4ݮ% x d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZ d dl m Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZmZ d dlmZ d d lmZ d d
lmZ d d lm Z m Z m Z m Z m Z d d l!m"Z"m#Z# d d
l$m%Z% d dl&m'Z' d dl(m)Z) dZ*dZ+ e,d Z- ej. e/ Z0de1de2fdZ3 e d de4e2e5e2 f fd Z6de2de2de5fdZ7 e d de8fd Z9d Z:d e2d!e5de5fd"Z;de2d#e2de5e2 fd$Zd e2de4fd(Z?d) Z@de4e2e2dz f fd*ZA dBd+eBd,eBd e2d%e%d-e4d.e4e2e2dz f dz de4fd/ZCd e2de4fd0ZDdd1d2e2d3eEd4eEd5eEdz ddf
d6ZFd7e2de2fd8ZGd9e2de2fd:ZHd;e4de2fd<ZId2e2de4fd=ZJd>ed3eEd4eEd5eEddf
d?ZKd%e%d@ejL defdAZMdS )C N) defaultdict)datetime timedelta) lru_cache)Path)Optional)choose_value_from_configMalwareScanScheduleInterval)
LicenseCLN) HostingPanel)Plesk)IMUNIFY_PACKAGE_NAMESasync_lru_cacheatomic_rewrite check_runsystem_packages_info)open_dir_no_symlinkssafe_dir)WPSite)WP_CLI_WRAPPER_PATH)PHPErrorz/usr/sbin/cagefs_enter_userz/usr/sbin/cagefsctl)balancedstrictmonitorvaluereturnc F t | t r | t v r| S dS )u Coerce a config-read preset value to a canonical preset string.
Returns "balanced" for anything outside _VALID_PRESETS — including
None, non-strings, and hand-edited values like "extreme" or
"BALANCED". The agent always writes lowercase canonical values, so
a non-canonical read indicates either a manual edit or a future
preset that this version doesn't recognise; "balanced" is the safe
fallback in both cases.
r )
isinstancestr_VALID_PRESETS)r s T/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/utils.py_validate_presetr" + s* % %>"9"9 : < )ttlc K t } | d{V }t t }| D ]%\ }}|D ] }|| | &|S )zN
Get a mapping of docroots to their associated domains, with caching.
N)r get_domain_pathsr listitemsappend)
hosting_panel panel_paths docroot_mapdomaindocrootsdocroots r! r' r' : s
!NNM%6688888888K d##K ' - - / / 0 0 0 0G ' ' / / / / 0 r# php_pathr0 c 0 t t | |gS )z Get wp cli common command list)r r )r1 r0 s r!
wp_wrapperr3 H s # $ $h 88r# )maxsizec t j t r$t j t t j st
S t j t dgdd } | j dk rt
S | j
d }t
|dd S )z)Get the list of users enabled for CageFS.z--list-enabledT)capture_outputtextr
r4 N)
ospathisfileCAGEFS_CTL_PATHaccessX_OKset
subprocessrun
returncodestdoutstripsplit)resultliness r! get_cagefs_enabled_usersrI M s 7>>/ * * ")3 3 uu
^ *+Dt F A uu M ! ! ' ' - -E uQRRy>>r# c 8 t dS )z-Clear the cache for get_cagefs_enabled_users.N)rI cache_clear r# r! $clear_get_cagefs_enabled_users_cacherM _ s ((*****r# usernameargsc | t v rTt j t r0t j t t j r t d| g|S ddd| dt j | gS )zNBuild the necessary command to run the given cmdline args with specified user.z--no-io-and-memory-limitsuz-sz /bin/bashz-c) rI r: r; r< CAGEFS_ENTER_PATHr> r? shlexjoin)rN rO s r! build_command_for_userrU d s +----
7>>+ , , rw2
2
"*
4
r# domain_to_excludec x K t d{V }| | g }fd|D S )z
Get all domains associated with a given document root, excluding one domain.
It's panel-agnostic and uses a cached mapping.
Nc g | ]
}|k | S rL rL ).0r. rV s r!
z+get_domains_for_docroot.. s$ L L Lv:K0K0KF0K0K0Kr# )r' get)r0 rV r- all_domainss ` r! get_domains_for_docrootr] { sS )********K //'2..K L L L L L L LLr# sitec P K ddl m}m} | | dt dt t f fd } || j }|r|S t
| j | j d{V }|D ]} || }|r|c S t d| j d )
z/Determine PHP binary path for the given WPSite.r )get_domains_php_infoget_installed_php_versionsr. r c | }|r| d k rd S | d }|sd S D ]2}| d |k r| d c S 3d S )NrN display_version
identifierbin)r[ )r. domain_infophp_display_version php_versiondomains_php_infoinstalled_php_versionsrN s r! find_php_binary_for_domainz7get_php_binary_path..find_php_binary_for_domain s &**622 kooj 9 9X E E4 )oo.? @ @" 41 . .K|,,0CCC"u----- Dtr# )rV Nz+PHP binary was not identified for docroot: z , username: ) clcommon.cpapir` ra r r r. r] r0 r )
r^ rN r` ra rk php_binary_pathdomainsr. ri rj s
` @@r! get_php_binary_pathro sX
,+-- 7 7 9 9 3 8C= 10==O , G # #44V<< #" " " " # dl r# c ddl m} | | \ }}|S # t $ r t d g cY S w xY w)z
Get malware history for the specified user.
This is an equivalent of calling `imunify360-agent malware history list --user {username}`.
Returns empty list if imav malware module is not available.
r )
MalwareHit)userz>imav.malwarelib not available, returning empty malware history)imav.malwarelib.modelrq malicious_list ImportErrorloggerdebug)rN rq max_counthitss r! get_malware_historyrz sx 444444 & 5 58 5 D DD L
s # &A A c $ K ddl m} ddlm} n,# t $ r t
d i cY S w xY w || }| |j |h d{V \ }}|si S | |dd }|d S )
z
Get the last scan for the specified user.
This is an equivalent of calling `imunify360-agent malware user list --user {username}`.
Returns empty dict if imav malware module is not available.
r )QueueSupervisorSync) user_listz8imav.malwarelib not available, returning empty last scan)matchN scan_dateT)desc)
*imav.malwarelib.scan.queue_supervisor_syncr| imav.malwarelib.utilsr} ru rv rw fetch_user_listget_scans_from_pathssort)sinkrN ScanQueuer} queue_userss r!
get_last_scanr s
4333333 F
IdOOE ..
"8* / HAu NN5+DN 9 9E 8Os &::c h t j }| t j k rF| |ddd }||k r|t d z
}| S | t j k rt|| dz dz z
dz dz }|dk r
|j |k rd}|t | z }| |ddd S | t j
k rddl m fd}|j
|k p5|j
|k o
|j |k p | |j |j d k } | r7 ||j |j | \ }
} | || |
|ddd }n| ||ddd }| S d
S ) a
Calculate the next scan timestamp based on schedule configuration.
Args:
interval: Scan interval (DAY, WEEK, MONTH, or NONE)
hour: Hour of day to run scan (0-23)
day_of_month: Day of month to run scan (1-31)
day_of_week: Day of week to run scan (0-6, where 0=Sunday)
Returns:
Timestamp of next scan, or None if interval is NONE
r )hourminutesecond microsecondr4 )days )
monthrangec | |}}|dz
}|dk rd}|dz
} || d }||k r||fS |dz
}|dk rd}|dz
}/)z;Find the next month that has at least given number of days.r4 rL )yearmonthr current_year
current_month
days_in_monthr s r! find_next_suitable_monthz?calculate_next_scan_timestamp..find_next_suitable_month s *.-L
Q M r!! !
!
& *
< G G J
=((' 66 "
2%%$%M A%L
&r# )dayr r r r r r )r r r r r N)r utcnowIntervalDAYreplacer timestampWEEKweekdayr MONTHcalendarr r r r )
intervalr day_of_month day_of_weektoday next_scan
days_aheadnext_scan_dater should_advance_month next_year
next_monthr s
@r! calculate_next_scan_timestampr s9
O E8< MM "
I *** *I""$$$8= "U]]__q%8A$==AQF
??uzT 1 1J
!;!;!;; %%aq &
)++ 8>!!'''''' & & & & &0
I $
E \)@ejD.@
E jjU[ A A! DD
$<$<
EK % % !Iz #]] + NN #]] + N '')))w "!r# c : K t t d{V S )zFetch installed versions of Imunify packages.
Returns a dict mapping package name to version string,
with None for packages that are not installed.
Intended to be called once per sync cycle (not per site).
N)r r rL r# r! get_imunify_package_versionsr J s) &&;<< < < < < < <>.%*<<%%%K
#
)" # #
| #
s A88A<?A<json_strc V | dd dd S )a
Escape a JSON string for embedding inside a PHP single-quoted string.
PHP single-quoted strings only recognise two escape sequences:
``\\`` (literal backslash) and ``\'`` (literal single quote).
All other backslash sequences are kept verbatim. That means we must
double every ``\`` *before* we escape ``'``, otherwise PHP will
consume JSON backslashes (e.g. ``\\s`` in JSON becomes ``\s``
after PHP parsing, which is not a valid JSON escape).
\\\'\'r )r s r! )_escape_json_for_php_single_quoted_stringr s* D& ) ) 1 1#u = ==r# escapedc V | dd dd S )z\
Reverse the escaping applied by :func:`_escape_json_for_php_single_quoted_string`.
r r r r r )r s r! _unescape_php_single_quoted_jsonr s( ??5# & & . .vt < <
)z .htaccessz index.phpz
index.htmlr r r N)r) r )r r r r protection_filesfilenamer r s r! #ensure_directory_listing_protectionr : sx LDD . 3 3 5 5
' x' ) wCS
r# user_infoc * K ddl m} | | d{V }d} t | }n# t $ r t |j ddt | g }t | d{V t | }n[# t $ rN}|j
t j t j fv rt d| d |t d | d
| |d}~ww xY wd }Y nEt $ r9}|j
t j t j fv rt d| d | d}~ww xY w |rt j |d t! || j |j |
t j | n# t j | w xY w|S )a Ensure the site's data directory exists with correct permissions.
The directory is opened with symlink protection after creation
(or if it already exists) to obtain a stable file descriptor.
All subsequent operations use that descriptor.
Args:
site: WordPress site
user_info: User information from pwd
Returns:
Path to data directory
Raises:
Exception: If the data directory is a symlink or cannot be created
r )cliNFmkdirz-pzData directory z is a symlink, skipping.z Failed to open data directory z: Ti r )defence360agent.wordpressr get_data_dirr FileNotFoundErrorrU pw_namer r OSErrorerrnoELOOPENOTDIR Exceptionr: chmodr r pw_gidclose)r^ r r r
newly_createdr commandexcs r! ensure_site_data_directoryr R s% & .-----%%d++++++++HM%h// )
dCMM *
)(33FF yU[%- 888 HhHHH BBBSBB
9em4 4 4D(DDD
$ HVU # # #+ $( (8
OsM 7 AD-<B D-
C$A C C$$D-+ D-44D((D-14E: :F)N)Nr r loggingr: pwdrS rA collectionsr r r functoolsr pathlibr typingr defence360agent.contracts.configr r
r !defence360agent.contracts.licenser +defence360agent.subsys.panels.hosting_panelr #defence360agent.subsys.panels.pleskr
defence360agent.utilsr r r r r defence360agent.utils.fd_opsr r defence360agent.model.wordpressr #defence360agent.wordpress.constantsr #defence360agent.wordpress.exceptionr rR r= frozensetr getLogger__name__rv objectr r" dictr( r' r3 r@ rI rM rU r] ro rz r r r floatr r intr r r r r r
struct_passwdr rL r# r! r) s
# # # # # # ( ( ( ( ( ( ( ( 9 8 8 8 8 8 D D D D D D 5 5 5 5 5 5 H G G G G G G G 2 2 2 2 2 2 C C C C C C 8 8 8 8 8 81 '<== 8 $ $ F s R
S$s)^ 4
9 9s 9t 9 9 9 9
1# "+ + +
S . M
M%( M #Y M M M M)F )c )hsm ) ) ) )X# $ ( >a* a* a*H=DcDj ,A = = = = .2
@ @@@ @ @
@ 3d
?#d*
@
@ @ @ @F2C 2D 2 2 2 2l JN
"%
,/
> > > > > =c =c = = = = 2 # $ :
#&
36
0>
> .> > > > > > >r#