%W&P3 d Z ddlmZ ddlZddlZddlmZmZmZm Z m
Z
m Z ddl m
Z
mZ ej e Z G d de
ZdS )a WordPress-specific disabled rules data model.
This module provides a separate data model for WordPress disabled rules,
independent of the existing DisabledRule/DisabledRuleDomain models used
by modsec/ossec plugins.
Disable Behavior:
Global and domain-level disables are independent and can coexist.
A rule is considered effectively disabled for a given WordPress domain
if EITHER of these conditions is true:
- A global disable exists for the rule (applies to all domains)
- A domain-specific disable exists for the rule and that domain
Enabling a rule at one scope does not affect disables at the other scope.
For example, removing a global disable leaves any domain-specific disables
intact, and vice versa.
)IteratorN) CharField
FloatField IntegerFieldIntegrityErrorPrimaryKeyFieldfn)Modelinstancec e Zd ZdZ G d d Z e Z ed Z ed Z ed Z
e d Z ed Z
ed ZdZdZd Zd
Ze d$d ed
ee d z dededed z def d Zed ededededef
d Zed ed
ee dedededef d Zed ededed z dededede fd Z ed ed
ee d z defd Z ed$d eded z de fd Z e d%dede dee fd Z ede!e fd Z"ed ee d z de fd Z#e d&d!ed"ed ee d z de de$eee% f f
d# Z&d S )'WPDisabledRulezStores disabled WordPress protection rules.
Uses a scope-based design:
- scope='global', scope_value=NULL: Rule disabled for all domains (root only)
- scope='domain', scope_value='example.com': Rule disabled for specific domain
c $ e Zd Zej ZdZdZdS )WPDisabledRule.Metawp_disabled_rules)))rule_idscope scope_valueTN)__name__
__module__ __qualname__r dbdatabasedb_tableindexes [/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/wp_disabled_rule.pyMetar - s ;&@r r F)nullTglobaldomain wordpressagentNr domainssourceuser_id timestampreturnc |t j }|r| ||||| S | |||| S )a>
Disable a rule globally or for specific domains.
Args:
rule_id: The rule identifier (e.g., "CVE-2025-001")
domains: List of domains to disable for, or None/empty for global disable
source: Origin of the action ("wordpress" or "agent")
user_id: UID of the user performing the action (0 for root)
timestamp: Unix timestamp for when the rule was disabled.
If None, uses current time.
Returns:
Number of new entries created (0 if all were no-ops).
)time_disable_for_domains_disable_globally)clsr r$ r% r& r' s r storezWPDisabledRule.storeH s\ . I ++)VW
$$WiIIIr c | || j d||| }|r t d||| t | S )zADisable a rule globally (independent of domain-specific entries).Nr r r disabled_atr% r& z1Disabled rule %s globally (source=%s, user_id=%s))_create_if_not_exists SCOPE_GLOBALloggerdebugint)r- r r' r% r& createds r r, z WPDisabledRule._disable_globallyh sm ++" !
,
LLC
7||r c d}|D ]G}| || j |||| }|r#|dz
}t d|||| H|S )zBDisable a rule for specific domains (independent of global state).r r0 z6Disabled rule %s for domain %s (source=%s, user_id=%s))r2 SCOPE_DOMAINr4 r5 ) r- r r$ r' r% r& countr! r7 s r r+ z#WPDisabledRule._disable_for_domains s F// & " %
0 G
L r r r r1 c | |||||| dS # t $ r Y dS w xY w)z
Create a new disabled rule entry if it doesn't already exist.
Returns:
True if a new entry was created, False if it already existed (no-op)
)r r r r1 r% created_by_user_idTF)insertexecuter )r- r r r r1 r% r& s r r2 z$WPDisabledRule._create_if_not_exists sc JJ ' ' #*
giii4 55 s -1
??c |so| | j |k | j | j k }|rt d| n| | j |k | j | j k | j
| }|r t d|| |S )a
Re-enable a rule globally or for specific domains.
Args:
rule_id: The rule identifier
domains: List of domains to enable for, or None/empty to enable globally
Returns:
Number of rows deleted
zEnabled rule %s globallyz Enabled rule %s for %d domain(s)) deletewherer r r3 r? r4 r5 r: r in_)r- r r$ r; s r removezWPDisabledRule.remove s
K7*I!11
B 7AAA
K7*I!11O''00
6
r c |Q| | j |k | j | j k S | | j |k | j | j k | j | j k | j |k z z S )a"
Check if a rule is disabled globally or for a specific domain.
Args:
rule_id: The rule identifier
domain: The domain to check. If None, only checks global disable.
Returns:
True if the rule is disabled, False otherwise
)selectrB r r r3 existsr: r )r- r r! s r is_rule_disabledz WPDisabledRule.is_rule_disabled s >
K7*I!11
JJLL
U w&Y#"22 c&66 ?f46 VXX
r include_globalc ~ |rk| | j | j | j k | j | j k | j |k z z }nE| | j | j | j k | j |k }d |D S )a
Get all rule IDs that are disabled for a specific domain.
Args:
domain: The domain to get disabled rules for
include_global: If True, also include globally disabled rules.
If False (default), only return domain-specific disables.
Returns:
List of rule IDs that are disabled for the domain
c g | ] }|j
S r r .0rows r
z6WPDisabledRule.get_domain_disabled../ s --- ---r )rF r rB r r3 r: r distinct)r- r! rI querys r get_domain_disabledz"WPDisabledRule.get_domain_disabled s
3;''Y#"22 c&66 ?f46
E JJs{++11 S --6) E .-u----r c | | j | j | j k }d |D S )z
Get all rule IDs that are disabled globally.
Returns:
Iterator of globally disabled rule IDs
c 3 $ K | ] }|j V d S NrL rM s r z5WPDisabledRule.get_global_disabled..: s$ -- ------r )rF r rB r r3 )r- rR s r get_global_disabledz"WPDisabledRule.get_global_disabled1 sC
3;''--ci3;K.KLL--u----r user_domainsc |B| j | j k | j | z }|r| j | j k |z S |S |s| j | j k S dS )z
Build the WHERE condition for filtering rules.
Returns:
A Peewee expression for the WHERE clause, or None if no filter needed.
N)r r: r rC r3 )r- rY rI domain_matchs r _build_filter_conditionz&WPDisabledRule._build_filter_condition< st # I)9 9##L11 L
F S%55 EE 19 00 0tr r limitoffsetc | || }| | j | j t j | j }|| | }|
}d | | | D }|s|g fS | | j
| } || | } i }
| D ]z} | j |
vr| j dg d|
| j < | j | j k rd|
| j d< ?| j | j k r+|
| j d | j {g } |D ]7}
|
|
}t' |d |d< | | 8|| fS )a>
List disabled rules with aggregation by rule_id.
Multiple domain entries for the same rule are aggregated into a single
result with a list of domains. Results are ordered by most recently
disabled first (using the latest disabled_at timestamp per rule_id).
Uses a two-pass approach for efficiency:
1. First pass: Get rule_ids ordered by latest disabled_at with pagination
2. Second pass: Fetch only rows for the paginated rule_ids
Args:
limit: Maximum number of rules to return
offset: Number of rules to skip
user_domains: If provided, only return rules for these domains.
If None, return all rules (for root users).
include_global: Whether to include global rules in the result
Returns:
Tuple of (total_count, list of rule dicts)
Each dict has: {"rule_id": str, "is_global": bool, "domains": list[str]}
is_global is True if rule has a global disable, domains lists domain-specific disables
Nc g | ] }|j
S r rL rM s r rP z(WPDisabledRule.fetch.. s'
CK
r F)r is_globalr$ Tra r$ )r\ rF r group_byorder_byr MAXr1 descrB r; r^ r] rC r r3 r: appendr sorted)r- r] r^ rY rI conditionrule_ids_query total_countpaginated_rule_ids
rows_query rules_by_idrO resultr rule_datas r fetchzWPDisabledRule.fetchS s @ // nMM
JJs{ # #
Xck
"
"
XbfS_--2244
5
5
+ 1 1) < #?#?Ii MM) $ $ $ $F""r rV )F)r NF)'r r r __doc__r r idr r r r r r1 r% r r= r3 r: SOURCE_WORDPRESS SOURCE_AGENT classmethodstrlistr6 floatr. r, r+ boolr2 rD rH rS r rX r\ tupledictrp r r r r
r
% s A A A A A A A A
BiU###G I5 ! ! !E)&&&K *%(((K
YE
"
"
"F% 5111 LL #L #'
J J J cT! J J
J 4<
J
J J J [ J>
[ 2 c
[ < 4Z
[: (S (49t+; ( ( ( ( [(T "
"
s "
C$J "
$ "
"
"
["
H 16 . . .*. .
c . . . [ .B .HSM . . . [. 3i$& [, )- $ O# O#O# O# 3i$& O#
O#
sDJ
O# O# O# [O# O# O#r r
)rq collections.abcr loggingr* peeweer r r r r r defence360agent.modelr
r getLoggerr r4 r
r r r r s $ % $ $ $ $ $ 2 1 1 1 1 1 1 1 8 $ $~# ~# ~# ~# ~#U ~# ~# ~# ~# ~#r