||
// Check for files that expose WordPress version.
|
||||
$readme_exists = file_exists( ABSPATH . 'readme.html' );
|
||||
$license_exists = file_exists( ABSPATH . 'license.txt' );
|
||||
|
||||
if ( $readme_exists || $license_exists ) :
|
||||
?>
|
||||
<div class="wpsp-section">
|
||||
<h2><?php esc_html_e( 'Recommended Actions', 'wp-security-pack' ); ?></h2>
|
||||
<div class="notice notice-warning inline" style="margin: 0 0 15px;">
|
||||
<p><?php esc_html_e( 'These files expose your WordPress version and can be safely removed.', 'wp-security-pack' ); ?></p>
|
||||
</div>
|
||||
<table class="widefat striped">
|
||||
<thead>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'File', 'wp-security-pack' ); ?></th>
|
||||
<th><?php esc_html_e( 'Status', 'wp-security-pack' ); ?></th>
|
||||
<th style="width: 100px;"><?php esc_html_e( 'Action', 'wp-security-pack' ); ?></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<?php if ( $readme_exists ) : ?>
|
||||
<tr>
|
||||
<td><code>readme.html</code></td>
|
||||
<td><span class="wpsp-status wpsp-status-warning"><?php esc_html_e( 'Exists', 'wp-security-pack' ); ?></span></td>
|
||||
<td>
|
||||
<button type="button" class="button button-small wpsp-delete-file" data-file="readme.html">
|
||||
<?php esc_html_e( 'Delete', 'wp-security-pack' ); ?>
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endif; ?>
|
||||
<?php if ( $license_exists ) : ?>
|
||||
<tr>
|
||||
<td><code>license.txt</code></td>
|
||||
<td><span class="wpsp-status wpsp-status-warning"><?php esc_html_e( 'Exists', 'wp-security-pack' ); ?></span></td>
|
||||
<td>
|
||||
<button type="button" class="button button-small wpsp-delete-file" data-file="license.txt">
|
||||
<?php esc_html_e( 'Delete', 'wp-security-pack' ); ?>
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endif; ?>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<script>
|
||||
jQuery(function($) {
|
||||
$('.wpsp-delete-file').on('click', function() {
|
||||
var $btn = $(this);
|
||||
var file = $btn.data('file');
|
||||
|
||||
if (!confirm('<?php echo esc_js( __( 'Delete this file?', 'wp-security-pack' ) ); ?>')) {
|
||||
return;
|
||||
}
|
||||
|
||||
$btn.prop('disabled', true).text('<?php echo esc_js( __( 'Deleting...', 'wp-security-pack' ) ); ?>');
|
||||
|
||||
$.post(ajaxurl, {
|
||||
action: 'wpsp_delete_wp_file',
|
||||
file: file,
|
||||
_ajax_nonce: '<?php echo esc_js( wp_create_nonce( 'wpsp_admin' ) ); ?>'
|
||||
}, function(response) {
|
||||
if (response.success) {
|
||||
$btn.closest('tr').fadeOut();
|
||||
} else {
|
||||
alert(response.data.message || '<?php echo esc_js( __( 'Failed to delete file.', 'wp-security-pack' ) ); ?>');
|
||||
$btn.prop('disabled', false).text('<?php echo esc_js( __( 'Delete', 'wp-security-pack' ) ); ?>');
|
||||
}
|
||||
});
|
||||
});
|
||||
});
|
||||
</script>
|
||||
<?php endif; ?>
|
||||
<?php
|
||||
}
|
||||
|
||||
@@ -1792,8 +1948,23 @@ class WPSP_Admin {
|
||||
<tr>
|
||||
<th scope="row"><?php esc_html_e( 'Last Scan', 'wp-security-pack' ); ?></th>
|
||||
<td>
|
||||
<?php if ( $malware_results['time'] > 0 ) : ?>
|
||||
<?php
|
||||
$scan_stats = get_option( 'wpsp_malware_scan_stats', array() );
|
||||
if ( $malware_results['time'] > 0 ) :
|
||||
?>
|
||||
<?php echo esc_html( human_time_diff( $malware_results['time'] ) . ' ' . __( 'ago', 'wp-security-pack' ) ); ?>
|
||||
<?php if ( ! empty( $scan_stats['files_scanned'] ) ) : ?>
|
||||
<span class="description" style="margin-left: 10px;">
|
||||
<?php
|
||||
printf(
|
||||
/* translators: 1: Number of files, 2: Duration in seconds */
|
||||
esc_html__( '(%1$s files in %2$ss)', 'wp-security-pack' ),
|
||||
esc_html( number_format_i18n( $scan_stats['files_scanned'] ) ),
|
||||
esc_html( $scan_stats['duration'] )
|
||||
);
|
||||
?>
|
||||
</span>
|
||||
<?php endif; ?>
|
||||
<?php else : ?>
|
||||
<?php esc_html_e( 'Never', 'wp-security-pack' ); ?>
|
||||
<?php endif; ?>
|
||||
@@ -1817,11 +1988,12 @@ class WPSP_Admin {
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'File', 'wp-security-pack' ); ?></th>
|
||||
<th><?php esc_html_e( 'Finding', 'wp-security-pack' ); ?></th>
|
||||
<th style="width: 120px;"><?php esc_html_e( 'Actions', 'wp-security-pack' ); ?></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<?php foreach ( $malware_results['results'] as $file => $findings ) : ?>
|
||||
<tr>
|
||||
<tr data-file="<?php echo esc_attr( $file ); ?>">
|
||||
<td><code><?php echo esc_html( str_replace( ABSPATH, '', $file ) ); ?></code></td>
|
||||
<td>
|
||||
<?php foreach ( $findings as $finding ) : ?>
|
||||
@@ -1834,6 +2006,11 @@ class WPSP_Admin {
|
||||
</span>
|
||||
<?php endforeach; ?>
|
||||
</td>
|
||||
<td>
|
||||
<button type="button" class="button button-small wpsp-quarantine-file" data-file="<?php echo esc_attr( $file ); ?>">
|
||||
<?php esc_html_e( 'Quarantine', 'wp-security-pack' ); ?>
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endforeach; ?>
|
||||
</tbody>
|
||||
@@ -1852,6 +2029,41 @@ class WPSP_Admin {
|
||||
<p><?php esc_html_e( 'No malware or suspicious files detected.', 'wp-security-pack' ); ?></p>
|
||||
</div>
|
||||
<?php endif; ?>
|
||||
|
||||
<?php
|
||||
$quarantined_files = $malware_scanner->get_quarantined_files();
|
||||
if ( ! empty( $quarantined_files ) ) :
|
||||
?>
|
||||
<h3 style="margin-top: 20px;"><?php esc_html_e( 'Quarantined Files', 'wp-security-pack' ); ?></h3>
|
||||
<p class="description"><?php esc_html_e( 'Files that have been isolated. They cannot execute from quarantine.', 'wp-security-pack' ); ?></p>
|
||||
<table class="widefat striped" style="margin-top: 10px;">
|
||||
<thead>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'Original Location', 'wp-security-pack' ); ?></th>
|
||||
<th><?php esc_html_e( 'Quarantined', 'wp-security-pack' ); ?></th>
|
||||
<th><?php esc_html_e( 'Size', 'wp-security-pack' ); ?></th>
|
||||
<th style="width: 180px;"><?php esc_html_e( 'Actions', 'wp-security-pack' ); ?></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<?php foreach ( $quarantined_files as $name => $meta ) : ?>
|
||||
<tr data-quarantine-name="<?php echo esc_attr( $name ); ?>">
|
||||
<td><code><?php echo esc_html( $meta['relative_path'] ?? $meta['original_name'] ); ?></code></td>
|
||||
<td><?php echo esc_html( human_time_diff( $meta['quarantined_at'] ) . ' ' . __( 'ago', 'wp-security-pack' ) ); ?></td>
|
||||
<td><?php echo esc_html( size_format( $meta['file_size'] ?? 0 ) ); ?></td>
|
||||
<td>
|
||||
<button type="button" class="button button-small wpsp-restore-file" data-name="<?php echo esc_attr( $name ); ?>">
|
||||
<?php esc_html_e( 'Restore', 'wp-security-pack' ); ?>
|
||||
</button>
|
||||
<button type="button" class="button button-small wpsp-delete-quarantined" data-name="<?php echo esc_attr( $name ); ?>" style="color: #a00;">
|
||||
<?php esc_html_e( 'Delete', 'wp-security-pack' ); ?>
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endforeach; ?>
|
||||
</tbody>
|
||||
</table>
|
||||
<?php endif; ?>
|
||||
</div>
|
||||
|
||||
<div class="wpsp-section">
|
||||
@@ -1866,8 +2078,8 @@ class WPSP_Admin {
|
||||
<h3><?php esc_html_e( 'Detection Methods', 'wp-security-pack' ); ?></h3>
|
||||
<table class="widefat striped" style="max-width: 600px;">
|
||||
<tr>
|
||||
<td><strong><?php esc_html_e( 'Hash-based', 'wp-security-pack' ); ?></strong></td>
|
||||
<td><?php esc_html_e( 'Compares file MD5 against database of known malware', 'wp-security-pack' ); ?></td>
|
||||
<td><strong><?php esc_html_e( 'Checksum verification', 'wp-security-pack' ); ?></strong></td>
|
||||
<td><?php esc_html_e( 'Compares core files against WordPress.org checksums', 'wp-security-pack' ); ?></td>
|
||||
<td><span style="color: green;">✓ <?php esc_html_e( '100% accurate', 'wp-security-pack' ); ?></span></td>
|
||||
</tr>
|
||||
<tr>
|
||||
@@ -1875,11 +2087,6 @@ class WPSP_Admin {
|
||||
<td><?php esc_html_e( 'Scans code for suspicious patterns and functions', 'wp-security-pack' ); ?></td>
|
||||
<td><span style="color: orange;">⚠ <?php esc_html_e( 'May have false positives', 'wp-security-pack' ); ?></span></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong><?php esc_html_e( 'Checksum verification', 'wp-security-pack' ); ?></strong></td>
|
||||
<td><?php esc_html_e( 'Compares core files against WordPress.org checksums', 'wp-security-pack' ); ?></td>
|
||||
<td><span style="color: green;">✓ <?php esc_html_e( '100% accurate', 'wp-security-pack' ); ?></span></td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
@@ -1933,6 +2140,86 @@ class WPSP_Admin {
|
||||
location.reload();
|
||||
});
|
||||
});
|
||||
|
||||
// Quarantine file.
|
||||
$('.wpsp-quarantine-file').on('click', function() {
|
||||
var $btn = $(this);
|
||||
var filePath = $btn.data('file');
|
||||
|
||||
if (!confirm('<?php echo esc_js( __( 'Quarantine this file? It will be moved to a safe location and cannot execute.', 'wp-security-pack' ) ); ?>')) {
|
||||
return;
|
||||
}
|
||||
|
||||
$btn.prop('disabled', true).text('<?php echo esc_js( __( 'Moving...', 'wp-security-pack' ) ); ?>');
|
||||
|
||||
$.post(ajaxurl, {
|
||||
action: 'wpsp_quarantine_file',
|
||||
file_path: filePath,
|
||||
_ajax_nonce: '<?php echo esc_js( wp_create_nonce( 'wpsp_admin' ) ); ?>'
|
||||
}, function(response) {
|
||||
if (response.success) {
|
||||
$btn.closest('tr').fadeOut(function() {
|
||||
$(this).remove();
|
||||
location.reload();
|
||||
});
|
||||
} else {
|
||||
alert(response.data.message || '<?php echo esc_js( __( 'Failed to quarantine file.', 'wp-security-pack' ) ); ?>');
|
||||
$btn.prop('disabled', false).text('<?php echo esc_js( __( 'Quarantine', 'wp-security-pack' ) ); ?>');
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// Restore file from quarantine.
|
||||
$('.wpsp-restore-file').on('click', function() {
|
||||
var $btn = $(this);
|
||||
var name = $btn.data('name');
|
||||
|
||||
if (!confirm('<?php echo esc_js( __( 'Restore this file to its original location? Make sure it is safe before restoring.', 'wp-security-pack' ) ); ?>')) {
|
||||
return;
|
||||
}
|
||||
|
||||
$btn.prop('disabled', true).text('<?php echo esc_js( __( 'Restoring...', 'wp-security-pack' ) ); ?>');
|
||||
|
||||
$.post(ajaxurl, {
|
||||
action: 'wpsp_restore_file',
|
||||
quarantine_name: name,
|
||||
_ajax_nonce: '<?php echo esc_js( wp_create_nonce( 'wpsp_admin' ) ); ?>'
|
||||
}, function(response) {
|
||||
if (response.success) {
|
||||
location.reload();
|
||||
} else {
|
||||
alert(response.data.message || '<?php echo esc_js( __( 'Failed to restore file.', 'wp-security-pack' ) ); ?>');
|
||||
$btn.prop('disabled', false).text('<?php echo esc_js( __( 'Restore', 'wp-security-pack' ) ); ?>');
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// Delete quarantined file permanently.
|
||||
$('.wpsp-delete-quarantined').on('click', function() {
|
||||
var $btn = $(this);
|
||||
var name = $btn.data('name');
|
||||
|
||||
if (!confirm('<?php echo esc_js( __( 'Permanently delete this file? This cannot be undone.', 'wp-security-pack' ) ); ?>')) {
|
||||
return;
|
||||
}
|
||||
|
||||
$btn.prop('disabled', true).text('<?php echo esc_js( __( 'Deleting...', 'wp-security-pack' ) ); ?>');
|
||||
|
||||
$.post(ajaxurl, {
|
||||
action: 'wpsp_delete_quarantined',
|
||||
quarantine_name: name,
|
||||
_ajax_nonce: '<?php echo esc_js( wp_create_nonce( 'wpsp_admin' ) ); ?>'
|
||||
}, function(response) {
|
||||
if (response.success) {
|
||||
$btn.closest('tr').fadeOut(function() {
|
||||
$(this).remove();
|
||||
});
|
||||
} else {
|
||||
alert(response.data.message || '<?php echo esc_js( __( 'Failed to delete file.', 'wp-security-pack' ) ); ?>');
|
||||
$btn.prop('disabled', false).text('<?php echo esc_js( __( 'Delete', 'wp-security-pack' ) ); ?>');
|
||||
}
|
||||
});
|
||||
});
|
||||
});
|
||||
</script>
|
||||
<?php
|
||||
@@ -2826,4 +3113,115 @@ class WPSP_Admin {
|
||||
|
||||
wp_send_json_success();
|
||||
}
|
||||
|
||||
/**
|
||||
* AJAX: Quarantine a suspicious file.
|
||||
*/
|
||||
public function ajax_quarantine_file() {
|
||||
check_ajax_referer( 'wpsp_admin' );
|
||||
|
||||
if ( ! current_user_can( 'manage_options' ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$file_path = isset( $_POST['file_path'] ) ? sanitize_text_field( wp_unslash( $_POST['file_path'] ) ) : '';
|
||||
|
||||
if ( empty( $file_path ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'No file specified.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$scanner = new WPSP_Malware_Scanner();
|
||||
$result = $scanner->quarantine_file( $file_path );
|
||||
|
||||
if ( is_wp_error( $result ) ) {
|
||||
wp_send_json_error( array( 'message' => $result->get_error_message() ) );
|
||||
}
|
||||
|
||||
wp_send_json_success( $result );
|
||||
}
|
||||
|
||||
/**
|
||||
* AJAX: Restore a file from quarantine.
|
||||
*/
|
||||
public function ajax_restore_file() {
|
||||
check_ajax_referer( 'wpsp_admin' );
|
||||
|
||||
if ( ! current_user_can( 'manage_options' ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$quarantine_name = isset( $_POST['quarantine_name'] ) ? sanitize_file_name( wp_unslash( $_POST['quarantine_name'] ) ) : '';
|
||||
|
||||
if ( empty( $quarantine_name ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'No file specified.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$scanner = new WPSP_Malware_Scanner();
|
||||
$result = $scanner->restore_file( $quarantine_name );
|
||||
|
||||
if ( is_wp_error( $result ) ) {
|
||||
wp_send_json_error( array( 'message' => $result->get_error_message() ) );
|
||||
}
|
||||
|
||||
wp_send_json_success( $result );
|
||||
}
|
||||
|
||||
/**
|
||||
* AJAX: Delete a quarantined file permanently.
|
||||
*/
|
||||
public function ajax_delete_quarantined() {
|
||||
check_ajax_referer( 'wpsp_admin' );
|
||||
|
||||
if ( ! current_user_can( 'manage_options' ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$quarantine_name = isset( $_POST['quarantine_name'] ) ? sanitize_file_name( wp_unslash( $_POST['quarantine_name'] ) ) : '';
|
||||
|
||||
if ( empty( $quarantine_name ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'No file specified.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$scanner = new WPSP_Malware_Scanner();
|
||||
$result = $scanner->delete_quarantined_file( $quarantine_name );
|
||||
|
||||
if ( is_wp_error( $result ) ) {
|
||||
wp_send_json_error( array( 'message' => $result->get_error_message() ) );
|
||||
}
|
||||
|
||||
wp_send_json_success( $result );
|
||||
}
|
||||
|
||||
/**
|
||||
* AJAX: Delete WordPress info files (readme.html, license.txt).
|
||||
*/
|
||||
public function ajax_delete_wp_file() {
|
||||
check_ajax_referer( 'wpsp_admin' );
|
||||
|
||||
if ( ! current_user_can( 'manage_options' ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$file = isset( $_POST['file'] ) ? sanitize_file_name( wp_unslash( $_POST['file'] ) ) : '';
|
||||
|
||||
// Only allow specific safe files to be deleted.
|
||||
$allowed_files = array( 'readme.html', 'license.txt' );
|
||||
|
||||
if ( ! in_array( $file, $allowed_files, true ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Invalid file.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$file_path = ABSPATH . $file;
|
||||
|
||||
if ( ! file_exists( $file_path ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'File not found.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
|
||||
if ( ! unlink( $file_path ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Failed to delete file. Check file permissions.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
wp_send_json_success();
|
||||
}
|
||||
}
|
||||
|
||||
@@ -155,6 +155,15 @@ class WPSP_DB {
|
||||
// Delete options.
|
||||
delete_option( 'wpsp_settings' );
|
||||
delete_option( 'wpsp_db_version' );
|
||||
delete_option( 'wpsp_malware_scan_results' );
|
||||
delete_option( 'wpsp_malware_last_scan' );
|
||||
delete_option( 'wpsp_malware_hashes' );
|
||||
delete_option( 'wpsp_malware_hashes_updated' );
|
||||
delete_option( 'wpsp_malware_scan_stats' );
|
||||
delete_option( 'wpsp_quarantined_files' );
|
||||
delete_option( 'wpsp_file_scan_results' );
|
||||
delete_option( 'wpsp_file_last_scan' );
|
||||
delete_option( 'wpsp_file_baseline' );
|
||||
|
||||
// Delete transients.
|
||||
delete_transient( 'wpsp_geo_cache' );
|
||||
|
||||
@@ -108,27 +108,48 @@ class WPSP_Malware_Scanner {
|
||||
/**
|
||||
* Load known malware file hashes.
|
||||
*
|
||||
* These are MD5 hashes of known malicious files. When a file matches,
|
||||
* it's 100% confirmed malware - no false positives possible.
|
||||
* Hashes can come from:
|
||||
* 1. Local database (user-added)
|
||||
* 2. Custom filter (wpsp_malware_hashes)
|
||||
*/
|
||||
private function load_malware_hashes() {
|
||||
// Try to load from database (updated hashes).
|
||||
$stored_hashes = get_option( self::HASH_DB_OPTION, array() );
|
||||
|
||||
if ( ! empty( $stored_hashes ) ) {
|
||||
$this->malware_hashes = $stored_hashes;
|
||||
return;
|
||||
}
|
||||
|
||||
// Hash database starts empty - relies on signature detection.
|
||||
// Users can add hashes via the 'wpsp_malware_hashes' filter or
|
||||
// by updating from a trusted source using update_hash_database().
|
||||
$this->malware_hashes = array();
|
||||
// Load from database (user-added or previously downloaded).
|
||||
$this->malware_hashes = get_option( self::HASH_DB_OPTION, array() );
|
||||
|
||||
// Allow adding custom hashes via filter.
|
||||
$this->malware_hashes = apply_filters( 'wpsp_malware_hashes', $this->malware_hashes );
|
||||
}
|
||||
|
||||
/**
|
||||
* Add a hash to the local database.
|
||||
*
|
||||
* @param string $hash MD5 hash.
|
||||
* @param string $name Malware name/description.
|
||||
*/
|
||||
public function add_hash_to_database( $hash, $name ) {
|
||||
$hashes = get_option( self::HASH_DB_OPTION, array() );
|
||||
$hashes[ strtolower( $hash ) ] = $name;
|
||||
update_option( self::HASH_DB_OPTION, $hashes );
|
||||
$this->malware_hashes[ strtolower( $hash ) ] = $name;
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove a hash from the local database.
|
||||
*
|
||||
* @param string $hash MD5 hash.
|
||||
*/
|
||||
public function remove_hash_from_database( $hash ) {
|
||||
$hashes = get_option( self::HASH_DB_OPTION, array() );
|
||||
$hash = strtolower( $hash );
|
||||
if ( isset( $hashes[ $hash ] ) ) {
|
||||
unset( $hashes[ $hash ] );
|
||||
update_option( self::HASH_DB_OPTION, $hashes );
|
||||
}
|
||||
if ( isset( $this->malware_hashes[ $hash ] ) ) {
|
||||
unset( $this->malware_hashes[ $hash ] );
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Update malware hash database from remote source.
|
||||
*
|
||||
@@ -516,6 +537,8 @@ class WPSP_Malware_Scanner {
|
||||
* @return array
|
||||
*/
|
||||
public function scan_files( $paths = array() ) {
|
||||
$start_time = microtime( true );
|
||||
|
||||
if ( empty( $paths ) ) {
|
||||
// Only scan wp-content directories, NOT WordPress core.
|
||||
$paths = array(
|
||||
@@ -586,7 +609,18 @@ class WPSP_Malware_Scanner {
|
||||
}
|
||||
}
|
||||
|
||||
$duration = microtime( true ) - $start_time;
|
||||
|
||||
// Save scan stats.
|
||||
update_option( self::LAST_SCAN_OPTION, time() );
|
||||
update_option(
|
||||
'wpsp_malware_scan_stats',
|
||||
array(
|
||||
'files_scanned' => $file_count,
|
||||
'duration' => round( $duration, 2 ),
|
||||
'issues_found' => count( $results ),
|
||||
)
|
||||
);
|
||||
|
||||
return $results;
|
||||
}
|
||||
@@ -763,4 +797,219 @@ class WPSP_Malware_Scanner {
|
||||
|
||||
return isset( $colors[ $severity ] ) ? $colors[ $severity ] : '#6c757d';
|
||||
}
|
||||
|
||||
/**
|
||||
* Get quarantine directory path.
|
||||
*
|
||||
* @return string
|
||||
*/
|
||||
public function get_quarantine_dir() {
|
||||
$upload_dir = wp_upload_dir();
|
||||
$quarantine = $upload_dir['basedir'] . '/wpsp-quarantine';
|
||||
|
||||
if ( ! file_exists( $quarantine ) ) {
|
||||
wp_mkdir_p( $quarantine );
|
||||
|
||||
// Protect quarantine directory.
|
||||
$htaccess = $quarantine . '/.htaccess';
|
||||
if ( ! file_exists( $htaccess ) ) {
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
|
||||
file_put_contents( $htaccess, "Deny from all\n" );
|
||||
}
|
||||
|
||||
$index = $quarantine . '/index.php';
|
||||
if ( ! file_exists( $index ) ) {
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
|
||||
file_put_contents( $index, "<?php\n// Silence is golden.\n" );
|
||||
}
|
||||
}
|
||||
|
||||
return $quarantine;
|
||||
}
|
||||
|
||||
/**
|
||||
* Quarantine a suspicious file.
|
||||
*
|
||||
* @param string $file_path Full path to the file.
|
||||
* @return array|WP_Error Result with quarantine info or error.
|
||||
*/
|
||||
public function quarantine_file( $file_path ) {
|
||||
if ( ! file_exists( $file_path ) ) {
|
||||
return new WP_Error( 'file_not_found', __( 'File not found.', 'wp-security-pack' ) );
|
||||
}
|
||||
|
||||
// Security: Only allow quarantining files within wp-content.
|
||||
if ( strpos( realpath( $file_path ), realpath( WP_CONTENT_DIR ) ) !== 0 ) {
|
||||
return new WP_Error( 'invalid_path', __( 'Can only quarantine files within wp-content.', 'wp-security-pack' ) );
|
||||
}
|
||||
|
||||
$quarantine_dir = $this->get_quarantine_dir();
|
||||
$file_hash = md5_file( $file_path );
|
||||
$timestamp = time();
|
||||
$original_name = basename( $file_path );
|
||||
$relative_path = str_replace( ABSPATH, '', $file_path );
|
||||
|
||||
// Create unique quarantine filename.
|
||||
$quarantine_name = sprintf(
|
||||
'%s_%s_%s.quarantined',
|
||||
$timestamp,
|
||||
$file_hash,
|
||||
sanitize_file_name( $original_name )
|
||||
);
|
||||
$quarantine_path = $quarantine_dir . '/' . $quarantine_name;
|
||||
|
||||
// Store metadata.
|
||||
$metadata = array(
|
||||
'original_path' => $file_path,
|
||||
'relative_path' => $relative_path,
|
||||
'original_name' => $original_name,
|
||||
'file_hash' => $file_hash,
|
||||
'quarantined_at' => $timestamp,
|
||||
'quarantined_by' => get_current_user_id(),
|
||||
'file_size' => filesize( $file_path ),
|
||||
);
|
||||
|
||||
// Move file to quarantine.
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.rename_rename
|
||||
if ( ! rename( $file_path, $quarantine_path ) ) {
|
||||
return new WP_Error( 'move_failed', __( 'Failed to move file to quarantine.', 'wp-security-pack' ) );
|
||||
}
|
||||
|
||||
// Save metadata.
|
||||
$meta_file = $quarantine_path . '.meta';
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
|
||||
file_put_contents( $meta_file, wp_json_encode( $metadata, JSON_PRETTY_PRINT ) );
|
||||
|
||||
// Update quarantine list in options.
|
||||
$quarantined = get_option( 'wpsp_quarantined_files', array() );
|
||||
$quarantined[ $quarantine_name ] = $metadata;
|
||||
update_option( 'wpsp_quarantined_files', $quarantined );
|
||||
|
||||
// Remove from scan results if present.
|
||||
$results = get_option( self::RESULTS_OPTION, array() );
|
||||
if ( isset( $results[ $file_path ] ) ) {
|
||||
unset( $results[ $file_path ] );
|
||||
update_option( self::RESULTS_OPTION, $results );
|
||||
}
|
||||
|
||||
return array(
|
||||
'success' => true,
|
||||
'quarantine_name' => $quarantine_name,
|
||||
'metadata' => $metadata,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Restore a file from quarantine.
|
||||
*
|
||||
* @param string $quarantine_name The quarantine filename.
|
||||
* @return array|WP_Error Result or error.
|
||||
*/
|
||||
public function restore_file( $quarantine_name ) {
|
||||
$quarantine_dir = $this->get_quarantine_dir();
|
||||
$quarantine_path = $quarantine_dir . '/' . $quarantine_name;
|
||||
$meta_file = $quarantine_path . '.meta';
|
||||
|
||||
if ( ! file_exists( $quarantine_path ) ) {
|
||||
return new WP_Error( 'file_not_found', __( 'Quarantined file not found.', 'wp-security-pack' ) );
|
||||
}
|
||||
|
||||
// Get metadata.
|
||||
$metadata = array();
|
||||
if ( file_exists( $meta_file ) ) {
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
|
||||
$metadata = json_decode( file_get_contents( $meta_file ), true );
|
||||
}
|
||||
|
||||
if ( empty( $metadata['original_path'] ) ) {
|
||||
return new WP_Error( 'no_metadata', __( 'Cannot restore: original path unknown.', 'wp-security-pack' ) );
|
||||
}
|
||||
|
||||
$original_path = $metadata['original_path'];
|
||||
|
||||
// Ensure parent directory exists.
|
||||
$parent_dir = dirname( $original_path );
|
||||
if ( ! file_exists( $parent_dir ) ) {
|
||||
wp_mkdir_p( $parent_dir );
|
||||
}
|
||||
|
||||
// Restore file.
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.rename_rename
|
||||
if ( ! rename( $quarantine_path, $original_path ) ) {
|
||||
return new WP_Error( 'restore_failed', __( 'Failed to restore file.', 'wp-security-pack' ) );
|
||||
}
|
||||
|
||||
// Clean up metadata file.
|
||||
if ( file_exists( $meta_file ) ) {
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
|
||||
unlink( $meta_file );
|
||||
}
|
||||
|
||||
// Update quarantine list.
|
||||
$quarantined = get_option( 'wpsp_quarantined_files', array() );
|
||||
if ( isset( $quarantined[ $quarantine_name ] ) ) {
|
||||
unset( $quarantined[ $quarantine_name ] );
|
||||
update_option( 'wpsp_quarantined_files', $quarantined );
|
||||
}
|
||||
|
||||
return array(
|
||||
'success' => true,
|
||||
'restored_path' => $original_path,
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete a quarantined file permanently.
|
||||
*
|
||||
* @param string $quarantine_name The quarantine filename.
|
||||
* @return array|WP_Error Result or error.
|
||||
*/
|
||||
public function delete_quarantined_file( $quarantine_name ) {
|
||||
$quarantine_dir = $this->get_quarantine_dir();
|
||||
$quarantine_path = $quarantine_dir . '/' . $quarantine_name;
|
||||
$meta_file = $quarantine_path . '.meta';
|
||||
|
||||
if ( ! file_exists( $quarantine_path ) ) {
|
||||
return new WP_Error( 'file_not_found', __( 'Quarantined file not found.', 'wp-security-pack' ) );
|
||||
}
|
||||
|
||||
// Delete file.
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
|
||||
if ( ! unlink( $quarantine_path ) ) {
|
||||
return new WP_Error( 'delete_failed', __( 'Failed to delete file.', 'wp-security-pack' ) );
|
||||
}
|
||||
|
||||
// Clean up metadata file.
|
||||
if ( file_exists( $meta_file ) ) {
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
|
||||
unlink( $meta_file );
|
||||
}
|
||||
|
||||
// Update quarantine list.
|
||||
$quarantined = get_option( 'wpsp_quarantined_files', array() );
|
||||
if ( isset( $quarantined[ $quarantine_name ] ) ) {
|
||||
unset( $quarantined[ $quarantine_name ] );
|
||||
update_option( 'wpsp_quarantined_files', $quarantined );
|
||||
}
|
||||
|
||||
return array( 'success' => true );
|
||||
}
|
||||
|
||||
/**
|
||||
* Get list of quarantined files.
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public function get_quarantined_files() {
|
||||
return get_option( 'wpsp_quarantined_files', array() );
|
||||
}
|
||||
|
||||
/**
|
||||
* Get count of quarantined files.
|
||||
*
|
||||
* @return int
|
||||
*/
|
||||
public function get_quarantine_count() {
|
||||
return count( $this->get_quarantined_files() );
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user