Orderclasses/Action.php 0000644 00000012124 14760004224 0010126 0 ustar 00 getActions( true ); } } /** * The hookSubmit is loaded when action si posted * * @return void * @throws Exception */ function hookMenu() { /* Only if post */ if ( ! HMWP_Classes_Tools::isAjax() ) { $this->getActions(); } } /** * Hook the Multisite Menu * * @throws Exception */ function hookMultisiteMenu() { /* Only if post */ if ( ! HMWP_Classes_Tools::isAjax() ) { $this->getActions(); } } /** * Get the list with all the plugin actions * * @return array * @since 6.1.1 */ public function getActionsTable() { return array( array( "name" => "HMWP_Controllers_Settings", "actions" => array( "action" => array( "hmwp_settings", "hmwp_tweakssettings", "hmwp_confirm", "hmwp_newpluginschange", "hmwp_abort", "hmwp_ignore_errors", "hmwp_restore_settings", "hmwp_manualrewrite", "hmwp_mappsettings", "hmwp_firewall", "hmwp_advsettings", "hmwp_devsettings", "hmwp_devdownload", "hmwp_changepathsincache", "hmwp_savecachepath", "hmwp_backup", "hmwp_restore", "hmwp_rollback", "hmwp_preset", "hmwp_download_settings", "hmwp_advanced_install", "hmwp_pause_enable", "hmwp_pause_disable", "hmwp_update_product_name", ) ), ), array( "name" => "HMWP_Controllers_Overview", "actions" => array( "action" => array( "hmwp_feature_save" ) ), ), array( "name" => "HMWP_Controllers_SecurityCheck", "actions" => array( "action" => array( "hmwp_securitycheck", "hmwp_frontendcheck", "hmwp_fixsettings", "hmwp_fixconfig", "hmwp_fixprefix", "hmwp_fixpermissions", "hmwp_fixsalts", "hmwp_fixadmin", "hmwp_fixupgrade", "hmwp_securityexclude", "hmwp_resetexclude" ) ), ), array( "name" => "HMWP_Controllers_Brute", "actions" => array( "action" => array( "hmwp_brutesettings", "hmwp_blockedips", "hmwp_deleteip", "hmwp_deleteallips" ) ), ), array( "name" => "HMWP_Controllers_Templogin", "actions" => array( "action" => array( "hmwp_temploginsettings", "hmwp_templogin_block", "hmwp_templogin_activate", "hmwp_templogin_delete", "hmwp_templogin_new", "hmwp_templogin_update", ) ), ), array( "name" => "HMWP_Controllers_Log", "actions" => array( "action" => array( "hmwp_logsettings" ) ), ), array( "name" => "HMWP_Controllers_Widget", "actions" => array( "action" => "hmwp_widget_securitycheck" ), ), array( "name" => "HMWP_Controllers_Connect", "actions" => array( "action" => array( "hmwp_connect" ) ), ), array( "name" => "HMWP_Classes_Error", "actions" => array( "action" => array( "hmwp_ignoreerror" ) ), ), ); } /** * Get all actions from config.json in core directory and add them in the WP * * @param bool $ajax * * @throws Exception * @since 4.0.0 */ public function getActions( $ajax = false ) { //Proceed only if logged in and in dashboard if ( ! is_admin() && ! is_network_admin() ) { return; } $this->actions = array(); $action = HMWP_Classes_Tools::getValue( 'action' ); $nonce = HMWP_Classes_Tools::getValue( 'hmwp_nonce' ); if ( $action == '' || $nonce == '' ) { return; } //Get all the plugin actions $actions = $this->getActionsTable(); foreach ( $actions as $block ) { //If there is a single action if ( isset( $block['actions']['action'] ) ) { //If there are more actions for the current block if ( ! is_array( $block['actions']['action'] ) ) { //Add the action in the actions array if ( $block['actions']['action'] == $action ) { $this->actions[] = array( 'class' => $block['name'] ); } } else { //If there are more actions for the current block foreach ( $block['actions']['action'] as $value ) { //Add the actions in the actions array if ( $value == $action ) { $this->actions[] = array( 'class' => $block['name'] ); } } } } } //Validate referer based on the call type if ( $ajax ) { check_ajax_referer( $action, 'hmwp_nonce' ); } else { check_admin_referer( $action, 'hmwp_nonce' ); } //Add the actions in WP. foreach ( $this->actions as $actions ) { HMWP_Classes_ObjController::getClass( $actions['class'] )->action(); } } } classes/Debug.php 0000644 00000005477 14760004224 0007754 0 ustar 00 is_dir( WP_CONTENT_DIR . '/cache/hmwp' ) ) { $wp_filesystem->mkdir( WP_CONTENT_DIR . '/cache/hmwp' ); } //if the debug dir can't be defined. if ( ! $wp_filesystem->is_dir( WP_CONTENT_DIR . '/cache/hmwp' ) ) { return; } define( '_HMWP_CACHE_DIR_', WP_CONTENT_DIR . '/cache/hmwp/' ); add_action( 'hmwp_debug_request', array( $this, 'hookDebugRequests' ) ); add_action( 'hmwp_debug_cache', array( $this, 'hookDebugCache' ) ); add_action( 'hmwp_debug_files', array( $this, 'hookDebugFiles' ) ); add_action( 'hmwp_debug_local_request', array( $this, 'hookDebugRequests' ) ); add_action( 'hmwp_debug_access_log', array( $this, 'hookAccessLog' ) ); } } /** * @param string $url * @param array $options * @param array $response * * @return void */ public function hookDebugRequests( $url, $options = array(), $response = array() ) { //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); $cachefile = _HMWP_CACHE_DIR_ . 'hmwp_wpcall.log'; $wp_filesystem->put_contents( $cachefile, gmdate( 'Y-m-d H:i:s' ) . ' - ' . $url . ' - ' . wp_json_encode( $response ) . PHP_EOL, FILE_APPEND, FS_CHMOD_FILE ); $wp_filesystem->chmod( $cachefile, FS_CHMOD_FILE ); } /** * @param string $data * * @return void */ public function hookDebugCache( $data ) { //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); $cachefile = _HMWP_CACHE_DIR_ . 'rewrite.log'; $wp_filesystem->put_contents( $cachefile, $data, FILE_APPEND, FS_CHMOD_FILE ); $wp_filesystem->chmod( $cachefile, FS_CHMOD_FILE ); } /** * @param string $data * * @return void */ public function hookDebugFiles( $data ) { //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); $cachefile = _HMWP_CACHE_DIR_ . 'filecall.log'; $wp_filesystem->put_contents( $cachefile, $data . PHP_EOL, FILE_APPEND, FS_CHMOD_FILE ); $wp_filesystem->chmod( $cachefile, FS_CHMOD_FILE ); } /** * @param string $data * * @return void */ public function hookAccessLog( $data ) { //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); $cachefile = _HMWP_CACHE_DIR_ . 'access.log'; $wp_filesystem->put_contents( $cachefile, $data . PHP_EOL, FILE_APPEND, FS_CHMOD_FILE ); $wp_filesystem->chmod( $cachefile, FS_CHMOD_FILE ); } } classes/DisplayController.php 0000644 00000006214 14760004224 0012365 0 ustar 00 exists( _HMWP_ASSETS_DIR_ . 'css/' . $name . '.min.css' ) ) { $css_uri = _HMWP_ASSETS_URL_ . 'css/' . $name . '.min.css?ver=' . HMWP_VERSION_ID; } if ( $wp_filesystem->exists( _HMWP_ASSETS_DIR_ . 'css/' . $name . '.min.scss' ) ) { $css_uri = _HMWP_ASSETS_URL_ . 'css/' . $name . '.min.scss?ver=' . HMWP_VERSION_ID; } if ( $wp_filesystem->exists( _HMWP_ASSETS_DIR_ . 'js/' . $name . '.min.js' ) ) { $js_uri = _HMWP_ASSETS_URL_ . 'js/' . $name . '.min.js?ver=' . HMWP_VERSION_ID; } if ( $css_uri <> '' ) { if ( ! wp_style_is( $id ) ) { if ( did_action( 'wp_print_styles' ) ) { echo ""; } elseif ( is_admin() || is_network_admin() ) { //load CSS for admin or on triggered wp_enqueue_style( $id, $css_uri, $dependency, HMWP_VERSION_ID ); wp_print_styles( array( $id ) ); } } } if ( $js_uri <> '' ) { if ( ! wp_script_is( $id ) ) { if ( did_action( 'wp_print_scripts' ) ) { echo ""; } elseif ( is_admin() || is_network_admin() ) { //load CSS for admin or on triggered if ( ! wp_script_is( 'jquery' ) ) { wp_enqueue_script( 'jquery' ); wp_print_scripts( array( 'jquery' ) ); } wp_enqueue_script( $id, $js_uri, $dependency, HMWP_VERSION_ID, true ); wp_print_scripts( array( $id ) ); } } } } /** * Fetches and renders the view file associated with the given block. * * @param string $block The name of the block whose view file is to be rendered. * @param mixed $view Additional data or context to be used within the view. * * @return string|null The rendered output of the view file, or null if the file does not exist. */ public function getView( $block, $view ) { $output = null; //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); //Set the current view file from /view $file = _HMWP_THEME_DIR_ . $block . '.php'; if ( $wp_filesystem->exists( $file ) ) { ob_start(); include $file; $output .= ob_get_clean(); } return apply_filters( 'hmwp_getview', $output, $block ); } } classes/Error.php 0000644 00000007737 14760004224 0010020 0 ustar 00 $type, 'ignore' => $ignore, 'text' => $error ); } /** * Return if error * * @return bool */ public static function isError() { if ( ! empty( self::$errors ) ) { foreach ( self::$errors as $error ) { if ( $error['type'] <> 'success' ) { return true; } } } return false; } /** * Clear the errors * * @return void */ public static function clearErrors() { self::$errors = array(); } /** * This hook will show the error in WP header */ public function hookNotices() { if ( is_array( self::$errors ) && ( ( is_string( HMWP_Classes_Tools::getValue( 'page', '' ) ) && stripos( HMWP_Classes_Tools::getValue( 'page', '' ), _HMWP_NAMESPACE_ ) !== false ) || ( is_string( HMWP_Classes_Tools::getValue( 'plugin', '' ) ) && stripos( HMWP_Classes_Tools::getValue( 'plugin', '' ), dirname( HMWP_BASENAME ) ) !== false ) ) ) { foreach ( self::$errors as $error ) { self::showError( $error['text'], $error['type'], $error['ignore'] ); } } self::$errors = array(); } /** * Show the notices to WP * * @param string $message Error message to show in plugin * @param string $type Define the notification class 'notice', 'warning', 'dander'. Default 'notice' * @param bool $ignore Let user ignore this notification */ public static function showError( $message, $type = 'notice', $ignore = true ) { //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); if ( $wp_filesystem->exists( _HMWP_THEME_DIR_ . 'Notices.php' ) ) { include _HMWP_THEME_DIR_ . 'Notices.php'; } else { echo wp_kses_post( $message ); //returns the } } /** * Run the actions on submit * * @throws Exception */ public function action() { if ( ! HMWP_Classes_Tools::userCan( HMWP_CAPABILITY ) ) { return; } switch ( HMWP_Classes_Tools::getValue( 'action' ) ) { case 'hmwp_ignoreerror': $hash = HMWP_Classes_Tools::getValue( 'hash' ); $ignore_errors = (array) HMWP_Classes_Tools::getOption( 'ignore_errors' ); $ignore_errors[] = $hash; $ignore_errors = array_unique( $ignore_errors ); $ignore_errors = array_filter( $ignore_errors ); HMWP_Classes_Tools::saveOptions( 'ignore_errors', $ignore_errors ); wp_redirect( remove_query_arg( array( 'hmwp_nonce', 'action', 'hash' ) ) ); exit(); } } } classes/FrontController.php 0000644 00000006422 14760004224 0012051 0 ustar 00 name = get_class( $this ); /* load the model and hooks here for WordPress actions to take effect */ /* create the model and view instances */ $model_classname = str_replace( 'Controllers', 'Models', $this->name ); if ( HMWP_Classes_ObjController::getClassByPath( $model_classname ) ) { $this->model = HMWP_Classes_ObjController::getClass( $model_classname ); } //IMPORTANT TO LOAD HOOKS HERE /* check if there is a hook defined in the controller clients class */ HMWP_Classes_ObjController::getClass( 'HMWP_Classes_HookController' )->setHooks( $this ); /* Set the debug if activated */ if ( defined( 'HMWP_DEBUG' ) && HMWP_DEBUG ) { HMWP_Classes_ObjController::getClass( 'HMWP_Classes_Debug' ); } /* Load the rewrite */ HMWP_Classes_ObjController::getClass( 'HMWP_Controllers_Rewrite' ); /* Load the Main classes Actions Handler */ HMWP_Classes_ObjController::getClass( 'HMWP_Classes_Action' ); HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' ); HMWP_Classes_ObjController::getClass( 'HMWP_Models_Compatibility_Abstract' ); } /** * load sequence of classes * Function called usually when the controller is loaded in WP * * @return HMWP_Classes_FrontController * @throws Exception */ public function init() { return $this; } /** * Get the block view * * @param string $view * @param stdClass $obj * * @return string HTML * @throws Exception */ public function getView( $view = null, $obj = null ) { if ( ! isset( $obj ) ) { $obj = $this; } //Get the view class name if not defined if ( ! isset( $view ) ) { if ( $class = HMWP_Classes_ObjController::getClassByPath( $this->name ) ) { $view = $class['name']; } } //Call the display class to load the view if ( isset( $view ) ) { $this->view = HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' ); return $this->view->getView( $view, $obj ); } return ''; } /** * Called as menu callback to show the block * * @param string $view * * @throws Exception */ public function show( $view = null ) { echo $this->getView( $view ); //phpcs:ignore } /** * first function call for any class on form submit */ protected function action() { // called within each class with the action } /** * initialize settings * Called from index * * @return void */ public function hookInit() { } /** * Called on frontend. For disconnected users */ public function hookFrontinit() { } /** * Hook the admin head * This function will load the media in the header for each class * * @return void */ public function hookHead() { } } classes/HookController.php 0000644 00000005541 14760004224 0011662 0 ustar 00 admin_hooks = array( 'init' => 'init', // WP init action 'menu' => 'admin_menu', // WP admin menu action 'head' => 'admin_head', // WP admin head action 'multisiteMenu' => 'network_admin_menu', // WP network admin menu action 'footer' => 'admin_footer', // WP admin footer action ); // Called in frontend context $this->front_hooks = array( // -- 'frontinit' => 'init', // WP frontend init action 'load' => 'plugins_loaded', // WP plugins_loaded action ); } /** * Calls the specified action in WP * * @param object $instance The parent class instance * * @return void */ public function setHooks( $instance ) { if ( is_admin() || is_network_admin() ) { // Set hooks for admin context $this->setAdminHooks( $instance ); } else { // Set hooks for frontend context $this->setFrontHooks( $instance ); } } /** * Calls the specified action in WP for admin * * @param object $instance The parent class instance * * @return void */ public function setAdminHooks( $instance ) { // For each admin action, check if it is defined in the class and call it foreach ( $this->admin_hooks as $hook => $value ) { if ( is_callable( array( $instance, 'hook' . ucfirst( $hook ) ) ) ) { // Call the WP add_action function add_action( $value, array( $instance, 'hook' . ucfirst( $hook ) ) ); } } } /** * Calls the specified action in WP for frontend * * @param object $instance The parent class instance * * @return void */ public function setFrontHooks( $instance ) { // For each frontend action, check if it is defined in the class and call it foreach ( $this->front_hooks as $hook => $value ) { if ( is_callable( array( $instance, 'hook' . ucfirst( $hook ) ) ) ) { // Call the WP add_action function with priority 11111 add_action( $value, array( $instance, 'hook' . ucfirst( $hook ) ), 11111 ); } } } /** * Calls the specified action in WP * * @param string $action The action to set * @param HMWP_Classes_FrontController $obj The object that contains the callback * @param array $callback Contains the class name or object and the callback function * * @return void */ public function setAction( $action, $obj, $callback ) { // Call the custom action function from WP with priority 10 add_action( $action, array( $obj, $callback ), 10 ); } } classes/ObjController.php 0000644 00000016144 14760004224 0011475 0 ustar 00 isAbstract(); if ( ! $abstract) { // Instantiate the class and store it in the instances array self::$instances[$className] = new $className(); if ( ! empty($args)) { call_user_func_array(array(self::$instances[$className], '__construct'), $args); } return self::$instances[$className]; } else { // Mark abstract classes as true in instances array self::$instances[$className] = true; } } } else { // Return the existing instance return self::$instances[$className]; } } else { // Stop all hooks on error defined('HMWP_DISABLE') || define('HMWP_DISABLE', true); // Get the class dir and name $class = self::getClassPath($className); // Show the file not found error HMWP_Classes_Error::showError('File not found: '.$class['dir'].$class['name'].'.php', 'danger'); } return false; } /** * Clear the class instance * * @param string $className - The name of the class to instantiate * @param array $args - Arguments to pass to the class constructor * * @return mixed - The class instance or false on failure * @throws Exception */ public static function newInstance($className, $args = array()) { // Check if the class can be found by its path if (self::getClassByPath($className)) { // Check if the class is already defined if (class_exists($className)) { // Initialize the new class self::$instances[$className] = new $className(); if ( ! empty($args)) { call_user_func_array(array(self::$instances[$className], '__construct'), $args); } return self::$instances[$className]; } else { return self::getClass($className, $args); } } return false; } /** * Include Class if exists * * @param string $classDir - Directory of the class file * @param string $className - Name of the class file * * @throws Exception */ private static function includeClass($classDir, $className) { // Initialize WordPress Filesystem $wp_filesystem = self::initFilesystem(); $path = $classDir.$className.'.php'; // Include the class file if it exists if ($wp_filesystem->exists($path)) { include_once $path; } } /** * Check if the class is correctly set * * @param string $className - The name of the class to check * * @return boolean - True if the class path is valid, False otherwise */ private static function checkClassPath($className) { $path = preg_split('/[_]+/', $className); if (is_array($path) && count($path) > 1) { if (in_array(_HMWP_NAMESPACE_, $path)) { return true; } } return false; } /** * Get the path of the class and name of the class * * @param string $className - The name of the class * * @return array|false - Array with 'dir' and 'name', or false on failure */ public static function getClassPath($className) { $dir = ''; // Check if the class path is valid if (self::checkClassPath($className)) { $path = preg_split('/[_]+/', $className); for ($i = 1; $i < sizeof($path) - 1; $i++) { $dir .= strtolower($path[$i]).'/'; } return array( 'dir' => _HMWP_ROOT_DIR_.'/'.$dir, 'name' => $path[sizeof($path) - 1] ); } return false; } /** * Get the valid class by path * * @param string $className - The name of the class * * @return array|bool|false - Array with class directory and name, or false on failure */ public static function getClassByPath($className) { // Initialize WordPress Filesystem $wp_filesystem = self::initFilesystem(); // Get the class dir and name $class = self::getClassPath($className); // Return the class if the file exists if ($wp_filesystem->exists($class['dir'].$class['name'].'.php') || file_exists($class['dir'].$class['name'].'.php')) { return $class; } return false; } /** * Instantiates the WordPress filesystem * * @return mixed */ public static function initFilesystem() { // The WordPress filesystem. global $wp_filesystem; if ( ! function_exists('WP_Filesystem')) { include_once ABSPATH.'wp-admin/includes/file.php'; } // Call WordPress filesystem function WP_Filesystem(); // If the filesystem is not connected to the files, // Initiate filesystem with direct connection to the server files if ( ! $wp_filesystem->connect()) { add_filter('filesystem_method', function ($method) { return 'direct'; }, 1); WP_Filesystem(); } // return the filesystem object return $wp_filesystem; } } classes/Tools.php 0000644 00000246521 14760004224 0010023 0 ustar 00 0, //-- 'api_token' => false, 'hmwp_token' => false, //-- 'hmwp_valid' => 1, 'hmwp_expires' => 0, 'hmwp_disable' => HMWP_Classes_Tools::generateRandomString( 16 ), 'hmwp_disable_name' => HMWP_Classes_Tools::generateRandomString( 16 ), //-- 'hmwp_plugin_name' => _HMWP_PLUGIN_FULL_NAME_, 'hmwp_plugin_menu' => _HMWP_PLUGIN_FULL_NAME_, 'hmwp_plugin_logo' => false, 'hmwp_plugin_icon' => 'dashicons-shield-alt', 'hmwp_plugin_website' => 'https://wpghost.com', 'hmwp_plugin_account_show' => 1, //-- 'logout' => 0, 'error' => 0, 'file_mappings' => array(), 'test_frontend' => 0, 'changes' => 0, 'admin_notice' => array(), 'prevent_slow_loading' => 1, 'hmwp_rewrites_in_wp_rules' => 0, 'hmwp_server_type' => 'auto', //-- 'hmwp_loading_hook' => array( 'normal' ), //load when the other plugins are initialized 'hmwp_firstload' => 0, //load the plugin as Must Use Plugin 'hmwp_priorityload' => 0, //load the plugin on plugin start 'hmwp_laterload' => 0, //load the plugin on template redirect //-- 'hmwp_fix_relative' => 1, 'hmwp_remove_third_hooks' => 0, 'hmwp_send_email' => 0, 'hmwp_activity_log' => 0, 'hmwp_activity_log_roles' => array(), 'hmwp_email_address' => '', //-- Firewall 'whitelist_ip' => array(), 'whitelist_paths' => 0, 'whitelist_urls' => array(), 'banlist_ip' => array(), 'banlist_hostname' => array(), 'banlist_user_agent' => array(), 'banlist_referrer' => array(), //-- Brute Force 'hmwp_bruteforce' => 0, 'hmwp_bruteforce_comments' => 0, 'hmwp_bruteforce_register' => 0, 'hmwp_bruteforce_lostpassword' => 0, 'hmwp_bruteforce_woocommerce' => 0, 'hmwp_bruteforce_username' => 0, 'hmwp_brute_message' => esc_html__( 'Your IP has been flagged for potential security violations. Please try again in a little while.', 'hide-my-wp' ), 'hmwp_hide_classes' => wp_json_encode( array() ), 'trusted_ip_header' => '', //Temporary Login 'hmwp_templogin' => 0, 'hmwp_templogin_role' => 'administrator', 'hmwp_templogin_redirect' => false, 'hmwp_templogin_delete_uninstal' => false, //Geoblock Login 'hmwp_geoblock' => 0, 'hmwp_geoblock_countries' => array(), 'hmwp_geoblock_urls' => array(), //Unique Login 'hmwp_uniquelogin' => 0, 'hmwp_uniquelogin_woocommerce' => 0, //2FA Login 'hmwp_2falogin' => 0, 'hmwp_2falogin_status' => 1, 'hmwp_2fa_totp' => 1, 'hmwp_2fa_email' => 0, 'hmwp_2falogin_max_attempts' => 5, 'hmwp_2falogin_max_timeout' => 900, 'hmwp_2falogin_message' => '', 'hmwp_2falogin_fail_message' => '', //Math reCaptcha 'brute_use_math' => 1, 'brute_max_attempts' => 5, 'brute_max_timeout' => 3600, //reCaptcha V2 'brute_use_captcha' => 0, 'brute_captcha_site_key' => '', 'brute_captcha_secret_key' => '', 'brute_captcha_theme' => 'light', 'brute_captcha_language' => '', //reCaptcha V2 'brute_use_captcha_v3' => 0, 'brute_captcha_site_key_v3' => '', 'brute_captcha_secret_key_v3' => '', //tweaks 'hmwp_hide_admin_toolbar' => 0, 'hmwp_hide_admin_toolbar_roles' => array( 'customer', 'subscriber' ), //-- 'hmwp_change_in_cache' => ( ( defined( 'WP_CACHE' ) && WP_CACHE ) ? 1 : 0 ), 'hmwp_change_in_cache_directory' => '', 'hmwp_hide_loggedusers' => 1, 'hmwp_hide_version' => 1, 'hmwp_hide_version_random' => 1, 'hmwp_hide_generator' => 1, 'hmwp_hide_prefetch' => 1, 'hmwp_hide_comments' => 0, 'hmwp_hide_wp_text' => 0, 'hmwp_hide_configfile' => 0, 'hmwp_hide_feed' => 0, 'hmwp_hide_in_feed' => 0, 'hmwp_hide_in_sitemap' => 0, 'hmwp_hide_author_in_sitemap' => 1, 'hmwp_robots' => 0, 'hmwp_disable_emojicons' => 0, 'hmwp_disable_manifest' => 1, 'hmwp_disable_embeds' => 0, 'hmwp_disable_debug' => 1, //-- 'hmwp_disable_click' => 0, 'hmwp_disable_click_loggedusers' => 0, 'hmwp_disable_click_roles' => array( 'subscriber' ), 'hmwp_disable_click_message' => "Right click is disabled!", 'hmwp_disable_inspect' => 0, 'hmwp_disable_inspect_blank' => 0, 'hmwp_disable_inspect_loggedusers' => 0, 'hmwp_disable_inspect_roles' => array( 'subscriber' ), 'hmwp_disable_inspect_message' => "Inspect Element is disabled!", 'hmwp_disable_source' => 0, 'hmwp_disable_source_loggedusers' => 0, 'hmwp_disable_source_roles' => array( 'subscriber' ), 'hmwp_disable_source_message' => "View Source is disabled!", 'hmwp_disable_copy_paste' => 0, 'hmwp_disable_paste' => 1, 'hmwp_disable_copy_paste_loggedusers' => 0, 'hmwp_disable_copy_paste_roles' => array( 'subscriber' ), 'hmwp_disable_copy_paste_message' => "Copy/Paste is disabled!", 'hmwp_disable_drag_drop' => 0, 'hmwp_disable_drag_drop_loggedusers' => 0, 'hmwp_disable_drag_drop_roles' => array( 'subscriber' ), 'hmwp_disable_drag_drop_message' => "Drag-n-Drop is disabled!", 'hmwp_disable_recording' => 0, 'hmwp_disable_recording_loggedusers' => 0, 'hmwp_disable_recording_roles' => array( 'subscriber' ), 'hmwp_disable_recording_message' => "Screen Recording is disabled!", //-- 'hmwp_disable_screen_capture' => 0, 'hmwp_file_cache' => 0, 'hmwp_url_mapping' => wp_json_encode( array() ), 'hmwp_mapping_classes' => 1, 'hmwp_mapping_file' => 0, 'hmwp_text_mapping' => wp_json_encode( array( 'from' => array(), 'to' => array(), ) ), 'hmwp_cdn_urls' => wp_json_encode( array() ), 'hmwp_security_alert' => 1, //-- 'hmwp_hide_plugins_advanced' => 0, 'hmw_plugins_mapping' => array(), 'hmwp_hide_themes_advanced' => 0, 'hmw_themes_mapping' => array(), //-- //redirects 'hmwp_url_redirect' => 'NFError', 'hmwp_do_redirects' => 0, 'hmwp_logged_users_redirect' => 0, 'hmwp_url_redirects' => array( 'default' => array( 'login' => '', 'logout' => '' ) ), 'hmwp_signup_template' => 0, 'hmwp_mapping_text_show' => 1, 'hmwp_mapping_url_show' => 1, 'hmwp_mapping_cdn_show' => 1, ); // Set WordPress options when security is disables. self::$default = array( 'hmwp_mode' => 'default', 'hmwp_admin_url' => 'wp-admin', 'hmwp_login_url' => 'wp-login.php', 'hmwp_activate_url' => 'wp-activate.php', 'hmwp_lostpassword_url' => '', 'hmwp_register_url' => '', 'hmwp_logout_url' => '', 'hmwp_plugin_url' => $plugin_relative_url, 'hmwp_plugins' => array(), 'hmwp_themes_url' => 'themes', 'hmwp_themes' => array(), 'hmwp_upload_url' => 'uploads', 'hmwp_admin-ajax_url' => 'admin-ajax.php', 'hmwp_wp-signup_url' => 'wp-signup.php', 'hmwp_hideajax_paths' => 0, 'hmwp_hideajax_admin' => 0, 'hmwp_tags_url' => 'tag', 'hmwp_wp-content_url' => $content_relative_url, 'hmwp_wp-includes_url' => $includes_relative_url, 'hmwp_author_url' => 'author', 'hmwp_hide_authors' => 0, 'hmwp_wp-comments-post' => 'wp-comments-post.php', 'hmwp_themes_style' => 'style.css', 'hmwp_hide_img_classes' => 0, 'hmwp_hide_styleids' => 0, 'hmwp_noncekey' => '_wpnonce', 'hmwp_wp-json' => 'wp-json', 'hmwp_hide_rest_api' => 0, 'hmwp_disable_rest_api' => 0, 'hmwp_disable_rest_api_param' => 0, 'hmwp_disable_xmlrpc' => 0, 'hmwp_hide_rsd' => 0, 'hmwp_hide_admin' => 0, 'hmwp_hide_newadmin' => 0, 'hmwp_hide_admin_loggedusers' => 0, 'hmwp_hide_login' => 0, 'hmwp_hide_wplogin' => 0, 'hmwp_hide_newlogin' => 0, 'hmwp_disable_language_switcher' => 0, 'hmwp_hide_plugins' => 0, 'hmwp_hide_all_plugins' => 0, 'hmwp_hide_themes' => 0, 'hmwp_emulate_cms' => '', //--secure headers 'hmwp_sqlinjection' => 0, 'hmwp_sqlinjection_location' => 'onload', 'hmwp_sqlinjection_level' => 2, 'hmwp_security_header' => 0, 'hmwp_hide_unsafe_headers' => 0, 'hmwp_security_headers' => array( "Strict-Transport-Security" => "max-age=15768000;includeSubdomains", "Content-Security-Policy" => "object-src 'none'", "X-XSS-Protection" => "1; mode=block", ), //-- 'hmwp_detectors_block' => 0, 'hmwp_hide_commonfiles' => 0, 'hmwp_disable_browsing' => 0, 'hmwp_hide_oldpaths' => 0, 'hmwp_hide_oldpaths_plugins' => 0, 'hmwp_hide_oldpaths_themes' => 0, 'hmwp_hide_oldpaths_types' => array( 'php', 'txt', 'html', 'lock' ), 'hmwp_hide_commonfiles_files' => array( 'wp-config-sample.php', 'readme.html', 'readme.txt', 'install.php', 'license.txt', 'php.ini', 'upgrade.php', 'bb-config.php', 'error_log', 'debug.log' ), // 'hmwp_category_base' => '', 'hmwp_tag_base' => '', // ); // Set options for "Safe Mode". self::$lite = array( 'hmwp_mode' => 'lite', 'hmwp_login_url' => 'newlogin', 'hmwp_activate_url' => 'activate', 'hmwp_lostpassword_url' => 'lostpass', 'hmwp_register_url' => 'register', 'hmwp_logout_url' => '', 'hmwp_admin-ajax_url' => 'admin-ajax.php', 'hmwp_hideajax_admin' => 0, 'hmwp_hideajax_paths' => 0, 'hmwp_plugin_url' => 'core/modules', 'hmwp_themes_url' => 'core/views', 'hmwp_upload_url' => 'storage', 'hmwp_wp-content_url' => 'core', 'hmwp_wp-includes_url' => 'lib', 'hmwp_author_url' => 'writer', 'hmwp_hide_authors' => 1, 'hmwp_wp-comments-post' => 'comments', 'hmwp_themes_style' => 'design.css', 'hmwp_wp-json' => 'wp-json', 'hmwp_hide_admin' => 1, 'hmwp_hide_newadmin' => 0, 'hmwp_hide_admin_loggedusers' => 0, 'hmwp_hide_login' => 1, 'hmwp_hide_wplogin' => 1, 'hmwp_hide_newlogin' => 1, 'hmwp_disable_language_switcher' => 0, 'hmwp_hide_plugins' => 1, 'hmwp_hide_all_plugins' => 0, 'hmwp_hide_themes' => 1, 'hmwp_emulate_cms' => 'drupal11', // 'hmwp_hide_img_classes' => 1, 'hmwp_hide_rest_api' => 1, 'hmwp_disable_rest_api' => 0, 'hmwp_disable_rest_api_param' => 0, 'hmwp_disable_xmlrpc' => 0, 'hmwp_hide_rsd' => 1, 'hmwp_hide_styleids' => 0, // 'hmwp_detectors_block' => 1, 'hmwp_sqlinjection' => 1, 'hmwp_security_header' => 1, 'hmwp_hide_unsafe_headers' => 1, 'hmwp_hide_commonfiles' => 1, 'hmwp_hide_oldpaths' => 0, 'hmwp_hide_oldpaths_plugins' => 0, 'hmwp_hide_oldpaths_themes' => 0, 'hmwp_disable_browsing' => 0, // ); // Set options for "Ghost Mode". self::$ninja = array( 'hmwp_mode' => 'ninja', 'hmwp_admin_url' => 'ghost-admin', 'hmwp_login_url' => 'ghost-login', 'hmwp_activate_url' => 'activate', 'hmwp_lostpassword_url' => 'lostpass', 'hmwp_register_url' => 'register', 'hmwp_logout_url' => 'disconnect', 'hmwp_admin-ajax_url' => 'ajax-call', 'hmwp_hideajax_paths' => 0, 'hmwp_hideajax_admin' => 1, 'hmwp_plugin_url' => 'core/modules', 'hmwp_themes_url' => 'core/views', 'hmwp_upload_url' => 'storage', 'hmwp_wp-content_url' => 'core', 'hmwp_wp-includes_url' => 'lib', 'hmwp_author_url' => 'writer', 'hmwp_hide_authors' => 1, 'hmwp_wp-comments-post' => 'comments', 'hmwp_themes_style' => 'design.css', 'hmwp_wp-json' => 'wp-json', 'hmwp_hide_admin' => 1, 'hmwp_hide_newadmin' => 1, 'hmwp_hide_admin_loggedusers' => 1, 'hmwp_hide_login' => 1, 'hmwp_hide_wplogin' => 1, 'hmwp_hide_newlogin' => 1, 'hmwp_disable_language_switcher' => 0, 'hmwp_hide_plugins' => 1, 'hmwp_hide_all_plugins' => ( self::isMultisites() ? 1 : 0 ), 'hmwp_hide_themes' => 1, 'hmwp_hide_img_classes' => 1, 'hmwp_hide_rest_api' => 1, 'hmwp_disable_rest_api' => 0, 'hmwp_disable_rest_api_param' => 1, 'hmwp_disable_xmlrpc' => 1, 'hmwp_hide_rsd' => 1, 'hmwp_hide_styleids' => 0, 'hmwp_emulate_cms' => 'drupal11', // 'hmwp_detectors_block' => 1, 'hmwp_sqlinjection' => 1, 'hmwp_security_header' => 1, 'hmwp_hide_unsafe_headers' => 1, 'hmwp_hide_commonfiles' => 1, 'hmwp_disable_browsing' => 0, 'hmwp_hide_oldpaths' => 1, 'hmwp_hide_oldpaths_plugins' => 1, 'hmwp_hide_oldpaths_themes' => 1, // 'hmwp_hide_in_feed' => 1, 'hmwp_hide_in_sitemap' => 1, 'hmwp_robots' => 1, 'hmwp_disable_embeds' => 1, 'hmwp_disable_manifest' => 1, 'hmwp_disable_emojicons' => 1, ); // Fetch the options based on whether it's a multisite and merge with defaults. if ( self::isMultisites() && defined( 'BLOG_ID_CURRENT_SITE' ) ) { $options = json_decode( get_blog_option( BLOG_ID_CURRENT_SITE, $keymeta ), true ); } else { $options = json_decode( get_option( $keymeta ), true ); } // Ensure compatibility with WP Client plugin. if ( self::isPluginActive( 'wp-client/wp-client.php' ) ) { self::$lite['hmwp_wp-content_url'] = 'include'; self::$ninja['hmwp_wp-content_url'] = 'include'; } // Merge the options with initial and default values. if ( is_array( $options ) ) { $options = @array_merge( self::$init, self::$default, $options ); } else { $options = @array_merge( self::$init, self::$default ); } // Validate the custom cache directory and reset if it contains 'wp-content'. if ( isset( $options['hmwp_change_in_cache_directory'] ) && $options['hmwp_change_in_cache_directory'] <> '' ) { if ( strpos( $options['hmwp_change_in_cache_directory'], 'wp-content' ) !== false ) { $options['hmwp_change_in_cache_directory'] = ''; } } // Update the whitelist level based on whitelist paths setting. if ( isset( $options['whitelist_paths'] ) && ! isset( $options['whitelist_level'] ) ) { $options['whitelist_level'] = ( $options['whitelist_paths'] == 1 ? 2 : 1 ); } // Set the category and tag bases considering multisite setup. $category_base = get_option( 'category_base' ); $tag_base = get_option( 'tag_base' ); if ( self::isMultisites() && ! is_subdomain_install() && is_main_site() && 0 === strpos( get_option( 'permalink_structure' ), '/blog/' ) ) { $category_base = preg_replace( '|^/?blog|', '', $category_base ); $tag_base = preg_replace( '|^/?blog|', '', $tag_base ); } $options['hmwp_category_base'] = $category_base; $options['hmwp_tag_base'] = $tag_base; // Set priority and rewrite rules settings if defined constants are set. if ( HMW_PRIORITY ) { $options['hmwp_priorityload'] = 1; } if ( HMW_RULES_IN_WP_RULES ) { $options['hmwp_rewrites_in_wp_rules'] = 1; } // Return the final options array. return $options; } /** * Update the database configuration and options for the plugin. * * This method is called during a plugin update to migrate existing settings and set new defaults. * It handles various tasks such as upgrading from a lite version, migrating specific options, * and initializing default values where necessary. * * @return void */ private static function updateDatabase() { // Check if the plugin version is updated if ( self::$options['hmwp_ver'] < HMWP_VERSION_ID ) { // Upgrade from Old Version if hmwp_options exist in the database if ( get_option( 'hmw_options_safe' ) ) { $options = json_decode( get_option( 'hmw_options_safe' ), true ); // If options are not empty, migrate them to the new format if ( ! empty( $options ) ) { foreach ( $options as $key => $value ) { self::$options[ str_replace( 'hmw_', 'hmwp_', $key ) ] = $value; } } // Delete old options to prevent conflicts delete_option( 'hmw_options_safe' ); } // Set default value for hmwp_hide_wplogin if it's not set and hmwp_hide_login is set if ( ! isset( self::$options['hmwp_hide_wplogin'] ) && isset( self::$options['hmwp_hide_login'] ) && self::$options['hmwp_hide_login'] ) { self::$options['hmwp_hide_wplogin'] = self::$options['hmwp_hide_login']; } // Initialize the account show option if not set if ( ! isset( self::$options['hmwp_plugin_account_show'] ) ) { self::$options['hmwp_plugin_account_show'] = 1; } // Upgrade logout redirect options to the new format if ( isset( self::$options['hmwp_logout_redirect'] ) && self::$options['hmwp_logout_redirect'] ) { self::$options['hmwp_url_redirects']['default']['logout'] = self::$options['hmwp_logout_redirect']; unset( self::$options['hmwp_logout_redirect'] ); } // Upgrade admin toolbar visibility option to the new format if ( isset( self::$options['hmwp_in_dashboard'] ) && self::$options['hmwp_in_dashboard'] ) { self::$options['hmwp_hide_admin_toolbar'] = self::$options['hmwp_in_dashboard']; unset( self::$options['hmwp_in_dashboard'] ); } // Upgrade sitemap visibility option to the new format if ( isset( self::$options['hmwp_shutdownload'] ) && self::$options['hmwp_shutdownload'] ) { self::$options['hmwp_hide_in_sitemap'] = self::$options['hmwp_shutdownload']; unset( self::$options['hmwp_shutdownload'] ); } // Remove old whitelist_paths option if ( isset( self::$options['whitelist_paths'] ) ) { unset( self::$options['whitelist_paths'] ); } //Update the new options in version 6.0.00 if ( self::$options['hmwp_ver'] < 6000 ) { if ( ! isset( self::$options['hmwp_security_header'] ) ) { self::$options['hmwp_security_header'] = 1; } if ( ! isset( self::$options['hmwp_hide_unsafe_headers'] ) ) { self::$options['hmwp_hide_unsafe_headers'] = 1; } if ( ! isset( self::$options['hmwp_hide_rsd'] ) ) { self::$options['hmwp_hide_rsd'] = 1; } if ( isset( self::$options['hmwp_hide_oldpaths_themes'] ) && self::$options['hmwp_hide_oldpaths_themes'] ) { self::$options['hmwp_hide_oldpaths_themes'] = 1; self::$options['hmwp_hide_oldpaths_plugins'] = 1; } if ( ! isset( self::$options['hmwp_security_headers'] ) ) { self::$options['hmwp_security_headers'] = array( "Strict-Transport-Security" => "max-age=63072000", "Content-Security-Policy" => "object-src 'none'", "X-XSS-Protection" => "1; mode=block", ); } } // Update the login paths on Cloud when the plugin is updated self::sendLoginPathsApi(); // Set the current version ID self::$options['hmwp_ver'] = HMWP_VERSION_ID; // Save updated options self::saveOptions(); } } /** * Retrieve the default value for a given key. * * @param string $key The key whose default value needs to be retrieved. * * @return mixed The default value associated with the given key, or false if the key doesn't exist. * @since 6.0.0 */ public static function getDefault( $key ) { if ( isset( self::$default[ $key ] ) ) { return self::$default[ $key ]; } return false; } /** * Retrieve the value of a specified option key. * * @param string $key The key of the option to retrieve. * * @return mixed The value of the specified option, or a default value if the key does not exist. */ public static function getOption( $key ) { if ( ! isset( self::$options[ $key ] ) ) { self::$options = self::getOptions(); if ( ! isset( self::$options[ $key ] ) ) { self::$options[ $key ] = 0; } } return apply_filters( 'hmwp_option_' . $key, self::$options[ $key ] ); } /** * Save the specified options in the WordPress options table * * @param string|null $key The key of the option to save. If null, no key will be set. * @param mixed $value The value of the option to save. * @param bool $safe Whether to save the option safely or not. * * @return void */ public static function saveOptions( $key = null, $value = '', $safe = false ) { // Default option key $keymeta = HMWP_OPTION; // Use a different option key if the $safe parameter is true if ( $safe ) { $keymeta = HMWP_OPTION_SAFE; } // If a specific key is provided, update the value in the options array if ( isset( $key ) ) { self::$options[ $key ] = $value; } // If the site is a multisite and BLOG_ID_CURRENT_SITE is defined if ( self::isMultisites() && defined( 'BLOG_ID_CURRENT_SITE' ) ) { // Update the option for the current blog in the network update_blog_option( BLOG_ID_CURRENT_SITE, $keymeta, wp_json_encode( self::$options ) ); } else { // Otherwise, update the option normally update_option( $keymeta, wp_json_encode( self::$options ) ); } } /** * Save the options into backup */ public static function saveOptionsBackup() { //Save the working options into backup foreach ( self::$options as $key => $value ) { HMWP_Classes_Tools::saveOptions( $key, $value, true ); } } /** * Add a link to settings in the plugin list * * @param array $links * * @return array */ public function hookActionlink( $links ) { // Check if the current user has the required capability to view the links if ( HMWP_Classes_Tools::userCan( HMWP_CAPABILITY ) ) { // Check if the transient 'hmwp_disable' exists, offering the option to resume security if ( get_transient( 'hmwp_disable' ) ) { $links[] = '' . esc_html__( "Resume Security", 'hide-my-wp' ) . ''; } else { // If 'hmwp_disable' transient does not exist, show the option to pause $links[] = '' . esc_html__( "Pause for 5 minutes", 'hide-my-wp' ) . ''; } // Add a Settings link for easy access to the plugin settings page $links[] = '' . esc_html__( 'Settings', 'hide-my-wp' ) . ''; } // Reverse the order of the links so they appear in a specific order in the plugin list return array_reverse( $links ); } /** * Load the plugin text domain for multilanguage support. * * @return void */ public static function loadMultilanguage() { load_plugin_textdomain( dirname( HMWP_BASENAME ), false, dirname( HMWP_BASENAME ) . '/languages/' ); } /** * Check if it's Rest Api call * * @return bool */ public static function isApi() { if ( isset( $_SERVER['REQUEST_URI'] ) ) { $uri = filter_var( $_SERVER['REQUEST_URI'], FILTER_SANITIZE_URL ); if ( $uri && strpos( $uri, '/' . HMWP_Classes_Tools::getOption( 'hmwp_wp-json' ) . '/' ) !== false ) { return true; } } return false; } /** * Check if it's Ajax call * * @return bool */ public static function isAjax() { if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) { return true; } return false; } /** * Check if it's Cron call * * @return bool */ public static function isCron() { if ( defined( 'DOING_CRON' ) && DOING_CRON ) { return true; } return false; } /** * Check if it's XML RPC call * * @return bool */ public static function isXmlRpc() { if ( defined( 'XMLRPC_REQUEST' ) && constant( 'XMLRPC_REQUEST' ) ) { return true; } return false; } /** * Check if it's valid to load firewall on the page * * @return bool */ public static function doFirewall() { //If allways change paths admin & frontend if ( defined( 'HMW_ALWAYS_RUN_FIREWALL' ) && HMW_ALWAYS_RUN_FIREWALL ) { return true; } //If firewall process is activated if ( ! apply_filters( 'hmwp_process_firewall', true ) ) { return false; } if ( HMWP_Classes_Tools::isApi() ) { return false; } //If not admin if ( ! is_admin() && ! is_network_admin() ) { //if user is not logged in if ( function_exists( 'is_user_logged_in' ) && ! is_user_logged_in() ) { return true; } } return false; } /** * Determines whether paths should be changed based on various conditions. * * @return bool True if paths should be changed, false otherwise. */ public static function doChangePaths() { //If allways change paths admin & frontend if ( defined( 'HMW_ALWAYS_CHANGE_PATHS' ) && HMW_ALWAYS_CHANGE_PATHS ) { return true; } if ( HMWP_Classes_Tools::isApi() ) { return false; } //If not admin if ( ( ! is_admin() && ! is_network_admin() ) || HMWP_Classes_Tools::isAjax() ) { //if process the change paths if ( HMWP_Classes_Tools::getOption( 'hmwp_hide_loggedusers' ) || ( function_exists( 'is_user_logged_in' ) && ! is_user_logged_in() ) ) { return true; } } return false; } /** * Determine whether to proceed with hiding or disabling functionality * * Applies filters and checks to validate if the process can proceed, * and performs validation on the current context (e.g., AJAX, API, Cron, admin). * * @return bool Returns true if the process should proceed, false otherwise */ public static function doHideDisable() { //Check if is valid for moving on if ( ! apply_filters( 'hmwp_process_hide_disable', true ) ) { return false; } if ( HMWP_Classes_Tools::isAjax() || HMWP_Classes_Tools::isApi() || HMWP_Classes_Tools::isCron() ) { return false; } //If not admin if ( ! is_admin() && ! is_network_admin() ) { //if process the change paths if ( HMWP_Classes_Tools::getOption( 'hmwp_hide_loggedusers' ) || ( function_exists( 'is_user_logged_in' ) && ! is_user_logged_in() ) ) { return true; } } return false; } /** * Determines whether specific click, inspect, or other actions should be disabled * based on the configuration and context. * * @return bool True if the action should be disabled, false otherwise. */ public static function doDisableClick() { // Check if is valid for moving on if ( ! apply_filters( 'hmwp_process_hide_disable', true ) ) { return false; } if ( HMWP_Classes_Tools::isCron() ) { return false; } // If not admin if ( ! is_admin() && ! is_network_admin() ) { if ( function_exists( 'is_user_logged_in' ) && ( HMWP_Classes_Tools::getOption( 'hmwp_disable_click' ) || HMWP_Classes_Tools::getOption( 'hmwp_disable_inspect' ) || HMWP_Classes_Tools::getOption( 'hmwp_disable_source' ) || HMWP_Classes_Tools::getOption( 'hmwp_disable_copy_paste' ) || HMWP_Classes_Tools::getOption( 'hmwp_disable_drag_drop' ) ) ) { return true; } } return false; } /** * Determines if URLs should be hidden based on various conditions and checks. * * @return bool True if URLs should be hidden, false otherwise. */ public static function doHideURLs() { // Check if it's valid for processing according to the 'hmwp_process_hide_urls' filter if ( ! apply_filters( 'hmwp_process_hide_urls', true ) ) { return false; } // Ensure the 'is_user_logged_in' function is available if ( ! function_exists( 'is_user_logged_in' ) ) { include_once ABSPATH . WPINC . '/pluggable.php'; } // Verify that the 'REQUEST_URI' server variable is set if ( ! isset( $_SERVER['REQUEST_URI'] ) ) { return false; } // Prevent hiding URLs when running a Cron job if ( HMWP_Classes_Tools::isCron() ) { return false; } // If all checks passed, return true to allow hiding URLs return true; } /** * Get the settings URL for the WordPress admin page. * * @param string $page The slug of the settings page. Default is 'hmwp_settings'. * @param bool $relative Whether to return a relative URL. Default is false. * * @return string The generated settings URL. */ public static function getSettingsUrl( $page = 'hmwp_settings', $relative = false ) { // Check if the URL is relative if ( $relative ) { return 'admin.php?page=' . $page; // Return relative admin URL } else { // Check if it's not a multisite setup if ( ! self::isMultisites() ) { return admin_url( 'admin.php?page=' . $page ); // Return standard WordPress admin URL } else { return network_admin_url( 'admin.php?page=' . $page ); // Return network admin URL for multisites } } } /** * Generate the cloud URL for the specified page * * @param string $page The page to append to the base URL (default is 'login') * * @return string The complete cloud URL */ public static function getCloudUrl( $page = 'login' ) { return _HMWP_ACCOUNT_SITE_ . '/user/auth/' . $page; } /** * Retrieves the WordPress configuration file path if it exists. * * @return string|false Returns the path to the wp-config.php file if found, or false if not found. */ public static function getConfigFile() { //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); if ( $wp_filesystem->exists( self::getRootPath() . 'wp-config.php' ) ) { return self::getRootPath() . 'wp-config.php'; } if ( $wp_filesystem->exists( dirname( ABSPATH ) . '/wp-config.php' ) ) { return dirname( ABSPATH ) . '/wp-config.php'; } return false; } /** * Set the header for the response based on the given type. * * @param string $type The type of header to set (e.g., 'json', 'html', 'text', 'text/xml', 'application/xml'). * * @return void */ public static function setHeader( $type ) { switch ( $type ) { case 'json': header( 'Content-Type: application/json' ); break; case 'html': header( "Content-type: text/html" ); break; case 'text': header( "Content-type: text/plain" ); break; case 'text/xml': header( 'Content-Type: text/xml' ); break; case 'application/xml': header( 'Content-Type: application/xml' ); break; } } /** * Get a value from $_POST / $_GET * if unavailable, take a default value * * @param string $key Value key * @param mixed $defaultValue (optional) * @param boolean $keep_newlines Keep the new lines in variable in case of texareas * * @return array|false|string Value */ public static function getValue( $key = null, $defaultValue = false, $keep_newlines = false ) { if ( ! isset( $key ) || $key == '' ) { return false; } //Get the parameters based on the form method //Sanitize each parameter based on the parameter type $ret = ( isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_GET[ $key ] ) ? $_GET[ $key ] : $defaultValue ) ); //phpcs:ignore if ( is_string( $ret ) === true ) { if ( $keep_newlines === false ) { // Validate the param based on its type if ( in_array( $key, array( 'hmwp_email_address', 'hmwp_email', 'whitelist_ip', 'banlist_ip', 'log' ) ) ) { // Validate email address, logs and ip addresses $ret = preg_replace( '/[^A-Za-z0-9-_.+*#:~@\!\'\/]/', '', $ret ); } elseif ( in_array( $key, array( 'hmwp_disable_name' ) ) ) { // Validate plugin disable parameter $ret = preg_replace( '/[^A-Za-z0-9-_]/', '', $ret ); } elseif ( in_array( $key, array( 'hmwp_admin_url' ) ) ) { // Validate new admin path $ret = preg_replace( '/[^A-Za-z0-9-_.]/', '', $ret ); } else { // Validate the rest of the fields $ret = preg_replace( '/[^A-Za-z0-9-_.\/]/', '', $ret ); } //Sanitize the text field $ret = sanitize_text_field( $ret ); } else { //Validate the text areas $ret = preg_replace( '/[^A-Za-z0-9-_.+*#:~\!\'\n\r\s\/]@/', '', $ret ); //Sanitize the textarea if ( function_exists( 'sanitize_textarea_field' ) ) { $ret = sanitize_textarea_field( $ret ); } } } //Return the unsplas validated and sanitized value return wp_unslash( $ret ); } /** * Determines whether the permalink structure ends with a trailing slash. * * @return bool True if the permalink structure ends with a trailing slash, false otherwise. */ public static function isTrailingslashit() { // Check if the permalink structure ends with a trailing slash and return true or false accordingly return ( '/' === substr( get_option( 'permalink_structure' ), - 1, 1 ) ); } /** * Determine if a key is set in the request data * * @param string|null $key The key to check in the POST or GET data * * @return bool */ public static function getIsset( $key = null ) { // Check if the key is not set or is an empty string, return false early if ( ! isset( $key ) || $key == '' ) { return false; } return isset( $_POST[ $key ] ) || isset( $_GET[ $key ] ); //phpcs:ignore } /** * Show the notices to WP * * @param string $message * @param string $type * * @return string */ public static function showNotices( $message, $type = '' ) { //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); if ( $wp_filesystem->exists( _HMWP_THEME_DIR_ . 'Notices.php' ) ) { ob_start(); include _HMWP_THEME_DIR_ . 'Notices.php'; $message = ob_get_contents(); ob_end_clean(); } return $message; } /** * Perform a remote GET request to the specified URL with optional parameters and options. * * @param string $url The URL to send the GET request to. * @param array $params Optional query parameters to be appended to the URL. * @param array $options Optional request options for customization. * * @return string|false The cleaned response body on success, or false on failure. */ public static function hmwp_remote_get( $url, $params = array(), $options = array() ) { $parameters = ''; if ( ! empty( $params ) ) { foreach ( $params as $key => $value ) { if ( $key <> '' ) { $parameters .= ( $parameters == "" ? "" : "&" ) . $key . "=" . $value; } } if ( $parameters <> '' ) { $url .= ( ( strpos( $url, "?" ) === false ) ? "?" : "&" ) . $parameters; } } $response = self::hmwp_wpcall( $url, $params, $options ); if ( is_wp_error( $response ) ) { return false; } return self::cleanResponce( wp_remote_retrieve_body( $response ) ); //clear and get the body } /** * Perform a remote POST request to the specified URL with given parameters and options. * * @param string $url The URL to which the POST request is sent. * @param array $params The parameters to include in the POST request. Default is an empty array. * @param array $options Additional options for the request. Default is an empty array. * * @return mixed The cleaned response body on success, or false if an error occurs. */ public static function hmwp_remote_post( $url, $params = array(), $options = array() ) { $options['method'] = 'POST'; $response = self::hmwp_wpcall( $url, $params, $options ); if ( is_wp_error( $response ) ) { return false; } return self::cleanResponce( wp_remote_retrieve_body( $response ) ); //clear and get the body } /** * Merge and set default remote options. * * @param array $options Custom options to merge with the default remote options. * * @return array The merged options array. */ public function add_remote_options( $options ) { $options = array_replace_recursive( array( 'sslverify' => _HMWP_CHECK_SSL_, 'method' => 'GET', 'timeout' => 10, 'headers' => array( 'TOKEN' => HMWP_Classes_Tools::getOption( 'hmwp_token' ), 'API-TOKEN' => HMWP_Classes_Tools::getOption( 'api_token' ), 'USER-URL' => site_url(), 'LANG' => get_bloginfo( 'language' ), 'VER' => HMWP_VERSION ) ), $options ); return $options; } /** * Makes a remote request to the specified URL using WordPress HTTP API. * * @param string $url The URL to send the request to. * @param array $params The parameters to send with the request. * @param array $options Additional options for the HTTP request. * * @return array|WP_Error The response or WP_Error on failure. */ public static function hmwp_wpcall( $url, $params, $options ) { // Apply filters to the options array before making the request $options = apply_filters( 'hmwp_wpcall_options', $options ); if ( $options['method'] == 'POST' ) { // Check if the method is POST and handle accordingly $options['body'] = $params; unset( $options['method'] ); $response = wp_remote_post( $url, $options ); } else { // Make a POST request to the provided URL with the specified options unset( $options['method'] ); $response = wp_remote_get( $url, $options ); } // Trigger debug action to log the remote request details for debugging purposes do_action( 'hmwp_debug_request', $url, $options, $response ); return $response; } /** * Perform a local HTTP GET request with specific options. * * @param string $url The URL to be requested. * @param array $options Additional options for the HTTP request. Defaults include 'sslverify' as false and 'timeout' as 10 seconds. * * @return array|WP_Error The response received from the HTTP request or a WP_Error object in case of an error. */ public static function hmwp_localcall( $url, $options = array() ) { // Predefined options with default values for SSL verification and request timeout $options = array_merge( array( 'sslverify' => false, // Disable SSL verification by default 'timeout' => 10, // Set timeout to 10 seconds by default ), $options ); // Perform a GET request using the WordPress HTTP API with the provided options $response = wp_remote_get( $url, $options ); // Check if the response has an error if ( is_wp_error( $response ) ) { // Trigger debug action to log details of the failed local request for debugging purposes do_action( 'hmwp_debug_local_request', $url, $options, $response ); } // Return the response received or the error object return $response; } /** * Cleans the provided response by trimming specific characters. * * @param string $response The response string to be cleaned * * @return string The cleaned response string */ private static function cleanResponce( $response ) { return trim( $response, '()' ); } /** * Determines if the "Content-Type" header matches any of the specified types. * * @param array $types List of content types to check against. Default is ['text/html', 'text/xml']. * * @return bool Returns true if a "Content-Type" header matching one of the specified types is found, otherwise false. */ public static function isContentHeader( $types = array( 'text/html', 'text/xml' ) ) { // Get the list of headers sent by the server or PHP script $headers = headers_list(); // Check if headers and content types list are not empty if ( ! empty( $headers ) && ! empty( $types ) ) { // Loop through each header foreach ( $headers as $value ) { // Check if the header contains a colon (to ensure it's properly formatted) if ( strpos( $value, ':' ) !== false ) { // Look for "Content-Type" within the header if ( stripos( $value, 'Content-Type' ) !== false ) { // Loop through the provided list of content types to find a match foreach ( $types as $type ) { // Check if the header value contains the current content type if ( stripos( $value, $type ) !== false ) { // Return true if a match is found return true; } } // Return false if no match is found within this "Content-Type" header return false; } } } } // Return false if no headers or no matches for any content type are found return false; } /** * Determine if the server is running Apache or a compatible server type. * * This method checks multiple criteria to identify if the server is Apache or * a similar server type, such as LiteSpeed or SiteGround. * * - If a custom server type is set in the options, it validates against predefined types. * - If a custom server type is defined as a constant, it verifies if it matches Apache. * - It excludes Flywheel servers, as they force Nginx. * - Falls back to checking a global variable that indicates if the server is Apache. * * @return bool True if the server is identified as Apache or a similar type, false otherwise. */ public static function isApache() { global $is_apache; // Check if custom server type is defined in options if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { // Return true if the custom server type matches Apache or similar types return in_array( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ), array( 'apache', 'litespeed', 'siteground' ) ); } // Check if custom server type is defined as a constant and matches Apache if ( defined( 'HMWP_SERVER_TYPE' ) && strtolower( HMWP_SERVER_TYPE ) == 'apache' ) { return true; } // Check if the server is Flywheel, which forces Nginx, thus not Apache if ( self::isFlywheel() ) { return false; } // Return the global variable indicating if the server is Apache return $is_apache; } /** * Determines if the mod_rewrite module is enabled in the server. * * @return bool True if mod_rewrite is active, false otherwise. */ public static function isModeRewrite() { if ( function_exists( 'apache_get_modules' ) ) { $modules = apache_get_modules(); if ( ! empty( $modules ) ) { return in_array( 'mod_rewrite', $modules ); } } return true; } /** * Determine if the server environment is running on LiteSpeed. * * This method checks multiple conditions, including custom-defined settings, * server constants, and server-specific headers, to ascertain if the server * environment is using LiteSpeed. * * @return bool True if the server environment is LiteSpeed, false otherwise. */ public static function isLitespeed() { $litespeed = false; // Check if server type is custom defined in the options and matches LiteSpeed if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { return ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) == 'litespeed' ); } // Check if server type is custom defined as a constant and matches LiteSpeed if ( defined( 'HMWP_SERVER_TYPE' ) && strtolower( HMWP_SERVER_TYPE ) == 'litespeed' ) { return true; } // Check server software name for "LiteSpeed" if ( isset( $_SERVER['SERVER_SOFTWARE'] ) && stripos( $_SERVER['SERVER_SOFTWARE'], 'LiteSpeed' ) !== false ) { //phpcs:ignore $litespeed = true; // Check server name for "LiteSpeed" } elseif ( isset( $_SERVER['SERVER_NAME'] ) && stripos( $_SERVER['SERVER_NAME'], 'LiteSpeed' ) !== false ) { //phpcs:ignore $litespeed = true; // Check for LiteSpeed-specific headers } elseif ( isset( $_SERVER['X-Litespeed-Cache-Control'] ) ) { $litespeed = true; } // Return false if the server is detected as Flywheel, since it's not LiteSpeed if ( self::isFlywheel() ) { return false; } // Return the LiteSpeed detection result return $litespeed; } /** * Determines if the server is using Lighttpd as its server software. * * @return bool True if the server software is Lighttpd, false otherwise. */ public static function isLighthttp() { return ( isset( $_SERVER['SERVER_SOFTWARE'] ) && stripos( $_SERVER['SERVER_SOFTWARE'], 'lighttpd' ) !== false ); //phpcs:ignore } /** * Check if the environment is running on AWS infrastructure. * * @return bool True if the environment is identified as AWS, false otherwise. */ public static function isAWS() { // Check if a custom-defined server type matches Bitnami (used in AWS infrastructure) if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { return ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) == 'bitnami' ); } // Check if the document root contains '/bitnami/', which is often used in AWS setups if ( isset( $_SERVER["DOCUMENT_ROOT"] ) && strpos( $_SERVER["DOCUMENT_ROOT"], "/bitnami/" ) ) { //phpcs:ignore return true; } // Retrieve the list of headers sent by the server $headers = headers_list(); // Loop through the headers to check for the AWS CloudFront header 'x-amz-cf-id' foreach ( $headers as $header ) { if ( strpos( $header, 'x-amz-cf-id' ) !== false ) { return true; } } // Return false if none of the conditions above indicate AWS infrastructure return false; } /** * Check if the current WordPress installation supports multisite. * * @return bool */ public static function isMultisites() { return is_multisite(); } /** * Determines if the current WordPress installation is a multisite setup with path-based rather than subdomain-based URLs. * * @return bool True if the installation is multisite and uses path-based URLs, false otherwise. */ public static function isMultisiteWithPath() { return ( is_multisite() && ( ( defined( 'SUBDOMAIN_INSTALL' ) && ! SUBDOMAIN_INSTALL ) || ( defined( 'VHOST' ) && VHOST == 'no' ) ) ); } /** * Determine if the server is running Nginx. * * @return bool */ public static function isNginx() { global $is_nginx; // Check if a custom-defined server type matches Nginx if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) == 'nginx' ) { return true; } } // Return true if the custom server type constant matches Nginx if ( defined( 'HMWP_SERVER_TYPE' ) && strtolower( HMWP_SERVER_TYPE ) == 'nginx' ) { return true; } return ( $is_nginx || ( isset( $_SERVER['SERVER_SOFTWARE'] ) && ( stripos( $_SERVER['SERVER_SOFTWARE'], 'nginx' ) !== false || stripos( $_SERVER['SERVER_SOFTWARE'], 'TasteWP' ) !== false ) ) ); //phpcs:ignore } /** * Returns true if server is Wpengine * * @return boolean */ public static function isWpengine() { // Check if a custom-defined server type matches WPEngine if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { return ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) == 'wpengine' ); } // Return true if the custom server type constant matches WPEngine if ( defined( 'HMWP_SERVER_TYPE' ) && strtolower( HMWP_SERVER_TYPE ) == 'wpengine' ) { return true; } return ( isset( $_SERVER['WPENGINE_PHPSESSIONS'] ) ); } /** * Returns true if server is Local by Flywheel * * @return boolean */ public static function isLocalFlywheel() { // Check if a custom-defined server type matches Local by Flywheel if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { return ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) == 'local' ); } return false; } /** * Returns true if server is Wpengine * * @return boolean */ public static function isFlywheel() { // Check if a custom-defined server type matches Flywheel if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { return ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) == 'flywheel' ); } // Return true if the custom server type constant matches Flywheel if ( defined( 'HMWP_SERVER_TYPE' ) && strtolower( HMWP_SERVER_TYPE ) == 'flywheel' ) { return true; } if ( isset( $_SERVER['SERVER'] ) && stripos( $_SERVER['SERVER'], 'Flywheel' ) !== false ) { //phpcs:ignore return true; } return ( isset( $_SERVER['SERVER_SOFTWARE'] ) && stripos( $_SERVER['SERVER_SOFTWARE'], 'Flywheel' ) !== false ); //phpcs:ignore } /** * Returns true if server is Inmotion * * @return boolean */ public static function isInmotion() { // Check if a custom-defined server type matches Inmotion if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { return ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) == 'inmotion' ); } // Return true if the custom server type constant matches Inmotion if ( defined( 'HMWP_SERVER_TYPE' ) && strtolower( HMWP_SERVER_TYPE ) == 'inmotion' ) { return true; } return ( isset( $_SERVER['SERVER_ADDR'] ) && stripos( @gethostbyaddr( $_SERVER['SERVER_ADDR'] ), 'inmotionhosting.com' ) !== false ); //phpcs:ignore } /** * Returns true if server is Godaddy * * @return boolean */ public static function isGodaddy() { // Check if a custom-defined server type matches Godaddy if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { return ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) == 'godaddy' ); } // Return true if the custom server type constant matches Nginx if ( defined( 'HMWP_SERVER_TYPE' ) && strtolower( HMWP_SERVER_TYPE ) == 'godaddy' ) { return true; } return ( file_exists( ABSPATH . 'gd-config.php' ) ); } /** * Returns true if server is IIS * * @return boolean */ public static function isIIS() { global $is_IIS, $is_iis7; // Check if a custom-defined server type matches IIS Windows if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { return ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) == 'iis' ); } // Return true if the custom server type constant matches IIS if ( defined( 'HMWP_SERVER_TYPE' ) && strtolower( HMWP_SERVER_TYPE ) == 'iis' ) { return true; } return ( $is_iis7 || $is_IIS || ( isset( $_SERVER['SERVER_SOFTWARE'] ) && stripos( $_SERVER['SERVER_SOFTWARE'], 'microsoft-iis' ) !== false ) ); //phpcs:ignore } /** * Determines if the operating system is Windows. * * @return bool True if the operating system is Windows, false otherwise. */ public static function isWindows() { return ( strtoupper( substr( PHP_OS, 0, 3 ) ) === 'WIN' ); } /** * Check if IIS has rewritten 2 structure enabled * * @return bool */ public static function isPHPPermalink() { if ( get_option( 'permalink_structure' ) ) { if ( strpos( get_option( 'permalink_structure' ), 'index.php' ) !== false || stripos( get_option( 'permalink_structure' ), 'index.html' ) !== false || strpos( get_option( 'permalink_structure' ), 'index.htm' ) !== false ) { return true; } } return false; } /** * Returns true if server is Godaddy * * @return boolean */ public static function isCloudPanel() { global $is_nginx; //If custom defined if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) <> 'auto' ) { if ( HMWP_Classes_Tools::getOption( 'hmwp_server_type' ) == 'cloudpanel' ) { $is_nginx = true; return true; } } return false; } /** * Is a cache plugin installed in WordPress? * * @return bool */ public static function isCachePlugin() { return ( HMWP_Classes_Tools::isPluginActive( 'autoptimize/autoptimize.php' ) || HMWP_Classes_Tools::isPluginActive( 'beaver-builder-lite-version/fl-builder.php' ) || HMWP_Classes_Tools::isPluginActive( 'beaver-builder/fl-builder.php' ) || HMWP_Classes_Tools::isPluginActive( 'breeze/breeze.php' ) || HMWP_Classes_Tools::isPluginActive( 'cache-enabler/cache-enabler.php' ) || HMWP_Classes_Tools::isPluginActive( 'comet-cache/comet-cache.php' ) || HMWP_Classes_Tools::isPluginActive( 'hummingbird-performance/wp-hummingbird.php' ) || HMWP_Classes_Tools::isPluginActive( 'hyper-cache/plugin.php' ) || HMWP_Classes_Tools::isPluginActive( 'jch-optimize/jch-optimize.php' ) || HMWP_Classes_Tools::isPluginActive( 'litespeed-cache/litespeed-cache.php' ) || HMWP_Classes_Tools::isPluginActive( 'powered-cache/powered-cache.php' ) || HMWP_Classes_Tools::isPluginActive( 'sg-cachepress/sg-cachepress.php' ) || HMWP_Classes_Tools::isPluginActive( 'w3-total-cache/w3-total-cache.php' ) || HMWP_Classes_Tools::isPluginActive( 'wp-asset-clean-up/wpacu.php' ) || HMWP_Classes_Tools::isPluginActive( 'wp-fastest-cache/wpFastestCache.php' ) || HMWP_Classes_Tools::isPluginActive( 'wp-rocket/wp-rocket.php' ) || HMWP_Classes_Tools::isPluginActive( 'wp-super-cache/wp-cache.php' ) || HMWP_Classes_Tools::isPluginActive( 'swift-performance/performance.php' ) || HMWP_Classes_Tools::isPluginActive( 'swift-performance-lite/performance.php' ) || HMWP_Classes_Tools::isPluginActive( 'wp-core-web-vitals/wpcorewebvitals.php' ) || WP_CACHE ); } /** * Check whether the plugin is active by checking the active_plugins list. * * @source wp-admin/includes/plugin.php * * @param string $plugin Plugin folder/main file. * * @return boolean */ public static function isPluginActive( $plugin ) { // Initialize the active plugins list if it's not already set if ( empty( self::$active_plugins ) ) { // Check if it's a multisite setup if ( self::isMultisites() ) { // Get the list of plugins that are active sitewide, defaults to an empty array if none if ( ! $sitewide_plugins = get_site_option( 'active_sitewide_plugins' ) ) { $sitewide_plugins = array(); } // Add the sitewide plugins to the active plugins list self::$active_plugins = array_keys( $sitewide_plugins ); // Retrieve all sites in the multisite setup $sites = get_sites( array( 'number' => 10000, 'public' => 1, 'deleted' => 0, ) ); // Loop through each site to collect active plugins foreach ( $sites as $site ) { // Switch to the current site switch_to_blog( $site->blog_id ); // Retrieve active plugins for this site, defaults to an empty array if none $active_plugins = (array) get_option( 'active_plugins', array() ); // Merge the site's active plugins into the global active plugins list self::$active_plugins = array_merge( self::$active_plugins, $active_plugins ); // Restore to the original site restore_current_blog(); } // Remove duplicate entries from the active plugins list if ( ! empty( self::$active_plugins ) ) { self::$active_plugins = array_unique( self::$active_plugins ); } } else { // Regular single site setup - retrieve the active plugins directly self::$active_plugins = (array) get_option( 'active_plugins', array() ); } } // Return whether the plugin is in the active plugins list return in_array( $plugin, self::$active_plugins, true ); } /** * Check whether the theme is active. * * @param string $name Theme folder/main file. * * @return boolean */ public static function isThemeActive( $name ) { $theme = get_option( 'template' ); if ( $theme ) { if ( strtolower( $theme ) == strtolower( $name ) || strtolower( $theme ) == strtolower( $name ) . ' child' || strtolower( $theme ) == strtolower( $name ) . ' child theme' ) { return true; } } return false; } /** * Get all the plugin names * * @return array */ public static function getAllPlugins() { // Check if the HMWP option to hide all plugins is enabled if ( HMWP_Classes_Tools::getOption( 'hmwp_hide_all_plugins' ) ) { // Ensure the get_plugins() function is included before use if ( ! function_exists( 'get_plugins' ) ) { include_once ABSPATH . 'wp-admin/includes/plugin.php'; } // Retrieve all plugin file paths from WordPress $all_plugins = array_keys( get_plugins() ); } else { // Retrieve only the active plugins from WordPress options $all_plugins = (array) get_option( 'active_plugins', array() ); } // Check if WordPress is running as a multisite if ( self::isMultisites() ) { // Merge active plugins with any sitewide active plugins $all_plugins = array_merge( array_values( $all_plugins ), array_keys( get_site_option( 'active_sitewide_plugins' ) ) ); } // Remove duplicate entries from the plugins array if ( ! empty( $all_plugins ) ) { $all_plugins = array_unique( $all_plugins ); } return $all_plugins; } /** * Get all the themes names * * @return array */ public static function getAllThemes() { return search_theme_directories(); } /** * Get the absolute filesystem path to the root of the WordPress installation * * @return string Full filesystem path to the root of the WordPress installation */ public static function getRootPath() { $root_path = ABSPATH; if ( defined( '_HMWP_CONFIGPATH' ) ) { $root_path = _HMWP_CONFIGPATH; } elseif ( self::isFlywheel() && defined( 'WP_CONTENT_DIR' ) && dirname( WP_CONTENT_DIR ) ) { $root_path = str_replace( '\\', '/', dirname( WP_CONTENT_DIR ) ) . '/'; } return apply_filters( 'hmwp_root_path', $root_path ); } /** * Get the absolute filesystem path to the root of the WordPress installation * * @return string Full filesystem path to the root of the WordPress installation */ public static function getHomeRootPath() { $home_root = '/'; if ( HMWP_Classes_Tools::isMultisites() && defined( 'PATH_CURRENT_SITE' ) ) { $path = PATH_CURRENT_SITE; } else { $path = wp_parse_url( site_url(), PHP_URL_PATH ); } if ( $path ) { $home_root = trailingslashit( $path ); } return apply_filters( 'hmwp_home_root', $home_root ); } /** * Get Relative path for the current blog in case of WP Multisite * * @param $url * * @return string */ public static function getRelativePath( $url ) { if ( $url <> '' ) { // Get the relative url path $url = wp_make_link_relative( $url ); // Get the relative domain $domain = site_url(); // f WP Multisite, get the root domain if ( self::isMultisiteWithPath() ) { $domain = network_site_url(); } // Get relative path and exclude any root domain from URL if($domain = wp_make_link_relative( trim($domain , '/') )){ $url = str_replace( $domain, '', $url ); } //remove the domain path if exists if ( self::isMultisiteWithPath() && defined( 'PATH_CURRENT_SITE' ) && PATH_CURRENT_SITE <> '/' ) { $url = str_replace( rtrim( PATH_CURRENT_SITE, '/' ), '', $url ); } } return trailingslashit( $url ); } /** * Check if wp-content is changed and set in a different location * * @ver 7.0.12 * * @return bool */ public static function isDifferentWPContentPath() { $homepath = ''; if ( wp_parse_url( site_url(), PHP_URL_PATH ) ) { $homepath = ltrim( wp_parse_url( site_url(), PHP_URL_PATH ), '/' ); } if ( $homepath <> '/' ) { $contenturl = ltrim( wp_parse_url( content_url(), PHP_URL_PATH ), '/' ); return ( strpos( $contenturl, $homepath . '/' ) === false ); } return false; } /** * Check if the upload file is placed on a different location * * @ver 7.0.12 * * @return bool */ public static function isDifferentUploadPath() { return defined( 'UPLOADS' ); } /** * Empty the cache from other cache plugins when save the settings */ public static function emptyCache() { try { //Empty WordPress rewrites count for 404 error. //This happens when the rules are not saved through config file HMWP_Classes_Tools::saveOptions( 'file_mappings', array() ); //For debugging do_action( 'hmwp_debug_cache', '' ); if ( class_exists( '\FlyingPress\Purge' ) && method_exists( '\FlyingPress\Purge', 'purge_everything' ) ) { \FlyingPress\Purge::purge_everything(); } if ( class_exists( '\JchOptimize\Platform\Cache' ) && method_exists( '\JchOptimize\Platform\Cache', 'deleteCache' ) ) { \JchOptimize\Platform\Cache::deleteCache(); } ////////////////////////////////////////////////////////////////////////////// if ( function_exists( 'w3tc_pgcache_flush' ) ) { w3tc_pgcache_flush(); } if ( function_exists( 'w3tc_minify_flush' ) ) { w3tc_minify_flush(); } if ( function_exists( 'w3tc_dbcache_flush' ) ) { w3tc_dbcache_flush(); } if ( function_exists( 'w3tc_objectcache_flush' ) ) { w3tc_objectcache_flush(); } ////////////////////////////////////////////////////////////////////////////// if ( function_exists( 'wp_cache_clear_cache' ) ) { wp_cache_clear_cache(); } if ( function_exists( 'rocket_clean_domain' ) && function_exists( 'rocket_clean_minify' ) && function_exists( 'rocket_clean_cache_busting' ) ) { // Remove all cache files rocket_clean_domain(); rocket_clean_minify(); rocket_clean_cache_busting(); } ////////////////////////////////////////////////////////////////////////////// if ( function_exists( 'apc_clear_cache' ) ) { // Remove all apc if enabled apc_clear_cache(); } ////////////////////////////////////////////////////////////////////////////// if ( class_exists( 'Cache_Enabler_Disk' ) && method_exists( 'Cache_Enabler_Disk', 'clear_cache' ) ) { // clear disk cache Cache_Enabler_Disk::clear_cache(); } ////////////////////////////////////////////////////////////////////////////// if ( self::isPluginActive( 'litespeed-cache/litespeed-cache.php' ) ) { header("X-LiteSpeed-Purge: *"); } ////////////////////////////////////////////////////////////////////////////// if ( self::isPluginActive( 'hummingbird-performance/wp-hummingbird.php' ) ) { do_action( 'wphb_clear_page_cache' ); } ////////////////////////////////////////////////////////////////////////////// if ( class_exists( 'WpeCommon' ) ) { if ( method_exists( 'WpeCommon', 'purge_memcached' ) ) { WpeCommon::purge_memcached(); } if ( method_exists( 'WpeCommon', 'clear_maxcdn_cache' ) ) { WpeCommon::clear_maxcdn_cache(); } if ( method_exists( 'WpeCommon', 'purge_varnish_cache' ) ) { WpeCommon::purge_varnish_cache(); } } ////////////////////////////////////////////////////////////////////////////// if ( self::isPluginActive( 'sg-cachepress/sg-cachepress.php' ) && class_exists( 'Supercacher' ) ) { if ( method_exists( 'Supercacher', 'purge_cache' ) && method_exists( 'Supercacher', 'delete_assets' ) ) { Supercacher::purge_cache(); Supercacher::delete_assets(); } } //Clear the fastest cache global $wp_fastest_cache; if ( isset( $wp_fastest_cache ) && method_exists( $wp_fastest_cache, 'deleteCache' ) ) { $wp_fastest_cache->deleteCache(); } ////////////////////////////////////////////////////////////////////////////// } catch ( Exception $e ) { } } /** * Flush the WordPress rewrites */ public static function flushWPRewrites() { if ( HMWP_Classes_Tools::isPluginActive( 'woocommerce/woocommerce.php' ) ) { update_option( 'woocommerce_queue_flush_rewrite_rules', 'yes' ); } } /** * Called on plugin activation * * @throws Exception */ public function hmwp_activate() { set_transient( 'hmwp_activate', true ); //set restore settings option on plugin activate $lastsafeoptions = self::getOptions( true ); if ( isset( $lastsafeoptions['hmwp_mode'] ) && ( $lastsafeoptions['hmwp_mode'] == 'ninja' || $lastsafeoptions['hmwp_mode'] == 'lite' ) ) { set_transient( 'hmwp_restore', true ); } //Initialize the compatibility with other plugins HMWP_Classes_ObjController::getClass( 'HMWP_Models_Compatibility' )->install(); } /** * Called on plugin deactivation * Remove all the rewrite rules on deactivation * * @throws Exception */ public function hmwp_deactivate() { //Get the default values $options = self::$default; //Prevent duplicates foreach ( $options as $key => $value ) { //set the default params from tools self::saveOptions( $key, $value ); } //remove the custom rules HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rules' )->writeToFile( '', 'HMWP_VULNERABILITY' ); HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rules' )->writeToFile( '', 'HMWP_RULES' ); //clear the locked ips HMWP_Classes_ObjController::getClass( 'HMWP_Controllers_Brute' )->clearBlockedIPs(); //Build the redirect table HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rewrite' )->flushChanges(); //Delete the compatibility with other plugins HMWP_Classes_ObjController::getClass( 'HMWP_Models_Compatibility' )->uninstall(); } /** * Call this function on rewrite update from other plugins * * @param array $wp_rules * * @return array * @throws Exception */ public function checkRewriteUpdate( $wp_rules = array() ) { try { if ( ! HMWP_Classes_Tools::getOption( 'error' ) && ! HMWP_Classes_Tools::getOption( 'logout' ) ) { //Build the redirect table HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rewrite' )->clearRedirect()->setRewriteRules()->flushRewrites(); //INSERT SEURITY RULES if ( ! HMWP_Classes_Tools::isIIS() ) { //For Nginx and Apache the rules can be inserted separately $rules = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rules' )->getInjectionRewrite(); if ( HMWP_Classes_Tools::getOption( 'hmwp_hide_oldpaths' ) || HMWP_Classes_Tools::getOption( 'hmwp_hide_commonfiles' ) ) { $rules .= HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rules' )->getHideOldPathRewrite(); } HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rules' )->writeToFile( $rules, 'HMWP_VULNERABILITY' ); } } } catch ( Exception $e ) { } return $wp_rules; } /** * Check if new themes or plugins are added in WordPress */ public function checkPluginsThemesUpdates() { try { //Check if tere are plugins added to website if ( HMWP_Classes_Tools::getOption( 'hmwp_hide_plugins' ) ) { $all_plugins = HMWP_Classes_Tools::getAllPlugins(); $dbplugins = HMWP_Classes_Tools::getOption( 'hmwp_plugins' ); foreach ( $all_plugins as $plugin ) { if ( function_exists( 'is_plugin_active' ) && is_plugin_active( $plugin ) && isset( $dbplugins['from'] ) && ! empty( $dbplugins['from'] ) ) { if ( ! in_array( plugin_dir_path( $plugin ), $dbplugins['from'] ) ) { HMWP_Classes_Tools::saveOptions( 'changes', true ); } } } } //Check if there are themes added to website if ( HMWP_Classes_Tools::getOption( 'hmwp_hide_themes' ) ) { //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); $all_themes = HMWP_Classes_Tools::getAllThemes(); $dbthemes = HMWP_Classes_Tools::getOption( 'hmwp_themes' ); foreach ( $all_themes as $theme => $value ) { if ( $wp_filesystem->is_dir( $value['theme_root'] ) && isset( $dbthemes['from'] ) && ! empty( $dbthemes['from'] ) ) { if ( ! in_array( $theme . '/', $dbthemes['from'] ) ) { HMWP_Classes_Tools::saveOptions( 'changes', true ); } } } } //If there are changed (new plugins, new themes) if ( self::getOption( 'changes' ) ) { //Initialize the compatibility with other plugins HMWP_Classes_ObjController::getClass( 'HMWP_Models_Compatibility' )->install(); } } catch ( Exception $e ) { } } /** * Send the login URL to Cloud for this URL * * @return void */ public static function sendLoginPathsApi() { $domain = ( self::isMultisites() && defined( 'BLOG_ID_CURRENT_SITE' ) ) ? get_home_url( BLOG_ID_CURRENT_SITE ) : site_url(); $options = array( 'timeout' => 10, 'headers' => array( 'USER-URL' => $domain ) ); $login = array( 'path' => HMWP_Classes_Tools::getOption( 'hmwp_login_url' ), 'parameter' => HMWP_Classes_Tools::getOption( 'hmwp_disable_name' ), 'value' => HMWP_Classes_Tools::getOption( 'hmwp_disable' ), ); self::hmwp_remote_post( _HMWP_API_SITE_ . '/api/settings', array( 'login' => wp_json_encode( $login ), 'url' => $domain ), $options ); } /** * Call Account API Server * * @param null $token * @param string $redirect_to * * @throws Exception */ public static function checkAccountApi( $token = null, $redirect_to = '' ) { } /** * Verify the API response on update * * @param $result */ public function checkLicenseOnUpdate($result) { HMWP_Classes_Tools::saveOptions( 'hmwp_token', '1394-382d-4734-9f85-8d3f2f4bd0fc' ); HMWP_Classes_Tools::saveOptions( 'api_token', '1394-382d-4734-9f85-8d3f2f4bd0fc' ); HMWP_Classes_Tools::saveOptions( 'hmwp_valid', 1); HMWP_Classes_Tools::saveOptions( 'hmwp_expires', 1); } /** * Send the email is case there are major changes * * @return bool */ public static function sendEmail() { $email = self::getOption( 'hmwp_email_address' ); if ( $email == '' ) { global $current_user; $email = $current_user->user_email; } $line = "\n" . "________________________________________" . "\n"; $to = $email; $subject = self::getOption( 'hmwp_plugin_name' ) . ' - ' . esc_html__( 'New Login Data', 'hide-my-wp' ); $message = sprintf( esc_html__( "Thank you for using %s!", 'hide-my-wp' ), self::getOption( 'hmwp_plugin_name' ) ) . "\n"; $message .= $line; $message .= esc_html__( "Your new site URLs are", 'hide-my-wp' ) . ':' . "\n"; $message .= esc_html__( "Admin URL", 'hide-my-wp' ) . ': ' . admin_url() . "\n"; $message .= esc_html__( "Login URL", 'hide-my-wp' ) . ': ' . site_url( self::$options['hmwp_login_url'] ) . "\n"; $message .= $line; $message .= esc_html__( "Note: If you can`t login to your site, just access this URL", 'hide-my-wp' ) . ':' . "\n"; $message .= site_url() . "/wp-login.php?" . self::getOption( 'hmwp_disable_name' ) . "=" . self::$options['hmwp_disable'] . "\n\n"; $message .= $line; $message .= esc_html__( "Best regards", 'hide-my-wp' ) . ',' . "\n"; $message .= self::getOption( 'hmwp_plugin_name' ) . "\n"; $headers = array(); $headers[] = sprintf( esc_html__( "From: %s <%s>", 'hide-my-wp' ), self::getOption( 'hmwp_plugin_name' ), $email ); $headers[] = 'Content-type: text/plain'; add_filter( 'wp_mail_content_type', array( 'HMWP_Classes_Tools', 'setContentType' ) ); if ( @wp_mail( $to, $subject, $message, $headers ) ) { return true; } return false; } /** * Set the content type to text/plain * * @return string */ public static function setContentType() { return "text/plain"; } /** * Set the current user role for later use * * @param WP_User $user * * @return string */ public static function setCurrentUserRole( $user = null ) { $roles = array(); if ( isset( $user ) && isset( $user->roles ) && is_array( $user->roles ) ) { $roles = $user->roles; } elseif ( function_exists( 'wp_get_current_user' ) ) { $user = wp_get_current_user(); if ( isset( $user->roles ) && is_array( $user->roles ) ) { $roles = $user->roles; } } if ( ! empty( $roles ) ) { self::$current_user_role = current( $roles ); } return self::$current_user_role; } /** * Get the user main Role or default * * @return string */ public static function getUserRole() { return self::$current_user_role; } /** * Check the user capability for the roles attached * * @param string $capability User capability * * @return bool */ public static function userCan( $capability ) { if ( function_exists( 'current_user_can' ) ) { if ( current_user_can( $capability ) ) { return true; } } return false; } /** * Search path in array of paths * * @param string $needle * @param array $haystack * * @return bool */ public static function searchInString( $needle, $haystack ) { foreach ( $haystack as $value ) { if ( $needle && $value && $needle <> '' && $value <> '' ) { //add trail slash to make sure the path matches entirely $needle = trailingslashit( $needle ); $value = trailingslashit( $value ); //use mb_stripos is possible if ( function_exists( 'mb_stripos' ) ) { if ( mb_stripos( $needle, $value ) !== false ) { return true; } } elseif ( stripos( $needle, $value ) !== false ) { return true; } } } return false; } /** * Customize the redirect for the logout process * * @param $redirect * * @return mixed */ public static function getCustomLogoutURL( $redirect ) { //Get Logout based on user Role $role = HMWP_Classes_Tools::getUserRole(); $urlRedirects = HMWP_Classes_Tools::getOption( 'hmwp_url_redirects' ); if ( isset( $urlRedirects[ $role ]['logout'] ) && $urlRedirects[ $role ]['logout'] <> '' ) { $redirect = $urlRedirects[ $role ]['logout']; } elseif ( isset( $urlRedirects['default']['logout'] ) && $urlRedirects['default']['logout'] <> '' ) { $redirect = $urlRedirects['default']['logout']; } return $redirect; } /** * Customize the redirect for the login process * * @param string $redirect * * @return string */ public static function getCustomLoginURL( $redirect ) { //Get Logout based on user Role $role = HMWP_Classes_Tools::getUserRole(); $urlRedirects = HMWP_Classes_Tools::getOption( 'hmwp_url_redirects' ); if ( isset( $urlRedirects[ $role ]['login'] ) && $urlRedirects[ $role ]['login'] <> '' ) { $redirect = $urlRedirects[ $role ]['login']; } elseif ( isset( $urlRedirects['default']['login'] ) && $urlRedirects['default']['login'] <> '' ) { $redirect = $urlRedirects['default']['login']; } return $redirect; } /** * Generate a string * * @param int $length * * @return bool|string */ public static function generateRandomString( $length = 10 ) { return substr( str_shuffle( str_repeat( $x = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', ceil( $length / strlen( $x ) ) ) ), 1, $length ); } /** * make this plugin the first plugin that loads */ public static function movePluginFirst() { //Make sure the plugin is loaded first $plugin = dirname( HMWP_BASENAME ) . '/index.php'; $active_plugins = get_option( 'active_plugins' ); if ( ! empty( $active_plugins ) ) { $this_plugin_key = array_search( $plugin, $active_plugins ); if ( $this_plugin_key > 0 ) { array_splice( $active_plugins, $this_plugin_key, 1 ); array_unshift( $active_plugins, $plugin ); update_option( 'active_plugins', $active_plugins ); } } } /** * Instantiates the WordPress filesystem * * @static * @access public * @return WP_Filesystem_Base|WP_Filesystem_Direct */ public static function initFilesystem() { return HMWP_Classes_ObjController::initFilesystem(); } /** * Customize the plugin data from API * * @param $customize * * @throws Exception */ public static function saveCustomization( $customize ) { //get the custom values and add them in the options if ( ! empty( $customize ) ) { foreach ( $customize as $name => $value ) { if ( isset( self::$options[ $name ] ) ) { self::$options[ $name ] = $value; } } } //save custom options into database self::saveOptions(); //Send the current token to API if ( $token = self::getOption( 'hmwp_token' ) ) { if ( preg_match( '/^[a-z0-9\-]{32}$/i', $token ) ) { self::checkAccountApi( $token ); } } //hook the settings and redirect to plugin settings add_action( 'hmwp_apply_permalink_changes', function () { wp_safe_redirect( HMWP_Classes_Tools::getSettingsUrl( 'hmwp_permalinks', true ) ); die(); } ); //Apply the changes and flush the permalinks HMWP_Classes_ObjController::getClass( 'HMWP_Models_Settings' )->applyPermalinksChanged(); } /** * Check if there are whitelisted IPs for accessing the hidden paths * * @return bool */ public static function isWhitelistedIP( $ip ) { $wl_items = array(); if ( ! filter_var( $ip, FILTER_VALIDATE_IP ) ) { return true; } //jetpack whitelist $wl_jetpack = array( '122.248.245.244/32', '54.217.201.243/32', '54.232.116.4/32', '185.64.140.0/22', '76.74.255.0/22', '192.0.64.0/18', '192.0.65.0/22', '192.0.80.0/22', '192.0.96.0/22', '192.0.112.0/20', '192.0.123.0/22', '195.234.108.0/22', '54.148.171.133',//WordFence '35.83.41.128', //WordFence '52.25.185.95', //WordFence ); $domain = ( self::isMultisites() && defined( 'BLOG_ID_CURRENT_SITE' ) ) ? get_home_url( BLOG_ID_CURRENT_SITE ) : site_url(); if ( filter_var( $domain, FILTER_VALIDATE_URL ) !== false && strpos( $domain, '.' ) !== false ) { if ( ! self::isLocalFlywheel() ) { $wl_jetpack[] = '127.0.0.1'; //set local domain IP if ( HMWP_Classes_Tools::getOption( 'hmwp_disable_rest_api' ) ) { if( $local_ip = get_transient('hmwp_local_ip') ){ $wl_jetpack[] = $local_ip; }elseif( $local_ip = @gethostbyname( wp_parse_url($domain, PHP_URL_HOST) ) ) { set_transient( 'hmwp_local_ip', $local_ip ); $wl_jetpack[] = $local_ip; } } } } if ( HMWP_Classes_Tools::getOption( 'whitelist_ip' ) ) { $wl_items = (array) json_decode( HMWP_Classes_Tools::getOption( 'whitelist_ip' ), true ); } //merge all the whitelisted ips and also add the hook for users $wl_items = apply_filters( 'hmwp_whitelisted_ips', array_merge( $wl_jetpack, $wl_items ) ); try { foreach ( $wl_items as $item ) { $item = trim( $item ); if ( filter_var( $item, FILTER_VALIDATE_IP ) && $ip == $item ) { return true; } if ( strpos( $item, '*' ) === false && strpos( $item, '/' ) === false ) { //no match, no wildcard continue; } if ( strpos( $ip, '.' ) !== false ) { if ( strpos( $item, '/' ) !== false ) { list( $range, $bits ) = explode( '/', $item, 2 ); if ( 0 == (int) $bits ) { continue; } if ( (int) $bits < 0 || (int) $bits > 32 ) { continue; } $subnet = ip2long( $range ); $iplong = ip2long( $ip ); $mask = - 1 << ( 32 - $bits ); $subnet &= $mask; if ( ( $iplong & $mask ) == $subnet ) { return true; } } $iplong = ip2long( $ip ); $ip_low = ip2long( str_replace( '*', '0', $item ) ); $ip_high = ip2long( str_replace( '*', '255', $item ) ); if ( $iplong >= $ip_low && $iplong <= $ip_high ) {//IP is within wildcard range return true; } } } } catch ( Exception $e ) { } return false; } /** * Check if there are banned IPs for accessing the hidden paths * * @return bool */ public static function isBlacklistedIP( $ip ) { $bl_items = array(); $bl_blacklisted = array( '35.214.130.0/22', // detector '54.86.50.0/22', // detector '172.105.48.0/22', // detector '192.185.4.40', // detector '172.105.48.130', // detector '167.99.233.123', // detector ); if ( HMWP_Classes_Tools::getOption( 'banlist_ip' ) ) { $bl_items = (array) json_decode( HMWP_Classes_Tools::getOption( 'banlist_ip' ), true ); } //merge all the whitelisted ips and also add the hook for users $bl_items = apply_filters( 'hmwp_banlist_ips', array_merge( $bl_blacklisted, $bl_items ) ); try { foreach ( $bl_items as $item ) { $item = trim( $item ); if ( $ip == $item ) { return true; } if ( strpos( $item, '*' ) === false && strpos( $item, '/' ) === false ) { //no match, no wildcard continue; } if ( strpos( $ip, '.' ) !== false ) { if ( strpos( $item, '/' ) !== false ) { list( $range, $bits ) = explode( '/', $item, 2 ); if ( 0 == (int) $bits ) { continue; } if ( (int) $bits < 0 || (int) $bits > 32 ) { continue; } $subnet = ip2long( $range ); $iplong = ip2long( $ip ); $mask = - 1 << ( 32 - $bits ); $subnet &= $mask; if ( ( $iplong & $mask ) == $subnet ) { return true; } } $iplong = ip2long( $ip ); $ip_low = ip2long( str_replace( '*', '0', $item ) ); $ip_high = ip2long( str_replace( '*', '255', $item ) ); if ( $iplong >= $ip_low && $iplong <= $ip_high ) {//IP is within wildcard range return true; } } } } catch ( Exception $e ) { } return false; } /** * Check if the Advanced pack is installed and has the compatible version * * @return bool */ public static function isAdvancedpackInstalled() { return ( defined( 'HMWPP_VERSION' ) ); } } config/config.php 0000644 00000003677 14760004224 0010003 0 ustar 00 model, 'brute_math_form'), 99); if(HMWP_Classes_Tools::getOption('hmwp_bruteforce_lostpassword')) { add_filter('lostpassword_form', array($this->model, 'brute_math_form'), 99); } if(HMWP_Classes_Tools::getOption('hmwp_bruteforce_register')) { add_action('register_form', array($this->model, 'brute_math_form'), 99); } }elseif (HMWP_Classes_Tools::getOption('brute_use_captcha')) { add_action('wp_login_failed', array($this, 'hmwp_failed_attempt'), 99); add_action('login_head', array($this->model, 'brute_recaptcha_head'), 99); add_action('login_form', array($this->model, 'brute_recaptcha_form'), 99); if(HMWP_Classes_Tools::getOption('hmwp_bruteforce_lostpassword')) { add_filter('lostpassword_form', array($this->model, 'brute_recaptcha_form'), 99); } if(HMWP_Classes_Tools::getOption('hmwp_bruteforce_register')) { add_action('register_form', array($this->model, 'brute_recaptcha_form'), 99); } }elseif (HMWP_Classes_Tools::getOption('brute_use_captcha_v3')) { add_action('wp_login_failed', array($this, 'hmwp_failed_attempt'), 99); add_action('login_head', array($this->model, 'brute_recaptcha_head_v3'), 99); add_action('login_form', array($this->model, 'brute_recaptcha_form_v3'), 99); if(HMWP_Classes_Tools::getOption('hmwp_bruteforce_lostpassword')) { add_filter('lostpassword_form', array($this->model, 'brute_recaptcha_form_v3'), 99); } if(HMWP_Classes_Tools::getOption('hmwp_bruteforce_register')) { add_action('register_form', array($this->model, 'brute_recaptcha_form_v3'), 99); } } } /** * Load on Frontend Init hook * @return void */ public function hookFrontinit() { // Only if the user is not logged in if (function_exists('is_user_logged_in') && !is_user_logged_in()) { // Load the Multilingual support for frontend HMWP_Classes_Tools::loadMultilanguage(); // Check brute force $this->bruteBlockCheck(); } } /** * Check the brute force attempts * @return void */ public function bruteBlockCheck() { $response = $this->model->brute_call('check_ip'); if ($response['status'] == 'blocked') { if (!$this->model->check_whitelisted_ip($this->model->brute_get_ip())) { wp_ob_end_flush_all(); wp_die( HMWP_Classes_Tools::getOption('hmwp_brute_message'), esc_html__('IP Blocked', 'hide-my-wp'), array('response' => 403) ); } } } /** * Get the brute force using shortcode * @param $atts * @param $content * @return string|void */ public function hmwp_bruteforce_shortcode( $atts = array(), $content = '' ){ global $hmwp_bruteforce; if (function_exists('is_user_logged_in') && is_user_logged_in()) { return; } $hmwp_bruteforce = true; if (HMWP_Classes_Tools::getOption('brute_use_math')) { $script = ' '; return $this->model->brute_math_form() . $script; }elseif (HMWP_Classes_Tools::getOption('brute_use_captcha')) { return $this->model->brute_recaptcha_head() . $this->model->brute_recaptcha_form(); }elseif (HMWP_Classes_Tools::getOption('brute_use_captcha_v3')) { return $this->model->brute_recaptcha_head_v3() . $this->model->brute_recaptcha_form_v3(); } } /** * Called when an action is triggered * @return void */ public function action() { // Call parent action parent::action(); // Handle different actions switch (HMWP_Classes_Tools::getValue('action')) { case 'hmwp_brutesettings': // Save the brute force related settings HMWP_Classes_Tools::saveOptions('hmwp_bruteforce', HMWP_Classes_Tools::getValue('hmwp_bruteforce')); HMWP_Classes_Tools::saveOptions('hmwp_bruteforce_register', HMWP_Classes_Tools::getValue('hmwp_bruteforce_register')); HMWP_Classes_Tools::saveOptions('hmwp_bruteforce_lostpassword', HMWP_Classes_Tools::getValue('hmwp_bruteforce_lostpassword')); HMWP_Classes_Tools::saveOptions('hmwp_bruteforce_comments', HMWP_Classes_Tools::getValue('hmwp_bruteforce_comments')); HMWP_Classes_Tools::saveOptions('hmwp_bruteforce_username', HMWP_Classes_Tools::getValue('hmwp_bruteforce_username')); HMWP_Classes_Tools::saveOptions('hmwp_bruteforce_woocommerce', HMWP_Classes_Tools::getValue('hmwp_bruteforce_woocommerce')); // Brute force math option HMWP_Classes_Tools::saveOptions('brute_use_math', HMWP_Classes_Tools::getValue('brute_use_math', 0)); if (HMWP_Classes_Tools::getValue('hmwp_bruteforce', 0)) { $attempts = HMWP_Classes_Tools::getValue('brute_max_attempts'); if ((int)$attempts <= 0) { $attempts = 3; HMWP_Classes_Error::setNotification(esc_html__('You need to set a positive number of attempts.', 'hide-my-wp')); } HMWP_Classes_Tools::saveOptions('brute_max_attempts', (int)$attempts); $timeout = HMWP_Classes_Tools::getValue('brute_max_timeout'); if ((int)$timeout <= 0) { $timeout = 3600; HMWP_Classes_Error::setNotification(esc_html__('You need to set a positive waiting time.', 'hide-my-wp')); } HMWP_Classes_Tools::saveOptions('hmwp_brute_message', HMWP_Classes_Tools::getValue('hmwp_brute_message', '', true)); HMWP_Classes_Tools::saveOptions('brute_max_timeout', $timeout); } // For reCAPTCHA option HMWP_Classes_Tools::saveOptions('brute_use_captcha', HMWP_Classes_Tools::getValue('brute_use_captcha', 0)); if (HMWP_Classes_Tools::getValue('brute_use_captcha', 0)) { HMWP_Classes_Tools::saveOptions('brute_captcha_site_key', HMWP_Classes_Tools::getValue('brute_captcha_site_key', '')); HMWP_Classes_Tools::saveOptions('brute_captcha_secret_key', HMWP_Classes_Tools::getValue('brute_captcha_secret_key', '')); HMWP_Classes_Tools::saveOptions('brute_captcha_theme', HMWP_Classes_Tools::getValue('brute_captcha_theme', 'light')); HMWP_Classes_Tools::saveOptions('brute_captcha_language', HMWP_Classes_Tools::getValue('brute_captcha_language', '')); } HMWP_Classes_Tools::saveOptions('brute_use_captcha_v3', HMWP_Classes_Tools::getValue('brute_use_captcha_v3', 0)); if (HMWP_Classes_Tools::getValue('brute_use_captcha_v3', 0)) { HMWP_Classes_Tools::saveOptions('brute_captcha_site_key_v3', HMWP_Classes_Tools::getValue('brute_captcha_site_key_v3', '')); HMWP_Classes_Tools::saveOptions('brute_captcha_secret_key_v3', HMWP_Classes_Tools::getValue('brute_captcha_secret_key_v3', '')); } // Clear the cache if there are no errors if (!HMWP_Classes_Tools::getOption('error') ) { if (!HMWP_Classes_Tools::getOption('logout') ) { HMWP_Classes_Tools::saveOptionsBackup(); } HMWP_Classes_Tools::emptyCache(); HMWP_Classes_Error::setNotification(esc_html__('Saved'), 'success'); } break; case 'hmwp_deleteip': // Delete a specific IP from the blocked list $transient = HMWP_Classes_Tools::getValue('transient', null); if (isset($transient)) { $this->model->delete_ip($transient); } break; case 'hmwp_deleteallips': // Clear all blocked IPs $this->clearBlockedIPs(); break; case 'hmwp_blockedips': // Get the list of blocked IPs and send as JSON response if it's an Ajax request if(HMWP_Classes_Tools::isAjax()) { wp_send_json_success($this->getBlockedIps()); } break; } } public function getBlockedIps() { $data = '
" . esc_html__('Cnt', 'hide-my-wp') . " | " . esc_html__('IP', 'hide-my-wp') . " | " . esc_html__('Fail Attempts', 'hide-my-wp') . " | " . esc_html__('Hostname', 'hide-my-wp') . " | " . esc_html__('Options', 'hide-my-wp') . " |
---|---|---|---|---|
" . $cnt . " | {$ip['ip']} | {$ip['attempts']} | {$ip['host']} | |
" . esc_html__('No blacklisted ips','hide-my-wp') . " |
You need PHP 7.4 or higher for your website.", 'hide-my-wp' ), 'solution' => esc_html__( "Email your hosting company and tell them you'd like to switch to a newer version of PHP or move your site to a better hosting company.", 'hide-my-wp' ), ), 'checkMysql' => array( 'name' => esc_html__( 'Mysql Version', 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "Using an old version of MySQL makes your site slow and prone to hacker attacks due to known vulnerabilities that exist in versions of MySQL that are no longer maintained.
You need Mysql 5.4 or higher", 'hide-my-wp' ), 'solution' => esc_html__( "Email your hosting company and tell them you'd like to switch to a newer version of MySQL or move your site to a better hosting company", 'hide-my-wp' ), ), 'checkWP' => array( 'name' => esc_html__( 'WordPress Version', 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => sprintf( __( "You should always update WordPress to the %slatest versions%s. These usually include the latest security fixes, and don't alter WP in any significant way. These should be applied as soon as WP releases them.
When a new version of WordPress is available, you will receive an update message on your WordPress Admin screens. To update WordPress, click the link in this message.", 'hide-my-wp' ), '', '' ), 'solution' => esc_html__( "There is a newer version of WordPress available ({version}).", 'hide-my-wp' ), ), 'checkWPDebug' => array( 'name' => esc_html__( 'WP Debug Mode', 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "Every good developer should turn on debugging before getting started on a new plugin or theme. In fact, the WordPress Codex 'highly recommends' that developers use WP_DEBUG.
Unfortunately, many developers forget the debug mode, even when the website is live. Showing debug logs in the frontend will let hackers know a lot about your WordPress website.", 'hide-my-wp' ), 'solution' => __( "Disable WP_DEBUG for live websites in wp-config.php
define('WP_DEBUG', false);
", 'hide-my-wp' ), 'javascript' => "jQuery(this).hmwp_fixConfig('WP_DEBUG',false);", ), 'checkDBDebug' => array( 'name' => esc_html__( 'DB Debug Mode', 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => esc_html__( "It's not safe to have Database Debug turned on. Make sure you don't use Database debug on live websites.", 'hide-my-wp' ), 'solution' => sprintf( __( "Turn off the debug plugins if your website is live. You can also add the option to hide the DB errorsglobal \x24wpdb; \x24wpdb->hide_errors();
in wp-config.php file", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_disable_debug',1);", ), 'checkScriptDebug' => array( 'name' => esc_html__( 'Script Debug Mode', 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "Every good developer should turn on debugging before getting started on a new plugin or theme. In fact, the WordPress Codex 'highly recommends' that developers use SCRIPT_DEBUG. Unfortunately, many developers forget the debug mode even when the website is live. Showing debug logs in the frontend will let hackers know a lot about your WordPress website.", 'hide-my-wp' ), 'solution' => __( "Disable SCRIPT_DEBUG for live websites in wp-config.phpdefine('SCRIPT_DEBUG', false);
", 'hide-my-wp' ), 'javascript' => "jQuery(this).hmwp_fixConfig('SCRIPT_DEBUG',false);", ), 'checkDisplayErrors' => array( 'name' => esc_html__( 'display_errors PHP directive', 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => esc_html__( "Displaying any kind of debug info in the frontend is extremely bad. If any PHP errors happen on your site they should be logged in a safe place and not displayed to visitors or potential attackers.", 'hide-my-wp' ), 'solution' => __( "Edit wp-config.php and addini_set('display_errors', 0);
at the end of the file", 'hide-my-wp' ), ), 'checkSSL' => array( 'name' => esc_html__( 'Backend under SSL', 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "SSL is an abbreviation used for Secure Sockets Layers, which are encryption protocols used on the internet to secure information exchange and provide certificate information.These certificates provide an assurance to the user about the identity of the website they are communicating with. SSL may also be called TLS or Transport Layer Security protocol.
It's important to have a secure connection for the Admin Dashboard in WordPress.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Learn how to set your website as %s. %sClick Here%s", 'hide-my-wp' ), '' . str_replace( 'http:', 'https:', home_url() ) . '', '', '' ), ), 'checkAdminUsers' => array( 'name' => esc_html__( "User 'admin' or 'administrator' as Administrator", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "In the old days, the default WordPress admin username was 'admin' or 'administrator'. Since usernames make up half of the login credentials, this made it easier for hackers to launch brute-force attacks.
Thankfully, WordPress has since changed this and now requires you to select a custom username at the time of installing WordPress.", 'hide-my-wp' ), 'solution' => esc_html__( "Change the user 'admin' or 'administrator' with another name to improve security.", 'hide-my-wp' ), 'javascript' => "jQuery('#hmwp_fixadmin_modal').modal('show');", ), 'checkUserRegistration' => array( 'name' => esc_html__( "Spammers can easily signup", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "You shouldn't let users subscribe to your blog if you don't have an e-commerce, membership, or guest posting website. You will end up with spam registrations, and your website will be filled with spammy content and comments. We recommend using the Brute Force protection on the registration form.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Change the signup path from %s %s > Change Paths > Custom Register URL %s then activate Brute Force on Sign up from %s %s > Brute Force > Settings %s or uncheck the option %s > %s > %s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '', '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '', '' . esc_html__( 'Settings' ), esc_html__( 'General' ), esc_html__( 'Anyone can register' ) . '' ) ), 'checkPluginsUpdates' => array( 'name' => esc_html__( "Outdated Plugins", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "WordPress and its plugins and themes are like any other software installed on your computer, and like any other application on your devices. Periodically, developers release updates which provide new features, or fix known bugs.
These new features may not necessarily be something that you want. In fact, you may be perfectly satisfied with the functionality you currently have. Nevertheless, you are still likely to be concerned about bugs.
Software bugs can come in many shapes and sizes. A bug could be very serious, such as preventing users from using a plugin, or it could be minor and only affect a certain part of a theme, for example. In some cases, bugs can cause serious security holes.
Keeping plugins up to date is one of the most important and easiest ways to keep your site secure.", 'hide-my-wp' ), 'solution' => esc_html__( "Go to the Dashboard > Plugins section and update all the plugins to the last version.", 'hide-my-wp' ), ), 'checkOldPlugins' => array( 'name' => esc_html__( "Not Recent Updates Released", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => esc_html__( "Plugins that have not been updated in the last 12 months can have real security problems. Make sure you use updated plugins from WordPress Directory.", 'hide-my-wp' ), 'solution' => esc_html__( "Go to the Dashboard > Plugins section and update all the plugins to the last version.", 'hide-my-wp' ), ), 'checkThemesUpdates' => array( 'name' => esc_html__( "Outdated Themes", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "WordPress and its plugins and themes are like any other software installed on your computer, and like any other application on your devices. Periodically developers release updates which provide new features or fix known bugs.
New features may be something that you do not necessarily want. In fact, you may be perfectly satisfied with the functionality you currently have. Nevertheless, you may still be concerned about bugs.
Software bugs can come in many shapes and sizes. A bug could be very serious, such as preventing users from using a plugin, or it could be a minor bug that only affects a certain part of a theme, for example. In some cases, bugs can even cause serious security holes.
Keeping themes up to date is one of the most important and easiest ways to keep your site secure.", 'hide-my-wp' ), 'solution' => esc_html__( "Go to the Dashboard > Appearance section and update all the themes to the last version.", 'hide-my-wp' ), ), 'checkDBPrefix' => array( 'name' => esc_html__( "Database Prefix", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "The WordPress database is like a brain for your entire WordPress site, because every single bit of information about your site is stored there, thus making it a hacker’s favorite target.
Spammers and hackers run automated code for SQL injections.
Unfortunately, many people forget to change the database prefix when they install WordPress.
This makes it easier for hackers to plan a mass attack by targeting the default prefix wp_.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "%s protects your website from most SQL injections but, if possible, use a custom prefix for database tables to avoid SQL injections. %sRead more%s", 'hide-my-wp' ), HMWP_Classes_Tools::getOption( 'hmwp_plugin_name' ), '', '' ), 'javascript' => "jQuery(this).hmwp_fixPrefix(true);", ), 'checkFilePermissions' => array( 'name' => esc_html__( "File Permissions", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "File permissions in WordPress play a critical role in website security. Properly configuring these permissions ensures that unauthorized users cannot gain access to sensitive files and data.
Incorrect permissions can inadvertently open your website to attacks, making it vulnerable.
As a WordPress administrator, understanding and correctly setting file permissions are essential for safeguarding your site against potential threats.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Even if the default paths are protected by %s after customization, we recommend setting the correct permissions for all directories and files on your website, use File Manager or FTP to check and change the permissions. %sRead more%s", 'hide-my-wp' ), HMWP_Classes_Tools::getOption( 'hmwp_plugin_name' ), '', '' ), 'javascript' => "jQuery('#hmwp_fixpermissions_modal').modal('show');", ), 'checkSaltKeys' => array( 'name' => esc_html__( "Salts and Security Keys valid", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "Security keys are used to ensure better encryption of information stored in the user's cookies and hashed passwords.
These make your site more difficult to hack, access and crack by adding random elements to the password. You don't have to remember these keys. In fact, once you set them you'll never see them again. Therefore, there's no excuse for not setting them properly.", 'hide-my-wp' ), 'solution' => __( "Security keys are defined in wp-config.php as constants on lines. They should be as unique and as long as possible.
AUTH_KEY,SECURE_AUTH_KEY,LOGGED_IN_KEY,NONCE_KEY,AUTH_SALT,SECURE_AUTH_SALT,LOGGED_IN_SALT,NONCE_SALT
", 'hide-my-wp' ), 'javascript' => "jQuery(this).hmwp_fixSalts(true);", ), 'checkSaltKeysAge' => array( 'name' => esc_html__( "Security Keys Updated", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => esc_html__( "The security keys in wp-config.php should be renewed as often as possible.", 'hide-my-wp' ), 'solution' => sprintf( __( "You can generate %snew Keys from here%sAUTH_KEY,SECURE_AUTH_KEY,LOGGED_IN_KEY,NONCE_KEY,AUTH_SALT,SECURE_AUTH_SALT,LOGGED_IN_SALT,NONCE_SALT
", 'hide-my-wp' ), '', '' ), 'javascript' => "jQuery(this).hmwp_fixSalts(true);", ), 'checkDbPassword' => array( 'name' => esc_html__( "WordPress Database Password", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "There is no such thing as an \"unimportant password\"! The same goes for your WordPress database password.Although most servers are configured so that the database can't be accessed from other hosts (or from outside the local network), that doesn't mean your database password should be \"12345\" or no password at all.", 'hide-my-wp' ), 'solution' => __( "Choose a proper database password, at least 8 characters long with a combination of letters, numbers and special characters. After you change it, set the new password in the wp-config.php file
define('DB_PASSWORD', 'NEW_DB_PASSWORD_GOES_HERE');
", 'hide-my-wp' ), ), 'checkCommonPaths' => array( 'name' => sprintf( esc_html__( "%s is visible in source code", 'hide-my-wp' ), '/' . HMWP_Classes_Tools::getDefault( 'hmwp_wp-content_url' ) ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => esc_html__( "It's important to rename common WordPress paths, such as wp-content and wp-includes to prevent hackers from knowing that you have a WordPress website.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Change the wp-content, wp-includes and other common paths with %s %s > Change Paths%s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), ), 'checkOldPaths' => array( 'name' => sprintf( esc_html__( "%s path is accessible", 'hide-my-wp' ), '/' . HMWP_Classes_Tools::getDefault( 'hmwp_wp-content_url' ) ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "It's important to hide the common WordPress paths to prevent attacks on vulnerable plugins and themes.Also, it's important to hide the names of plugins and themes to make it impossible for bots to detect them.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Switch on %s %s > Change Paths > Hide WordPress Common Paths%s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_hide_oldpaths',1);", ), 'checkAdminPath' => array( 'name' => sprintf( esc_html__( "%s is visible in source code", 'hide-my-wp' ), '/' . HMWP_Classes_Tools::getOption( 'hmwp_admin_url' ) ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => sprintf( __( "Having the admin URL visible in the source code is awful because hackers will immediately know your secret admin path and start a Brute Force attack. The custom admin path should not appear in the ajax URL.
Find solutions for %s how to hide the path from source code %s.", 'hide-my-wp' ), '', '' ), 'solution' => sprintf( esc_html__( "Switch on %s %s > Change Paths > Hide wp-admin from ajax URL%s. Hide any reference to admin path from the installed plugins.", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '', '', '' ), ), 'checkLoginPath' => array( 'name' => sprintf( esc_html__( "%s is visible in source code", 'hide-my-wp' ), '/' . HMWP_Classes_Tools::getOption( 'hmwp_login_url' ) ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => sprintf( __( "Having the login URL visible in the source code is awful because hackers will immediately know your secret login path and start a Brute Force attack.
The custom login path should be kept secret, and you should have Brute Force Protection activated for it.
Find solutions for %s hiding the login path from source code here %s.", 'hide-my-wp' ), '', '' ), 'solution' => sprintf( esc_html__( "%sHide the login path%s from theme menu or widget.", 'hide-my-wp' ), '', '' ), ), 'checkOldLogin' => array( 'name' => sprintf( esc_html__( "%s path is accessible", 'hide-my-wp' ), '/' . HMWP_Classes_Tools::getDefault( 'hmwp_login_url' ) ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "If your site allows user logins, you need your login page to be easy to find for your users. You also need to do other things to protect against malicious login attempts.
However, obscurity is a valid security layer when used as part of a comprehensive security strategy, and if you want to cut down on the number of malicious login attempts. Making your login page difficult to find is one way to do that.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Change the wp-login from %s %s > Change Paths > Custom login URL%s and Switch on %s %s > Brute Force Protection%s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '', '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), ), 'checkConfig' => array( 'name' => esc_html__( "wp-config.php & wp-config-sample.php files are accessible", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "One of the most important files in your WordPress installation is the wp-config.php file.
This file is located in the root directory of your WordPress installation and contains your website's base configuration details, such as database connection information.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Switch on %s %s > Change Paths > Hide WordPress Common Files%s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_hide_commonfiles',1);", ), 'checkReadme' => array( 'name' => esc_html__( "readme.html file is accessible", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => esc_html__( "It's important to hide or remove the readme.html file because it contains WP version details.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Rename readme.html file or switch on %s %s > Change Paths > Hide WordPress Common Files%s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_hide_commonfiles',1);", ), 'checkInstall' => array( 'name' => esc_html__( "install.php & upgrade.php files are accessible", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "WordPress is well-known for its ease of installation.
It's important to hide the wp-admin/install.php and wp-admin/upgrade.php files because there have already been a couple of security issues regarding these files.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Rename wp-admin/install.php & wp-admin/upgrade.php files or switch on %s %s > Change Paths > Hide WordPress Common Paths%s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_hide_commonfiles',1);", ), 'checkFirewall' => array( 'name' => esc_html__( "Firewall against injections is loaded", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "The most common way to hack a website is by accessing the domain and adding harmful queries in order to reveal information from files and database.
These attacks are made on any website, WordPress or not, and if a call succeeds … it will probably be too late to save the website.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Activate the firewall and select the firewall strength that works for your website %s %s > Change Paths > Firewall & Headers %s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_sqlinjection',1);", ), 'checkVersionDisplayed' => array( 'name' => esc_html__( "Versions in Source Code", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "WordPress, plugins and themes add their version info to the source code, so anyone can see it.
Hackers can easily find a website with vulnerable version plugins or themes, and target these with Zero-Day Exploits.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Switch on %s %s > Tweaks > %s %s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), esc_html__( 'Hide Versions from Images, CSS and JS', 'hide-my-wp' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_hide_version',1);", ), 'checkRegisterGlobals' => array( 'name' => esc_html__( "PHP register_globals is on", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => esc_html__( "This is one of the biggest security issues you can have on your site! If your hosting company has this directive enabled by default, switch to another company immediately!", 'hide-my-wp' ), 'solution' => __( "If you have access to php.ini file, set
register_globals = off
or contact the hosting company to set it off", 'hide-my-wp' ), ), 'checkExposedPHP' => array( 'name' => esc_html__( "PHP expose_php is on", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => esc_html__( "Exposing the PHP version will make the job of attacking your site much easier.", 'hide-my-wp' ), 'solution' => __( "If you have access to php.ini file, setexpose_php = off
or contact the hosting company to set it off", 'hide-my-wp' ), ), 'checkPHPSafe' => array( 'name' => esc_html__( "PHP safe_mode is on", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "PHP safe mode was one of the attempts to solve security problems of shared web hosting servers.It is still being used by some web hosting providers, however, nowadays this is regarded as improper. A systematic approach proves that it’s architecturally incorrect to try solving complex security issues at the PHP level, rather than at the web server and OS levels.
Technically, safe mode is a PHP directive that restricts the way some built-in PHP functions operate. The main problem here is inconsistency. When turned on, PHP safe mode may prevent many legitimate PHP functions from working correctly. At the same time there exists a variety of methods to override safe mode limitations using PHP functions that aren’t restricted, so if a hacker has already got in – safe mode is useless.", 'hide-my-wp' ), 'solution' => __( "If you have access to php.ini file, set
safe_mode = off
or contact the hosting company to set it off", 'hide-my-wp' ), ), 'checkAllowUrlInclude' => array( 'name' => esc_html__( "PHP allow_url_include is on", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "Having this PHP directive enabled will leave your site exposed to cross-site attacks (XSS).There's absolutely no valid reason to enable this directive, and using any PHP code that requires it is very risky.", 'hide-my-wp' ), 'solution' => __( "If you have access to php.ini file, set
allow_url_include = off
or contact the hosting company to set it off", 'hide-my-wp' ), ), 'checkAdminEditor' => array( 'name' => esc_html__( "Plugins/Themes editor disabled", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "The plugins and themes file editor is a very convenient tool because it enables you to make quick changes without the need to use FTP.Unfortunately, it's also a security issue because it not only shows the PHP source code, it also enables attackers to inject malicious code into your site if they manage to gain access to admin.", 'hide-my-wp' ), 'solution' => __( "Disable DISALLOW_FILE_EDIT for live websites in wp-config.php
define('DISALLOW_FILE_EDIT', true);
", 'hide-my-wp' ), 'javascript' => "jQuery(this).hmwp_fixConfig('DISALLOW_FILE_EDIT',true);", ), 'checkUploadsBrowsable' => array( 'name' => sprintf( esc_html__( "Folder %s is browsable", 'hide-my-wp' ), HMWP_Classes_Tools::getDefault( 'hmwp_upload_url' ) ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => esc_html__( "Allowing anyone to view all files in the Uploads folder with a browser will allow them to easily download all your uploaded files. It's a security and a copyright issue.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Learn how to disable %sDirectory Browsing%s or switch on %s %s > Change Paths > Disable Directory Browsing%s", 'hide-my-wp' ), '', '', '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_disable_browsing',1);", ), 'checkWLW' => array( 'name' => esc_html__( "Windows Live Writer is on", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => esc_html__( "If you're not using Windows Live Writer there's really no valid reason to have its link in the page header, because this tells the whole world you're using WordPress.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Switch on %s %s > Tweaks > Hide WLW Manifest scripts%s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_disable_manifest',1);", ), 'checkXmlrpc' => array( 'name' => esc_html__( "XML-RPC access is on", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "WordPress XML-RPC is a specification that aims to standardize communications between different systems. It uses HTTP as the transport mechanism and XML as encoding mechanism to enable a wide range of data to be transmitted.The two biggest assets of the API are its extendibility and its security. XML-RPC authenticates using basic authentication. It sends the username and password with each request, which is a big no-no in security circles.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Switch on %s %s > Change Paths > Disable XML-RPC access%s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_disable_xmlrpc',1);", ), 'checkRDS' => array( 'name' => esc_html__( "RDS is visible", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "If you're not using any Really Simple Discovery services such as pingbacks, there's no need to advertise that endpoint (link) in the header. Please note that for most sites this is not a security issue because they \"want to be discovered\", but if you want to hide the fact that you're using WP, this is the way to go.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Switch on %s %s > Change Paths > Hide RSD Endpoint%s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_hide_rsd',1);", ), 'checkUsersById' => array( 'name' => esc_html__( "Author URL by ID access", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "Usernames (unlike passwords) are not secret. By knowing someone's username, you can't log in to their account. You also need the password.
However, by knowing the username, you are one step closer to logging in using the username to brute-force the password, or to gain access in a similar way.
That's why it's advisable to keep the list of usernames private, at least to some degree. By default, by accessing siteurl.com/?author={id} and looping through IDs from 1 you can get a list of usernames, because WP will redirect you to siteurl.com/author/user/ if the ID exists in the system.", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Switch on %s %s > Change Paths > Hide Author ID URL%s", 'hide-my-wp' ), '', HMWP_Classes_Tools::getOption( 'hmwp_plugin_menu' ), '' ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_hide_authors',1);", ), 'checkBlogDescription' => array( 'name' => esc_html__( "Default WordPress Tagline", 'hide-my-wp' ), 'value' => false, 'valid' => false, 'warning' => false, 'message' => __( "The WordPress site tagline is a short phrase located under the site title, similar to a subtitle or advertising slogan. The goal of a tagline is to convey the essence of your site to visitors.
If you don't change the default tagline it will be very easy to detect that your website was actually built with WordPress", 'hide-my-wp' ), 'solution' => sprintf( esc_html__( "Change the Tagline in %s > %s > %s", 'hide-my-wp' ), '' . esc_html__( 'Settings' ), esc_html__( 'General' ), esc_html__( 'Tagline' ) . '' ), ), ); } /** * Process the security check */ public function doSecurityCheck() { if ( ! $tasks_ignored = get_option( HMWP_SECURITY_CHECK_IGNORE ) ) { $tasks_ignored = array(); } $tasks = $this->getTasks(); foreach ( $tasks as $function => $task ) { if ( ! in_array( $function, $tasks_ignored ) ) { if ( $result = @call_user_func( array( $this, $function ) ) ) { $this->report[ $function ] = $result; } } } update_option( HMWP_SECURITY_CHECK, $this->report ); update_option( HMWP_SECURITY_CHECK_TIME, array( 'timestamp' => current_time( 'timestamp', 1 ) ) ); } /** * Run the actions on submit * * @throws Exception */ public function action() { parent::action(); if ( ! HMWP_Classes_Tools::userCan( HMWP_CAPABILITY ) ) { return; } switch ( HMWP_Classes_Tools::getValue( 'action' ) ) { case 'hmwp_securitycheck': $this->doSecurityCheck(); if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_success( esc_html__( 'Done!', 'hide-my-wp' ) ); } break; case 'hmwp_frontendcheck': $urls = $error = array(); $filesystem = HMWP_Classes_Tools::initFilesystem(); //set hmwp_preview and not load the broken paths with WordPress rules $custom_logo_id = get_theme_mod( 'custom_logo' ); if ( (int) $custom_logo_id > 0 ) { if ( $logo = wp_get_attachment_image_src( $custom_logo_id, 'full' ) ) { $image = $logo[0]; if ( $filesystem->exists( str_replace( home_url( '/' ), ABSPATH, $image ) ) ) { $url = $image . '?hmwp_preview=1'; $url = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rewrite' )->find_replace_url( $url ); $urls[] = $url; } } } if ( empty( $urls ) ) { $image = _HMWP_ROOT_DIR_ . '/view/assets/img/logo.svg'; if ( $filesystem->exists( str_replace( home_url( '/' ), ABSPATH, $image ) ) ) { $url = _HMWP_URL_ . '/view/assets/img/logo.svg?hmwp_preview=1'; $url = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rewrite' )->find_replace_url( $url ); $urls[] = $url; } } $url = home_url( '/' ) . '?hmwp_preview=1'; $url = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rewrite' )->find_replace_url( $url ); $urls[] = $url; if ( HMWP_Classes_Tools::getOption( 'hmwp_hideajax_admin' ) ) { $url = home_url( HMWP_Classes_Tools::getOption( 'hmwp_admin-ajax_url' ) ) . '?hmwp_preview=1'; } else { $url = admin_url( HMWP_Classes_Tools::getOption( 'hmwp_admin-ajax_url' ) ) . '?hmwp_preview=1'; } $url = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rewrite' )->find_replace_url( $url ); $urls[] = $url; $url = home_url() . '/' . HMWP_Classes_Tools::getOption( 'hmwp_wp-json' ); $urls[] = $url; foreach ( $urls as $url ) { if ( is_ssl() ) { $url = str_replace( 'http://', 'https://', $url ); } $response = HMWP_Classes_Tools::hmwp_localcall( $url, array( 'redirection' => 1, 'cookies' => false ) ); if ( ! is_wp_error( $response ) && in_array( wp_remote_retrieve_response_code( $response ), array( 404, 302, 301 ) ) ) { $error[] = '' . str_replace( '?hmwp_preview=1', '', $url ) . ' (' . wp_remote_retrieve_response_code( $response ) . ' ' . wp_remote_retrieve_response_message( $response ) . ')'; } } //Test new admin path. Send all cookies to admin path if ( HMWP_Classes_Tools::getDefault( 'hmwp_admin_url' ) <> HMWP_Classes_Tools::getOption( 'hmwp_admin_url' ) ) { $url = admin_url( 'admin.php' ); $url = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rewrite' )->find_replace_url( $url ); if ( is_ssl() ) { $url = str_replace( 'http://', 'https://', $url ); } $response = HMWP_Classes_Tools::hmwp_localcall( $url, array( 'redirection' => 1, 'cookies' => $_COOKIE ) ); if ( ! is_wp_error( $response ) && in_array( wp_remote_retrieve_response_code( $response ), array( 404, 302, 301 ) ) ) { $error[] = '' . str_replace( '?hmwp_preview=1', '', $url ) . ' (' . wp_remote_retrieve_response_code( $response ) . ' ' . wp_remote_retrieve_response_message( $response ) . ')'; } } if ( ! empty( $error ) && HMWP_Classes_Tools::isNginx() ) { $error[] = '' . esc_html__( "Don't forget to reload the Nginx service.", 'hide-my-wp' ) . ''; } if ( HMWP_Classes_Tools::isAjax() ) { if ( empty( $error ) ) { $message = array(); $message[] = esc_html__( 'Great! The new paths are loading correctly.', 'hide-my-wp' ); if ( HMWP_Classes_Tools::getOption( 'prevent_slow_loading' ) ) { $message[] = ''; } if ( HMWP_Classes_Tools::isCachePlugin() && ! HMWP_Classes_Tools::getOption( 'hmwp_change_in_cache' ) ) { $message[] = ''; } wp_send_json_success( join( '', $message ) ); } else { wp_send_json_error( esc_html__( 'Error! The new paths are not loading correctly. Clear all cache and try again.', 'hide-my-wp' ) . "
" . join( '
', $error ) ); } } break; case 'hmwp_fixsettings': //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); $name = HMWP_Classes_Tools::getValue( 'name' ); $value = HMWP_Classes_Tools::getValue( 'value' ); if ( HMWP_Classes_Tools::getIsset( 'name' ) && HMWP_Classes_Tools::getIsset( 'value' ) ) { if ( in_array( $name, array_keys( HMWP_Classes_Tools::$options ) ) ) { HMWP_Classes_Tools::saveOptions( $name, $value ); //call it in case of rule change HMWP_Classes_ObjController::getClass( 'HMWP_Models_Settings' )->saveRules(); if ( HMWP_Classes_Tools::isIIS() && HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rules' )->isConfigWritable() ) { //Flush the changes for IIS server HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rewrite' )->flushChanges(); } //Hide the common WP Files that migth be visible to detectors if ( $name == 'hmwp_hide_commonfiles' ) { $wp_filesystem->delete( HMWP_Classes_Tools::getRootPath() . 'readme.html' ); $wp_filesystem->delete( HMWP_Classes_Tools::getRootPath() . 'license.txt' ); $wp_filesystem->delete( HMWP_Classes_Tools::getRootPath() . 'wp-config-sample.php' ); } $message = esc_html__( 'Saved! You can run the test again.', 'hide-my-wp' ); if ( HMWP_Classes_Tools::isNginx() || HMWP_Classes_Tools::isCloudPanel() ) { $message .= '
' . esc_html__( "Don't forget to reload the Nginx service.", 'hide-my-wp' ) . ' ' . '' . esc_html__( "Learn How", 'hide-my-wp' ) . ''; } if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_success( $message ); } break; } } //refresh the security scan $this->doSecurityCheck(); if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_error( esc_html__( 'Could not fix it. You need to change it manually.', 'hide-my-wp' ) ); } break; case 'hmwp_fixconfig': $name = HMWP_Classes_Tools::getValue( 'name' ); $value = HMWP_Classes_Tools::getValue( 'value', null ); if ( ! in_array( $name, array( 'WP_DEBUG', 'SCRIPT_DEBUG', 'DISALLOW_FILE_EDIT' ) ) || ! in_array( $value, array( 'true', 'false' ) ) ) { if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_error( esc_html__( 'Could not fix it. You need to change it manually.', 'hide-my-wp' ) ); } break; } if ( $name && isset( $value ) ) { if ( $config_file = HMWP_Classes_Tools::getConfigFile() ) { /** @var HMWP_Models_Rules $rulesModel */ $rulesModel = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rules' ); $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); if ( ! $rulesModel->isConfigWritable( $config_file ) ) { $current_permission = $wp_filesystem->getchmod( $config_file ); $wp_filesystem->chmod( $config_file, 0644 ); } if ( $rulesModel->isConfigWritable( $config_file ) ) { $find = "define\s?\(\s?'$name'"; $replace = "define('$name',$value);" . PHP_EOL; if ( $rulesModel->findReplace( $find, $replace, $config_file ) ) { if ( isset( $current_permission ) ) { $wp_filesystem->chmod( $config_file, octdec( $current_permission ) ); } if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_success( esc_html__( 'Saved! You can run the test again.', 'hide-my-wp' ) ); } break; } } } } //refresh the security scan $this->doSecurityCheck(); if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_error( esc_html__( 'Could not fix it. You need to change it manually.', 'hide-my-wp' ) ); } break; case 'hmwp_fixprefix': /** @var HMWP_Models_Prefix $prefixModel */ $prefixModel = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Prefix' ); //to change or undo the database prefix (true = change, false = undo) if ( HMWP_Classes_Tools::getValue( 'value' ) == 'true' ) { //Generate random database prefix $prefixModel->setPrefix( $prefixModel->generateValidateNewPrefix() );; } //run the process to change the prefix if ( $prefixModel->changePrefix() ) { //empty the cache HMWP_Classes_Tools::emptyCache(); //Flush the rules in WordPress flush_rewrite_rules(); //wait for config refresh sleep( 10 ); //Force the recheck security notification delete_option( HMWP_SECURITY_CHECK ); if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_success( esc_html__( 'Saved! You can run the test again.', 'hide-my-wp' ) ); } break; } if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_error( esc_html__( 'Could not fix it. You need to change it manually.', 'hide-my-wp' ) ); } break; case 'hmwp_fixpermissions': $value = HMWP_Classes_Tools::getValue( 'value' ); /** @var HMWP_Models_Permissions $permissionModel */ $permissionModel = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Permissions' ); //run the process to change the prefix if ( $permissionModel->changePermissions( $value ) ) { //refresh the security scan $this->doSecurityCheck(); if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_success( esc_html__( 'Saved! You can run the test again.', 'hide-my-wp' ) ); } break; } if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_error( esc_html__( 'Could not fix it. You need to change it manually.', 'hide-my-wp' ) ); } break; case 'hmwp_fixsalts': /** @var HMWP_Models_Salts $saltsModel */ $saltsModel = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Salts' ); //run the process to change the prefix if ( $saltsModel->validateSalts() ) { if ( $saltsModel->generateSalts() ) { update_option( HMWP_SALT_CHANGED, array( 'timestamp' => current_time( 'timestamp', 1 ) ) ); //Force the recheck security notification delete_option( HMWP_SECURITY_CHECK ); if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_success( esc_html__( 'Saved! You can run the test again.', 'hide-my-wp' ) . '' ); } break; } } if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_error( esc_html__( 'Could not fix it. You need to change it manually.', 'hide-my-wp' ) ); } break; case 'hmwp_fixadmin': global $wpdb; $username = HMWP_Classes_Tools::getValue( 'name' ); if ( ! validate_username( $username ) ) { if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_error( esc_html__( 'Invalid username.', 'hide-my-wp' ) ); } break; } if ( username_exists( $username ) ) { if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_error( esc_html__( 'A user already exists with that username.', 'hide-my-wp' ) ); } break; } $admin = false; if ( username_exists( 'admin' ) ) { $admin = 'admin'; } elseif ( username_exists( 'administrator' ) ) { $admin = 'administrator'; } if ( $admin ) { // Query main user table $wpdb->query( $wpdb->prepare( "UPDATE `{$wpdb->users}` SET user_login = %s WHERE user_login = %s", $username, $admin ) ); // Process sitemeta if we're in a multi-site situation if ( is_multisite() ) { $old_admins = $wpdb->get_var( "SELECT meta_value FROM `" . $wpdb->sitemeta . "` WHERE meta_key = 'site_admins'" ); $new_admins = str_replace( strlen( $admin ) . ':"' . $admin . '"', strlen( $username ) . ':"' . $username . '"', $old_admins ); $wpdb->query( $wpdb->prepare( "UPDATE `{$wpdb->sitemeta}` SET meta_value = %s WHERE meta_key = 'site_admins'", $new_admins ) ); } } //Force the recheck security notification delete_option( HMWP_SECURITY_CHECK_TIME ); if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_success( esc_html__( 'Saved! You can run the test again.', 'hide-my-wp' ) . '' ); } break; case 'hmwp_fixupgrade': if ( ! function_exists( 'get_plugins' ) ) { require_once ABSPATH . 'wp-admin/includes/plugin.php'; } $all_plugins = get_plugins(); include_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php'; foreach ( $all_plugins as $plugin_slug => $value ) { $upgrader = new \Plugin_Upgrader( new \WP_Ajax_Upgrader_Skin() ); $upgrader->upgrade( $plugin_slug ); } if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_success( esc_html__( 'Saved! You can run the test again.', 'hide-my-wp' ) ); } break; case 'hmwp_securityexclude': $name = HMWP_Classes_Tools::getValue( 'name' ); if ( $name ) { if ( ! $tasks_ignored = get_option( HMWP_SECURITY_CHECK_IGNORE ) ) { $tasks_ignored = array(); } $tasks_ignored[] = $name; $tasks_ignored = array_unique( $tasks_ignored ); update_option( HMWP_SECURITY_CHECK_IGNORE, $tasks_ignored ); } if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_success( esc_html__( 'Saved! This task will be ignored on future tests.', 'hide-my-wp' ) ); } break; case 'hmwp_resetexclude': update_option( HMWP_SECURITY_CHECK_IGNORE, array() ); if ( HMWP_Classes_Tools::isAjax() ) { wp_send_json_success( esc_html__( 'Saved! You can run the test again.', 'hide-my-wp' ) ); } break; } } /** * Check PHP version * * @return array */ public function checkPHP() { $phpversion = phpversion(); if ( $phpversion <> '' && strpos( $phpversion, '-' ) !== false ) { $phpversion = substr( $phpversion, 0, strpos( $phpversion, '-' ) ); } return array( 'value' => $phpversion, 'valid' => ( version_compare( $phpversion, '7.4', '>=' ) ), ); } /** * Check if mysql is up-to-date * * @return array */ public function checkMysql() { global $wpdb; $mysql_version = $wpdb->db_version(); return array( 'value' => $mysql_version, 'valid' => ( version_compare( $mysql_version, '8.0', '>' ) ), ); } /** * Check is WP_DEBUG is true * * @return array|bool */ public function checkWPDebug() { if ( defined( 'WP_DEBUG' ) ) { if ( defined( 'WP_DEBUG_DISPLAY' ) && ! WP_DEBUG_DISPLAY ) { return array( 'value' => esc_html__( 'No' ), 'valid' => true ); } else { return array( 'value' => ( WP_DEBUG ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ! WP_DEBUG, ); } } return false; } /** * Check if DB debugging is enabled * * @return array */ static function checkDbDebug() { global $wpdb; $show_errors = ( $wpdb->show_errors && ! HMWP_Classes_Tools::getOption( 'hmwp_disable_debug' ) ); return array( 'value' => ( $show_errors ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ! $show_errors, ); } /** * Check if global WP JS debugging is enabled * * @return array|bool */ static function checkScriptDebug() { if ( defined( 'SCRIPT_DEBUG' ) ) { return array( 'value' => ( SCRIPT_DEBUG ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ! SCRIPT_DEBUG, ); } return false; } /** * Check if the backend is SSL or not * * @return array */ public function checkSSL() { return array( 'value' => ( is_ssl() ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( is_ssl() ), ); } /** * Check Admin User declared * * @return array */ public function checkAdminUsers() { if ( ! $admin = username_exists( 'admin' ) ) { $admin = username_exists( 'administrator' ); } return array( 'value' => ( ! empty( $admin ) ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( empty( $admin ) ), ); } /** * Check WordPress version * * @return array|bool */ public function checkWP() { global $wp_version; $wp_lastversion = false; if ( isset( $wp_version ) ) { $url = 'https://api.wordpress.org/core/version-check/1.7/'; $response = HMWP_Classes_Tools::hmwp_localcall( $url, array( 'timeout' => 5 ) ); $obj = json_decode( $response['body'] ); if ( isset( $obj->offers[0] ) ) { $upgrade = $obj->offers[0]; if ( isset( $upgrade->version ) ) { $wp_lastversion = $upgrade->version; } } if ( $wp_lastversion ) { return array( 'value' => $wp_version, 'valid' => version_compare( $wp_version, $wp_lastversion, '>=' ), 'version' => $wp_lastversion, ); } } return false; } /** * Check if plugins are up-to-date * * @return array */ public function checkPluginsUpdates() { //Get the current update info $current = get_site_transient( 'update_plugins' ); if ( ! is_object( $current ) ) { $current = new stdClass; set_site_transient( 'update_plugins', $current ); // run the internal plugin update check wp_update_plugins(); $current = get_site_transient( 'update_plugins' ); } if ( isset( $current->response ) && is_array( $current->response ) ) { $plugin_update_cnt = count( $current->response ); } else { $plugin_update_cnt = 0; } $plugins = array(); foreach ( $current->response as $tmp ) { if ( isset( $tmp->slug ) ) { $plugins[] = $tmp->slug; } } return array( 'value' => ( $plugin_update_cnt > 0 ? sprintf( esc_html__( '%s plugin(s) are outdated: %s', 'hide-my-wp' ), $plugin_update_cnt, '
' . '' . join( "
", $plugins ) . '' ) : esc_html__( 'All plugins are up to date', 'hide-my-wp' ) ), 'valid' => ( ! $plugin_update_cnt ), ); } /** * Check if themes are up-to-date * * @return array */ public function checkThemesUpdates() { $current = get_site_transient( 'update_themes' ); $themes = array(); $theme_update_cnt = 0; if ( ! is_object( $current ) ) { $current = new stdClass; } set_site_transient( 'update_themes', $current ); wp_update_themes(); $current = get_site_transient( 'update_themes' ); if ( isset( $current->response ) && is_array( $current->response ) ) { $theme_update_cnt = count( $current->response ); } foreach ( $current->response as $theme_name => $tmp ) { $themes[] = $theme_name; } return array( 'value' => ( $theme_update_cnt > 0 ? sprintf( esc_html__( '%s theme(s) are outdated: %s', 'hide-my-wp' ), $theme_update_cnt, '
' . '' . join( "
", $themes ) . '' ) : esc_html__( 'Themes are up to date', 'hide-my-wp' ) ), 'valid' => ( ! $theme_update_cnt ), ); } /** * Check the old plugins from WordPress directory * * @return array */ public function checkOldPlugins() { global $hmwp_plugin_details; $hmwp_plugin_details = array(); $bad = array(); $active_plugins = get_option( 'active_plugins', array() ); foreach ( $active_plugins as $plugin_path ) { $plugin = explode( '/', $plugin_path ); $plugin = @$plugin[0]; if ( empty( $plugin ) || empty( $plugin_path ) ) { continue; } $response = HMWP_Classes_Tools::hmwp_localcall( 'https://api.wordpress.org/plugins/info/1.1/?action=plugin_information&request%5Bslug%5D=' . $plugin, array( 'timeout' => 5 ) ); if ( ! is_wp_error( $response ) && wp_remote_retrieve_response_code( $response ) == 200 && wp_remote_retrieve_body( $response ) ) { $details = wp_remote_retrieve_body( $response ); $details = json_decode( $details, true ); if ( empty( $details ) ) { continue; } $hmwp_plugin_details[ $plugin_path ] = $details; $updated = strtotime( $details['last_updated'] ); if ( $updated + 365 * DAY_IN_SECONDS < time() ) { $bad[ $plugin_path ] = true; } } } // foreach active plugin if ( ! empty( $bad ) ) { $plugins = get_plugins(); foreach ( $bad as $plugin_path => $tmp ) { if ( $plugins[ $plugin_path ]['Name'] <> '' ) { $bad[ $plugin_path ] = $plugins[ $plugin_path ]['Name']; } } } return array( 'value' => ( count( $bad ) > 0 ? sprintf( esc_html__( '%s plugin(s) have NOT been updated by their developers in the past 12 months: %s', 'hide-my-wp' ), count( $bad ), '
' . '' . join( "
", $bad ) . '' ) : esc_html__( 'All plugins have been updated by their developers in the past 12 months', 'hide-my-wp' ) ), 'valid' => empty( $bad ), ); } /** * Check incompatible plugins * * @return array */ public function checkIncompatiblePlugins() { global $hmwp_plugin_details, $wp_version; $bad = array(); if ( empty( $hmwp_plugin_details ) ) { $this->checkOldPlugins(); } foreach ( $hmwp_plugin_details as $plugin_path => $plugin ) { if ( version_compare( $wp_version, $plugin['tested'], '>' ) ) { $bad[ $plugin_path ] = $plugin; } } // foreach active plugins we have details on if ( ! empty( $bad ) ) { $plugins = get_plugins(); foreach ( $bad as $plugin_path => $tmp ) { $bad[ $plugin_path ] = $plugins[ $plugin_path ]['Name']; } } return array( 'value' => ( empty( $bad ) ? esc_html__( 'All plugins are compatible', 'hide-my-wp' ) : implode( '
', $bad ) ), 'valid' => empty( $bad ), ); } /** * Check if version is displayed in source code * * @return array */ public function checkVersionDisplayed() { return array( 'value' => ( HMWP_Classes_Tools::getOption( 'hmwp_hide_version' ) ? 'Removed' : 'Visible' ), 'valid' => ( HMWP_Classes_Tools::getOption( 'hmwp_hide_version' ) ), ); } /** * Check if PHP is exposed * * @return array */ public function checkExposedPHP() { if ( ! isset( $this->html ) || $this->html == '' ) { $this->getSourceCode(); } $check = false; if ( isset( $this->headers ) && ! empty( $this->headers ) ) { if ( isset( $this->headers['X-Powered-By'] ) && is_string( $this->headers['X-Powered-By'] ) && stripos( $this->headers['X-Powered-By'], 'PHP' ) !== false ) { $check = true; } if ( isset( $this->headers['server'] ) && is_string( $this->headers['server'] ) && stripos( $this->headers['server'], 'PHP' ) !== false ) { $check = true; } } else { $check = (bool) ini_get( 'expose_php' ); } return array( 'value' => ( $check ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $check ), ); } /** * Check Database Prefix * * @return array */ public function checkDBPrefix() { global $wpdb; if ( ( $wpdb->prefix === 'wp_' ) || ( $wpdb->prefix === 'wordpress_' ) || ( $wpdb->prefix === 'wp3_' ) ) { return array( 'value' => $wpdb->prefix, 'valid' => false, ); } else { return array( 'value' => $wpdb->prefix, 'valid' => true, 'javascript_custom' => "jQuery(this).hmwp_fixPrefix(false);", 'javascript_button' => esc_html__( 'Reset', 'hide-my-wp' ), ); } } /** * Check Salt Keys * * @return array */ public function checkSaltKeys() { $bad_keys = array(); $keys = array( 'AUTH_KEY', 'SECURE_AUTH_KEY', 'LOGGED_IN_KEY', 'NONCE_KEY', 'AUTH_SALT', 'SECURE_AUTH_SALT', 'LOGGED_IN_SALT', 'NONCE_SALT' ); try { $constants = get_defined_constants(); foreach ( $keys as $key ) { if ( ! in_array( $key, array_keys( $constants ) ) ) { $bad_keys[] = $key; } else { $constant = $constants[ $key ]; if ( empty( $constant ) || trim( $constant ) == 'put your unique phrase here' || strlen( $constant ) < 50 ) { $bad_keys[] = $key; } } } // foreach } catch ( Exception $e ) { } return array( 'value' => ( ! empty( $bad_keys ) ? implode( ', ', $bad_keys ) : esc_html__( 'Yes' ) ), 'valid' => empty( $bad_keys ), ); } /** * Check if wp-config.php has the right chmod * * @return array|false */ public function checkSaltKeysAge() { $old = 95; $diff = false; if ( $saltcheck_time = get_option( HMWP_SALT_CHANGED ) ) { if ( ( isset( $saltcheck_time['timestamp'] ) ) ) { $diff = ( time() - $saltcheck_time['timestamp'] ); } } elseif ( $config_file = HMWP_Classes_Tools::getConfigFile() ) { $age = @filemtime( $config_file ); if ( ! empty( $age ) ) { $diff = time() - $age; } } if ( $diff ) { return array( 'value' => ( ( $diff > ( DAY_IN_SECONDS * $old ) ) ? sprintf( esc_html__( '%s days since last update', 'hide-my-wp' ), $diff ) : esc_html__( 'Updated', 'hide-my-wp' ) ), 'valid' => ( $diff <= ( DAY_IN_SECONDS * $old ) ), 'javascript_custom' => "jQuery(this).hmwp_fixSalts(true);", 'javascript_button' => esc_html__( 'Renew', 'hide-my-wp' ), ); } return false; } /** * Check Database Password * * @return array */ public function checkDbPassword() { $password = DB_PASSWORD; if ( empty( $password ) ) { return array( 'value' => esc_html__( 'Empty', 'hide-my-wp' ), 'valid' => false, ); } elseif ( strlen( $password ) < 6 ) { return array( 'value' => sprintf( esc_html__( 'only %d chars', 'hide-my-wp' ), strlen( $password ) ), 'valid' => false, ); } elseif ( sizeof( count_chars( $password, 1 ) ) < 5 ) { return array( 'value' => esc_html__( 'too simple', 'hide-my-wp' ), 'valid' => false, ); } else { return array( 'value' => esc_html__( 'Good', 'hide-my-wp' ), 'valid' => true, ); } } /** * Check if display_errors is off * * @return array */ public function checkDisplayErrors() { $check = ini_get( 'display_errors' ); return array( 'value' => $check, 'valid' => ! (bool) $check, ); } /** * Compare WP Blog Url with WP Site Url * * @return array */ public function checkBlogSiteURL() { $siteurl = home_url(); $wpurl = site_url(); return array( 'value' => ( ( $siteurl == $wpurl ) ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( $siteurl <> $wpurl ), ); } /** * Check if wp-config.php has the right chmod * * @return array|bool */ public function checkConfigChmod() { //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); if ( $config_file = HMWP_Classes_Tools::getConfigFile() ) { if ( HMWP_Classes_Tools::isWindows() ) { return array( 'value' => ( ( $wp_filesystem->is_writable( $config_file ) ) ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $wp_filesystem->is_writable( $config_file ) ), 'solution' => sprintf( esc_html__( "Change the wp-config.php file permission to Read-Only using File Manager.", 'hide-my-wp' ), '', '', '', '' ), ); } else { $chmod = $wp_filesystem->getchmod( $config_file ); $octmode = substr( sprintf( '%o', $chmod ), - 4 ); return array( 'value' => ( ( substr( $octmode, - 1 ) != 0 ) ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( substr( $octmode, - 1 ) == 0 ), ); } } return array( 'value' => esc_html__( 'No' ), 'valid' => true, ); } /** * Check wp-config.php file * * @return array */ public function checkConfig() { $url = home_url( 'wp-config.php?hmwp_preview=1&rnd=' . wp_rand() ); $response = wp_remote_head( $url, array( 'timeout' => 5, 'cookies' => false ) ); $visible = false; if ( ! is_wp_error( $response ) ) { if ( wp_remote_retrieve_response_code( $response ) == 200 ) { $visible = true; } } $url = home_url( 'wp-config-sample.php?hmwp_preview=1&rnd=' . wp_rand() ); $response = wp_remote_head( $url, array( 'timeout' => 5, 'cookies' => false ) ); if ( ! is_wp_error( $response ) ) { if ( wp_remote_retrieve_response_code( $response ) == 200 ) { $visible = true; } } //if the settings are already activated if ( HMWP_Classes_Tools::getOption( 'hmwp_hide_commonfiles' ) ) { return array( 'value' => esc_html__( 'No' ), 'valid' => true ); } return array( 'value' => ( $visible ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $visible ), ); } /** * Check readme.html file * * @return array */ public function checkReadme() { $url = home_url( 'readme.html?hmwp_preview=1&rnd=' . wp_rand() ); $response = wp_remote_head( $url, array( 'timeout' => 5, 'cookies' => false ) ); $visible = false; if ( ! is_wp_error( $response ) ) { if ( wp_remote_retrieve_response_code( $response ) == 200 ) { $visible = true; } } //In case it's litespeed, the file is hidden if ( HMWP_Classes_Tools::isLitespeed() ) { return array( 'value' => esc_html__( 'No' ), 'valid' => true ); } //if the settings are already activated if ( HMWP_Classes_Tools::getOption( 'hmwp_hide_commonfiles' ) ) { $files = HMWP_Classes_Tools::getOption( 'hmwp_hide_commonfiles_files' ); if ( ! empty( $files ) && in_array( 'readme.html', $files ) ) { return array( 'value' => esc_html__( 'No' ), 'valid' => true ); } } return array( 'value' => ( $visible ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $visible ), ); } /** * Does WP install.php file exist? * * @return array */ public function checkInstall() { $url = site_url() . '/wp-admin/install.php?hmwp_preview=1&rnd=' . wp_rand(); $response = wp_remote_head( $url, array( 'timeout' => 10, 'cookies' => false ) ); $visible = false; if ( ! is_wp_error( $response ) ) { if ( wp_remote_retrieve_response_code( $response ) == 200 ) { $visible = true; } } //if the settings are already activated if ( HMWP_Classes_Tools::getOption( 'hmwp_hide_commonfiles' ) ) { $files = HMWP_Classes_Tools::getOption( 'hmwp_hide_commonfiles_files' ); if ( ! empty( $files ) && in_array( 'install.php', $files ) ) { return array( 'value' => esc_html__( 'No' ), 'valid' => true ); } } return array( 'value' => ( $visible ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $visible ), ); } /** * Check if firewall is activated * * @return array */ public function checkFirewall() { return array( 'value' => ( HMWP_Classes_Tools::getOption( 'hmwp_sqlinjection' ) ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( HMWP_Classes_Tools::getOption( 'hmwp_sqlinjection' ) ), ); } /** * Check if register_globals is off * * @return array */ public function checkRegisterGlobals() { $check = (bool) ini_get( 'register' . '_globals' ); return array( 'value' => ( $check ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $check ), ); } /** * Check if safe mode is off * * @return array */ public function checkPHPSafe() { $check = (bool) ini_get( 'safe' . '_mode' ); return array( 'value' => ( $check ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $check ), ); } /** * Check if allow_url_include is off * * @return array */ public function checkAllowUrlInclude() { $check = (bool) ini_get( 'allow_url_include' ); return array( 'value' => ( $check ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $check ), ); } /** * Is theme/plugin editor disabled? * * @return array */ public function checkAdminEditor() { if ( defined( 'DISALLOW_FILE_EDIT' ) ) { return array( 'value' => ( DISALLOW_FILE_EDIT ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => DISALLOW_FILE_EDIT, 'javascript_undo' => "jQuery(this).hmwp_fixConfig('DISALLOW_FILE_EDIT',false);", ); } else { return array( 'value' => esc_html__( 'Yes' ), 'valid' => false, ); } } /** * Check if Upload Folder is browsable * * @return array|false */ public function checkUploadsBrowsable() { //if the settings are already activated if ( HMWP_Classes_Tools::getOption( 'hmwp_disable_browsing' ) ) { return array( 'value' => esc_html__( 'No' ), 'valid' => true ); } $upload_dir = wp_upload_dir(); if ( ! isset( $upload_dir['baseurl'] ) || $upload_dir['baseurl'] == '' ) { return false; } $args = array( 'method' => 'GET', 'timeout' => 5, 'sslverify' => false, 'httpversion' => 1.0, 'blocking' => true, 'headers' => array(), 'body' => null, 'cookies' => array() ); $response = HMWP_Classes_Tools::hmwp_localcall( rtrim( $upload_dir['baseurl'], '/' ) . '/?nocache=' . wp_rand(), $args ); if ( is_wp_error( $response ) ) { $return = array( 'value' => esc_html__( 'No' ), 'valid' => true, ); } elseif ( wp_remote_retrieve_response_code( $response ) == 200 && stripos( $response['body'], 'index' ) !== false ) { $return = array( 'value' => esc_html__( 'Yes' ), 'valid' => false, ); } else { $return = array( 'value' => esc_html__( 'No' ), 'valid' => true, ); } if ( ! HMWP_Classes_Tools::isApache() && ! HMWP_Classes_Tools::isNginx() && ! HMWP_Classes_Tools::isLitespeed() ) { $return['javascript'] = ''; } return $return; } /** * Check if Wondows Live Writer is not disabled * * @return array */ public function checkWLW() { $check = ( ! HMWP_Classes_Tools::getOption( 'hmwp_disable_manifest' ) ); return array( 'value' => ( $check ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $check ), ); } /** * Check if XML PRC * * @return array */ public function checkXmlrpc() { $visible = false; if ( ! HMWP_Classes_Tools::getOption( 'hmwp_disable_xmlrpc' ) ) { $url = site_url() . '/xmlrpc.php?rnd=' . wp_rand(); $response = wp_remote_head( $url, array( 'timeout' => 5, 'cookies' => false ) ); if ( ! is_wp_error( $response ) ) { if ( wp_remote_retrieve_response_code( $response ) == 200 || wp_remote_retrieve_response_code( $response ) == 405 ) { $visible = true; } } } return array( 'value' => ( $visible ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $visible ), ); } /** * Check if XML PRC * * @return array */ public function checkRDS() { $check = ( ! HMWP_Classes_Tools::getOption( 'hmwp_hide_rsd' ) ); return array( 'value' => ( $check ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $check ), ); } /** * Check if the WP MySQL user has too many permissions granted * * @return array */ static function checkMysqlPermissions() { global $wpdb; $grants = $wpdb->get_results( 'SHOW GRANTS', ARRAY_N ); foreach ( $grants as $grant ) { if ( stripos( $grant[0], 'GRANT ALL PRIVILEGES' ) !== false ) { return array( 'value' => esc_html__( 'Yes' ), 'valid' => false, ); } } return array( 'value' => esc_html__( 'No' ), 'valid' => true, ); } /** * Check if a user can be found by its ID * * @return array */ static function checkUsersById() { $users = get_users( 'number=1' ); $success = false; $url = home_url() . '/?hmwp_preview=1&author='; foreach ( $users as $user ) { $response = wp_remote_head( $url . $user->ID, array( 'redirection' => 0, 'timeout' => 5, 'cookies' => false ) ); $response_code = wp_remote_retrieve_response_code( $response ); if ( $response_code == 301 ) { $success = true; } break; } // foreach //If the option is on, the author is hidden if ( HMWP_Classes_Tools::getOption( 'hmwp_hide_authors' ) ) { $success = false; } return array( 'value' => ( $success ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $success ), ); } /** * Check if XML PRC * * @return array */ public function checkOldPaths() { $visible = false; $url = site_url() . '/wp-content/?rnd=' . wp_rand(); $response = wp_remote_head( $url, array( 'timeout' => 5, 'cookies' => false ) ); if ( ! is_wp_error( $response ) ) { if ( wp_remote_retrieve_response_code( $response ) == 200 ) { $visible = true; } } if ( HMWP_Classes_Tools::getDefault( 'hmwp_wp-content_url' ) <> HMWP_Classes_Tools::getOption( 'hmwp_wp-content_url' ) && HMWP_Classes_Tools::getOption( 'hmwp_hide_oldpaths' ) ) { $visible = false; } return array( 'value' => ( $visible ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $visible ), ); } /** * Check the Old paths in source code * * @return array|bool */ public function checkCommonPaths() { $visible = false; if ( ! isset( $this->html ) || $this->html == '' ) { if ( ! $this->getSourceCode() ) { return false; } } //if the wp-content path is changed in HMWP if ( HMWP_Classes_Tools::getDefault( 'hmwp_wp-content_url' ) <> HMWP_Classes_Tools::getOption( 'hmwp_wp-content_url' ) ) { //if the new path is visible in the source code, the paths are changed if ( strpos( $this->html, site_url( '/' . HMWP_Classes_Tools::getOption( 'hmwp_wp-content_url' ) . '/' ) ) ) { //the old paths are changed $visible = false; } else { //check if wp-content is visible in the source code $visible = strpos( $this->html, content_url() ); } } else { //check if wp-content is visible in the source code $visible = strpos( $this->html, content_url() ); } return array( 'value' => ( $visible ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $visible ), ); } /** * Check the Login path in source code * * @return array|bool */ public function checkLoginPath() { if ( ! isset( $this->html ) || $this->html == '' ) { if ( ! $this->getSourceCode() ) { return false; } } if ( ! $found = strpos( $this->html, site_url( 'wp-login.php' ) ) ) { if ( ! HMWP_Classes_Tools::getOption( 'hmwp_bruteforce' ) ) { //If the custom login path is visible in the source code and Brute force is not activated $found = strpos( $this->html, site_url( '/' . HMWP_Classes_Tools::getOption( 'hmwp_login_url' ) . '/' ) ); } } return array( 'value' => ( $found ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $found ), ); } /** * Check the Admin path in source code * * @return array|bool */ public function checkAdminPath() { if ( ! isset( $this->html ) || $this->html == '' ) { if ( ! $this->getSourceCode() ) { return false; } } $found = strpos( $this->html, site_url( '/' . HMWP_Classes_Tools::getOption( 'hmwp_admin_url' ) . '/' ) ); if ( HMWP_Classes_Tools::getDefault( 'hmwp_admin-ajax_url' ) == HMWP_Classes_Tools::getOption( 'hmwp_admin-ajax_url' ) ) { return array( 'value' => ( $found ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $found ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_hideajax_admin',1);jQuery(this).hmwp_fixSettings('hmwp_admin-ajax_url','ajax');", ); } return array( 'value' => ( $found ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $found ), 'javascript' => "jQuery(this).hmwp_fixSettings('hmwp_hideajax_admin',1);", ); } /** * Check if wp-admin is accessible for visitors * * @return array */ public function checkOldLogin() { $url = home_url() . '/wp-login.php?hmwp_preview=1&rnd=' . wp_rand(); $response = HMWP_Classes_Tools::hmwp_localcall( $url, array( 'redirection' => 0, 'cookies' => false ) ); $visible = false; if ( ! is_wp_error( $response ) ) { if ( wp_remote_retrieve_response_code( $response ) == 200 ) { $visible = true; } } if ( HMWP_Classes_Tools::getDefault( 'hmwp_login_url' ) <> HMWP_Classes_Tools::getOption( 'hmwp_login_url' ) && HMWP_Classes_Tools::getOption( 'hmwp_hide_login' ) ) { $visible = false; } return array( 'value' => ( $visible ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $visible ), ); } /** * Check if anyone can register easily * * @return array */ public function checkUserRegistration() { $check = ( get_option( 'users_can_register' ) ); if ( $check ) { $check = ( HMWP_Classes_Tools::getOption( 'hmwp_register_url' ) == '' || !HMWP_Classes_Tools::getOption('hmwp_bruteforce') || !HMWP_Classes_Tools::getOption('hmwp_bruteforce_register') ); } return array( 'value' => ( $check ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $check ), ); } /** * Check if the default website description is shown * * @return array */ public function checkBlogDescription() { $check = ( get_option( 'blogdescription' ) == esc_html__( 'Just another WordPress site' ) ); return array( 'value' => ( $check ? esc_html__( 'Yes' ) : esc_html__( 'No' ) ), 'valid' => ( ! $check ), ); } /** * Check if file and directory permissions are correctly set * * @return array * @throws Exception */ public function checkFilePermissions() { /** @var HMWP_Models_Permissions $permissionModel */ $permissionModel = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Permissions' ); $invalid = $permissionModel->getInvalidPermissions(); $values = array(); foreach ( $invalid as $row ) { $values[] = $row['display_path'] . ' (' . $row['display_permission'] . ')'; } return array( 'value' => ( ! empty( $values ) ? sprintf( esc_html__( "%s don't have the correct permission.", 'hide-my-wp' ), '' . join( '
', $values ) . '' . '
' ) : esc_html__( 'All files have the correct permissions.', 'hide-my-wp' ) ), 'valid' => ( empty( $values ) ), ); } /** * Get the homepage source code * * @return string */ public function getSourceCode() { if ( ! isset( $this->html ) && ! isset( $this->htmlerror ) ) { $url = home_url() . '?hmwp_preview=1'; $response = HMWP_Classes_Tools::hmwp_localcall( $url, array( 'redirection' => 0, 'timeout' => 10, 'cookies' => false ) ); if ( ! is_wp_error( $response ) ) { if ( wp_remote_retrieve_response_code( $response ) == 200 ) { $this->html = wp_remote_retrieve_body( $response ); $this->headers = wp_remote_retrieve_headers( $response ); } else { $this->htmlerror = true; $this->html = false; $this->headers = false; } } else { $this->htmlerror = true; $this->html = false; $this->headers = false; } } return $this->html; } } controllers/Settings.php 0000644 00000121641 14760004224 0011427 0 ustar 00 find_replace_url( $url ); $response = HMWP_Classes_Tools::hmwp_localcall( $url, array( 'redirection' => 0, 'cookies' => false ) ); //If the plugin logo is not loading correctly, switch off the path changes if ( ! is_wp_error( $response ) && wp_remote_retrieve_response_code( $response ) == 404 ) { HMWP_Classes_Tools::saveOptions( 'file_mappings', array( home_url() ) ); } } ); } // Save the login path on Cloud add_action( 'hmwp_apply_permalink_changes', function() { HMWP_Classes_Tools::sendLoginPathsApi(); } ); } /** * Called on Menu hook * Init the Settings page * * @return void * @throws Exception */ public function init() { ///////////////////////////////////////////////// // Get the current Page $page = HMWP_Classes_Tools::getValue( 'page' ); if ( strpos( $page, '_' ) !== false ) { $tab = substr( $page, ( strpos( $page, '_' ) + 1 ) ); if ( method_exists( $this, $tab ) ) { call_user_func( array( $this, $tab ) ); } } ///////////////////////////////////////////////// // We need that function so make sure is loaded if ( ! function_exists( 'is_plugin_active_for_network' ) ) { include_once ABSPATH . '/wp-admin/includes/plugin.php'; } if ( HMWP_Classes_Tools::isNginx() && HMWP_Classes_Tools::getOption( 'test_frontend' ) && HMWP_Classes_Tools::getOption( 'hmwp_mode' ) <> 'default' ) { $config_file = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rules' )->getConfFile(); if ( HMWP_Classes_Tools::isLocalFlywheel() ) { if ( strpos( $config_file, '/includes/' ) !== false ) { $config_file = substr( $config_file, strpos( $config_file, '/includes/' ) + 1 ); } HMWP_Classes_Error::setNotification( sprintf( esc_html__( "Local & NGINX detected. In case you didn't add the code in the NGINX config already, please add the following line. %s", 'hide-my-wp' ), '
include ' . $config_file . ';
' . esc_html__( "Learn how to setup on Local & Nginx", 'hide-my-wp' ) . ' >>' ), 'notice', false ); } else { HMWP_Classes_Error::setNotification( sprintf( esc_html__( "NGINX detected. In case you didn't add the code in the NGINX config already, please add the following line. %s", 'hide-my-wp' ), '
include ' . $config_file . ';
' . esc_html__( "Learn how to setup on Nginx server", 'hide-my-wp' ) . ' >>' ), 'notice', false ); } } // Setting Alerts based on Logout and Error statements if ( get_transient( 'hmwp_restore' ) == 1 ) { $restoreLink = '' . esc_html__( "Restore Settings", 'hide-my-wp' ) . ''; HMWP_Classes_Error::setNotification( esc_html__( 'Do you want to restore the last saved settings?', 'hide-my-wp' ) . $restoreLink ); } // Show the config rules to make sure they are okay if ( HMWP_Classes_Tools::getValue( 'hmwp_config' ) ) { //Initialize WordPress Filesystem $wp_filesystem = HMWP_Classes_ObjController::initFilesystem(); $config_file = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rules' )->getConfFile(); if ( $config_file <> '' && $wp_filesystem->exists( $config_file ) ) { $rules = $wp_filesystem->get_contents( HMWP_Classes_ObjController::getClass( 'HMWP_Models_Rules' )->getConfFile() ); HMWP_Classes_Error::setNotification( ' ' ); } } // Load the css for Settings HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' )->loadMedia( 'popper' ); if ( is_rtl() ) { HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' )->loadMedia( 'bootstrap.rtl' ); HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' )->loadMedia( 'rtl' ); } else { HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' )->loadMedia( 'bootstrap' ); } HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' )->loadMedia( 'bootstrap-select' ); HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' )->loadMedia( 'font-awesome' ); HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' )->loadMedia( 'switchery' ); HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' )->loadMedia( 'alert' ); HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' )->loadMedia( 'clipboard' ); HMWP_Classes_ObjController::getClass( 'HMWP_Classes_DisplayController' )->loadMedia( 'settings' ); // Check connection with the cloud HMWP_Classes_Tools::checkAccountApi(); // Show connect for activation if ( ! HMWP_Classes_Tools::getOption( 'hmwp_token' ) ) { $this->show( 'Connect' ); return; } if ( HMWP_Classes_Tools::getOption( 'error' ) ) { HMWP_Classes_Error::setNotification( esc_html__( 'There is a configuration error in the plugin. Please Save the settings again and follow the instruction.', 'hide-my-wp' ) ); } if ( HMWP_Classes_Tools::isWpengine() ) { add_filter( 'hmwp_option_hmwp_mapping_url_show', "__return_false" ); } // Check compatibilities with other plugins HMWP_Classes_ObjController::getClass( 'HMWP_Models_Compatibility' )->getAlerts(); // Show errors on top HMWP_Classes_ObjController::getClass( 'HMWP_Classes_Error' )->hookNotices(); echo ''; echo ''; $this->show( ucfirst( str_replace( 'hmwp_', '', $page ) ) ); } /** * Log the user event * * @throws Exception */ public function log() { $this->listTable = HMWP_Classes_ObjController::getClass( 'HMWP_Models_ListTable' ); if ( apply_filters( 'hmwp_showlogs', true ) ) { $args = $urls = array(); $args['search'] = HMWP_Classes_Tools::getValue( 's', false ); //If it's multisite if ( is_multisite() ) { if ( function_exists( 'get_sites' ) && class_exists( 'WP_Site_Query' ) ) { $sites = get_sites(); if ( ! empty( $sites ) ) { foreach ( $sites as $site ) { $urls[] = ( _HMWP_CHECK_SSL_ ? 'https://' : 'http://' ) . rtrim( $site->domain . $site->path, '/' ); } } } } else { $urls[] = home_url(); } // Pack the urls $args['urls'] = wp_json_encode( array_unique( $urls ) ); // Set the log table data $logs = HMWP_Classes_Tools::hmwp_remote_get( _HMWP_API_SITE_ . '/api/log', $args ); if ( $logs = json_decode( $logs, true ) ) { if ( isset( $logs['error'] ) && $logs['error'] <> '' ) { // Check connection with the cloud on error HMWP_Classes_Tools::checkAccountApi(); } if ( isset( $logs['data'] ) && ! empty( $logs['data'] ) ) { $logs = $logs['data']; } else { $logs = array(); } } else { $logs = array(); } $this->listTable->setData( $logs ); } } /** * Log the user event * * @throws Exception */ public function templogin() { if ( ! HMWP_Classes_Tools::getOption( 'hmwp_token' ) ) { return; } // Clear previous alerts HMWP_Classes_Error::clearErrors(); if ( HMWP_Classes_Tools::getValue( 'action' ) == 'hmwp_update' && HMWP_Classes_Tools::getValue( 'user_id' ) ) { $user_id = HMWP_Classes_Tools::getValue( 'user_id' ); $this->user = get_user_by( 'ID', $user_id ); $this->user->details = HMWP_Classes_ObjController::getClass( 'HMWP_Models_Templogin' )->getUserDetails( $this->user ); } if ( HMWP_Classes_Tools::getValue( 'hmwp_message' ) ) { HMWP_Classes_Error::setNotification( HMWP_Classes_Tools::getValue( 'hmwp_message', false, true ), 'success' ); } } /** * Firewall page init * * @return void * @throws Exception */ public function twofactor() { if ( ! HMWP_Classes_Tools::isAdvancedpackInstalled() ) { add_filter( 'hmwp_getview', function( $output, $block ) { if ( $block == 'Twofactor' ) { return '
'; if ( ( esc_attr( $user->user_email ) ) ) { $user_details .= '
' . esc_html( $user->user_email ) . '
'; } $user_details .= '
(' . esc_html__( 'after first access' ) . ')'; } } $form .= '
' . get_home_url( $user->details->user_blog_id ); } $data .= "