yiSގ d Z ddlZddlZddlZddlZddlmZ ddlmZ ddl m
Z
m Z ddl m
Z
ddlmZ ddlmZmZ dd lmZ dd
lmZmZ dd lmZ dd lmZm Z dd
l m Z ddl m Z ej! e" Z#de$de%e$ fdZ&de$de%e$ dz de%e$ fdZ'de%e( de(dz de%e( fdZ) dde%e$ dedz ddfdZ* G d de Z+dS ) z6RPC endpoints for WordPress disabled protection rules. N) MessageType) MessageSink)IndexWP_RULES)WPDisabledRule)ValidationError)CommonEndpointsbind)
hosting_panel)Scopelog_future_errors)ChangelogProcessor)redeploy_wp_rules update_disabled_rules_on_sites) get_installed_sites_by_domains)get_wp_rules_datauserreturnc K t j }| d{V }| | g S # t $ r(}t
d| | g cY d}~S d}~ww xY w)z
Get domains for a user from the hosting panel.
Returns:
List of domains the user owns, or empty list on error.
Nz%Failed to get domains for user %s: %s)r HostingPanelget_domains_per_userget Exceptionloggerwarning)r hpdomains_per_useres a/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/wp_disabled_rules.py_get_user_domainsr s
'
)
)!#!8!8!:!::::::: ##D"--- >aHHH s AA
A9 A4.A94A9domainsc K t | d{V |sst d S fd|D }|st d |S )a
Validate and filter domains for a non-root user.
If no domains specified, returns all user's domains.
If domains specified, filters to only those the user owns.
Args:
user: Username to validate domains for
domains: Requested domains, or None for all user's domains
Returns:
List of validated domains the user can access
Raises:
ValidationError: If user has no domains or no access to requested domains
NzNo domains found for userc g | ]}|v | S r$ .0d user_domainss r
z*_validate_user_domains..H s# BBB\0A0A!0A0A0A z5You don't have access to any of the specified domains)r r )r r! authorized_domainsr( s @r _validate_user_domainsr, / s & +400000000L ?!"=>> >BBBBWBBB
C
r* disabled_rules
wp_rules_datac g }| D ]f}|d }|r| |i ni }| i || d | d d g|S )a9
Enrich disabled rules with metadata from wp-rules.yaml.
Args:
disabled_rules: List of disabled rule dicts from WPDisabledRule.fetch()
wp_rules_data: Parsed wp-rules.yaml data, or None if unavailable
Returns:
List of enriched rule dicts with component and versions added
rule_idtargetversions) componentr2 )r append)r- r. enrichedruler0 metadatas r _enrich_with_metadatar8 P s H
y/5BJ=$$Wb111
%\\( 3 3 $LL 4 4
Or* sinkc K t | }|sdS t || d{V dS # t $ r(}t d|d Y d}~dS d}~ww xY w)a Process pending changelog files for the given domains before an API change.
This "Just-in-Time" sync ensures the database reflects any WordPress-side
changes before the agent applies its own disable/enable operation.
File regeneration (disabled-rules.php) is intentionally skipped here because
the calling API endpoint will regenerate files after its own DB mutation.
N)r9 z JIT changelog sync failed: %sT)exc_info)r r process_changelogs_for_sitesr r r )r! r9 sitesr s r _jit_sync_changelogsr> m s J.w77 F ""?? @
J J J6DIIIIIIIIIJs A )A
A4 A//A4c e Zd ZdZej Z eddd dded ed
e e
dz d e
dz d e ee e f f
d
Z
de
de
d
e e
dz d e
dz d e f
dZ eddd dde
d
e e
dz d e
dz d e fd Z eddd dde
d
e e
dz d e
dz d e fd ZdS )WPDisabledRulesEndpointsz:Endpoints for listing disabled WordPress protection rules.zwordpress-pluginrulesz
list-disabled2 r Nlimitoffsetr! r r c K |r.t | d{V |s }n fd|D }|sdg fS t j ||||du \ }} t t d }t | }n4# t $ r'} t d| d}Y d} ~ nd} ~ ww xY wt || }
||
fS )a
List disabled WordPress protection rules with metadata.
When user is provided, returns rules for that user's domains.
Otherwise, returns all disabled rules.
Args:
limit: Maximum number of rules to return
offset: Number of rules to skip
domains: Filter by specific domains (optional)
user: Username (populated by middleware)
Returns:
Tuple of (total_count, list of enriched rule dicts)
Nc g | ]}|v | S r$ r$ r% s r r) z@WPDisabledRulesEndpoints.list_disabled_rules.. s# CCCl1B1B11B1B1Br* r )rC rD r( include_globalF)integrity_checkz Failed to load wp-rules data: %s)
r r fetchr r r r r r r8 ) selfrC rD r! r total_countr- wp_rules_indexr. r enriched_rulesr( s @r list_disabled_rulesz,WPDisabledRulesEndpoints.list_disabled_rules s 0 !!24!8!8888888L
!&CCCCgCCC ! b5L '5&: 4< '
'
'
# ^ ! "8U C C CN -n = =MM ! ! ! NN=q A A A MMMMMM !
/~}MMN**s %A8 8
B) B$$B)actionr6 c
f K |d}n< t j | j }n!# t $ r t d| d w xY w|rt || d{V }|rt
|| j d{V |dk r/t j ||t j
| t j }n"t j
|| t j } | j |d||pg t! j |t j
d{V n4# t" $ r'}t$ d
||| Y d}~nd}~ww xY w|r#t) j t- | }n t) j t/ }| t2 i S ) z8Shared implementation for disable/enable rule endpoints.Nr zUser 'z ' not founddisable)r0 r! sourceuser_id)r0 r! wordpress) plugin_idr6 r! timestamprS rR z#Failed to report rule %s for %s: %s)r! )pwdgetpwnampw_uidKeyErrorr r, r> _sinkr store SOURCE_AGENTr WPRuleDisabledremove
WPRuleEnabledprocess_messagetimer r errorasyncio create_taskr r add_done_callbackr
) rJ rO r6 r! r rS message_clsr tasks r _toggle_rulez%WPDisabledRulesEndpoints._toggle_rule sL <GG
B ,t,,3
B
B
B%&@t&@&@&@AAA
B B 24 A AAAAAAAG
<&w
;; ; ; ; ; ; ; ; Y %2
&4KK !$ @ @ @ @%3K *,, ) #Mr "ikk #)6
LL5vtQ
<&.w??? DD
&'8':':;;D 0111 s" # AA D
E( E
ErQ c B K | d||| d{V S )av
Disable a WordPress protection rule globally or for specific domains.
Root users can disable globally (no domains) or for specific domains.
Non-root users can disable for all their domains (by specifying no
domains) or for specific domains.
Non-root users can only disable for domains they own.
Args:
rule: The rule ID to disable (e.g., "CVE-2025-001")
domains: List of domains to disable the rule for, or None for global
user: Username (populated by middleware for non-root users)
Returns:
Empty dict on success.
rQ Nri rJ r6 r! r s r disable_rulez%WPDisabledRulesEndpoints.disable_rule s4 . &&y$FFFFFFFFFr* enablec B K | d||| d{V S )a
Re-enable a WordPress protection rule globally or for specific domains.
Root users can enable globally (no domains) or for specific domains.
Non-root users can enable for all their domains (no domains) or
specific ones.
Non-root users can only enable for domains they own.
Note: Enabling at one scope doesn't affect the other scope.
E.g., enabling globally leaves domain-specific disables intact.
Args:
rule: The rule ID to enable (e.g., "CVE-2025-001")
domains: List of domains to enable the rule for, or None for global
user: Username (populated by middleware for non-root users)
Returns:
Empty dict on success
rn Nrk rl s r enable_rulez$WPDisabledRulesEndpoints.enable_rule s4 4 &&xwEEEEEEEEEr* )rB r NN)NN)__name__
__module__ __qualname____doc__r AV_IM360SCOPEr
intliststrtupledictrN ri rm rp r$ r* r r@ r@ s DD NE T
g77 $( 6+ 6+6+ 6+ cT! 6+
Dj 6+
sDJ
6+ 6+ 6+ 876+p?? ? cT! ?
Dj ?
? ? ? ?B
T
gy11 %) G GG cT!G Dj G
G G G 21G0
T
gx00 %) F FF cT!F Dj F
F F F 10F F Fr* r@ )N),rt rd loggingrW rb "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr defence360agent.filesr r &defence360agent.model.wp_disabled_ruler defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r
defence360agent.subsys.panelsr defence360agent.utilsr r
-defence360agent.wordpress.changelog_processorr defence360agent.wordpress.pluginr r )defence360agent.wordpress.site_repositoryr "defence360agent.wordpress.wp_rulesr getLoggerrq r ry rx r r, r{ r8 r> r@ r$ r* r r s < <
: : : : : : 9 9 9 9 9 9 1 1 1 1 1 1 1 1 A A A A A A 5 5 5 5 5 5 B B B B B B B B 7 7 7 7 7 7 : : : : : : : : A @ @ @ @ @ 8 $ $
#
$s)
S D( #Y BJ/3d{ $Z < 48J J
#YJ )D 0J J J J J*rF rF rF rF rF rF rF rF rF rFr*