mirror of
https://gitlab.com/ArkHost/WP-Security-Pack.git
synced 2026-09-19 17:37:30 +02:00
v1.0
This commit is contained in:
Yuri Karamian
@@ -25,6 +25,7 @@ class WPSP_Admin {
|
||||
add_action( 'wp_dashboard_setup', array( $this, 'add_dashboard_widget' ) );
|
||||
add_filter( 'plugin_row_meta', array( $this, 'plugin_row_meta' ), 10, 2 );
|
||||
add_filter( 'plugin_action_links_' . WPSP_PLUGIN_BASENAME, array( $this, 'plugin_action_links' ) );
|
||||
add_filter( 'submenu_file', array( $this, 'highlight_submenu' ) );
|
||||
|
||||
// AJAX handlers.
|
||||
add_action( 'wp_ajax_wpsp_clear_logs', array( $this, 'ajax_clear_logs' ) );
|
||||
@@ -41,6 +42,10 @@ class WPSP_Admin {
|
||||
add_action( 'wp_ajax_wpsp_reset_settings', array( $this, 'ajax_reset_settings' ) );
|
||||
add_action( 'wp_ajax_wpsp_test_email', array( $this, 'ajax_test_email' ) );
|
||||
add_action( 'wp_ajax_wpsp_force_logout_all', array( $this, 'ajax_force_logout_all' ) );
|
||||
add_action( 'wp_ajax_wpsp_quarantine_file', array( $this, 'ajax_quarantine_file' ) );
|
||||
add_action( 'wp_ajax_wpsp_restore_file', array( $this, 'ajax_restore_file' ) );
|
||||
add_action( 'wp_ajax_wpsp_delete_quarantined', array( $this, 'ajax_delete_quarantined' ) );
|
||||
add_action( 'wp_ajax_wpsp_delete_wp_file', array( $this, 'ajax_delete_wp_file' ) );
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -83,6 +88,36 @@ class WPSP_Admin {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Highlight the correct submenu based on current tab.
|
||||
*
|
||||
* @param string $submenu_file The current submenu file.
|
||||
* @return string
|
||||
*/
|
||||
public function highlight_submenu( $submenu_file ) {
|
||||
global $pagenow;
|
||||
|
||||
if ( 'admin.php' !== $pagenow ) {
|
||||
return $submenu_file;
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
|
||||
$page = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : '';
|
||||
|
||||
if ( 'wp-security-pack' !== $page ) {
|
||||
return $submenu_file;
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
|
||||
$tab = isset( $_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : 'status';
|
||||
|
||||
if ( 'status' === $tab ) {
|
||||
return 'wp-security-pack';
|
||||
}
|
||||
|
||||
return 'wp-security-pack&tab=' . $tab;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add plugin action links (left side - Settings, Deactivate, etc.).
|
||||
*
|
||||
@@ -565,8 +600,129 @@ class WPSP_Admin {
|
||||
<?php endif; ?>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'Debug Mode', 'wp-security-pack' ); ?></th>
|
||||
<td>
|
||||
<?php if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) : ?>
|
||||
<span class="wpsp-status wpsp-status-warning"><?php esc_html_e( 'Enabled', 'wp-security-pack' ); ?></span>
|
||||
<span class="description"><?php esc_html_e( 'Disable WP_DEBUG in production', 'wp-security-pack' ); ?></span>
|
||||
<?php else : ?>
|
||||
<span class="wpsp-status wpsp-status-ok"><?php esc_html_e( 'Disabled', 'wp-security-pack' ); ?></span>
|
||||
<?php endif; ?>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'Database Prefix', 'wp-security-pack' ); ?></th>
|
||||
<td>
|
||||
<?php global $wpdb; ?>
|
||||
<?php if ( 'wp_' === $wpdb->prefix ) : ?>
|
||||
<span class="wpsp-status wpsp-status-warning"><code>wp_</code></span>
|
||||
<span class="description"><?php esc_html_e( 'Default prefix - consider changing for new installs', 'wp-security-pack' ); ?></span>
|
||||
<?php else : ?>
|
||||
<span class="wpsp-status wpsp-status-ok"><code><?php echo esc_html( $wpdb->prefix ); ?></code></span>
|
||||
<?php endif; ?>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'Admin Username', 'wp-security-pack' ); ?></th>
|
||||
<td>
|
||||
<?php if ( username_exists( 'admin' ) ) : ?>
|
||||
<span class="wpsp-status wpsp-status-warning"><?php esc_html_e( 'Exists', 'wp-security-pack' ); ?></span>
|
||||
<span class="description"><?php esc_html_e( '"admin" username is commonly targeted', 'wp-security-pack' ); ?></span>
|
||||
<?php else : ?>
|
||||
<span class="wpsp-status wpsp-status-ok"><?php esc_html_e( 'Not found', 'wp-security-pack' ); ?></span>
|
||||
<?php endif; ?>
|
||||
</td>
|
||||
</tr>
|
||||
<?php
|
||||
$custom_login = WP_Security_Pack::get_setting( 'custom_login_url', '' );
|
||||
if ( ! empty( $custom_login ) ) :
|
||||
?>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'Custom Login URL', 'wp-security-pack' ); ?></th>
|
||||
<td>
|
||||
<code><?php echo esc_url( home_url( '/' . $custom_login . '/' ) ); ?></code>
|
||||
<span class="description"><?php esc_html_e( 'Bookmark this!', 'wp-security-pack' ); ?></span>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endif; ?>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<?php
|
||||
// Check for files that expose WordPress version.
|
||||
$readme_exists = file_exists( ABSPATH . 'readme.html' );
|
||||
$license_exists = file_exists( ABSPATH . 'license.txt' );
|
||||
|
||||
if ( $readme_exists || $license_exists ) :
|
||||
?>
|
||||
<div class="wpsp-section">
|
||||
<h2><?php esc_html_e( 'Recommended Actions', 'wp-security-pack' ); ?></h2>
|
||||
<div class="notice notice-warning inline" style="margin: 0 0 15px;">
|
||||
<p><?php esc_html_e( 'These files expose your WordPress version and can be safely removed.', 'wp-security-pack' ); ?></p>
|
||||
</div>
|
||||
<table class="widefat striped">
|
||||
<thead>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'File', 'wp-security-pack' ); ?></th>
|
||||
<th><?php esc_html_e( 'Status', 'wp-security-pack' ); ?></th>
|
||||
<th style="width: 100px;"><?php esc_html_e( 'Action', 'wp-security-pack' ); ?></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<?php if ( $readme_exists ) : ?>
|
||||
<tr>
|
||||
<td><code>readme.html</code></td>
|
||||
<td><span class="wpsp-status wpsp-status-warning"><?php esc_html_e( 'Exists', 'wp-security-pack' ); ?></span></td>
|
||||
<td>
|
||||
<button type="button" class="button button-small wpsp-delete-file" data-file="readme.html">
|
||||
<?php esc_html_e( 'Delete', 'wp-security-pack' ); ?>
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endif; ?>
|
||||
<?php if ( $license_exists ) : ?>
|
||||
<tr>
|
||||
<td><code>license.txt</code></td>
|
||||
<td><span class="wpsp-status wpsp-status-warning"><?php esc_html_e( 'Exists', 'wp-security-pack' ); ?></span></td>
|
||||
<td>
|
||||
<button type="button" class="button button-small wpsp-delete-file" data-file="license.txt">
|
||||
<?php esc_html_e( 'Delete', 'wp-security-pack' ); ?>
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endif; ?>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<script>
|
||||
jQuery(function($) {
|
||||
$('.wpsp-delete-file').on('click', function() {
|
||||
var $btn = $(this);
|
||||
var file = $btn.data('file');
|
||||
|
||||
if (!confirm('<?php echo esc_js( __( 'Delete this file?', 'wp-security-pack' ) ); ?>')) {
|
||||
return;
|
||||
}
|
||||
|
||||
$btn.prop('disabled', true).text('<?php echo esc_js( __( 'Deleting...', 'wp-security-pack' ) ); ?>');
|
||||
|
||||
$.post(ajaxurl, {
|
||||
action: 'wpsp_delete_wp_file',
|
||||
file: file,
|
||||
_ajax_nonce: '<?php echo esc_js( wp_create_nonce( 'wpsp_admin' ) ); ?>'
|
||||
}, function(response) {
|
||||
if (response.success) {
|
||||
$btn.closest('tr').fadeOut();
|
||||
} else {
|
||||
alert(response.data.message || '<?php echo esc_js( __( 'Failed to delete file.', 'wp-security-pack' ) ); ?>');
|
||||
$btn.prop('disabled', false).text('<?php echo esc_js( __( 'Delete', 'wp-security-pack' ) ); ?>');
|
||||
}
|
||||
});
|
||||
});
|
||||
});
|
||||
</script>
|
||||
<?php endif; ?>
|
||||
<?php
|
||||
}
|
||||
|
||||
@@ -1792,8 +1948,23 @@ class WPSP_Admin {
|
||||
<tr>
|
||||
<th scope="row"><?php esc_html_e( 'Last Scan', 'wp-security-pack' ); ?></th>
|
||||
<td>
|
||||
<?php if ( $malware_results['time'] > 0 ) : ?>
|
||||
<?php
|
||||
$scan_stats = get_option( 'wpsp_malware_scan_stats', array() );
|
||||
if ( $malware_results['time'] > 0 ) :
|
||||
?>
|
||||
<?php echo esc_html( human_time_diff( $malware_results['time'] ) . ' ' . __( 'ago', 'wp-security-pack' ) ); ?>
|
||||
<?php if ( ! empty( $scan_stats['files_scanned'] ) ) : ?>
|
||||
<span class="description" style="margin-left: 10px;">
|
||||
<?php
|
||||
printf(
|
||||
/* translators: 1: Number of files, 2: Duration in seconds */
|
||||
esc_html__( '(%1$s files in %2$ss)', 'wp-security-pack' ),
|
||||
esc_html( number_format_i18n( $scan_stats['files_scanned'] ) ),
|
||||
esc_html( $scan_stats['duration'] )
|
||||
);
|
||||
?>
|
||||
</span>
|
||||
<?php endif; ?>
|
||||
<?php else : ?>
|
||||
<?php esc_html_e( 'Never', 'wp-security-pack' ); ?>
|
||||
<?php endif; ?>
|
||||
@@ -1817,11 +1988,12 @@ class WPSP_Admin {
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'File', 'wp-security-pack' ); ?></th>
|
||||
<th><?php esc_html_e( 'Finding', 'wp-security-pack' ); ?></th>
|
||||
<th style="width: 120px;"><?php esc_html_e( 'Actions', 'wp-security-pack' ); ?></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<?php foreach ( $malware_results['results'] as $file => $findings ) : ?>
|
||||
<tr>
|
||||
<tr data-file="<?php echo esc_attr( $file ); ?>">
|
||||
<td><code><?php echo esc_html( str_replace( ABSPATH, '', $file ) ); ?></code></td>
|
||||
<td>
|
||||
<?php foreach ( $findings as $finding ) : ?>
|
||||
@@ -1834,6 +2006,11 @@ class WPSP_Admin {
|
||||
</span>
|
||||
<?php endforeach; ?>
|
||||
</td>
|
||||
<td>
|
||||
<button type="button" class="button button-small wpsp-quarantine-file" data-file="<?php echo esc_attr( $file ); ?>">
|
||||
<?php esc_html_e( 'Quarantine', 'wp-security-pack' ); ?>
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endforeach; ?>
|
||||
</tbody>
|
||||
@@ -1852,6 +2029,41 @@ class WPSP_Admin {
|
||||
<p><?php esc_html_e( 'No malware or suspicious files detected.', 'wp-security-pack' ); ?></p>
|
||||
</div>
|
||||
<?php endif; ?>
|
||||
|
||||
<?php
|
||||
$quarantined_files = $malware_scanner->get_quarantined_files();
|
||||
if ( ! empty( $quarantined_files ) ) :
|
||||
?>
|
||||
<h3 style="margin-top: 20px;"><?php esc_html_e( 'Quarantined Files', 'wp-security-pack' ); ?></h3>
|
||||
<p class="description"><?php esc_html_e( 'Files that have been isolated. They cannot execute from quarantine.', 'wp-security-pack' ); ?></p>
|
||||
<table class="widefat striped" style="margin-top: 10px;">
|
||||
<thead>
|
||||
<tr>
|
||||
<th><?php esc_html_e( 'Original Location', 'wp-security-pack' ); ?></th>
|
||||
<th><?php esc_html_e( 'Quarantined', 'wp-security-pack' ); ?></th>
|
||||
<th><?php esc_html_e( 'Size', 'wp-security-pack' ); ?></th>
|
||||
<th style="width: 180px;"><?php esc_html_e( 'Actions', 'wp-security-pack' ); ?></th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<?php foreach ( $quarantined_files as $name => $meta ) : ?>
|
||||
<tr data-quarantine-name="<?php echo esc_attr( $name ); ?>">
|
||||
<td><code><?php echo esc_html( $meta['relative_path'] ?? $meta['original_name'] ); ?></code></td>
|
||||
<td><?php echo esc_html( human_time_diff( $meta['quarantined_at'] ) . ' ' . __( 'ago', 'wp-security-pack' ) ); ?></td>
|
||||
<td><?php echo esc_html( size_format( $meta['file_size'] ?? 0 ) ); ?></td>
|
||||
<td>
|
||||
<button type="button" class="button button-small wpsp-restore-file" data-name="<?php echo esc_attr( $name ); ?>">
|
||||
<?php esc_html_e( 'Restore', 'wp-security-pack' ); ?>
|
||||
</button>
|
||||
<button type="button" class="button button-small wpsp-delete-quarantined" data-name="<?php echo esc_attr( $name ); ?>" style="color: #a00;">
|
||||
<?php esc_html_e( 'Delete', 'wp-security-pack' ); ?>
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endforeach; ?>
|
||||
</tbody>
|
||||
</table>
|
||||
<?php endif; ?>
|
||||
</div>
|
||||
|
||||
<div class="wpsp-section">
|
||||
@@ -1866,8 +2078,8 @@ class WPSP_Admin {
|
||||
<h3><?php esc_html_e( 'Detection Methods', 'wp-security-pack' ); ?></h3>
|
||||
<table class="widefat striped" style="max-width: 600px;">
|
||||
<tr>
|
||||
<td><strong><?php esc_html_e( 'Hash-based', 'wp-security-pack' ); ?></strong></td>
|
||||
<td><?php esc_html_e( 'Compares file MD5 against database of known malware', 'wp-security-pack' ); ?></td>
|
||||
<td><strong><?php esc_html_e( 'Checksum verification', 'wp-security-pack' ); ?></strong></td>
|
||||
<td><?php esc_html_e( 'Compares core files against WordPress.org checksums', 'wp-security-pack' ); ?></td>
|
||||
<td><span style="color: green;">✓ <?php esc_html_e( '100% accurate', 'wp-security-pack' ); ?></span></td>
|
||||
</tr>
|
||||
<tr>
|
||||
@@ -1875,11 +2087,6 @@ class WPSP_Admin {
|
||||
<td><?php esc_html_e( 'Scans code for suspicious patterns and functions', 'wp-security-pack' ); ?></td>
|
||||
<td><span style="color: orange;">⚠ <?php esc_html_e( 'May have false positives', 'wp-security-pack' ); ?></span></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong><?php esc_html_e( 'Checksum verification', 'wp-security-pack' ); ?></strong></td>
|
||||
<td><?php esc_html_e( 'Compares core files against WordPress.org checksums', 'wp-security-pack' ); ?></td>
|
||||
<td><span style="color: green;">✓ <?php esc_html_e( '100% accurate', 'wp-security-pack' ); ?></span></td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
@@ -1933,6 +2140,86 @@ class WPSP_Admin {
|
||||
location.reload();
|
||||
});
|
||||
});
|
||||
|
||||
// Quarantine file.
|
||||
$('.wpsp-quarantine-file').on('click', function() {
|
||||
var $btn = $(this);
|
||||
var filePath = $btn.data('file');
|
||||
|
||||
if (!confirm('<?php echo esc_js( __( 'Quarantine this file? It will be moved to a safe location and cannot execute.', 'wp-security-pack' ) ); ?>')) {
|
||||
return;
|
||||
}
|
||||
|
||||
$btn.prop('disabled', true).text('<?php echo esc_js( __( 'Moving...', 'wp-security-pack' ) ); ?>');
|
||||
|
||||
$.post(ajaxurl, {
|
||||
action: 'wpsp_quarantine_file',
|
||||
file_path: filePath,
|
||||
_ajax_nonce: '<?php echo esc_js( wp_create_nonce( 'wpsp_admin' ) ); ?>'
|
||||
}, function(response) {
|
||||
if (response.success) {
|
||||
$btn.closest('tr').fadeOut(function() {
|
||||
$(this).remove();
|
||||
location.reload();
|
||||
});
|
||||
} else {
|
||||
alert(response.data.message || '<?php echo esc_js( __( 'Failed to quarantine file.', 'wp-security-pack' ) ); ?>');
|
||||
$btn.prop('disabled', false).text('<?php echo esc_js( __( 'Quarantine', 'wp-security-pack' ) ); ?>');
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// Restore file from quarantine.
|
||||
$('.wpsp-restore-file').on('click', function() {
|
||||
var $btn = $(this);
|
||||
var name = $btn.data('name');
|
||||
|
||||
if (!confirm('<?php echo esc_js( __( 'Restore this file to its original location? Make sure it is safe before restoring.', 'wp-security-pack' ) ); ?>')) {
|
||||
return;
|
||||
}
|
||||
|
||||
$btn.prop('disabled', true).text('<?php echo esc_js( __( 'Restoring...', 'wp-security-pack' ) ); ?>');
|
||||
|
||||
$.post(ajaxurl, {
|
||||
action: 'wpsp_restore_file',
|
||||
quarantine_name: name,
|
||||
_ajax_nonce: '<?php echo esc_js( wp_create_nonce( 'wpsp_admin' ) ); ?>'
|
||||
}, function(response) {
|
||||
if (response.success) {
|
||||
location.reload();
|
||||
} else {
|
||||
alert(response.data.message || '<?php echo esc_js( __( 'Failed to restore file.', 'wp-security-pack' ) ); ?>');
|
||||
$btn.prop('disabled', false).text('<?php echo esc_js( __( 'Restore', 'wp-security-pack' ) ); ?>');
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// Delete quarantined file permanently.
|
||||
$('.wpsp-delete-quarantined').on('click', function() {
|
||||
var $btn = $(this);
|
||||
var name = $btn.data('name');
|
||||
|
||||
if (!confirm('<?php echo esc_js( __( 'Permanently delete this file? This cannot be undone.', 'wp-security-pack' ) ); ?>')) {
|
||||
return;
|
||||
}
|
||||
|
||||
$btn.prop('disabled', true).text('<?php echo esc_js( __( 'Deleting...', 'wp-security-pack' ) ); ?>');
|
||||
|
||||
$.post(ajaxurl, {
|
||||
action: 'wpsp_delete_quarantined',
|
||||
quarantine_name: name,
|
||||
_ajax_nonce: '<?php echo esc_js( wp_create_nonce( 'wpsp_admin' ) ); ?>'
|
||||
}, function(response) {
|
||||
if (response.success) {
|
||||
$btn.closest('tr').fadeOut(function() {
|
||||
$(this).remove();
|
||||
});
|
||||
} else {
|
||||
alert(response.data.message || '<?php echo esc_js( __( 'Failed to delete file.', 'wp-security-pack' ) ); ?>');
|
||||
$btn.prop('disabled', false).text('<?php echo esc_js( __( 'Delete', 'wp-security-pack' ) ); ?>');
|
||||
}
|
||||
});
|
||||
});
|
||||
});
|
||||
</script>
|
||||
<?php
|
||||
@@ -2826,4 +3113,115 @@ class WPSP_Admin {
|
||||
|
||||
wp_send_json_success();
|
||||
}
|
||||
|
||||
/**
|
||||
* AJAX: Quarantine a suspicious file.
|
||||
*/
|
||||
public function ajax_quarantine_file() {
|
||||
check_ajax_referer( 'wpsp_admin' );
|
||||
|
||||
if ( ! current_user_can( 'manage_options' ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$file_path = isset( $_POST['file_path'] ) ? sanitize_text_field( wp_unslash( $_POST['file_path'] ) ) : '';
|
||||
|
||||
if ( empty( $file_path ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'No file specified.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$scanner = new WPSP_Malware_Scanner();
|
||||
$result = $scanner->quarantine_file( $file_path );
|
||||
|
||||
if ( is_wp_error( $result ) ) {
|
||||
wp_send_json_error( array( 'message' => $result->get_error_message() ) );
|
||||
}
|
||||
|
||||
wp_send_json_success( $result );
|
||||
}
|
||||
|
||||
/**
|
||||
* AJAX: Restore a file from quarantine.
|
||||
*/
|
||||
public function ajax_restore_file() {
|
||||
check_ajax_referer( 'wpsp_admin' );
|
||||
|
||||
if ( ! current_user_can( 'manage_options' ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$quarantine_name = isset( $_POST['quarantine_name'] ) ? sanitize_file_name( wp_unslash( $_POST['quarantine_name'] ) ) : '';
|
||||
|
||||
if ( empty( $quarantine_name ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'No file specified.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$scanner = new WPSP_Malware_Scanner();
|
||||
$result = $scanner->restore_file( $quarantine_name );
|
||||
|
||||
if ( is_wp_error( $result ) ) {
|
||||
wp_send_json_error( array( 'message' => $result->get_error_message() ) );
|
||||
}
|
||||
|
||||
wp_send_json_success( $result );
|
||||
}
|
||||
|
||||
/**
|
||||
* AJAX: Delete a quarantined file permanently.
|
||||
*/
|
||||
public function ajax_delete_quarantined() {
|
||||
check_ajax_referer( 'wpsp_admin' );
|
||||
|
||||
if ( ! current_user_can( 'manage_options' ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$quarantine_name = isset( $_POST['quarantine_name'] ) ? sanitize_file_name( wp_unslash( $_POST['quarantine_name'] ) ) : '';
|
||||
|
||||
if ( empty( $quarantine_name ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'No file specified.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$scanner = new WPSP_Malware_Scanner();
|
||||
$result = $scanner->delete_quarantined_file( $quarantine_name );
|
||||
|
||||
if ( is_wp_error( $result ) ) {
|
||||
wp_send_json_error( array( 'message' => $result->get_error_message() ) );
|
||||
}
|
||||
|
||||
wp_send_json_success( $result );
|
||||
}
|
||||
|
||||
/**
|
||||
* AJAX: Delete WordPress info files (readme.html, license.txt).
|
||||
*/
|
||||
public function ajax_delete_wp_file() {
|
||||
check_ajax_referer( 'wpsp_admin' );
|
||||
|
||||
if ( ! current_user_can( 'manage_options' ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Permission denied.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$file = isset( $_POST['file'] ) ? sanitize_file_name( wp_unslash( $_POST['file'] ) ) : '';
|
||||
|
||||
// Only allow specific safe files to be deleted.
|
||||
$allowed_files = array( 'readme.html', 'license.txt' );
|
||||
|
||||
if ( ! in_array( $file, $allowed_files, true ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Invalid file.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
$file_path = ABSPATH . $file;
|
||||
|
||||
if ( ! file_exists( $file_path ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'File not found.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
// phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
|
||||
if ( ! unlink( $file_path ) ) {
|
||||
wp_send_json_error( array( 'message' => __( 'Failed to delete file. Check file permissions.', 'wp-security-pack' ) ) );
|
||||
}
|
||||
|
||||
wp_send_json_success();
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user