d(
j d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZmZmZmZ d dlmZmZ d d lmZ d d
l m Z m Z m Z m Z d d lm!Z! d d l"m#Z#m$Z$ d d
l%m&Z&m'Z' d dl(m)Z) d dl*m+Z+m,Z, d dl-m.Z. d dl/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z: d dl;mZ>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZH d dlImJZJ ejK eL ZMdZNdZOdZPdeQfdZRdeQfdZSdeTfdZUdeTdeQfd ZVdeTdeQfd ZW ed ZXdeTd efd ZYd!edeZdz fd"Z[d# Z\d$eZd%ej] deZfd&Z^d%ej] d efd'Z_d(e j` fd)Zaddd+ebfd,Zcd- Zdd. Zed/ ZfdeTfd0Zgd1 Zhd2e'fd3Zid2e'dejfd4Zkd5 Zld6 Zm ded7ene' fd8Zod9ebe' fd:Zpd2e'd;eTdeZfd?Zrd2e'd@eZddfdAZsd9ebe' dejfdBZtd2e'd%ej] dCeTdDendEenddf dFZu dfd9ebe' dGe
e'ej] enenge d f dHeTdIeTdJeQddf dKZvdedCeTddfdLZwd!edMeQddfdNZx e jy Zzda{dgdOZ|d9ebe' ddfdPZ}deTddfdQZ~deTddfdRZdgdSZdTeTdUedeTfdVZd2e'd%ej] dUedDendEenddf dWZ dhdXebeT dz ddfdYZdedZZd[ Zd2e'deQfd\Zd2e'd]ejdeQfd^Zd_ Z G d` da Z G db dce ZdS )i N) defaultdict) AwaitableCallable) LooseVersion)Path)
inactivity)MalwareScanScheduleInterval SystemConfigANTIVIRUS_MODEchoose_value_from_config)IndexWP_RULES) log_message)open_dir_no_symlinks
open_nofollow rmtree_fdsafe_dir) Wordpress)get_wp_rules_dataget_wp_ruleset_version)
WordpressSiteWPSite)WPDisabledRule)cli telemetry)PLUGIN_VERSION_FILE) _validate_preset calculate_next_scan_timestamp$clear_get_cagefs_enabled_users_cacheensure_site_data_directory format_php_with_embedded_json get_imunify_package_versions
get_last_scanget_malware_historyprepare_plugin_configprepare_scan_data!write_plugin_data_file_atomically)
clear_manually_deleted_flag delete_site get_installed_sites_by_domainsget_outdated_sitesget_sites_for_userget_sites_to_adoptget_sites_to_install%get_sites_to_mark_as_manually_deletedget_installed_sitesinsert_installed_sites mark_site_as_manually_deletedupdate_site_identityupdate_site_version)setup_site_authenticationTFbalancedreturnc d t t j S # t $ r
t cY S w xY w)u Read WORDPRESS.waf_enabled from config, defaulting to True.
Returns _WAF_ENABLED_DEFAULT when the config key is missing (old
schema without waf_enabled), so WAF stays enabled — no behavior
change on upgrade.
)boolr WAF_ENABLEDKeyError_WAF_ENABLED_DEFAULT U/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/plugin.py_get_global_waf_enabledr@ S s? $I)*** $ $ $####$ //c d t t j S # t $ r
t cY S w xY w)uS Read WORDPRESS.ai_bot_protection from config, defaulting to False.
Returns _AI_BOT_PROTECTION_DEFAULT when the config key is missing
— e.g. the ai_bot_protection field hasn't rolled out to this
install's imunify360 yet, or a sibling package is still on an
older schema. Keeps the feature off in all ambiguous cases.
)r9 r AI_BOT_PROTECTIONr; _AI_BOT_PROTECTION_DEFAULTr= r> r? _get_global_ai_bot_protectionrE ` s? *I/000 * * *))))*rA c j t j } n# t $ r
t cY S w xY wt | S )u Read WORDPRESS.ai_bot_protection_preset from config, defaulting to
"balanced".
Two layers of safety: KeyError on a missing key (older schema, agent
upgrade in progress) and _validate_preset() on the value itself
(hand-edited override file, future preset rolled in via a sibling
package this version doesn't recognise). Both fall back to the same
canonical default so all layers — schema, agent, plugin — agree.
)r AI_BOT_PROTECTION_PRESETr; !_AI_BOT_PROTECTION_PRESET_DEFAULTr )raws r? $_get_global_ai_bot_protection_presetrJ n sF 10 1 1 100001 C s ##usernamec t sdS t dd| \ }}n# t $ r
t cY S w xY w|t nt | S )zECheck if WAF is enabled for a user, respecting global-off precedence.F WORDPRESS waf_enabled)rK )r@ r r; r< r9 )rK value_s r? _is_waf_enabled_for_user_syncrQ sz " $ $ u$+
qq $ $ $####$#(= d5kkAs ( <<c p K t j }| dt | d{V S )u3 Async wrapper — runs config file I/O in executor.N)asyncioget_event_looprun_in_executorrQ )rK loops r? is_waf_enabled_for_userrW sR ! # #D%% +X r> zD/var/lib/cloudlinux-app-version-detector/components_versions.sqlite3 admin_configc ddl m} || | S # t $ r- t d t
j dddfcY S w xY w)z
Get user-specific schedule configuration with lazy import fallback.
Returns default values if imav.malwarelib is not available.
r )get_user_schedule_configz@imav.malwarelib not available, returning default schedule config )(imav.malwarelib.plugins.schedule_watcherrZ ImportErrorloggerdebugIntervalNONE)rK rX rZ s r? _get_user_schedule_configrb s
&
(',??? & & & N
}aA%%%% &s 4A
A indexc t | }|dS t r | D ]
\ }}d|d< t t j r fd| D }|S )uI
Retrieve WordPress rules with ANTIVIRUS_MODE handling and global disable filtering.
In ANTIVIRUS_MODE, all rules are set to monitoring mode ("pass").
Globally disabled rules are filtered out entirely — they should not
appear in rules.php. Domain-specific disables are handled separately
via disabled-rules.php.
Args:
index: The Index object used to locate the wp-rules.zip file.
Returns:
The parsed wp-rules data with mode adjusted for ANTIVIRUS_MODE
and globally disabled rules removed, or None if rules cannot be loaded.
Npassmodec $ i | ] \ }}|v ||
S r= r= ).0cveparamsglobally_disableds r?
z-get_updated_wp_rules_data.. s5
V+++
+++r> )r r itemssetr get_global_disabled)rc
rules_datari rj rk s @r? get_updated_wp_rules_datarq s #5))Jt $%++-- $ $KC #F6NN N > @ @AA
) / / 1 1
r> c H t t j dS )z#Clear all WordPress-related caches.N)r r clear_get_content_dir_cacher= r> r? clear_cachesrt s# (***#%%%%%r> rm user_infoc t | }d |D }| D ]Dfd|D }|r1t |t }|| E|S )Nc i | ]}|g S r= r= )rh paths r? rl z site_search.. s
.
.
.4dB
.
.
.r> c , g | ]} | |S r= r= )rh rx itemmatchers r?
z site_search.. s* MMM4t9L9LM$MMMr> )key)r, maxlenappend)rm ru r{
user_sitesresultmatching_sitesmost_specific_siterz s ` @r? site_searchr s #I..J
.
.:
.
.
.F 4 4MMMMM:MMM 4!$^!=!=!= % & - -d 3 3 3 Mr> c : K t | |j d {V }| dd }t |j | \ }}}}d } |t j k rt
|||| } t |j }
t |
|d } || | fS )N scan_datec P | d dk o| d | S )N
resource_typefile)
startswith)rz rx s r? z)_get_scan_data_for_user.. s- 40F: * L # #D ) ) r> ) r# pw_namegetrb r` ra r r$ r ) sinkru rX last_scanlast_scan_timeintervalhour day_of_month day_of_weeknext_scan_timemalware_historymalware_by_sites r? _get_scan_data_for_userr s $D)*;<<<<<<<? ::r> semaphorec K |4 d {V | d {V n4# t $ r'}t d| Y d }~nd }~ww xY wd d d d {V d S # 1 d {V swxY w Y d S )NzTelemetry task failed: ) Exceptionr^ error)coror es r? _send_telemetry_taskr
s+ 8 8 8 8 8 8 8 8 8JJJJJJJJ 8 8 8 LL6166 7 7 7 7 7 7 7 7 88 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8s5 A A
A AA AA
A'*A'
coroutinesc K | sdS t j | fd| D } t j | d{V dS # t $ r(}t d| Y d}~dS d}~ww xY w)zK
Process a list of telemetry coroutines with a concurrency limit.s
Nc T g | ]$}t j t | %S r= )rS create_taskr )rh r r s r? r| z+process_telemetry_tasks.. s?
0y A ABB
r> z Some telemetry tasks failed: )rS Semaphoregatherr r^ r )r concurrencytasksr r s @r? process_telemetry_tasksr s !+..I
E
:ne$$$$$$$$$$ : : : 8Q88999999999:s A
A3 A..A3c p K t t d } | d{V t | }n3# t $ r&}t
d| Y d}~dS d}~ww xY w|s t
d dS t | }||d}t | S )z
Load WordPress rules from the index and format them as PHP.
Returns:
str or None: PHP-formatted rules data, or None if rules could not be loaded.
F)integrity_checkNz>Failed to load wp-rules index: %s, skipping rules installationz c v K t }t | | }| d{V S )a
Adopt WordPress sites where the plugin is installed but not tracked in our database
or flagged as manually removed.
This handles scenarios like:
- Sites copied/migrated from another location
- Sites migrated from another server
- Sites where the manually_deleted flag was incorrectly set (past bugs)
- Sites where the user installed the plugin from wordpress.org
N)r- WordPressSiteAdopterr )r r processors r? adopt_found_sitesr M sB
E$T511I r> c t j s"t dt dS t j S # t $ r&} t d| Y d} ~ dS d} ~ ww xY w)zLGet the latest version of the imunify-security plugin from the version file.z&Plugin version file does not exist: %sNz&Failed to read plugin version file: %s)r existsr^ r read_textstripr )r s r? get_latest_plugin_versionr ] s ")++ LL8:M
4",..44666 =qAAAttttts 3A $A
B &BB c j K t }|s t d dS t d| t }g }t
j d 5 t | }t dt | d |s# t | d{V ddd dS t }t d{V }t t }|D ]"}||j | #| D ]\ } }
t% j | } | j } n3# t* $ r&}
t d| |
Y d}
~
Nd}
~
ww xY wt- | | | d{V \ }}}t/ | }|
D ]}t1 | | d{V r t3 j | d{V s t d| Qt7 ||| ||| }t9 || d{V t; || d{V t3 j | d{V | | t3 j | d{V }|r{|j! }tE || |# | }tI | tI | k }| tK j& | |rd
nd || Z# t* $ r'}
t d
||
Y d}
~
d}
~
ww xY wt dt | nf# tN j( $ r+ t dt | Y n-t* $ r!}
t d|
d}
~
ww xY wt | d{V n# t | d{V w xY w ddd dS # 1 swxY w Y dS )zFUpdate the imunify-security plugin on all sites where it is installed.z)Could not determine latest plugin versionNz>L 9 ; ;;;;;;;H ( - -M&
5
5 dh'..t4444 , 1 1 3 3 \
\
U # S 1 1I ( 0HH LLE
HHHH
2)\ ""# !6h ? ?
! F FD 3D$ ? ??????? ! C%(%?%E%E E E E E E E % "KK Et % %6 * * $ +%-
% % % 4D) D DDDDDDDD 8m L LLLLLLLL " / 5 55555555 D))) ),(>t(D(D"D"D"D"D"D"D" /3| , 0g > > > $(#:#:7#C#CD ,8 ', , ,-= > >,?L
, 2 2 ) 4)- ,8)B(?(?-A)-,3 !" !" !" % I ! CFP
KK@G
% KK+G
LL?
*/:: : : : : : : : :)/:: : : : : : : : : :GC; C; C; C; C; C; C; C; C; C; C; C; C; C; C; C; C; C;s 9P(;1E2/2E!!E22E69E6c K t | | t | d{V | t j |d| | j dS # t $ r'}t d| | Y d}~dS d}~ww xY w)a
Process the manually deleted plugin for a single site.
Args:
site: The site to process.
now: The current time.
sink: The telemetry/event sink.
telemetry_coros: The list of telemetry coroutines to add the event to.
The process includes:
- marking the site as manually deleted in the database
- removing plugin data files
- sending telemetry for manual removal
Nremoved_by_userr z>Failed to process manually deleted plugin for site=%s error=%s) r2 r r r r r r r^ r )r nowr r r s r? r r o s
%dC000 "$''''''''' '
L
s AA
B % BB freshly_installed_sitesc d K g } t | }|r0t j }|D ]}t ||| | d{V n2# t $ r%}t d| Y d}~nd}~ww xY w|rt
| d{V dS dS # |rt
| d{V w w xY w)a>
Tidy up sites that have been manually deleted by the user.
Args:
sink: The telemetry/event sink.
freshly_installed_sites: Optional set of sites that were just installed and should be excluded
from being marked as manually deleted to avoid race conditions.
Nz&Error occurred during site tidy up. %s)r/ r r r r^ r r )r r r to_mark_as_manually_removedr r r s r? tidy_up_manually_deletedr s> O;&K #'
'
# ' )++C3
5#t_ F F F =uEEEEEEEEF ;)/:: : : : : : : : : : ; ;? ;)/:: : : : : : : : : ;s0 AA B
A7A2-B 2A77B B/r c
K |sd S t }t d {V }t t }|D ]"}||j | #| D ]\ }} t j | }|j }n3# t $ r&} t d|| Y d } ~ Nd } ~ ww xY wt | || d {V \ }
} } t | }
|D ]}t | | d {V r t! |
| ||| | }t# || d {V t% ||
d {V \# t $ r&} t d|| Y d } ~ d } ~ ww xY wd S )Nr r z.Failed to update site data on site=%s error=%s)r
r" r r r r rm r r r r r^ r r r% r r& r r )r r rX r r r r ru rK r r r r r r s r? update_data_on_sitesr sQ >>L133333333H %%M - -dh &&t,,,, $))++ + +
U S))I (HH LL=
HHHH
*$ <HH H H H H H H
-h77
D+D$77777777
-"" # %
,D)<<<<<<<<< 0mDDDDDDDDDD
D
' '+ +s1 =B
C # CC AE
F E??Ffilenamedatac K t j | j }|j }t | | d{V }t | }t
||z || j | dS )zKEmbed ``data`` as JSON inside a PHP file at ``/``.Nr gid)r r r pw_gidr r! r' )r r r ru r r php_contents r? _write_json_php_data_filer s TX&&I
C/i@@@@@@@@H/55K%8[dhC r> r c 8 K t | d| d {V d S )N
scan_data.phpr )r r s r? r r s0
#D/9
E
EEEEEEEEEEr> r c 8 K t | d| d{V dS )z
Write plugin_config.php for a single WordPress site.
Separate file from scan_data.php so a config toggle doesn't force
rewriting the malware list, and so the mu-plugin hot path loads
only what it needs per request.
plugin_config.phpNr )r r s r? r r s3 $D*=}
M
MMMMMMMMMMr> c " K | sdS d}t t }| D ]"}||j | #| D ]\ }} t j | }|j }n3# t $ r&}t
d|| Y d}~Md}~ww xY wt | } |D ]Q} t || d{V |dz
} # t $ r&}t
d|| Y d}~Jd}~ww xY w|S )us
Rewrite plugin_config.php on every managed site in one pass.
Used by the ConfigUpdate handler that reacts to
WORDPRESS.ai_bot_protection toggles. Writes only plugin_config.php
— scan_data.php is untouched, so a toggle doesn't churn the
(potentially large) malware payload or wait on a scan cycle.
No sink is needed: unlike update_data_on_sites we emit no
telemetry here — the per-site write loop just needs local file
I/O plus the process-level logger for errors.
Returns the number of sites successfully updated so the caller
can decide whether to advance its cached state.
r r Nr[ z6Failed to update plugin_config.php on site=%s error=%s)
r r r r rm r r r r r^ r r% r )
r r r r r r ru rK r r s
r? update_plugin_config_on_sitesr#
s qG
.9->->M - -dh &&t,,,,(..00 Z S))I (HH LL=
HHHH
.h77
D
/mDDDDDDDDD1
L
Ns0 A88
B( B##B(?C
D % DD wp_rules_phpr failedc K |j } t | | d{V }|dz }t ||| j | | | t
d| j dS # t $ rA}| | t
d| j | Y d}~dS d}~ww xY w)a=
Deploy wp-rules to a single WordPress site and track the result.
Args:
site: WordPress site to deploy to
user_info: User information from pwd
wp_rules_php: Formatted PHP rules content
updated: Set to add site to if successful
failed: Set to add site to if failed
N rules.phpr z Updated wp-rules for site %sz)Failed to update wp-rules for site %s: %s)
r r r' r r r^ r docrootr r ) r ru r$ r r% r r
rules_pathr s r? update_wp_rules_for_siter* E s "
C
3D)DDDDDDDD +
) $(
D 2DLAAAAA
4 7 L
s A(A5 5
C ?6B;;C make_task task_name fingerprintskip_waf_disabledc K t }t }t j | 5 t j }t t } | D ]"}
| |
j |
#g } | D ]+\ } }
t j | }|j }nW# t $ rJ}t d|t |
| |ddd| |
D ]}
| |
Y d}~rd}~ww xY w|rr t# | d{V }n/# t $ r" t$ d|d d}Y nw xY w|s*t$ d
|t |
|
D ]:}
t+ ||
d{V r| ||
||| ;-d }t- d t | | D ]&}| |||z }t/ j |d
di d{V 't j |z
}t$ d|t | t | | nh# t. j $ r, t$ d|t | Y n.t $ r"}t$ d|| d}~ww xY wddd dS # 1 swxY w Y dS )a6
Run a per-site async deployment over a list of WordPress sites.
Groups sites by user, resolves UIDs, then runs tasks concurrently
in batches.
Args:
sites: WordPress sites to deploy to
make_task: Callable that creates a coroutine for one site.
Signature: (site, user_info, updated_set, failed_set) -> awaitable
task_name: Human-readable name for logging and inactivity tracking
fingerprint: Sentry fingerprint for user-lookup failures
sink: Optional telemetry sink for remove_site_if_missing
zwSkipping {task} update for {count} site(s) belonging to user {user} because username retrieval failed. Reason: {reason})r countuserreasonr wordpress format_argslevel componentr- NBCould not check WAF status for user %s, proceeding with deploymentTexc_infoz-WAF disabled for user %s, skipping %d site(s)r r return_exceptionsz@%s deployment complete. Updated: %d, Failed: %d, Duration: %.2fsz-%s deployment was cancelled. Updated %d sitesz-Error occurred during %s deployment. error=%s)rn r r r r r r r r rm r r r r r r r rW r^ r r r rangerS r r r )r r+ r, r- r. r r r%
start_timer r r r r ru rK r rN max_concurrentibatchelapseds r? _deploy_to_sitesrB i s 0 eeG
UUF y ) ) S SR J ' - -M
5
5 dh'..t4444E#0#6#6#8#8 -
N -
NZ # S 1 1I ( 0HH > %.%(__$'&+ % % ("-$/
!+ ) )
4(((( HHHH# & % ! +,CH,M,M&M&M&M&M&M&M $ + + + : $%) ' '+ + ' ! K $
OO
! & N ND 3D$ ? ??????? ! LL4GV!L!LMMMMN
N1c%jj.99
E
E a!n"4 45 neDtDDDDDDDDDDikkJ.G KK#G F
% KK?G
LL?
[S S S S S S S S S S S S S S S S S Ss K A(I%)CI%
DA DI%DI% D54I%5)E! I% E!!DI%$K%8K
K K
( KK
KK !K c K t t }|s t d dS fd}t ||ddd| d{V dS )zHDeploy pre-formatted wp-rules PHP content to all active WordPress sites.z No active WordPress sites foundNc * t | ||| S N)r* )r ru r r% r$ s r? r+ z'_deploy_wp_rules_php..make_task s ' )\7F
r> zwp-ruleszwp-rules-update-skip-userTr, r- r. r )rt r0 r^ r_ rB )r$ r installed_sitesr+ s ` r? _deploy_wp_rules_phprH s NNN)++O 6777
/
r>
is_updatedc K t j s t d dS |s t d dS t d t | }|s t d dS t
| }||d}t | }t | d{V dS )z
Hook that runs when wp-rules files are updated.
Extracts wp-rules.yaml from wp-rules.zip and deploys to all active WordPress sites.
Args:
index: Index object for wp-rules
is_updated: Whether files were actually updated
zCwordpress security plugin not enabled, skipping wp-rules deploymentNz)wp-rules not updated, skipping deploymentz/Starting wp-rules deployment to WordPress sitesz,No valid wp-rules found, skipping deploymentr ) r SECURITY_PLUGIN_ENABLEDr^ r rq r r r! rH )rc rI r r r r$ s r? update_wp_rules_on_sitesrL s ,
?@@@
KKABBB-e44M CDDD .e44# L 1 >>L
|
,
,,,,,,,,,,r> c ` K t j s t d dS t r dat d dS t 4 d{V dat d t d{V } | s.t d ddd d{V dS t | d{V t snt d ddd d{V dS # 1 d{V swxY w Y dS ) aN
Re-deploy rules.php to all WordPress sites.
Used when globally disabled rules change, requiring rules.php
to be regenerated with updated rule filtering.
Uses a coalescing lock: if a redeployment is already running,
the request is merged into the current run rather than starting
a duplicate deployment.
zEwordpress security plugin not enabled, skipping wp-rules redeploymentNTz5wp-rules redeployment already in progress, coalescingFz6Starting wp-rules redeployment (global disable change)z(Could not load wp-rules for redeploymentz4Re-running wp-rules redeployment (coalesced request))
r rK r^ r _redeploy_wp_rules_locklocked_redeploy_wp_rules_pendingr r rH )r$ s r? redeploy_wp_rulesrQ sS ,
%%'' %)" KLLL& P P P P P P P P P). & KKH
"3!4!4444444L
IJJJP P P P P P P P P P P P P P '|44 4 4 4 4 4 4 4-
KKN O O O! P PP P P P P P P P P P P P P P P P P P P P P P P P P P P P P Ps /AD 8D
D'*D'c K t j }| D ]} t j | d{V }|dz }| d|j d{V rG| dt j | d{V t d|j
# t $ r+}t d|j
| Y d}~d}~ww xY wdS )z&Remove rules.php from the given sites.Nr' z(Removed rules.php from %s (WAF disabled)z&Failed to remove rules.php from %s: %s)
rS rT r r rU r r remover^ r r( r r )r rV r r r) r s r? _remove_rules_php_from_sitesrT K s/ ! # #D
-d 3 3333333H!K/J))$
0ABBBBBBBB
**4JGGGGGGGGG >L LL8$,
s BB##
C-!CCc K t j sdS t j } | dt
j | d{V n,# t $ r t d| Y dS w xY wt d{V }|s t d dS | dt d{V }fd|D }|sdS t }t }|D ]}t |||| d{V t d| t | t | dS )z?Redeploy rules.php only for sites belonging to a specific user.Nz.User %s not found, skipping WAF rules redeployz)Could not load wp-rules for user redeployc 4 g | ]}|j j k |S r= r pw_uidrh sru s r? r| z.redeploy_wp_rules_for_user..r ( @@@aey/?&?&?!&?&?&?r> z6Redeployed wp-rules for user %s: %d updated, %d failed)r rK rS rT rU r getpwnamr; r^ r r r0 rn r* r r ) rK rV r$ r r r r% r ru s @r? redeploy_wp_rules_for_userr] ^ s , ! # #D ..tS\8LLLLLLLL . r[ r> )
rS rT rU r r\ r; r^ r r0 rT )rK rV r r ru s @r? remove_waf_rules_for_userr` s ! # #D ..tS\8LLLLLLLL ;X
&&t-@AA A A A A A AE@@@@U@@@J
&z
2
2222222222s 'A %A)(A)c K t j } | dt d{V }t dt
| t | d{V dS )z?Remove rules.php from all installed sites (global WAF disable).Nz7Global WAF disabled, removing rules.php from %d site(s))rS rT rU r0 r^ r r rT )rV r s r? remove_waf_rules_for_all_sitesrb s ! # #D&&t-@AA A A A A A AE
KKA E
'u
-
----------r> domain timestampc p t j | d }|t | d}t | S )a|
Generate the disabled-rules.php content for a specific domain.
Only includes domain-specific disabled rules. Globally disabled rules
are handled separately by filtering them out of rules.php.
Args:
domain: The domain to generate disabled rules for
timestamp: Unix timestamp to embed in the file
Returns:
PHP file content string
F)include_global)tsr )r get_domain_disabledsortedr! )rc rd disabled_rule_idsr s r? generate_disabled_rules_phprk sN ':u )** D ) . ..r> c J K |j } t | | d{V }|dz }t | j | }t ||| j | t
j | t j | j k
| | t
d| j dS # t $ rA} | | t d| j | Y d} ~ dS d} ~ ww xY w)a[
Deploy disabled-rules.php to a single WordPress site and track the result.
Args:
site: WordPress site to deploy to
user_info: User information from pwd
timestamp: Unix timestamp for both file content and DB record
updated: Set to add site to if successful
failed: Set to add site to if failed
Ndisabled-rules.phpr disabled_rules_sync_tsz"Updated disabled-rules for site %sz/Failed to update disabled-rules for site %s: %s)r r rk rc r' r r r wherer( executer r^ r r r )
r ru rd r r% r r disabled_rules_pathr r s
r? update_disabled_rules_for_siters sO "
C
3D)DDDDDDDD &)= =1$+yII ) $(
I>>>DD !T\ 1
'))) D 8$,GGGGG
4 = L
s C
C
D"!6D D"domainsc b K t j s t d dS t d t | rt | }nt
}|s t d dS d }t ||ddd| d{V dS )
ai
Deploy disabled-rules.php to WordPress sites.
If domains are specified, only updates sites for those domains.
If domains is None, updates all installed sites (e.g., after a global
disable/enable).
Args:
domains: List of domains to update, or None for all sites
sink: Optional telemetry sink for remove_site_if_missing
zIwordpress security plugin not enabled, skipping disabled-rules deploymentNz5Starting disabled-rules deployment to WordPress sitesz6No WordPress sites found for disabled-rules deploymentc J t | |t j || S rE )rs r )r ru r r% s r? r+ z1update_disabled_rules_on_sites..make_task s% - )TY[['6
r> zdisabled-rulesz disabled-rules-update-skip-userTrF )r rK r^ r rt r* r0 rB )rt r r r+ s r? update_disabled_rules_on_sitesrw s ,
KKGHHHNNN &.w77#%% LMMM
"5
r> c
K t d t }t }t j d 5 t
t }|s(t d ddd dS t t }|D ]"}||j
| #g }| D ]\ }} t j | } n<# t $ r/}
t! dt# | ||
dddd
Y d}
~
Od}
~
ww xY w|D ]@}t% | | d{V rt' || || } | | Ad } t) d t# | | D ]&}
||
|
| z }t+ j |d
di d{V 't dt# | t# | nf# t* j $ r+ t dt# | Y n-t $ r!}
t d|
d}
~
ww xY wddd dS # 1 swxY w Y dS )z7Update auth.php files for all existing WordPress sites.z4Updating auth.php files for existing WordPress siteszwp-auth-updatez"No installed WordPress sites foundNzSkipping auth update for WordPress sites on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}r0 r1 r2 r r3 z wp-plugin-auth-update-skip-userr4 r r r; Tz8Updated auth.php files for %d WordPress sites, %d failedzLAuth update for WordPress sites was cancelled. Auth was updated for %d sitesz+Error occurred during auth update. error=%s)r^ r rn r r r rt r0 r r r r rm r r r r r r update_site_authr< rS r r r )r r r% rG r r r r r ru r r r> r? r@ s r? update_auth_everywherer{ s
KKFGGGeeG
UUF / 0 0 @ @? NNN 2 3 3O"
@AAA@ @ @ @ @ @ @ @ ( - -M'
5
5 dh'..t4444 E + 1 1 3 3
'
'
U # S 1 1II D
&)ZZ$'&+% %
("-$E
HHHH " " ' 'D 3D$ ? ??????? ! +D)WfMMDLL&&&& ' N1c%jj.99
E
E a!n"4 45 neDtDDDDDDDDDD KKJG F
% KK(G
LLF N N N }@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @st I;8H AH5D
H
E%D>9H>ECHI;7I+?I; I+
I&&I++I;;I?I?c K t | | d{V | | dS # t $ r<}| | t d| | Y d}~dS d}~ww xY w)z/Process authentication setup for a single site.Nz*Failed to update auth for site=%s error=%s)r5 r r r^ r )r ru r r% r s r? rz rz \ s
'i888888888 D
4 8
s +1
A71A22A7c . K t j |j rdS t | }|dk r&| #t j | d||j d{V n1t d| t dd|id d
d d
S )a
Checks if the site directory exists. If not, removes the site from the local database and sends a 'site_removed' telemetry event only if deletion is successful.
Returns True if the site was removed (directory missing), False otherwise.
Parameters:
sink: The telemetry/event sink.
site: The WPSite object to check and potentially remove.
Side effect: If the site is missing and successfully deleted from database, a telemetry event will be sent.
Fr N site_removedr z@Failed to delete missing site %s from database, no rows affectedz2Failed to delete missing site {site} from databaser r r3 z wp-plugin-site-delete-failedr4 T) r rx isdirr( r) r r r r^ r r )r r rows_deleteds r? r r j s
w}}T\"" u t$$L a &$
N
@ !6
4r> file_permissionsc K t j | d{V } t | }nC# t $ r6}|j t j t j t j fv rY d}~dS d}~ww xY w t j | j
dz }|dk rt j |d dD ]} t || 5 }t j
| }|j
dz |k rt j || ddd n # 1 swxY w Y d# t $ r Y pt $ r<}|j t j k r!t d|| Y d}~ d}~ww xY w t j | n# t j | w xY wdS # t$ $ r'} t d | | Y d} ~ dS d} ~ ww xY w)
z6Fix data file permissions for a single WordPress site.NFi i )r r! zauth.phpr' rm r z"Skipping chmod: %s/%s is a symlinkTz.Failed to fix permissions for site=%s error=%s)r r r r r r r r r statst_modechmodr fstatFileNotFoundErrorr^ r r r r )
r r r r r current_dir_mode file_namefile_fdstr s
r? fix_site_data_file_permissionsr s{ 1 )$//////// )(33FF yU\5;
FFF uuuuu
!wv 6 > 5(('''
&y@@@ @G Xg . . :-1AAA HW.> ? ? ?@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ ) H yEK// @ $ %
!
0
HV BHV t <
uuuuu
s F / F
A/*A*#F )A**A//F 3;E: /D 8D8 DD D D DE:
E!E: E!%1E E: E E!!E: %F :FF
G GGc \ K t }t }t j d 5 t t }|s ddd dS ddlm} ddlm } | j
|j
k rdnd}|D ]\}t | | d{V rt || d{V }|r|
| G|
| ]t dt! | t! | nj# t" j $ r+ t d t! | Y n1t& $ r%} t d
| Y d} ~ nd} ~ ww xY wddd dS # 1 swxY w Y dS ) z
Fix data file permissions for all WordPress sites with imunify-security plugin installed.
Args:
sink: The telemetry/event sink
zwp-plugin-fix-permissionsNr ) HostingPanel)Pleski z=Fixed data file permissions for %d WordPress sites, %d failedzOFixing data file permissions was cancelled. Permissions were fixed for %d sitesz1Error occurred during permission fixing. error=%s)rn r r r rt r0 +defence360agent.subsys.panels.hosting_panelr #defence360agent.subsys.panels.pleskr NAMEr r r r^ r r rS r r r )
r fixedr% rG r r r r successr s
r? $fix_data_file_permissions_everywherer s
EEE
UUF : ; ; 0 0/ NNN 2 3 3O"
0 0 0 0 0 0 0 0
B A A A A A & ,
::
(
%
%/d;;;;;;;; >*! ! %IIdOOOOJJt$$$$ KKE
F
% KK&E
LLCU
[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0sN F! D*,B=D*)F!*7F!F!# F,F F! FF!!F%(F%c d e Zd ZdZdZdZdZdZdddd d
d d d
Zd Z d Z
d Z d Z de
ddfdZd ZdS )r z
Handles installation of imunify-security plugin on WordPress sites.
This class processes WordPress sites and installs the imunify-security
plugin, including setting up authentication, scan data files, and rules.
Tinstalled_by_imunifyzwp-plugin-installationzwp-plugin-install-skip-userz%Installing imunify-security wp pluginz5Installed imunify-security wp plugin on {count} sitesz&Found {count} site(s) for installationz5Failed to install plugin to site={site} error={error}z`Installation of imunify-security wp plugin was cancelled. Plugin was installed for {count} sitesz8Error occurred during plugin installation. error={error}zSkipping installation of WordPress plugin on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}startcompletefoundr cancelled exception skip_userc H || _ || _ t | _ t | _ t | _ t | _ t | _ t | _ d | _ t | _
d | _ d S rE ) r r rn processed
authenticatedrules_installedfailed_rules_updatesdisabled_rules_installed failed_disabled_rules_updatesdisabled_rules_ts failed_auth
_current_site)selfr r s r? __init__z WordPressSiteInstaller.__init__( sy
UU "uu $'EE!(+%-0UU*/3 55,0r> c K t j | d{V }|s3t d| t dd|iddd d S d
S ) a
Check if site is ready for processing.
Override in subclasses to implement different readiness checks.
Args:
site: The WordPress site to check.
Returns:
bool: True if the site is ready for processing, False otherwise.
Nz6WordPress site is not accessible using WP CLI. site=%sz:WordPress site is not accessible using WP CLI. site={site}r r r3 z wp-plugin-cli-not-accessibler4 FT)r r r^ r r )r r r s r?
is_site_readyz$WordPressSiteInstaller.is_site_ready5 s (+'A$'G'G!G!G!G!G!G!G % NNH
L #TN % :
5tr> c | j | t |h | | dS )u
Record a successfully processed site and persist it to the database.
Each site is inserted immediately so that it is tracked in the DB
at all times — even if the overall installation loop is cancelled
mid-run.
Override in subclasses to implement different recording logic.
Args:
site: The WordPress site that was processed.
version: The plugin version installed on the site.
N)r r r1 _stamp_disabled_rules_sync_tsr r r s r? _record_processed_sitez-WordPressSiteInstaller._record_processed_siteQ sD
4 v&&& **400000r> c K | j }d| _ t | d{V n3# t $ r&}t d|| Y d}~nd}~ww xY w| j r t
j | d{V dS dS )a Revert the site that was mid-processing when cancellation occurred.
Deletes data files and, if this processor installs plugins,
attempts to uninstall the partially-installed plugin.
Each step runs independently so one failure doesn't skip the other.
Nz5Failed to delete data files for in-flight site %s: %s)r r r r^ r install_pluginr try_plugin_uninstall)r r r s r? _revert_in_flight_sitez-WordPressSiteInstaller._revert_in_flight_sitec s ! ! %d++ + + + + + + + + NNG
1*400 0 0 0 0 0 0 0 0 0 1 1s (
A AAr r7 Nc || j vrdS | j dS t j | j t j |j k dS )z
Stamp disabled_rules_sync_ts for a single site after it has been
inserted into the DB.
Called from ``_record_processed_site`` so the DB row already exists.
Nrn )r r r r rp r( rq )r r s r? r z4WordPressSiteInstaller._stamp_disabled_rules_sync_tsw se t4 4 4 F ! ) F #'#9
%
% 5
6
6wwyyyyyr> c
K t | j d g }t j | j 5 t | j s{t d | j |rLt j |ddi d{V }|D ]2}t |t rt d| 3cddd S t | j d t! | j t# }t% d{V }t' j | _ t+ d{V }t- t. }| j D ]"}||j | #| D ]&\ } }
t7 j | } | j } nL# t $ r?}
t= | j d t! |
| |
d
d d | j
Y d}
~
gd}
~
ww xY w tA | d{V }n/# t $ r" t d| d d}Y nw xY w|s)t d| t! |
tC | j" | | d{V \ }}}tG | }|
D ]}tI | j" | d{V r | % | d{V s<|| _& tO ||| ||| }tQ || d{V tS || d{V tU || | j+ | j, d{V |r%|r#t[ || || j. | j/ d{V |r(ta || | j | j1 | j2 d{V | j3 rti j5 | d{V ti j6 | d{V }|rto j8 || }| 9 || d| _& | t j: tw j< | j" | j= || # t $ rY}
d| _& t > | j d |t |
Y d}
~
d}
~
ww xY w(t | j d t! | j | j, r-t dt! | j, | j/ r-t dt! | j/ | j2 r-t dt! | j2 n# t j@ $ ro | j& r| A d{V t | j d t! | j Y nXt $ rL}
t > | j d t |
d}
~
ww xY w|rLt j |ddi d{V }|D ]2}t |t rt d| 3nT# |rLt j |ddi d{V }|D ]3}t |t rt d| 3w w xY wddd n # 1 swxY w Y | j S ) z
Process WordPress sites for imunify-security plugin operations.
Returns:
set: The set of successfully processed sites.
r z'No WordPress sites found, nothing to dor; TNz Failed to send telemetry: %sr )r0 r ry r r3 r4 r8 r9 zFWAF disabled for user %s, skipping WAF rules deployment for %d site(s)r r r )r r r z Failed to authenticate %d sitesz&Failed to install wp-rules on %d sitesz,Failed to install disabled-rules on %d sitesr r )r )Br^ r messagesr r r r, rt r r rS r
isinstancer r formatr r
r r r r" r r r r rm r r r r log_fingerprint_skip_userrW r r r% r r r r& r r rz r r r* r r rs r r r r plugin_installr r r r r r r telemetry_eventr reprr r )r telemetry_tasksresultsr rX r$ r r r r r ru rK r rN r r r r r r s r? r zWordPressSiteInstaller.run s<
DM'*+++
"
"4>
2
2 I I H
z *KK IJJJ >v # $+N(%<@% % G #* %fi88 "NN > OI I I I I I I I M'*11DJ1HH
,~~ &7%8%8 8 8 8 8 8 8 *.&!=!?!??????? !,D 1 1
J 9 9D!$(+2248888 #0"5"5"7"7 A A JC!$'L$5$5 #,#4$ ! ! !# M+ 6),U(+*/) )
#,&1(,(F
! ! +,CH,M,M&M&M&M&M&M&M $ + + + : $%) ' '+ + ' ? $ JJ 6 9l &&' %:($C$CM % T T !7 4!H!HHHHHHH % $P )-););D)A)A#A#A#A#A#A#A ) (15D . ): . . ( $ /)1
) ) ) I #8i"H"H H H H H H H H"; $m# # #3 $ ) $ 2 $ 0 # # , " "&>$($-$0$($8$($= '" '" !" !" !" !" !" !" !" + "&D$($-$($:$($A$($F '" '" !" !" !" !" !" !" !" $ 2 ?&)&8&>&> > > > > > > > -0,B4,H,H&H&H&H&H&H&HG & P'-'@w'O'O ! 7 7g F F F15D . + 2 2 ' 3$-$8-1Y.2.B-107 %& %& %&!" !" ) 15D . "LL $
g 6 = =)-T%[[ !> !" !" ]T j M*-443t~;N;N4OO # NN9D ,-- , NN@D 566 5 NNFD >??
)
% 8 55777777777 M+.55 !$. 1 1 6
M+.55DKK5HH
# $+N(%<@% % G #* %fi88 "NN >
# $+N(%<@% % G #* %fi88 "NN >
KI I I I I I I I I I I I I I I V ~ s ] 5WA] C1WG.-W.
H785H2-W2H77W;IW)I=:W<I==A>W<R WE1R W
S. AS) #W)S. .C,W[?A;Z-[? Z-!AZ((Z--[?0A] ?A]] ]#&]#)__name__
__module__ __qualname____doc__r r r, r r r r r r r r r r= r> r? r r s N,O(I = 8K9H
5
G
7 H( 1 1 1 81 1 1$1 1 1(
A&
AT
A
A
A
A U U U U U r> r c V e Zd ZdZdZdZdZdZdddd d
d d d
Z fdZ d Z
fdZ xZ S )r z
Handles adoption of existing WordPress sites with imunify-security plugin.
Adoption is a special case of installation where the site already has
the plugin installed but is not tracked in our database.
F
site_foundzwp-plugin-adoptionzwp-plugin-adopt-skip-userz#Adopting imunify-security wp pluginz3Adopted imunify-security wp plugin on {count} sitesz"Found {count} site(s) for adoptionz3Failed to adopt plugin to site={site} error={error}zZAdoption of imunify-security wp plugin was cancelled. Plugin was adopted for {count} sitesz4Error occurred during plugin adoption. error={error}zSkipping adoption of WordPress plugin on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason}r c t || d t j t j D | _ d S )Nc h | ] }|j
S r= )r( )rh rs r? z0WordPressSiteAdopter.__init__.. s' "
"
"
AI"
"
"
r> )superr r selectr( existing_docroots)r r r __class__s r? r z WordPressSiteAdopter.__init__| sR
u%%%"
"
, 3M4I J J"
"
"
r> c | j | |j | j v r1t | t | |rt
|| nt |h | | dS )a
Record a successfully adopted site and persist it immediately.
For adoption, sites that already exist in the database (flagged as
manually deleted) have their flag cleared. New sites are inserted
into the database right away.
Args:
site: The WordPress site that was processed.
version: The plugin version installed on the site.
N) r r r( r r( r3 r4 r1 r r s r? r z+WordPressSiteAdopter._record_processed_site s
4 <41 1 1 ' - - - & & &
3#D'222 "D6 * * * **400000r> c K t | d{V sdS t j | d{V }|s t d| dS dS )z
Check if site is ready for adoption.
Args:
site: The WordPress site to check.
Returns:
bool: True if the site is ready for adoption, False otherwise.
NFz2Plugin not installed on site %s, skipping adoptionT)r r r r r^ r )r r r r s r? r z"WordPressSiteAdopter.is_site_ready s WW**400000000 5 ! 4T : ::::::: NND
5tr> )
r r r r r r r, r r r r r
__classcell__)r s @r? r r ^ s N"O$I ; 6I5F
3 L
7 H$
1 1 1. r> r )r rE )FN)r7 N)NN)rS r loggingr r r collectionsr collections.abcr r distutils.versionr pathlibr defence360agent.apir defence360agent.contracts.configr r` r
r r defence360agent.filesr
r defence360agent.sentryr defence360agent.utils.fd_opsr r r r r "defence360agent.wordpress.wp_rulesr r defence360agent.model.wordpressr r &defence360agent.model.wp_disabled_ruler defence360agent.wordpressr r #defence360agent.wordpress.constantsr defence360agent.wordpress.utilsr r r r r! r" r# r$ r% r& r' )defence360agent.wordpress.site_repositoryr( r) r* r+ r, r- r. r/ r0 r1 r2 r3 r4 $defence360agent.wordpress.proxy_authr5 getLoggerr r^ r< rD rH r9 r@ rE strrJ rQ rW COMPONENTS_DB_PATHrb dictrq rt
struct_passwdr r r r r r r r r r r r intr r r rn r r r r r r# r* rB rH rL LockrN rP rQ rT r] r` rb floatrk rs rw r{ rz r r r r r r= r> r? r s
# # # # # # / / / / / / / / * * * * * * * * * * * * 2 1 1 1 1 1 1 1 . . . . . . 7 6 6 6 6 6 B A A A A A A A A A A A A A 4 4 4 4 4 4 4 4 C C C C C C K J J J J J 8 $ $
# $. !
$
$
$
$
$ *t * * * * !c ! ! ! !"
BC
BD
B
B
B
BC D TJ
& &< & & & &&"U "td{ " " " "J& & &
t
(9
t
;& ;6B ; ; ; ;F80A 8 8 8 8: :d : : : :& 7 7 7B! ! !
!
!
! 3 Q; Q; Q;h F >) )# ) ) ) )X"; "; ";J$
$
$
P 26; ;#&v;; ; ; ;<:DL : : : :z
'+
Ff F F F F FN& N N$ N N N N5tF| 5 5 5 5 5p!
!
!
!
!
!
!
!
!
!
V $
n n <n "C-y>n
n
n n
n n n nb S 0#-% #-T #-d #- #- #- #-L '',.. # *P *P *P *PZd6l t &$s $t $ $ $ $N
3c
3d
3
3
3
3 . . . ./ / /# / / / /0%
%
%
%
%
%
%
%
%
%
R !%
/ /
#Y
/
/ / / /dG G G GT
&V & & & & &R5
5$'5 5 5 5 5p: : :zS S S S S S S S l
R R R R R1 R R R R Rr>