asda2432es

✏️ Editing: class-secupress-scan-db-prefix.php

<?php
defined( 'ABSPATH' ) or die( 'Something went wrong.' );

/**
 * DB Prefix scan class.
 *
 * @package SecuPress
 * @subpackage SecuPress_Scan
 * @since 1.0
 */
class SecuPress_Scan_DB_Prefix extends SecuPress_Scan implements SecuPress_Scan_Interface {

/** Constants. ============================================================================== */

/**
	 * Class version.
	 *
	 * @var (string)
	 */
	const VERSION = '1.0.2';

/** Properties. ============================================================================= */

/**
	 * The reference to the *Singleton* instance of this class.
	 *
	 * @var (object)
	 */
	protected static $_instance;

/** Init and messages. ====================================================================== */

/**
	 * Init.
	 *
	 * @since 1.0
	 */
	protected function init() {
		$this->title    = __( 'Check if your database tables prefix is correct.', 'secupress' );
		$this->more     = __( 'Avoid the use of <code>wp_</code> or <code>wordpress_</code> as database tables prefix to improve your security.', 'secupress' );
		$this->more_fix = __( 'Rename all your database table names, then update your configuration with a new and more secure one.', 'secupress' );
	}

/**
	 * Get messages.
	 *
	 * @since 1.0
	 *
	 * @param (int) $message_id A message ID.
	 *
	 * @return (string|array) A message if a message ID is provided. An array containing all messages otherwise.
	 */
	public static function get_messages( $message_id = null ) {
		$messages = array(
			// "good"
			0   => __( 'Your database tables prefix is correct.', 'secupress' ),
			// "bad"
			200 => __( 'The database tables prefix should not be %s. Choose something else besides <code>wp_</code> or <code>wordpress_</code>, they are too easy to guess.', 'secupress' ),
			// "cantfix"
			301 => __( 'The database user cannot alter tables and so the database tables prefix could not be changed.', 'secupress' ),
			302 => sprintf( __( 'The <code>%s</code> file is not writable, so the database tables prefix cannot be changed.', 'secupress' ), secupress_get_wpconfig_filename( 'db' ) ),
			303 => __( 'The database user seems to have to correct rights, but the database tables prefix could still not be changed.', 'secupress' ),
			304 => __( 'Too many database tables found, so which ones to rename?!', 'secupress' ), // Trinity! Help me!
		);

if ( isset( $message_id ) ) {
			return isset( $messages[ $message_id ] ) ? $messages[ $message_id ] : __( 'Unknown message', 'secupress' );
		}

return $messages;
	}

/** Getters. ================================================================================ */

/**
	 * Get the documentation URL.
	 *
	 * @since 1.2.3
	 *
	 * @return (string)
	 */
	public static function get_docs_url() {
		return __( 'https://docs.secupress.me/article/99-database-table-prefix-scan', 'secupress' );
	}

/** Scan. =================================================================================== */

/**
	 * Scan for flaw(s).
	 *
	 * @since 1.0
	 *
	 * @return (array) The scan results.
	 */
	public function scan() {

$activated = $this->filter_scanner( __CLASS__ );
		if ( true === $activated ) {
			$this->add_message( 0 );
			return parent::scan();
		}

global $wpdb;

if ( $this->need_fix() ) {
			// "bad"
			$this->add_message( 200, array( '<code>' . $wpdb->prefix . '</code>' ) );
		} else {
			// "good"
			$this->add_message( 0 );
		}

return parent::scan();
	}

/** Fix. ==================================================================================== */

/**
	 * Tell if we need to rename the table prefix.
	 *
	 * @since 1.1.1
	 * @author Grégory Viguier
	 *
	 * @return (bool)
	 */
	protected function need_fix() {
		global $wpdb;
		return 'wp_' === $wpdb->prefix || 'wordpress_' === $wpdb->prefix;
	}

/**
	 * Tell if the `wp-config.php` file can be fixed.
	 *
	 * @since 1.2.2 Returns the file path instead of true.
	 * @since 1.1.1
	 * @author Grégory Viguier
	 *
	 * @return (string|bool) The path of `wp-config.php` file or false.
	 */
	protected function is_wp_config_fixable() {
		global $wpdb;

$wpconfig_filepath = secupress_is_wpconfig_writable( 'db' );

if ( ! $wpconfig_filepath ) {
			return false;
		}

// Get the file content
		$file_content = file_get_contents( $wpconfig_filepath );
		// Find the string we need with WP default syntax
		$match_default = preg_match( '/\$table_prefix\s*=\s*(\'' . $wpdb->prefix . '\'|"' . $wpdb->prefix . '");.*/', $file_content );
		if ( $match_default ) {
			return $wpconfig_filepath;
		}

// Find the string we need with GLOBALS syntax
		$match_globals = preg_match( '/\$GLOBALS[\'table_prefix\']\s*=\s*(\'' . $wpdb->prefix . '\'|"' . $wpdb->prefix . '");.*/', $file_content );
		if ( $match_globals ) {
			return $wpconfig_filepath;
		}

// Nothing found
		return false;
	}

/**
	 * Try to fix the flaw(s).
	 *
	 * @since 1.0
	 *
	 * @return (array) The fix results.
	 */
	public function fix() {

if ( ! $this->need_fix() ) {
			// "good"
			$this->add_fix_message( 0 );
			return parent::fix();
		}

$can_fix = true;

if ( ! secupress_db_access_granted() ) {
			// "cantfix"
			$this->add_fix_message( 301 );
			$can_fix = false;
		}

if ( ! secupress_where_is_table_prefix() ) {
			// "cantfix"
			$this->add_fix_message( 302 );
			$can_fix = false;
		}

if ( ! $can_fix ) {
			return parent::fix();
		}

// "bad"
		$this->add_fix_message( 200 );

return parent::fix();
	}

/** Manual fix. ============================================================================= */

/**
	 * Return an array of actions if a manual fix is needed here.
	 *
	 * @since 1.0
	 * @since 1.1.1 Return false instead of an empty array.
	 *
	 * @return (array|bool)
	 */
	public function need_manual_fix() {

if ( ! $this->need_fix() ) {
			return false;
		}

if ( ! secupress_where_is_table_prefix() ) {
			return false;
		}

if ( ! secupress_db_access_granted() ) {
			return array( 'db_access' => 'db_access' );
		}

// We have non WP table(s) to (maybe) rename, the user must choose.
		return array( 'select-db-tables-to-rename' => 'select-db-tables-to-rename' );
	}

/**
	 * Try to fix the flaw(s) after requiring user action.
	 *
	 * @since 1.0
	 *
	 * @return (array) The fix results.
	 */
	public function manual_fix() {
		global $wpdb, $table_prefix;

if ( ! empty( $_POST ) && ! $this->has_fix_action_part( 'select-db-tables-to-rename' ) ) { // WPCS: CSRF ok.
			return parent::manual_fix();
		}

// Make the tests again, we want to be sure to not run this script unnecessarily.
		if ( ! $this->need_fix() ) {
			// "good"
			$this->add_fix_message( 0 );
			return parent::manual_fix();
		}

$can_fix = true;

if ( ! secupress_db_access_granted() ) {
			// "cantfix"
			$this->add_fix_message( 301 );
			$can_fix = false;
		}

$wpconfig_filepath = secupress_where_is_table_prefix();

if ( ! $wpconfig_filepath ) {
			// "cantfix"
			$this->add_fix_message( 302 );
			$can_fix = false;
		}

if ( ! $can_fix ) {
			return parent::manual_fix();
		}

// Chosen non WP tables.
		$tables_to_rename = secupress_get_wp_tables();
		if ( isset( $_POST['secupress-select-db-tables-to-rename-flag'] ) && ! empty( $_POST['secupress-select-db-tables-to-rename'] ) ) { // WPCS: CSRF ok.
			$non_wp_tables    = (array) $_POST['secupress-select-db-tables-to-rename']; // WPCS: CSRF ok.
			$non_wp_tables    = array_intersect( $non_wp_tables, secupress_get_non_wp_tables() );
			$tables_to_rename = array_merge( $non_wp_tables, $tables_to_rename );
		}
		secupress_change_db_prefix( secupress_create_unique_db_prefix(), $tables_to_rename );

$this->add_fix_message( 0 );

return parent::manual_fix();
	}

/**
	 * Get an array containing ALL the forms that would fix the scan if it requires user action.
	 *
	 * @since 1.0
	 *
	 * @return (array) An array of HTML templates (form contents most of the time).
	 */
	protected function get_fix_action_template_parts() {
		global $wpdb;

$non_wp_tables = secupress_get_non_wp_tables();
		$wp_tables     = secupress_get_wp_tables();
		$blog_ids      = ! is_multisite() ? array( '1' ) : $wpdb->get_col( "SELECT blog_id FROM {$wpdb->blogs}" );

$form  = '<div class="show-input">';

$form .= '<h4>' . __( 'Checked tables will be renamed:', 'secupress' ) . '</h4>';
		$form .= '<input type="hidden" name="secupress-select-db-tables-to-rename-flag">';

$form .= '<fieldset aria-labelledby="select-db-tables-to-rename" class="secupress-boxed-group">';

if ( $non_wp_tables ) {
			$form .= '<b>' . __( 'Unknown tables', 'secupress' ) . '</b><br/>';
			foreach ( $non_wp_tables as $table ) {
				$table_attr = esc_attr( $table );
				$form      .= '<input type="checkbox" name="secupress-select-db-tables-to-rename[]" value="' . $table_attr . '" id="select-db-tables-to-rename-' . $table_attr . '" checked="checked"><label for="select-db-tables-to-rename-' . $table_attr . '">' . esc_html( $table ) . '</label><br/>';
			}
		}

$form .= '<b>' . __( 'WordPress tables (mandatory)', 'secupress' ) . '</b><br/>';

foreach ( $blog_ids as $blog_id ) {
			$blog_id = '1' === $blog_id ? '' : $blog_id . '_';

foreach ( $wp_tables as $table ) {
				$table = substr_replace( $table, $wpdb->prefix . $blog_id, 0, strlen( $wpdb->prefix ) );
				$form .= '<input type="checkbox" id="secupress-select-db-tables-to-rename-' . esc_attr( $table ) . '" checked="checked" disabled="disabled"><label>' . esc_html( $table ) . '</label><br/>';
			}
		}

$form .= '</fieldset>';

$form .= '</div>';

return [ 'select-db-tables-to-rename' => $form,
				 'db_access' => $this->get_messages( 301 ) . '<br>' . sprintf( __( 'Please <a href="%s">read the documentation</a>.', 'secupress' ), $this->get_docs_url() ),
				 'wpconfig_fixable' => $this->get_messages( 302 ) . '<br>' . sprintf( __( 'Please <a href="%s">read the documentation</a>.', 'secupress' ), $this->get_docs_url() ),
			 	];
	}
}

Ubuntu

Sid Gifari From Gifari Industries - BD Cyber Security Team