ׇk/ d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z m Z ddl
mZ ddlmZ dd lmZ dd
lmZ dd lmZ ej e Zd Zd
ZdZ dZ G d d Z dS )a Processor for WordPress rule disable/enable changelog files.
The PHP WordPress plugin writes rule change actions to changelog.php when a user
disables or enables protection rules from the WordPress admin panel. This module
reads, parses, and applies those actions to the agent database.
The changelog.php file uses the same format as incident files:
||k r8t d | dd |j || | ||| rd
}| |||| d{V # t $ r%} t
d | Y d} ~ d} ~ wt $ r-} t d ||j | Y d} ~ 2d} ~ ww xY wt d
|j t | | |S )am Parse and apply actions from a changelog file.
The file is always deleted after reading, even on parse errors.
Actions older than the last sync timestamp are skipped to prevent
stale changelog files (e.g. from backup restores) from undoing
more recent changes.
Returns:
True if any DB changes occurred.
Ftsr z:Missing or invalid timestamp in changelog action for rule rule_id? on site NzPSkipping stale changelog action for rule %s on site %s (ts=%.0f <= sync_ts=%.0f)Tz$Skipping invalid changelog entry: %sz5Failed to process changelog action %s for site %s: %sz9Processed changelog for site %s: %d action(s), changed=%s)r4 _get_last_sync_tsfloatgetr3 r* r r _process_action_report_actionwarningr( r) r )
r r, r! r actions last_sync_tschangedaction timestampr- s
r r& z*ChangelogProcessor._process_changelog_file s$ )).$?? 5--d33 F
!&**T1"5"5 6 6 >>$3%+ZZ 3%?%?3 3$(L3 3
+ \0I0IKK@
9c22 !$
''i@@ # "G))&$iHHHHHHHHHH
J
J
J EqIIIIIIII
KL
G L LL
s* BD 7D
E-D33
E- "E((E-rC rD c B | d }| d }|r|st d| |t k r| ||| S |t k r| || S t d| d| d|j )a Apply a single changelog action to the database.
Args:
action: Parsed action dict with keys: action, rule_id, ts.
site: The WordPress site the action belongs to.
timestamp: Pre-resolved Unix timestamp for this action.
Returns:
True if the database state was modified.
Raises:
ValueError: If the action is missing required fields or has
an unknown action type.
rC r7 z.Missing action or rule_id in changelog entry: zUnknown changelog action 'z ' for rule r9 )r< r3 ACTION_DISABLE_apply_disable
ACTION_ENABLE
_apply_enabler* )r rC r! rD action_typer7 s r r= z"ChangelogProcessor._process_action s " jj** **Y'' ' III
. ( (&&wi@@ @
M
)
)%%gt44 4 >[ > > $> >/3|> >
r c p t j | j }|j S # t j $ r Y dS w xY w)zGet the last disabled-rules sync timestamp for a site.
Returns None if the site has no DB record or no sync timestamp,
meaning all actions should be processed.
N)r get_by_idr* disabled_rules_sync_ts DoesNotExist)r! db_sites r r: z$ChangelogProcessor._get_last_sync_ts sG #-dl;;G1 1 ) 44 s " 55r7 c j t j | |j gt j |j | }|dk S )zApply a disable action from the changelog.
Returns:
True if a new disable entry was created (not a no-op).
)r7 domainssourceuser_idrD r )r storedomainSOURCE_WORDPRESSuid)r7 r! rD counts r rG z!ChangelogProcessor._apply_disable s? $[M!2H
qyr c F t j ||j g }|dk S )zvApply an enable action from the changelog.
Returns:
True if a disable entry was removed.
)r7 rQ r )r removerU )r r7 r! rX s r rI z ChangelogProcessor._apply_enable s1 %[M
qyr c
K |dS | d }| d }|t k r
t j }n|t k r
t j }ndS | |d||j g||j t j d{V dS # t $ r-}t d||j
| Y d}~dS d}~ww xY w)zSend a rule change event to the correlation server.
Must only be called for valid actions (after _process_action succeeds).
NrC r7 wordpress) plugin_idrulerQ rD rS rR z z!ChangelogProcessor._report_action" s, < F X& # . ( (%4KK
M
)
)%3KK F && ) ![M ' H):
LLN
s
?B
C"B==Cr+ c b |t z } t t | 5 }t j t j | dd 5 }| }ddd n # 1 swxY w Y ddd n # 1 swxY w Y nU# t $ r Y dS t $ r<}|j t j
k r t d|| Y d}~dS d}~ww xY w t | }t | dd }n@# t t f$ r,} t d | j | Y d} ~ dS d} ~ ww xY w t' j | j }
n# t& j $ r Y dS w xY w|
j } | du pt/ || z
d
k S ) a Check if disabled-rules.php was modified externally.
Reads the embedded timestamp from the file and compares it against
the stored sync timestamp in the database. If they differ
(e.g. file restored from backup), returns True to trigger regeneration.
rzutf-8)encodingNFzCannot open %s: %sr6 r z.Cannot read disabled-rules.php for site %s: %sg ?)DISABLED_RULES_FILENAMEr strosfdopendupreadFileNotFoundErrorr2 errnoELOOPr debugr r; r< r3 r? r* r rL rN rM abs) r! r+ disabled_rules_pathfdfcontentexcdatafile_tsr- rO db_tss r r' z0ChangelogProcessor._is_disabled_rules_file_staleM sV ')@ @
s#6 7 788
'BYrvbzz3AAA 'Q ffhhG' ' ' ' ' ' ' ' ' ' ' ' ' ' '
'
'
'
'
'
'
'
'
'
'
'
'
'
'
' ! 55 yEK'' 13FLLL55555
/88DDHHT1 - -..GG$ NN@
55555
#-dl;;GG ) 55 .}:GeO 4 4s ::s B *B
A3' B
3A7 7B
:A7 ;B
> B
BB BB
C(# C(,1C##C(,2D E 0!EE E: :F
F
)r N)__name__
__module__ __qualname____doc__r listr r r" boolr r dictr4 r& r; r= staticmethodr: rg rG rI r> r' r r r r * so + + + +
F| D
f :$$ D $
$ $ $ $L "*0
d 4= = = D =
= = = =~ "( 5:
D
54<
\
6
e
\
S
4
((( D ( (
( ( ( \(T );););
); ); ); \); ); );r r ) r| rm loggingrh pathlibr "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr defence360agent.model.wordpressr r &defence360agent.model.wp_disabled_ruler defence360agent.utils.fd_opsr defence360agent.wordpress.clir
)defence360agent.wordpress.incident_parserr defence360agent.wordpress.utilsr getLoggerry r r% rf rF rH r r r r r s8 $
: : : : : : 9 9 9 9 9 9 A A A A A A A A A A A A A A 6 6 6 6 6 6 6 6 6 6 6 6 H H H H H H H H H H H H 8 $ $$ .
M; M; M; M; M; M; M; M; M; M;r