';
} else {
$page = "" . $url . "";
}
$event = spbc_format_security_log_event($row->event, $url, $row->page_time);
$country_part = spbc_report_country_part($ips_c, $row->auth_ip);
$ip_blacklist_link = LinkConstructor::buildCleanTalkLink(
// ?utm_source=wordpress&utm_medium=dashboard&utm_campaign=security_log
'settings__security_logs_ip_addresses',
'blacklists/%s'
);
$ip_part = sprintf(
'%s %s',
$row->auth_ip,
IP::reduceIPv6($row->auth_ip),
$country_part
);
$table->items[] = array(
'cb' => $row->id,
'user_login' => $user_part,
'datetime' => date("M d Y, H:i:s", strtotime($row->datetime) + $time_offset),
'event' => $event,
'page' => $page,
'auth_ip' => $ip_part,
'url' => $url,
);
}
// accumulate similar rows
$result = [];
foreach ($table->items as $item) {
$last_item = end($result);
// Get base events without count for comparison
$current_base_event = trim(preg_replace('/\s*\(\d+\)$/', '', $item['event']));
$last_base_event = $last_item ? trim(preg_replace('/\s*\(\d+\)$/', '', $last_item['event'])) : '';
if ($last_item &&
$item['user_login'] === $last_item['user_login'] &&
$current_base_event === $last_base_event &&
$item['url'] === $last_item['url'] &&
$item['auth_ip'] === $last_item['auth_ip']
) {
// Extract current count if exists
if (preg_match('/\((\d+)\)$/', $last_item['event'], $matches)) {
$count = (int)$matches[1] + 1;
} else {
$count = 2;
// Store first datetime when starting to accumulate
$result[count($result) - 1]['datetime'] = $last_item['datetime'] . ' ' . $item['datetime'];
}
// Update last item with new count
$result[count($result) - 1]['event'] = $current_base_event . ' (' . $count . ')';
// Update end of datetime range
$result[count($result) - 1]['datetime'] = preg_replace('/ .*$/', '', $result[count($result) - 1]['datetime']) . ' ' . $item['datetime'];
continue;
}
$result[] = $item;
}
$table->items = $result;
}
}
/**
* Admin callback function - Displays description of 'main' plugin parameters section
* @throws Exception
*/
function spbc_field_security_logs()
{
global $spbc;
echo spbc_get_widget_timeline_code();
echo '
';
/**
* Check if tab is restricted by license, layout according HTML if so.
*/
$feature_state = $spbc->feature_restrictions->getState($spbc, 'security_log');
if (false === $feature_state->is_active) {
echo $feature_state->sanitizedReasonOutput();
echo '
';
return;
}
// HEADER
$message_about_log = __('This table contains details of all brute-force attacks and security actions made in the past 24 hours.', 'security-malware-firewall');
if ( ! $spbc->data["wl_mode_enabled"] ) {
$message_about_log .= sprintf(
esc_html__(' Please, use your %sSecurity Control Panel%s to see the full report.', 'security-malware-firewall'),
'',
''
);
}
echo "
$message_about_log
";
// OUTPUT
$table = new ListTable(spbc_list_table__get_args_by_type('security_logs'));
$table->getData();
// Send logs button
// @ToDo need to return the button and fix its behaviour
/*if ($table->items_total) {
echo '
';
}*/
$table->display();
$link_proceed_to = '';
if (( ! empty($spbc->user_token))) {
/**
* Attention! This link should be hidden by default untill the limit of show more clicks is reached.
*/
$link_proceed_to = TextPlateStatic::render(
'
';
return $out;
}
/**
* @throws Exception
*/
function spbc_field_scanner()
{
global $spbc, $wp_version;
echo '
';
/**
* Check if tab is restricted by license, layout according HTML if so.
*/
$feature_state = $spbc->feature_restrictions->getState($spbc, 'scanner');
if (false === $feature_state->is_active) {
echo $feature_state->sanitizedReasonOutput();
echo '
';
printf(__('Your WordPress version %s is not supported', 'security-malware-firewall'), $wp_version);
echo '
';
// return;
}
echo '
';
echo '';
if (empty($spbc->data['scanner']['last_scan'])) {
_e('System hasn\'t been scanned yet. Please, perform the scan to secure the website.', 'security-malware-firewall');
//should be offset because last_scan is offset
} elseif ($spbc->data['scanner']['last_scan'] < current_time('timestamp') - 86400 * 7) {
_e('System hasn\'t been scanned for a long time', 'security-malware-firewall');
} else {
_e('Look below for scan results.', 'security-malware-firewall');
}
echo '';
echo '';
if (! $spbc->data["wl_mode_enabled"]) {
printf(
__('%sView all scan results for this website%s%s', 'security-malware-firewall'),
"",
'',
', '
);
}
// show save to pdf link
if ( ! empty($spbc->data['scanner']['last_scan'])) {
echo ' '
. __('Export results to PDF', 'security-malware-firewall')
. ', ';
}
//show backups link
printf(
__('%sBackups%s', 'security-malware-firewall'),
' ',
''
);
echo '
';
$scanner_disabled = isset($spbc->errors['configuration']) ? 'disabled="disabled"' : '';
$scanner_disabled_reason = $scanner_disabled
? 'title="' . __('Scanner is disabled. Please, check errors on the top of the settings.', 'security-malware-firewall') . '"'
: '';
echo '
';
if ( ! empty($spbc->data['scanner']['last_scan'])) {
spbc_field_scanner__show_accordion(true);
}
echo '
';
echo ' ';
echo spbc_field_scanner__log();
// Scan results log
if ( ! empty($spbc->data['scanner']['last_scan'])) {
echo ScanningLogFacade::render();
}
echo ' ';
echo spbc_bulk_actions_description();
echo '';
}
add_action('wp_ajax_spbc_analysyis_files_stats__get_html', 'spbc__analysyis_files_stats__get_html');
/**
* Retrieves HTML code block to layout files counters stats in the analysis accordion.
* @return string
*/
function spbc__analysyis_files_stats__get_html()
{
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
$out = '
%s
%s: %d / %d / %d
%s
';
$caption = __('List of files sent for the Cloud analysis, it takes up to 10 minutes to process a file.', 'security-malware-firewall');
$files_stats_string = __('Files sent/checked/unchecked', 'security-malware-firewall');
$data = spbc__analysyis_files_stats__get_data();
$last_updated_chunk = __('Files statuses updates every', 'security-malware-firewall') . ' ' . SPBC_PSCAN_UPDATE_FILES_STATUS_PERIOD . ' seconds';
$last_updated_chunk .= '';
$last_updated_chunk .= $data['last_updated'] && is_int($data['last_updated'])
? ', ' . __('last update time', 'security-malware-firewall') . ': ' . date("M d Y H:i:s", $data['last_updated'])
: '.';
$last_updated_chunk .= '';
$out = sprintf(
$out,
$caption,
$files_stats_string,
$data['files_sent_count'],
$data['files_checked_count'],
$data['files_unchecked_count'],
$last_updated_chunk
);
if (Post::getString('sub_action') === 'give_me_html') {
echo $out;
exit;
}
return $out;
}
/**
* Retrieves the data for analysis stats block.
* @return array
*/
function spbc__analysyis_files_stats__get_data()
{
global $wpdb, $spbc;
$out = array(
'files_sent_count' => 'N/D',
'files_checked_count' => 'N/D',
'files_unchecked_count' => 'N/D',
'last_updated' => false,
);
$files_sent_count = $wpdb->get_var('
SELECT COUNT(*) from ' . SPBC_TBL_SCAN_FILES . '
WHERE last_sent IS NOT NULL;
');
$files_checked_count = $wpdb->get_var('
SELECT COUNT(*) from ' . SPBC_TBL_SCAN_FILES . '
WHERE last_sent IS NOT NULL AND pscan_processing_status = \'DONE\';
');
$files_unchecked_count = !is_null($files_sent_count) && !is_null($files_checked_count)
? (int)$files_sent_count - (int)$files_checked_count
: false;
$last_updated = \CleantalkSP\SpbctWP\Cron::getTask('scanner_update_pscan_files_status');
//next call checking is a trick - the last_call key does not work properly
$last_updated = $last_updated && !empty($last_updated['next_call'])
? $last_updated['next_call'] - $last_updated['period'] + $spbc->data['site_utc_offset_in_seconds']
: false;
$out['files_sent_count'] = !is_null($files_sent_count) ? (int)$files_sent_count : $out['files_sent_count'];
$out['files_checked_count'] = !is_null($files_checked_count) ? (int)$files_checked_count : $out['files_checked_count'];
$out['files_unchecked_count'] = $files_unchecked_count ? : $out['files_unchecked_count'];
$out['last_updated'] = $last_updated ? : $out['last_updated'];
return $out;
}
function spbc_field_scanner__show_accordion($direct_call = false)
{
if ( ! $direct_call) {
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
}
global $spbc;
//analysis log description
$dashboard_link = ! $spbc->data['wl_mode_enabled'] ? sprintf(
__(' at the %s Security Dashboard %s.', 'security-malware-firewall'),
'',
''
) : '';
$analysis_log_description = spbc__analysyis_files_stats__get_html() .
'
' .
'
' .
'' .
' ' .
__('If you feel that the Cloud verdict is incorrect, please click the link "Copy file info" near the file name and contact us', 'security-malware-firewall') . ' ' .
$dashboard_link .
'
' .
'
';
if ($spbc->data['display_scanner_warnings']['analysis'] && !$spbc->data['wl_mode_enabled']) {
$analysis_log_description .= spbc__get_accordion_tab_info_block_html('analysis');
}
//critical description
$critical_description = __('These files contain known vulnerabilities. Immediately cure, quarantine or delete the files!', 'security-malware-firewall');
if ($spbc->data['display_scanner_warnings']['critical'] && !$spbc->data['wl_mode_enabled']) {
$critical_description .= spbc__get_accordion_tab_info_block_html('critical');
}
if ($spbc->settings['scanner__schedule_send_heuristic_suspicious_files'] ) {
$scheduled_count = count(spbc_get_list_of_scheduled_suspicious_files_to_send());
if ( $scheduled_count > 0 ) {
$critical_description .= Escape::escKsesPreset(spbct_get_automatic_files_send_notice_html($scheduled_count), 'spbc_settings__notice_autosend');
}
}
$suspicious_description = __('These files may not contain malicious code, but they use very dangerous PHP functions and constructions! Take a look at files code or send it to the cloud for analyzing.', 'security-malware-firewall');
//unknown files description
$unknown_files_description = __('These files do not include known malware signatures or dangerous code. In same time these files do not belong to the WordPress core or any plugin, theme which are hosted on wordpress.org.', 'security-malware-firewall')
. ' '
. __('To disable this list deactivate the', 'security-malware-firewall')
. ' '
. '"' . __('List unknown files', 'security-malware-firewall') . '"'
. ' '
. __('option', 'security-malware-firewall')
. ' '
. '' . __('here', 'security-malware-firewall') . '.';
$unknown_files_description .= $spbc->data['wl_mode_enabled'] ? '' : spbc__get_accordion_tab_info_block_html('unknown');
//cure log description
$cure_log_description = sprintf(
'
';
$table = new ListTable(spbc_list_table__get_args_by_type('cure_backups'));
$table->getData();
// Pass output if empty and said to do so
if ($table->items_total !== 0) {
echo '
'
. __('All backups that were made during the automatic curing procedure', 'security-malware-firewall')
. '
';
$table->display();
echo "
";
} else {
// This is necessary to display 'No backups found'
$table->display();
}
echo '
';
echo '';
}
function spbc_field_debug_drop()
{
echo '
'
. ' '
. ''
. '
If you don\'t what is this just push the button =)
'
. '
';
}
add_action('wp_ajax_spbc_debug_users_pass_check_run', 'spbc_debug_users_pass_check_run');
function spbc_debug_users_pass_check_run()
{
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
global $wpdb;
// Reset all records so the worker processes them fresh
$wpdb->query("UPDATE {$wpdb->base_prefix}spbc_users_pass SET checked = 0");
// Run the worker directly (synchronous, no cron delay)
\CleantalkSP\SpbctWP\UsersPassCheckModule\UsersPassCheckCron::worker();
// Collect stats after the run
$total = (int) $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->base_prefix}spbc_users_pass");
$checked = (int) $wpdb->get_var("SELECT COALESCE(SUM(checked), 0) FROM {$wpdb->base_prefix}spbc_users_pass");
$leaked = (int) $wpdb->get_var("SELECT COALESCE(SUM(leaked), 0) FROM {$wpdb->base_prefix}spbc_users_pass");
if ($total > 0 && $checked === 0) {
wp_send_json_error('pwnedpasswords.com API unavailable or no pass hashes in table');
}
wp_send_json_success(array(
'total' => $total,
'checked' => $checked,
'leaked' => $leaked,
));
}
function spbc_field_debug_user_pass_check()
{
?>
'
. ' '
. ''
. '';
}
function spbc_field_debug__set_fw_update_cron()
{
global $spbc;
echo '
'
. ' '
. ''
. '
';
}
function spbc_field_debug__set_scan_cron()
{
global $spbc;
echo '
'
. ' '
. ''
. '
';
}
function spbc_field_debug__set_check_vulnerabilities_cron()
{
global $spbc;
echo '
'
. ' '
. ''
. '
';
}
function spbc_field_debug()
{
global $spbc;
$nonce_field = wp_nonce_field('spbc_secret_nonce');
echo ''
. ''
. '';
if ($spbc->debug) {
$debug = get_option(SPBC_DEBUG);
$output = print_r($debug, true);
$output = str_replace("\n", " ", $output);
$output = preg_replace("/[^\S]{4}/", " ", $output);
$spbc->dev_log; // This is the lazy load the `dev_log` property into the State
if ( ! empty($spbc->dev_log) ) {
echo 'Dev log:' . " ";
$dev_log = $spbc->dev_log;
$dev_log_output = print_r($dev_log, true);
$dev_log_output = str_replace("\n", " ", $dev_log_output);
$dev_log_output = preg_replace("/[^\S]{4}/", " ", $dev_log_output);
$output .= $dev_log_output;
}
echo "
";
echo $output
. "" .
"
" .
"
";
echo "
";
}
}
/**
* Admin callback function - Sanitize settings
*
* @param array $settings raw settings array
*
* @return array sanitized settings
*/
function spbc_sanitize_settings($settings)
{
global $spbc;
// Set missing settings.
foreach ($spbc->default_settings as $setting => $value) {
if ( ! isset($settings[ $setting ])) {
$settings[ $setting ] = null;
settype($settings[ $setting ], gettype($value));
}
}
unset($setting, $value);
//Sanitizing traffic_control__autoblock_amount setting
if (isset($settings['traffic_control__autoblock_amount'])) {
$settings['traffic_control__autoblock_amount'] = floor(intval($settings['traffic_control__autoblock_amount']));
$settings['traffic_control__autoblock_amount'] = ($settings['traffic_control__autoblock_amount'] == 0 ? 1000 : $settings['traffic_control__autoblock_amount']);
$settings['traffic_control__autoblock_amount'] = ($settings['traffic_control__autoblock_amount'] < 20 ? 20 : $settings['traffic_control__autoblock_amount']);
}
//Sanitizing bfp__allowed_wrong_auths setting
if (isset($settings['bfp__allowed_wrong_auths'])) {
$settings['bfp__allowed_wrong_auths'] = (int) $settings['bfp__allowed_wrong_auths'];
if ($settings['bfp__allowed_wrong_auths'] < 3) {
$settings['bfp__allowed_wrong_auths'] = $spbc->default_settings['bfp__allowed_wrong_auths'];
}
if ($settings['bfp__allowed_wrong_auths'] > 20) {
$settings['bfp__allowed_wrong_auths'] = 20;
}
}
// XSS: sanitize options
foreach ($settings as &$setting) {
if (is_scalar($setting)) {
$setting = preg_replace('/[<"\'>]/', '', trim((string)$setting));
}
}
// Sanitize URLs for redirect login page
$settings['login_page_rename__name'] = preg_match('@^[a-zA-Z0-9-/]+$@', (string)$settings['login_page_rename__name']) &&
! in_array(
$settings['login_page_rename__name'],
\CleantalkSP\SpbctWP\RenameLoginPage::getForbiddenSlugs(),
true
)
? (string)$settings['login_page_rename__name']
: 'login';
$settings['login_page_rename__name'] = trim($settings['login_page_rename__name'], '/');
$settings['login_page_rename__redirect'] =
preg_match('@^[a-zA-Z0-9-=/]+$@', $settings['login_page_rename__redirect'])
|| $settings['login_page_rename__redirect'] === ''
? (string)$settings['login_page_rename__redirect']
: '';
$settings['login_page_rename__redirect'] = trim($settings['login_page_rename__redirect'], '/');
// Sanitize URLs for technical support link
$settings['edit_tech_support_url__link'] = preg_match('@^[a-zA-Z0-9-/]+$@', (string)$settings['edit_tech_support_url__link'])
? (string)$settings['edit_tech_support_url__link']
: '';
$settings['edit_tech_support_url__link'] = trim($settings['edit_tech_support_url__link'], '/');
// Clearing the link if the edit_tech_support_url__remove flag is set
if ($settings['edit_tech_support_url__remove']) {
$settings['edit_tech_support_url__link'] = '';
}
// Send email notification to admin if about changing login URL
if (
empty($spbc->settings['login_page_rename__enabled']) &&
$settings['login_page_rename__enabled'] &&
($settings['login_page_rename__send_email_notification'] && current_user_can('activate_plugins'))
) {
$mail = wp_mail(
spbc_get_admin_email(),
$spbc->data["wl_brandname"] . esc_html__(': New login URL', 'security-malware-firewall'),
sprintf(
esc_html__('New login URL is: %s', 'security-malware-firewall'),
\CleantalkSP\SpbctWP\RenameLoginPage::getURL($settings['login_page_rename__name'])
)
. "\n\n"
. esc_html__('Please, make sure that you will not forget the URL!', 'security-malware-firewall')
);
// If email is not sent, disabling the feature
if ( !$mail ) {
$spbc->error_add(
'login_page_rename',
__('Can not send notification email to the admin address. New login URL was not sent. Changes aborted.', 'security-malware-firewall')
);
$settings['login_page_rename__enabled'] = '0';
} else {
$spbc->error_delete('login_page_rename');
}
}
if (!$settings['login_page_rename__send_email_notification']) {
$spbc->error_delete('login_page_rename', true);
}
// Send logs for 2 previous days
if ($settings['misc__backend_logs_enable'] && ! $spbc->settings['misc__backend_logs_enable']) {
//neither we show this in the UI, method spbc_PHP_logs__collect use time() value to collect logs correct
$spbc->data['last_php_log_sent'] = time() - 86400 * 2;
$spbc->save('data');
}
// Scanner custom start time logic
if (
empty($spbc->errors['configuration']) &&
$settings['scanner__auto_start_manual_time'] &&
$settings['scanner__auto_start_manual_time'] != $spbc->settings['scanner__auto_start_manual_time']
) {
//if ( empty($spbc->errors['configuration']) ) {
$scanner_launch_data = spbc_get_custom_scanner_launch_data(false, $settings);
\CleantalkSP\SpbctWP\Cron::updateTask(
'scanner__launch',
'spbc_scanner__launch',
$scanner_launch_data['period'],
$scanner_launch_data['start_time']
);
}
// Sanitizing website mirrors
if ($settings['scanner__outbound_links_mirrors']) {
if (preg_match('/^[\sa-zA-Z0-9,_\.\-\~]+$/', $settings['scanner__outbound_links_mirrors'])) {
$tmp = explode(',', $settings['scanner__outbound_links_mirrors']);
$mirrors = array();
foreach ($tmp as $key => $value) {
$value = trim($value);
if ( ! empty($value)) {
$mirrors[ $key ] = trim($value);
}
}
unset($key, $value);
$settings['scanner__outbound_links_mirrors'] = implode(', ', $mirrors);
}
}
// Sanitizing scanner dirs exceptions
if ($settings['scanner__path_exclusions_view']) {
$pathExclusion = new FilesScanPathExclusion();
$settings['scanner__path_exclusions_view'] = $pathExclusion->pathExclusionsView($settings['scanner__path_exclusions_view']);
$settings['scanner__path_exclusions'] = $pathExclusion->pathExclusions($settings['scanner__path_exclusions_view']);
} else {
update_option('spbc_upload_dirs_stat', array());
}
// Sanitizing frontend scanner URL exclusions
if ($settings['scanner__frontend_analysis__domains_exclusions_view']) {
$domainExclusion = new \CleantalkSP\SpbctWP\Settings\FrontendScanDomainExclusion();
$domainExclusionView = $domainExclusion->frontendScanDomainExclusionsView($settings['scanner__frontend_analysis__domains_exclusions_view']);
$settings['scanner__frontend_analysis__domains_exclusions_view'] = $domainExclusionView;
$domainExclusionSets = $domainExclusion->domainExclusions($settings['scanner__frontend_analysis__domains_exclusions_view']);
$settings['scanner__frontend_analysis__domains_exclusions'] = $domainExclusionSets;
$domainExclusion->resetScannerFrontendResult($settings);
}
if ($settings['scanner__path_exclusions_view'] || $settings['scanner__frontend_analysis__domains_exclusions_view']) {
SpbcCron::updateTask(
'update_scan_settings_exclusions',
'spbc_update_scan_settings_exclusions',
FilesScanPathExclusion::EXTERNAL_SOURCE_UPDATE_PERIOD
);
}
if ($settings['scanner__fs_watcher__snapshots_period']) {
SpbcCron::updateTask('fswatcher_do_work', 'spbc_cron__fs_watcher_do_work', $settings['scanner__fs_watcher__snapshots_period']);
}
// Sanitizing API key
$settings['spbc_key'] = trim($settings['spbc_key']);
$settings['spbc_key'] = preg_match('/^[a-z\d]*$/', $settings['spbc_key']) ? $settings['spbc_key'] : $spbc->settings['spbc_key']; // Check key format a-z\d
$settings['spbc_key'] = is_main_site() || $spbc->ms__work_mode != 2 ? $settings['spbc_key'] : $spbc->network_settings['spbc_key'];
$spbc->data['key_changed'] = $settings['spbc_key'] !== $spbc->settings['spbc_key'];
$spbc->data['key_is_ok'] = spbc_api_key__is_correct($settings['spbc_key']);
if ($settings['spbc_key'] === '' && $spbc->data['key_changed']) {
$spbc = spbc_drop_to_defaults_on_key_clearance($spbc);
\CleantalkSP\SpbctWP\Cron::removeAllTasks();
}
$spbc->save('data');
if ($spbc->is_network && $spbc->is_mainsite) {
// @todo Should check unset settings because some hook is saving settings twice
$spbc->network_settings['spbc_key'] = $settings['spbc_key'];
if (isset($settings['ms__hoster_api_key'])) {
$spbc->network_settings['ms__hoster_api_key'] = $settings['ms__hoster_api_key'];
unset($settings['ms__hoster_api_key']);
}
if (isset($settings['ms__work_mode'])) {
$spbc->network_settings['ms__work_mode'] = $settings['ms__work_mode'];
unset($settings['ms__work_mode']);
}
$spbc->save('network_settings');
$spbc->network_data = array(
'key_is_ok' => $spbc->data['key_is_ok'],
'user_token' => isset($spbc->data['user_token']) ? $spbc->data['user_token'] : '',
'service_id' => isset($spbc->data['service_id']) ? $spbc->data['service_id'] : '',
'moderate' => $spbc->data['moderate'],
);
$spbc->save('network_data');
}
if (isset($settings['2fa__enable'])) {
if ($settings['2fa__enable'] == 1 || $settings['2fa__enable'] == -1) {
$code2fa = get_site_option('spbc_confirmation_code');
if (isset($code2fa['verified']) && $code2fa['verified'] === false) {
$settings['2fa__enable'] = 0;
}
}
if ($settings['2fa__enable'] == 0) {
delete_site_option('spbc_confirmation_code');
}
}
if (
isset($settings['check_pass__enable']) &&
$settings['check_pass__enable'] == '0' &&
empty($settings['check_pass__roles']) &&
! empty($spbc->settings['check_pass__roles'])
) {
$settings['check_pass__roles'] = $spbc->settings['check_pass__roles'];
}
/**
* Triggered before returning the settings
*/
do_action('spbc_before_returning_settings', $settings);
// Try to add|remove content to .htaccess file
if ($settings['wp__upload_dir_prevent_php_execution'] !== $spbc->settings['wp__upload_dir_prevent_php_execution']) {
SpbcCron::updateTask('upload_dir_prevent_php_execution', 'spbc_upload_dir_prevent_php_execution', 86400, time() + 60);
}
return $settings;
}
/**
* Whether the current AJAX request comes from the React signup wizard.
*
* @return bool
*/
function spbc_settings__is_wizard_ajax_request()
{
return Post::getInt('spbct_wizard_request') === 1;
}
//Get auto key button
function spbc_get_key_auto($direct_call = false)
{
if ( ! $direct_call) {
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
}
global $spbc;
$website = parse_url(get_option('home'), PHP_URL_HOST) . parse_url(get_option('home'), PHP_URL_PATH);
$platform = 'wordpress';
$user_ip = \CleantalkSP\SpbctWP\Helpers\IP::get();
$timezone = Post::getString('ct_admin_timezone');
$language = \CleantalkSP\Variables\Server::getString('HTTP_ACCEPT_LANGUAGE');
/** @psalm-suppress RedundantCondition */
$wpms = SPBC_WPMS && defined('SUBDOMAIN_INSTALL') && ! SUBDOMAIN_INSTALL;
$white_label = false;
$hoster_api_key = $spbc->ms__hoster_api_key;
$admin_email = Post::getString('email') ? Post::getString('email') : spbc_get_admin_email();
/**
* Filters the email to get API key
*
* @param string email to get API key
*/
$filtered_admin_email = apply_filters('spbc_get_api_key_email', $admin_email);
$filtered_admin_email = filter_var($filtered_admin_email, FILTER_VALIDATE_EMAIL);
// Mark the registrations made by the Connect button of the setup wizard
$lead_source = spbc_settings__is_wizard_ajax_request() ? 'spbct_wizard_auto' : '';
$result = API::method__get_api_key(
'security',
$filtered_admin_email,
$website,
$platform,
$timezone,
$language,
$user_ip,
$wpms,
$white_label,
$hoster_api_key,
$lead_source
);
if ( ! empty($result['error'])) {
$spbc->data['key_is_ok'] = false;
$spbc->error_add('get_key', $result);
$out = array(
'success' => false,
'msg' => isset($result['error_message'])
? esc_html($result['error_message'])
: $result['error']
);
} elseif (isset($result['error_no']) && $result['error_no'] == '403') {
$out = array(
'success' => false,
'error' => isset($result['error_message'])
? esc_html($result['error_message'])
: esc_html('Our service is not available in your region.'),
);
} elseif ( ! isset($result['auth_key'])) {
$out = array(
'success' => false,
'msg' => sprintf(
__('Please, get the Access Key from %s CleanTalk Control Panel %s and insert it in the Access Key field', 'cleantalk-spam-protect'),
'',
''
)
);
} else {
$user_token = ! empty($result['user_token']) ? $result['user_token'] : '';
spbc_save_key($result['auth_key'], $user_token, true);
$templates = \CleantalkSP\SpbctWP\CleantalkSettingsTemplates::get_options_template($result['auth_key']);
if ( ! empty($templates)) {
$templatesObj = new \CleantalkSP\SpbctWP\CleantalkSettingsTemplates($result['auth_key']);
$out = array(
'success' => true,
'getTemplates' => $templatesObj->getHtmlContent(true),
);
} else {
$out = array(
'success' => true
);
}
}
if ($direct_call) {
return $result;
}
die(json_encode($out));
}
function spbc_save_key($apikey, $user_token = '', $direct_call = false)
{
global $spbc;
// if ajax - run full check with notice_paid_till
if ( ! $direct_call ) {
$nonce_check = spbc_check_ajax_referer('spbc_secret_nonce', 'security', false);
try {
$apikey = trim(Post::getString('apiKey'));
$apikey = spbc_validate_ajax_access_key($apikey, $nonce_check);
} catch (\Exception $e) {
die(
json_encode(
[
'success' => false,
'msg' => sprintf(
__('Access Key validation error: %s', 'security-malware-firewall'),
sanitize_text_field($e->getMessage())
)
]
)
);
}
}
//run main saving flow
$settings['spbc_key'] = trim($apikey);
$settings['spbc_key'] = preg_match('/^[a-z\d]*$/', $settings['spbc_key']) ? $settings['spbc_key'] : $spbc->settings['spbc_key']; // Check key format a-z\d
$settings['spbc_key'] = is_main_site() || $spbc->ms__work_mode != 2 ? $settings['spbc_key'] : $spbc->network_settings['spbc_key'];
$spbc->settings['spbc_key'] = $settings['spbc_key'];
$spbc->save('settings');
$spbc->data['user_token'] = ! empty($user_token) ? $user_token : '';
$spbc->data['key_is_ok'] = spbc_api_key__is_correct($settings['spbc_key']);
$spbc->data['key_changed'] = true;
$spbc->save('data');
//die if ajax
if ( ! $direct_call ) {
die(
json_encode(
['success' => true]
)
);
}
}
/**
* Validation function for AJAX inserted apikey.
* Runs provided nonce state check, rate limit check, and main check flow via notice_paid_till.
* @param string $apikey
* @param bool $nonce_check
* @return string provided apikey if no errors
* @throws Exception on any step failed, the message contains a reason.
*/
function spbc_validate_ajax_access_key($apikey, $nonce_check)
{
//validate nonce
if (!$nonce_check) {
$error_msg = __('invalid nonce or permissions.', 'security-malware-firewall');
throw new \Exception($error_msg);
}
//run rate limiter check
$config = new RateLimiterConfig('ajax_key_validation_call', 3, 30);
$rate_limiter = new SpbcRateLimiter($config);
$rate_passed = $rate_limiter->checkPassed();
if (!$rate_passed) {
$error_msg = __('you have made too many requests. Please, try again later.', 'security-malware-firewall');
throw new \Exception($error_msg);
}
//run notice paid till and other checks
$key_full_validation = spbc_validate_access_key($apikey);
$validation_errors = !empty($key_full_validation['errors'])
? $key_full_validation['errors']
: [];
if (!empty($validation_errors)) {
$error_msg = __('unknown error.', 'security-malware-firewall');
if (is_array($validation_errors)) {
$error_msg = implode(', ', $validation_errors);
}
throw new \Exception($error_msg);
}
return $apikey;
}
function spbc_settings__spbc_create_support_user($direct_call = false)
{
if ( ! $direct_call) {
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
}
$support_user = new \CleantalkSP\SpbctWP\SupportUser();
$result = $support_user->ajaxProcess();
wp_send_json($result);
}
function spbc_show_more_security_logs_callback()
{
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
// PREPROCESS INPUT
$args = spbc_list_table__get_args_by_type('security_logs');
$args['sql']['limit_force'] = Post::getInt('amount') ?: SPBC_LAST_ACTIONS_TO_VIEW;
// OUTPUT
$table = new ListTable($args);
$table->getData();
die(
json_encode(
array(
'html' => $table->displayRows(null, 'return'),
'size' => $table->items_count,
'total' => $table->items_total,
)
)
);
}
function spbc_get_hostnames_by_ips_callback()
{
global $wpdb;
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
if ( ! function_exists('gethostbyaddr') ) {
die(
json_encode(
array(
'success' => false,
'hostnames' => [],
)
)
);
}
// validate ips — table stores IPv4 as unsigned int; IPv6 cannot use ip2long()
$ips = Post::getArray('ips');
if (empty($ips)) {
wp_send_json_error('IPs are required.');
}
$ips = array_map(function ($ip) {
return trim($ip);
}, $ips);
$ips = array_unique($ips);
$ips = array_filter($ips, function ($ip) {
return IP::validate($ip) === 'v4';
});
$ips = array_map(function ($ip) {
return (int) sprintf('%u', ip2long($ip));
}, $ips);
$ips = array_values(array_unique(array_filter($ips)));
if (!empty($ips)) {
// check in db
$hostnames = $wpdb->get_results(
$wpdb->prepare(
"SELECT network, hostname FROM " . SPBC_TBL_SECURITY_LOG_HOSTNAMES . " WHERE network IN (" . implode(',', array_fill(0, count($ips), '%d')) . ")",
$ips
),
ARRAY_A
);
} else {
die(
json_encode(
array(
'success' => false,
'hostnames' => [],
)
)
);
}
// separate new ips (cast DB values to int for strict comparison)
$known_networks = array_map('intval', array_column($hostnames, 'network'));
$new_ips = array_values(array_diff($ips, $known_networks));
// Get hostname by IPs using gethostbyaddr
if ( ! empty($new_ips) ) {
$new_hostnames = array();
foreach ($new_ips as $ip) {
$new_ip = long2ip($ip);
$new_hostname = gethostbyaddr($new_ip);
if ($new_hostname == $new_ip) {
$new_hostname = '';
}
$new_hostnames[] = array(
'network' => $ip,
'hostname' => $new_hostname
);
}
// write to db new hostnames (IGNORE races / already-cached rows)
$values = array();
foreach ($new_hostnames as $row) {
$values[] = $wpdb->prepare("(%d, %s)", $row['network'], $row['hostname']);
}
// @psalm-suppress WpdbUnsafeMethodsIssue
$wpdb->query(
"INSERT IGNORE INTO " . SPBC_TBL_SECURITY_LOG_HOSTNAMES . " (network, hostname) VALUES " . implode(',', $values)
);
for ($i = 0; $i < count($new_hostnames); $i++) {
$new_hostnames[$i]['network'] = long2ip($new_hostnames[$i]['network']);
}
}
if (isset($new_hostnames) && is_array($new_hostnames)) {
$hostnames = array_merge($hostnames, $new_hostnames);
}
foreach ($hostnames as &$hostname) {
if (is_numeric($hostname['network'])) {
$hostname['network'] = long2ip($hostname['network']);
}
}
unset($hostname);
die(
json_encode(
array(
'success' => true,
'hostnames' => $hostnames,
)
)
);
}
function spbc_tc__filter_ip()
{
global $spbc;
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
$ip = Post::getString('ip'); // validation is done next line
$status = Post::getString('status');
if ( IP::validate($ip) === false ) {
wp_send_json_error('IP is not correct.');
}
if ( $status !== 'allow' && $status !== 'deny' ) {
wp_send_json_error('Status is not correct.');
}
// Add to the personal lists to the Cloud
$res_cloud = API::method__private_list_add($spbc->user_token, $ip, $spbc->data['service_id'], ['status' => $status]);
if ( isset($res_cloud['records']) && is_array($res_cloud['records']) ) {
foreach ( $res_cloud['records'] as $record ) {
if ( $record['operation_status'] === 'FAILED' ) {
wp_send_json_error('API: adding IP ' . $record['record'] . ' failed: ' . $record['operation_message']);
}
}
} else {
wp_send_json_error('API wrong answer.');
}
// Add to the local database
$status_for_db = $status === 'allow' ? '1' : '0';
$version = IP::validate($ip);
if ( $version === 'v4' ) {
$data[] = ip2long($ip) . ',' . ip2long('255.255.255.255') . ',' . $status_for_db;
} elseif ( $version === 'v6' ) {
$data[] = $ip . ',' . '128' . ',' . $status_for_db;
} else {
wp_send_json_error('Local database: adding IP ' . $ip . ' failed: ip does not look like a valid IP address');
}
try {
$res_local = spbct_sfw_private_records_handler('add', json_encode($data, JSON_FORCE_OBJECT));
wp_send_json_success($res_local);
} catch (\Exception $e) {
wp_send_json_error('Local database: adding IP ' . $ip . ' failed: ' . $e->getMessage());
}
}
/**
* @return void
*/
function spbc_settings__get_description()
{
global $spbc;
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
if (!isset($_POST['setting_id'])) {
return;
}
$setting_id = str_replace(' ', '_', $_POST['setting_id']);
$tc_learn_more_link = ! $spbc->data["wl_mode_enabled"]
? '
'
: '';
$descriptions = array(
'secfw__enabled' => array(
'title' => __('Security FireWall', 'security-malware-firewall'),
'desc' => __('Security FireWall is a part of the security service and blocks a malicious active before the site pages load.', 'security-malware-firewall')
),
'waf__xss_check' => array(
'title' => __('XSS check', 'security-malware-firewall'),
'desc' => __('Cross-Site Scripting (XSS) — prevents malicious code to be executed/sent to any user. As a result malicious scripts can not get access to the cookie files, session tokens and any other confidential information browsers use and store. Such scripts can even overwrite content of HTML pages. ' . $spbc->data["wl_company_name"] . ' WAF monitors for patterns of these parameters and block them.', 'security-malware-firewall')
),
'waf__sql_check' => array(
'title' => __('SQL-injection check', 'security-malware-firewall'),
'desc' => __('SQL Injection — one of the most popular ways to hack websites and programs that work with databases. It is based on injection of a custom SQL code into database queries. It could transmit data through GET, POST requests or cookie files in an SQL code. If a website is vulnerable and execute such injections then it would allow attackers to apply changes to the website\'s MySQL database.', 'security-malware-firewall')
),
'upload_checker__file_check' => array(
'title' => __('Check uploaded files', 'security-malware-firewall'),
'desc' => __('The option checks each uploaded file to a website for malicious code. If it\'s possible for visitors to upload files to a website, for instance a work resume, then attackers could abuse it and upload an infected file to execute it later and get access to your website.', 'security-malware-firewall')
),
'traffic_control__enabled' => array(
'title' => __('Traffic Control', 'security-malware-firewall'),
'desc' => __('It analyzes quantity of requests towards website from any IP address for a certain period of time. For example, for an ordinary visitor it\'s impossible to generate 2000 requests within 1 hour. Big amount of requests towards website from the same IP address indicates that there is a high chance of presence of a malicious program.', 'security-malware-firewall')
. $tc_learn_more_link
),
'scanner__outbound_links' => array(
'title' => __('Scan links', 'security-malware-firewall'),
'desc' => __('This option allows you to know the number of outgoing links on your website and website addresses they lead to. These websites addresses will be checked with the ' . $spbc->data["wl_company_name"] . ' Database and the results will show if they were used in spam messages. The option\'s purpose is to check your website and find hidden, forgotten and spam links. You should always remember if you have links to other websites which have a bad reputation, it could affect your visitors\' trust and your SEO.', 'security-malware-firewall')
),
'scanner__heuristic_analysis' => array(
'title' => __('Heuristic analysis', 'security-malware-firewall'),
'desc' => __('Often, authors of malicious code disguise their code which makes it difficult to identify it by their signatures. The malicious code itself can be placed anywhere on the site, for example the obfuscated PHP-code in the "logo.png" file, and the code itself is called by one inconspicuous line in "index.php". Therefore, the usage of plugins to search for malicious code is preferable. Heuristic analysis can indicate suspicious PHP constructions in a file that you should pay attention to.', 'security-malware-firewall')
),
'scanner__schedule_send_heuristic_suspicious_files' => array(
'title' => __('Auto-send suspicious files for analysis', 'security-malware-firewall'),
'desc' => __('Automatic schedule suspicious files to send for analysis. Make note, if the file contains a malware signature, the file will not be sent, because this case is definitely a malware.', 'security-malware-firewall')
),
'scanner__signature_analysis' => array(
'title' => __('Signature analysis', 'security-malware-firewall'),
'desc' => __('Code signatures — it\'s a code sequence a malicious program consists of. Signatures are being added to the database after analysis of the infected files. Search for such malicious code sequences is performed in scanning by signatures. If any part of code matches a virus code from the database, such files would be marked as critical.', 'security-malware-firewall')
),
'scanner__binary_analysis' => array(
'title' => __('Binary analysis', 'security-malware-firewall'),
'desc' => __('Search for suspicious binary patterns in files.', 'security-malware-firewall')
),
'scanner__auto_cure' => array(
'title' => __('Cure malware', 'security-malware-firewall'),
'desc' => __('It cures infected files automatically if the scanner knows cure methods for these specific cases. If the option is disabled then when the scanning process ends you will be presented with several actions you can do to the found files: Cure. Malicious code will be removed from the file. Replace. The file will be replaced with the original file. Delete. The file will be put in quarantine. Do nothing. Before any action is chosen, backups of the files will be created and if the cure is unsuccessful it\'s possible to restore each file.', 'security-malware-firewall')
),
'misc__backend_logs_enable' => array(
'title' => __('Collect and send PHP logs', 'security-malware-firewall'),
'desc' => __('To control appearing errors you have to check log file of your hosting account regularly. It\'s inconvenient and just a few webmasters pay attention to it. Also, errors could appear for a short period of time and only when one specific function is running, they can\'t be spotted in other circumstances so it\'s hard to catch them. PHP errors tell you that some of your website functionality doesn\'t work correctly, furthermore hackers may use these errors to get access to your website. The ' . $spbc->data["wl_company_name"] . ' Scanner will check your website backend once per hour. Statistics of errors is available in your ' . $spbc->data["wl_company_name"] . ' Dashboard.', 'security-malware-firewall')
),
'vulnerability_check__enable_cron' => array(
'title' => __('Test installed plugins for known vulnerabilities', 'security-malware-firewall'),
'desc' => __('All the data about vulnerability statuses will be saved. If a known vulnerability found plugin informs you in Dashboard about details and gives instructions. Also, if appropriated setting below is enabled, you will be informed about the status on the modules page', 'security-malware-firewall')
),
'vulnerability_check__test_before_install' => array(
'title' => __('Test plugins for known vulnerabilities before install them', 'security-malware-firewall'),
'desc' => __('The plugin will request the vulnerability check over research.cleantalk.org for all the plugins listed on the installation page. If the appropriated data received, you will be earned about the result.', 'security-malware-firewall')
),
'misc__prevent_logins_collecting' => array(
'title' => __('Prevent collecting of authors logins', 'security-malware-firewall'),
'desc' => __('The option helps to hide the name of the author of articles on the site pages. This helps protect against login parsing, spam, and brute force.', 'security-malware-firewall')
. $logins_collecting_learn_mode_links
),
'misc__prevent_logins_collecting_on_password_reset' => array(
'title' => __('Prevent collecting of login on password reset error', 'security-malware-firewall'),
'desc' => __('The option exclude the info about the login existing on password change error. Error message will be replaced with followed text:', 'security-malware-firewall')
. '
'
),
'data__set_cookies' => array(
'title' => __('Set cookies', 'security-malware-firewall'),
'desc' => __('Part of the CleanTalk FireWall functions depend on cookie files, so disabling this option could lead to deceleration of the firewall work. It will affect user identification who are logged in right now. Traffic Control will not be able to determine authorized users and they could be blocked when the request limit is reached. We do not recommend to disable this option without serious reasons. However, you should disable this option is you\'re using Varnish.', 'security-malware-firewall')
),
'2fa__enable' => array(
'title' => __('Two factor authentication for administrators', 'security-malware-firewall'),
'desc' => __('Two-Factor Authentication for WordPress admin accounts will improve your website security and make it safer, if not impossible, for hackers to breach your WordPress account. Two-Factor Authentication works via e-mail. Authentication code will be sent to your admin email. When authorizing, a one-time code will be sent to your email. While entering the code, make sure that it does not contain spaces. With your first authorization, the ' . $spbc->data["wl_company_name"] . ' Security plugin remembers your browser and you won’t have to input your authorization code every time anymore. However, if you started to use a new device or a new browser then you are required to input your authorization code. The plugin will remember your browser for 30 days.', 'security-malware-firewall')
. $two_fa_learn_more_link
),
'check_pass__enable' => array(
'title' => __('Checking the user\'s password for information leaks', 'security-malware-firewall'),
'desc' => __("This feature helps enhance your website's security by continuously monitoring users' passwords for any potential exposure in known data breaches. With the increasing number of leaked password databases available on the dark web, it's critical to ensure that no user accounts are compromised. By enabling this feature, the CleanTalk Security plugin will automatically cross-check all user passwords against a regularly updated list of compromised credentials. Each time a password leak is detected, the plugin will alert the administrator and recommend a password reset for the affected user. This ensures that any compromised credentials are immediately addressed, reducing the risk of unauthorized access to your WordPress site. The feature works in the background, requiring no action from users unless a leak is detected. This periodic check is fully automated, and the plugin will ensure that users are notified only when necessary. It's a proactive measure to prevent potential attacks and to keep your website safe from the consequences of data breaches. By enabling this feature, you're taking an extra step in protecting your WordPress site from potential threats caused by compromised user passwords.", 'security-malware-firewall')
),
'data__additional_headers' => array(
'title' => __('Additional Headers', 'security-malware-firewall'),
'desc' => __('"X-Content-Type-Options" improves the security of your site (and your users) against some types of drive-by-downloads. "X-XSS-Protection" header improves the security of your site against some types of XSS (cross-site scripting) attacks.', 'security-malware-firewall') .
' ' . esc_html__('"Strict-Transport-Security" response header (often abbreviated as HSTS) informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS.', 'security-malware-firewall') .
' ' . esc_html__('"Referrer-Policy" make the `Referer` http-header transferring more strictly.', 'security-malware-firewall')
),
'misc_disable_file_editor' => array(
'title' => __('Disable File Editor', 'security-malware-firewall'),
'desc' => __('By prohibiting file editing, you protect the site from malicious attacks that may try to change the code and gain access to the site or steal confidential information', 'security-malware-firewall')
),
'wp__disable_xmlrpc' => array(
'title' => __('Disable XML-RPC', 'security-malware-firewall'),
'desc' => __('XML-RPC is an out-of-date technology that can compromise websites. It is still enabled by default in WordPress for the purpose of reverse compatibility for some parts of information systems like old apps on phones and tablets. Please, make sure that you don\'t use such obsolete systems. If you don\'t know anything about it it\'s a good practice to enable this option and disable the XML-RPC.
Enabled XML-RPC could give hackers a possibility to brute-force your website credentials and access your website.', 'security-malware-firewall')
),
'ms__work_mode' => array(
'title' => __('WordPress Multisite Work Mode', 'security-malware-firewall'),
'desc' => __(
'
Mutual Account, Individual Access Keys
'
. 'Each blog uses a separate key from the network administrator account. Each blog has its own separate security log, settings, personal lists. Key will be provided automatically to each blog once it is created or during the plugin activation process. The key could be changed only by the network administrator.'
. '
Mutual Account, Mutual Access Key
'
. 'All blogs use one mutual key. They also share security logs, settings and personal lists with each other. Network administrator holds the key.'
. '
Individual accounts, individual Access keys
'
. 'Each blog uses its own account and its own key. Separate security logs, settings, personal lists. Blog administrator can change the key on his own.',
'security-malware-firewall'
)
),
'ms__hoster_api_key' => array(
'title' => __('Hoster access key', 'security-malware-firewall'),
'desc' => __('You could find it here: Press on the screenshot to zoom.', 'security-malware-firewall')
),
'listing' => array(
'title' => __('Directory can be listed from the Internet', 'security-malware-firewall'),
'desc' => __('The listing of a directory allows an attacker to see the files inside the folder and the very existence of the folder. So if he sees ".git" folder is open for the listing, he can assume that you are using GIT technology and could exploit the known security issues to hack the website.', 'security-malware-firewall')
),
'accessible' => array(
'title' => __('File is accessible from the Internet', 'security-malware-firewall'),
'desc' => __('Anyone who knows the location of the file could download its content. This could sound pretty harmless, but in fact if this file is an error log, the attacker could identify the modules and plugins you are using and get some additional info about his hack attempts.', 'security-malware-firewall')
),
'action_shuffle_salts' => array(
'title' => 'Shuffle Salts',
'desc' => __('WordPress secret keys and salts are a random set of symbols that are being used in encrypting the
usernames and passwords that are being stored in the browser cookies. If the site has been hacked,
all data on the site can be considered compromised. One of the first important recommendations is
to change all passwords and security keys. If hackers have the security keys, they can regain
access to the site even if the passwords have been changed. It is very important to change each
security key along with the passwords when the malicious code is removed.', 'security-malware-firewall')
),
'dbd_found' => array(
'title' => 'Drive by Download',
'desc' => __('Unintentional loading of data from an external source is possible', 'security-malware-firewall')
),
'redirect_found' => array(
'title' => 'Redirects',
'desc' => __('An unexpected redirect to another resource is possible', 'security-malware-firewall')
),
'csrf' => array(
'title' => 'CSRF',
'desc' => __('Code found that can be used for csrf attacks', 'security-malware-firewall')
),
'signature' => array(
'title' => 'Signatures',
'desc' => __('Search for malicious code using the Cleantalk signature database', 'security-malware-firewall')
),
'signatures_XSS' => array(
'title' => 'XSS attack',
'desc' => __('Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are
injected into otherwise benign and trusted websites.', 'security-malware-firewall')
),
'signatures_SQL_INJECTION' => array(
'title' => 'SQL injection',
'desc' => __('SQL injection is a code injection technique that might destroy your database.', 'security-malware-firewall')
),
'signatures_EXPLOIT' => array(
'title' => 'Exploit',
'desc' => __('An exploit is a piece of software, a chunk of data, or a sequence of commands that takes
advantage of a bug or vulnerability to cause unintended or unanticipated behavior to occur on
computer software, hardware, or something electronic (usually computerized).', 'security-malware-firewall')
),
'signatures_SUSPICIOUS' => array(
'title' => 'Suspicious',
'desc' => __('The code looks suspicious. Make sure it is safe.', 'security-malware-firewall')
),
'signatures_MALWARE' => array(
'title' => 'Malware',
'desc' => __('Malware has been found during the signature analysis.', 'security-malware-firewall')
),
'heuristic_assert' => array(
'title' => 'assert()',
'desc' => __('Using the function in production is not recommended', 'security-malware-firewall')
),
'heuristic_eval' => array(
'title' => 'eval()',
'desc' => __('The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged.', 'security-malware-firewall')
),
'heuristic_create_function' => array(
'title' => 'create_function()',
'desc' => __('This function internally performs an eval() and as such has the same security issues as eval().', 'security-malware-firewall')
),
'heuristic_system' => array(
'title' => 'system()',
'desc' => __('Execute an external program and display the output', 'security-malware-firewall')
),
'heuristic_passthru' => array(
'title' => 'passthru()',
'desc' => __('Execute an external program and display raw output', 'security-malware-firewall')
),
'heuristic_proc_open' => array(
'title' => 'proc_open()',
'desc' => __('Execute a command and open file pointers for input/output', 'security-malware-firewall')
),
'heuristic_exec' => array(
'title' => 'exec()',
'desc' => __('Execute an external program', 'security-malware-firewall')
),
'heuristic_pcntl_exec' => array(
'title' => 'pcntl_exec()',
'desc' => __('Executes specified program in current process space', 'security-malware-firewall')
),
'heuristic_popen' => array(
'title' => 'popen()',
'desc' => __('Opens process file pointer', 'security-malware-firewall')
),
'heuristic_shell_exec' => array(
'title' => 'shell_exec()',
'desc' => __('Execute command via shell and return the complete output as a string', 'security-malware-firewall')
),
'heuristic_str_rot13' => array(
'title' => 'str_rot13()',
'desc' => __('Perform the rot13 transform on a string', 'security-malware-firewall')
),
'heuristic_syslog' => array(
'title' => 'syslog()',
'desc' => __('Generate a system log message', 'security-malware-firewall')
),
'heuristic_global_variables_in_a_sys_command' => array(
'title' => 'Super global in system command',
'desc' => __('Found direct request to super global variables in the system commands functions.', 'security-malware-firewall')
),
'heuristic_base64_decode' => array(
'title' => 'base64_decode()',
'desc' => __('Suspicious base64_decode usage.', 'security-malware-firewall')
),
'heuristic_the_function_contains_suspicious_arguments' => array(
'title' => '',
'desc' => __('The function contains suspicious arguments', 'security-malware-firewall')
),
'suspicious_assert' => array(
'title' => 'assert()',
'desc' => __('Using the function in production is not recommended', 'security-malware-firewall')
),
'suspicious_eval' => array(
'title' => 'eval()',
'desc' => __('The eval() language construct is very dangerous because it allows execution of arbitrary PHP code. Its use thus is discouraged.', 'security-malware-firewall')
),
'suspicious_create_function' => array(
'title' => 'create_function()',
'desc' => __('This function internally performs an eval() and as such has the same security issues as eval().', 'security-malware-firewall')
),
'suspicious_system' => array(
'title' => 'system()',
'desc' => __('Execute an external program and display the output', 'security-malware-firewall')
),
'suspicious_passthru' => array(
'title' => 'passthru()',
'desc' => __('Execute an external program and display raw output', 'security-malware-firewall')
),
'suspicious_proc_open' => array(
'title' => 'proc_open()',
'desc' => __('Execute a command and open file pointers for input/output', 'security-malware-firewall')
),
'suspicious_exec' => array(
'title' => 'exec()',
'desc' => __('Execute an external program', 'security-malware-firewall')
),
'suspicious_pcntl_exec' => array(
'title' => 'pcntl_exec()',
'desc' => __('Executes specified program in current process space', 'security-malware-firewall')
),
'suspicious_popen' => array(
'title' => 'popen()',
'desc' => __('Opens process file pointer', 'security-malware-firewall')
),
'suspicious_shell_exec' => array(
'title' => 'shell_exec()',
'desc' => __('Execute command via shell and return the complete output as a string', 'security-malware-firewall')
),
'suspicious_str_rot13' => array(
'title' => 'str_rot13()',
'desc' => __('Perform the rot13 transform on a string', 'security-malware-firewall')
),
'suspicious_syslog' => array(
'title' => 'syslog()',
'desc' => __('Generate a system log message', 'security-malware-firewall')
),
'suspicious_global_variables_in_a_sys_command' => array(
'title' => 'Super global in system command',
'desc' => __('Found direct request to super global variables in the system commands functions.', 'security-malware-firewall')
),
'suspicious_base64_decode' => array(
'title' => 'base64_decode()',
'desc' => __('Suspicious base64_decode usage.', 'security-malware-firewall')
),
'login_page_rename__send_email_notification' => array(
'title' => 'Send email with new login URL',
'desc' => __('If enabled, the plugin will necessarily send the notification to the admin email before login URL is changed.
If email could not be sent, all the changes will be reverted.
Disable this option if you have mail connection issues or SMTP service is not configured on this WordPress instance.
Please note that only user that has permissions to activate plugins can disable this option.', 'security-malware-firewall'),
),
'scanner__path_exclusions_view' => array(
'title' => __('Exclusions ruleset for files and directories', 'security-malware-firewall'),
'desc' => __('These rules will exclude files or directories (and all subdirectories) matching the specified path. Any type of directory separator is acceptable. Example: wp-content/themes/yourtheme/skipthisdir or wp-content/uploads/file.txt', 'security-malware-firewall')
. '
',
),
'hash_denied_hash' => array(
'title' => 'denied_hash',
'desc' => __('The file hash is in denied list. It means that the Security analysts have marked this file
as critically dangerous early.', 'security-malware-firewall')
),
'secfw__get_ip' => array(
'title' => IP::getOptionLongDescriptionArray()['title'],
'desc' => IP::getOptionLongDescriptionArray()['desc'],
),
'sending_for_analysis_rules' => array(
'title' => 'Sending for cloud analysis',
'desc' => spbc__get_accordion_tab_info_block_html('sending_for_analysis_rules'),
),
'wp__disable_rest_api' => array(
'title' => 'Disable WordPress REST API',
'desc' => __('This option restricts access for non-authenticated users only.
Modes:
Disable endpoint "users" - only /wp-json/wp/v2/users and /wp-json/wp/v2/users/"id_user" will be restricted.
Disable all endpoints - any REST routes will be restricted.', 'security-malware-firewall'),
),
// Note: this long desc called form user interface
'spbc_pass_check' => array(
'title' => 'User password leaks check',
'desc' => \CleantalkSP\SpbctWP\UsersPassCheckModule\UserPassCheckView::getLongDescription(),
),
'no_description' => array(
'title' => esc_html($setting_id),
'desc' => __('No description provided yet for this item. We are sorry about this. Please, contact support@cleantalk.org for further help.', 'security-malware-firewall'),
),
);
$out = isset($descriptions[ $setting_id ]) ? $descriptions[ $setting_id ] : $descriptions['no_description'];
wp_send_json($out);
}
/**
* @return void
*/
function spbc_settings__get_recommendation()
{
global $spbc;
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
if (!isset($_POST['setting_id'])) {
return;
}
$setting_id = str_replace(' ', '_', $_POST['setting_id']);
$recomendations = array(
'listing' => array(
'title' => __('Directory can be listed from the Internet', 'security-malware-firewall'),
'desc' => __('The listing of a directory allows an attacker to see the files inside the folder and the very existence of the folder. So if he sees ".git" folder is open for the listing, he can assume that you are using GIT technology and could exploit the known security issues to hack the website.', 'security-malware-firewall')
),
'accessible' => array(
'title' => __('File is accessible from the Internet', 'security-malware-firewall'),
'desc' => __('To solve this issue rename or move the debug.log')
. '
'
. ''
. __('More info', 'security-malware-firewall')
. ''
),
'unsafe_permissions' => array(
'title' => __('You likely do need to modify file permissions', 'security-malware-firewall'),
'desc' => __('Do it via FTP or hosting control panel. Set 644 for files and 755 for folders. If you are not sure, contact your hosting provider.', 'security-malware-firewall')
. '
'
. ''
. __('More info', 'security-malware-firewall')
. ''
),
);
if (!isset($recomendations[ $setting_id ])) {
return;
}
wp_send_json($recomendations[ $setting_id ]);
}
// Ajax handler: send 2FA confirmation code (React settings UI)
function spbctGenerateAndSendConfirmationCode()
{
global $spbc;
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
$user = wp_get_current_user();
if (isset($user->ID) && $user->ID > 0) {
$email = $user->user_email;
} else {
$email = spbc_get_admin_email();
}
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
$confirmation_code = get_site_option('spbc_confirmation_code', false);
$save_code = true;
// Code is outdated. Generate a new code
if ( ! isset($confirmation_code['generate_time']) || $confirmation_code['generate_time'] + 10 * 60 < time()) {
$confirmation_code = array(
'code' => rand(10000000, 99999999),
'generate_time' => time(),
'verified' => false,
);
$save_code = update_site_option('spbc_confirmation_code', $confirmation_code);
}
if (isset($confirmation_code['code'])) {
if ($save_code === true) {
$mail_result = wp_mail(
$email,
$spbc->data["wl_brandname"] . esc_html__(' confirmation code ', 'security-malware-firewall') . get_home_url(),
sprintf(
$spbc->data["wl_brandname"] . esc_html__('. Two-Factor Authentication Code on %s - %s', 'security-malware-firewall'),
get_home_url(),
$confirmation_code['code']
)
);
if ($mail_result) {
wp_send_json_success();
} else {
wp_send_json_error(__('Confirmation code not sent!', 'security-malware-firewall'));
}
} else {
wp_send_json_error(__('Confirmation code not saved!', 'security-malware-firewall'));
}
} else {
wp_send_json_error(__('Confirmation code generation error!', 'security-malware-firewall'));
}
}
// Ajax handler: verify 2FA confirmation code (React settings UI)
function spbctCheckConfirmationCode()
{
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
if ( ! isset($_POST['code'])) {
wp_send_json_error('Confirmation code not provided!');
}
$code = filter_input(INPUT_POST, 'code', FILTER_SANITIZE_NUMBER_INT);
$get_code = get_site_option('spbc_confirmation_code');
if ($get_code && array_key_exists('code', $get_code) && array_key_exists('generate_time', $get_code)) {
if ($get_code['code'] == $code && $get_code['generate_time'] + 10 * 60 > time()) { //Code is live for 10 minutes
if (isset($get_code['verified']) && $get_code['verified'] === false) {
$get_code['verified'] = true;
update_site_option('spbc_confirmation_code', $get_code);
}
wp_send_json_success($get_code);
} else {
wp_send_json_error('Confirmation code is wrong or outdated!');
}
} else {
wp_send_json_error('Could not check confirmation code!');
}
}
/**
* Ajax handler for checking renew banner
*/
function spbc_settings__check_renew_banner()
{
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
global $spbc;
wp_send_json(array(
'close_renew_banner' => $spbc->data['notice_show'] == 0
? true
: false
));
}
/**
* Descriptions for scanner results actions.
* @return string
*/
function spbc_bulk_actions_description()
{
global $spbc;
$guide_link = LinkConstructor::buildSimpleLink('https://research.cleantalk.org', 'major-signs-of-malware-on-an-infected-wordpress-site');
$guide_text = sprintf(
esc_html__('Check %s this guide %s out, it helps to identify a malware.', 'security-malware-firewall'),
'',
''
);
$actions = ListTable::getRowActionsElementNamingData();
$description = '
';
$description .= '
';
$description .= '
';
$description .= '
' . esc_html__('Available actions on the found files:', 'security-malware-firewall') . '
';
}
$description .= implode('', $action_description);
$description .= '';
$description .= __('The actions are available only after scanning your website.', 'security-malware-firewall');
$description .= '
';
break;
case 'critical-for-widget':
//banner for widget if critical files exist
$info_block_out = __('With a high degree of probability, your site has been infected. If you need professional help
from security specialists, feel free to order', 'security-malware-firewall');
$classes = 'spbc_widget_notice_critical';
$show_exclaim_triangle = true;
//generate button
$button_text = __('Request Malware removal', 'security-malware-firewall');
$button_div = '
' . __('If you are not sure of the results and cannot assess for yourself whether these files are dangerous or not, then we recommend sending these files to the cloud for analysis. Select suspicious files and click "Send for Analysis".', 'security-malware-firewall') . '
';
$info_block_out .= '
' . __('Please, note, the size of file to send is restricted with 1024 Kb.', 'security-malware-firewall') . '
'
. sprintf(
'Suspicious files are sent to the CleanTalk cloud to be analyzed by Cloud Malware scanner. If you do not want to send it to the cloud, turn this option off in the plugin %s settings %s',
'',
''
)
. '
';
}
$classes = 'notice notice-info';
break;
case 'analysis':
// todo this was the same output as suspicious - removed for now
return '';
case 'unknown':
$template = '
%MAIN_TEXT%
%OPTION_1%
%OPTION_2%
';
$main_text = __('If you are not sure about these files, you have two options,', 'security-malware-firewall');
$guide_link = LinkConstructor::buildSimpleLink('https://research.cleantalk.org', 'major-signs-of-malware-on-an-infected-wordpress-site');
$option1 = sprintf(
esc_html__('Check %s this guide %s out, it helps to identify a malware.', 'security-malware-firewall'),
'',
''
);
$option2 = __('Send it to the cloud where files will be passed through additional tests (Send for Analysis).', 'security-malware-firewall');
$template = str_replace('%MAIN_TEXT%', $main_text, $template);
$template = str_replace('%OPTION_1%', $option1, $template);
$template = str_replace('%OPTION_2%', $option2, $template);
$info_block_out = $template;
$classes = 'notice notice-info';
break;
case 'sending_for_analysis_rules':
$template = '
%MAIN_TEXT_1%
%MAIN_TEXT_2%
%OPTION_1%
%OPTION_2%
%OPTION_3%
%MAIN_TEXT_3%
%OPTION_4%
%MAIN_TEXT_4%
';
$main_text_1 = __('Send the file for cloud analysis. After the file is sent, the file is available in the tab "Analysis log". Read more about analysis results in the appropriate tab. ', 'security-malware-firewall');
$main_text_2 = __('The file sent for analysis must meet the following requirements:', 'security-malware-firewall');
$main_text_3 = __('For "Unknown" files category, file extension should be from the list of allowed extensions:', 'security-malware-firewall');
$main_text_4 = __('If any of requirements are not met, the action for file is not available.', 'security-malware-firewall');
$option1 = __('the file was not ever denied or approved by ' . $company_name . ' team', 'security-malware-firewall');
$option2 = __('the file sending is not already scheduled during common scan process', 'security-malware-firewall');
$option3 = __('the file size is larger than zero and less than 1Mb', 'security-malware-firewall');
$option4 = __('.php*, .html, .htm, .phtml, shtml, .phar, .odf', 'security-malware-firewall');
$template = str_replace('%MAIN_TEXT_1%', $main_text_1, $template);
$template = str_replace('%MAIN_TEXT_2%', $main_text_2, $template);
$template = str_replace('%MAIN_TEXT_3%', $main_text_3, $template);
$template = str_replace('%MAIN_TEXT_4%', $main_text_4, $template);
$template = str_replace('%OPTION_1%', $option1, $template);
$template = str_replace('%OPTION_2%', $option2, $template);
$template = str_replace('%OPTION_3%', $option3, $template);
$template = str_replace('%OPTION_4%', $option4, $template);
$info_block_out = Escape::escKsesPreset($template, 'spbc_settings__sending_for_analysis_rules');
$classes = '';
break;
case 'skipped':
$template = '
';
$header_p = __('Please, note the restrictions', 'security-malware-firewall');
$empty_info = __('Scanner does not check and report about empty files (file size is 0).', 'security-malware-firewall');
$signatures_restrict = __('Signatures module does not check files with size larger then %d Kb.', 'security-malware-firewall');
$value = \CleantalkSP\Common\Scanner\SignaturesAnalyser\Controller::SIGNATURES_SCAN_MAX_FILE_SIZE / 1024;
$signatures_restrict = sprintf($signatures_restrict, $value);
$heuristic_restrict = __('Heuristic module does not check files with size larger then %d Kb. ', 'security-malware-firewall');
$value = \CleantalkSP\Common\Scanner\HeuristicAnalyser\HeuristicAnalyser::HEURISTIC_SCAN_MAX_FILE_SIZE / 1024;
$heuristic_restrict = sprintf($heuristic_restrict, $value);
$suggest_file_manger = __('You can use a file manager to manage files in the list.', 'security-malware-firewall');
$suggest_contact = __('If you are sure that a file should be checked please let us know', 'security-malware-firewall');
$link = 'https://wordpress.org/support/plugin/security-malware-firewall/';
$template = str_replace('%HEADER_P%', $header_p, $template);
$template = str_replace('%SIGN_RESTRICT%', $signatures_restrict, $template);
$template = str_replace('%HEUR_RESTRICT%', $heuristic_restrict, $template);
$template = str_replace('%NOT_EMPTY%', $empty_info, $template);
$template = str_replace('%SUGGEST_FM%', $suggest_file_manger, $template);
$template = str_replace('%SUGGEST_CONTACT%', $suggest_contact, $template);
$template = str_replace('%LINK%', $link, $template);
$info_block_out = $template;
$classes = 'notice notice-info';
break;
case 'outbound_links':
$info_block_out = '
'
. __('Viruses post links to lead site visitors to compromised and fishing sites. It is a good idea to check links that you have not seen before. To manage the option go to the', 'security-malware-firewall')
. ' '
. ''
. __('scanner settings', 'security-malware-firewall')
. '
';
return $out;
}
/**
* Returns notice HTML about automatic sending is enabled.
* @param int $scheduled_count count of files scheduled to send
* @return string HTML
*/
function spbct_get_automatic_files_send_notice_html($scheduled_count)
{
$html = '
';
$html .= '
';
$html .= ' ';
$html .= "The automatic sending files for Cloud analysis is enabled in the plugin settings. Files count: $scheduled_count";
$html .= '
';
$html .= '
';
return $html;
}
/**
* Returns list of files scheduled to send for analysis due scan process.
* Uses state->data if available, wpdb query if not.
* @return array Array of fast_hash
*/
function spbc_get_list_of_scheduled_suspicious_files_to_send()
{
global $wpdb, $spbc;
if ( !isset($spbc->data['scheduled_suspicious_files_to_send']) ) {
$query = 'SELECT fast_hash FROM ' . SPBC_TBL_SCAN_FILES . ' WHERE pscan_pending_queue = 1';
$result = array_keys($wpdb->get_results($query, OBJECT_K));
$spbc->data['scheduled_suspicious_files_to_send'] = $result;
}
return (array)$spbc->data['scheduled_suspicious_files_to_send'];
}
function spbc__get_count_outbound_links()
{
global $wpdb;
return $wpdb->get_var(
"SELECT COUNT(*) FROM " . SPBC_TBL_SCAN_LINKS . ";"
);
}
/**
* Drop current data to defaults from state->default_data.
* On exceptions roll back to old current state.
* Attention! This function does not save the state to options,
* only the current state object will be handled.
* @param \CleantalkSP\SpbctWP\State $spbc current state
* @return \CleantalkSP\SpbctWP\State state dropped
*/
function spbc_drop_to_defaults_on_key_clearance(\CleantalkSP\SpbctWP\State $spbc)
{
$old_data = $spbc->data;
try {
$keep_data_keys = array(
'scanner',
'display_scanner_warnings',
'errors'
);
$spbc->error_delete_all(true);
foreach ( $spbc->default_data as $key => $value) {
if (!in_array($key, $keep_data_keys)) {
$spbc->data[$key] = $value;
}
}
} catch (Exception $e) {
$spbc->data = $old_data;
}
return $spbc;
}
/**
* Get HTML content for change role template
* @return void *echo
*/
function spbc_change_role_template()
{
spbc_check_ajax_referer('spbc_secret_nonce', 'security');
$user_login = sanitize_text_field($_POST['data']['user_login']);
$role = sanitize_text_field($_POST['data']['role']);
$template = sprintf(
'
'
. '
',
'ajax' => true,
);
$_section_default_params = array(
'title' => '',
'description' => '',
'html_before' => '',
'html_after' => '',
'display' => true,
);
$_section_banner_default_params = array(
'title' => '',
'description' => '',
'html_before' => '',
'html_after' => '',
'display' => true,
);
$_field_default_params = array(
'callback' => 'spbc_settings__field__draw',
'input_type' => 'checkbox',
'def_class' => 'spbc_wrapper_field',
'title_first' => false,
'class' => null,
'parent' => null,
'children' => null,
'children_by_ids' => null,
'display' => true, // Draw element or not
'disabled' => false,
'required' => false,
'value_source' => 'settings',
'parent_value_source' => 'settings',
);
foreach ($elems as $elem_name => &$elem) {
// Merging with default params
$elem = array_merge(${'_' . $elem['type'] . '_default_params'}, $elem);
switch ($elem['type']) {
case 'plain':
break;
case 'tab':
if (isset($elem['sections'])) {
$elem['sections'] = spbc_settings__register_sections_and_fields($elem['sections']);
}
// Creating new elements with tabs headings (before tabs)
if ($elem['display']) {
// Hiding a tab 'Backups' except for a direct link
if ($elem_name === 'backups' && ! (isset($_GET['spbc_tab']) && $_GET['spbc_tab'] === 'backups')) {
break;
}
$tab_head = '
',
array(
'button_caption' => __('Show more records', 'security-malware-firewall'),
'spbc_path' => esc_url(SPBC_PATH),
)
);
$section_show_more = TextPlateStatic::render(
'
' .
' ' .
__('If you feel that the Cloud verdict is incorrect, please click the link "Copy file info" near the file name and contact us', 'security-malware-firewall') . ' ' .
$dashboard_link .
'