wordpress/php-fpm/wordpress_files/plugins/wp-cerber/nexus/cerber-nexus-slave.php

602 lines
17 KiB
PHP
Raw Normal View History

2020-05-22 03:40:23 +02:00
<?php
/*
Copyright (C) 2015-20 CERBER TECH INC., https://cerber.tech
Copyright (C) 2015-20 CERBER TECH INC., https://wpcerber.com
Licenced under the GNU GPL.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
/*
*========================================================================*
| |
| ATTENTION! Do not change or edit this file! |
| |
*========================================================================*
*/
if ( ! defined( 'WPINC' ) ) { exit; }
require_once( dirname( cerber_plugin_file() ) . '/cerber-maintenance.php' );
add_action( 'plugins_loaded', function () {
if ( ! $key = cerber_get_get( 'cerber_magic_key', '[\d\w\-_]+' ) ) {
return;
}
if ( ! $data = cerber_get_set( '_the_key_' . $key ) ) {
cerber_404_page();
}
@ini_set( 'display_errors', 0 );
cerber_delete_set( '_the_key_' . $key );
cerber_load_admin_code();
crb_admin_download_file( $data['query']['type'], $data['query'] );
cerber_404_page();
}, 0 );
class CRB_Master {
public $page;
public $tab;
public $base;
public $is_post;
public $seal;
public $type;
public $get_params = array(); // Unsanitized, as is
public $payload;
public $action;
public $screen;
public $at_site;
public $locale;
public $error;
final function __construct() {
global $crb_assets_url, $crb_ajax_loader;
$fields = nexus_get_fields();
if ( ! $payload = cerber_get_post( $fields[1] ) ) {
$this->error = new WP_Error( 'nexus_format_error', 'Invalid request: master request malformed' );
return;
}
$request = json_decode( stripslashes( $payload ), true );
if ( JSON_ERROR_NONE != json_last_error() ) {
$this->error = new WP_Error( 'json_error', 'Unable to parse JSON: ' . json_last_error_msg() );
return;
}
array_walk_recursive( $request, function ( &$e ) {
$e = str_replace( array( '<br/>' ), "\n", $e ); // restore new lines after json_decode
} );
$this->seal = $request['seal'];
$this->base = rtrim( $request['base'], '/' ) . '/';
$this->get_params = $request['params'];
$this->payload = $request['payload'];
$this->type = $request['payload']['type'];
$this->page = preg_replace( '/[^\w\-]/i', '', crb_array_get( $request, 'page' ) );
$this->tab = preg_replace( '/[^\w\-]/i', '', crb_array_get( $request, 'tab' ) );
$this->at_site = crb_array_get( $request, 'at_site' );
$this->screen = crb_array_get( $request, 'screen' );
$this->is_post = ( ! empty( $request['is_post'] ) ) ? true : false;
if ( ! $this->locale = crb_array_get( $request, 'master_locale' ) ) {
if ( ! $this->locale = get_site_option( 'WPLANG' ) ) {
$this->locale = 'en_US';
}
}
$crb_assets_url = $request['assets'];
$crb_ajax_loader = $crb_assets_url . 'ajax-loader.gif';
if ( $this->type == 'ajax' ) {
if ( ! $this->action = crb_array_get( $request['params'], 'action' ) ) {
$this->action = $this->get_post_fields( 'action' );
}
$this->action = preg_replace( '/[^\w\-]/i', '', (string) $this->action );
}
}
/**
* @param integer|string $key
* @param mixed $default
* @param $pattern string REGEX pattern for value validation, UTF is not supported
*
* @return mixed
*/
final function get_post_fields( $key = null, $default = false, $pattern = '' ) {
if ( ! empty( $this->payload['data']['post'] ) ) {
if ( $key ) {
return crb_array_get( $this->payload['data']['post'], $key, $default, $pattern );
}
return $this->payload['data']['post'];
}
if ( $key ) {
return false;
}
return array();
}
}
/**
* @return CRB_Master
*/
function nexus_request_data() {
static $crb_master;
if ( ! is_object( $crb_master ) ) {
$crb_master = new CRB_Master();
}
return $crb_master;
}
function nexus_slave_process() {
if ( ! nexus_is_valid_request() ) {
return;
}
@ini_set( 'display_errors', 0 );
@ignore_user_abort( true );
crb_raise_limits();
cerber_update_set( 'processing_master_request', 1, 0, false, time() + 120 );
nexus_diag_log( 'Parsing request...' );
$crb_master = nexus_request_data();
if ( is_wp_error( $crb_master->error ) ) {
nexus_diag_log( 'ERROR: ' . $crb_master->error->get_error_message() );
exit;
}
nexus_diag_log( 'Request is parsed, generating response...' );
add_filter( 'plugin_locale', function () {
return nexus_request_data()->locale;
}, 9999 );
$use_eng = false;
if ( nexus_request_data()->locale == 'en_US' ) {
$use_eng = true;
// We do not load any translation files
add_filter( 'override_load_textdomain', function ( $val, $domain, $mofile ) {
return true;
}, 9999, 3 );
}
if ( ! $use_eng ) {
$r = load_plugin_textdomain( 'wp-cerber', false, 'wp-cerber/languages' );
/*if ( ! $r ) {
nexus_diag_log( 'Unable to load plugin localization files ' . (string) nexus_request_data()->locale );
}*/
}
require_once( ABSPATH . 'wp-admin/includes/plugin.php' );
require_once( ABSPATH . 'wp-admin/includes/template.php' );
require_once( ABSPATH . WPINC . '/pluggable.php' );
require_once( ABSPATH . WPINC . '/vars.php' );
cerber_load_admin_code();
$response = nexus_prepare_responce();
if ( is_wp_error( $response ) ) {
$m = __( 'ERROR:', 'wp-cerber' ) . ' ' . $response->get_error_message();
nexus_diag_log( $m );
$error = array( $response->get_error_code(), $response->get_error_message() );
$response = array( 'error' => $error );
}
nexus_diag_log( 'Now sending response to the master...' );
$result = nexus_net_send_responce( $response );
if ( is_wp_error( $result ) ) {
nexus_diag_log( __( 'ERROR:', 'wp-cerber' ) . ' ' . $result->get_error_message() );
}
cerber_delete_set( 'processing_master_request' );
nexus_diag_log( '=== SLAVE HAS FINISHED ===' );
exit;
}
/**
* Avoid simultaneous requests from the master(s)
*
* @return bool
*
*/
function nexus_is_processing() {
return ( cerber_get_set( 'processing_master_request' ) ) ? true : false;
}
/*
function nexus_render_admin_page_1(){
require_once( ABSPATH . 'wp-admin/includes/plugin.php' );
require_once( ABSPATH . '/wp-admin/includes/template.php' );
require_once( ABSPATH . '/wp-includes/pluggable.php' );
cerber_load_admin_code();
$page_id = 'cerber-recaptcha';
//$tab = 'captcha';
if ( empty( $tab ) ) {
$tab = $page_id;
}
cerber_wp_settings_setup( cerber_get_setting_id( $tab ) );
// Render inner html
$page = cerber_get_admin_page_config( $page_id );
call_user_func( $page['callback'], '' );
exit;
}*/
function nexus_render_admin_page( $page, $tab ) {
$id = ( empty( $tab ) ) ? $page : $tab;
cerber_wp_settings_setup( cerber_get_setting_id( $id ) );
cerber_admin_init(); // TODO: remove, old way
ob_start();
cerber_render_admin_page( $page, $tab ); // Render whole html
return ob_get_clean();
}
function nexus_parse_request() {
$fields = nexus_get_fields();
if ( ! $payload = cerber_get_post( $fields[1] ) ) {
return new WP_Error( 'nexus_format_error', 'Invalid request: master request malformed' );
}
$request = json_decode( stripslashes( $payload ), true );
if ( JSON_ERROR_NONE != json_last_error() ) {
return new WP_Error( 'json_error', 'Unable to parse JSON: ' . json_last_error_msg() );
}
return $request;
}
function nexus_prepare_responce() {
$master = nexus_request_data();
nexus_diag_log( 'Type: ' . $master->type );
if ( ! nexus_is_granted() ) {
return new WP_Error( 'not_allowed', 'Operation is not allowed in this context' );
}
$result = '';
switch ( $master->type ) {
case 'get_page':
CRB_Addons::load_active();
return array(
'html' => nexus_render_admin_page( $master->page, $master->tab ),
//'o' => get_option( 'gmt_offset' ),
//'z' => get_option( 'timezone_string' ),
);
break;
case 'submit':
CRB_Addons::load_active();
if ( $master->get_post_fields( 'option_page' ) ) { // True WP setting page
return nexus_process_wp_settings_form( $master->get_post_fields() );
}
else {
return cerber_admin_request( $master->is_post );
}
// A new way: processing + follow up rendering in a single request
//return nexus_render_admin_page( $master->page, $master->tab );
break;
case 'manage':
return cerber_admin_request( $master->is_post );
break;
case 'hello':
//case 'checkup':
return array( 'numbers' => nexus_get_numbers() );
break;
case 'ping':
return array( 'pong' );
break;
case 'sw_upgrade':
$result = nexus_sw_upgrade();
$result ['numbers'] = nexus_get_numbers();
if ( ! $result['updates'] ) {
//nexus_diag_log( 'No updates are available' );
}
break;
case 'ajax':
if ( ! crb_admin_allowed_ajax( $master->action ) ) {
return new WP_Error( 'unknown_ajax', 'The action ' . $master->action . ' is not supported' );
}
global $nexus_doing_ajax;
$nexus_doing_ajax = true;
ob_start();
do_action( 'wp_ajax_' . $master->action );
$nexus_doing_ajax = false;
nexus_diag_log( 'AJAX ' . $master->action . ' completed' );
return ob_get_clean();
break;
default:
return new WP_Error( 'unknown_request', 'This type of request is not supported' );
break;
}
return $result;
}
function nexus_sw_upgrade() {
$ret = array( 'updates' => 0, 'completed' => 1, 'results' => array() );
if ( nexus_is_processing() ) {
$ret['completed'] = 0;
$ret['wait'] = cerber_get_remote_ip();
return $ret;
}
$list = crb_array_get( nexus_request_data()->payload, 'list' );
switch ( nexus_request_data()->payload['sw_type'] ) {
case 'plugins':
if ( empty( $list ) ) {
// Upgrade all
$to_update = array();
$active = get_option( 'active_plugins' );
if ( ! $plugins = get_site_transient( 'update_plugins' ) ) {
wp_update_plugins();
$plugins = get_site_transient( 'update_plugins' );
}
if ( isset( $plugins->response ) ) {
$to_update = array_intersect( $active, array_keys( $plugins->response ) );
}
nexus_diag_log( 'Total active plugins to update: ' . count( $to_update ) );
if ( $done = cerber_get_set( 'plugins_done' ) ) { // Upgraded in the current bulk operation
$to_do = array_diff( $to_update, $done );
}
else {
$done = array();
$to_do = $to_update;
}
if ( ! empty( $to_do ) ) {
$run_now = array_shift( $to_do );
$done[] = $run_now;
$list = array( $run_now );
}
if ( ! empty( $to_do ) ) {
$ret['completed'] = 0; // Something left
cerber_update_set( 'plugins_done', $done, 0, true, time() + 300 * count( $to_do ) );
}
else {
cerber_delete_set( 'plugins_done' );
}
}
if ( ! empty( $list ) && is_array( $list ) ) {
foreach ( $list as $obj ) {
$ret['results'][ $obj ] = cerber_update_plugin( $obj );
}
}
break;
}
nexus_diag_log( cerber_flat_results( $ret['results'] ) );
return $ret;
}
/**
* Process forms generated by WP Settings API
*
* @param $form array WP Settings form fields
*
* @return string|WP_Error
*/
function nexus_process_wp_settings_form( $form ) {
if ( ! $page = crb_array_get( $form, 'option_page' ) ) {
return new WP_Error( 'unknown_option', 'Unable to identify settings page' );
}
if ( ! wp_verify_nonce( crb_array_get( $form, '_wpnonce' ), $page . '-options' ) ) {
return new WP_Error( 'nonce_failed', 'Nonce verification failed' );
}
$wp_option = 'cerber-' . cerber_get_wp_option_id( $page );
if ( ! isset( $form[ $wp_option ] ) ) {
return new WP_Error( 'no_value', 'Setting fields are not set' );
}
$new_values = crb_array_get( $form, $wp_option );
nexus_diag_log( 'Updating ' . $wp_option . ' option' );
cerber_update_site_option( $wp_option, $new_values );
cerber_admin_message( __( 'Settings updated', 'wp-cerber' ) );
return '';
}
/**
* @param string|array $payload
*
* @return bool|WP_Error
*/
function nexus_net_send_responce( $payload ) {
$ret = true;
$role = nexus_get_role_data();
if ( is_array( $payload ) ) {
$p = json_encode( $payload, JSON_UNESCAPED_UNICODE ); // 8.0.5
}
elseif ( is_scalar( $payload ) ) {
$p = (string) $payload;
}
else {
$p = '';
$ret = new WP_Error( 'wrong_type', 'Unsupported slave data type' );
}
$processing = microtime( true ) - cerber_request_time();
$hash = hash( 'sha512', $role['slave']['nx_echo'] . sha1( $p ) );
$response = json_encode( array(
'payload' => $payload,
'extra' => array(
'versions' => array( CERBER_VER, cerber_get_wp_version(), PHP_MAJOR_VERSION, PHP_MINOR_VERSION, PHP_RELEASE_VERSION, PHP_OS, lab_lab( 2 ) )
),
'echo' => $hash,
'p_time' => $processing,
'scheme' => 2 // 8.0.5
), JSON_UNESCAPED_UNICODE );
if ( JSON_ERROR_NONE != json_last_error() ) {
$response = 'Unable to encode payload. JSON error.';
$ret = new WP_Error( 'json_error', 'Unable to encode JSON: ' . json_last_error_msg() );
}
echo $response; // To master
return $ret;
}
function nexus_is_granted( $type = null ) {
$acs = crb_get_settings( 'slave_access' );
$lab = lab_lab();
if ( $acs >= 8 ) {
return false;
}
if ( $acs == 2 ) {
if ( $lab ) {
return true;
}
}
// RO mode
if ( ! $type ) {
$type = nexus_request_data()->type;
}
if ( in_array( $type, array( 'get_page', 'hello', 'ping', 'sw_upgrade' ) ) ) {
return true;
}
if ( $type == 'submit' ) {
if ( crb_get_post_fields( 'cerber_license' ) ) {
return true;
}
return false;
}
if ( $type == 'ajax' ) {
$action = nexus_request_data()->action;
if ( ! crb_admin_allowed_ajax( $action ) ) {
return false;
}
if ( in_array( $action, array( 'cerber_scan_control', 'cerber_view_file' ) ) ) {
return true;
}
if ( $action == 'cerber_ajax' ) {
$fields = crb_get_request_fields();
if ( empty( $fields['acl_delete'] ) ) {
return true;
}
}
}
return false;
}
function nexus_get_numbers() {
$numbers = array();
$active_plugins = get_option( 'active_plugins' );
// see wp_get_update_data();
$updates = array( 'plugins' => 0, 'themes' => 0, 'wp' => 0, 'translations' => 0 );
$pl_updates = get_site_transient( 'update_plugins' );
if ( ! $pl_updates || ( $pl_updates->last_checked < ( time() - 7200 ) ) ) {
delete_site_transient( 'update_plugins' );
wp_update_plugins();
$pl_updates = get_site_transient( 'update_plugins' );
}
if ( ! empty( $pl_updates->response ) ) {
$updates['plugins'] = count( array_intersect( $active_plugins, array_keys( $pl_updates->response ) ) );
}
include_once( ABSPATH . 'wp-admin/includes/update.php' );
if ( function_exists( 'get_core_updates' ) ) {
$wp = get_core_updates( array( 'dismissed' => false ) );
if ( ! empty( $wp ) ) {
$updates['wp'] = 1;
}
}
$scan = array();
if ( ( $last_scan = cerber_get_scan() ) && $last_scan['finished'] ) {
$scan['finished'] = $last_scan['finished'];
$scan['numbers'] = $last_scan['numbers'];
}
$numbers['updates'] = $updates;
$numbers['scan'] = $scan;
// New
$list = array();
if ( ! empty( $pl_updates->response ) ) {
$list = array_map( function ( $e ) {
//$ret = (array) $e;
$ret = array_map( function ( $e ) {
return ( is_object( $e ) ) ? (array) $e : $e;
}, (array) $e );
return $ret;
}, $pl_updates->response );
}
$numbers['pl_updates'] = $list;
$numbers['active'] = $active_plugins;
$numbers['plugins'] = get_plugins();
$numbers['themes'] = crb_get_themes();
$numbers['gmt'] = get_option( 'gmt_offset' );
$numbers['tz'] = get_option( 'timezone_string' );
return $numbers;
}
// We have to use our own "user id"
add_filter( 'nonce_user_logged_out', function ( $uid, $action ) {
if ( ! nexus_is_valid_request() ) {
return $uid;
}
return PHP_INT_MAX;
}, 10, 2 );