-zh
d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
m Z d dl m
Z
d dlmZ d dlmZ d dlmZ e j e Z dd edz d
edz d eedz edz f fd Z G d
de Z G d de Z dS ) N)ValidationError)CommonEndpoints
RootEndpointsbind)Scope is_root_user) MessageType)get_wordpress_incidents) get_installed_sites_paginated)get_domain_pathsuser site_searchreturnc x t j }t rt d| d}| s t j | j }t d| | n<# t $ r/ t d| t d| d w xY w||fS ||fS )a
Determine the user_id and site_path for filtering WordPress incidents.
Three calling contexts:
1. Root user: Can query all incidents or filter by specific user
2. Non-root user: Can only query their own incidents (user/site_search ignored)
3. Proxy service: Both user and site_search must be set, restricted to that site
Args:
user: Username to filter by
site_search: Site path to filter by
Returns:
Tuple of (user_id, site_path) to filter by, or (None, None) for all
Raises:
KeyError: If the specified user doesn't exist
ValueError: If proxy service call is missing required parameters
z-Root user querying incidents, user filter: %sNz(Filtering incidents for user %s (uid=%d)zUser not found: %szUser 'z ' not found)
osgetuidr loggerdebugpwdgetpwnampw_uidKeyErrorwarning)r
r current_uiduser_ids i/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/simple_rpc/wordpress_security_plugin.py get_user_id_and_site_for_queryr s , )++K~~ $ DdKKK
; ,t,,3 >g
;
;
; 3T::: 9 9 9 9:::
; ## ##s 5A8 89B1c e Zd Zej Z edd d Z edd d Z edd d Z edd d Z
d
S ) WordpressEndpointswordpress-pluginzinstall-on-new-sitesc p K | j t j d d {V d S )Ninstall_on_new_sitesaction_sinkprocess_messager WordpressPluginActionselfs r wordpress_plugin_installz+WordpressEndpoints.wordpress_plugin_installD sZ j(( -5K L L L
ztidy-upc p K | j t j d d {V d S )Ntidy_upr# r% r) s r wordpress_plugin_tidy_upz+WordpressEndpoints.wordpress_plugin_tidy_upJ sY j(( -Y ? ? ?
r, updatec p K | j t j d d {V d S )Nupdate_existingr# r% r) s r wordpress_plugin_updatez*WordpressEndpoints.wordpress_plugin_updateP sZ j(( -5F G G G
r, zinstall-and-updatec p K | j t j d d {V d S )Ninstall_and_updater# r% r) s r #wordpress_plugin_install_and_updatez6WordpressEndpoints.wordpress_plugin_install_and_updateV sZ j(( -5I J J J
r, N) __name__
__module__ __qualname__r AV_IM360SCOPEr r+ r/ r3 r6 r, r r r A s NE T
455
65
T
i((
)(
T
h''
('
T
233
43
r, r c e Zd Zej Z edd ddedz dedz ded ed
edz d edz d edz d
edz dedz dedz de dz de e
fd Z edd dd Z dS )WordpressCommonEndpointsr zlist-incidentsN2 r r
r limitoffset by_abuser_ipby_country_code by_domainsearchsincetoorder_byr c
@ K t || \ } }
n/# t $ r"}t t | |d}~ww xY wt ||| |||||
| |
| }|D ]:}| d |d< | d }|d|ind|d< ;|S )ac
List WordPress security incidents.
Three calling contexts:
1. Root user: Can query all incidents or filter by specific user
2. Non-root user: Can only query their own incidents
3. Proxy service: Both user and site_search must be set, restricted to that site
Args:
user: Username to filter by (root or proxy service)
site_search: Site path to filter by (proxy service only)
limit: Maximum number of incidents to return
offset: Number of incidents to skip
by_abuser_ip: Filter by attacker IP address
by_country_code: Filter by country code
by_domain: Filter by domain
search: Search across multiple fields
since: Filter by timestamp >= this value (unix timestamp)
to: Filter by timestamp <= this value (unix timestamp)
order_by: List of fields to order by (e.g., ['timestamp-', 'severity-'])
Returns:
List of incident dictionaries
Raises:
ValidationError: If the specified user doesn't exist
N) r@ rA r rB rC rD rE r rF rG rH retriestimescountrycode)r r r strr
pop)r* r
r r@ rA rB rC rD rE rF rG rH r site_pathe incidentsincidentrL s r wordpress_plugin_list_incidentsz8WordpressCommonEndpoints.wordpress_plugin_list_incidents` s T 1!?k" " GYY 1 1 1!#a&&))q 0 1 ,% + !
" H ( Y 7 7HW ll9--G%,%8!!d
Y s
A ?Az
list-sitesc f K d}|r/ t j | j }n# t $ r dg fcY S w xY wt ||| \ }}t d{V }g }|D ]K} | | j g }
|
r|
d n| j } | | | j d L||fS )z
List WordPress sites with Imunify plugin installed.
For root users: returns all sites.
For non-root users: returns only sites belonging to that user.
Nr )uidr@ rA )domaindocroot)
r r r r r r getrX rW append) r* r@ rA r
rV max_countsitesdocroot_domainsitemssitedomainsprimary_domains r
list_sitesz#WordpressCommonEndpoints.list_sites s
l4((/
"u
95
5
!1 2 2222222
D%))$,;;G+2 CWQZZ N LL , #|
% s " 33) NNr? r NNNNNNN)r? r N)
r7 r8 r9 r r: r; r rN intlistdictrT rb r< r, r r> r> ] sN NE T
.// "&#'&* $ ! $F FDjF 4ZF F
F Dj
F tF :F d
F TzF
$JF +F
dF F F 0/FP
T
l++# # # ,+# # # r, r> )NN) loggingr r defence360agent.rpc_toolsr defence360agent.rpc_tools.lookupr r r defence360agent.utilsr r "defence360agent.contracts.messagesr (defence360agent.model.wordpress_incidentr
)defence360agent.wordpress.site_repositoryr defence360agent.wordpress.utilsr getLoggerr7 r rN tuplerc r r r> r< r, r rp s
5 5 5 5 5 5
6 5 5 5 5 5 5 5 : : : : : : L L L L L L = < < < < < 8 $ $ 8<($ ($
*($*-*($
3:sTz !"($ ($ ($ ($V
8p p p p p p p p p p r,