updated plugin Jetpack Protect version 3.0.2
This commit is contained in:
Gitium
@ -0,0 +1,111 @@
|
||||
<?php
|
||||
/**
|
||||
* Class to handle the Protect plan
|
||||
*
|
||||
* @package automattic/jetpack-protect-status
|
||||
*/
|
||||
|
||||
namespace Automattic\Jetpack\Protect_Status;
|
||||
|
||||
use Automattic\Jetpack\Current_Plan;
|
||||
|
||||
/**
|
||||
* The Plan class.
|
||||
*/
|
||||
class Plan {
|
||||
/**
|
||||
* The meta name used to store the cache date
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
const CACHE_DATE_META_NAME = 'protect-cache-date';
|
||||
|
||||
/**
|
||||
* Valid pediord for the cache: One week.
|
||||
*/
|
||||
const CACHE_VALIDITY_PERIOD = 7 * DAY_IN_SECONDS;
|
||||
|
||||
/**
|
||||
* The meta name used to store the cache
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
const CACHE_META_NAME = 'protect-cache';
|
||||
|
||||
/**
|
||||
* Checks if the cache is old, meaning we need to fetch new data from WPCOM
|
||||
*/
|
||||
private static function is_cache_old() {
|
||||
if ( empty( self::get_product_from_cache() ) ) {
|
||||
return true;
|
||||
}
|
||||
|
||||
$cache_date = get_user_meta( get_current_user_id(), self::CACHE_DATE_META_NAME, true );
|
||||
return time() - (int) $cache_date > ( self::CACHE_VALIDITY_PERIOD );
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the product list from the user cache
|
||||
*/
|
||||
private static function get_product_from_cache() {
|
||||
return get_user_meta( get_current_user_id(), self::CACHE_META_NAME, true );
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the product data
|
||||
*
|
||||
* @param string $wpcom_product The product slug.
|
||||
* @return array
|
||||
*/
|
||||
public static function get_product( $wpcom_product = 'jetpack_scan' ) {
|
||||
if ( ! self::is_cache_old() ) {
|
||||
return self::get_product_from_cache();
|
||||
}
|
||||
|
||||
$request_url = 'https://public-api.wordpress.com/rest/v1.1/products?locale=' . get_user_locale() . '&type=jetpack';
|
||||
$wpcom_request = wp_remote_get( esc_url_raw( $request_url ) );
|
||||
$response_code = wp_remote_retrieve_response_code( $wpcom_request );
|
||||
|
||||
if ( 200 === $response_code ) {
|
||||
$products = json_decode( wp_remote_retrieve_body( $wpcom_request ) );
|
||||
|
||||
// Pick the desired product...
|
||||
$product = $products->{$wpcom_product};
|
||||
|
||||
// ... and store it into the cache.
|
||||
update_user_meta( get_current_user_id(), self::CACHE_DATE_META_NAME, time() );
|
||||
update_user_meta( get_current_user_id(), self::CACHE_META_NAME, $product );
|
||||
|
||||
return $product;
|
||||
}
|
||||
|
||||
return new \WP_Error(
|
||||
'failed_to_fetch_data',
|
||||
esc_html__( 'Unable to fetch the requested data.', 'jetpack-protect-status' ),
|
||||
array(
|
||||
'status' => $response_code,
|
||||
'request' => $wpcom_request,
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Has Required Plan
|
||||
*
|
||||
* @param bool $force_refresh Refresh the local plan cache from wpcom.
|
||||
* @return bool True when the site has a plan or product that supports the paid Protect tier.
|
||||
*/
|
||||
public static function has_required_plan( $force_refresh = false ) {
|
||||
static $has_scan = null;
|
||||
if ( null === $has_scan || $force_refresh ) {
|
||||
$products = array_column( Current_Plan::get_products(), 'product_slug' );
|
||||
|
||||
// Check for a plan or product that enables scan.
|
||||
$plan_supports_scan = Current_Plan::supports( 'scan', true );
|
||||
$has_scan_product = count( array_intersect( array( 'jetpack_scan', 'jetpack_scan_monthly' ), $products ) ) > 0;
|
||||
$has_scan = $plan_supports_scan || $has_scan_product;
|
||||
}
|
||||
|
||||
return $has_scan;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,261 @@
|
||||
<?php
|
||||
/**
|
||||
* Class to handle the Protect Status of Jetpack Protect
|
||||
*
|
||||
* @package automattic/jetpack-protect-status
|
||||
*/
|
||||
|
||||
namespace Automattic\Jetpack\Protect_Status;
|
||||
|
||||
use Automattic\Jetpack\Connection\Client;
|
||||
use Automattic\Jetpack\Connection\Manager as Connection_Manager;
|
||||
use Automattic\Jetpack\Plugins_Installer;
|
||||
use Automattic\Jetpack\Protect_Models\Extension_Model;
|
||||
use Automattic\Jetpack\Protect_Models\Status_Model;
|
||||
use Automattic\Jetpack\Protect_Models\Threat_Model;
|
||||
use Automattic\Jetpack\Redirect;
|
||||
use Automattic\Jetpack\Sync\Functions as Sync_Functions;
|
||||
use Jetpack_Options;
|
||||
use WP_Error;
|
||||
|
||||
/**
|
||||
* Class that handles fetching and caching the Status of vulnerabilities check from the WPCOM servers
|
||||
*/
|
||||
class Protect_Status extends Status {
|
||||
|
||||
/**
|
||||
* WPCOM endpoint
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
const REST_API_BASE = '/sites/%d/jetpack-protect-status';
|
||||
|
||||
/**
|
||||
* Name of the option where status is stored
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
const OPTION_NAME = 'jetpack_protect_status';
|
||||
|
||||
/**
|
||||
* Name of the option where the timestamp of the status is stored
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
const OPTION_TIMESTAMP_NAME = 'jetpack_protect_status_time';
|
||||
|
||||
/**
|
||||
* Gets the current status of the Jetpack Protect checks
|
||||
*
|
||||
* @param bool $refresh_from_wpcom Refresh the local plan and status cache from wpcom.
|
||||
* @return Status_Model
|
||||
*/
|
||||
public static function get_status( $refresh_from_wpcom = false ) {
|
||||
if ( self::$status !== null ) {
|
||||
return self::$status;
|
||||
}
|
||||
|
||||
if ( $refresh_from_wpcom || ! self::should_use_cache() || self::is_cache_expired() ) {
|
||||
$status = self::fetch_from_server();
|
||||
} else {
|
||||
$status = self::get_from_options();
|
||||
}
|
||||
|
||||
if ( is_wp_error( $status ) ) {
|
||||
$status = new Status_Model(
|
||||
array(
|
||||
'error' => true,
|
||||
'error_code' => $status->get_error_code(),
|
||||
'error_message' => $status->get_error_message(),
|
||||
)
|
||||
);
|
||||
} else {
|
||||
$status = self::normalize_protect_report_data( $status );
|
||||
}
|
||||
|
||||
self::$status = $status;
|
||||
return $status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the WPCOM API endpoint
|
||||
*
|
||||
* @return WP_Error|string
|
||||
*/
|
||||
public static function get_api_url() {
|
||||
$blog_id = Jetpack_Options::get_option( 'id' );
|
||||
$is_connected = ( new Connection_Manager() )->is_connected();
|
||||
|
||||
if ( ! $blog_id || ! $is_connected ) {
|
||||
return new WP_Error( 'site_not_connected' );
|
||||
}
|
||||
|
||||
$api_url = sprintf( self::REST_API_BASE, $blog_id );
|
||||
|
||||
return $api_url;
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetches the status from WPCOM servers
|
||||
*
|
||||
* @return WP_Error|array
|
||||
*/
|
||||
public static function fetch_from_server() {
|
||||
$api_url = self::get_api_url();
|
||||
if ( is_wp_error( $api_url ) ) {
|
||||
return $api_url;
|
||||
}
|
||||
|
||||
$response = Client::wpcom_json_api_request_as_blog(
|
||||
self::get_api_url(),
|
||||
'2',
|
||||
array( 'method' => 'GET' ),
|
||||
null,
|
||||
'wpcom'
|
||||
);
|
||||
|
||||
$response_code = wp_remote_retrieve_response_code( $response );
|
||||
|
||||
if ( is_wp_error( $response ) || 200 !== $response_code || empty( $response['body'] ) ) {
|
||||
return new WP_Error( 'failed_fetching_status', 'Failed to fetch Protect Status data from server', array( 'status' => $response_code ) );
|
||||
}
|
||||
|
||||
$body = json_decode( wp_remote_retrieve_body( $response ) );
|
||||
self::update_status_option( $body );
|
||||
return $body;
|
||||
}
|
||||
|
||||
/**
|
||||
* Normalize data from the Protect Report data source.
|
||||
*
|
||||
* @param object $report_data Data from the Protect Report.
|
||||
* @return Status_Model
|
||||
*/
|
||||
protected static function normalize_protect_report_data( $report_data ) {
|
||||
$status = new Status_Model();
|
||||
$status->data_source = 'protect_report';
|
||||
|
||||
// map report data properties directly into the Status_Model
|
||||
$status->status = isset( $report_data->status ) ? $report_data->status : null;
|
||||
$status->last_checked = isset( $report_data->last_checked ) ? $report_data->last_checked : null;
|
||||
$status->num_threats = isset( $report_data->num_vulnerabilities ) ? $report_data->num_vulnerabilities : null;
|
||||
$status->num_themes_threats = isset( $report_data->num_themes_vulnerabilities ) ? $report_data->num_themes_vulnerabilities : null;
|
||||
$status->num_plugins_threats = isset( $report_data->num_plugins_vulnerabilities ) ? $report_data->num_plugins_vulnerabilities : null;
|
||||
|
||||
// merge plugins from report with all installed plugins before mapping into the Status_Model
|
||||
$installed_plugins = Plugins_Installer::get_plugins();
|
||||
$last_report_plugins = isset( $report_data->plugins ) ? $report_data->plugins : new \stdClass();
|
||||
$status->plugins = self::merge_installed_and_checked_lists( $installed_plugins, $last_report_plugins, array( 'type' => 'plugins' ) );
|
||||
|
||||
// merge themes from report with all installed plugins before mapping into the Status_Model
|
||||
$installed_themes = Sync_Functions::get_themes();
|
||||
$last_report_themes = isset( $report_data->themes ) ? $report_data->themes : new \stdClass();
|
||||
$status->themes = self::merge_installed_and_checked_lists( $installed_themes, $last_report_themes, array( 'type' => 'themes' ) );
|
||||
|
||||
// normalize WordPress core report data and map into Status_Model
|
||||
$status->core = self::normalize_core_information( isset( $report_data->core ) ? $report_data->core : new \stdClass() );
|
||||
|
||||
// check if any installed items (themes, plugins, or core) have not been checked in the report
|
||||
$all_items = array_merge( $status->plugins, $status->themes, array( $status->core ) );
|
||||
$unchecked_items = array_filter(
|
||||
$all_items,
|
||||
function ( $item ) {
|
||||
return ! isset( $item->checked ) || ! $item->checked;
|
||||
}
|
||||
);
|
||||
$status->has_unchecked_items = ! empty( $unchecked_items );
|
||||
|
||||
return $status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Merges the list of installed extensions with the list of extensions that were checked for known vulnerabilities and return a normalized list to be used in the UI
|
||||
*
|
||||
* @param array $installed The list of installed extensions, where each attribute key is the extension slug.
|
||||
* @param object $checked The list of checked extensions.
|
||||
* @param array $append Additional data to append to each result in the list.
|
||||
* @return array Normalized list of extensions.
|
||||
*/
|
||||
protected static function merge_installed_and_checked_lists( $installed, $checked, $append ) {
|
||||
$new_list = array();
|
||||
foreach ( array_keys( $installed ) as $slug ) {
|
||||
|
||||
$checked = (object) $checked;
|
||||
|
||||
$extension = new Extension_Model(
|
||||
array_merge(
|
||||
array(
|
||||
'name' => $installed[ $slug ]['Name'],
|
||||
'version' => $installed[ $slug ]['Version'],
|
||||
'slug' => $slug,
|
||||
'threats' => array(),
|
||||
'checked' => false,
|
||||
),
|
||||
$append
|
||||
)
|
||||
);
|
||||
|
||||
if ( isset( $checked->{ $slug } ) && $checked->{ $slug }->version === $installed[ $slug ]['Version'] ) {
|
||||
$extension->version = $checked->{ $slug }->version;
|
||||
$extension->checked = true;
|
||||
|
||||
if ( is_array( $checked->{ $slug }->vulnerabilities ) ) {
|
||||
foreach ( $checked->{ $slug }->vulnerabilities as $threat ) {
|
||||
$extension->threats[] = new Threat_Model(
|
||||
array(
|
||||
'id' => $threat->id,
|
||||
'title' => $threat->title,
|
||||
'fixed_in' => $threat->fixed_in,
|
||||
'description' => isset( $threat->description ) ? $threat->description : null,
|
||||
'source' => isset( $threat->id ) ? Redirect::get_url( 'jetpack-protect-vul-info', array( 'path' => $threat->id ) ) : null,
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$new_list[] = $extension;
|
||||
|
||||
}
|
||||
|
||||
$new_list = parent::sort_threats( $new_list );
|
||||
|
||||
return $new_list;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the WordPress version that was checked matches the current installed version.
|
||||
*
|
||||
* @param object $core_check The object returned by Protect wpcom endpoint.
|
||||
* @return object The object representing the current status of core checks.
|
||||
*/
|
||||
protected static function normalize_core_information( $core_check ) {
|
||||
global $wp_version;
|
||||
|
||||
$core = new Extension_Model(
|
||||
array(
|
||||
'type' => 'core',
|
||||
'name' => 'WordPress',
|
||||
'version' => $wp_version,
|
||||
'checked' => false,
|
||||
)
|
||||
);
|
||||
|
||||
if ( isset( $core_check->version ) && $core_check->version === $wp_version ) {
|
||||
if ( is_array( $core_check->vulnerabilities ) ) {
|
||||
$core->checked = true;
|
||||
$core->set_threats(
|
||||
array_map(
|
||||
function ( $vulnerability ) {
|
||||
$vulnerability->source = isset( $vulnerability->id ) ? Redirect::get_url( 'jetpack-protect-vul-info', array( 'path' => $vulnerability->id ) ) : null;
|
||||
return $vulnerability;
|
||||
},
|
||||
$core_check->vulnerabilities
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
return $core;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,112 @@
|
||||
<?php
|
||||
/**
|
||||
* Class file for managing REST API endpoints for package protect-status.
|
||||
*
|
||||
* @package automattic/jetpack-protect-status
|
||||
*/
|
||||
|
||||
namespace Automattic\Jetpack\Protect_Status;
|
||||
|
||||
use Automattic\Jetpack\Connection\Rest_Authentication;
|
||||
use WP_REST_Request;
|
||||
use WP_REST_Response;
|
||||
|
||||
/**
|
||||
* Class REST_Controller
|
||||
*/
|
||||
class REST_Controller {
|
||||
|
||||
/**
|
||||
* Initialize the plugin's REST API.
|
||||
*
|
||||
* @return void
|
||||
*/
|
||||
public static function init() {
|
||||
// Set up the REST authentication hooks.
|
||||
Rest_Authentication::init();
|
||||
|
||||
// Add custom WP REST API endoints.
|
||||
add_action( 'rest_api_init', array( __CLASS__, 'register_rest_endpoints' ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Register the REST API routes.
|
||||
*
|
||||
* @return void
|
||||
*/
|
||||
public static function register_rest_endpoints() {
|
||||
register_rest_route(
|
||||
'jetpack-protect/v1',
|
||||
'check-plan',
|
||||
array(
|
||||
'methods' => \WP_REST_Server::READABLE,
|
||||
'callback' => __CLASS__ . '::api_check_plan',
|
||||
'permission_callback' => function () {
|
||||
return current_user_can( 'manage_options' );
|
||||
},
|
||||
)
|
||||
);
|
||||
|
||||
register_rest_route(
|
||||
'jetpack-protect/v1',
|
||||
'status',
|
||||
array(
|
||||
'methods' => \WP_REST_Server::READABLE,
|
||||
'callback' => __CLASS__ . '::api_get_status',
|
||||
'permission_callback' => function () {
|
||||
return current_user_can( 'manage_options' );
|
||||
},
|
||||
)
|
||||
);
|
||||
|
||||
register_rest_route(
|
||||
'jetpack-protect/v1',
|
||||
'clear-scan-cache',
|
||||
array(
|
||||
'methods' => \WP_REST_Server::EDITABLE,
|
||||
'callback' => __CLASS__ . '::api_clear_scan_cache',
|
||||
'permission_callback' => function () {
|
||||
return current_user_can( 'manage_options' );
|
||||
},
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Return site plan data for the API endpoint
|
||||
*
|
||||
* @return WP_REST_Response
|
||||
*/
|
||||
public static function api_check_plan() {
|
||||
$has_required_plan = Plan::has_required_plan();
|
||||
|
||||
return rest_ensure_response( $has_required_plan, 200 );
|
||||
}
|
||||
|
||||
/**
|
||||
* Return Protect Status for the API endpoint
|
||||
*
|
||||
* @param WP_REST_Request $request The request object.
|
||||
*
|
||||
* @return WP_REST_Response
|
||||
*/
|
||||
public static function api_get_status( $request ) {
|
||||
$status = Status::get_status( $request['hard_refresh'] );
|
||||
return rest_ensure_response( $status, 200 );
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear the Scan_Status cache for the API endpoint
|
||||
*
|
||||
* @return WP_REST_Response
|
||||
*/
|
||||
public static function api_clear_scan_cache() {
|
||||
$cache_cleared = Scan_Status::delete_option();
|
||||
|
||||
if ( ! $cache_cleared ) {
|
||||
return new WP_REST_Response( 'An error occured while attempting to clear the Jetpack Scan cache.', 500 );
|
||||
}
|
||||
|
||||
return new WP_REST_Response( 'Jetpack Scan cache cleared.' );
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,362 @@
|
||||
<?php
|
||||
/**
|
||||
* Class to handle the Scan Status of Jetpack Protect
|
||||
*
|
||||
* @package automattic/jetpack-protect-status
|
||||
*/
|
||||
|
||||
namespace Automattic\Jetpack\Protect_Status;
|
||||
|
||||
use Automattic\Jetpack\Connection\Client;
|
||||
use Automattic\Jetpack\Connection\Manager as Connection_Manager;
|
||||
use Automattic\Jetpack\Plugins_Installer;
|
||||
use Automattic\Jetpack\Protect_Models\Extension_Model;
|
||||
use Automattic\Jetpack\Protect_Models\Status_Model;
|
||||
use Automattic\Jetpack\Protect_Models\Threat_Model;
|
||||
use Automattic\Jetpack\Sync\Functions as Sync_Functions;
|
||||
use Jetpack_Options;
|
||||
use WP_Error;
|
||||
|
||||
/**
|
||||
* Class that handles fetching of threats from the Scan API
|
||||
*/
|
||||
class Scan_Status extends Status {
|
||||
|
||||
/**
|
||||
* Scan endpoint
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
const SCAN_API_BASE = '/sites/%d/scan';
|
||||
|
||||
/**
|
||||
* Name of the option where status is stored
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
const OPTION_NAME = 'jetpack_scan_status';
|
||||
|
||||
/**
|
||||
* Name of the option where the timestamp of the status is stored
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
const OPTION_TIMESTAMP_NAME = 'jetpack_scan_status_timestamp';
|
||||
|
||||
/**
|
||||
* Time in seconds that the cache should last
|
||||
*
|
||||
* @var int
|
||||
*/
|
||||
const OPTION_EXPIRES_AFTER = 300; // 5 minutes.
|
||||
|
||||
/**
|
||||
* Gets the current status of the Jetpack Protect checks
|
||||
*
|
||||
* @param bool $refresh_from_wpcom Refresh the local plan and status cache from wpcom.
|
||||
* @return Status_Model
|
||||
*/
|
||||
public static function get_status( $refresh_from_wpcom = false ) {
|
||||
if ( self::$status !== null ) {
|
||||
return self::$status;
|
||||
}
|
||||
|
||||
if ( $refresh_from_wpcom || ! self::should_use_cache() || self::is_cache_expired() ) {
|
||||
$status = self::fetch_from_api();
|
||||
} else {
|
||||
$status = self::get_from_options();
|
||||
}
|
||||
|
||||
if ( is_wp_error( $status ) ) {
|
||||
$status = new Status_Model(
|
||||
array(
|
||||
'error' => true,
|
||||
'error_code' => $status->get_error_code(),
|
||||
'error_message' => $status->get_error_message(),
|
||||
)
|
||||
);
|
||||
} else {
|
||||
$status = self::normalize_api_data( $status );
|
||||
}
|
||||
|
||||
self::$status = $status;
|
||||
return $status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the Scan API endpoint
|
||||
*
|
||||
* @return WP_Error|string
|
||||
*/
|
||||
public static function get_api_url() {
|
||||
$blog_id = Jetpack_Options::get_option( 'id' );
|
||||
$is_connected = ( new Connection_Manager() )->is_connected();
|
||||
|
||||
if ( ! $blog_id || ! $is_connected ) {
|
||||
return new WP_Error( 'site_not_connected' );
|
||||
}
|
||||
|
||||
$api_url = sprintf( self::SCAN_API_BASE, $blog_id );
|
||||
|
||||
return $api_url;
|
||||
}
|
||||
|
||||
/**
|
||||
* Fetches the status data from the Scan API
|
||||
*
|
||||
* @return WP_Error|array
|
||||
*/
|
||||
public static function fetch_from_api() {
|
||||
$api_url = self::get_api_url();
|
||||
if ( is_wp_error( $api_url ) ) {
|
||||
return $api_url;
|
||||
}
|
||||
|
||||
$response = Client::wpcom_json_api_request_as_blog(
|
||||
self::get_api_url(),
|
||||
'2',
|
||||
array( 'method' => 'GET' ),
|
||||
null,
|
||||
'wpcom'
|
||||
);
|
||||
|
||||
$response_code = wp_remote_retrieve_response_code( $response );
|
||||
|
||||
if ( is_wp_error( $response ) || 200 !== $response_code || empty( $response['body'] ) ) {
|
||||
return new WP_Error( 'failed_fetching_status', 'Failed to fetch Scan data from the server', array( 'status' => $response_code ) );
|
||||
}
|
||||
|
||||
$body = json_decode( wp_remote_retrieve_body( $response ) );
|
||||
self::update_status_option( $body );
|
||||
return $body;
|
||||
}
|
||||
|
||||
/**
|
||||
* Normalize API Data
|
||||
* Formats the payload from the Scan API into an instance of Status_Model.
|
||||
*
|
||||
* @param object $scan_data The data returned by the scan API.
|
||||
*
|
||||
* @return Status_Model
|
||||
*/
|
||||
private static function normalize_api_data( $scan_data ) {
|
||||
global $wp_version;
|
||||
|
||||
$status = new Status_Model();
|
||||
$status->data_source = 'scan_api';
|
||||
$status->status = isset( $scan_data->state ) ? $scan_data->state : null;
|
||||
$status->num_threats = 0;
|
||||
$status->num_themes_threats = 0;
|
||||
$status->num_plugins_threats = 0;
|
||||
$status->has_unchecked_items = false;
|
||||
$status->current_progress = isset( $scan_data->current->progress ) ? $scan_data->current->progress : null;
|
||||
|
||||
if ( ! empty( $scan_data->most_recent->timestamp ) ) {
|
||||
$date = new \DateTime( $scan_data->most_recent->timestamp );
|
||||
if ( $date ) {
|
||||
$status->last_checked = $date->format( 'Y-m-d H:i:s' );
|
||||
}
|
||||
}
|
||||
|
||||
$status->core = new Extension_Model(
|
||||
array(
|
||||
'type' => 'core',
|
||||
'name' => 'WordPress',
|
||||
'version' => $wp_version,
|
||||
'checked' => true, // to do: default to false once Scan API has manifest
|
||||
)
|
||||
);
|
||||
|
||||
if ( isset( $scan_data->threats ) && is_array( $scan_data->threats ) ) {
|
||||
foreach ( $scan_data->threats as $threat ) {
|
||||
if ( isset( $threat->extension->type ) ) {
|
||||
if ( 'plugin' === $threat->extension->type ) {
|
||||
// add the extension if it does not yet exist in the status
|
||||
if ( ! isset( $status->plugins[ $threat->extension->slug ] ) ) {
|
||||
$status->plugins[ $threat->extension->slug ] = new Extension_Model(
|
||||
array(
|
||||
'name' => isset( $threat->extension->name ) ? $threat->extension->name : null,
|
||||
'slug' => isset( $threat->extension->slug ) ? $threat->extension->slug : null,
|
||||
'version' => isset( $threat->extension->version ) ? $threat->extension->version : null,
|
||||
'type' => 'plugin',
|
||||
'checked' => true,
|
||||
'threats' => array(),
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
$status->plugins[ $threat->extension->slug ]->threats[] = new Threat_Model(
|
||||
array(
|
||||
'id' => isset( $threat->id ) ? $threat->id : null,
|
||||
'signature' => isset( $threat->signature ) ? $threat->signature : null,
|
||||
'title' => isset( $threat->title ) ? $threat->title : null,
|
||||
'description' => isset( $threat->description ) ? $threat->description : null,
|
||||
'vulnerability_description' => isset( $threat->vulnerability_description ) ? $threat->vulnerability_description : null,
|
||||
'fix_description' => isset( $threat->fix_description ) ? $threat->fix_description : null,
|
||||
'payload_subtitle' => isset( $threat->payload_subtitle ) ? $threat->payload_subtitle : null,
|
||||
'payload_description' => isset( $threat->payload_description ) ? $threat->payload_description : null,
|
||||
'first_detected' => isset( $threat->first_detected ) ? $threat->first_detected : null,
|
||||
'fixed_in' => isset( $threat->fixer->fixer ) && 'update' === $threat->fixer->fixer ? $threat->fixer->target : null,
|
||||
'severity' => isset( $threat->severity ) ? $threat->severity : null,
|
||||
'fixable' => isset( $threat->fixer ) ? $threat->fixer : null,
|
||||
'status' => isset( $threat->status ) ? $threat->status : null,
|
||||
'filename' => isset( $threat->filename ) ? $threat->filename : null,
|
||||
'context' => isset( $threat->context ) ? $threat->context : null,
|
||||
'source' => isset( $threat->source ) ? $threat->source : null,
|
||||
)
|
||||
);
|
||||
++$status->num_threats;
|
||||
++$status->num_plugins_threats;
|
||||
continue;
|
||||
}
|
||||
|
||||
if ( 'theme' === $threat->extension->type ) {
|
||||
// add the extension if it does not yet exist in the status
|
||||
if ( ! isset( $status->themes[ $threat->extension->slug ] ) ) {
|
||||
$status->themes[ $threat->extension->slug ] = new Extension_Model(
|
||||
array(
|
||||
'name' => isset( $threat->extension->name ) ? $threat->extension->name : null,
|
||||
'slug' => isset( $threat->extension->slug ) ? $threat->extension->slug : null,
|
||||
'version' => isset( $threat->extension->version ) ? $threat->extension->version : null,
|
||||
'type' => 'theme',
|
||||
'checked' => true,
|
||||
'threats' => array(),
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
$status->themes[ $threat->extension->slug ]->threats[] = new Threat_Model(
|
||||
array(
|
||||
'id' => isset( $threat->id ) ? $threat->id : null,
|
||||
'signature' => isset( $threat->signature ) ? $threat->signature : null,
|
||||
'title' => isset( $threat->title ) ? $threat->title : null,
|
||||
'description' => isset( $threat->description ) ? $threat->description : null,
|
||||
'vulnerability_description' => isset( $threat->vulnerability_description ) ? $threat->vulnerability_description : null,
|
||||
'fix_description' => isset( $threat->fix_description ) ? $threat->fix_description : null,
|
||||
'payload_subtitle' => isset( $threat->payload_subtitle ) ? $threat->payload_subtitle : null,
|
||||
'payload_description' => isset( $threat->payload_description ) ? $threat->payload_description : null,
|
||||
'first_detected' => isset( $threat->first_detected ) ? $threat->first_detected : null,
|
||||
'fixed_in' => isset( $threat->fixer->fixer ) && 'update' === $threat->fixer->fixer ? $threat->fixer->target : null,
|
||||
'severity' => isset( $threat->severity ) ? $threat->severity : null,
|
||||
'fixable' => isset( $threat->fixer ) ? $threat->fixer : null,
|
||||
'status' => isset( $threat->status ) ? $threat->status : null,
|
||||
'filename' => isset( $threat->filename ) ? $threat->filename : null,
|
||||
'context' => isset( $threat->context ) ? $threat->context : null,
|
||||
'source' => isset( $threat->source ) ? $threat->source : null,
|
||||
)
|
||||
);
|
||||
++$status->num_threats;
|
||||
++$status->num_themes_threats;
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
if ( isset( $threat->signature ) && 'Vulnerable.WP.Core' === $threat->signature ) {
|
||||
if ( $threat->version !== $wp_version ) {
|
||||
continue;
|
||||
}
|
||||
|
||||
$status->core->threats[] = new Threat_Model(
|
||||
array(
|
||||
'id' => $threat->id,
|
||||
'signature' => $threat->signature,
|
||||
'title' => $threat->title,
|
||||
'description' => $threat->description,
|
||||
'first_detected' => $threat->first_detected,
|
||||
'severity' => $threat->severity,
|
||||
)
|
||||
);
|
||||
++$status->num_threats;
|
||||
|
||||
continue;
|
||||
}
|
||||
|
||||
if ( ! empty( $threat->filename ) ) {
|
||||
$status->files[] = new Threat_Model( $threat );
|
||||
++$status->num_threats;
|
||||
continue;
|
||||
}
|
||||
|
||||
if ( ! empty( $threat->table ) ) {
|
||||
$status->database[] = new Threat_Model( $threat );
|
||||
++$status->num_threats;
|
||||
continue;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$installed_plugins = Plugins_Installer::get_plugins();
|
||||
$status->plugins = self::merge_installed_and_checked_lists( $installed_plugins, $status->plugins, array( 'type' => 'plugins' ), true );
|
||||
|
||||
$installed_themes = Sync_Functions::get_themes();
|
||||
$status->themes = self::merge_installed_and_checked_lists( $installed_themes, $status->themes, array( 'type' => 'themes' ), true );
|
||||
|
||||
foreach ( array_merge( $status->themes, $status->plugins ) as $extension ) {
|
||||
if ( ! $extension->checked ) {
|
||||
$status->has_unchecked_items = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return $status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Merges the list of installed extensions with the list of extensions that were checked for known vulnerabilities and return a normalized list to be used in the UI
|
||||
*
|
||||
* @param array $installed The list of installed extensions, where each attribute key is the extension slug.
|
||||
* @param object $checked The list of checked extensions.
|
||||
* @param array $append Additional data to append to each result in the list.
|
||||
* @return array Normalized list of extensions.
|
||||
*/
|
||||
protected static function merge_installed_and_checked_lists( $installed, $checked, $append ) {
|
||||
$new_list = array();
|
||||
$checked = (object) $checked;
|
||||
|
||||
foreach ( array_keys( $installed ) as $slug ) {
|
||||
/**
|
||||
* Extension Type Map
|
||||
*
|
||||
* @var array $extension_type_map Key value pairs of extension types and their corresponding
|
||||
* identifier used by the Scan API data source.
|
||||
*/
|
||||
$extension_type_map = array(
|
||||
'themes' => 'r1',
|
||||
'plugins' => 'r2',
|
||||
);
|
||||
|
||||
$version = $installed[ $slug ]['Version'];
|
||||
$short_slug = str_replace( '.php', '', explode( '/', $slug )[0] );
|
||||
$scanifest_slug = $extension_type_map[ $append['type'] ] . ":$short_slug@$version";
|
||||
|
||||
$extension = new Extension_Model(
|
||||
array_merge(
|
||||
array(
|
||||
'name' => $installed[ $slug ]['Name'],
|
||||
'version' => $version,
|
||||
'slug' => $slug,
|
||||
'threats' => array(),
|
||||
'checked' => false,
|
||||
),
|
||||
$append
|
||||
)
|
||||
);
|
||||
|
||||
if ( ! isset( $checked->extensions ) // no extension data available from Scan API
|
||||
|| is_array( $checked->extensions ) && in_array( $scanifest_slug, $checked->extensions, true ) // extension data matches Scan API
|
||||
) {
|
||||
$extension->checked = true;
|
||||
if ( isset( $checked->{ $short_slug }->threats ) ) {
|
||||
$extension->threats = $checked->{ $short_slug }->threats;
|
||||
}
|
||||
}
|
||||
|
||||
$new_list[] = $extension;
|
||||
|
||||
}
|
||||
|
||||
$new_list = parent::sort_threats( $new_list );
|
||||
|
||||
return $new_list;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,311 @@
|
||||
<?php
|
||||
/**
|
||||
* Class to handle the Status of Jetpack Protect
|
||||
*
|
||||
* @package automattic/jetpack-protect-status
|
||||
*/
|
||||
|
||||
namespace Automattic\Jetpack\Protect_Status;
|
||||
|
||||
use Automattic\Jetpack\Protect_Models\Extension_Model;
|
||||
use Automattic\Jetpack\Protect_Models\Status_Model;
|
||||
|
||||
/**
|
||||
* Class that handles fetching and caching the Status of vulnerabilities check from the WPCOM servers
|
||||
*/
|
||||
class Status {
|
||||
|
||||
const PACKAGE_VERSION = '0.1.5';
|
||||
/**
|
||||
* Name of the option where status is stored
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
const OPTION_NAME = '';
|
||||
|
||||
/**
|
||||
* Name of the option where the timestamp of the status is stored
|
||||
*
|
||||
* @var string
|
||||
*/
|
||||
const OPTION_TIMESTAMP_NAME = '';
|
||||
|
||||
/**
|
||||
* Time in seconds that the cache should last
|
||||
*
|
||||
* @var int
|
||||
*/
|
||||
const OPTION_EXPIRES_AFTER = 3600; // 1 hour.
|
||||
|
||||
/**
|
||||
* Time in seconds that the cache for the initial empty response should last
|
||||
*
|
||||
* @var int
|
||||
*/
|
||||
const INITIAL_OPTION_EXPIRES_AFTER = 1 * MINUTE_IN_SECONDS;
|
||||
|
||||
/**
|
||||
* Memoization for the current status
|
||||
*
|
||||
* @var null|Status_Model
|
||||
*/
|
||||
public static $status = null;
|
||||
|
||||
/**
|
||||
* Gets the current status of the Jetpack Protect checks
|
||||
*
|
||||
* @param bool $refresh_from_wpcom Refresh the local plan and status cache from wpcom.
|
||||
* @return Status_Model
|
||||
*/
|
||||
public static function get_status( $refresh_from_wpcom = false ) {
|
||||
$use_scan_status = Plan::has_required_plan();
|
||||
|
||||
if ( defined( 'JETPACK_PROTECT_DEV__DATA_SOURCE' ) ) {
|
||||
if ( 'scan_api' === JETPACK_PROTECT_DEV__DATA_SOURCE ) {
|
||||
$use_scan_status = true;
|
||||
}
|
||||
|
||||
if ( 'protect_report' === JETPACK_PROTECT_DEV__DATA_SOURCE ) {
|
||||
$use_scan_status = false;
|
||||
}
|
||||
}
|
||||
|
||||
self::$status = $use_scan_status ? Scan_Status::get_status( $refresh_from_wpcom ) : Protect_Status::get_status( $refresh_from_wpcom );
|
||||
return self::$status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks if the current cached status is expired and should be renewed
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public static function is_cache_expired() {
|
||||
$option_timestamp = get_option( static::OPTION_TIMESTAMP_NAME );
|
||||
|
||||
if ( ! $option_timestamp ) {
|
||||
return true;
|
||||
}
|
||||
|
||||
return time() > (int) $option_timestamp;
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks if we should consider the stored cache or bypass it
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public static function should_use_cache() {
|
||||
return defined( 'JETPACK_PROTECT_DEV__BYPASS_CACHE' ) && JETPACK_PROTECT_DEV__BYPASS_CACHE ? false : true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the current cached status
|
||||
*
|
||||
* @return bool|array False if value is not found. Array with values if cache is found.
|
||||
*/
|
||||
public static function get_from_options() {
|
||||
return maybe_unserialize( get_option( static::OPTION_NAME ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Updated the cached status and its timestamp
|
||||
*
|
||||
* @param array $status The new status to be cached.
|
||||
* @return void
|
||||
*/
|
||||
public static function update_status_option( $status ) {
|
||||
// TODO: Sanitize $status.
|
||||
update_option( static::OPTION_NAME, maybe_serialize( $status ) );
|
||||
$end_date = self::get_cache_end_date_by_status( $status );
|
||||
update_option( static::OPTION_TIMESTAMP_NAME, $end_date );
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the timestamp the cache should expire depending on the current status
|
||||
*
|
||||
* Initial empty status, which are returned before the first check was performed, should be cache for less time
|
||||
*
|
||||
* @param object $status The response from the server being cached.
|
||||
* @return int The timestamp when the cache should expire.
|
||||
*/
|
||||
public static function get_cache_end_date_by_status( $status ) {
|
||||
if ( ! is_object( $status ) || empty( $status->last_checked ) ) {
|
||||
return time() + static::INITIAL_OPTION_EXPIRES_AFTER;
|
||||
}
|
||||
return time() + static::OPTION_EXPIRES_AFTER;
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete the cached status and its timestamp
|
||||
*
|
||||
* @return bool Whether all related status options were successfully deleted.
|
||||
*/
|
||||
public static function delete_option() {
|
||||
$option_deleted = delete_option( static::OPTION_NAME );
|
||||
$option_timestamp_deleted = delete_option( static::OPTION_TIMESTAMP_NAME );
|
||||
|
||||
return $option_deleted && $option_timestamp_deleted;
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks the current status to see if there are any threats found
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public static function has_threats() {
|
||||
return 0 < self::get_total_threats();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the total number of threats found
|
||||
*
|
||||
* @return integer
|
||||
*/
|
||||
public static function get_total_threats() {
|
||||
$status = static::get_status();
|
||||
return isset( $status->num_threats ) && is_int( $status->num_threats ) ? $status->num_threats : 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all threats combined
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function get_all_threats() {
|
||||
return array_merge(
|
||||
self::get_wordpress_threats(),
|
||||
self::get_themes_threats(),
|
||||
self::get_plugins_threats(),
|
||||
self::get_files_threats(),
|
||||
self::get_database_threats()
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get threats found for WordPress core
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function get_wordpress_threats() {
|
||||
return self::get_threats( 'core' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Get threats found for themes
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function get_themes_threats() {
|
||||
return self::get_threats( 'themes' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Get threats found for plugins
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function get_plugins_threats() {
|
||||
return self::get_threats( 'plugins' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Get threats found for files
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function get_files_threats() {
|
||||
return self::get_threats( 'files' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Get threats found for plugins
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function get_database_threats() {
|
||||
return self::get_threats( 'database' );
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the threats for one type of extension or core
|
||||
*
|
||||
* @param string $type What threats you want to get. Possible values are 'core', 'themes' and 'plugins'.
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
public static function get_threats( $type ) {
|
||||
$status = static::get_status();
|
||||
|
||||
if ( 'core' === $type ) {
|
||||
return isset( $status->$type ) && ! empty( $status->$type->threats ) ? $status->$type->threats : array();
|
||||
}
|
||||
|
||||
if ( 'files' === $type || 'database' === $type ) {
|
||||
return isset( $status->$type ) && ! empty( $status->$type ) ? $status->$type : array();
|
||||
}
|
||||
|
||||
$threats = array();
|
||||
if ( isset( $status->$type ) ) {
|
||||
foreach ( (array) $status->$type as $item ) {
|
||||
if ( ! empty( $item->threats ) ) {
|
||||
$threats = array_merge( $threats, $item->threats );
|
||||
}
|
||||
}
|
||||
}
|
||||
return $threats;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the WordPress version that was checked matches the current installed version.
|
||||
*
|
||||
* @param object $core_check The object returned by Protect wpcom endpoint.
|
||||
* @return object The object representing the current status of core checks.
|
||||
*/
|
||||
protected static function normalize_core_information( $core_check ) {
|
||||
global $wp_version;
|
||||
|
||||
$core = new Extension_Model(
|
||||
array(
|
||||
'type' => 'core',
|
||||
'name' => 'WordPress',
|
||||
'version' => $wp_version,
|
||||
'checked' => false,
|
||||
)
|
||||
);
|
||||
|
||||
if ( isset( $core_check->version ) && $core_check->version === $wp_version ) {
|
||||
if ( is_array( $core_check->vulnerabilities ) ) {
|
||||
$core->checked = true;
|
||||
$core->set_threats( $core_check->vulnerabilities );
|
||||
}
|
||||
}
|
||||
|
||||
return $core;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sort By Threats
|
||||
*
|
||||
* @param array<object> $threats Array of threats to sort.
|
||||
*
|
||||
* @return array<object> The sorted $threats array.
|
||||
*/
|
||||
protected static function sort_threats( $threats ) {
|
||||
usort(
|
||||
$threats,
|
||||
function ( $a, $b ) {
|
||||
// sort primarily based on the presence of threats
|
||||
$ret = empty( $a->threats ) <=> empty( $b->threats );
|
||||
|
||||
// sort secondarily on whether the item has been checked
|
||||
if ( ! $ret ) {
|
||||
$ret = $a->checked <=> $b->checked;
|
||||
}
|
||||
|
||||
return $ret;
|
||||
}
|
||||
);
|
||||
|
||||
return $threats;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user