K6hI d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl Z ddl
mZ ddlmZ ddlmZmZ ddlmZmZ dd lmZmZ dd
lm Z m Z m Z dd l m Z m!Z!m"Z"m#Z#m$Z$ ej% e& Z' e d Z(d
efdZ)de*de+fdZ,dej- fdZ.d&de/fdZ0de1e* fdZ2d
efdZ3d Z4d Z5d Z6d e/e fd Z7d
ed e8fd Z9d!e1e fd"Z:de+d!e/e* fd#Z;d$e*d!e/e fd%Z.
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) defaultdict)Path)SqliteDatabase)
inactivity)MalwareScanScheduleMalwareScanScheduleInterval)atomic_rewrite check_run)
WordpressSiteWPSite)cli PLUGIN_SLUG telemetry)build_command_for_user calculate_next_scan_timestamp$clear_get_cagefs_enabled_users_cache
get_last_scanget_malware_historyzD/var/lib/cloudlinux-app-version-detector/components_versions.sqlite3sitec 6 t | j dz dz S )Nz
wp-contentzimunify-security)r docrootr s J/opt/imunify360/venv/lib/python3.11/site-packages/imav/wordpress/plugin.py get_data_dirr : s ,/A AA usernameuidc K t | | d {V }| dd }d }t j t j k rt
}t | }t | }t t }|D ]K} | d dk r=|D ]:}
| d |
r ||
| n;L|||fS )N scan_date
resource_typefile)
r getr INTERVALIntervalNONEr get_sites_for_userr r list
startswithappend) sinkr r last_scanlast_scan_timenext_scan_timeall_users_sitesmalware_historymalware_by_siteitem site_paths r _get_scan_data_for_userr3 > s #D(33333333I ]];55NN#x}44688 )--O *(33O "$''O F * * ,
<**955 #I.55d;;;E >? ::r semaphorec K |4 d {V | d {V n4# t $ r'}t d| Y d }~nd }~ww xY wd d d d {V d S # 1 d {V swxY w Y d S )NzTelemetry task failed: ) Exceptionloggererror)coror4 es r _send_telemetry_taskr; \ s+ 8 8 8 8 8 8 8 8 8JJJJJJJJ 8 8 8 LL6166 7 7 7 7 7 7 7 7 88 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8s5 A A
A AA AA
A'*A'
coroutinesc K t j | fd| D } t j | d {V d S # t $ r(}t d| Y d }~d S d }~ww xY w)Nc T g | ]$}t j t | %S )asyncio create_taskr; ).0r9 r4 s r
z+process_telemetry_tasks..f s?
0y A ABB
r z Some telemetry tasks failed: )rA Semaphoregatherr6 r7 r8 )r= concurrencytasksr: r4 s @r process_telemetry_tasksrI d s !+..I
E
:ne$$$$$$$$$$ : : : 8Q88999999999:s =
A/ A**A/usersc
( K t d t }g }t j d 5 t
t t d t j D z
}|sS t j
d |D t | d{V ddd dS t t }|D ]"}||j | #| D ]\ }} t% j | j } nP# t* $ rC}
t- j d t3 | ||
d Y d}
~
id}
~
ww xY w| | vrvt5 || | d{V \ } } }
|D ] } t7 j | d{V }|s+t- j d
| d K| | |
|j g d }t? || d{V t7 j | d{V |! | | tE j# |d
| # t* $ r'}
t $ d||
Y d}
~
d}
~
ww xY wt dt3 | nf# tJ j& $ r+ t dt3 | Y n-t* $ r!}
t $ d|
d}
~
ww xY wt j
d |D t | d{V nJ# t j
d |D t | d{V w xY w ddd dS # 1 swxY w Y dS )zLInstall the imunify-security plugin for all sites where it is not installed.z%Installing imunify-security wp pluginzwp-plugin-installationc 3 V K | ]$}t |j |j |j V %d S Nr r domainr rC rs r z$install_for_users..| sH ; ; qy!(AE22; ; ; ; ; ;r c : g | ]}|j |j |j d dS )N)rO r r manually_deleted_at)rO r r )rC r s r rD z%install_for_users.. sC #'+#'< #x/3 r NzSkipping installation of WordPress plugin on {count} site(s) because they belong to user {user} and it is not possible to retrieve username for this user. Reason: {reason})countuserreasonwarning)levelz:WordPress site is not accessible using WP CLI. site={site}r lastScanTimestampnextScanTimestampmalwareinstalled_by_imunifyr* eventr z,Failed to install plugin to site=%s error=%sz0Installed imunify-security wp plugin on %d siteszXInstallation imunify-security wp plugin was cancelled. Plugin was installed for %d sitesz3Error occurred during plugin installation. error=%s)'r7 infosetr tracktaskr _get_sites_without_pluginr select insert_manyexecuterI r r' r r) itemspwdgetpwuidpw_namer6
sentry_sdkcapture_messageformatlenr3 r
is_wordpress_installedr" r update_scan_data_fileplugin_installaddr
send_eventr8 rA CancelledError)rJ r* installedtelemetry_coros
to_install
sites_by_userr r sitesr r8 r, r- r0 rq json_datas r install_for_usersr} q s
KK7888 IO 7 8 8 t; t;s ; 0 2 2 2244s ; ;&-//; ; ; 8 8 J
|
% !*
giii)/:: : : : : : : :it; t; t; t; t; t; t; t; ( - -M"
5
5 dh'..t4444 , 1 1 3 3 D
D
U "|C 0 0 8HH .D EKF"%e**!$#( EK E E
(
HHHH 5(( 2$#FFFFFFFF ""# " ) )D( #&"EL
F%"9F L F%%(LAJ$LBJ$#L$
K . K
LK -LN/7M&:N/< M& M!!M&&N/)AP/AO66PP P c K t | }| r't j t j | d {V d S d S rM )r existsrA to_threadshutilrmtree)r data_dirs r delete_plugin_filesr s\ D!!H 9
x888888888889 9r c K t d g }d}t j d 5 t j t
j d }|D ]} t j | d{V t | d{V |t j
t
j |j k z
}| t# j | d| # t& $ r&}t d|| Y d}~d}~ww xY wnf# t* j $ r+ t d t/ | Y n-t& $ r!}t d
| d}~ww xY wt d | |dk rt1 | d{V n<# t d | |dk rt1 | d{V w w xY wddd dS # 1 swxY w Y dS ) zHRemove the imunify-security plugin from all sites where it is installed.z#Deleting imunify-security wp pluginr zwp-plugin-removalTNuninstalled_by_imunifyr_ z"Failed to remove plugin from %s %szSDeleting imunify-security wp plugin was cancelled. Plugin was deleted from %d sitesz)Error occurred during plugin deleting. %sz0Removed imunify-security wp plugin from %s sites)r7 ra r rc rd r rf whererT is_nullr
plugin_deactivater deleter rh r) r ru r6 r8 rA rv rp rI )r* rx affected to_remover r8 s r remove_all_installedr s
KK5666OH 2 3 3 0? 0?/ ?%,..44 199$?? I "
/555555555-d333333333 %,.. } 4 DEE H $**!,!%":!% ! LL>>>>>>>>
KKB
!||-o>>>>>>>>>> ]0? 0? 0? 0? 0? 0? 0? 0? 0? 0? 0? 0? 0? 0? 0? 0? 0? 0?s I AE&
B'D21E&2
E"< E E& E""E&%H&7G H G ( GG H 7I 9H<<I IIc K t d| | t j | t j | j k d S )Nz:Mark site %s as manually deleted at %s (WP-Plugin removed))rT )r7 ra r updater r rh )r nows r mark_site_as_manually_deletedr . s\
KKDdC 555 }$ 4 5 5 r c f K g } t t d t j t j D z }|rXt j }|D ]B}t || d {V | t j | d| Cn2# t $ r%}t d| Y d }~nd }~ww xY w|rt | d {V d S d S # |rt | d {V w w xY w)Nc 3 V K | ]$}t |j |j |j V %d S rM rN rP s r rR z+tidy_up_manually_deleted..< sP H
H
19ah . .H
H
H
H
H
H
r removed_by_userr_ z&Error occurred during site tidy up. %s)re rb r rf r rT r timer r) r ru r6 r7 r8 rI )r* rx to_mark_as_manually_removedr r r8 s r tidy_up_manually_deletedr 9 s O;&?&A&AC H
H
")++11 199;; H
H
H
E
E
'
# ' )++C3
3D#>>>>>>>>> && ( ! / ! F F F =uEEEEEEEEF ;)/:: : : : : : : : : : ; ;? ;)/:: : : : : : : : : ;s0 CC D
C8C3.D 3C88D D0r{ c f K |sd S t t }|D ]"}||j | #| D ]\ }} t j | j }n3# t $ r&}t
d|| Y d }~Kd }~ww xY wt | || d {V \ }}} |D ]k} ||| |j
g d}
t ||
d {V 9# t $ r&}t
d|| Y d }~dd }~ww xY wd S )Nz+Failed to get username for uid=%d. error=%srZ z.Failed to update scan data on site=%s error=%s)r r' r r) ri rj rk rl r6 r7 r8 r3 r" r rr ) r* r{ rz r r r r8 r, r- r0 r| s r update_data_on_sitesr X s %%M - -dh &&t,,,, $))++ ! !
U |C((0HH LL=
HHHH
*$#>> > > > > > >
D
*8)7 . 2 24< D D ,D)<<<<<<<<<<
D
#! !s0 A44
B$> B B$5C==
D- D((D-r| c K t j | j }|j }t | }t
j | r t dt | |
st |j ddt | g }t | d {V |
s#t dt | |j | d |dz }dt j | dd z d
z }|
s| t' ||d | j |d
d S )Nz)Data directory %s is a symlink, skipping.mkdirz-pz)Failed to create directory %s for user %si z
scan_data.phpzBz,_get_sites_without_plugin.. I s1vc!f#c!f++>>> r ) COMPONENTS_DB_PATHr r7 r8 r rb r execute_sqlr r fetchall)cursors r re re s $ $ & & ; " # #
uu
.
/
/
;
; , 0;/B3/L/L- F6 ??$$ r c < t s;t dt t t S t
t d| d }d | D S )z
Get a set of paths to WordPress sites belonging to a particular user. Paths are sorted by their length to make sure
that the main site is the last one in the list.
The data is pulled from the app-version-detector database.
r z
WITH latest_reports AS (
SELECT MAX(id) as id
FROM report
WHERE uid = a]
GROUP BY dir
)
SELECT wp.real_path
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
GROUP BY wp.real_path
ORDER BY length(wp.real_path) DESC
c g | ]
}|d S )r r@ r s r rD z&get_sites_for_user.. s 0 0 0sCF 0 0 0r ) r r r7 r8 r r' r r r )r r s r r& r& s $ $ & & ; " # #
vv
.
/
/
;
; ! F$ 1 0foo / / 0 0 00r r c p t s;t dt t t S | d s| dz
} t t d| d }d | D S )zn
Get a set of wp sites by given path.
The data is pulled from the app-version-detector database.
r *z/*ak
WITH latest_reports AS (
SELECT id, uid, domain
FROM report
WHERE id IN (
SELECT MAX(id)
FROM report
WHERE domain IS NOT NULL
AND domain != ''
GROUP BY dir
)
)
SELECT wp.real_path, lr.domain, lr.uid
FROM apps AS wp
INNER JOIN latest_reports AS lr
ON wp.report_id = lr.id
WHERE wp.title = 'wp_core'
AND wp.parent_id IS NULL
AND wp.real_path GLOB 'z
'
c
p g | ]3}t |d |d t |d 4S r r r s r rD z%get_sites_by_path..> r r )
r r r7 r8 r r' endswithr r r )r r s r get_sites_by_pathr s $ $ & & ; " # #
vv
==
.
/
/
;
; $ %)% F, ??$$ r )r< )=__doc__rA r loggingr rj r r collectionsr pathlibr rm peeweer defence360agent.apir defence360agent.contracts.configr r r$ defence360agent.utilsr r
imav.model.wordpressr r imav.wordpressr
r r imav.wordpress.utilsr r r r r getLogger__name__r7 r r r r r3 rE r; r' rI rb r} r r r r r dictrr re r& r r@ r r r s3 *
# # # # # # ! ! ! ! ! ! * * * * * * < ; ; ; ; ; ; ; 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
8 $ $TJ
Bv B B B B;# ;C ; ; ; ;<80A 8 8 8 8
:
:d
:
:
:
:{;3s8 {; {; {; {;|9F 9 9 9 9 6? 6? 6?r ; ; ;>+DL + + + +\=f = = = = =@+3v; + + + +\ 1C 1DI 1 1 1 1F*C *DL * * * * * *r