File Content: class-secupress-scan-inactive-plugins-themes.php <?php defined( 'ABSPATH' ) or die( 'Something went wrong.' ); /** * Inactive Plugins Themes scan class. * * @package SecuPress * @subpackage SecuPress_Scan * @since 1.0 */ class SecuPress_Scan_Inactive_Plugins_Themes extends SecuPress_Scan implements SecuPress_Scan_Interface { /** Constants. ============================================================================== */ /** * Class version. * * @var (string) */ const VERSION = '1.0.1'; /** Properties. ============================================================================= */ /** * The reference to the *Singleton* instance of this class. * * @var (object) */ protected static $_instance; /** Init and messages. ====================================================================== */ /** * Init. * * @since 1.0 */ protected function init() { $this->title = __( 'Check if you have some deactivated plugins or themes.', 'secupress' ); $this->more = __( 'Even deactivated plugins or themes can potentially be exploited to some vulnerabilities. Don’t take the risk to keep them on your website.', 'secupress' ); $this->more_fix = __( 'Delete every inactive plugin and theme you have.', 'secupress' ); } /** * Get messages. * * @since 1.0 * * @param (int) $message_id A message ID. * * @return (string|array) A message if a message ID is provided. An array containing all messages otherwise. */ public static function get_messages( $message_id = null ) { $messages = array( // "good" 0 => __( 'You don’t have any deactivated plugins or themes.', 'secupress' ), 1 => __( 'All inactive plugins have been deleted.', 'secupress' ), 2 => __( 'All inactive themes have been deleted.', 'secupress' ), // "warning" 100 => __( 'No plugins selected.', 'secupress' ), 101 => __( 'All selected plugins have been deleted (but some are still there).', 'secupress' ), 102 => _n_noop( 'Sorry, the following plugin could not be deleted: %s.', 'Sorry, the following plugins could not be deleted: %s.', 'secupress' ), 103 => __( 'No themes selected.', 'secupress' ), 104 => __( 'All selected themes have been deleted (but some are still there).', 'secupress' ), 105 => _n_noop( 'Sorry, the following theme could not be deleted: %s.', 'Sorry, the following themes could not be deleted: %s.', 'secupress' ), /** Translators: %s is the plugin name. */ 106 => sprintf( __( 'You have a big network, %s must work on some data before being able to perform this scan.', 'secupress' ), '<strong>' . SECUPRESS_PLUGIN_NAME . '</strong>' ), // "bad" 200 => _n_noop( '<strong>%1$d deactivated plugin</strong>, if you don’t need it, delete it: %2$s.', '<strong>%1$d deactivated plugins</strong>, if you don’t need them, delete them: %2$s.', 'secupress' ), 201 => _n_noop( '<strong>%1$d deactivated theme</strong>, if you don’t need it, delete it: %2$s.', '<strong>%1$d deactivated themes</strong>, if you don’t need them, delete them: %2$s.', 'secupress' ), 202 => _n_noop( 'Sorry, this plugin could not be deleted.', 'Sorry, those plugins could not be deleted.', 'secupress' ), 203 => _n_noop( 'Sorry, this theme could not be deleted.', 'Sorry, those themes could not be deleted.', 'secupress' ), // "cantfix" 300 => _n_noop( '%d plugin is deactivated.', '%d plugins are deactivated.', 'secupress' ), 301 => _n_noop( '%d theme is deactivated.', '%d themes are deactivated.', 'secupress' ), 302 => __( 'Unable to locate WordPress Plugin directory.', 'secupress' ), 303 => __( 'Unable to locate WordPress theme directory.', 'secupress' ), 304 => __( 'No plugins nor themes selected.', 'secupress' ), ); if ( isset( $message_id ) ) { return isset( $messages[ $message_id ] ) ? $messages[ $message_id ] : __( 'Unknown message', 'secupress' ); } return $messages; } /** Getters. ================================================================================ */ /** * Get the documentation URL. * * @since 1.2.3 * * @return (string) */ public static function get_docs_url() { return __( 'https://docs.secupress.me/article/118-deactivated-plugins-and-themes-scan', 'secupress' ); } /** Scan. =================================================================================== */ /** * Scan for flaw(s). * * @since 1.0 * * @return (array) The scan results. */ public function scan() { $activated = $this->filter_scanner( __CLASS__ ); if ( true === $activated ) { $this->add_message( 0 ); return parent::scan(); } if ( ! static::are_centralized_blog_options_filled() ) { // "warning" $this->add_message( 106 ); return parent::scan(); } $lists = static::get_inactive_plugins_and_themes(); // Inactive plugins. if ( $count = count( $lists['plugins'] ) ) { // "bad" $lists['plugins'] = wp_list_pluck( $lists['plugins'], 'Name' ); // Do not translate 'Name'. $lists['plugins'] = self::wrap_in_tag( $lists['plugins'], 'code' ); $this->slice_and_dice( $lists['plugins'], 8 ); $this->add_message( 200, array( $count, $count, $lists['plugins'] ) ); } // Inactive themes. if ( $count = count( $lists['themes'] ) ) { // "bad" foreach ( $lists['themes'] as $key => $theme ) { $lists['themes'][ $key ] = '<code>' . $theme->display( 'Name', false, true ) . '</code>'; } $this->slice_and_dice( $lists['themes'], 8 ); $this->add_message( 201, array( $count, $count, $lists['themes'] ) ); } // "good" $this->maybe_set_status( 0 ); return parent::scan(); } /** Fix. ==================================================================================== */ /** * Try to fix the flaw(s). * * @since 1.0 * * @return (array) The fix results. */ public function fix() { // "good" $this->add_fix_message( 0 ); return parent::fix(); } /** Manual fix. ============================================================================= */ /** * Return an array of actions if a manual fix is needed here. * * @since 1.0 * * @return (array) */ public function need_manual_fix() { $lists = static::get_inactive_plugins_and_themes(); $actions = array(); // Inactive plugins. if ( $lists['plugins'] ) { $actions['delete-inactive-plugins'] = 'delete-inactive-plugins'; } // Inactive themes. if ( $lists['themes'] ) { $actions['delete-inactive-themes'] = 'delete-inactive-themes'; } return $actions; } /** * Try to fix the flaw(s) after requiring user action. * * @since 1.0 * * @return (array) The fix results. */ public function manual_fix() { $inactive = static::get_inactive_plugins_and_themes(); ob_start(); // PLUGINS. if ( $this->has_fix_action_part( 'delete-inactive-plugins' ) ) { $plugins = $this->manual_fix_plugins( $inactive ); } // THEMES. if ( $this->has_fix_action_part( 'delete-inactive-themes' ) ) { $themes = $this->manual_fix_themes( $inactive ); } ob_end_clean(); if ( ! empty( $plugins ) && ! empty( $themes ) ) { // "cantfix": nothing selected in both lists. $this->add_fix_message( 304 ); } elseif ( ! empty( $plugins ) ) { // "warning": no plugins selected. $this->add_fix_message( $delete ); } elseif ( ! empty( $themes ) ) { // "warning": no themes selected. $this->add_fix_message( $themes ); } // "good" $this->maybe_set_fix_status( 0 ); return parent::manual_fix(); } /** * Manual fix for plugins. * * @since 1.0 * * @param (array) $inactive Array containing an array of inactive plugins and an array of inactive themes. Values must be sanitized before. */ protected function manual_fix_plugins( $inactive ) { // Get the list of plugins to uninstall. $selected_plugins = ! empty( $_POST['secupress-fix-delete-inactive-plugins'] ) && is_array( $_POST['secupress-fix-delete-inactive-plugins'] ) ? array_filter( $_POST['secupress-fix-delete-inactive-plugins'] ) : array(); // WPCS: CSRF ok. $selected_plugins = $selected_plugins ? array_fill_keys( $selected_plugins, 1 ) : array(); $selected_plugins = $selected_plugins ? array_intersect_key( $inactive['plugins'], $selected_plugins ) : array(); // Sanitize submitted values. if ( ! $selected_plugins ) { if ( $this->has_fix_action_part( 'delete-inactive-themes' ) ) { /* * warning: no plugins selected. * No `add_fix_message()`, we need to change the status from warning to cantfix if both lists have no selection. */ return 100; } // "cantfix": no plugins selected. return $this->add_fix_message( 304 ); } // Get the base plugin folder. $wp_filesystem = secupress_get_filesystem(); $plugins_dir = $wp_filesystem->wp_plugins_dir(); if ( empty( $plugins_dir ) ) { // "cantfix": plugins dir not located. return $this->add_fix_message( 302 ); } $plugins_dir = trailingslashit( $plugins_dir ); $plugin_translations = wp_get_installed_translations( 'plugins' ); $deleted_plugins = array(); $count_inactive = count( $inactive['plugins'] ); $count_selected = count( $selected_plugins ); foreach ( $selected_plugins as $plugin_file => $plugin_data ) { // Run Uninstall hook. if ( is_uninstallable_plugin( $plugin_file ) ) { uninstall_plugin( $plugin_file ); } /** This action is documented in wp-admin/includes/plugin.php */ do_action( 'delete_plugin', $plugin_file ); $this_plugin_dir = trailingslashit( dirname( $plugins_dir . $plugin_file ) ); // If plugin is in its own directory, recursively delete the directory. if ( strpos( $plugin_file, '/' ) && $this_plugin_dir !== $plugins_dir ) { // base check on if plugin includes directory separator AND that its not the root plugin folder. $deleted = $wp_filesystem->delete( $this_plugin_dir, true ); } else { $deleted = $wp_filesystem->delete( $plugins_dir . $plugin_file ); } /** This action is documented in wp-admin/includes/plugin.php */ do_action( 'deleted_plugin', $plugin_file, $deleted ); if ( $deleted ) { $deleted_plugins[ $plugin_file ] = 1; // Remove language files, silently. $plugin_slug = dirname( $plugin_file ); if ( '.' !== $plugin_slug && ! empty( $plugin_translations[ $plugin_slug ] ) ) { $translations = $plugin_translations[ $plugin_slug ]; foreach ( $translations as $translation => $data ) { $wp_filesystem->delete( WP_LANG_DIR . '/plugins/' . $plugin_slug . '-' . $translation . '.po' ); $wp_filesystem->delete( WP_LANG_DIR . '/plugins/' . $plugin_slug . '-' . $translation . '.mo' ); } } } } $count_deleted = count( $deleted_plugins ); // Everything's deleted, no plugins left. if ( $count_deleted === $count_inactive ) { // "good" $this->add_fix_message( 1 ); } // All selected plugins deleted. elseif ( $count_deleted === $count_selected ) { // "partial": some plugins still need to be deleted. $this->add_fix_message( 101 ); } // No plugins deleted. elseif ( ! $count_deleted ) { // "bad" $this->add_fix_message( 202, array( $count_inactive ) ); } // Some plugins could not be deleted. else { // "cantfix" $not_removed = array_diff_key( $selected_plugins, $deleted_plugins ); $not_removed = wp_list_pluck( $not_removed, 'Name' ); $this->add_fix_message( 102, array( count( $not_removed ), $not_removed ) ); } // Force refresh of plugin update information and cache. if ( $deleted_plugins ) { if ( $current = get_site_transient( 'update_plugins' ) ) { $current->response = array_diff_key( $current->response, $deleted_plugins ); $current->no_update = array_diff_key( $current->no_update, $deleted_plugins ); set_site_transient( 'update_plugins', $current ); } wp_cache_delete( 'plugins', 'plugins' ); } } /** * Manual fix for themes. * * @since 1.0 * * @param (array) $inactive Array containing an array of inactive plugins and an array of inactive themes. Values must be sanitized before. */ protected function manual_fix_themes( $inactive ) { // Get the list of themes to uninstall. $selected_themes = ! empty( $_POST['secupress-fix-delete-inactive-themes'] ) && is_array( $_POST['secupress-fix-delete-inactive-themes'] ) ? array_filter( $_POST['secupress-fix-delete-inactive-themes'] ) : array(); // WPCS: CSRF ok. $selected_themes = $selected_themes ? array_fill_keys( $selected_themes, 1 ) : array(); $selected_themes = $selected_themes ? array_intersect_key( $inactive['themes'], $selected_themes ) : array(); // Sanitize submitted values. if ( ! $selected_themes ) { if ( $this->has_fix_action_part( 'delete-inactive-plugins' ) ) { /* * warning: no themes selected. * No `add_fix_message()`, we need to change the status from warning to cantfix if both lists have no selection. */ return 103; } // "cantfix": no themes selected. return $this->add_fix_message( 304 ); } // Get the base theme folder. $wp_filesystem = secupress_get_filesystem(); $themes_dir = $wp_filesystem->wp_themes_dir(); if ( empty( $themes_dir ) ) { // "cantfix": themes dir not located. return $this->add_fix_message( 303 ); } $themes_dir = trailingslashit( $themes_dir ); $deleted_themes = array(); $count_inactive = count( $inactive['themes'] ); $count_selected = count( $selected_themes ); foreach ( $selected_themes as $theme_file => $theme_data ) { $this_theme_dir = trailingslashit( $themes_dir . $theme_file ); if ( $wp_filesystem->delete( $this_theme_dir, true ) ) { $deleted_themes[ $theme_file ] = 1; } } $count_deleted = count( $deleted_themes ); // Everything's deleted, no themes left. if ( $count_deleted === $count_inactive ) { // "good" $this->add_fix_message( 2 ); } // All selected themes deleted. elseif ( $count_deleted === $count_selected ) { // "partial": some themes still need to be deleted. $this->add_fix_message( 104 ); } // No themes deleted. elseif ( ! $count_deleted ) { // "bad" $this->add_fix_message( 203, array( $count_inactive ) ); } // Some themes could not be deleted. else { // "cantfix" $not_removed = array_diff_key( $selected_themes, $deleted_themes ); if ( $not_removed ) { foreach ( $not_removed as $key => $theme ) { $not_removed[ $key ] = $theme->display( 'Name', false, true ); } } $this->add_fix_message( 105, array( count( $not_removed ), $not_removed ) ); } // Force refresh of theme update information. delete_site_transient( 'update_themes' ); // Force refresh of themes list. search_theme_directories( true ); } /** * Get an array containing ALL the forms that would fix the scan if it requires user action. * * @since 1.0 * * @return (array) An array of HTML templates (form contents most of the time). */ protected function get_fix_action_template_parts() { $forms = array(); $lists = static::get_inactive_plugins_and_themes(); if ( $lists['plugins'] ) { $form = '<h4 id="secupress-fix-inactive-plugins">' . __( 'Checked plugins will be deleted:', 'secupress' ) . '</h4>'; $form .= '<fieldset aria-labelledby="secupress-fix-inactive-plugins" class="secupress-boxed-group">' . "\n"; foreach ( $lists['plugins'] as $plugin_file => $plugin_data ) { $is_symlinked = secupress_is_plugin_symlinked( $plugin_file ); $plugin_name = esc_html( strip_tags( $plugin_data['Name'] ) ); $form .= '<input type="checkbox" id="secupress-fix-delete-inactive-plugins-' . sanitize_html_class( $plugin_file ) . '" name="secupress-fix-delete-inactive-plugins[]" value="' . esc_attr( $plugin_file ) . '" ' . ( $is_symlinked ? 'disabled="disabled"' : 'checked="checked"' ) . '/> '; $form .= '<label for="secupress-fix-delete-inactive-plugins-' . sanitize_html_class( $plugin_file ) . '">'; if ( $is_symlinked ) { $form .= '<del>' . $plugin_data['Name'] . '</del> <span class="description">(' . __( 'symlinked', 'secupress' ) . ')</span>'; } else { $form .= $plugin_data['Name']; } $form .= "</label><br/>\n"; } $form .= "</fieldset>\n"; } else { $form = __( 'No inactive plugins', 'secupress' ); } $forms['delete-inactive-plugins'] = $form; if ( $lists['themes'] ) { $form = '<h4 id="secupress-fix-inactive-themes">' . __( 'Checked themes will be deleted:', 'secupress' ) . '</h4>'; $form .= '<fieldset aria-labelledby="secupress-fix-inactive-themes" class="secupress-boxed-group">' . "\n"; // Add the default themes back. if ( $lists['default_themes'] ) { $lists['themes'] = array_merge( $lists['themes'], $lists['default_themes'] ); WP_Theme::sort_by_name( $lists['themes'] ); } foreach ( $lists['themes'] as $theme_file => $theme_data ) { $is_symlinked = ! empty( $lists['default_themes'][ $theme_file ] ) ? true : secupress_is_theme_symlinked( $theme_file ); $form .= '<input type="checkbox" id="secupress-fix-delete-inactive-themes-' . sanitize_html_class( $theme_file ) . '" name="secupress-fix-delete-inactive-themes[]" value="' . esc_attr( $theme_file ) . '" ' . ( $is_symlinked ? 'disabled="disabled"' : 'checked="checked"' ) . '/> '; $form .= '<label for="secupress-fix-delete-inactive-themes-' . sanitize_html_class( $theme_file ) . '">'; $theme_name = $theme_data->display( 'Name', false, true ); if ( ! empty( $lists['default_themes'][ $theme_file ] ) ) { $form .= '<del>' . $theme_name . '</del> <span class="description">(' . __( 'default theme', 'secupress' ) . ')</span>'; } elseif ( $is_symlinked ) { $form .= '<del>' . $theme_name . '</del> <span class="description">(' . __( 'symlinked', 'secupress' ) . ')</span>'; } else { $form .= $theme_name; } $form .= "</label><br/>\n"; } $form .= "</fieldset>\n"; } else { $form = __( 'No inactive themes', 'secupress' ); } $forms['delete-inactive-themes'] = $form; return $forms; } /** Tools. ================================================================================== */ /** * Get the default theme and (maybe) its child theme. * * @since 1.0 * * @return (array) An array of theme slugs. */ protected static function get_default_themes() { static $themes; if ( isset( $themes ) ) { return $themes; } $themes = array(); $default = wp_get_theme( WP_DEFAULT_THEME ); if ( ! $default->exists() ) { $default = WP_Theme::get_core_default_theme(); if ( false === $default ) { return array(); } } $stylesheet = $default->get_stylesheet(); $template = $default->get_template(); $themes[ $stylesheet ] = $stylesheet; if ( $template !== $stylesheet ) { $default = wp_get_theme( $template ); if ( $default->exists() ) { $themes[ $template ] = $template; } } return $themes; } /** * Get the inactive plugins and themes. * * @since 1.0 * * @return (array) Array containing an array of inactive plugins, an array of inactive themes, and an array of default theme(s). */ protected static function get_inactive_plugins_and_themes() { $out = array(); if ( is_multisite() ) { // For multisite we need to get active plugins and themes for each blog. Here, we'll fetch both. $plugins = get_site_option( 'secupress_active_plugins' ); $themes = get_site_option( 'secupress_active_themes' ); $active = array( 'plugins' => array(), 'themes' => array() ); foreach ( $plugins as $site_id => $site_plugins ) { if ( $site_plugins ) { $active['plugins'] = array_merge( $active['plugins'], $site_plugins ); } } foreach ( $themes as $site_id => $theme ) { $active['themes'][ $theme ] = $theme; } } // INACTIVE PLUGINS. $out['plugins'] = get_plugins(); if ( is_multisite() ) { $network_active_plugins = get_site_option( 'active_sitewide_plugins', array() ); $network_active_plugins = is_array( $network_active_plugins ) ? $network_active_plugins : array(); $active_plugins = array_merge( $active['plugins'], $network_active_plugins ); } else { $active_plugins = get_option( 'active_plugins', array() ); $active_plugins = is_array( $active_plugins ) ? $active_plugins : array(); $active_plugins = array_fill_keys( $active_plugins, 1 ); } $out['plugins'] = array_diff_key( $out['plugins'], $active_plugins ); // INACTIVE THEMES. $out['themes'] = wp_get_themes(); if ( is_multisite() ) { $active_themes = $active['themes']; } else { $active_themes = array(); $this_blog_theme = get_stylesheet(); if ( $this_blog_theme ) { $active_themes[ $this_blog_theme ] = $this_blog_theme; } } // We may have child themes, we need to add their parent to the "active themes" list. if ( $active_themes ) { foreach ( $active_themes as $stylesheet ) { if ( isset( $out['themes'][ $stylesheet ] ) && $out['themes'][ $stylesheet ]->parent() ) { $parent_stylesheet = $out['themes'][ $stylesheet ]->parent()->get_stylesheet(); $active_themes[ $parent_stylesheet ] = $parent_stylesheet; } } $out['themes'] = array_diff_key( $out['themes'], $active_themes ); } // Don't list the default themes. $default_themes = static::get_default_themes(); if ( $default_themes ) { // Keep track of those that are inactive. $out['default_themes'] = array_intersect_key( $out['themes'], $default_themes ); $out['themes'] = array_diff_key( $out['themes'], $default_themes ); } else { $out['default_themes'] = array(); } return $out; } } Submit