gP U
d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZmZmZmZmZ d dlmZmZ d d lm Z d d
l m Z m Z m Z m!Z! d d lm"Z" d d l#m$Z$ d d
l%m&Z&m'Z' d dl(m)Z)m*Z* d dl+m,Z, d dl-m.Z.m/Z/ d dl0m1Z1 d dl2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mm?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZHmIZImJZJmKZK d dlLmMZM ejN eO ZPdZQ e jR ZSdaTdZUdZVdeWfdZXdeWfdZYdeWfdZZde[fd Z\d e[deWfd Z]d e[deWfd Z^d e[deWfd Z_ ed! Z`d e[d"efd#Zad$edebdz fd%Zcd& Zdd'ebd(eje debfd)Zfd(eje d"efd*Zgd+e jh fd,Zidhd.ejfd/Zkd0 Zld1 Zmd2 Znde[fd3Zod4 Zpd5e*fd6Zqd5e*derfd7Zsd8 Ztd9 Zu did:eve* fd;Zwde[d?ebddfd@Zyd5e*dAebfdBZzd5e*dCebddfdDZ{d r? r@ rA rB _get_waf_defaultrH _ rD rE c d t t j S # t $ r
t cY S w xY w)uS Read WORDPRESS.ai_bot_protection from config, defaulting to False.
Returns _AI_BOT_PROTECTION_DEFAULT when the config key is missing
— e.g. the ai_bot_protection field hasn't rolled out to this
install's imunify360 yet, or a sibling package is still on an
older schema. Keeps the feature off in all ambiguous cases.
)r< r AI_BOT_PROTECTIONr> _AI_BOT_PROTECTION_DEFAULTr@ rA rB _get_global_ai_bot_protectionrL f s? *I/000 * * *))))*rE c j t j } n# t $ r
t cY S w xY wt | S )u Read WORDPRESS.ai_bot_protection_preset from config, defaulting to
"balanced".
Two layers of safety: KeyError on a missing key (older schema, agent
upgrade in progress) and _validate_preset() on the value itself
(hand-edited override file, future preset rolled in via a sibling
package this version doesn't recognise). Both fall back to the same
canonical default so all layers — schema, agent, plugin — agree.
)r AI_BOT_PROTECTION_PRESETr> !_AI_BOT_PROTECTION_PRESET_DEFAULTr )raws rB $_get_global_ai_bot_protection_presetrQ t sF 10 1 1 100001 C s ##usernamec t sdS t dd| \ }}n # t $ r t cY S w xY w|t j k rt S t
| S )NF WORDPRESS waf_enabledrR )rC r
r> rH r ROOTr< )rR valuesources rB _is_waf_enabled_for_user_syncrZ s " $ $ u"0
vv " " " !!!!!"
!!! ;;s ( AAc p K t j }| dt | d{V S )u3 Async wrapper — runs config file I/O in executor.N)asyncioget_running_looprun_in_executorrZ )rR loops rB is_waf_enabled_for_userr` sR # % %D%% +X rA c r t dd| \ }}n# t $ r Y dS w xY w|t j k S )NrT rU rV F)r
r> r rW )rR _rY s rB $_user_has_explicit_waf_override_syncrc sY ,
66 uu X] ""s
&&zD/var/lib/cloudlinux-app-version-detector/components_versions.sqlite3 admin_configc ddl m} || | S # t $ r- t d t
j dddfcY S w xY w)z
Get user-specific schedule configuration with lazy import fallback.
Returns default values if imav.malwarelib is not available.
r )get_user_schedule_configz@imav.malwarelib not available, returning default schedule config )(imav.malwarelib.plugins.schedule_watcherrf ImportErrorloggerdebugIntervalNONE)rR rd rf s rB _get_user_schedule_configrn s
&
(',??? & & & N
}aA%%%% &s 4A
A indexc t | }|dS t r | D ]
\ }}d|d< t t j r fd| D }|S )uI
Retrieve WordPress rules with ANTIVIRUS_MODE handling and global disable filtering.
In ANTIVIRUS_MODE, all rules are set to monitoring mode ("pass").
Globally disabled rules are filtered out entirely — they should not
appear in rules.php. Domain-specific disables are handled separately
via disabled-rules.php.
Args:
index: The Index object used to locate the wp-rules.zip file.
Returns:
The parsed wp-rules data with mode adjusted for ANTIVIRUS_MODE
and globally disabled rules removed, or None if rules cannot be loaded.
Npassmodec $ i | ] \ }}|v ||
S r@ r@ ).0cveparamsglobally_disableds rB
z-get_updated_wp_rules_data.. s5
V+++
+++rA )r r itemssetr get_global_disabled)ro
rules_dataru rv rw s @rB get_updated_wp_rules_datar} s #5))Jt $%++-- $ $KC #F6NN N > @ @AA
) / / 1 1
rA c H t t j dS )z#Clear all WordPress-related caches.N)r! r clear_get_content_dir_cacher@ rA rB clear_cachesr s# (***#%%%%%rA ry user_infoc t | }d |D }| D ]Dfd|D }|r1t |t }|| E|S )Nc i | ]}|g S r@ r@ )rt paths rB rx z site_search.. s
.
.
.4dB
.
.
.rA c , g | ]} | |S r@ r@ )rt r itemmatchers rB
z site_search.. s* MMM4t9L9LM$MMMrA )key)r. maxlenappend)ry r r
user_sitesresultmatching_sitesmost_specific_siter s ` @rB site_searchr s #I..J
.
.:
.
.
.F 4 4MMMMM:MMM 4!$^!=!=!= % & - -d 3 3 3 MrA c : K t | |j d {V }| dd }t |j | \ }}}}d } |t j k rt
|||| } t |j }
t |
|d } || | fS )N scan_datec P | d dk o| d | S )N
resource_typefile)
startswith)r r s rB z)_get_scan_data_for_user.. s- 40F: * L # #D ) ) rA ) r% pw_namegetrn rl rm r r& r ) sinkr rd last_scanlast_scan_timeintervalhour day_of_month day_of_weeknext_scan_timemalware_historymalware_by_sites rB _get_scan_data_for_userr s $D)*;<<<<<<<? ::rA semaphorec K |4 d {V | d {V n4# t $ r'}t d| Y d }~nd }~ww xY wd d d d {V d S # 1 d {V swxY w Y d S )NzTelemetry task failed: ) Exceptionrj error)coror es rB _send_telemetry_taskr s+ 8 8 8 8 8 8 8 8 8JJJJJJJJ 8 8 8 LL6166 7 7 7 7 7 7 7 7 88 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8s5 A A
A AA AA
A'*A'
coroutinesc K | sdS t j | fd| D } t j | d{V dS # t $ r(}t d| Y d}~dS d}~ww xY w)zK
Process a list of telemetry coroutines with a concurrency limit.s
Nc T g | ]$}t j t | %S r@ )r\ create_taskr )rt r r s rB r z+process_telemetry_tasks..+ s?
0y A ABB
rA z Some telemetry tasks failed: )r\ Semaphoregatherr rj r )r concurrencytasksr r s @rB process_telemetry_tasksr # s !+..I
E
:ne$$$$$$$$$$ : : : 8Q88999999999:s A
A3 A..A3c p K t t d } | d{V t | }n3# t $ r&}t
d| Y d}~dS d}~ww xY w|s t
d dS t | }||d}t | S )z
Load WordPress rules from the index and format them as PHP.
Returns:
str or None: PHP-formatted rules data, or None if rules could not be loaded.
F)integrity_checkNz>Failed to load wp-rules index: %s, skipping rules installationz>L 9 ; ;;;;;;;H ( - -M&
5
5 dh'..t4444 , 1 1 3 3 \
\
U # S 1 1I ( 0HH LLE
HHHH
2)\ ""# !6h ? ?
! F FD 3D$ ? ??????? ! C%(%?%E%E E E E E E E % "KK Et % %6 * * $ +%-
% % % 4D) D DDDDDDDD 8m L LLLLLLLL " / 5 55555555 D))) ),(>t(D(D"D"D"D"D"D"D" /3| , 0g > > > $(#:#:7#C#CD ,8 ', , ,-= > >,?L
, 2 2 ) 4)- ,8)B(?(?-A)-,3 !" !" !" % I ! CFP
KK@G
% KK+G
LL?
*/:: : : : : : : : :)/:: : : : : : : : : :GC; C; C; C; C; C; C; C; C; C; C; C; C; C; C; C; C; C;s 9P(;1E2/2E!!E22E69E6c K t | | t | d{V | t j |d| | j dS # t $ r'}t d| | Y d}~dS d}~ww xY w)a
Process the manually deleted plugin for a single site.
Args:
site: The site to process.
now: The current time.
sink: The telemetry/event sink.
telemetry_coros: The list of telemetry coroutines to add the event to.
The process includes:
- marking the site as manually deleted in the database
- removing plugin data files
- sending telemetry for manual removal
Nremoved_by_userr z>Failed to process manually deleted plugin for site=%s error=%s) r4 r
r r r r r rj r )r nowr r r s rB r r s
%dC000 "$''''''''' '
L
s AA
B % BB freshly_installed_sitesc d K g } t | }|r0t j }|D ]}t ||| | d{V n2# t $ r%}t d| Y d}~nd}~ww xY w|rt
| d{V dS dS # |rt
| d{V w w xY w)a>
Tidy up sites that have been manually deleted by the user.
Args:
sink: The telemetry/event sink.
freshly_installed_sites: Optional set of sites that were just installed and should be excluded
from being marked as manually deleted to avoid race conditions.
Nz&Error occurred during site tidy up. %s)r1 r r r rj r r )r r r to_mark_as_manually_removedr r r s rB tidy_up_manually_deletedr s> O;&K #'
'
# ' )++C3
5#t_ F F F =uEEEEEEEEF ;)/:: : : : : : : : : : ; ;? ;)/:: : : : : : : : : ;s0 AA B
A7A2-B 2A77B B/r c
K |sd S t }t d {V }t t }|D ]"}||j | #| D ]\ }} t j | }|j }n3# t $ r&} t d|| Y d } ~ Nd } ~ ww xY wt | || d {V \ }
} } t | }
|D ]}t | | d {V r t! |
| ||| | }t# || d {V t% ||
d {V \# t $ r&} t d|| Y d } ~ d } ~ ww xY wd S )Nr r z.Failed to update site data on site=%s error=%s)r
r$ r r r r ry r r r r rj r r r' r r( r r )r r rd r r r r r rR r r r r r r s rB update_data_on_sitesr sQ >>L133333333H %%M - -dh &&t,,,, $))++ + +
U S))I (HH LL=
HHHH
*$ <HH H H H H H H
-h77
D+D$77777777
-"" # %
,D)<<<<<<<<< 0mDDDDDDDDDD
D
' '+ +s1 =B
C # CC AE
F E??Ffilenamedatac K t j | j }|j }t | | d{V }t | }t
||z || j | dS )zKEmbed ``data`` as JSON inside a PHP file at ``/``.Nr gid)r r r pw_gidr" r# r) )r r! r" r r% r php_contents rB _write_json_php_data_filer( s TX&&I
C/i@@@@@@@@H/55K%8[dhC rA r c 8 K t | d| d {V d S )N
scan_data.phpr( )r r s rB r r s0
#D/9
E
EEEEEEEEEErA r c 8 K t | d| d{V dS )z
Write plugin_config.php for a single WordPress site.
Separate file from scan_data.php so a config toggle doesn't force
rewriting the malware list, and so the mu-plugin hot path loads
only what it needs per request.
plugin_config.phpNr+ )r r s rB r r s3 $D*=}
M
MMMMMMMMMMrA c " K | sdS d}t t }| D ]"}||j | #| D ]\ }} t j | }|j }n3# t $ r&}t
d|| Y d}~Md}~ww xY wt | } |D ]Q} t || d{V |dz
} # t $ r&}t
d|| Y d}~Jd}~ww xY w|S )us
Rewrite plugin_config.php on every managed site in one pass.
Used by the ConfigUpdate handler that reacts to
WORDPRESS.ai_bot_protection toggles. Writes only plugin_config.php
— scan_data.php is untouched, so a toggle doesn't churn the
(potentially large) malware payload or wait on a scan cycle.
No sink is needed: unlike update_data_on_sites we emit no
telemetry here — the per-site write loop just needs local file
I/O plus the process-level logger for errors.
Returns the number of sites successfully updated so the caller
can decide whether to advance its cached state.
r r Nrg z6Failed to update plugin_config.php on site=%s error=%s)
r r r r ry r r r r rj r r' r )
r r r r r r r rR r r s
rB update_plugin_config_on_sitesr/ s qG
.9->->M - -dh &&t,,,,(..00 Z S))I (HH LL=
HHHH
.h77
D
/mDDDDDDDDD1
L
Ns0 A88
B( B##B(?C
D % DD wp_rules_phpr failedc K |j } t | | d{V }|dz }t ||| j | | | t
d| j dS # t $ rA}| | t
d| j | Y d}~dS d}~ww xY w)a=
Deploy wp-rules to a single WordPress site and track the result.
Args:
site: WordPress site to deploy to
user_info: User information from pwd
wp_rules_php: Formatted PHP rules content
updated: Set to add site to if successful
failed: Set to add site to if failed
N rules.phpr$ z Updated wp-rules for site %sz)Failed to update wp-rules for site %s: %s)
r& r" r) r r rj r docrootr r ) r r r0 r r1 r% r
rules_pathr s rB update_wp_rules_for_siter6 V s "
C
3D)DDDDDDDD +
) $(
D 2DLAAAAA
4 7 L
s A(A5 5
C ?6B;;C make_task task_name fingerprintskip_waf_disabledc K t }t }t j | 5 t j }t t } | D ]"}
| |
j |
#g } | D ]+\ } }
t j | }|j }nW# t $ rJ}t d|t |
| |ddd| |
D ]}
| |
Y d}~rd}~ww xY w|rr t# | d{V }n/# t $ r" t$ d|d d}Y nw xY w|s*t$ d
|t |
|
D ]:}
t+ ||
d{V r| ||
||| ;-d }t- d t | | D ]&}| |||z }t/ j |d
di d{V 't j |z
}t$ d|t | t | | nh# t. j $ r, t$ d|t | Y n.t $ r"}t$ d|| d}~ww xY wddd dS # 1 swxY w Y dS )a6
Run a per-site async deployment over a list of WordPress sites.
Groups sites by user, resolves UIDs, then runs tasks concurrently
in batches.
Args:
sites: WordPress sites to deploy to
make_task: Callable that creates a coroutine for one site.
Signature: (site, user_info, updated_set, failed_set) -> awaitable
task_name: Human-readable name for logging and inactivity tracking
fingerprint: Sentry fingerprint for user-lookup failures
sink: Optional telemetry sink for remove_site_if_missing
zwSkipping {task} update for {count} site(s) belonging to user {user} because username retrieval failed. Reason: {reason})r countuserreasonr wordpress format_argslevel componentr9 NBCould not check WAF status for user %s, proceeding with deploymentTexc_infoz-WAF disabled for user %s, skipping %d site(s)r r return_exceptionsz@%s deployment complete. Updated: %d, Failed: %d, Duration: %.2fsz-%s deployment was cancelled. Updated %d sitesz-Error occurred during %s deployment. error=%s)rz r r r r r r r r ry r r r r r r r r` rj r r r ranger\ r r r )r r7 r8 r9 r: r r r1
start_timer r r r r r rR r rU max_concurrentibatchelapseds rB _deploy_to_sitesrN z s 0 eeG
UUF y ) ) S SR J ' - -M
5
5 dh'..t4444E#0#6#6#8#8 -
N -
NZ # S 1 1I ( 0HH > %.%(__$'&+ % % ("-$/
!+ ) )
4(((( HHHH# & % ! +,CH,M,M&M&M&M&M&M&M $ + + + : $%) ' '+ + ' ! K $
OO
! & N ND 3D$ ? ??????? ! LL4GV!L!LMMMMN
N1c%jj.99
E
E a!n"4 45 neDtDDDDDDDDDDikkJ.G KK#G F
% KK?G
LL?
[S S S S S S S S S S S S S S S S S Ss K A(I%)CI%
DA DI%DI% D54I%5)E! I% E!!DI%$K%8K
K K
( KK
KK !K c K t t }|s t d dS fd}t ||ddd| d{V dS )zHDeploy pre-formatted wp-rules PHP content to all active WordPress sites.z No active WordPress sites foundNc * t | ||| S r; )r6 )r r r r1 r0 s rB r7 z'_deploy_wp_rules_php..make_task s ' )\7F
rA zwp-ruleszwp-rules-update-skip-userTr8 r9 r: r )r r2 rj rk rN )r0 r installed_sitesr7 s ` rB _deploy_wp_rules_phprS s NNN)++O 6777
/
rA
is_updatedc K t j s t d dS |s t d dS t d t | }|s t d dS t
| }||d}t | }t | d{V dS )z
Hook that runs when wp-rules files are updated.
Extracts wp-rules.yaml from wp-rules.zip and deploys to all active WordPress sites.
Args:
index: Index object for wp-rules
is_updated: Whether files were actually updated
zCwordpress security plugin not enabled, skipping wp-rules deploymentNz)wp-rules not updated, skipping deploymentz/Starting wp-rules deployment to WordPress sitesz,No valid wp-rules found, skipping deploymentr ) r SECURITY_PLUGIN_ENABLEDrj r r} r r r# rS )ro rT r r r r0 s rB update_wp_rules_on_sitesrW s ,
?@@@
KKABBB-e44M CDDD .e44# L 1 >>L
|
,
,,,,,,,,,,rA c ` K t j s t d dS t r dat d dS t 4 d{V dat d t d{V } | s.t d ddd d{V dS t | d{V t snt d ddd d{V dS # 1 d{V swxY w Y dS ) aN
Re-deploy rules.php to all WordPress sites.
Used when globally disabled rules change, requiring rules.php
to be regenerated with updated rule filtering.
Uses a coalescing lock: if a redeployment is already running,
the request is merged into the current run rather than starting
a duplicate deployment.
zEwordpress security plugin not enabled, skipping wp-rules redeploymentNTz5wp-rules redeployment already in progress, coalescingFz6Starting wp-rules redeployment (global disable change)z(Could not load wp-rules for redeploymentz4Re-running wp-rules redeployment (coalesced request))
r rV rj r _redeploy_wp_rules_locklocked_redeploy_wp_rules_pendingr r rS )r0 s rB redeploy_wp_rulesr\ / sS ,
%%'' %)" KLLL& P P P P P P P P P). & KKH
"3!4!4444444L
IJJJP P P P P P P P P P P P P P '|44 4 4 4 4 4 4 4-
KKN O O O! P PP P P P P P P P P P P P P P P P P P P P P P P P P P P P P Ps /AD 8D
D'*D'c K t j }| D ]} t j | d{V }|dz }| d|j d{V rG| dt j | d{V t d|j
# t $ r+}t d|j
| Y d}~d}~ww xY wdS )z&Remove rules.php from the given sites.Nr3 z(Removed rules.php from %s (WAF disabled)z&Failed to remove rules.php from %s: %s)
r\ r] r r r^ r r removerj r r4 r r )r r_ r r r5 r s rB _remove_rules_php_from_sitesr_ \ s/ # % %D
-d 3 3333333H!K/J))$
0ABBBBBBBB
**4JGGGGGGGGG >L LL8$,
s BB##
C-!CCc K t j sdS t j } | dt
j | d{V n,# t $ r t d| Y dS w xY wt d{V }|s t d dS | dt d{V }fd|D }|sdS t }t }|D ]}t |||| d{V t d| t | t | dS )z?Redeploy rules.php only for sites belonging to a specific user.Nz.User %s not found, skipping WAF rules redeployz)Could not load wp-rules for user redeployc 4 g | ]}|j j k |S r@ r pw_uidrt sr s rB r z.redeploy_wp_rules_for_user.. ( @@@aey/?&?&?!&?&?&?rA z6Redeployed wp-rules for user %s: %d updated, %d failed)r rV r\ r] r^ r getpwnamr> rj r r r2 rz r6 r r ) rR r_ r0 r r r r1 r r s @rB redeploy_wp_rules_for_userrh o s , # % %D ..tS\8LLLLLLLL . rf rA )
r\ r] r^ r rg r> rj r r2 r_ )rR r_ r r r s @rB remove_waf_rules_for_userrk s # % %D ..tS\8LLLLLLLL ;X
&&t-@AA A A A A A AE@@@@U@@@J
&z
2
2222222222s 'A %A)(A)c K t j } | dt d{V }t dt
| t | d{V dS )z?Remove rules.php from all installed sites (global WAF disable).Nz7Global WAF disabled, removing rules.php from %d site(s))r\ r] r^ r2 rj r r r_ )r_ r s rB remove_waf_rules_for_all_sitesrm s # % %D&&t-@AA A A A A A AE
KKA E
'u
-
----------rA c 6 K t j sdS t r dat
d dS t 4 d{V dat s ddd d{V dS t } t j
d{V }t j
}|D ]} | dt | d{V r&| rt! | d{V nt# | d{V T# t$ $ r&}t
d|| Y d}~d}~ww xY wt sn t
d ddd d{V dS # 1 d{V swxY w Y dS )zMRedeploy/remove rules.php for users without an explicit waf_enabled override.NTz2waf_default change already in progress, coalescingFz2Failed to apply waf_default change for user %s: %sz1Re-running waf_default change (coalesced request))r rV _apply_waf_default_lockrZ _apply_waf_default_pendingrj r rC rH r HostingPanel get_usersr\ r] r^ rc rh rk r r ) new_default usernamesr_ rR r s rB apply_waf_default_changeru s , %%'' %)" HIII& M M M M M M M M M). &*,,
M M M M M M M M M M M M M M +,,K + 8 : : D D F FFFFFFFI+--D %
! 1 1 < !
!" B 8 B BBBBBBBBB 7 A AAAAAAAA NNL .
KKK L L L? M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M MsO F;AF "D .F/-D F
E
' EFE
'F
FFdomain timestampc p t j | d }|t | d}t | S )a|
Generate the disabled-rules.php content for a specific domain.
Only includes domain-specific disabled rules. Globally disabled rules
are handled separately by filtering them out of rules.php.
Args:
domain: The domain to generate disabled rules for
timestamp: Unix timestamp to embed in the file
Returns:
PHP file content string
F)include_global)tsr )r get_domain_disabledsortedr# )rv rw disabled_rule_idsr" s rB generate_disabled_rules_phpr~ sN ':u )** D ) . ..rA c J K |j } t | | d{V }|dz }t | j | }t ||| j | t
j | t j | j k
| | t
d| j dS # t $ rA} | | t d| j | Y d} ~ dS d} ~ ww xY w)a[
Deploy disabled-rules.php to a single WordPress site and track the result.
Args:
site: WordPress site to deploy to
user_info: User information from pwd
timestamp: Unix timestamp for both file content and DB record
updated: Set to add site to if successful
failed: Set to add site to if failed
Ndisabled-rules.phpr$ disabled_rules_sync_tsz"Updated disabled-rules for site %sz/Failed to update disabled-rules for site %s: %s)r& r" r~ rv r) r r r wherer4 executer rj r r r )
r r rw r r1 r% r disabled_rules_pathr' r s
rB update_disabled_rules_for_siter sO "
C
3D)DDDDDDDD &)= =1$+yII ) $(
I>>>DD !T\ 1
'))) D 8$,GGGGG
4 = L
s C
C
D"!6D D"domainsc b K t j s t d dS t d t | rt | }nt
}|s t d dS d }t ||ddd| d{V dS )
ai
Deploy disabled-rules.php to WordPress sites.
If domains are specified, only updates sites for those domains.
If domains is None, updates all installed sites (e.g., after a global
disable/enable).
Args:
domains: List of domains to update, or None for all sites
sink: Optional telemetry sink for remove_site_if_missing
zIwordpress security plugin not enabled, skipping disabled-rules deploymentNz5Starting disabled-rules deployment to WordPress sitesz6No WordPress sites found for disabled-rules deploymentc J t | |t j || S r; )r r )r r r r1 s rB r7 z1update_disabled_rules_on_sites..make_taskC s% - )TY[['6
rA zdisabled-rulesz disabled-rules-update-skip-userTrQ )r rV rj r r r, r2 rN )r r r r7 s rB update_disabled_rules_on_sitesr s ,
KKGHHHNNN &.w77#%% LMMM
"5
rA c
K t d t }t }t j d 5 t
t }|s(t d ddd dS t t }|D ]"}||j
| #g }| D ]\ }} t j | } n<# t $ r/}
t! dt# | ||
dddd
Y d}
~
Od}
~
ww xY w|D ]@}t% | | d{V rt' || || } | | Ad } t) d t# | | D ]&}
||
|
| z }t+ j |d
di d{V 't dt# | t# | nf# t* j $ r+ t dt# | Y n-t $ r!}
t d|
d}
~
ww xY wddd dS # 1 swxY w Y dS )z7Update auth.php files for all existing WordPress sites.z4Updating auth.php files for existing WordPress siteszwp-auth-updatez"No installed WordPress sites foundNzSkipping auth update for WordPress sites on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}r< r= r> r r? z wp-plugin-auth-update-skip-userr@ r r rG Tz8Updated auth.php files for %d WordPress sites, %d failedzLAuth update for WordPress sites was cancelled. Auth was updated for %d sitesz+Error occurred during auth update. error=%s)rj r rz r r r r r2 r r r r ry r r r r r r update_site_authrH r\ r r r )r r r1 rR r r r r r r r r rJ rK rL s rB update_auth_everywherer R s
KKFGGGeeG
UUF / 0 0 @ @? NNN 2 3 3O"
@AAA@ @ @ @ @ @ @ @ ( - -M'
5
5 dh'..t4444 E + 1 1 3 3
'
'
U # S 1 1II D
&)ZZ$'&+% %
("-$E
HHHH " " ' 'D 3D$ ? ??????? ! +D)WfMMDLL&&&& ' N1c%jj.99
E
E a!n"4 45 neDtDDDDDDDDDD KKJG F
% KK(G
LLF N N N }@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @st I;8H AH5D
H
E%D>9H>ECHI;7I+?I; I+
I&&I++I;;I?I?c K t | | d{V | | dS # t $ r<}| | t d| | Y d}~dS d}~ww xY w)z/Process authentication setup for a single site.Nz*Failed to update auth for site=%s error=%s)r7 r r rj r )r r r r1 r s rB r r s
'i888888888 D
4 8
s +1
A71A22A7c . K t j |j rdS t | }|dk r&| #t j | d||j d{V n1t d| t dd|id d
d d
S )a
Checks if the site directory exists. If not, removes the site from the local database and sends a 'site_removed' telemetry event only if deletion is successful.
Returns True if the site was removed (directory missing), False otherwise.
Parameters:
sink: The telemetry/event sink.
site: The WPSite object to check and potentially remove.
Side effect: If the site is missing and successfully deleted from database, a telemetry event will be sent.
Fr N site_removedr z@Failed to delete missing site %s from database, no rows affectedz2Failed to delete missing site {site} from databaser r r? z wp-plugin-site-delete-failedr@ T) r r isdirr4 r+ r r r rj r r )r r rows_deleteds rB r r s
w}}T\"" u t$$L a &$
N
@ !6
4rA file_permissionsc K t j | d{V } t | }nC# t $ r6}|j t j t j t j fv rY d}~dS d}~ww xY w t j | j
dz }|dk rt j |d dD ]} t || 5 }t j
| }|j
dz |k rt j || ddd n # 1 swxY w Y d# t $ r Y pt $ r<}|j t j k r!t d|| Y d}~ d}~ww xY w t j | n# t j | w xY wdS # t$ $ r'} t d | | Y d} ~ dS d} ~ ww xY w)
z6Fix data file permissions for a single WordPress site.NFi i )r* r- zauth.phpr3 r r z"Skipping chmod: %s/%s is a symlinkTz.Failed to fix permissions for site=%s error=%s)r r r r r r r r r statst_modechmodr fstatFileNotFoundErrorrj r r r r )
r r r r r current_dir_mode file_namefile_fdstr s
rB fix_site_data_file_permissionsr s{ 1 )$//////// )(33FF yU\5;
FFF uuuuu
!wv 6 > 5(('''
&y@@@ @G Xg . . :-1AAA HW.> ? ? ?@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ ) H yEK// @ $ %
!
0
HV BHV t <
uuuuu
s F / F
A/*A*#F )A**A//F 3;E: /D 8D8 DD D D DE:
E!E: E!%1E E: E E!!E: %F :FF
G GGc \ K t }t }t j d 5 t t }|s ddd dS ddlm} ddlm } | j
|j
k rdnd}|D ]\}t | | d{V rt || d{V }|r|
| G|
| ]t dt! | t! | nj# t" j $ r+ t d t! | Y n1t& $ r%} t d
| Y d} ~ nd} ~ ww xY wddd dS # 1 swxY w Y dS ) z
Fix data file permissions for all WordPress sites with imunify-security plugin installed.
Args:
sink: The telemetry/event sink
zwp-plugin-fix-permissionsNr )rq )Pleski z=Fixed data file permissions for %d WordPress sites, %d failedzOFixing data file permissions was cancelled. Permissions were fixed for %d sitesz1Error occurred during permission fixing. error=%s)rz r r r r r2 +defence360agent.subsys.panels.hosting_panelrq #defence360agent.subsys.panels.pleskr NAMEr r r rj r r r\ r r r )
r fixedr1 rR rq r r r successr s
rB $fix_data_file_permissions_everywherer s
EEE
UUF : ; ; 0 0/ NNN 2 3 3O"
0 0 0 0 0 0 0 0
B A A A A A & ,
::
(
%
%/d;;;;;;;; >*! ! %IIdOOOOJJt$$$$ KKE
F
% KK&E
LLCU
[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0sN F! D*,B=D*)F!*7F!F!# F,F F! FF!!F%(F%c d e Zd ZdZdZdZdZdZdddd d
d d d
Zd Z d Z
d Z d Z de
ddfdZd ZdS )r z
Handles installation of imunify-security plugin on WordPress sites.
This class processes WordPress sites and installs the imunify-security
plugin, including setting up authentication, scan data files, and rules.
Tinstalled_by_imunifyzwp-plugin-installationzwp-plugin-install-skip-userz%Installing imunify-security wp pluginz5Installed imunify-security wp plugin on {count} sitesz&Found {count} site(s) for installationz5Failed to install plugin to site={site} error={error}z`Installation of imunify-security wp plugin was cancelled. Plugin was installed for {count} sitesz8Error occurred during plugin installation. error={error}zSkipping installation of WordPress plugin on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}startcompletefoundr cancelled exception skip_userc H || _ || _ t | _ t | _ t | _ t | _ t | _ t | _ d | _ t | _
d | _ d S r; ) r r rz processed
authenticatedrules_installedfailed_rules_updatesdisabled_rules_installed failed_disabled_rules_updatesdisabled_rules_ts failed_auth
_current_site)selfr r s rB __init__z WordPressSiteInstaller.__init__h sy
UU "uu $'EE!(+%-0UU*/3 55,0rA c K t j | d{V }|s3t d| t dd|iddd d S d
S ) a
Check if site is ready for processing.
Override in subclasses to implement different readiness checks.
Args:
site: The WordPress site to check.
Returns:
bool: True if the site is ready for processing, False otherwise.
Nz6WordPress site is not accessible using WP CLI. site=%sz:WordPress site is not accessible using WP CLI. site={site}r r r? z wp-plugin-cli-not-accessibler@ FT)r r rj r r )r r r s rB
is_site_readyz$WordPressSiteInstaller.is_site_readyu s (+'A$'G'G!G!G!G!G!G!G % NNH
L #TN % :
5trA c | j | t |h | | dS )u
Record a successfully processed site and persist it to the database.
Each site is inserted immediately so that it is tracked in the DB
at all times — even if the overall installation loop is cancelled
mid-run.
Override in subclasses to implement different recording logic.
Args:
site: The WordPress site that was processed.
version: The plugin version installed on the site.
N)r r r3 _stamp_disabled_rules_sync_tsr r r s rB _record_processed_sitez-WordPressSiteInstaller._record_processed_site sD
4 v&&& **400000rA c K | j }d| _ t | d{V n3# t $ r&}t d|| Y d}~nd}~ww xY w| j r t
j | d{V dS dS )a Revert the site that was mid-processing when cancellation occurred.
Deletes data files and, if this processor installs plugins,
attempts to uninstall the partially-installed plugin.
Each step runs independently so one failure doesn't skip the other.
Nz5Failed to delete data files for in-flight site %s: %s)r r
r rj r install_pluginr try_plugin_uninstall)r r r s rB _revert_in_flight_sitez-WordPressSiteInstaller._revert_in_flight_site s ! ! %d++ + + + + + + + + NNG
1*400 0 0 0 0 0 0 0 0 0 1 1s (
A AAr r9 Nc || j vrdS | j dS t j | j t j |j k dS )z
Stamp disabled_rules_sync_ts for a single site after it has been
inserted into the DB.
Called from ``_record_processed_site`` so the DB row already exists.
Nr )r r r r r r4 r )r r s rB r z4WordPressSiteInstaller._stamp_disabled_rules_sync_ts se t4 4 4 F ! ) F #'#9
%
% 5
6
6wwyyyyyrA c
K t | j d g }t j | j 5 t | j s{t d | j |rLt j |ddi d{V }|D ]2}t |t rt d| 3cddd S t | j d t! | j t# }t% d{V }t' j | _ t+ d{V }t- t. }| j D ]"}||j | #| D ]&\ } }
t7 j | } | j } nL# t $ r?}
t= | j d t! |
| |
d
d d | j
Y d}
~
gd}
~
ww xY w tA | d{V }n/# t $ r" t d| d d}Y nw xY w|s)t d| t! |
tC | j" | | d{V \ }}}tG | }|
D ]}tI | j" | d{V r | % | d{V s<|| _& tO ||| ||| }tQ || d{V tS || d{V tU || | j+ | j, d{V |r%|r#t[ || || j. | j/ d{V |r(ta || | j | j1 | j2 d{V | j3 rti j5 | d{V ti j6 | d{V }|rto j8 || }| 9 || d| _& | t j: tw j< | j" | j= || # t $ rY}
d| _& t > | j d |t |
Y d}
~
d}
~
ww xY w(t | j d t! | j | j, r-t dt! | j, | j/ r-t dt! | j/ | j2 r-t dt! | j2 n# t j@ $ ro | j& r| A d{V t | j d t! | j Y nXt $ rL}
t > | j d t |
d}
~
ww xY w|rLt j |ddi d{V }|D ]2}t |t rt d| 3nT# |rLt j |ddi d{V }|D ]3}t |t rt d| 3w w xY wddd n # 1 swxY w Y | j S ) z
Process WordPress sites for imunify-security plugin operations.
Returns:
set: The set of successfully processed sites.
r z'No WordPress sites found, nothing to dorG TNz Failed to send telemetry: %sr )r< r r r r? r@ rD rE zFWAF disabled for user %s, skipping WAF rules deployment for %d site(s)r r r )r r r z Failed to authenticate %d sitesz&Failed to install wp-rules on %d sitesz,Failed to install disabled-rules on %d sitesr r )r )Brj r messagesr r r r8 r r r r\ r
isinstancer r formatr r
r r r r$ r r r r ry r r r r log_fingerprint_skip_userr` r r r' r r r r( r r r r r r6 r r r r r r r plugin_installr r r r r r r telemetry_eventr reprr r )r telemetry_tasksresultsr rd r0 r r r r r r rR r rU r r r r r r s rB r zWordPressSiteInstaller.run s<
DM'*+++
"
"4>
2
2 I I H
z *KK IJJJ >v # $+N(%<@% % G #* %fi88 "NN > OI I I I I I I I M'*11DJ1HH
,~~ &7%8%8 8 8 8 8 8 8 *.&!=!?!??????? !,D 1 1
J 9 9D!$(+2248888 #0"5"5"7"7 A A JC!$'L$5$5 #,#4$ ! ! !# M+ 6),U(+*/) )
#,&1(,(F
! ! +,CH,M,M&M&M&M&M&M&M $ + + + : $%) ' '+ + ' ? $ JJ 6 9l &&' %:($C$CM % T T !7 4!H!HHHHHHH % $P )-););D)A)A#A#A#A#A#A#A ) (15D . ): . . ( $ /)1
) ) ) I #8i"H"H H H H H H H H"; $m# # #3 $ ) $ 2 $ 0 # # , " "&>$($-$0$($8$($= '" '" !" !" !" !" !" !" !" + "&D$($-$($:$($A$($F '" '" !" !" !" !" !" !" !" $ 2 ?&)&8&>&> > > > > > > > -0,B4,H,H&H&H&H&H&H&HG & P'-'@w'O'O ! 7 7g F F F15D . + 2 2 ' 3$-$8-1Y.2.B-107 %& %& %&!" !" ) 15D . "LL $
g 6 = =)-T%[[ !> !" !" ]T j M*-443t~;N;N4OO # NN9D ,-- , NN@D 566 5 NNFD >??
)
% 8 55777777777 M+.55 !$. 1 1 6
M+.55DKK5HH
# $+N(%<@% % G #* %fi88 "NN >
# $+N(%<@% % G #* %fi88 "NN >
KI I I I I I I I I I I I I I I V ~ s ] 5WA] C1WG.-W.
H785H2-W2H77W;IW)I=:W<I==A>W<R WE1R W
S. AS) #W)S. .C,W[?A;Z-[? Z-!AZ((Z--[?0A] ?A]] ]#&]#)__name__
__module__ __qualname____doc__r r r8 r r r r r r r r r r@ rA rB r r H s N,O(I = 8K9H
5
G
7 H( 1 1 1 81 1 1$1 1 1(
A&
AT
A
A
A
A U U U U U rA r c V e Zd ZdZdZdZdZdZdddd d
d d d
Z fdZ d Z
fdZ xZ S )r z
Handles adoption of existing WordPress sites with imunify-security plugin.
Adoption is a special case of installation where the site already has
the plugin installed but is not tracked in our database.
F
site_foundzwp-plugin-adoptionzwp-plugin-adopt-skip-userz#Adopting imunify-security wp pluginz3Adopted imunify-security wp plugin on {count} sitesz"Found {count} site(s) for adoptionz3Failed to adopt plugin to site={site} error={error}zZAdoption of imunify-security wp plugin was cancelled. Plugin was adopted for {count} sitesz4Error occurred during plugin adoption. error={error}zSkipping adoption of WordPress plugin on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}r c t || d t j t j D | _ d S )Nc h | ] }|j
S r@ )r4 )rt rs rB z0WordPressSiteAdopter.__init__.. s' "
"
"
AI"
"
"
rA )superr r selectr4 existing_docroots)r r r __class__s rB r z WordPressSiteAdopter.__init__ sR
u%%%"
"
, 3M4I J J"
"
"
rA c | j | |j | j v r1t | t | |rt
|| nt |h | | dS )a
Record a successfully adopted site and persist it immediately.
For adoption, sites that already exist in the database (flagged as
manually deleted) have their flag cleared. New sites are inserted
into the database right away.
Args:
site: The WordPress site that was processed.
version: The plugin version installed on the site.
N) r r r4 r r* r5 r6 r3 r r s rB r z+WordPressSiteAdopter._record_processed_site s
4 <41 1 1 ' - - - & & &
3#D'222 "D6 * * * **400000rA c K t | d{V sdS t j | d{V }|s t d| dS dS )z
Check if site is ready for adoption.
Args:
site: The WordPress site to check.
Returns:
bool: True if the site is ready for adoption, False otherwise.
NFz2Plugin not installed on site %s, skipping adoptionT)r r r r
rj r )r r r r s rB r z"WordPressSiteAdopter.is_site_ready s WW**400000000 5 ! 4T : ::::::: NND
5trA )
r r r r r r r8 r r r r r
__classcell__)r s @rB r r s N"O$I ; 6I5F
3 L
7 H$
1 1 1. rA r )r r; )FN)r9 N)NN)r\ r loggingr r r collectionsr collections.abcr r distutils.versionr pathlibr defence360agent.apir defence360agent.contracts.configr rl r
r r r
defence360agent.filesr r defence360agent.sentryr defence360agent.utils.fd_opsr r r r r defence360agent.subsys.panelsr "defence360agent.wordpress.wp_rulesr r defence360agent.model.wordpressr r &defence360agent.model.wp_disabled_ruler defence360agent.wordpressr r #defence360agent.wordpress.constantsr defence360agent.wordpress.utilsr r r! r" r# r$ r% r& r' r( r) )defence360agent.wordpress.site_repositoryr* r+ r, r- r. r/ r0 r1 r2 r3 r4 r5 r6 $defence360agent.wordpress.proxy_authr7 getLoggerr rj r? Lockro rp rK rO r< rC rH rL strrQ rZ r` rc COMPONENTS_DB_PATHrn dictr} r
struct_passwdr r r r r r r r r r r r
intr r r rz r r r( r r r/ r6 rN rS rW rY r[ r\ r_ rh rk rm ru floatr~ r r r r r r r r r r@ rA rB r s
# # # # # # / / / / / / / / * * * * * * * * * * * * 2 1 1 1 1 1 1 1 . . . . . . 7 6 6 6 6 6 7 7 7 7 7 7 B A A A A A A A A A A A A A 4 4 4 4 4 4 4 4 C C C C C C K J J J J J 8 $ $
&',.. " # $. !$ $ $ $ $$$ $ $ $ $ *t * * * * !c ! ! ! !" C D C D #3 #4 # # # # TJ
& &< & & & &&"U "td{ " " " "J& & &
t
(9
t
;& ;6B ; ; ; ;F80A 8 8 8 8: :d : : : :& 7 7 7B! ! !
!
!
! 3 Q; Q; Q;h F >) )# ) ) ) )X"; "; ";J$
$
$
P 26; ;#&v;; ; ; ;<:DL : : : :z
'+
Ff F F F F FN& N N$ N N N N5tF| 5 5 5 5 5p!
!
!
!
!
!
!
!
!
!
V $
n n <n "C-y>n
n
n n
n n n nb S 0#-% #-T #-d #- #- #- #-L '',.. # *P *P *P *PZd6l t &$s $t $ $ $ $N
3c
3d
3
3
3
3 . . . .,M ,M ,M ,M^/ / /# / / / /0%
%
%
%
%
%
%
%
%
%
R !%
/ /
#Y
/
/ / / /dG G G GT
&V & & & & &R5
5$'5 5 5 5 5p: : :zS S S S S S S S l
R R R R R1 R R R R RrA