h{' N d Z ddlZddlZddlZddlZddlmZ ddlmZmZ ddl m
Z
ddl m Z ddl
mZ ddlmZmZmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
l m Z ddl m Z ddl!m"Z" ddl#m$Z$ ddl%m&Z& dZ'dZ( ej) e* Z+ ed de,e-e.e- f fd Z/de-de-de.fdZ0de"fd Z1 e
d de2fd Z3d Z4d!e-d"e.de.fd#Z5de-d$e-de.e- fd%Z6de"d!e-de e- fd&Z7d!e-de.fd'Z8d!e-de,fd(Z9d) Z:d*e;d+e;d!e-de"d,e,de,f d-Z.
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) defaultdict)datetime timedelta) lru_cache)Optional)Path)choose_value_from_configMalwareScanScheduleMalwareScanScheduleInterval)
LicenseCLN) HostingPanel)async_lru_cache)
MalwareHit)QueueSupervisorSync) user_list)WPSite)WP_CLI_WRAPPER_PATH)PHPErrorz/usr/sbin/cagefs_enter_userz/usr/sbin/cagefsctl< )ttlreturnc K t } | d{V }t t }| D ]%\ }}|D ] }|| | &|S )zN
Get a mapping of docroots to their associated domains, with caching.
N)r
get_domain_pathsr listitemsappend)
hosting_panel panel_paths docroot_mapdomaindocrootsdocroots I/opt/imunify360/venv/lib/python3.11/site-packages/imav/wordpress/utils.pyr r < s
!NNM%6688888888K d##K ' - - / / 0 0 0 0G ' ' / / / / 0 php_pathr" c 0 t t | |gS )z Get wp cli common command list)strr )r% r" s r#
wp_wrapperr( J s # $ $h 88r$ sitec 6 t | j dz dz S )Nz
wp-contentzimunify-security)r r" )r) s r# get_data_dirr+ O s ,/A AAr$ )maxsizec t j t r$t j t t j st
S t j t dgdd } | j dk rt
S | j
d }t
|dd S )z)Get the list of users enabled for CageFS.z--list-enabledT)capture_outputtextr
r, N)
ospathisfileCAGEFS_CTL_PATHaccessX_OKset
subprocessrun
returncodestdoutstripsplit)resultliness r# get_cagefs_enabled_usersrA S s 7>>/ * * ")3 3 uu
^ *+Dt F A uu M ! ! ' ' - -E uQRRy>>r$ c 8 t d S )N)rA cache_clear r$ r# $clear_get_cagefs_enabled_users_cacherE e s ((*****r$ usernameargsc | t v rTt j t r0t j t t j r t d| g|S ddd| dt j | gS )zNBuild the necessary command to run the given cmdline args with specified user.z--no-io-and-memory-limitsuz-sz /bin/bashz-c) rA r2 r3 r4 CAGEFS_ENTER_PATHr6 r7 shlexjoin)rF rG s r# build_command_for_userrM i s +----
7>>+ , , rw2
2
"*
4
r$ domain_to_excludec x K t d{V }| | g }fd|D S )z
Get all domains associated with a given document root, excluding one domain.
It's panel-agnostic and uses a cached mapping.
Nc g | ]
}|k | S rD rD ).0r rN s r#
z+get_domains_for_docroot.. s$ L L Lv:K0K0KF0K0K0Kr$ )r get)r" rN r all_domainss ` r# get_domains_for_docrootrU sS )********K //'2..K L L L L L L LLr$ c P K ddl m}m} | | dt dt t f fd } || j }|r|S t
| j | j d{V }|D ]} || }|r|c S t d| j d )
z/Determine PHP binary path for the given WPSite.r )get_domains_php_infoget_installed_php_versionsr r c | }|r| d k rd S | d }|sd S D ]2}| d |k r| d c S 3d S )NrF display_version
identifierbin)rS )r domain_infophp_display_version php_versiondomains_php_infoinstalled_php_versionsrF s r# find_php_binary_for_domainz7get_php_binary_path..find_php_binary_for_domain s &**622 kooj 9 9X E E4 )oo.? @ @" 41 . .K|,,0CCC"u----- Dtr$ )rN Nz+PHP binary was not identified for docroot: z , username: ) clcommon.cpapirW rX r' r r rU r" r )
r) rF rW rX rb php_binary_pathdomainsr r` ra s
` @@r# get_php_binary_pathrf sX
,+-- 7 7 9 9 3 8C= 10==O , G # #44V<< #" " " " # dl r$ c 6 t j | \ }}|S )z
Get malware history for the specified user.
This is an equivalent of calling `imunify360-agent malware history list --user {username}`.
``
)user)r malicious_list)rF max_counthitss r# get_malware_historyrl s! #1x@@@Y Kr$ c K t | }t j |j |h d{V \ }}|si S t j |dd }|d S )z
Get the last scan for the specified user.
This is an equivalent of calling `imunify360-agent malware user list --user {username}`.
)matchN scan_dateT)descr ) ScanQueuer fetch_user_listget_scans_from_pathssort)sinkrF queue_userss r#
get_last_scanry s
dOOE .
"8* HAu N5+D 9 9 9E 8Or$ c 0 t j } t j t j k rP| t j ddd }| |k r|t d z
}| S t j t j
k rt j | dz dz z
dz dz }|dk r| j
t j k rd}| t | z }| t j ddd S t j t j k r| t j t j ddd }| j t j k s*| j t j k rf| j
t j k rQ| j dk r
| j dz nd}| | }|dk r | | j dz }| S d S )
Nr )hourminutesecond microsecondr, )days )dayr{ r| r} r~ )month)year)r utcnowr
INTERVALIntervalDAYreplaceHOURr timestampWEEK DAY_OF_WEEKweekdayr{ MONTH DAY_OF_MONTHr r r )today next_scan
days_aheadnext_scan_date
next_months r# calculate_next_scan_timestampr s O E#x|33MM$) "
I *** *I""$$$#x}44
+u}}/Ba.G G! K
??uz-@-E E EJ
!;!;!;; %%$)!A1 &
)++ #x~55 #0$) '
9*7 7 7 I,9 9 9
1 666,1K",<,<q !J + 3 3* 3 E ENQ!/!7!7UZ!^!7!L!L '')))! 65r$ last_scan_timenext_scan_timemalware_by_sitec g d}i }|D ]B\ }}||vri ||< t ||| \ } }
n# t $ r d} Y nw xY w| || |< C| ||| |j g |t j dS )a8
Prepare scan data JSON for a WordPress site.
Args:
last_scan_time: Timestamp of the last scan
next_scan_time: Timestamp of the next scheduled scan
username: Username of the site owner
site: WordPress site object
malware_by_site: Dictionary mapping site docroots to their malware hits
Returns:
dict: JSON data ready to be written to scan_data.php. The response includes:
- lastScanTimestamp: Timestamp of the last scan
- nextScanTimestamp: Timestamp of the next scheduled scan
- username: Username of the site owner
- malware: List of malware hits for the site
- config: Configuration items for the site
- license: License information including status and eligibility for Imunify patch
))MALWARE_SCANNINGenable_scan_cpanel)r default_action)PROACTIVE_DEFENCEblamer)rF N)lastScanTimestampnextScanTimestamprF malwareconfiglicense)r KeyErrorrS r" r license_info) r r rF r) r config_sections config_itemssectionoptionvaluerw s r# prepare_scan_datar s 6 O L* . . , & &$&L ! /! HE11
EEE (- W f%% , + "&&t|R88 *,,
s . ==)=__doc__loggingr2 rK r9 collectionsr r r functoolsr typingr pathlibr defence360agent.contracts.configr r
r r !defence360agent.contracts.licenser +defence360agent.subsys.panels.hosting_panelr
defence360agent.utilsr imav.malwarelib.modelr *imav.malwarelib.scan.queue_supervisor_syncr rq imav.malwarelib.utilsr imav.model.wordpressr imav.wordpressr imav.wordpress.exceptionr rJ r5 getLogger__name__loggerdictr' r r r( r+ r8 rA rE rM rU rf rl ry r floatr rD r$ r# r s * # # # # # # ( ( ( ( ( ( ( (
9 8 8 8 8 8 D D D D D D 1 1 1 1 1 1 , , , , , , , + + + + + ' ' ' ' ' ' . - - - - -1 ' 8 $ $ R
S$s)^ 4
9 9s 9t 9 9 9 9
Bv B B B B 1# "+ + +S . M
M%( M #Y M M M M)F )c )hsm ) ) ) )X# $ $+* +* +*\888 8 8
8
8 8 8 8 8 8r$