qjk 2 d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZm Z m
Z
m Z d dl m
Z
d dlmZ d dlmZmZmZ d dlmZ d d lmZmZmZ d d
lmZm Z m Z d d l m Z d d l m!Z! d d
l"m#Z# d dlm$Z$ d dl%m&Z& d dl'm(Z(m)Z)m*Z* d dl+m,Z,m-Z- d dl"m.Z.m/Z/m0Z0 d dl1m2Z2 d dl3m4Z4 ej5 e6 Z7 edej8 Z9 edej8 Z: ed Z; ed Z e j? dd d Z@d eAd eBfd ZC G d! d"ee ZDdS )# N)Path) Coroutine)ANTIVIRUS_MODEConfigValidationError SystemConfig
UserConfig) HookEvent) MessageType) MessageSink
MessageSourceexpect)
hosting_panel)
load_stateregister_lock_file
save_state)Scopeimporterrecurring_check)
check_lock)DAY)plugin) WordpressWPSite)get_sites_by_pathget_sites_for_userget_installed_sites)is_secret_expired
rotate_secret)ChangelogProcessorIncidentCollectorIncidentSender) update_disabled_rules_on_sites) delete_old_wordpress_incidentsz wp-gen-authzwp-site-processz-/etc/sysconfig/imunify360/imunify360.config.dzF/opt/imunify360/venv/share/imunify360/11_on_first_install_wp_av.configz 11_on_first_install_wp_av.configz .11_on_first_install_wp_av.flagzimav.malwarelib.model
MalwareHit)modulenamedefaultstarted_timestampreturnc | t t d g S t | S )z
Get malware hits cleaned since the given timestamp with lazy import fallback.
Returns empty list if imav.malwarelib is not available.
Nz;imav.malwarelib not available, returning empty cleaned hits) _MalwareHitloggerdebug
cleaned_since)r) s V/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/wordpress.py_get_cleaned_malware_hitsr1 J s? I
$ $%6 7 77 c e Zd Zej Zd Zd Zd Zd Z d Z
d Z d Z d Z
d ej fd
Zd d efd
Zd Z eedee d Z eedde d Zd Zd Z d Z d Z d Z e e!j" d Z# e e!j$ d Z% e e!j$ d Z& e e!j$ d Z' e e(j) d Z* e e(j+ d Z,d S )!ImunifySecurityPluginc f d | _ d | _ t d }| d | _ | d }||n t
j | _ t j | _
t j | _ i | _
t j | _ t j | _ d | _ d | _ d | _ t+ | _ t/ | _ t3 | _ t7 | _ d | _ d S )Nr4 installedenabled) _loop_sinkr getinstallation_completedr SECURITY_PLUGIN_ENABLEDlast_config_valuer _get_global_waf_enabled_last_waf_enabled_get_waf_default_last_waf_default_last_user_waf_enabled _get_global_ai_bot_protection_last_ai_bot_protection$_get_global_ai_bot_protection_preset _last_ai_bot_protection_presetinstallation_task
deleting_taskinstall_and_update_tasksetfreshly_installed_sitesr! incident_collectorr" incident_senderr changelog_processor_site_processing_task)selfstatepersisted_enableds r0 __init__z ImunifySecurityPlugin.__init__[ s
233&+ii &<&<# "IIi 0 0 !,
2
"(!?!A!A !'!8!:!: >@# (.'K'M'M$ 7 9 9
+ 7; 26<@$47EE$ #4"5"5 - / / #5#7#7 :>"""r2 c
K d S N )rP loops r0 create_sinkz!ImunifySecurityPlugin.create_sink| s r2 c K || _ || _ | j | | _ | j | | _ t r| d {V nt
d | d {V d S )NT)
missing_ok) r8 r9 create_taskrefresh_auth_files_update_auth_taskprocess_wordpress_sitesrO r _apply_first_install_configFIRST_INSTALL_FLAGunlink _recover_installation_on_startup)rP rW sinks r0
create_sourcez#ImunifySecurityPlugin.create_source s
!%!7!7 # # % %"
"
&*Z%;%; ( ( * *&
&
" 72244 4 4 4 4 4 4 4 4 % % % 6 6 63355555555555r2 c , K | j s t j sdS t d d| _ | t j | j d{V | j
!| j
| j dS dS )a
Self-heal when the installation state was lost.
If the feature is enabled but installation_completed is falsy (state
file missing, earlier install interrupted, etc.), manage_plugin_installation
can never recover: its True == True guard always returns early.
Trigger install_everywhere once per restart to repopulate the
wordpress_site table and flip the flag.
NzXInstallation state is missing while feature is enabled; triggering startup self-recoveryTrc )
r; r r< r- infor= process_installationr install_everywherer9 rG add_done_callback_mark_installation_donerP s r0 rb z6ImunifySecurityPlugin._recover_installation_on_startup s
' 4
F
/
"& '' %4: 6 6 6
! - " 4 4,
. -r2 c f K t sd S t j d {V dk rKt
t }t
d t
d S )N i ) r` existsr HostingPanel users_countFIRST_INSTALL_CONFIG_PATH
write_textFIRST_INSTALL_CONFIG_FILE read_textchmodra )rP _s r0 r_ z1ImunifySecurityPlugin._apply_first_install_config s !((** F +--99;; ; ; ; ; ; ;q @ @)44)3355 A
& + +E 2 2 2!!#####r2 c K | j | j d {V | j r(| j | j d {V d S d S rU )r] cancelrO rl s r0 shutdownz ImunifySecurityPlugin.shutdown s %%'''$$$$$$$$ % - & - - / / /, , , , , , , , , , - -r2 c t | | s t d| dS t | | }|d uo)| o| S )NzUnknown task '%s'F)hasattrr- errorgetattrdone cancelled)rP task_attr_nametasks r0 _task_in_progressz'ImunifySecurityPlugin._task_in_progress si t^,, LL,n = = =5t^,,4 L OLDNNFeature was disabled during installation, skipping flag updateT)r r- rg exceptionr} r= r; r )rP r excs r0 rk z-ImunifySecurityPlugin._mark_installation_done s >> KK9 : : : Fnn ? LL7 = = = F% KK'
F&*# %%'''''r2 Fcoroc K | d r\|r| d S | j r=| j | j d {V n# t j $ r Y nw xY w| d r0t d | d S t j | | _ d S )NrH rG z Installation is already running)
r closerH ry asyncioCancelledErrorr- warningr[ rG )rP r
for_new_sitess r0 rh z*ImunifySecurityPlugin.process_installation s ! !/ 2 2
!
"))+++ ,,,,,,,,, - D ! !"5 6 6 NN< = = = JJLLL F!(!4T!:!: s
A A10A1c P K | d rD| j r=| j | j d {V n# t j $ r Y nw xY w| d r t
d d S t j | | _ d S )NrG rH zDeleting is already running) r rG ry r r r- r r[ rH )rP r s r0 process_deletingz&ImunifySecurityPlugin.process_deleting s ! !"5 6 6 %
&--/// 000000000 - D ! !/ 2 2 NN8 9 9 9 F $ 0 6 6s
A AAT)check_period_firstcheck_lock_period lock_filec K t rt d {V t j | j d {V d S Nrf )r r r update_auth_everywherer9 rl s r0 r\ z(ImunifySecurityPlugin.refresh_auth_files
s` " // ! ! ! ! ! ! !+<<<<<<<<<<<zAImunifySecurityPlugin.process_wordpress_sites..: s > > >!QX > > >r2 )domainsrc T)delete_after_processing )daysz*Error in WordPress periodic processing: %s)r- r. r rN process_changelogs_for_sitesr9 r# rL collect_incidents_for_sitesrM send_incidentsr$ Exceptionr} )rP sitesaffected_sites incidentses r0 r^ z-ImunifySecurityPlugin.process_wordpress_sites s
A
! J'))E
F .KK4:
4 > >~ > > > -II,0 J
&55dj)LL L L L L L L L * 3 3 3 3 3 3 J J J LLEq I I I I I I I I I Js *C2
B&C2 2
D"<D D"c K j fd} | d d{V dS )z&Install plugin on new WordPress sites.c K t j j d {V } | rj | | S r )r ri r9 rK update)installed_sitesrP s r0 install_and_trackzFImunifySecurityPlugin._install_on_new_sites..install_and_trackR sT $*$=4:$N$N$N N N N N N NO
E,33ODDD" "r2 T)r N)rK clearrh )rP r s ` r0 _install_on_new_sitesz+ImunifySecurityPlugin._install_on_new_sitesM s
$**,,, # # # # # '' (
r2 c \ K t j | j | j d{V t j | j d{V t
j sW| t j | j d{V d| _ d| _
| dS dS )zCTidy up sites from which the WordPress plugin was deleted manually.)rc rK Nrf F) r tidy_up_manually_deletedr9 rK $fix_data_file_permissions_everywherer r< r remove_all_installedr; r= r rl s r0 _tidy_upz ImunifySecurityPlugin._tidy_up] s -$($@
9tzJJJJJJJJJJ0 ,''+<<<
+0D '%*D " ) ) + + + + +
, ,r2 c K t j | j d{V }|r | j | dS dS )zFAdopt sites where plugin is installed but not tracked in our database.rf N)r adopt_found_sitesr9 rK r )rP
adopted_sitess r0 _adopt_found_sitesz(ImunifySecurityPlugin._adopt_found_sitesm s^ $ 6DJ G G GGGGGGG
? ( / /
> > > > > ? ?r2 c J K t j | j d{V dS )z1Update plugin on all sites where it is installed.rf N)r update_everywherer9 rl s r0 _update_existingz&ImunifySecurityPlugin._update_existingu s4 &DJ777777777777r2 c K | d{V | j r
| j d{V | d{V | d{V | d{V dS )z
Combined operation: install on new sites, adopt found sites, tidy up,
and update existing plugins.
This runs all operations sequentially to avoid race conditions.
N)r rG r r r rl s r0 _run_install_and_updatez-ImunifySecurityPlugin._run_install_and_updatey s ((********* ! )( ( ( ( ( ( ( ( %%''''''''' mmoo ##%%%%%%%%%%%r2 c R K t d|j |j | d r"t d|j d S |j dk r%| j sd S | d {V d S | d r"t d|j d S | d r"t d|j d S |j d k r | d {V d S |j d
k r | d {V d S |j d k rP| j s t d d S t j | | _
d S d S )
NzInstallation is not completed yet, skipping install_and_update)r- rg actionmethodr r r; r r r r r[ r rI )rP messages r0 manage_plugin_actionz*ImunifySecurityPlugin.manage_plugin_action s J N N
! !"; < < NNI
F > 3 3 3.
,,.. . . . . . . . F ! !"5 6 6 NNC
F ! !/ 2 2 NNG
F > . . .'')) ) ) ) ) ) ) ) F >Y & &--// ! ! ! ! ! ! ! F > 1 1 1.
*
,3+>,,.., ,D ( ( ( 2 1r2 c K t |d t sd S t j }|| j k rd S || _ |r-| j s% t dddii d| _ n*# t $ r t
d Y nw xY w t dddii d| _ t j
| _ n*# t $ r t
d Y nw xY w| t j | j d {V | j !| j | j d S d S |sl| j s| d
rR| t j | j d {V d| _ | d S d S d S ) Nconf WORDPRESS waf_enabledTz9waf_enabled config reset skipped, field not in schema yetai_bot_protectionFz?ai_bot_protection config reset skipped, field not in schema yetrf rG )
isinstancer r r< r= r; dict_to_configr? r r- r. rD r rE rF rh ri r9 rG rj rk r r r r )rP r current_config_values r0 manage_plugin_installationz0ImunifySecurityPlugin.manage_plugin_installation s '&/<88 F ( @ 4#9 9 9 F "6 , ,(C , ,
-- =$"78 *.&&(
O
-- #6">? 05,?AA 33 )
/
++)tz:::
%1&880 21
& , ' ,%%&9:: , ''+<<<
+0D ' ) ) + + + + + , , , ,s% ,A9 9$B B $AC) )$DDc K t |d t sdS t j sdS | j sdS t j }t j }|| j k r
|| j k rdS | j
dt d{V }|s|| _ || _ dS t j
| d{V }|t | k r|| _ || _ dS dS )a
Propagate admin toggles of WORDPRESS.ai_bot_protection and
WORDPRESS.ai_bot_protection_preset to every managed WP install's
plugin_config.php immediately, so the WP plugin picks up the
change at the next request rather than waiting for a scan cycle.
Phase 2 per-account support extends *this* handler with a
UserConfig branch (mirroring manage_waf_config); do not add a
sibling handler.
r N)r r r r< r; r rC rE rD rF r8 run_in_executorr update_plugin_config_on_siteslen)rP r current_enabledcurrent_presetr writtens r0 manage_ai_bot_protection_configz5ImunifySecurityPlugin.manage_ai_bot_protection_config s '&/<88 F0
F*
F >@@ DFF t ; ; ; $"EEE Fj007JKKKKKKKK +:D (2@D / F r WAF_ENABLEDr? remove_waf_rules_for_all_sitesredeploy_waf_for_all_sitesKeyError WAF_DEFAULTrA apply_waf_default_change) rP r r config_dict waf_valueprev
new_effectivecurrentcurrent_defaults r0 manage_waf_configz'ImunifySecurityPlugin.manage_waf_config0 s 0 Fv))++ OOK4488 GG dJ ' ' ( < 266t}dKK<F&,&DM' ' ! ! ! ! ! !
J
J 6t}EEEEEEEEEE J- J :4=IIIIIIIIID 7 ; ;DM J JJJ9BD '
6
BF$B$D$D
B 6t}EEEEEEEEEEE 24=AAAAAAAAAAA
l
+
+ <
B#/ d 444-4D*" B $ C E EEEEEEEEE $ ? A AAAAAAAA
<"+"7 #d&<<<- no sites found for cleaned hitsz1Cleanup finished => %s site(s) need to be updatedc 8 g | ]\ }}t |d | S ) )docrootr uidr )r site_pathr s r0 r zIImunifySecurityPlugin.handle_malware_cleanup_finished.. s;
3
9RS 9 9 9
r2 z"%s site(s) updated after a cleanup)r= r: r1 rJ
resource_typepwdgetpwnamuserr pw_uid orig_file
startswithaddr r- r. rg r r update_data_on_sitesr9 )
rP r hits
site_pathshit user_info
user_sitesr r wordpress_sitess
r0 handle_malware_cleanup_finishedz5ImunifySecurityPlugin.handle_malware_cleanup_finishedb s % F ;;x D ( ( I0F0F ( F ));<<UU
C F** # SX 6 6I!3I!>!>J,5? ((4 &0 " " =33I>> " &NNIs+; < < < !E" D + LLN O O O F ?
OO
",
)$*oFFFFFFFFF 8#o:N:NOOOOOs /A+C
C('C(c K | j sdS | d dk s*| d r| d sdS |d }t | }|s t d| dS t dt
| t j | j | d{V t dt
| dS ) a
INFO [2025-02-24 11:57:17,968] imav.plugins.wordpress: Malware scan finished:
HookEvent.MalwareScanningFinished(
{
'scan_id': 'b9bd136aff0a4d87a248c859cfe41c47',
'scan_type': 'user',
'path': '/home/user1'
}
)
INFO [2025-02-24 12:00:10,740] imav.plugins.wordpress: Malware scan finished:
HookEvent.MalwareScanningFinished(
{
'scan_id': 'a74271d2cdd04e0c9bd49ef6de23e0d8',
'scan_type': 'user',
'path': '/home/user4',
'started': 1740398383,
'total_files': 39229,
'total_malicious': 3,
'error': None,
'status': 'ok',
'scan_params': {'intensity_cpu': 2, 'intensity_io': 2, 'intensity_ram': 2048, 'initiator': None, 'file_patterns': None, 'exclude_patterns': None, 'follow_symlinks': False, 'detect_elf': True},
'stats': {'scan_time': 27, 'mem_peak': 28217344, 'smart_time_hs': 0.004, 'scan_time_hs': 1.1751, 'smart_time_preg': 0, 'scan_time_preg': 2.7391, 'finder_time': 13.5896, 'cas_time': 0.7562, 'deobfuscate_time': 0.8998, 'total_files': 39229}
}
)
Nr r pathstatsz+Scan finished => no sites found for path=%sz.Scan finished => %s site(s) need to be updatedz %s site(s) updated after a scan)
r= r: r r- r. rg r r r r9 )rP r r r s r0 handle_malware_scan_finishedz2ImunifySecurityPlugin.handle_malware_scan_finished s 8 % F
KK ! !T ) );;v&&
*;;w''
*
F v!$'' LLF M M M F P >P .->P@ VI -..4C 4C /.4C 4C 4Cr2 r4 )Er loggingr pathlibr typingr defence360agent.contracts.configr r r r %defence360agent.contracts.hook_eventsr "defence360agent.contracts.messagesr
!defence360agent.contracts.pluginsr r r
defence360agent.subsys.panelsr 'defence360agent.subsys.persistent_stater r r defence360agent.utilsr r r defence360agent.utils.check_lockr defence360agent.utils.commonr defence360agent.wordpressr r defence360agent.model.wordpressr )defence360agent.wordpress.site_repositoryr r r $defence360agent.wordpress.proxy_authr r r r! r" defence360agent.wordpress.pluginr# (defence360agent.model.wordpress_incidentr$ getLoggerr r- r r r
CONFIG_DIRrt rr r` r: r, floatlistr1 r4 rV r2 r0 r. sf
< ; ; ; ; ; : : : : : :
8 7 7 7 7 7
C B B B B B B B B B 7 7 7 7 7 7 , , , , , , , , , , , , 6 6 6 6 6 6 2 2 2 2 2 2
L K K K K K
8 $ $ }en = = . .u~ TA
B
B
DL ')K K "CC hl " t
8 84 8 8 8 8 @
C @
C @
C @
C @
CK @
C @
C @
C @
C @
Cr2