文件操作 - XMLRPC.php

文件: /home/www/public/wp-content/plugins/ionos-security/inc/Controllers/XMLRPC.php

编辑文件内容

<?php

namespace Ionos\Security\Controllers;

use Ionos\Security\Controllers\Settings\SettingsXMLRPC;
use Ionos\Librarysecurity\Config;
use Ionos\Librarysecurity\Options;
use Ionos\Security\Helper;

/**
 * Contains the main logic of the plugin and functions that are used for managing the plugin options.
 */
class XMLRPC {

/**
	 * Inits relevant actions, hooks and filters.
	 *
	 * @since 1.0.0
	 */
	public static function init() {
		// Register uninstall hook.
		register_uninstall_hook( basename( __DIR__ ), [ __CLASS__, 'on_uninstall' ] );

// Check if the feature is enabled in the s3 config.
		if ( Config::get( 'features.xmlrpcGuard.enabled' ) !== '1' ) {
			return;
		}

add_action( 'admin_init', [ __CLASS__, 'init_settings_builder' ], 230 );

// Check if toggle is switched on.
		if ( self::get_option( 'xmlrpc_guard_enabled' ) === 1 ) {
			self::enable_xmlrpc_methods_allowlisting();
		}
	}

/**
	 * Load the settings builder scripts.
	 */
	public static function init_settings_builder() {
		$settings = new SettingsXMLRPC();
		$settings->init();
	}

/**
	 * Inits backend related actions, hooks and filters.
	 *
	 * @since 1.0.0
	 */
	public function admin_init() {
		if ( is_multisite() ) {
			add_action( 'delete_blog', [ __CLASS__, 'uninstall_later' ] );
		}
	}

/**
	 * Gets plugins options.
	 *
	 * @since 1.0.0
	 *
	 * @return array Array of option values
	 */
	public static function get_options() {
		return get_option( 'ionos-security', [] );
	}

/**
	 * Gets options managed by the xmlrpc-guard feature.
	 *
	 * @since 1.0.0
	 *
	 * @return array Array of option values prefixed with xmlrpc_guard_.
	 */
	public static function get_feature_options() {
		return array_filter(
			self::get_options(),
			/**
			 * Filters options by prefix.
			 *
			 * @param string $option The option key.
			 *
			 * @return bool True if the option key starts with xmlrpc_guard_, false otherwise.
			 */
			function ( $option_key ) {
				return strpos( $option_key, 'xmlrpc_guard_' ) !== false;
			},
			ARRAY_FILTER_USE_KEY
		);
	}

/**
	 * Merges the options passed as parameter with the existing options and updates them in database.
	 *
	 * @since 1.0.0
	 *
	 * @param array $options The options to update.
	 *
	 * @return bool
	 */
	public static function set_options( $options ) {
		$merged_options = array_merge( self::get_options(), $options );
		return update_option( 'ionos-security', $merged_options );
	}

/**
	 * Uninstalls the plugin, also removes settings for all multisite instances.
	 *
	 * @since 1.0.0
	 */
	public static function on_uninstall() {
		global $wpdb;

// phpcs:ignore WordPress.Security.NonceVerification.Recommended
		if ( is_multisite() && ! empty( $_GET['networkwide'] ) ) {
			// Get all multisite IDs in a performance optimized way, rather than using get_sites().
			$ids = $wpdb->get_col( "SELECT blog_id FROM `{$wpdb->blogs}`" );

foreach ( $ids as $id ) {
				switch_to_blog( $id );
				self::uninstall_backend();
			}

restore_current_blog();

return;
		}
		self::uninstall_backend();
	}

/**
	 * Cleans up the options table from the plugin settings.
	 *
	 * @since 1.0.0
	 */
	private static function uninstall_backend() {
		delete_option( 'ionos-security' );

Options::set_tenant_and_plugin_name( 'ionos', 'security' );
		Options::clean_up( basename( __DIR__ ) );
	}

/**
	 * Removes the settings for a specific blog if it is a network installation.
	 *
	 * @since 1.0.0
	 *
	 * @param integer $id Multisite Blog ID.
	 */
	public static function uninstall_later( $id ) {
		//phpcs:ignore PHPCompatibility.FunctionUse.NewFunctionParameters.dirname_levelsFound
		if ( ! is_plugin_active_for_network( basename( plugin_dir_path( dirname( __DIR__, 1 ) ) ) ) ) {
			return;
		}

switch_to_blog( $id );
		self::uninstall_backend();
		restore_current_blog();
	}

/**
	 * Gets a specific option.
	 *
	 * @since 1.0.0
	 *
	 * @param string $option The option key.
	 *
	 * @return mixed|null
	 */
	public static function get_option( $option ) {
		$options = self::get_options();
		if ( isset( $options[ $option ] ) ) {
			return $options[ $option ];
		}

return null;
	}

/**
	 * Checks if IPv4 is in CIDR.
	 *
	 * @since 1.0.0
	 *
	 * @param string $ipv4 IPv4 address.
	 * @param string $cidr CIDR.
	 *
	 * @return bool
	 */
	public static function ipv4_in_cidr( $ipv4, $cidr ) {
		list ( $subnet, $mask ) = explode( '/', $cidr );
		$subnet_addr            = ip2long( $subnet );
		$ip_addr                = ip2long( $ipv4 );
		$mask_addr              = -1 << ( 32 - $mask );
		return ( $subnet_addr & $mask_addr ) === ( $ip_addr & $mask_addr );
	}

/**
	 * Checks if IPv6 is in CIDR.
	 *
	 * @since 1.0.0
	 *
	 * @param string $ipv6 IPv6 address.
	 * @param string $cidr CIDR.
	 *
	 * @return bool
	 */
	public static function ipv6_in_cidr( $ipv6, $cidr ) {
		list ( $subnet, $mask ) = explode( '/', $cidr );
		$subnet_addr            = inet_pton( $subnet );
		$ip_addr                = inet_pton( $ipv6 );
		$mask_addr              = inet_pton( str_repeat( 'f', $mask / 4 ) . ( $mask % 4 ? substr( 'f0', 2 - $mask % 4, 1 ) : '' ) );
		return ( $subnet_addr & $mask_addr ) === ( $ip_addr & $mask_addr );
	}

/**
	 * Checks whether the current request is an XML-RPC request.
	 *
	 * @since 1.0.0
	 *
	 * @return bool
	 */
	private static function is_xmlrpc_request() {
		return defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST;
	}

/**
	 * Disables all XMLRPC methods.
	 *
	 * @since 1.0.0
	 */
	private static function disable_xmlrpc_methods() {
		add_filter( 'xmlrpc_methods', '__return_empty_array' );
	}

/**
	 * Enables the IP allowlisting logic in case it is an XML-RPC request.
	 *
	 * @since 1.0.0
	 */
	private static function enable_xmlrpc_methods_allowlisting() {
		if ( ! self::is_xmlrpc_request() ) {
			return;
		}

if ( ! isset( $_SERVER['REMOTE_ADDR'] ) ) {
			self::disable_xmlrpc_methods();
		}

$ip = $_SERVER['REMOTE_ADDR'];

if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 ) !== false ) {
			$ipv4_allow_list = Config::get( 'features.xmlrpcGuard.allowLists.cidr.ipv4' );
			foreach ( $ipv4_allow_list as $cidr ) {
				if ( self::ipv4_in_cidr( $ip, $cidr ) !== false ) {
					return;
				}
			}
		}

if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 ) !== false ) {
			$ipv6_allow_list = Config::get( 'features.xmlrpcGuard.allowLists.cidr.ipv6' );
			foreach ( $ipv6_allow_list as $cidr ) {
				if ( self::ipv6_in_cidr( $ip, $cidr ) !== false ) {
					return;
				}
			}
		}

self::disable_xmlrpc_methods();
	}
}

文件操作 - XMLRPC.php

文件: /home/www/public/wp-content/plugins/ionos-security/inc/Controllers/XMLRPC.php

编辑文件内容

修改文件时间

删除文件