Plugin Directory

Changeset 1422006


Ignore:
Timestamp:
05/22/2016 10:53:27 PM (10 years ago)
Author:
WebTechGlobal
Message:

Improvements made to the security feature for forcing administrator accounts limit.

Location:
multitool/trunk
Files:
12 edited

Legend:

Unmodified
Added
Removed
  • multitool/trunk/classes/class-automation.php

    r1420327 r1422006  
    2828   
    2929    /**
     30    * Used to determine if automated system is active or not.
     31    * This does not apply to administrator triggered automation as
     32    * that is required to run on its own.
     33    *
     34    * @var mixed
     35    */
     36    public $auto_switch = false;
     37   
     38    /**
    3039    * Force a delay on all automatic activity. Use this to prevent WTG plugins
    3140    * being too active in short periods of time.
     
    7786        // Add our own schedule delays to WordPress.
    7887        add_filter( 'cron_schedules', array( $this, 'webtechglobal_custom_cron_schedule' ) );
     88       
     89        // Get the automation switch status.
     90        $this->auto_switch = get_option( 'webtechglobal_auto_switch' );
    7991       
    8092        // Get the last time any automatic action was taking.
     
    198210    /**
    199211    * Focuses on updating the schedule table so that it reflects the users
    200     * requirements.
     212    * requirements i.e. if a plugin is updated, new schedule methods are
     213    * added or existing ones changed.
     214    *
     215    * Can also create cron jobs for WP Cron but this is not fully in use
     216    * at this time. It works but it does not offer great enough benefits over
     217    * the WTG Cron system.
    201218    *
    202219    * @author Ryan R. Bayne
     
    508525    */
    509526    public function webtechglobal_hourly_cron_function( $args ) {
    510         global $wpdb;
    511          
     527        global $wpdb;           
     528        // If automation not switched on return now.
     529        if( !$this->auto_switch )
     530        {                       
     531            return false;
     532        } 
     533       
    512534        // Apply an event delay to prevent flooding.
    513         if( $this->last_auto_time ) {
     535        if( $this->last_auto_time ) {    
    514536            $seconds_past = time() - $this->last_auto_time;
    515537            if( $seconds_past < $this->auto_delay_all ) {   
  • multitool/trunk/classes/class-configuration.php

    r1420327 r1422006  
    7070            array( 'admin_notices',                  array( 'multitool', 'admin_notices' ),                               'admin_notices', null ),                   
    7171            array( 'wp_before_admin_bar_render',     array( 'multitool', 'admin_toolbars',999),                           'pluginscreens', null ),
     72           
     73            ################################################################
     74            #                                                              #
     75            #                    AUTOMATION AND SCHEDULING                 #
     76            #                                                              #
     77            ################################################################
     78           
     79            // WTG Cron main hourly job processes all scheduled actions.
    7280            array( 'init',                           array( 'multitool', 'webtechglobal_hourly_cron_function', 1 ),       'cron', null ),         
    73 
    74             // Widgets
     81            // When admin logged in runs constantly.
     82            array( 'init',                           array( 'multitool', 'administrator_triggered_automation', 1 ),       'administrator', null ),         
     83
     84            ################################################################
     85            #                                                              #
     86            #                             WIDGETS                          #
     87            #                                                              #
     88            ################################################################
    7589            array( 'widgets_init',                   array( 'multitool', 'Foo_Widget' ),                                  'widget', null ),           
    7690               
  • multitool/trunk/classes/class-forms.php

    r1420327 r1422006  
    2828        'textarea',
    2929        'radiogroup',
     30        'boolean',
    3031        'switch',
    3132        'password',
     
    15921593        <input type="hidden" name="<?php echo esc_attr( $this->inputname ); ?>" id="<?php echo esc_attr( $this->inputid ); ?>" value="<?php echo esc_attr( $this->currentvalue );?>"<?php echo $disabled; ?>><?php     
    15931594    }
    1594    
    1595     /**
    1596     * table row with two choice radio group styled by WordPress and used for switch type settings
    1597     *
    1598     * $current_value should be enabled or disabled, use another method and do not change this if you need other values
     1595
     1596    /**
     1597    * A boolean radio switch.
     1598    *
     1599    * @version 1.0
     1600    *
     1601    * @todo Shorten the input lines by moving functions to new lines.
     1602    */
     1603    public function input_boolean(){
     1604        // Init a default value if not passed by the input function.
     1605        if( !isset( $this->defaultvalue ) ) {
     1606            $defaultvalue = 0;
     1607        }
     1608       
     1609        // Force a normal default if the giving default is not valid.
     1610        if( $this->defaultvalue != 1 && $this->defaultvalue != 0 ){
     1611            $defaultvalue = 0;
     1612        }
     1613                 
     1614        // Force a valid current value if the giving is not valid.       
     1615        if( isset( $this->currentvalue ) ) {
     1616            if( $this->currentvalue != 1 && $this->currentvalue != 0 ){
     1617                $this->currentvalue = $this->defaultvalue;
     1618            }   
     1619        }
     1620
     1621        // Apply input disabled state.
     1622        $disabled = '';
     1623        if( isset( $this->disabled ) && $this->disabled === true ) {
     1624            $disabled = ' disabled';
     1625        }
     1626         
     1627        // Apply the selected status.
     1628        $true = ''; $false = '';
     1629        if( $this->currentvalue == 1 ) { $true = ' checked';}
     1630        if( $this->currentvalue == 0 ) { $false = ' checked';}
     1631        ?>
     1632   
     1633        <!-- Option Start -->
     1634        <tr valign="top">
     1635            <th scope="row"><?php _e( $this->optiontitle, 'multitool' ); ?></th>
     1636            <td>
     1637                <fieldset<?php echo esc_attr( $disabled ); ?>><legend class="screen-reader-text"><span><?php echo esc_html( $this->optiontitle ); ?></span></legend>
     1638                    <input type="radio" id="<?php echo esc_attr( $this->inputname );?>_enabled" name="<?php echo esc_attr( $this->inputname );?>" value="1" <?php echo $true;?> />
     1639                    <label for="<?php echo esc_attr( $this->inputname );?>_enabled"> <?php echo esc_html( $this->first_switch_label ); ?></label>
     1640                    <br />
     1641                    <input type="radio" id="<?php echo esc_attr( $this->inputname );?>_disabled" name="<?php echo esc_attr( $this->inputname );?>" value="0" <?php echo $false;?> />
     1642                    <label for="<?php echo esc_attr( $this->inputname );?>_disabled"> <?php echo esc_html( $this->second_switch_label ); ?></label>
     1643                </fieldset>
     1644            </td>
     1645        </tr>
     1646        <!-- Option End -->
     1647                           
     1648    <?php 
     1649    }
     1650       
     1651    /**
     1652    * Radio buttons offering two choices. Use as a switch.
     1653    *
     1654    * $current_value should be enabled or disabled.
     1655    *
     1656    * Use input_boolean() for a true, false approach.
    15991657    *     
    1600     * @param mixed $title
    1601     * @param mixed $name
    1602     * @param mixed $id
    1603     * @param mixed $current_value
    1604     * @param string $default pass enabled or disabled depending on the softwares default state
     1658    * @deprecated use input_boolean() and store 1 or 0 not enabled or disabled
    16051659    */
    16061660    public function input_switch(){
     
    16471701    * Basic radiogroup input.
    16481702    *
    1649     * @param mixed $title
    1650     * @param mixed $id
    1651     * @param mixed $name
    1652     * @param mixed $radio_array
    1653     * @param mixed $current
    1654     * @param mixed $default
    1655     * @param mixed $validation
    16561703    */
    16571704    public function input_radiogroup(){
     
    20182065   
    20192066    /**
    2020     * a standard menu of categories wrapped in <td>
     2067    * A standard menu of categories wrapped in <td>
     2068    *
     2069    * @version 1.0
    20212070    */
    20222071    public function input_menu_categories(){   
     
    20542103   
    20552104    /**
    2056     * radio group of post types wrapped in <tr>
    2057     *
    2058     * @param string $title
    2059     * @param string $name
    2060     * @param string $id
    2061     * @param string $current_value
     2105    * Radio group of post types wrapped in <tr>
     2106    *
     2107    * @version 1.0
    20622108    */
    20632109    public function input_radiogroup_posttypes(){
     
    21172163    * Radio group of post formats wrapped in table.
    21182164    *
    2119     * @param mixed $title
    2120     * @param mixed $name
    2121     * @param mixed $id
    2122     * @param mixed $current_value
    2123     * @param mixed $validation
     2165    * @version 1.0
    21242166    */
    21252167    public function input_radiogroup_postformats(){ 
     
    21762218    * @since 0.0.1
    21772219    * @version 1.0
    2178     *
    2179     * @param string $title
    2180     * @param string $name
    2181     * @param string $id
    2182     * @param string $validation - pass name of a custom validation function
    21832220    */
    21842221    public function input_file(){?>         
     
    21932230    /**
    21942231    * A table row with menu of all WordPress capabilities
    2195     *
    2196     * @param mixed $title
    2197     * @param mixed $id
    2198     * @param mixed $name
    2199     * @param mixed $current
    22002232    *
    22012233    * @author Ryan R. Bayne
     
    27142746
    27152747    /**
     2748    * Two radios with boolean values to act as a toggle/switch.
     2749    *
     2750    * @author Ryan R. Bayne
     2751    * @package WebTechGlobal WordPress Plugins
     2752    * @since 0.0.1
     2753    * @version 1.0
     2754    */
     2755    public function boolean_basic( $formid, $id, $name, $title, $defaultvalue = 0, $current_value = '', $required = false ) {
     2756        self::input( $formid, 'boolean', $id, $name, $title, $title, $required, $current_value, array( 'defaultvalue' => $defaultvalue ), array() );
     2757    }
     2758
     2759    /**
    27162760    * Switch configuration (two radios for switching between two states, modes)
    27172761    *
     
    27192763    * @package WebTechGlobal WordPress Plugins
    27202764    * @since 0.0.1
    2721     * @version 1.0
     2765    * @version 1.2
    27222766    */
    27232767    public function switch_basic( $formid, $id, $name, $title, $defaultvalue = 'disabled', $current_value = '', $required = false ) {
    2724         self::input( $formid, 'switch', $id, $name, $title, $title, $required, $current_value, array( 'defaultvalue' => 'disabled' ), array() );
     2768        self::input( $formid, 'switch', $id, $name, $title, $title, $required, $current_value, array( 'defaultvalue' => $defaultvalue ), array() );
    27252769    }
    27262770
     
    29402984    * @param mixed $item_value
    29412985    * @param mixed $output
     2986    *
    29422987    * @return mixed
     2988    *
     2989    * @version 1.0
    29432990    */
    29442991    public function is_checked( $actual_value, $item_value, $output = 'return' ){
    2945         if( $actual_value === $item_value){
     2992        if( $actual_value === $item_value ){
    29462993            if( $output == 'return' ){
    29472994                return ' checked';
  • multitool/trunk/classes/class-multitool.php

    r1420327 r1422006  
    9595        }                   
    9696    }
    97                            
     97   
     98    /**
     99    * Administrator Triggered Automation.
     100    *
     101    * This is an easy way to run tasks normally scheduled but with a user
     102    * who is monitoring the blog and can respond to any problems or
     103    * evidence that an automated task is over demanding and its activation
     104    * by CRON needs to be reviewed.
     105    *
     106    * @author Ryan R. Bayne
     107    * @package WebTechGlobal WordPress Plugins
     108    * @since 0.0.0
     109    * @version 1.0
     110    *
     111    * @todo Add field for user to set a delay.
     112    * @todo Add options fields for activating individual functions within this method.
     113    */
     114    public function administrator_triggered_automation() {
     115
     116        // Has administration triggered automation been activated?
     117        if( !get_option( 'multitool_adm_trig_auto') )
     118        {       
     119            return false;// User has not activated admin triggered automation. 
     120        }
     121                 
     122        // clear out log table (48 hour log)
     123        self::log_cleanup();
     124               
     125        // Encorce maximum number of administration accounts.
     126        $this->SECURITY = self::load_class( 'MULTITOOL_Security', 'class-security.php', 'classes' ); # interface, mainly notices
     127        $this->SECURITY->security_adminaccounts_capenforcement();
     128    }
     129             
    98130    /**
    99131    * Set variables that are required on most pages.
     
    13021334        }
    13031335    }
    1304  
    1305     /**
    1306     * Administrator Triggered Automation.
    1307     *
    1308     * This is an easy way to run tasks normally scheduled but with a user
    1309     * who is monitoring the blog and can respond to any problems or
    1310     * evidence that an automated task is over demanding and its activation
    1311     * by CRON needs to be reviewed.
    1312     *
    1313     * @author Ryan R. Bayne
    1314     * @package WebTechGlobal WordPress Plugins
    1315     * @since 0.0.0
    1316     * @version 1.0
    1317     */
    1318     public function administrator_triggered_automation() {
    1319         // clear out log table (48 hour log)
    1320         self::log_cleanup();
    1321                
    1322         // prevent hackers adding administrator accounts, requires a cap
    1323         self::security_adminaccounts_capenforcement();
    1324     }
    1325 
    1326     /**
    1327     * Enforces a limit on the number of allowed administration accounts.
    1328     *
    1329     * This is something to bring into effect if hackers are injecting data
    1330     * into wp_users table. Removal of new users is not enough as an infection
    1331     * or attack may occur again.
    1332     *
    1333     * @author Ryan R. Bayne
    1334     * @package WebTechGlobal WordPress Plugins
    1335     * @version 1.2
    1336     */
    1337     public function security_adminaccounts_capenforcement() {
    1338         global $multitool_settings;
    1339                    
    1340         if( !isset( $multitool_settings['securitysettings']['adminaccountcap'] ) ) {
    1341             return;   
    1342         }       
    1343        
    1344         $cap = $multitool_settings['securitysettings']['adminaccountcap'];
    1345          
    1346         if( !isset( $multitool_settings['securitysettings']['enforceaccountcap'] ) ) {
    1347             return;   
    1348         }
    1349        
    1350         if( $multitool_settings['securitysettings']['enforceaccountcap'] !== true ) {
    1351             return;   
    1352         }     
    1353              
    1354         if( !is_numeric( $cap ) ) {
    1355             return;   
    1356         }
    1357                
    1358         // avoid the risk of disabling the only admin account that exists     
    1359         if( $cap < 2 ) {
    1360             return;   
    1361         }
    1362              
    1363         // return admin and NEAR admin and a count of result (array)
    1364         $total_admin_accounts = self::total_administrators( true, true );
    1365                  
    1366         if( !$total_admin_accounts['count'] ) {
    1367             // TODO 2 Task: flag this situation, enforcement active but no cap!?
    1368             return;// cap setting or file not found (user has not set it up)
    1369         }
    1370        
    1371         if( $total_admin_accounts['count'] > $cap ) {
    1372             // alert! Possibly hack has happened and may still be in progress.
    1373             $suspended_accounts = array();
    1374             $email_content_list = '';     
    1375             // get users OVER the cap then change those LATEST users to subscribers
    1376             $output = array_slice( $total_admin_accounts['users'], $cap );
    1377 
    1378             foreach( $output as $key => $user ) {
    1379  
    1380                 // for some safety avoid changing user with ID 1
    1381                 if( $user->ID === 1 ) {
    1382                     continue;   
    1383                 }
    1384  
    1385                 // change potential hacker account to subscriber
    1386                 $u = new WP_User( $user->ID );
    1387 
    1388                 // Remove role
    1389                 $u->remove_role( 'administrator' );
    1390 
    1391                 // Add role
    1392                 $u->add_role( 'subscriber' );           
    1393                
    1394                 // store user ID's that have been suspended
    1395                 $suspended_accounts[] = $user->ID;
    1396                
    1397                 // build content for emailing administrator
    1398                 $email_content_list .= $user->ID . ' - ' . $user->user_email;
    1399                
    1400                 // add user meta to track the account
    1401                 add_user_meta( $user->ID, 'webtechglobalsuspension', array(
    1402                     'time' => time(),
    1403                     'plugin' => MULTITOOL_TITLE,
    1404                     'reason' => __( 'Possible security breach detected. This user
    1405                     account may have been created by a hacker. Please consult with
    1406                     Ryan Bayne at WebTechGlobal if you are unsure why this message
    1407                     exists in your data. ', 'multitool' ),
    1408                 ), true );
    1409             }
    1410            
    1411             $email_recipients = array();
    1412            
    1413             $multiple_recipients[] = get_option( 'admin_email' );
    1414            
    1415             $subj = __( 'WebTechGlobal Security Alert: Admin accounts hack', 'multitool' );
    1416 
    1417             // set content-type
    1418             add_filter( 'wp_mail_content_type', array( $this, 'set_html_content_type') );
    1419                        
    1420             wp_mail( $multiple_recipients, $subj, $email_content_list );
    1421 
    1422             // Reset content-type to avoid conflicts -- http://core.trac.wordpress.org/ticket/23578
    1423             remove_filter( 'wp_mail_content_type', array( $this, 'set_html_content_type') );           
    1424         }
    1425     }
    14261336
    14271337    public function set_html_content_type() {
     
    14501360       
    14511361        return false;
    1452     }
    1453    
    1454     /**
    1455     * Count total number of "administrators". This is the beginning of
    1456     * security to counteract a hack quickly, where illegal users are being
    1457     * entered into the wp_users table.
    1458     *
    1459     * I have added the ability to return the result so that a count and
    1460     * user query can be done separate and ensure each result matches.
    1461     *
    1462     * @author Ryan R. Bayne
    1463     * @package WebTechGlobal WordPress Plugins
    1464     * @version 1.0
    1465     *
    1466     * @todo include users with highest capabilities ($partial_admin)
    1467     */
    1468     public function total_administrators( $partial_admin = false, $return_users = false ) {
    1469         $args = array(
    1470             'role'         => 'administrator',
    1471         ); 
    1472 
    1473         // if $partial_admin = true check for none "administrator" users
    1474         // who have create_user, delete user or activate_plugin capabilities
    1475 
    1476         $users = get_users( $args );
    1477        
    1478         $count = count( $users );
    1479        
    1480         if( $return_users ) {
    1481             return array(
    1482                 'count' => $count,
    1483                 'users' => $users
    1484             );   
    1485         }
    1486 
    1487         return $count;     
    14881362    }
    14891363         
  • multitool/trunk/classes/class-requests.php

    r1420327 r1422006  
    208208        $this->UI->n_postresult_depreciated( 'success', __( 'Log Settings Saved', 'multitool' ), __( 'It may take sometime for new log entries to be created depending on your websites activity.', 'multitool' ) ); 
    209209    } 
    210    
    211     /**
    212     * Save drip feed limits 
    213     */
    214     public function schedulerestrictions() {
    215         $multitool_schedule_array = $this->MULTITOOL->get_option_schedule_array();
    216        
    217         // if any required values are not in $_POST set them to zero
    218         if(!isset( $_POST['day'] ) ){
    219             $multitool_schedule_array['limits']['day'] = 0;       
    220         }else{
    221             $multitool_schedule_array['limits']['day'] = $_POST['day'];           
    222         }
    223        
    224         if(!isset( $_POST['hour'] ) ){
    225             $multitool_schedule_array['limits']['hour'] = 0;
    226         }else{
    227             $multitool_schedule_array['limits']['hour'] = $_POST['hour'];           
    228         }
    229        
    230         if(!isset( $_POST['session'] ) ){
    231             $multitool_schedule_array['limits']['session'] = 0;
    232         }else{
    233             $multitool_schedule_array['limits']['session'] = $_POST['session'];           
    234         }
    235                                  
    236         // ensure $multitool_schedule_array is an array, it may be boolean false if schedule has never been set
    237         if( isset( $multitool_schedule_array ) && is_array( $multitool_schedule_array ) ){
    238            
    239             // if times array exists, unset the [times] array
    240             if( isset( $multitool_schedule_array['days'] ) ){
    241                 unset( $multitool_schedule_array['days'] );   
    242             }
    243            
    244             // if hours array exists, unset the [hours] array
    245             if( isset( $multitool_schedule_array['hours'] ) ){
    246                 unset( $multitool_schedule_array['hours'] );   
    247             }
    248            
    249         }else{
    250             // $schedule_array value is not array, this is first time it is being set
    251             $multitool_schedule_array = array();
    252         }
    253        
    254         // loop through all days and set each one to true or false
    255         if( isset( $_POST['multitool_scheduleday_list'] ) ){
    256             foreach( $_POST['multitool_scheduleday_list'] as $key => $submitted_day ){
    257                 $multitool_schedule_array['days'][$submitted_day] = true;       
    258             } 
    259         }
    260        
    261         // loop through all hours and add each one to the array, any not in array will not be permitted                             
    262         if( isset( $_POST['multitool_schedulehour_list'] ) ){
    263             foreach( $_POST['multitool_schedulehour_list'] as $key => $submitted_hour){
    264                 $multitool_schedule_array['hours'][$submitted_hour] = true;       
    265             }           
    266         }   
    267 
    268         if( isset( $_POST['deleteuserswaiting'] ) )
    269         {
    270             $multitool_schedule_array['eventtypes']['deleteuserswaiting']['switch'] = 'enabled';               
    271         }
    272        
    273         if( isset( $_POST['eventsendemails'] ) )
    274         {
    275             $multitool_schedule_array['eventtypes']['sendemails']['switch'] = 'enabled';   
    276         }       
    277  
    278         $this->MULTITOOL->update_option_schedule_array( $multitool_schedule_array );
    279         $this->UI->notice_depreciated( __( 'Schedule settings have been saved.', 'multitool' ), 'success', 'Large', __( 'Schedule Times Saved', 'multitool' ) );   
    280     }
    281    
     210
    282211    /**
    283212    * Processes a request by form submission.
     
    335264        $multitool_settings['developermode']['developermodeswitch'] = $_POST['developermodeswitch'];
    336265        $multitool_settings['api']['twitter']['active'] = $_POST['twitterapiswitch'];
    337        
     266
    338267        $this->MULTITOOL->update_settings( $multitool_settings );
    339268        $this->UI->create_notice( __( 'Global switches have been updated. These
     
    13411270        add_option( 'webtechglobal_auto_plugins', array() );
    13421271        add_option( 'webtechglobal_auto_actionssettings', array() );
     1272           
     1273        // Update automation switch, this is global to all plugins.
     1274        // Does not apply to administration triggered automation.
     1275        $existing_auto_value = get_option( 'webtechglobal_auto_switch' );
    13431276       
    1344         // Also initialize the hourly CRON job which is our basic primary trigger. 
    1345         // TODO: allow user to select Single Hourly Cron or Many Cron           
    1346         if (! wp_next_scheduled ( 'webtechglobal_hourly_cron' )) {
    1347             wp_schedule_event( time() + 100, 'hourly', 'webtechglobal_hourly_cron', array( 'trigger' => 'hourlycron' ) );
    1348             $description = __( "A cron job is simply the name of a schedule event controlled by
    1349             your server. By submitting the automation settings you have setup an hourly cron job which
    1350             will check for oustanding tasks. This is also done using WordPress core scheduling functions. You have
    1351             the option of allowing a single hourly cron job to process all tasks or allow this plugin to make
    1352             cron jobs for all tasks.", 'multitool' ); 
    1353             $this->UI->create_notice(
    1354                 $description,
    1355                 'info',
    1356                 'Small',
    1357                 __( 'Hourly Cron Job Scheduled', 'multitool' )
    1358             );         
    1359         }
    1360                
    1361         // Update automation switch, this is global to all plugins.
    1362         update_option( 'webtechglobal_auto_switch', $_POST['automationswitch'] );
    1363         if( $_POST['automationswitch'] === 'enabled' )
    1364         {             
     1277        if( $_POST['automationswitch'] == 1 && $existing_auto_value != 1 )
     1278        {   
     1279            update_option( 'webtechglobal_auto_switch', 1 );         
    13651280            $description = __( "Automation and scheduling is now active. This switch
    13661281            applies to all WebTechGlobal plugins. However you must submit the same
     
    13741289            );         
    13751290        }
    1376         else
     1291        elseif( $_POST['automationswitch'] == 0 && $existing_auto_value != 0 )
    13771292        {
     1293            update_option( 'webtechglobal_auto_switch', 0 );
    13781294            $description = __( "Automation and scheduling has been disabled. This switch
    13791295            applies to all WebTechGlobal plugins. If you had multiple plugins registered
     
    13891305            );         
    13901306        }
     1307       
     1308        $existing_admintrigauto_value = get_option( 'multitool_adm_trig_auto' );
     1309        if( $_POST['adminautotrigswitch'] == true && $existing_admintrigauto_value !== true )
     1310        {   
     1311            update_option( 'multitool_adm_trig_auto', true );         
     1312            $description = __( "Multitool will perform automated tasks while
     1313            an administrator is logged in and loading WordPress.", 'multitool' ); 
     1314            $this->UI->create_notice(
     1315                $description,
     1316                'success',
     1317                'Small',
     1318                __( 'Administrator Triggered Automation Enabled', 'multitool' )
     1319            );         
     1320        }
     1321        elseif( $_POST['adminautotrigswitch'] == false && $existing_admintrigauto_value !== false )
     1322        {
     1323            update_option( 'multitool_adm_trig_auto', false );
     1324            $description = __( "Multitool will not run automation triggered by
     1325            administrators being logged in and loading WordPress administration
     1326            views.", 'multitool' ); 
     1327            $this->UI->create_notice(
     1328                $description,
     1329                'success',
     1330                'Small',
     1331                __( 'Administrator Triggered Automation Disabled', 'multitool' )
     1332            );         
     1333        }       
    13911334       
    13921335        // Process plugins registration.
  • multitool/trunk/classes/class-schedule.php

    r1420327 r1422006  
    2020        $this->DB = $CONFIG->load_class( 'MULTITOOL_DB', 'class-wpdb.php', 'classes' ); # database interaction
    2121        $this->PHP = $CONFIG->load_class( 'MULTITOOL_PHP', 'class-phplibrary.php', 'classes' ); # php library by Ryan R. Bayne
    22     }
    23      
     22    }   
     23   
    2424    /**
    2525    * Sample scheduled method primarily for WTG Cron system and not WP Cron.
  • multitool/trunk/classes/class-wpcore.php

    r1365891 r1422006  
    3333        }
    3434        return $capabilities_array;
    35     }   
     35    }
     36   
     37    /**
     38    * Count total number of "administrators". This is the beginning of
     39    * security to counteract a hack quickly, where illegal users are being
     40    * entered into the wp_users table.
     41    *
     42    * I have added the ability to return the result so that a count and
     43    * user query can be done separate and ensure each result matches.
     44    *
     45    * @author Ryan R. Bayne
     46    * @package WebTechGlobal WordPress Plugins
     47    * @version 1.0
     48    *
     49    * @todo include users with highest capabilities ($partial_admin)
     50    */
     51    public function total_administrators( $partial_admin = false, $return_users = false ) {
     52        $args = array(
     53            'role'         => 'administrator',
     54        ); 
     55
     56        // if $partial_admin = true check for none "administrator" users
     57        // who have create_user, delete user or activate_plugin capabilities
     58
     59        $users = get_users( $args );
     60       
     61        $count = count( $users );
     62       
     63        if( $return_users ) {
     64            return array(
     65                'count' => $count,
     66                'users' => $users
     67            );   
     68        }
     69       
     70        return $count;     
     71    }       
    3672}
    3773?>
  • multitool/trunk/inc/fields/automationsettings.php

    r1420327 r1422006  
    2020<?php
    2121// Global switch for WebTechGlobal automation class.
    22 $this->FORMS->switch_basic(
     22$autoswitch_current = get_option( 'webtechglobal_auto_switch', 'multitool' );
     23$this->FORMS->boolean_basic(
    2324    $formid,
    2425    'automationswitch',
    2526    'automationswitch',
    2627    __( 'Automation Switch', 'multitool' ),
    27     'disabled',
    28     get_option( 'webtechglobal_auto_switch', 'multitool' ),
     28    0,
     29    $autoswitch_current,
    2930    false
    3031);
     32
     33// Plugin switch for Multitool administrator triggered automation.
     34$adminauto_current = get_option( 'multitool_adm_trig_auto', 'multitool' );
     35$this->FORMS->boolean_basic(
     36    $formid,
     37    'adminautotrigswitch',
     38    'adminautotrigswitch',
     39    __( 'Administration Triggered Automation', 'multitool' ),
     40    0,
     41    $adminauto_current,
     42    false
     43);
     44
     45// TODO: add check boxes for individual admin triggered auto actions. See administrator_triggered_automation().
    3146
    3247// Display a list of the plugins that have been added to the automation system.
  • multitool/trunk/multitool.php

    r1420327 r1422006  
    22/*
    33Plugin Name: Multitool Beta
    4 Version: 1.0.3
     4Version: 1.0.4
    55Plugin URI: http://www.webtechglobal.co.uk/wtg-plugin-framework-wordpress/
    66Description: Multitool does a little bit of everything.
     
    4141
    4242// define package constants...                                           
    43 if(!defined( "MULTITOOL_VERSION") ){define( "MULTITOOL_VERSION", '1.0.3' );}
     43if(!defined( "MULTITOOL_VERSION") ){define( "MULTITOOL_VERSION", '1.0.4' );}
    4444if(!defined( "MULTITOOL_RELEASENAME") ){define( "MULTITOOL_RELEASENAME", 'Beta' );}                         
    4545if(!defined( "MULTITOOL_TITLE") ){define( "MULTITOOL_TITLE", 'Multitool' );}
  • multitool/trunk/readme.txt

    r1420327 r1422006  
    44License: GPLv2 or later
    55License URI: http://www.gnu.org/licenses/gpl-2.0.html
    6 Tags: Tool Kit, Tools Kit, Tools, Multi, Multitool
     6Tags: Tool Kit, Tools Kit, Tools, Multi, Multitool, cron, scheduling
    77Requires at least: 3.8.0
    88Tested up to: 4.3.1
    99Stable tag: trunk
    1010                       
    11 Multitool is a place for new ideas to start before becoming the full plugin.
     11Multitool aims to cover all aspects of WordPress in one massive plugin.
    1212                       
    1313== Description ==
     
    7474
    7575== Changelog ==
    76 
     76= 1.0.4 =
     77* Feature Changes
     78    * "Hourly Cron Job Scheduled" is not longer displayed when submitting main scheduling settings.
     79    * Maximum Admin Accounts input now displays the stored value. It was always saved, just not displays in form.
     80    * Security section and on admin accounts tab now has information about the most recent breach.
     81* Technical Notes
     82    * The WP cron job "webtechglobal_hourly_cron" is no longer initiated.
     83    * Maximum admin accounts security no longer adds subscriber role, it only removed administrator role.
     84    * Admin accounts security now disables all admin accounts apart from those with ID's 1 and 2
     85   
    7786= 1.0.3 =
    7887* Feature Changes
     
    8493    * Added jQuery UI .css and images
    8594    * get_currentuserinfo() depreciated and replaced with wp_get_current_user()
     95    * jQuery UI files added for datepicker and timepicker in-one
     96    * Changed the way the plugin is initiated. Now uses init() and sets global $MULTITOOL_Class.
    8697   
    8798= 1.0.2 =
  • multitool/trunk/views/adminaccounts.php

    r1420327 r1422006  
    3838            array( $this->view_name . '-capmonitoringswitch', __( 'Admin Cap Monitoring', 'multitool' ), array( $this, 'parent' ), 'side','default',array( 'formid' => 'capmonitoringswitch' ), true, 'activate_plugins' ),           
    3939            array( $this->view_name . '-maximumadministrators', __( 'Maximum Administrators (cap)', 'multitool' ), array( $this, 'parent' ), 'normal','default',array( 'formid' => 'maximumadministrators' ), true, 'activate_plugins' ),
     40            array( $this->view_name . '-securityeventadmincap', __( 'Security Breach Details', 'multitool' ), array( $this, 'parent' ), 'normal','default',array( 'formid' => 'securityeventadmincap' ), true, 'activate_plugins' ),
    4041        );   
    4142    }           
     
    152153         
    153154    /**
    154     * Set a maximum number of adminstrator accounts. This is very simple. All
    155     * we need to do is keep counting the number of administrators. I may
    156     * do that by caching the administrator user ID's, caching the highest
    157     * ID, get all ID's above the highest and check them for admin rights. If
    158     * any have admin rights, check the user ID agains those cached as original
    159     * legal administrators. If the new admin ID is not in that cache then the
    160     * new admin is illegal.
     155    * Set a maximum number of adminstrator accounts.
    161156    *
    162157    * @author Ryan Bayne
     
    167162    * @todo allow user to enter email address for the security alert
    168163    */
    169     public function postbox_adminaccounts_maximumadministrators( $data, $box ) { 
     164    public function postbox_adminaccounts_maximumadministrators( $data, $box ) {
     165        global $multitool_settings;
     166         
    170167        $intro = __( 'This form allows you to enter
    171168        the maximum number of administrators permitted to exist in the database.
    172         If a hacker injects new user accounts and those accounts turn out to be
    173         administrators. This plugin will change those accounts to subscribers and
    174         notify the original key holder (first admin created).', 'multitool' );
     169        If a hacker injects new admin user into your database this plugin will
     170        change those accounts to subscribers and
     171        notify the original key holder (first admin created). We do not ever
     172        automatically delete a user and the code does not exist in this procedure
     173        to do that.', 'multitool' );
    175174         
    176175        $this->UI->postbox_content_header( $box['title'], $box['args']['formid'], $intro, false );
    177176               
    178177        $this->FORMS->form_start( $box['args']['formid'], $box['args']['formid'], $box['title'] );
    179 
     178           
    180179        $current_value = '';
    181180        if( isset( $multitool_settings['securitysettings']['adminaccountcap'] ) ) {
     
    196195                array( 'numeric' )
    197196            );
     197           
     198            // Display total number of administrators.
     199            $user_query = new WP_User_Query( array( 'role' => 'Administrator' ) );
     200            $total_admins = count( $user_query );
     201            $this->FORMS->input_emptyrow( __( 'Total Administrators', 'multitool' ), $total_admins );
    198202            ?>
    199203           
     
    222226         
    223227            $intro = __( 'Disable Administrator Account Cap enforcement. This is
    224             a security feature that frequently checks user data. It is recommended
    225             that you run it temporarily or configure this plugin so that the checks
    226             are less frequent. If you activated it because your WordPress was hacked
    227             you should be aware that this feature is not a fix and only makes it harder
    228             for a hacker/bot to use illegal administration accounts.', 'multitool' );
    229             $button_text = __( 'Disabled Security Measure', 'multitool' );
     228            a security feature that frequently checks user data. If it detects
     229            extra administrator accounts it takes action. Do not disable it if you
     230            are under constant attack from hackers who inject new administrator
     231            accounts into your user table or change a normal registered subscriber
     232            to an administrator.', 'multitool' );
     233            $button_text = __( 'Disable Security Measure', 'multitool' );
    230234           
    231235        } else {
    232236           
    233             $intro = __( 'Activate in the event of your WordPress being hacked/infected
    234             and you have confirmed the creation of illegal administrator accounts.
    235             This plugin will frequently check for new user accounts with the
    236             administrator role, then downgrade them to subscribers. It will also
    237             send you an email detailing accounts that are under suspicion. To make
    238             this work you must submit the "Maximum Administrators (cap)" form.
     237            $intro = __( 'Activate to monitor the total number of administrators
     238            in your user table. If a hacker injects a new user or changes a
     239            seemingly harmless subscriber account to an administrator this
     240            plugin will prevent them using the administration account.
     241            All administrator accounts will have their administrator capability
     242            removed apart from those with ID 1 and 2. This covers any situation
     243            where a previously trusted administrator account is breached. The
     244            account with ID 2 is often and administrator also. It is a common
     245            practice to create a second administrator account when WordPress is
     246            setup. It is also less likely to be the account that is breached even
     247            if it is a subscriber.
    239248            ', 'multitool' );
    240249        }
     
    251260        $this->UI->postbox_content_footer( $button_text );
    252261    }
     262   
     263    /**
     264    * Information about the most recent security breach that
     265    * involves extra administration accounts.
     266    *
     267    * @author Ryan Bayne
     268    * @package Multitool
     269    * @since 0.0.1
     270    * @version 1.0
     271    *
     272    * @todo Create button or just a link for resetting the security event option.
     273    */
     274    public function postbox_adminaccounts_securityeventadmincap( $data, $box ) {
     275        global $multitool_settings;
     276       
     277        $securityevent = get_option( 'multitool_securityevent_admincap' );
     278
     279        if( !is_array( $securityevent ) ) {
     280         
     281            $intro = __( 'Mulitool security has not detected extra administration
     282            accounts in your user table and there are no records of a security
     283            breech of this nature.', 'multitool' );
     284             
     285           
     286        } else {
     287           
     288             $intro = __( 'There are details about a possible security breach stored
     289            in your database. This breach is related to extra administrators being
     290            detected in the user table. Please review the information below and
     291            decide yourself. Illegal accounts should have been disabled by Multitool
     292            but you should ensure that is the case.', 'multitool' );
     293
     294        }
     295       
     296        $this->UI->postbox_content_header(
     297            $box['title'],
     298            $box['args']['formid'],
     299            $intro,
     300            false
     301        ); 
     302               
     303        $this->FORMS->form_start( $box['args']['formid'], $box['args']['formid'], $box['title'] );
     304             
     305        if( is_array( $securityevent ) ) {     
     306            ?> 
     307
     308                <table class="form-table">
     309               
     310                <?php
     311                $time = '';
     312                $limit = ''; 
     313               
     314                if( is_array( $securityevent ) ) {
     315                    $time = date( 'Y-m-d H:i:s', $securityevent['time'] );
     316                    $limit = $securityevent['cap'];     
     317                }
     318               
     319                $this->FORMS->input_emptyrow( __( 'Detection Time', 'multitool' ), $time );
     320                $this->FORMS->input_emptyrow( __( 'Admin Limit Was', 'multitool' ), $limit );
     321   
     322                ?>
     323               
     324                </table>
     325               
     326            <?php
     327            $this->UI->postbox_content_footer( __( 'Reset Security Information', 'multitool' ) );
     328        }
     329    }
     330           
    253331}?>
  • multitool/trunk/views/main.php

    r1420327 r1422006  
    165165            $this->UI->option_switch( __( 'Dashboard Widgets Switch', 'multitool' ), 'dashboardwidgetsswitch', 'dashboardwidgetsswitch', $multitool_settings['widgetsettings']['dashboardwidgetsswitch'], 'Enabled', 'Disabled', 'disabled' );     
    166166            $this->UI->option_switch( __( 'Developer Mode', 'multitool' ), 'developermodeswitch', 'developermodeswitch', $multitool_settings['developermode']['developermodeswitch'], 'Enabled', 'Disabled', 'disabled' );     
    167             $this->UI->option_switch( __( 'Twitter API Switch', 'multitool' ), 'twitterapiswitch', 'twitterapiswitch', $multitool_settings['api']['twitter']['active'], 'Enabled', 'Disabled', 'disabled' );     
     167            $this->UI->option_switch( __( 'Twitter API Switch', 'multitool' ), 'twitterapiswitch', 'twitterapiswitch', $multitool_settings['api']['twitter']['active'], 'Enabled', 'Disabled', 'disabled' );               
    168168            ?>
    169169            </table>
     
    407407    */
    408408    public function postbox_main_twitterupdates( $data, $box ) {   
    409         $introduction = __( 'Follow the WTG Twitter account for news on all things
    410         to do with the web - including updates about this plugin.', 'wtgeci' );       
     409        $introduction = __( 'Follow the WTG Twitter account for news updates on this plugins development.', 'wtgeci' );       
    411410        echo "<p class=\"multitool_boxes_introtext\">". $introduction ."</p>"       
    412411        ?>
Note: See TracChangeset for help on using the changeset viewer.