th.guenther/kompass
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security Settings:

Browse Source 
xmlrpc deaktivieren
 Autorenscan deaktivieren
 Scripting in /wp-content/uploads/ deaktivieren
 Zugriff auf potenziell sensible Dateien blockieren
 Dateieditor im WP Dashboard deaktivieren
 Skriptverkettung deaktivieren
 Skriptausführung im Include-Verzeichnis deaktivieren
 Zugriff von ungewollten Bots verbieten
 Auflistung von Verzeichnissen deaktivieren
 Debug-Ausgaben deaktivieren
 Login-URL ändern
This commit is contained in:
Thomas Günther
2024-02-21 21:31:00 +01:00
parent 69322d64f3
commit 80fb6cd452
22 changed files with 1062 additions and 370 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
includes/FileAccess.class.php Normal file
View File

@ -0,0 +1,56 @@
<?php
declare(strict_types=1);
namespace Bdp\Libs;
class FileAccess extends \WP_Filesystem_Direct
{
public const HTACCESS_MAIN = '/.htaccess';
public const HTACCESS_UPLOADS = '/wp-content/uploads/.htaccess';
public function __construct( $arg = null )
{
if ( ! defined( 'FS_CHMOD_FILE' ) ) {
define( 'FS_CHMOD_FILE', ( fileperms( ABSPATH . 'index.php' ) & 0777 | 0644 ) );
}
}
public static function htaccessContains(string $needle, $file = self::HTACCESS_MAIN) : bool
{
return str_contains(FileAccess::readHtaccess($file), $needle);
}
public static function readHtaccess($file = self::HTACCESS_MAIN) : string
{
$wfs = new self();
if (!$wfs->exists(ABSPATH . $file)) {
return '';
}
return $wfs->get_contents(ABSPATH . $file);
}
public static function writeHtaccess(string $value, $file = self::HTACCESS_MAIN) : bool
{
$wfs = new self();
$wfs->put_contents(ABSPATH . $file, $value);
return true;
}
public static function insertInHtaccess(string $element, $file = self::HTACCESS_MAIN) : bool
{
if (FileAccess::htaccessContains($element, $file)) {
return true;
}
$htaccessFile = FileAccess::readHtaccess($file);
$htaccessFile .= PHP_EOL . $element . PHP_EOL;
FileAccess::writeHtaccess($htaccessFile, $file);
return true;
}
public static function deleteFromHtaccess(string $element, $file = self::HTACCESS_MAIN) : bool {
$htaccessFile = str_replace($element . PHP_EOL, '', FileAccess::readHtaccess($file));
return FileAccess::writeHtaccess($htaccessFile, $file);
}
}

82
includes/WpConfigEditor.class.php Normal file
View File

@ -0,0 +1,82 @@
<?php
declare(strict_types=1);
namespace Bdp\Libs;
class WpConfigEditor extends \WP_Filesystem_Direct
{
public const WP_CONFIG_FILE = '/wp-config.php';
public function __construct($arg = null)
{
if (!defined('FS_CHMOD_FILE')) {
define('FS_CHMOD_FILE', (fileperms(ABSPATH . 'index.php') & 0777 | 0644));
}
}
public function readConfig(): string
{
if (!$this->exists(ABSPATH . self::WP_CONFIG_FILE)) {
return '';
}
return $this->get_contents(ABSPATH . self::WP_CONFIG_FILE);
}
public function writeConfig($value): bool
{
$this->put_contents(ABSPATH . self::WP_CONFIG_FILE, $value);
return true;
}
public static function updateConfig($key, $value): bool
{
$wfs = new self();
$configContent = $wfs->readConfig();
if (null === self::getConfigValue($key)) {
$configContent .= "define( '$key', $value );";
}
preg_match("/define\([ ]?'($key)'\,[ ]?(.*)[ ]?\);/",$configContent, $matches);
$configContent = str_replace($matches[0], "define( '$key', $value );", $configContent);
return $wfs->writeConfig($configContent);
}
public static function getConfigValue($key): ?string
{
$wfs = new self();
$configContent = $wfs->readConfig();
preg_match("/define\([ ]?'($key)'\,[ ]?(.*)[ ]?\);/",$configContent, $matches);
if (count($matches) == 0) {
return null;
}
return trim($matches[2]);
}
public static function updateSiteKeys(string $newKeySet)
{
foreach (explode(PHP_EOL, trim($newKeySet)) as $currentKeyLine) {
preg_match("/define\([ ]?'(.*)'\,[ ]?(.*)[ ]?\);/", $currentKeyLine, $matches);
self::updateConfig($matches[1], trim($matches[2]));
}
return true;
}
public static function deleteConfigKey($key): bool
{
if (null === self::getConfigValue($key)) {
return true;
}
$wfs = new self();
$configContent = $wfs->readConfig();
preg_match("/define\([ ]?'($key)'\,[ ]?(.*)[ ]?\);/",$configContent, $matches);
$configContent = str_replace($matches[0], '', $configContent);
return $wfs->writeConfig($configContent);
}
}

7
includes/environment.php Normal file
View File

@ -0,0 +1,7 @@
<?php
define('BDP_LV_PLUGIN_SLUG', 'bdp-kompass');
define('BDP_LV_STARTUP_FILE', WP_PLUGIN_DIR . '/' . BDP_LV_PLUGIN_SLUG . '/' . BDP_LV_PLUGIN_SLUG . '.php');
define('BDP_LV_PLUGIN_DIR', plugin_dir_path(BDP_LV_STARTUP_FILE));
define('BDP_LV_PLUGIN_URL', plugin_dir_url(BDP_LV_STARTUP_FILE));

45
includes/filters.php Normal file
View File

@ -0,0 +1,45 @@
<?php
add_action( 'plugins_loaded', 'bdp_kompass_load_plugin_textdomain' );
register_activation_hook(__FILE__, 'bdp_plugin_install');
add_action('init', 'bdp_plugin_init');
function _protect_wp_disablexmlrpc_string() {
return "<FilesMatch \"xmlrpc.php\">
Require all denied
</FilesMatch>";
}
function _protect_wp_disable_script_execution_string() {
return '<FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|jsp|asp|html|htm|shtml|sh|cgi|suspected)$">' . "
deny from all
</FilesMatch>";
}
function _protect_wp_disable_special_files_string() {
return '<FilesMatch "^.*(README|error_log|wp-config\.php|user.ini|log|php.ini|\.[hH][tT][aApP].*)$">' . "
deny from all
</FilesMatch>";
}
function _protect_wp_disable_directory_listing_string() {
return 'Options -Indexes';
}
function _protect_wp_secure_include_dir_string() {
return "RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]";
}
function _protect_wp_initial_bot_list_array()
{
return explode(';', 'SemrushBot;AhrefsBot;DotBot;WhatCMS;Rogerbot;trendictionbot;BLEXBot;linkfluence;magpie-crawler;MJ12bot;Mediatoolkitbot;AspiegelBot;DomainStatsBot;Cincraw;Nimbostratus;HTTrack;serpstatbot;omgili;GrapeshotCrawler;MegaIndex;PetalBot;Semanticbot;Cocolyzebot;DomCopBot;Traackr;BomboraBot;Linguee;webtechbot;DomainStatsBot;Clickagy;sqlmap;Internet-structure-research-project-bot;Seekport;AwarioSmartBot;OnalyticaBot;Buck;Riddler;SBL-BOT;DF Bot 1.0;PubMatic Crawler Bot;BVBot;Sogou;Barkrowler;Yandex');
}

171
includes/frontend-functions.php Normal file
View File

@ -0,0 +1,171 @@
<?php
add_action('admin_enqueue_scripts', 'bdp_update_dashboard_style');
add_action('login_enqueue_scripts', 'bdp_update_login_style');
function bdp_update_login_style() {
$css = file_get_contents(BDP_LV_PLUGIN_DIR . 'assets/dashboard.style.css.tpl');
echo str_replace('%%BDP_LV_PLUGIN_URL%%', BDP_LV_PLUGIN_URL, $css);
}
function bdp_update_dashboard_style() {
wp_enqueue_style('custom-dashboard-styles', BDP_LV_PLUGIN_URL . '/assets/wordpress-bdp.css');
wp_enqueue_style('custom-calendar-styles', BDP_LV_PLUGIN_URL . '/assets/calendar.css');
wp_enqueue_style('custom-security-styles', BDP_LV_PLUGIN_URL . '/assets/security.css');
}
function bdp_add_menu_security() {
$moduleLoad = get_admin_url() . 'admin.php?page=' . BDP_LV_PLUGIN_SLUG . '/modules/index.php&loadmodule=';
add_menu_page(
'Sicherheit',
'Webseiten-Sicherheit',
'manage_options',
'site-health.php',
'',
'dashicons-admin-network',
5
);
}
function bdp_add_menu_contents() {
add_menu_page(
'Beiträge',
'Inhalte',
'edit_posts',
'edit.php',
'',
'dashicons-format-aside',
4
);
add_submenu_page('edit.php',
'media',
'Medienverwaltung',
'edit_posts',
'upload.php'
);
add_submenu_page('edit.php',
'media',
'Statische Seiten',
'edit_posts',
'edit.php?post_type=page'
);
add_submenu_page('edit.php',
'comments',
'Kommentare',
'edit_posts',
'edit-comments.php'
);
}
function bdp_add_menu_mein_lv() {
$location = BDP_LV_PLUGIN_DIR . '/modules/';
$mainSlug = $location . 'index.php';
$moduleLoad = get_admin_url() . 'admin.php?page=' . BDP_LV_PLUGIN_SLUG . '/modules/index.php&loadmodule=';
add_menu_page(
'Mein BDP',
'BdP',
'manage_options',
$mainSlug,
'',
BDP_LV_PLUGIN_URL . '/icon.png',
3
);
add_submenu_page($mainSlug,
'calendar_settings',
'Kalender-Einstellungen',
'manage_options',
$moduleLoad . 'calendar'
);
add_submenu_page($mainSlug,
'calendar_settings',
'Über',
'manage_options',
$moduleLoad . 'about'
);
}
function bdp_add_menu_setup() {
add_menu_page(
'Allgemeine Einstellungen',
'Webseiten-Setup',
'manage_options',
'users.php',
'',
'dashicons-admin-generic',
6
);
add_submenu_page('users.php',
'Allgemeine Einstellungen',
'Allgemeine Einstellungen',
'manage_options',
'options-general.php'
);
add_submenu_page('users.php',
'Design-Einstellungen',
'Design',
'manage_options',
'customize.php?return=/wp-admin/'
);
add_submenu_page('users.php',
'plugins',
'Erweiterungen',
'manage_options',
'plugins.php'
);
add_submenu_page('users.php',
'themes',
'Designs',
'manage_options',
'themes.php'
);
}
function bdp_cleanup_menu()
{
global $submenu;
remove_menu_page('edit-comments.php');
remove_menu_page('edit.php');
remove_menu_page('edit.php?post_type=page');
remove_menu_page('upload.php');
remove_menu_page('themes.php');
remove_menu_page('plugins.php');
remove_menu_page('options-general.php');
remove_menu_page('users.php');
remove_menu_page('tools.php');
bdp_add_menu_contents();
bdp_add_menu_setup();
bdp_add_menu_security();
remove_submenu_page('users.php','user-new.php');
remove_submenu_page('users.php','profile.php');
remove_submenu_page('edit.php','post-new.php');
remove_submenu_page('edit.php','edit-tags.php?taxonomy=category');
remove_submenu_page('edit.php','edit-tags.php?taxonomy=post_tag');
}
function bdp_create_menu_structure()
{
add_action('admin_menu', 'bdp_cleanup_menu');
bdp_add_menu_mein_lv();
}

5
includes/pre_requires.php Normal file
View File

@ -0,0 +1,5 @@
<?php
require_once (ABSPATH . '/wp-admin/includes/plugin.php');
require_once (ABSPATH . '/wp-admin/includes/class-wp-filesystem-base.php');
require_once (ABSPATH . '/wp-admin/includes/class-wp-filesystem-direct.php');
require_once (ABSPATH . '/wp-includes/pluggable.php');

36
includes/setup.php Normal file
View File

@ -0,0 +1,36 @@
<?php
if ( ! defined( 'WP_PLUGIN_DIR' ) ) { // Abspath to wp-content/plugins
define( 'WP_PLUGIN_DIR', WP_CONTENT_DIR . '/plugins' ); // Full path, no trailing slash.
}
require_once dirname(__FILE__) . '/pre_requires.php';
require_once dirname(__FILE__) . '/environment.php';
require_once dirname(__FILE__) . '/update.class.php';
require_once BDP_LV_PLUGIN_DIR . 'includes/FileAccess.class.php';
require_once BDP_LV_PLUGIN_DIR . 'includes/WpConfigEditor.class.php';
require_once (BDP_LV_PLUGIN_DIR . '/includes/filters.php');
require_once (BDP_LV_PLUGIN_DIR . '/lib/ics-parser/Event.php');
require_once (BDP_LV_PLUGIN_DIR . '/lib/ics-parser/ICal.php');
require_once (BDP_LV_PLUGIN_DIR . '/modules/seo/seo.php');
require_once (BDP_LV_PLUGIN_DIR . '/modules/calendar/calendar.php');
require_once (BDP_LV_PLUGIN_DIR . '/includes/frontend-functions.php');
require_once (BDP_LV_PLUGIN_DIR . '/modules/security/security.php');
bdp_create_menu_structure();
function bdp_kompass_load_plugin_textdomain() {
load_textdomain( BDP_LV_PLUGIN_SLUG, BDP_LV_PLUGIN_DIR . '/lang/' . BDP_LV_PLUGIN_SLUG . '_' . get_locale() . '.mo' );
}
#$class =
new BdpVersionChecker();
#add_filter( 'plugins_api', array( $class, 'info' ), 20, 3 );

152
includes/update.class.php Normal file
View File

@ -0,0 +1,152 @@
<?php
class BdpVersionChecker
{
public $plugin_slug;
public $version;
public $cache_key;
public $cache_allowed;
public $updateUrl;
public function __construct()
{
$plugin_data = get_plugin_data( BDP_LV_STARTUP_FILE );
$this->plugin_slug = BDP_LV_PLUGIN_SLUG;
$this->updateUrl = $plugin_data['UpdateURI'] . '/info_development.json';
$this->version = $plugin_data['Version'];
$this->cache_key = 'bdp-kompass-upd';
$this->cache_allowed = false;
add_filter( 'plugins_api', array( $this, 'info' ), 20, 3 );
add_filter( 'site_transient_update_plugins', array( $this, 'update' ) );
add_action( 'upgrader_process_complete', array( $this, 'purge' ), 10, 2 );
}
public function request(){
$remote = get_transient( $this->cache_key );
if( false === $remote || ! $this->cache_allowed ) {
$remote = wp_remote_get(
$this->updateUrl
,
array(
'timeout' => 10,
'headers' => array(
'Accept' => 'application/json'
)
)
);
if(
is_wp_error( $remote )
|| 200 !== wp_remote_retrieve_response_code( $remote )
|| empty( wp_remote_retrieve_body( $remote ) )
) {
return false;
}
set_transient( $this->cache_key, $remote, 3600 );
}
$remote = json_decode( wp_remote_retrieve_body( $remote ) );
return $remote;
}
function info( $res = '', $action = '', $args = '' )
{
if (!isset($args->slug) || $args->slug !== $this->plugin_slug) {
return $res;
}
// get updates
$remote = $this->request();
if( ! $remote ) {
return $res;
}
$newVersion = $remote->version;
$res = new stdClass();
$res->name = $remote->name;
$res->slug = $remote->slug;
$res->version = $newVersion;
$res->tested = $remote->tested;
$res->requires = $remote->requires;
$res->author = $remote->author;
$res->author_profile = $remote->author_profile;
$res->download_link = $remote->download_url;
$res->trunk = $remote->download_url;
$res->requires_php = $remote->requires_php;
$res->last_updated = $remote->last_updated;
$res->sections = array(
'description' => $remote->sections->description,
'installation' => $remote->sections->installation,
'changelog' => $remote->sections->changelog
);
if( ! empty( $remote->banners ) ) {
$res->banners = array(
'low' => $remote->banners->low,
'high' => $remote->banners->high
);
}
return $res;
}
public function update( $transient ) {
if ( empty($transient->checked ) ) {
return $transient;
}
$remote = $this->request();
if(
$remote
&& version_compare( $this->version, $remote->version, '<' )
&& version_compare( $remote->requires, get_bloginfo( 'version' ), '<=' )
&& version_compare( $remote->requires_php, PHP_VERSION, '<' )
) {
$newVersion = $remote->version;
$res = new stdClass();
$res->slug = $this->plugin_slug;
$res->plugin = plugin_basename( BDP_LV_STARTUP_FILE );
$res->new_version = $newVersion;
$res->tested = $remote->tested;
$res->package = $remote->download_url;
$transient->response[ $res->plugin ] = $res;
} else {
$res = new stdClass();
$res->slug = $this->plugin_slug;
$res->plugin = plugin_basename( BDP_LV_STARTUP_FILE );
$transient->no_update[ $res->plugin ] = $res;
}
return $transient;
}
public function purge( $upgrader, $options ){
if (
$this->cache_allowed
&& 'update' === $options['action']
&& 'plugin' === $options[ 'type' ]
) {
// just clean the cache when new plugin version is installed
delete_transient( $this->cache_key );
}
}
}