Changeset 1422006
- Timestamp:
- 05/22/2016 10:53:27 PM (10 years ago)
- Location:
- multitool/trunk
- Files:
-
- 12 edited
-
classes/class-automation.php (modified) (4 diffs)
-
classes/class-configuration.php (modified) (1 diff)
-
classes/class-forms.php (modified) (11 diffs)
-
classes/class-multitool.php (modified) (3 diffs)
-
classes/class-requests.php (modified) (5 diffs)
-
classes/class-schedule.php (modified) (1 diff)
-
classes/class-wpcore.php (modified) (1 diff)
-
inc/fields/automationsettings.php (modified) (1 diff)
-
multitool.php (modified) (2 diffs)
-
readme.txt (modified) (3 diffs)
-
views/adminaccounts.php (modified) (6 diffs)
-
views/main.php (modified) (2 diffs)
Legend:
- Unmodified
- Added
- Removed
-
multitool/trunk/classes/class-automation.php
r1420327 r1422006 28 28 29 29 /** 30 * Used to determine if automated system is active or not. 31 * This does not apply to administrator triggered automation as 32 * that is required to run on its own. 33 * 34 * @var mixed 35 */ 36 public $auto_switch = false; 37 38 /** 30 39 * Force a delay on all automatic activity. Use this to prevent WTG plugins 31 40 * being too active in short periods of time. … … 77 86 // Add our own schedule delays to WordPress. 78 87 add_filter( 'cron_schedules', array( $this, 'webtechglobal_custom_cron_schedule' ) ); 88 89 // Get the automation switch status. 90 $this->auto_switch = get_option( 'webtechglobal_auto_switch' ); 79 91 80 92 // Get the last time any automatic action was taking. … … 198 210 /** 199 211 * Focuses on updating the schedule table so that it reflects the users 200 * requirements. 212 * requirements i.e. if a plugin is updated, new schedule methods are 213 * added or existing ones changed. 214 * 215 * Can also create cron jobs for WP Cron but this is not fully in use 216 * at this time. It works but it does not offer great enough benefits over 217 * the WTG Cron system. 201 218 * 202 219 * @author Ryan R. Bayne … … 508 525 */ 509 526 public function webtechglobal_hourly_cron_function( $args ) { 510 global $wpdb; 511 527 global $wpdb; 528 // If automation not switched on return now. 529 if( !$this->auto_switch ) 530 { 531 return false; 532 } 533 512 534 // Apply an event delay to prevent flooding. 513 if( $this->last_auto_time ) { 535 if( $this->last_auto_time ) { 514 536 $seconds_past = time() - $this->last_auto_time; 515 537 if( $seconds_past < $this->auto_delay_all ) { -
multitool/trunk/classes/class-configuration.php
r1420327 r1422006 70 70 array( 'admin_notices', array( 'multitool', 'admin_notices' ), 'admin_notices', null ), 71 71 array( 'wp_before_admin_bar_render', array( 'multitool', 'admin_toolbars',999), 'pluginscreens', null ), 72 73 ################################################################ 74 # # 75 # AUTOMATION AND SCHEDULING # 76 # # 77 ################################################################ 78 79 // WTG Cron main hourly job processes all scheduled actions. 72 80 array( 'init', array( 'multitool', 'webtechglobal_hourly_cron_function', 1 ), 'cron', null ), 73 74 // Widgets 81 // When admin logged in runs constantly. 82 array( 'init', array( 'multitool', 'administrator_triggered_automation', 1 ), 'administrator', null ), 83 84 ################################################################ 85 # # 86 # WIDGETS # 87 # # 88 ################################################################ 75 89 array( 'widgets_init', array( 'multitool', 'Foo_Widget' ), 'widget', null ), 76 90 -
multitool/trunk/classes/class-forms.php
r1420327 r1422006 28 28 'textarea', 29 29 'radiogroup', 30 'boolean', 30 31 'switch', 31 32 'password', … … 1592 1593 <input type="hidden" name="<?php echo esc_attr( $this->inputname ); ?>" id="<?php echo esc_attr( $this->inputid ); ?>" value="<?php echo esc_attr( $this->currentvalue );?>"<?php echo $disabled; ?>><?php 1593 1594 } 1594 1595 /** 1596 * table row with two choice radio group styled by WordPress and used for switch type settings 1597 * 1598 * $current_value should be enabled or disabled, use another method and do not change this if you need other values 1595 1596 /** 1597 * A boolean radio switch. 1598 * 1599 * @version 1.0 1600 * 1601 * @todo Shorten the input lines by moving functions to new lines. 1602 */ 1603 public function input_boolean(){ 1604 // Init a default value if not passed by the input function. 1605 if( !isset( $this->defaultvalue ) ) { 1606 $defaultvalue = 0; 1607 } 1608 1609 // Force a normal default if the giving default is not valid. 1610 if( $this->defaultvalue != 1 && $this->defaultvalue != 0 ){ 1611 $defaultvalue = 0; 1612 } 1613 1614 // Force a valid current value if the giving is not valid. 1615 if( isset( $this->currentvalue ) ) { 1616 if( $this->currentvalue != 1 && $this->currentvalue != 0 ){ 1617 $this->currentvalue = $this->defaultvalue; 1618 } 1619 } 1620 1621 // Apply input disabled state. 1622 $disabled = ''; 1623 if( isset( $this->disabled ) && $this->disabled === true ) { 1624 $disabled = ' disabled'; 1625 } 1626 1627 // Apply the selected status. 1628 $true = ''; $false = ''; 1629 if( $this->currentvalue == 1 ) { $true = ' checked';} 1630 if( $this->currentvalue == 0 ) { $false = ' checked';} 1631 ?> 1632 1633 <!-- Option Start --> 1634 <tr valign="top"> 1635 <th scope="row"><?php _e( $this->optiontitle, 'multitool' ); ?></th> 1636 <td> 1637 <fieldset<?php echo esc_attr( $disabled ); ?>><legend class="screen-reader-text"><span><?php echo esc_html( $this->optiontitle ); ?></span></legend> 1638 <input type="radio" id="<?php echo esc_attr( $this->inputname );?>_enabled" name="<?php echo esc_attr( $this->inputname );?>" value="1" <?php echo $true;?> /> 1639 <label for="<?php echo esc_attr( $this->inputname );?>_enabled"> <?php echo esc_html( $this->first_switch_label ); ?></label> 1640 <br /> 1641 <input type="radio" id="<?php echo esc_attr( $this->inputname );?>_disabled" name="<?php echo esc_attr( $this->inputname );?>" value="0" <?php echo $false;?> /> 1642 <label for="<?php echo esc_attr( $this->inputname );?>_disabled"> <?php echo esc_html( $this->second_switch_label ); ?></label> 1643 </fieldset> 1644 </td> 1645 </tr> 1646 <!-- Option End --> 1647 1648 <?php 1649 } 1650 1651 /** 1652 * Radio buttons offering two choices. Use as a switch. 1653 * 1654 * $current_value should be enabled or disabled. 1655 * 1656 * Use input_boolean() for a true, false approach. 1599 1657 * 1600 * @param mixed $title 1601 * @param mixed $name 1602 * @param mixed $id 1603 * @param mixed $current_value 1604 * @param string $default pass enabled or disabled depending on the softwares default state 1658 * @deprecated use input_boolean() and store 1 or 0 not enabled or disabled 1605 1659 */ 1606 1660 public function input_switch(){ … … 1647 1701 * Basic radiogroup input. 1648 1702 * 1649 * @param mixed $title1650 * @param mixed $id1651 * @param mixed $name1652 * @param mixed $radio_array1653 * @param mixed $current1654 * @param mixed $default1655 * @param mixed $validation1656 1703 */ 1657 1704 public function input_radiogroup(){ … … 2018 2065 2019 2066 /** 2020 * a standard menu of categories wrapped in <td> 2067 * A standard menu of categories wrapped in <td> 2068 * 2069 * @version 1.0 2021 2070 */ 2022 2071 public function input_menu_categories(){ … … 2054 2103 2055 2104 /** 2056 * radio group of post types wrapped in <tr> 2057 * 2058 * @param string $title 2059 * @param string $name 2060 * @param string $id 2061 * @param string $current_value 2105 * Radio group of post types wrapped in <tr> 2106 * 2107 * @version 1.0 2062 2108 */ 2063 2109 public function input_radiogroup_posttypes(){ … … 2117 2163 * Radio group of post formats wrapped in table. 2118 2164 * 2119 * @param mixed $title 2120 * @param mixed $name 2121 * @param mixed $id 2122 * @param mixed $current_value 2123 * @param mixed $validation 2165 * @version 1.0 2124 2166 */ 2125 2167 public function input_radiogroup_postformats(){ … … 2176 2218 * @since 0.0.1 2177 2219 * @version 1.0 2178 *2179 * @param string $title2180 * @param string $name2181 * @param string $id2182 * @param string $validation - pass name of a custom validation function2183 2220 */ 2184 2221 public function input_file(){?> … … 2193 2230 /** 2194 2231 * A table row with menu of all WordPress capabilities 2195 *2196 * @param mixed $title2197 * @param mixed $id2198 * @param mixed $name2199 * @param mixed $current2200 2232 * 2201 2233 * @author Ryan R. Bayne … … 2714 2746 2715 2747 /** 2748 * Two radios with boolean values to act as a toggle/switch. 2749 * 2750 * @author Ryan R. Bayne 2751 * @package WebTechGlobal WordPress Plugins 2752 * @since 0.0.1 2753 * @version 1.0 2754 */ 2755 public function boolean_basic( $formid, $id, $name, $title, $defaultvalue = 0, $current_value = '', $required = false ) { 2756 self::input( $formid, 'boolean', $id, $name, $title, $title, $required, $current_value, array( 'defaultvalue' => $defaultvalue ), array() ); 2757 } 2758 2759 /** 2716 2760 * Switch configuration (two radios for switching between two states, modes) 2717 2761 * … … 2719 2763 * @package WebTechGlobal WordPress Plugins 2720 2764 * @since 0.0.1 2721 * @version 1. 02765 * @version 1.2 2722 2766 */ 2723 2767 public function switch_basic( $formid, $id, $name, $title, $defaultvalue = 'disabled', $current_value = '', $required = false ) { 2724 self::input( $formid, 'switch', $id, $name, $title, $title, $required, $current_value, array( 'defaultvalue' => 'disabled'), array() );2768 self::input( $formid, 'switch', $id, $name, $title, $title, $required, $current_value, array( 'defaultvalue' => $defaultvalue ), array() ); 2725 2769 } 2726 2770 … … 2940 2984 * @param mixed $item_value 2941 2985 * @param mixed $output 2986 * 2942 2987 * @return mixed 2988 * 2989 * @version 1.0 2943 2990 */ 2944 2991 public function is_checked( $actual_value, $item_value, $output = 'return' ){ 2945 if( $actual_value === $item_value ){2992 if( $actual_value === $item_value ){ 2946 2993 if( $output == 'return' ){ 2947 2994 return ' checked'; -
multitool/trunk/classes/class-multitool.php
r1420327 r1422006 95 95 } 96 96 } 97 97 98 /** 99 * Administrator Triggered Automation. 100 * 101 * This is an easy way to run tasks normally scheduled but with a user 102 * who is monitoring the blog and can respond to any problems or 103 * evidence that an automated task is over demanding and its activation 104 * by CRON needs to be reviewed. 105 * 106 * @author Ryan R. Bayne 107 * @package WebTechGlobal WordPress Plugins 108 * @since 0.0.0 109 * @version 1.0 110 * 111 * @todo Add field for user to set a delay. 112 * @todo Add options fields for activating individual functions within this method. 113 */ 114 public function administrator_triggered_automation() { 115 116 // Has administration triggered automation been activated? 117 if( !get_option( 'multitool_adm_trig_auto') ) 118 { 119 return false;// User has not activated admin triggered automation. 120 } 121 122 // clear out log table (48 hour log) 123 self::log_cleanup(); 124 125 // Encorce maximum number of administration accounts. 126 $this->SECURITY = self::load_class( 'MULTITOOL_Security', 'class-security.php', 'classes' ); # interface, mainly notices 127 $this->SECURITY->security_adminaccounts_capenforcement(); 128 } 129 98 130 /** 99 131 * Set variables that are required on most pages. … … 1302 1334 } 1303 1335 } 1304 1305 /**1306 * Administrator Triggered Automation.1307 *1308 * This is an easy way to run tasks normally scheduled but with a user1309 * who is monitoring the blog and can respond to any problems or1310 * evidence that an automated task is over demanding and its activation1311 * by CRON needs to be reviewed.1312 *1313 * @author Ryan R. Bayne1314 * @package WebTechGlobal WordPress Plugins1315 * @since 0.0.01316 * @version 1.01317 */1318 public function administrator_triggered_automation() {1319 // clear out log table (48 hour log)1320 self::log_cleanup();1321 1322 // prevent hackers adding administrator accounts, requires a cap1323 self::security_adminaccounts_capenforcement();1324 }1325 1326 /**1327 * Enforces a limit on the number of allowed administration accounts.1328 *1329 * This is something to bring into effect if hackers are injecting data1330 * into wp_users table. Removal of new users is not enough as an infection1331 * or attack may occur again.1332 *1333 * @author Ryan R. Bayne1334 * @package WebTechGlobal WordPress Plugins1335 * @version 1.21336 */1337 public function security_adminaccounts_capenforcement() {1338 global $multitool_settings;1339 1340 if( !isset( $multitool_settings['securitysettings']['adminaccountcap'] ) ) {1341 return;1342 }1343 1344 $cap = $multitool_settings['securitysettings']['adminaccountcap'];1345 1346 if( !isset( $multitool_settings['securitysettings']['enforceaccountcap'] ) ) {1347 return;1348 }1349 1350 if( $multitool_settings['securitysettings']['enforceaccountcap'] !== true ) {1351 return;1352 }1353 1354 if( !is_numeric( $cap ) ) {1355 return;1356 }1357 1358 // avoid the risk of disabling the only admin account that exists1359 if( $cap < 2 ) {1360 return;1361 }1362 1363 // return admin and NEAR admin and a count of result (array)1364 $total_admin_accounts = self::total_administrators( true, true );1365 1366 if( !$total_admin_accounts['count'] ) {1367 // TODO 2 Task: flag this situation, enforcement active but no cap!?1368 return;// cap setting or file not found (user has not set it up)1369 }1370 1371 if( $total_admin_accounts['count'] > $cap ) {1372 // alert! Possibly hack has happened and may still be in progress.1373 $suspended_accounts = array();1374 $email_content_list = '';1375 // get users OVER the cap then change those LATEST users to subscribers1376 $output = array_slice( $total_admin_accounts['users'], $cap );1377 1378 foreach( $output as $key => $user ) {1379 1380 // for some safety avoid changing user with ID 11381 if( $user->ID === 1 ) {1382 continue;1383 }1384 1385 // change potential hacker account to subscriber1386 $u = new WP_User( $user->ID );1387 1388 // Remove role1389 $u->remove_role( 'administrator' );1390 1391 // Add role1392 $u->add_role( 'subscriber' );1393 1394 // store user ID's that have been suspended1395 $suspended_accounts[] = $user->ID;1396 1397 // build content for emailing administrator1398 $email_content_list .= $user->ID . ' - ' . $user->user_email;1399 1400 // add user meta to track the account1401 add_user_meta( $user->ID, 'webtechglobalsuspension', array(1402 'time' => time(),1403 'plugin' => MULTITOOL_TITLE,1404 'reason' => __( 'Possible security breach detected. This user1405 account may have been created by a hacker. Please consult with1406 Ryan Bayne at WebTechGlobal if you are unsure why this message1407 exists in your data. ', 'multitool' ),1408 ), true );1409 }1410 1411 $email_recipients = array();1412 1413 $multiple_recipients[] = get_option( 'admin_email' );1414 1415 $subj = __( 'WebTechGlobal Security Alert: Admin accounts hack', 'multitool' );1416 1417 // set content-type1418 add_filter( 'wp_mail_content_type', array( $this, 'set_html_content_type') );1419 1420 wp_mail( $multiple_recipients, $subj, $email_content_list );1421 1422 // Reset content-type to avoid conflicts -- http://core.trac.wordpress.org/ticket/235781423 remove_filter( 'wp_mail_content_type', array( $this, 'set_html_content_type') );1424 }1425 }1426 1336 1427 1337 public function set_html_content_type() { … … 1450 1360 1451 1361 return false; 1452 }1453 1454 /**1455 * Count total number of "administrators". This is the beginning of1456 * security to counteract a hack quickly, where illegal users are being1457 * entered into the wp_users table.1458 *1459 * I have added the ability to return the result so that a count and1460 * user query can be done separate and ensure each result matches.1461 *1462 * @author Ryan R. Bayne1463 * @package WebTechGlobal WordPress Plugins1464 * @version 1.01465 *1466 * @todo include users with highest capabilities ($partial_admin)1467 */1468 public function total_administrators( $partial_admin = false, $return_users = false ) {1469 $args = array(1470 'role' => 'administrator',1471 );1472 1473 // if $partial_admin = true check for none "administrator" users1474 // who have create_user, delete user or activate_plugin capabilities1475 1476 $users = get_users( $args );1477 1478 $count = count( $users );1479 1480 if( $return_users ) {1481 return array(1482 'count' => $count,1483 'users' => $users1484 );1485 }1486 1487 return $count;1488 1362 } 1489 1363 -
multitool/trunk/classes/class-requests.php
r1420327 r1422006 208 208 $this->UI->n_postresult_depreciated( 'success', __( 'Log Settings Saved', 'multitool' ), __( 'It may take sometime for new log entries to be created depending on your websites activity.', 'multitool' ) ); 209 209 } 210 211 /** 212 * Save drip feed limits 213 */ 214 public function schedulerestrictions() { 215 $multitool_schedule_array = $this->MULTITOOL->get_option_schedule_array(); 216 217 // if any required values are not in $_POST set them to zero 218 if(!isset( $_POST['day'] ) ){ 219 $multitool_schedule_array['limits']['day'] = 0; 220 }else{ 221 $multitool_schedule_array['limits']['day'] = $_POST['day']; 222 } 223 224 if(!isset( $_POST['hour'] ) ){ 225 $multitool_schedule_array['limits']['hour'] = 0; 226 }else{ 227 $multitool_schedule_array['limits']['hour'] = $_POST['hour']; 228 } 229 230 if(!isset( $_POST['session'] ) ){ 231 $multitool_schedule_array['limits']['session'] = 0; 232 }else{ 233 $multitool_schedule_array['limits']['session'] = $_POST['session']; 234 } 235 236 // ensure $multitool_schedule_array is an array, it may be boolean false if schedule has never been set 237 if( isset( $multitool_schedule_array ) && is_array( $multitool_schedule_array ) ){ 238 239 // if times array exists, unset the [times] array 240 if( isset( $multitool_schedule_array['days'] ) ){ 241 unset( $multitool_schedule_array['days'] ); 242 } 243 244 // if hours array exists, unset the [hours] array 245 if( isset( $multitool_schedule_array['hours'] ) ){ 246 unset( $multitool_schedule_array['hours'] ); 247 } 248 249 }else{ 250 // $schedule_array value is not array, this is first time it is being set 251 $multitool_schedule_array = array(); 252 } 253 254 // loop through all days and set each one to true or false 255 if( isset( $_POST['multitool_scheduleday_list'] ) ){ 256 foreach( $_POST['multitool_scheduleday_list'] as $key => $submitted_day ){ 257 $multitool_schedule_array['days'][$submitted_day] = true; 258 } 259 } 260 261 // loop through all hours and add each one to the array, any not in array will not be permitted 262 if( isset( $_POST['multitool_schedulehour_list'] ) ){ 263 foreach( $_POST['multitool_schedulehour_list'] as $key => $submitted_hour){ 264 $multitool_schedule_array['hours'][$submitted_hour] = true; 265 } 266 } 267 268 if( isset( $_POST['deleteuserswaiting'] ) ) 269 { 270 $multitool_schedule_array['eventtypes']['deleteuserswaiting']['switch'] = 'enabled'; 271 } 272 273 if( isset( $_POST['eventsendemails'] ) ) 274 { 275 $multitool_schedule_array['eventtypes']['sendemails']['switch'] = 'enabled'; 276 } 277 278 $this->MULTITOOL->update_option_schedule_array( $multitool_schedule_array ); 279 $this->UI->notice_depreciated( __( 'Schedule settings have been saved.', 'multitool' ), 'success', 'Large', __( 'Schedule Times Saved', 'multitool' ) ); 280 } 281 210 282 211 /** 283 212 * Processes a request by form submission. … … 335 264 $multitool_settings['developermode']['developermodeswitch'] = $_POST['developermodeswitch']; 336 265 $multitool_settings['api']['twitter']['active'] = $_POST['twitterapiswitch']; 337 266 338 267 $this->MULTITOOL->update_settings( $multitool_settings ); 339 268 $this->UI->create_notice( __( 'Global switches have been updated. These … … 1341 1270 add_option( 'webtechglobal_auto_plugins', array() ); 1342 1271 add_option( 'webtechglobal_auto_actionssettings', array() ); 1272 1273 // Update automation switch, this is global to all plugins. 1274 // Does not apply to administration triggered automation. 1275 $existing_auto_value = get_option( 'webtechglobal_auto_switch' ); 1343 1276 1344 // Also initialize the hourly CRON job which is our basic primary trigger. 1345 // TODO: allow user to select Single Hourly Cron or Many Cron 1346 if (! wp_next_scheduled ( 'webtechglobal_hourly_cron' )) { 1347 wp_schedule_event( time() + 100, 'hourly', 'webtechglobal_hourly_cron', array( 'trigger' => 'hourlycron' ) ); 1348 $description = __( "A cron job is simply the name of a schedule event controlled by 1349 your server. By submitting the automation settings you have setup an hourly cron job which 1350 will check for oustanding tasks. This is also done using WordPress core scheduling functions. You have 1351 the option of allowing a single hourly cron job to process all tasks or allow this plugin to make 1352 cron jobs for all tasks.", 'multitool' ); 1353 $this->UI->create_notice( 1354 $description, 1355 'info', 1356 'Small', 1357 __( 'Hourly Cron Job Scheduled', 'multitool' ) 1358 ); 1359 } 1360 1361 // Update automation switch, this is global to all plugins. 1362 update_option( 'webtechglobal_auto_switch', $_POST['automationswitch'] ); 1363 if( $_POST['automationswitch'] === 'enabled' ) 1364 { 1277 if( $_POST['automationswitch'] == 1 && $existing_auto_value != 1 ) 1278 { 1279 update_option( 'webtechglobal_auto_switch', 1 ); 1365 1280 $description = __( "Automation and scheduling is now active. This switch 1366 1281 applies to all WebTechGlobal plugins. However you must submit the same … … 1374 1289 ); 1375 1290 } 1376 else 1291 elseif( $_POST['automationswitch'] == 0 && $existing_auto_value != 0 ) 1377 1292 { 1293 update_option( 'webtechglobal_auto_switch', 0 ); 1378 1294 $description = __( "Automation and scheduling has been disabled. This switch 1379 1295 applies to all WebTechGlobal plugins. If you had multiple plugins registered … … 1389 1305 ); 1390 1306 } 1307 1308 $existing_admintrigauto_value = get_option( 'multitool_adm_trig_auto' ); 1309 if( $_POST['adminautotrigswitch'] == true && $existing_admintrigauto_value !== true ) 1310 { 1311 update_option( 'multitool_adm_trig_auto', true ); 1312 $description = __( "Multitool will perform automated tasks while 1313 an administrator is logged in and loading WordPress.", 'multitool' ); 1314 $this->UI->create_notice( 1315 $description, 1316 'success', 1317 'Small', 1318 __( 'Administrator Triggered Automation Enabled', 'multitool' ) 1319 ); 1320 } 1321 elseif( $_POST['adminautotrigswitch'] == false && $existing_admintrigauto_value !== false ) 1322 { 1323 update_option( 'multitool_adm_trig_auto', false ); 1324 $description = __( "Multitool will not run automation triggered by 1325 administrators being logged in and loading WordPress administration 1326 views.", 'multitool' ); 1327 $this->UI->create_notice( 1328 $description, 1329 'success', 1330 'Small', 1331 __( 'Administrator Triggered Automation Disabled', 'multitool' ) 1332 ); 1333 } 1391 1334 1392 1335 // Process plugins registration. -
multitool/trunk/classes/class-schedule.php
r1420327 r1422006 20 20 $this->DB = $CONFIG->load_class( 'MULTITOOL_DB', 'class-wpdb.php', 'classes' ); # database interaction 21 21 $this->PHP = $CONFIG->load_class( 'MULTITOOL_PHP', 'class-phplibrary.php', 'classes' ); # php library by Ryan R. Bayne 22 } 23 22 } 23 24 24 /** 25 25 * Sample scheduled method primarily for WTG Cron system and not WP Cron. -
multitool/trunk/classes/class-wpcore.php
r1365891 r1422006 33 33 } 34 34 return $capabilities_array; 35 } 35 } 36 37 /** 38 * Count total number of "administrators". This is the beginning of 39 * security to counteract a hack quickly, where illegal users are being 40 * entered into the wp_users table. 41 * 42 * I have added the ability to return the result so that a count and 43 * user query can be done separate and ensure each result matches. 44 * 45 * @author Ryan R. Bayne 46 * @package WebTechGlobal WordPress Plugins 47 * @version 1.0 48 * 49 * @todo include users with highest capabilities ($partial_admin) 50 */ 51 public function total_administrators( $partial_admin = false, $return_users = false ) { 52 $args = array( 53 'role' => 'administrator', 54 ); 55 56 // if $partial_admin = true check for none "administrator" users 57 // who have create_user, delete user or activate_plugin capabilities 58 59 $users = get_users( $args ); 60 61 $count = count( $users ); 62 63 if( $return_users ) { 64 return array( 65 'count' => $count, 66 'users' => $users 67 ); 68 } 69 70 return $count; 71 } 36 72 } 37 73 ?> -
multitool/trunk/inc/fields/automationsettings.php
r1420327 r1422006 20 20 <?php 21 21 // Global switch for WebTechGlobal automation class. 22 $this->FORMS->switch_basic( 22 $autoswitch_current = get_option( 'webtechglobal_auto_switch', 'multitool' ); 23 $this->FORMS->boolean_basic( 23 24 $formid, 24 25 'automationswitch', 25 26 'automationswitch', 26 27 __( 'Automation Switch', 'multitool' ), 27 'disabled',28 get_option( 'webtechglobal_auto_switch', 'multitool' ),28 0, 29 $autoswitch_current, 29 30 false 30 31 ); 32 33 // Plugin switch for Multitool administrator triggered automation. 34 $adminauto_current = get_option( 'multitool_adm_trig_auto', 'multitool' ); 35 $this->FORMS->boolean_basic( 36 $formid, 37 'adminautotrigswitch', 38 'adminautotrigswitch', 39 __( 'Administration Triggered Automation', 'multitool' ), 40 0, 41 $adminauto_current, 42 false 43 ); 44 45 // TODO: add check boxes for individual admin triggered auto actions. See administrator_triggered_automation(). 31 46 32 47 // Display a list of the plugins that have been added to the automation system. -
multitool/trunk/multitool.php
r1420327 r1422006 2 2 /* 3 3 Plugin Name: Multitool Beta 4 Version: 1.0. 34 Version: 1.0.4 5 5 Plugin URI: http://www.webtechglobal.co.uk/wtg-plugin-framework-wordpress/ 6 6 Description: Multitool does a little bit of everything. … … 41 41 42 42 // define package constants... 43 if(!defined( "MULTITOOL_VERSION") ){define( "MULTITOOL_VERSION", '1.0. 3' );}43 if(!defined( "MULTITOOL_VERSION") ){define( "MULTITOOL_VERSION", '1.0.4' );} 44 44 if(!defined( "MULTITOOL_RELEASENAME") ){define( "MULTITOOL_RELEASENAME", 'Beta' );} 45 45 if(!defined( "MULTITOOL_TITLE") ){define( "MULTITOOL_TITLE", 'Multitool' );} -
multitool/trunk/readme.txt
r1420327 r1422006 4 4 License: GPLv2 or later 5 5 License URI: http://www.gnu.org/licenses/gpl-2.0.html 6 Tags: Tool Kit, Tools Kit, Tools, Multi, Multitool 6 Tags: Tool Kit, Tools Kit, Tools, Multi, Multitool, cron, scheduling 7 7 Requires at least: 3.8.0 8 8 Tested up to: 4.3.1 9 9 Stable tag: trunk 10 10 11 Multitool is a place for new ideas to start before becoming the fullplugin.11 Multitool aims to cover all aspects of WordPress in one massive plugin. 12 12 13 13 == Description == … … 74 74 75 75 == Changelog == 76 76 = 1.0.4 = 77 * Feature Changes 78 * "Hourly Cron Job Scheduled" is not longer displayed when submitting main scheduling settings. 79 * Maximum Admin Accounts input now displays the stored value. It was always saved, just not displays in form. 80 * Security section and on admin accounts tab now has information about the most recent breach. 81 * Technical Notes 82 * The WP cron job "webtechglobal_hourly_cron" is no longer initiated. 83 * Maximum admin accounts security no longer adds subscriber role, it only removed administrator role. 84 * Admin accounts security now disables all admin accounts apart from those with ID's 1 and 2 85 77 86 = 1.0.3 = 78 87 * Feature Changes … … 84 93 * Added jQuery UI .css and images 85 94 * get_currentuserinfo() depreciated and replaced with wp_get_current_user() 95 * jQuery UI files added for datepicker and timepicker in-one 96 * Changed the way the plugin is initiated. Now uses init() and sets global $MULTITOOL_Class. 86 97 87 98 = 1.0.2 = -
multitool/trunk/views/adminaccounts.php
r1420327 r1422006 38 38 array( $this->view_name . '-capmonitoringswitch', __( 'Admin Cap Monitoring', 'multitool' ), array( $this, 'parent' ), 'side','default',array( 'formid' => 'capmonitoringswitch' ), true, 'activate_plugins' ), 39 39 array( $this->view_name . '-maximumadministrators', __( 'Maximum Administrators (cap)', 'multitool' ), array( $this, 'parent' ), 'normal','default',array( 'formid' => 'maximumadministrators' ), true, 'activate_plugins' ), 40 array( $this->view_name . '-securityeventadmincap', __( 'Security Breach Details', 'multitool' ), array( $this, 'parent' ), 'normal','default',array( 'formid' => 'securityeventadmincap' ), true, 'activate_plugins' ), 40 41 ); 41 42 } … … 152 153 153 154 /** 154 * Set a maximum number of adminstrator accounts. This is very simple. All 155 * we need to do is keep counting the number of administrators. I may 156 * do that by caching the administrator user ID's, caching the highest 157 * ID, get all ID's above the highest and check them for admin rights. If 158 * any have admin rights, check the user ID agains those cached as original 159 * legal administrators. If the new admin ID is not in that cache then the 160 * new admin is illegal. 155 * Set a maximum number of adminstrator accounts. 161 156 * 162 157 * @author Ryan Bayne … … 167 162 * @todo allow user to enter email address for the security alert 168 163 */ 169 public function postbox_adminaccounts_maximumadministrators( $data, $box ) { 164 public function postbox_adminaccounts_maximumadministrators( $data, $box ) { 165 global $multitool_settings; 166 170 167 $intro = __( 'This form allows you to enter 171 168 the maximum number of administrators permitted to exist in the database. 172 If a hacker injects new user accounts and those accounts turn out to be 173 administrators. This plugin will change those accounts to subscribers and 174 notify the original key holder (first admin created).', 'multitool' ); 169 If a hacker injects new admin user into your database this plugin will 170 change those accounts to subscribers and 171 notify the original key holder (first admin created). We do not ever 172 automatically delete a user and the code does not exist in this procedure 173 to do that.', 'multitool' ); 175 174 176 175 $this->UI->postbox_content_header( $box['title'], $box['args']['formid'], $intro, false ); 177 176 178 177 $this->FORMS->form_start( $box['args']['formid'], $box['args']['formid'], $box['title'] ); 179 178 180 179 $current_value = ''; 181 180 if( isset( $multitool_settings['securitysettings']['adminaccountcap'] ) ) { … … 196 195 array( 'numeric' ) 197 196 ); 197 198 // Display total number of administrators. 199 $user_query = new WP_User_Query( array( 'role' => 'Administrator' ) ); 200 $total_admins = count( $user_query ); 201 $this->FORMS->input_emptyrow( __( 'Total Administrators', 'multitool' ), $total_admins ); 198 202 ?> 199 203 … … 222 226 223 227 $intro = __( 'Disable Administrator Account Cap enforcement. This is 224 a security feature that frequently checks user data. I t is recommended225 that you run it temporarily or configure this plugin so that the checks226 are less frequent. If you activated it because your WordPress was hacked227 you should be aware that this feature is not a fix and only makes it harder228 for a hacker/bot to use illegal administration accounts.', 'multitool' );229 $button_text = __( 'Disable dSecurity Measure', 'multitool' );228 a security feature that frequently checks user data. If it detects 229 extra administrator accounts it takes action. Do not disable it if you 230 are under constant attack from hackers who inject new administrator 231 accounts into your user table or change a normal registered subscriber 232 to an administrator.', 'multitool' ); 233 $button_text = __( 'Disable Security Measure', 'multitool' ); 230 234 231 235 } else { 232 236 233 $intro = __( 'Activate in the event of your WordPress being hacked/infected 234 and you have confirmed the creation of illegal administrator accounts. 235 This plugin will frequently check for new user accounts with the 236 administrator role, then downgrade them to subscribers. It will also 237 send you an email detailing accounts that are under suspicion. To make 238 this work you must submit the "Maximum Administrators (cap)" form. 237 $intro = __( 'Activate to monitor the total number of administrators 238 in your user table. If a hacker injects a new user or changes a 239 seemingly harmless subscriber account to an administrator this 240 plugin will prevent them using the administration account. 241 All administrator accounts will have their administrator capability 242 removed apart from those with ID 1 and 2. This covers any situation 243 where a previously trusted administrator account is breached. The 244 account with ID 2 is often and administrator also. It is a common 245 practice to create a second administrator account when WordPress is 246 setup. It is also less likely to be the account that is breached even 247 if it is a subscriber. 239 248 ', 'multitool' ); 240 249 } … … 251 260 $this->UI->postbox_content_footer( $button_text ); 252 261 } 262 263 /** 264 * Information about the most recent security breach that 265 * involves extra administration accounts. 266 * 267 * @author Ryan Bayne 268 * @package Multitool 269 * @since 0.0.1 270 * @version 1.0 271 * 272 * @todo Create button or just a link for resetting the security event option. 273 */ 274 public function postbox_adminaccounts_securityeventadmincap( $data, $box ) { 275 global $multitool_settings; 276 277 $securityevent = get_option( 'multitool_securityevent_admincap' ); 278 279 if( !is_array( $securityevent ) ) { 280 281 $intro = __( 'Mulitool security has not detected extra administration 282 accounts in your user table and there are no records of a security 283 breech of this nature.', 'multitool' ); 284 285 286 } else { 287 288 $intro = __( 'There are details about a possible security breach stored 289 in your database. This breach is related to extra administrators being 290 detected in the user table. Please review the information below and 291 decide yourself. Illegal accounts should have been disabled by Multitool 292 but you should ensure that is the case.', 'multitool' ); 293 294 } 295 296 $this->UI->postbox_content_header( 297 $box['title'], 298 $box['args']['formid'], 299 $intro, 300 false 301 ); 302 303 $this->FORMS->form_start( $box['args']['formid'], $box['args']['formid'], $box['title'] ); 304 305 if( is_array( $securityevent ) ) { 306 ?> 307 308 <table class="form-table"> 309 310 <?php 311 $time = ''; 312 $limit = ''; 313 314 if( is_array( $securityevent ) ) { 315 $time = date( 'Y-m-d H:i:s', $securityevent['time'] ); 316 $limit = $securityevent['cap']; 317 } 318 319 $this->FORMS->input_emptyrow( __( 'Detection Time', 'multitool' ), $time ); 320 $this->FORMS->input_emptyrow( __( 'Admin Limit Was', 'multitool' ), $limit ); 321 322 ?> 323 324 </table> 325 326 <?php 327 $this->UI->postbox_content_footer( __( 'Reset Security Information', 'multitool' ) ); 328 } 329 } 330 253 331 }?> -
multitool/trunk/views/main.php
r1420327 r1422006 165 165 $this->UI->option_switch( __( 'Dashboard Widgets Switch', 'multitool' ), 'dashboardwidgetsswitch', 'dashboardwidgetsswitch', $multitool_settings['widgetsettings']['dashboardwidgetsswitch'], 'Enabled', 'Disabled', 'disabled' ); 166 166 $this->UI->option_switch( __( 'Developer Mode', 'multitool' ), 'developermodeswitch', 'developermodeswitch', $multitool_settings['developermode']['developermodeswitch'], 'Enabled', 'Disabled', 'disabled' ); 167 $this->UI->option_switch( __( 'Twitter API Switch', 'multitool' ), 'twitterapiswitch', 'twitterapiswitch', $multitool_settings['api']['twitter']['active'], 'Enabled', 'Disabled', 'disabled' ); 167 $this->UI->option_switch( __( 'Twitter API Switch', 'multitool' ), 'twitterapiswitch', 'twitterapiswitch', $multitool_settings['api']['twitter']['active'], 'Enabled', 'Disabled', 'disabled' ); 168 168 ?> 169 169 </table> … … 407 407 */ 408 408 public function postbox_main_twitterupdates( $data, $box ) { 409 $introduction = __( 'Follow the WTG Twitter account for news on all things 410 to do with the web - including updates about this plugin.', 'wtgeci' ); 409 $introduction = __( 'Follow the WTG Twitter account for news updates on this plugins development.', 'wtgeci' ); 411 410 echo "<p class=\"multitool_boxes_introtext\">". $introduction ."</p>" 412 411 ?>
Note: See TracChangeset
for help on using the changeset viewer.