asda2432es

✏️ Editing: class-secupress-scan-passwords-strength.php

<?php
defined( 'ABSPATH' ) or die( 'Cheatin\' uh?' );

/**
 * Passwords Strength scan class.
 *
 * @package SecuPress
 * @subpackage SecuPress_Scan
 * @since 1.0
 */
class SecuPress_Scan_Passwords_Strength extends SecuPress_Scan implements SecuPress_Scan_Interface {

/** Constants. ============================================================================== */

/**
	 * Class version.
	 *
	 * @var (string)
	 */
	const VERSION = '1.0.1';

/** Properties. ============================================================================= */

/**
	 * The reference to the *Singleton* instance of this class.
	 *
	 * @var (object)
	 */
	protected static $_instance;

/**
	 * Tells if a scanner is fixable by SecuPress. The value "pro" means it's fixable only with the version PRO.
	 *
	 * @var (bool|string)
	 */
	protected $fixable = false;

/** Init and messages. ====================================================================== */

/**
	 * Init.
	 *
	 * @since 1.0
	 */
	protected function init() {
		if ( defined( 'FTP_PASS' ) ) {
			$this->title = __( 'Test the strength of WordPress database and FTP passwords.', 'secupress' );
			$this->more  = __( 'The passwords of the database and FTP have to be strong to avoid a possible brute-force attack.', 'secupress' );
		} else {
			$this->title = __( 'Test the strength of WordPress database password.', 'secupress' );
			$this->more  = __( 'The password of the database has to be strong to avoid a possible brute-force attack.', 'secupress' );
		}
		$this->more_fix  = static::get_messages( 300 );
	}

/**
	 * Get messages.
	 *
	 * @since 1.0
	 *
	 * @param (int) $message_id A message ID.
	 *
	 * @return (string|array) A message if a message ID is provided. An array containing all messages otherwise.
	 */
	public static function get_messages( $message_id = null ) {
		$messages = array(
			// "good"
			0 => __( 'Database password seems strong enough.', 'secupress' ),
			1 => __( 'Database and FTP passwords seems strong enough.', 'secupress' ),
			// "bad"
			200 => __( 'Your Database password is empty, this is not secure!', 'secupress' ),
			201 => __( 'Your Database password is known to be too common, this is not secure', 'secupress' ),
			202 => _n_noop( 'Your Database password is only %d character length, this is not secure', 'Your Database password is only %d characters length, this is not secure', 'secupress' ),
			203 => __( 'Your Database password is not complex enough, this is not secure', 'secupress' ),
			210 => __( 'Your FTP password is empty, this is not secure!', 'secupress' ),
			211 => __( 'Your FTP password is known to be too common, this is not secure', 'secupress' ),
			212 => _n_noop( 'Your FTP password is only %d character length, this is not secure', 'Your FTP password is only %d characters length, this is not secure', 'secupress' ),
			213 => __( 'Your FTP password is not complex enough, this is not secure', 'secupress' ),
			// "cantfix"
			300 => __( 'This cannot be fixed automatically, you have to manually change your database and FTP password in your server administration.', 'secupress' ),
			301 => __( 'This cannot be fixed automatically, you have to manually change your database password in your server administration.', 'secupress' ),
			302 => __( 'This cannot be fixed automatically, you have to manually change your FTP password in your server administration.', 'secupress' ),
		);

if ( isset( $message_id ) ) {
			return isset( $messages[ $message_id ] ) ? $messages[ $message_id ] : __( 'Unknown message', 'secupress' );
		}

return $messages;
	}

/** Getters. ================================================================================ */

/**
	 * Get the documentation URL.
	 *
	 * @since 1.2.3
	 *
	 * @return (string)
	 */
	public static function get_docs_url() {
		return __( 'http://docs.secupress.me/article/131-ftp-and-database-passwords-scan', 'secupress' );
	}

/** Scan. =================================================================================== */

/**
	 * Scan for flaw(s).
	 *
	 * @since 1.0
	 *
	 * @return (array) The scan results.
	 */
	public function scan() {

$activated = secupress_filter_scanner( __CLASS__ );
		if ( true === $activated ) {
			$this->add_message( 0 );
			return parent::scan();
		}

$has_ftp = defined( 'FTP_PASS' );

// DB_PASSWORD.
		if ( '' === DB_PASSWORD ) {
			// "bad"
			$this->add_message( 200 );
			$this->add_pre_fix_message( 301 );

} elseif ( self::dictionary_attack( DB_PASSWORD ) ) {
			// "bad"
			$this->add_message( 201 );
			$this->add_pre_fix_message( 301 );

} elseif ( ( $len = strlen( DB_PASSWORD ) ) <= 6 ) {
			// "bad"
			$this->add_message( 202 );
			$this->add_pre_fix_message( 301 );

} elseif ( count( count_chars( DB_PASSWORD, 1 ) ) < 5 ) {
			// "bad"
			$this->add_message( 203 );
			$this->add_pre_fix_message( 301 );

}

// FTP_PASS.
		if ( $has_ftp ) {
			if ( '' === FTP_PASS ) {
					// "bad"
				$this->add_message( 210 );
				$this->add_pre_fix_message( 302 );

} elseif ( self::dictionary_attack( FTP_PASS ) ) {
					// "bad"
				$this->add_message( 211 );
				$this->add_pre_fix_message( 302 );

} elseif ( ( $len = strlen( FTP_PASS ) ) <= 6 ) {
					// "bad"
				$this->add_message( 212 );
				$this->add_pre_fix_message( 302 );

} elseif ( count( count_chars( FTP_PASS, 1 ) ) < 5 ) {
					// "bad"
				$this->add_message( 213 );
				$this->add_pre_fix_message( 302 );

}
		}

// "good"
		$this->maybe_set_status( $has_ftp ? 1 : 0 );

return parent::scan();
	}

/** Tools. ================================================================================== */

/**
	 * Test if a password is in our dictionary.
	 *
	 * @since 1.0
	 *
	 * @param (string) $password The password to test.
	 *
	 * @return (bool)
	 */
	public static function dictionary_attack( $password ) {
		$dictionary = file( SECUPRESS_INC_PATH . 'data/10kmostcommon.data', FILE_IGNORE_NEW_LINES );
		return $dictionary ? in_array( $password, $dictionary, true ) : null;
	}
}

Ubuntu

Sid Gifari From Gifari Industries - BD Cyber Security Team