/wp-content/plugins/better-wp-security/core/modules/hide-backend/class-itsec-hide-backend.php
PHP | 361 lines | 184 code | 107 blank | 70 comment | 69 complexity | e8d6827891345d4f023d5f4f3dbff518 MD5 | raw file
- <?php
- class ITSEC_Hide_Backend {
- private
- $settings,
- $auth_cookie_expired;
- function run() {
- $this->settings = ITSEC_Modules::get_settings( 'hide-backend' );
- if ( ! $this->settings['enabled'] ) {
- return;
- }
- add_filter( 'itsec_filter_apache_server_config_modification', array( $this, 'filter_apache_server_config_modification' ) );
- add_filter( 'itsec_filter_litespeed_server_config_modification', array( $this, 'filter_apache_server_config_modification' ) );
- add_filter( 'itsec_filter_nginx_server_config_modification', array( $this, 'filter_nginx_server_config_modification' ) );
- $jetpack_active_modules = get_option( 'jetpack_active_modules' );
- if ( is_multisite() && function_exists( 'is_plugin_active_for_network' ) ) { //see if Jetpack is active
- $is_jetpack_active = in_array( 'jetpack/jetpack.php', (array) get_option( 'active_plugins', array() ) ) || is_plugin_active_for_network( 'jetpack/jetpack.php' );
- } else {
- $is_jetpack_active = in_array( 'jetpack/jetpack.php', (array) get_option( 'active_plugins', array() ) );
- }
- if (
- ! (
- $is_jetpack_active === true &&
- is_array( $jetpack_active_modules ) &&
- in_array( 'json-api', $jetpack_active_modules ) &&
- isset( $_GET['action'] ) &&
- $_GET['action'] == 'jetpack_json_api_authorization'
- )
- ) {
- $this->auth_cookie_expired = false;
- add_action( 'auth_cookie_expired', array( $this, 'auth_cookie_expired' ) );
- add_action( 'init', array( $this, 'execute_hide_backend' ), 1000 );
- add_action( 'login_init', array( $this, 'execute_hide_backend_login' ) );
- add_action( 'plugins_loaded', array( $this, 'plugins_loaded' ), 11 );
- add_filter( 'body_class', array( $this, 'remove_admin_bar' ) );
- add_filter( 'loginout', array( $this, 'filter_loginout' ) );
- add_filter( 'wp_redirect', array( $this, 'filter_login_url' ), 10, 2 );
- add_filter( 'lostpassword_url', array( $this, 'filter_login_url' ), 10, 2 );
- add_filter( 'site_url', array( $this, 'filter_login_url' ), 10, 2 );
- add_filter( 'retrieve_password_message', array( $this, 'retrieve_password_message' ) );
- add_filter( 'comment_moderation_text', array( $this, 'comment_moderation_text' ) );
- remove_action( 'template_redirect', 'wp_redirect_admin_locations', 1000 );
- }
- }
- public function filter_apache_server_config_modification( $modification ) {
- require_once( dirname( __FILE__ ) . '/config-generators.php' );
-
- return ITSEC_Hide_Backend_Config_Generators::filter_apache_server_config_modification( $modification, $this->settings );
- }
-
- public function filter_nginx_server_config_modification( $modification ) {
- require_once( dirname( __FILE__ ) . '/config-generators.php' );
-
- return ITSEC_Hide_Backend_Config_Generators::filter_nginx_server_config_modification( $modification, $this->settings );
- }
- /**
- * Lets the module know that this is a reauthorization
- *
- * @since 4.1
- *
- * @return void
- */
- public function auth_cookie_expired() {
- $this->auth_cookie_expired = true;
- wp_clear_auth_cookie();
- }
- /**
- * @param $notify_message
- *
- * @since 4.5
- *
- * @param sting $notify_message Notification message
- *
- * @return string Notification message
- */
- public function comment_moderation_text( $notify_message ) {
- preg_match_all( "#(https?:\/\/((.*)wp-admin(.*)))#", $notify_message, $urls );
- if ( isset( $urls ) && is_array( $urls ) && isset( $urls[0] ) ) {
- foreach ( $urls[0] as $url ) {
- $notify_message = str_replace( trim( $url ), wp_login_url( trim( $url ) ), $notify_message );
- }
- }
- return $notify_message;
- }
- /**
- * Execute hide backend functionality
- *
- * @since 4.0
- *
- * @return void
- */
- public
- function execute_hide_backend() {
- if ( get_site_option( 'users_can_register' ) == 1 && isset( $_SERVER['REQUEST_URI'] ) && $_SERVER['REQUEST_URI'] == ITSEC_Lib::get_home_root() . $this->settings['register'] ) {
- wp_redirect( wp_login_url() . '?action=register' );
- exit;
- }
- //redirect wp-admin and wp-register.php to 404 when not logged in
- if (
- (
- (
- get_site_option( 'users_can_register' ) == false &&
- (
- isset( $_SERVER['REQUEST_URI'] ) && strpos( $_SERVER['REQUEST_URI'], 'wp-register.php' ) ||
- isset( $_SERVER['REQUEST_URI'] ) && strpos( $_SERVER['REQUEST_URI'], 'wp-signup.php' )
- )
- ) ||
- (
- isset( $_SERVER['REQUEST_URI'] ) && strpos( $_SERVER['REQUEST_URI'], 'wp-login.php' ) && is_user_logged_in() !== true
- ) ||
- ( is_admin() && is_user_logged_in() !== true ) ||
- (
- $this->settings['register'] != 'wp-register.php' &&
- strpos( $_SERVER['REQUEST_URI'], 'wp-register.php' ) !== false ||
- strpos( $_SERVER['REQUEST_URI'], 'wp-signup.php' ) !== false ||
- (
- isset( $_REQUEST['redirect_to'] ) &&
- strpos( $_REQUEST['redirect_to'], 'wp-admin/customize.php' ) !== false
- )
- )
- ) &&
- strpos( $_SERVER['REQUEST_URI'], 'admin-ajax.php' ) === false
- && $this->auth_cookie_expired === false
- ) {
- global $itsec_is_old_admin;
- $itsec_is_old_admin = true;
- if ( isset( $this->settings['theme_compat'] ) && $this->settings['theme_compat'] === true ) { //theme compat (process theme and redirect to a 404)
- wp_redirect( ITSEC_Lib::get_home_root() . sanitize_title( isset( $this->settings['theme_compat_slug'] ) ? $this->settings['theme_compat_slug'] : 'not_found' ), 302 );
- exit;
- } else {
- // Throw a 403 forbidden
- wp_die( __( 'This has been disabled.', 'better-wp-security' ), 403 );
- }
- }
- $url_info = parse_url( $_SERVER['REQUEST_URI'] );
- $login_path = site_url( $this->settings['slug'], 'relative' );
- $login_path_trailing_slash = site_url( $this->settings['slug'] . '/', 'relative' );
- if ( $url_info['path'] === $login_path || $url_info['path'] === $login_path_trailing_slash ) {
- if ( ! is_user_logged_in() ) {
- //Add the login form
- if ( isset( $this->settings['post_logout_slug'] ) && strlen( trim( $this->settings['post_logout_slug'] ) ) > 0 && isset( $_GET['action'] ) && sanitize_text_field( $_GET['action'] ) == trim( $this->settings['post_logout_slug'] ) ) {
- do_action( 'itsec_custom_login_slug' ); //add hook here for custom users
- }
- //suppress error messages due to timing
- error_reporting( 0 );
- @ini_set( 'display_errors', 0 );
- status_header( 200 );
- //don't allow domain mapping to redirect
- if ( defined( 'DOMAIN_MAPPING' ) && DOMAIN_MAPPING == 1 ) {
- remove_action( 'login_head', 'redirect_login_to_orig' );
- }
- if ( ! function_exists( 'login_header' ) ) {
- include( ABSPATH . 'wp-login.php' );
- exit;
- }
- } elseif ( ! isset( $_GET['action'] ) || ( sanitize_text_field( $_GET['action'] ) != 'logout' && sanitize_text_field( $_GET['action'] ) != 'postpass' && ( isset( $this->settings['post_logout_slug'] ) && strlen( trim( $this->settings['post_logout_slug'] ) ) > 0 && sanitize_text_field( $_GET['action'] ) != trim( $this->settings['post_logout_slug'] ) ) ) ) {
- //Just redirect them to the dashboard (for logged in users)
- if ( $this->auth_cookie_expired === false ) {
- wp_redirect( get_admin_url() );
- exit();
- }
- } elseif ( isset( $_GET['action'] ) && ( sanitize_text_field( $_GET['action'] ) == 'postpass' || ( isset( $this->settings['post_logout_slug'] ) && strlen( trim( $this->settings['post_logout_slug'] ) ) > 0 && sanitize_text_field( $_GET['action'] ) == trim( $this->settings['post_logout_slug'] ) ) ) ) {
- //handle private posts for
- if ( isset( $this->settings['post_logout_slug'] ) && strlen( trim( $this->settings['post_logout_slug'] ) ) > 0 && sanitize_text_field( $_GET['action'] ) == trim( $this->settings['post_logout_slug'] ) ) {
- do_action( 'itsec_custom_login_slug' ); //add hook here for custom users
- }
- //suppress error messages due to timing
- error_reporting( 0 );
- @ini_set( 'display_errors', 0 );
- status_header( 200 ); //its a good login page. make sure we say so
- //include the login page where we need it
- if ( ! function_exists( 'login_header' ) ) {
- include( ABSPATH . '/wp-login.php' );
- exit;
- }
- //Take them back to the page if we need to
- if ( isset( $_SERVER['HTTP_REFERRER'] ) ) {
- wp_redirect( sanitize_text_field( $_SERVER['HTTP_REFERRER'] ) );
- exit();
- }
- }
- }
- }
- /**
- * Filter the old login page out
- *
- * @return void
- */
- public function execute_hide_backend_login() {
- if ( strpos( $_SERVER['REQUEST_URI'], 'wp-login.php' ) ) { //are we on the login page
- global $itsec_is_old_admin;
- $itsec_is_old_admin = true;
- ITSEC_Lib::set_404();
- }
- }
- /**
- * Filters redirects for correct login URL
- *
- * @since 4.0
- *
- * @param string $url URL redirecting to
- *
- * @return string Correct redirect URL
- */
- public function filter_login_url( $url ) {
- $t = str_replace( 'wp-login.php', $this->settings['slug'], $url );
- return str_replace( 'wp-login.php', $this->settings['slug'], $url );
- }
- /**
- * Filter meta link
- *
- * @since 4.2
- *
- * @param string $link the link
- *
- * @return string the link
- */
- public function filter_loginout( $link ) {
- return str_replace( 'wp-login.php', $this->settings['slug'], $link );
- }
- /**
- * Actions for plugins loaded.
- *
- * Makes certain logout is processed on NGINX.
- *
- * @return void
- */
- public function plugins_loaded() {
- if ( is_user_logged_in() && isset( $_GET['action'] ) && sanitize_text_field( $_GET['action'] ) == 'logout' ) {
- check_admin_referer( 'log-out' );
- wp_logout();
- $redirect_to = ! empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : 'wp-login.php?loggedout=true';
- wp_safe_redirect( $redirect_to );
- exit();
- }
- }
- /**
- * Removes the admin bar class from the body tag
- *
- * @param array $classes body tag classes
- *
- * @return array body tag classes
- */
- public function remove_admin_bar( $classes ) {
- if ( is_admin() && is_user_logged_in() !== true ) {
- foreach ( $classes as $key => $value ) {
- if ( $value == 'admin-bar' ) {
- unset( $classes[ $key ] );
- }
- }
- }
- return $classes;
- }
- public function retrieve_password_message( $message ) {
- return str_replace( 'wp-login.php', $this->settings['slug'], $message );
- return $message;
- }
- }