GRAYBYTE

Back Back Up Advanced Editor

<?php

/**
 * @package WP Encryption
 *
 * @author     WP Encryption
 * @copyright  Copyright (C) 2019-2024, WP Encryption
 * @license    http://www.gnu.org/licenses/gpl-3.0.html GNU General Public License, version 3
 * @link       https://wpencryption.com
 * @since      Class available since Release 1.1.0
 *
 *
 *   This program is free software: you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation, either version 3 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 */

if (!defined('ABSPATH')) {
    die('Access Denied');
}

/**
 * WPLE_Security Class
 * Handles all the security actions
 * 
 * @since 7.0.0
 */
if (!class_exists('WPLE_Security')) {
    class WPLE_Security
    {
        private $enabledSettings;

public function __construct()
        {
            $this->enabledSettings = get_option('wple_security_settings') ? get_option('wple_security_settings') : array();

add_action('init', [$this, 'wple_security_inits']);
        }

public function wple_security_inits()
        {
            if (in_array('hide_wp_version', $this->enabledSettings)) {
                $this->wple_remove_wp_versions();
            }

if (in_array('stop_user_enumeration', $this->enabledSettings)) {
                $this->wple_stop_user_enumeration();
            }

if (in_array('hide_login_error', $this->enabledSettings)) {
                add_filter('wp_login_errors', [$this, 'wple_hide_login_error']);
            }

if (in_array('disable_pingback', $this->enabledSettings)) {
                add_filter('xmlrpc_methods', array($this, 'wple_disable_pingback_methods'));
                add_filter('wp_headers', array($this, 'wple_disable_pingback_header'));
            }

if (in_array('remove_feeds', $this->enabledSettings)) {
                $this->wple_remove_feeds();
            }
        }

/**
         * Stop user enumeration   
         */
        public function wple_stop_user_enumeration()
        {
            if (!is_admin() && isset($_SERVER['REQUEST_URI'])) {
                if (preg_match('/(wp-comments-post)/', sanitize_text_field($_SERVER['REQUEST_URI'])) === 0 && !empty($_REQUEST['author'])) {
                    wp_die(esc_html__('Author info access is forbidden', 'wp-letsencrypt-ssl'), 403);
                }
            }
            add_filter('oembed_response_data', array($this, 'wple_oembed_user_enumeration'), 10, 1);
            add_filter('rest_request_before_callbacks', array($this, 'wple_rest_user_enumeration'), 10, 1);
        }

public function wple_oembed_user_enumeration($response)
        {
            unset($response['author_name']);
            unset($response['author_url']);
            return $response;
        }

public function wple_rest_user_enumeration($response)
        {
            $rest_route = !empty($_GET['rest_route']) ? sanitize_text_field($_GET['rest_route']) : (empty($_SERVER['REQUEST_URI']) ? '' : (string) parse_url(urldecode(sanitize_text_field($_SERVER['REQUEST_URI'])), PHP_URL_PATH));
            $rest_route = trim($rest_route, '/');

if ('' != $rest_route && !current_user_can('edit_others_posts')) {
                if (preg_match('/wp\/v2\/users$/i', $rest_route)) {
                    $error = new WP_Error('wple_users_list_forbidden', 'Access to users list is forbidden');
                    $response = rest_ensure_response($error);
                } elseif (preg_match('/wp\/v2\/users\/+(\d+)$/i', $rest_route, $matches)) {
                    $id = empty($matches) ? 0 : (int) $matches[1];
                    if (get_current_user_id() !== $id) {
                        $error = new WP_Error('wple_user_details_forbidden', 'Access to user details is forbidden', array('status' => 403));
                        $response = rest_ensure_response($error);
                    }
                }
            }
            return $response;
        }

/**
         * Remove WP version info
         */
        public function wple_remove_wp_versions()
        {
            add_filter('the_generator', array($this, 'wple_remove_wp_meta'));
            add_filter('style_loader_src', array($this, 'wple_replace_wpver_with_hash'));
            add_filter('script_loader_src', array($this, 'wple_replace_wpver_with_hash'));
        }
        public function wple_remove_wp_meta()
        {
            return '';
        }
        public function wple_replace_wpver_with_hash($src)
        {
            global $wp_version;
            static $wp_hash = null;

if (empty($src)) return '';

if (stripos($src, 'ver=' . $wp_version) !== false) {
                if (!$wp_hash) {
                    $wp_hash = wp_hash($wp_version);
                }
                $src = add_query_arg('ver', $wp_hash, $src);
            }
            return $src;
        }

/**
         * Disallow File Edit
         * 
         * @param boolean $disallow
         */
        public function wple_disallow_file_edit($disallow = 'true')
        {
            $disallow = sanitize_text_field($disallow);
            $conf = ABSPATH . "wp-config.php";
            if (is_writable($conf)) {
                $config = file_get_contents(ABSPATH . "wp-config.php");

if (FALSE == strpos($config, 'DISALLOW_FILE_EDIT')) {
                    $newconfig = preg_replace("/^([\r\n\t ]*)(\<\?)(php)?/i", "<?php " . "\n" . "define('DISALLOW_FILE_EDIT', $disallow);" . "\n", $config);
                } else { //already defined
                    $newconfig = preg_replace("/define$['\"]DISALLOW_FILE_EDIT.*$/i", "define('DISALLOW_FILE_EDIT', $disallow)", $config);
                }

file_put_contents(ABSPATH . "wp-config.php", $newconfig);
            }
        }

/**
         * Hide login error feedback
         */
        public function wple_hide_login_error($errors)
        {
            $arr = ['invalid_username', 'incorrect_password'];
            if (is_wp_error($errors) && in_array($errors->get_error_code(), $arr)) {
                $errors = new WP_Error('invalid', sprintf(__('%sError:%s Incorrect login credentials', 'wp-letsencrypt-ssl'), '<strong>', '</strong>'));
            }

return $errors;
        }

/**
         * Control anyone can register option
         * @param bool $enable
         */
        public function wple_anyone_can_register($enable = true)
        {
            update_option('users_can_register', $enable);
        }

/**
         * Disable XMLRPC Pingbacks
         */
        public function wple_disable_pingback_methods($methods)
        {
            unset($methods['pingback.ping']);
            unset($methods['pingback.extensions.getPingbacks']);
            return $methods;
        }

public function wple_disable_pingback_header($headers)
        {
            unset($headers['X-Pingback']);
            return $headers;
        }

/**
         * Disable X-Powered-By header
         */
        public function wple_disable_x_poweredby_header($enable = true)
        {
            if (!is_writable(ABSPATH . '.htaccess')) {
                echo 0; //alert Could not update setting! Please try again.
                exit();
            }

if ($enable) { //add request
                if (is_writable(ABSPATH . '.htaccess')) {

WPLE_Trait::wple_remove_xpoweredby();

$getrules = WPLE_Trait::disable_xpoweredby_header();

insert_with_markers(ABSPATH . '.htaccess', 'WP_Encryption_Disable_XPoweredBy', $getrules);
                }
            } else { //remove request
                WPLE_Trait::wple_remove_xpoweredby();
            }
        }

/**
         * Remove RSS & Atom feeds
         */
        public function wple_remove_feeds()
        {
            remove_action('wp_head', 'feed_links_extra', 3);
            remove_action('wp_head', 'feed_links', 2);

add_action('do_feed', array($this, 'wp_redirect_home'), 1);
            add_action('do_feed_rdf', array($this, 'wp_redirect_home'), 1);

add_action('do_feed_rss', array($this, 'wp_redirect_home'), 1);
            add_action('do_feed_rss2', array($this, 'wp_redirect_home'), 1);
            add_action('do_feed_rss2_comments', array($this, 'wp_redirect_home'), 1);

add_action('do_feed_atom', array($this, 'wp_redirect_home'), 1);
            add_action('do_feed_atom_comments', array($this, 'wp_redirect_home'), 1);
        }
        public function wp_redirect_home()
        {
            wp_redirect(home_url());
        }

/**
         * Deny php execution in uploads folder
         */
        public function wple_deny_php_in_uploads($enable = true)
        {
            $uploads_htaccess = ABSPATH . 'wp-content/uploads/.htaccess';

if ($enable) {
                $rules = "#BEGIN WP_ENCRYPTION_SECURITY" . "\n" . "<Files *.php>" . "\n" . "deny from all" . "\n" . "</Files>" . "\n" . "# END WP_ENCRYPTION_SECURITY" . "\n";

$backup = '';
                if (file_exists($uploads_htaccess)) {
                    $backup = file_get_contents($uploads_htaccess);
                }

if (stripos($backup, 'WP_ENCRYPTION_SECURITY') === FALSE) { //dont repeat
                    file_put_contents($uploads_htaccess, $rules . $backup);
                }
            } else { //remove the rules

if (file_exists($uploads_htaccess)) {
                    $htaccess = file_get_contents($uploads_htaccess);
                    $group = "/#\\s?BEGIN\\s?WP_ENCRYPTION_SECURITY.*?#\\s?END\\s?WP_ENCRYPTION_SECURITY/s";

if (preg_match($group, $htaccess)) {
                        $modhtaccess = preg_replace($group, "", $htaccess);
                        file_put_contents($uploads_htaccess, $modhtaccess);
                    }
                }
            }
        }

public function wple_disable_directory_listing($enable = true)
        {

if (!is_writable(ABSPATH . '.htaccess')) {
                echo 0; //alert Could not update setting! Please try again.
                exit();
            }

if ($enable) { //add request
                if (is_writable(ABSPATH . '.htaccess')) {

WPLE_Trait::wple_remove_directory_listing();

$getrules = WPLE_Trait::compose_directory_listing_rules();

// $wpruleset = "# BEGIN WordPress";

// if (strpos($htaccess, $wpruleset) !== false) {
                    //   $newhtaccess = str_replace($wpruleset, $getrules . $wpruleset, $htaccess);
                    // } else {
                    //   $newhtaccess = $htaccess . $getrules;
                    // }

insert_with_markers(ABSPATH . '.htaccess', 'WP_Encryption_Disable_Directory_Listing', $getrules);
                }
            } else { //remove request
                WPLE_Trait::wple_remove_directory_listing();
            }
        }

/**
         * security score section render
         * 
         * @since 7.8.0
         * @return html
         */
        public static function wple_security_score()
        {
            $scorecard = array(
                'https_enforced' => 20,
                'critical_issues' => 10,
                'disable_register' => 10,
                'disable_directory' => 10,
                'latest_vulnerability' => 20,
                'daily_vulnerability_scan' => 10,
                'daily_malware_scan' => 20
            );

$scoredefinitions = array(
                'https_enforced' => 'Valid SSL certificate installed and HTTPS enforced',
                'critical_issues' => 'Make sure no critical issues exists in <a href="' . admin_url('/site-health.php') . '">site health</a>',
                'disable_register' => 'Disable "anyone can register"',
                'disable_directory' => 'Disable directory listing',
                'latest_vulnerability' => 'Latest vulnerability scan was performed within last 7 days',
                'daily_vulnerability_scan' => 'Enable daily vulnerability scanning (<a href="https://wpencryption.com/?utm_source=wordpress&utm_medium=security&utm_campaign=wpencryption#pricing">Premium</a>)',
                'daily_malware_scan' => 'Enable daily malware scanning (<a href="https://wpencryption.com/?utm_source=wordpress&utm_medium=security&utm_campaign=wpencryption#pricing">Premium</a>)'
            );

$score = 0;

$featurelist = '<ul>';

$error_count = 0;

foreach ($scoredefinitions as $key => $desc) {

$isenabled = false;
                $security_opts = get_option('wple_security_settings') ?: array();

if ($key == 'https_enforced') {
                    if (WPLE_Security::wple_feature_check('valid_ssl') && WPLE_Security::wple_feature_check('ssl_redirect')) {
                        $isenabled = true;
                    }
                } else if ($key == 'disable_register') {
                    if (!get_option('users_can_register')) $isenabled = true;
                } else if ($key == 'critical_issues') {
                    $site_health = get_transient('health-check-site-status-result');

if ($site_health !== false) {
                        $issues = json_decode($site_health, true);
                        $critical_count = isset($issues['critical']) ? $issues['critical'] : 0;
                        if ($critical_count == 0) $isenabled = true;
                    } else {
                        $isenabled = true;
                    }
                } else if ($key == 'disable_directory') {
                    if (in_array('disable_directory_listing', $security_opts)) {
                        $isenabled = true;
                    }
                } else if ($key == 'latest_vulnerability') {
                    if ($lastscan = get_option('wple_vulnerability_lastscan')) {
                        $sevenDaysFromScan = $lastscan + (7 * 24 * 60 * 60);
                        if (time() < $sevenDaysFromScan) { //last scan was within last 7 days
                            $isenabled = true;
                        }
                    }
                } else if ($key == 'daily_vulnerability_scan' || $key == 'daily_malware_scan') {
                    if (wple_fs()->can_use_premium_code__premium_only()) {
                        if (get_option('wple_' . $key)) {
                            $isenabled = true;
                        }
                    }
                }

$sayyesno = '<span class="wple-no">no</span>';

if ($isenabled) {
                    $sayyesno = '<span class="wple-yes">Yes</span>';
                    $score += (int) $scorecard[$key];
                } else {
                    $error_count++;
                }

$featurelist .= '<li class="' . esc_attr($key) . '">' . $sayyesno . WPLE_Trait::wple_kses($desc, 'a') . ($key == 'tls_version' ? '<span class="dashicons dashicons-editor-help wple-tooltip" data-tippy="TLS version should be 1.2 or above. Contact your hosting support to update TLS version or our Annual PRO plan can offer TLS1.2 protocol."></span>' : ($key == 'security_headers' ? '<span class="dashicons dashicons-editor-help wple-tooltip" data-tippy="X-XSS and X-Content-Type-Options header"></span>' : '')) . '</li>';
            }

///update_option("wple_ssl_errors", $error_count);

$featurelist .= '</ul>';

$scorecolor = ($score >= 30 && $score <= 70) ? 'e2d754' : (($score > 70) ? '67d467' : 'ff5252');

$output = '<div class="wple-ssl-score">
            <h2 style="color:#444">Security Score</h2>';

$output .= '<div class="wple-score">' . (int) $score . '</div>
            <div class="wple-scorebar"><span data-width="' . (int) $score . '" style="width:' . (int) $score . '%;background:#' . esc_attr($scorecolor) . '"></span></div>';

if ($score == 70) $output .= '<h3 class="score-prom" style="margin-bottom:30px">You still have major task pending!</h3>';

$output .= $featurelist;

///$output .= WPLE_Trait::wple_other_plugins(true);

$output .= '</div>';

return $output;
        }

public static function wple_feature_check($key)
        {
            $rootdomain = WPLE_Trait::get_root_domain(false);

switch ($key) {
                case 'valid_ssl':
                    $rootdomain = WPLE_Trait::get_root_domain(false);
                    $client = WPLE_Trait::wple_verify_ssl($rootdomain);

if ($client || is_ssl()) {
                        update_option('wple_ssl_valid', true);
                        return 1;
                    }

update_option('wple_ssl_valid', false);
                    break;
                case 'ssl_redirect':
                    $gethead = wp_remote_head('http://' . $rootdomain, array(
                        'sslverify' => false,
                        'redirection' => 0,
                        'timeout' => 10
                    ));
                    if (is_wp_error($gethead)) {
                        return 0;
                    }

$privatearray = $gethead['headers']->getAll();

if (isset($privatearray['location']) && untrailingslashit($privatearray['location']) == 'https://' . $rootdomain) {
                        return 1;
                    }

$opts = get_option('wple_opts');
                    if (FALSE !== $opts && isset($opts['force_ssl']) && $opts['force_ssl'] >= 1) {
                        return 1;
                    }

break;
                case 'httponly_cookies':
                    if (get_option('wple_' . $key)) {
                        return 1;
                    }

$arr = session_get_cookie_params();
                    if ($arr['httponly']) {
                        return 2;
                    }
                    break;
                case 'hsts':
                    $gethead = wp_remote_head('http://' . $rootdomain, array(
                        'sslverify' => false,
                        'redirection' => 1,
                        'timeout' => 10
                    ));
                    if (!is_wp_error($gethead)) {
                        $privatearray = $gethead['headers']->getAll();

if (isset($privatearray['strict-transport-security'])) {
                            return 2;
                        }
                    }

if (get_option('wple_' . $key)) {
                        return 1;
                    }

break;
                case 'mixed_content_fixer':
                case 'ssl_monitoring':
                    if (get_option('wple_' . $key)) {
                        return 1;
                    }
                    break;
                case 'security_headers':
                    if (get_option('wple_xxss') && get_option('wple_xcontenttype')) {
                        return 1;
                    }
                    break;
                case 'advanced_security':
                    if (wple_fs()->can_use_premium_code__premium_only()) {
                        if (get_option('wple_xframe') && get_option('wple_referrer')) {
                            return 1;
                        }
                    }
                    break;
                case 'tls_version':
                    $tls = '1.2';

if (function_exists('curl_init')) {

$ch = curl_init('https://www.howsmyssl.com/a/check');
                        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
                        curl_setopt($ch, CURLOPT_TIMEOUT, 5);
                        $json = curl_exec($ch);
                        curl_close($ch);
                        $json = json_decode($json);

if (!empty($json->tls_version)) {
                            $tls = str_replace("TLS ", "", sanitize_text_field($json->tls_version));
                        }
                    }

if (version_compare($tls, '1.2', '>=')) {
                        return 1;
                    }
                    break;
                case 'ssl_auto_renew':
                    if (wple_fs()->can_use_premium_code__premium_only()) {
                        return 1;
                    }
                    break;
                case 'improve_security':
                    if (wple_fs()->can_use_premium_code__premium_only()) {
                        return 1;
                    }
                    break;
            }

return 0;
        }
    }
}