WordPress.org
Get WordPress

Plugin Directory

Changeset 3020311


Ignore:
Timestamp:
01/11/2024 12:29:37 PM (2 years ago)
Author:
patchstack
Message:
  • Fixed: issue where an activation loop would occur when a certain variable is set internally.
  • Fixed: issue where some data remains after license is expired.
  • Fixed: do not run firewall during cronjob call.
  • Fixed: add no caching headers to login page rename, and change priority of execution.
  • Fixed: bug with the firewall engine that could throw a PHP error.
  • Changed: moved mu-plugin from patchstack.php to _patchstack.php for higher priority.
  • Changed: made all hardening features available to paid community users.
Location:
patchstack
Files:
286 added
18 edited

Legend:

Unmodified
Added
Removed

  • patchstack/trunk/includes/activation.php

    r2992086 r3020311  
    1313
    1414    /**
     15     * Holds any activation errors.
     16     *
     17     * @var array
     18     */
     19    private $activation_errors = [];
     20
     21    /**
    1522     * Add the actions required for the activation.
    1623     *
    … …  
    3946            // In case of multisite, we want to redirect the user to a different page.
    4047            if ( $network_activation ) {
    41                 wp_safe_redirect( network_admin_url( 'admin.php?page=patchstack-multisite-settings&tab=multisite&activated=1' ) );
     48                wp_safe_redirect( network_admin_url( 'admin.php?page=patchstack-multisite-settings&tab=multisite&ps_activated=1' ) );
    4249            } else {
    43                 wp_safe_redirect( admin_url( 'admin.php?page=' . $this->plugin->name . '&activated=1' ) );
     50                wp_safe_redirect( admin_url( 'admin.php?page=' . $this->plugin->name . '&ps_activated=1' ) );
    4451            }
    4552            exit;
    … …  
    183190        // Try to create the mu-plugins folder/file.
    184191        // No need to do this if it already exists.
    185         if ( file_exists( WPMU_PLUGIN_DIR . '/patchstack.php' )) {
    186             return;
    187         }
    188    
     192        if ( file_exists( WPMU_PLUGIN_DIR . '/patchstack.php' ) || file_exists( WPMU_PLUGIN_DIR . '/_patchstack.php' )) {
     193            return;
     194        }
     195
    189196        // The mu-plugin does not exist, try to create it.
    190197        @include_once ABSPATH . 'wp-admin/includes/file.php';
    … …  
    208215        if ( is_writable( WPMU_PLUGIN_DIR ) ) {
    209216            $php = @file_get_contents( trailingslashit( plugin_dir_path( __FILE__ ) ) . 'mu-plugin.php' );
    210             @file_put_contents( trailingslashit( WPMU_PLUGIN_DIR ) . 'patchstack.php', $php );
     217            @file_put_contents( trailingslashit( WPMU_PLUGIN_DIR ) . '_patchstack.php', $php );
    211218        }
    212219    }
    … …  
    287294    public function migrate_check() {
    288295        // Only perform migrations if we have any to execute.
    289         $versions = ['3.0.0', '3.0.1', '3.0.2', '3.0.3'];
     296        $versions = ['3.0.0', '3.0.1', '3.0.2', '3.0.3', '3.0.4'];
    290297        if ( count( $versions ) == 0 ) {
    291298            return;
    … …  
    327334
    328335        // Remove the mu-plugin file if it exists.
    329         if ( file_exists( WPMU_PLUGIN_DIR . '/patchstack.php' )) {
    330             wp_delete_file( WPMU_PLUGIN_DIR . '/patchstack.php' );
     336        foreach (['patchstack.php', '_patchstack.php'] as $file) {
     337            if ( file_exists( WPMU_PLUGIN_DIR . '/' . $file )) {
     338                wp_delete_file( WPMU_PLUGIN_DIR . '/' . $file );
     339            }
    331340        }
    332341    }

  • patchstack/trunk/includes/api.php

    r2992086 r3020311  
    177177            if ( $response['free'] == true ) {
    178178                $this->update_blog_option( $this->blog_id, 'patchstack_show_settings', 0 );
     179                $this->update_blog_option( $this->blog_id, 'patchstack_firewall_rules_v3', '[]' );
    179180            } else {
    180181                $this->send_header_request();
    … …  
    182183        }
    183184
    184         if ( isset( $response['active'] ) && $response['active'] == true ) {
    185             $this->update_blog_option( $this->blog_id, 'patchstack_license_activated', true );
     185        if ( isset( $response['active'] ) ) {
     186            $this->update_blog_option( $this->blog_id, 'patchstack_license_activated', $response['active'] == true );
    186187        }
    187188

  • patchstack/trunk/includes/cookie-notice.php

    r2992086 r3020311  
    2222
    2323        // The cookie notice feature can only be used on an activated license.
    24         if ( ! $this->license_is_active() || $this->get_option( 'patchstack_license_free', 0 ) == 1 || $this->is_community() ) {
     24        if ( ! $this->license_is_active() || $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
    2525            return;
    2626        }

  • patchstack/trunk/includes/event-log.php

    r2992086 r3020311  
    2424
    2525        // The activity logger feature can only be used on an activated license.
    26         if ( ! $this->license_is_active() || $this->get_option( 'patchstack_license_free', 0 ) == 1 || $this->is_community() ) {
     26        if ( ! $this->license_is_active() || $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
    2727            return;
    2828        }

  • patchstack/trunk/includes/firewall.php

    r3002173 r3020311  
    3131
    3232        // If we only want to initialize the firewall but not execute the rules.
    33         if ( $skip ) {
     33        if ( $skip || defined( 'DOING_CRON' ) ) {
    3434            return;
    3535        }

  • patchstack/trunk/includes/hardening.php

    r2992086 r3020311  
    2424
    2525        // The hardening features can only be used on an activated license.
    26         if ( ! $this->license_is_active() || $this->get_option( 'patchstack_license_free', 0 ) == 1 || $this->is_community() ) {
     26        if ( ! $this->license_is_active() || $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
    2727            return;
    2828        }

  • patchstack/trunk/includes/hide-login.php

    r2992086 r3020311  
    1919        parent::__construct( $core );
    2020
    21         if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 || $this->is_community() ) {
     21        if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
    2222            return;
    2323        }
    … …  
    3434
    3535        // Register the filters and actions for the functionality.
    36         add_action( 'init', [ $this, 'init' ] );
     36        add_action( 'init', [ $this, 'init' ], ~PHP_INT_MAX + 1 );
    3737        add_action( 'wp_logout', [ $this, 'wp_logout' ] );
    3838    }
    … …  
    6060        // If the current page is the renamed login page we give the user access for 10 minutes to the login page.
    6161        if ( strpos( $_SERVER['REQUEST_URI'], get_site_option( 'patchstack_rename_wp_login' ) ) !== false ) {
     62            // Whitelist the current IP address.
    6263            $this->whitelist_ip();
    63             wp_safe_redirect( 'wp-login.php' );
     64
     65            // Supported by a number of popular caching plugins.
     66            if ( ! defined( 'DONOTCACHEPAGE' ) ) {
     67                define( 'DONOTCACHEPAGE', true );
     68            }
     69
     70            // No caching.
     71            send_nosniff_header();
     72            nocache_headers();
     73
     74            // User should be whitelisted now, redirect to the login page.
     75            wp_safe_redirect( 'wp-login.php', 307 );
    6476            exit;
    6577        }

  • patchstack/trunk/includes/htaccess.php

    r2992086 r3020311  
    2121        parent::__construct( $core );
    2222
    23         if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 || $this->is_community() ) {
     23        if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
    2424            return;
    2525        }

  • patchstack/trunk/includes/login.php

    r2992086 r3020311  
    2020        parent::__construct( $core );
    2121
    22         if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 || $this->is_community() ) {
     22        if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
    2323            return;
    2424        }

  • patchstack/trunk/includes/migrations/v303.php

    r2992086 r3020311  
    33// Try to create the mu-plugins folder/file.
    44// No need to do this if it already exists.
    5 if ( file_exists( WPMU_PLUGIN_DIR . '/patchstack.php' )) {
     5if ( file_exists( WPMU_PLUGIN_DIR . '/patchstack.php' ) || file_exists( WPMU_PLUGIN_DIR . '/_patchstack.php' )) {
    66    update_option('patchstack_db_version', '3.0.3');
    77    return;
    … …  
    3232if ( is_writable( WPMU_PLUGIN_DIR ) ) {
    3333    $php = file_get_contents( trailingslashit( plugin_dir_path( __FILE__ ) ) . '../mu-plugin.php' );
    34     file_put_contents( trailingslashit( WPMU_PLUGIN_DIR ) . 'patchstack.php', $php );
     34    file_put_contents( trailingslashit( WPMU_PLUGIN_DIR ) . '_patchstack.php', $php );
    3535}
    3636

  • patchstack/trunk/includes/upload.php

    r2992086 r3020311  
    4949        $data = $this->get_software_data();
    5050        $hash = sha1( json_encode( $data ) );
     51
     52        // Do not sync for no reason.
    5153        if ( ! defined( 'DOING_CRON' ) && ! isset( $_POST['webarx_secret'] ) && get_option( 'patchstack_software_data_hash', false ) === $hash && ! is_admin() ) {
    5254            return;

  • patchstack/trunk/includes/views/pages/license-free.php

    r2992086 r3020311  
    1111$site_id = get_option( 'patchstack_site_id', 0 );
    1212$app_url = $site_id != 0 ? 'https://app.patchstack.com/app/' . $site_id . '/"' : 'https://app.patchstack.com/apps/overview';
    13 if ( isset( $_GET['activated'] ) && $status ) {
     13if ( isset( $_GET['ps_activated'] ) && $status ) {
    1414    echo "<script>window.location = 'admin.php?page=patchstack&tab=license&active=1';</script>";
    1515}

  • patchstack/trunk/includes/views/pages/license.php

    r3002173 r3020311  
    1313$site_id = get_option( 'patchstack_site_id', 0 );
    1414$app_url = $site_id != 0 ? 'https://app.patchstack.com/app/' . $site_id . '/"' : 'https://app.patchstack.com/apps/overview';
    15 if ( isset( $_GET['activated'] ) && $status ) {
     15if ( isset( $_GET['ps_activated'] ) && $status ) {
    1616    echo "<script>window.location = 'admin.php?page=patchstack&tab=license&active=1';</script>";
    1717}

  • patchstack/trunk/includes/views/pages/settings.php

    r2992086 r3020311  
    99$tabs          = [ 'hardening', 'firewall', 'login', 'cookienotice', 'logs', 'license', 'multisite' ];
    1010$active_tab    = isset( $_GET['tab'] ) && in_array( $_GET['tab'], $tabs ) ? esc_attr( $_GET['tab'] ) : 'license'; // default active tab
    11 $activated     = ( ( isset( $_GET['activated'] ) && $_GET['activated'] == 1 ) || ( isset( $_GET['active'] ) && $_GET['active'] == 1 ) );
     11$activated     = ( ( isset( $_GET['ps_activated'] ) && $_GET['ps_activated'] == 1 ) || ( isset( $_GET['active'] ) && $_GET['active'] == 1 ) );
    1212$status        = ( get_option( 'patchstack_license_expiry', '' ) == '' || time() >= strtotime( get_option( 'patchstack_license_expiry', '' ) ) );
    1313$show_settings = $this->get_option( 'patchstack_show_settings', 0 ) == 1 && !isset($_GET['tab']) || isset($_GET['tab']) && $_GET['tab'] != 'license';

  • patchstack/trunk/languages/patchstack.pot

    r3002173 r3020311  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Patchstack Security 2.2.5\n"
     5"Project-Id-Version: Patchstack Security 2.2.6\n"
    66"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/patchstack\n"
    77"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"

  • patchstack/trunk/lib/patchstack/src/Request.php

    r3002173 r3020311  
    119119                // If it's not an array, no need to continue.
    120120                if (!is_array($data)) {
    121                     return [$data];
     121                    $data = [$data];
    122122                }
    123123            default:
    … …  
    413413            // Merge together if the shortcode occurs more than once.
    414414            if (isset($return[$shortcode[2]])) {
     415
     416                // Shortcode index must not be a string.
     417                if (is_string($return[$shortcode[2]])) {
     418                    continue;
     419                }
     420
    415421                $atts = @\shortcode_parse_atts($shortcode[3]);
    416422                foreach ($atts as $key => $value) {
    417423                    if (isset($return[$shortcode[2]][$key])) {
    418                         $return[$shortcode[2]][$key] .= $value;
     424                        $return[$shortcode[2]][$key] = $return[$shortcode[2]][$key] . $value;
    419425                    } else {
    420426                        $return[$shortcode[2]][$key] = $value;

  • patchstack/trunk/patchstack.php

    r3002173 r3020311  
    55 * Author URI: https://patchstack.com/?utm_medium=wp&utm_source=dashboard&utm_campaign=patchstack%20plugin
    66 * Description: Patchstack identifies security vulnerabilities in WordPress plugins, themes, and core.
    7  * Version: 2.2.5
     7 * Version: 2.2.6
    88 * Author: Patchstack
    99 * License: GPLv3
    … …  
    6060         * @var string
    6161         */
    62         const VERSION = '2.2.5';
     62        const VERSION = '2.2.6';
    6363
    6464        /**

  • patchstack/trunk/readme.txt

    r3002173 r3020311  
    66Requires at least: 4.4
    77Tested up to: 6.4
    8 Stable tag: 2.2.5
     8Stable tag: 2.2.6
    99Requires PHP: 5.6
    1010
Note: See TracChangeset for help on using the changeset viewer.