FM / security

/home/techb158/l2hypotheques.com/wp-content/plugins/really-simple-ssl/security/

/home/techb158/l2hypotheques.com/wp-content/plugins/really-simple-ssl/security

Name	Size	Mode	Actions
includes/	-	0755	rm
server/	-	0755	rm
tests/	-	0755	rm
wordpress/	-	0755	rm
class-rsssl-htaccess-file-manager.php	21108	0644	edit dl rm
cron.php	4169	0644	edit dl rm
deactivate-integration.php	1611	0644	edit dl rm
firewall-manager.php	29096	0644	edit dl rm
functions.php	21250	0644	edit dl rm
hardening.php	2260	0644	edit dl rm
index.php	32	0644	edit dl rm
integrations.php	4813	0644	edit dl rm
notices.php	6174	0644	edit dl rm
security.php	1805	0644	edit dl rm
sync-settings.php	2860	0644	edit dl rm
tests.php	13704	0644	edit dl rm

Edit: /home/techb158/l2hypotheques.com/wp-content/plugins/really-simple-ssl/security/tests.php (13704B)

<?php
defined( 'ABSPATH' ) or die();

/**
 * Check if XML-RPC requests are allowed on this site
 * POST a request, if the request returns a 200 response code the request is allowed
 */
function rsssl_xmlrpc_allowed()
{
	$allowed = get_transient( 'rsssl_xmlrpc_allowed' );
	if ( !$allowed ) {
		$allowed = 'allowed';
		if ( function_exists( 'curl_init' ) ) {
			//set a default, in case of time out
			set_transient( 'rsssl_xmlrpc_allowed', 'no-response', DAY_IN_SECONDS );
			$url = site_url() . '/xmlrpc.php';
			$ch = curl_init($url);
			// XML-RPC listMethods call
			// Valid XML-RPC request
			$xmlstring = '<?xml version="1.0" encoding="utf-8"?> 
                            <methodCall>
                            <methodName>system.listMethods</methodName>
                            <params></params>
                            </methodCall>';

curl_setopt($ch, CURLOPT_POST, 1);
			curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
			curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
			curl_setopt($ch, CURLOPT_HEADER, 1);
			curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
			// Post string
			curl_setopt($ch, CURLOPT_POSTFIELDS, $xmlstring );
			curl_setopt($ch, CURLOPT_TIMEOUT, 3); //timeout in seconds
			curl_exec($ch);
			$response_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
			if ($response_code === 200) {
				$allowed = 'allowed';
			} else {
				$allowed = 'not-allowed';
			}
		}
		set_transient( 'rsssl_xmlrpc_allowed', $allowed, DAY_IN_SECONDS );
	}
	return $allowed === 'allowed';
}

/**
 * @return bool
 * Test if HTTP methods are allowed
 */
function rsssl_http_methods_allowed()
{
	if ( ! rsssl_user_can_manage() ) {
		return false;
	}

$methods = [
		'GET',
		'POST',
		'PUT',
		'DELETE',
		'HEAD',
		'OPTIONS',
		'CONNECT',
		'TRACE',
		'TRACK',
		'PATCH',
		'COPY',
		'LINK',
		'UNLINK',
		'PURGE',
		'LOCK',
		'UNLOCK',
		'PROPFIND',
		'VIEW',
	];
	$tested = get_option( 'rsssl_http_methods_allowed' );

#if the option was reset, start couting from 0
	if ( !$tested ){
		delete_option('rsssl_last_tested_http_method');
	}
	$last_tested = get_option('rsssl_last_tested_http_method', -1);

$nr_of_tests_on_batch = 4;
	if ( !$tested || ( $last_tested < count($methods)-1 ) ) {
		$tested = get_option( 'rsssl_http_methods_allowed', [] );
		$next_test = $last_tested+1;

$test_methods = array_slice($methods, $next_test, $nr_of_tests_on_batch, true);
		update_option('rsssl_last_tested_http_method', $last_tested+$nr_of_tests_on_batch, false);

foreach ( $test_methods as $method ) {
			#set a default, in case a timeout occurs
			$tested['not-allowed'][] = $method;
			update_option( 'rsssl_http_methods_allowed', $tested, false );

if ( function_exists( 'curl_init' ) ) {

$ch = curl_init();
				curl_setopt( $ch, CURLOPT_URL, site_url() );
				curl_setopt( $ch, CURLOPT_CUSTOMREQUEST, $method );
				curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
				curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, false );
				curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
				curl_setopt( $ch, CURLOPT_HEADER, true );
				curl_setopt( $ch, CURLOPT_NOBODY, true );
				curl_setopt( $ch, CURLOPT_VERBOSE, true );
				curl_setopt( $ch, CURLOPT_TIMEOUT, 3 ); //timeout in seconds
				curl_exec( $ch );

#if there are no errors, the request is allowed
				if ( ! curl_errno( $ch ) ) {
					//remove the not allowed entry
					$not_allowed_index = array_search( $method, $tested['not-allowed'], true );
					if ( $not_allowed_index !== false ) {
						unset( $tested['not-allowed'][ $not_allowed_index ] );
					}
					$tested['allowed'][] = $method;
				}
				curl_close( $ch );
				update_option( 'rsssl_http_methods_allowed', $tested, false );
			}
		}
	}

if ( !empty($tested['allowed'])) {
		return true;
	}
	return false;
}

/**
 * @return bool
 *
 * Check if DB has default wp_ prefix
 */

function rsssl_is_default_wp_prefix() {
	global $wpdb;
	if ( $wpdb->prefix === 'wp_' ) {
		return true;
	}
	return false;
}

function rsssl_xmlrpc_enabled(){
	return apply_filters('xmlrpc_enabled', true );
}

/**
 * @return bool
 *
 * Check if user admin exists
 */

return $count > 0;
}

/**
 * Check if username is valid for use
 * @return bool
 */
function rsssl_new_username_valid(): bool {

$new_user_login = trim(sanitize_user(rsssl_get_option('new_admin_user_login')));
	if ( $new_user_login === 'admin' ) {
		return false;
	}
	$user_exists = get_user_by('login', $new_user_login);
	if ( $user_exists ) {
		return false;
	}

return is_string($new_user_login) && strlen($new_user_login)>2;
}

/**
 * For backward compatibility we need to wrap this function, as older versions do not have this function (<5.6)
 * @return bool
 */
function rsssl_wp_is_application_passwords_available(){
	if ( function_exists('wp_is_application_passwords_available') ) {
		return wp_is_application_passwords_available();
	}

return false;
}

/**
 * Get users where display name is the same as login
 *
 * @param bool $return_users
 *
 * @return bool | array
 *
 */

function rsssl_get_users_where_display_name_is_login( $return_users=false ) {
	$found_users = [];
	$users = get_transient('rsssl_admin_users');
	if ( !$users ){
		$args = array(
			'role'    => 'administrator',
		);
		$users = get_users( $args );
		set_transient('rsssl_admin_users', $users, HOUR_IN_SECONDS);
	}

foreach ( $users as $user ) {
		if ($user->display_name === $user->user_login) {
			$found_users[] = $user->user_login;
		}
	}

// Maybe return users in integration
	if ( $return_users ) {
		return $found_users;
	}

if ( count($found_users) > 0 ) {
		return true;
	}

return false;
}

/**
 * Check if debugging in WordPress is enabled
 *
 * @return bool
 */
function rsssl_is_debugging_enabled() {
	return ( defined('WP_DEBUG') && WP_DEBUG && defined('WP_DEBUG_LOG') && WP_DEBUG_LOG );
}

function rsssl_debug_log_value_is_default(){
	$value = rsssl_get_debug_log_value();

return (string) $value === 'true';
}

/**
 * Get value of debug_log constant
 * Please note that for a value 'true', you should check for the string value === 'true'
 * @return bool|string
 */

function rsssl_get_debug_log_value(){
	if ( !defined('WP_DEBUG_LOG')) {
		return false;
	}
	$wpconfig_path = rsssl_find_wp_config_path();

if ( !$wpconfig_path ) {
		return false;
	}
	$wpconfig      = file_get_contents( $wpconfig_path );

// Get WP_DEBUG_LOG declaration
	$regex = "/^\s*define$[ ]{0,2}[\'|\"]WP_DEBUG_LOG[\'|\"][ ]{0,2},[ ]{0,2}(.*)[ ]{0,2}$;/m";
	preg_match( $regex, $wpconfig, $matches );
	if ($matches && isset($matches[1]) ){
		return trim($matches[1]);
	}

return false;
}

/**
 * Check if the debug log file exists in the default location, and if it contains our bogus info
 * @return bool
 *
 */
function rsssl_debug_log_file_exists_in_default_location(){
	$default_file = trailingslashit(WP_CONTENT_DIR).'debug.log';
	if ( !file_exists($default_file) ) {
		return false;
	}
	//limit max length of string to 500
	$content = file_get_contents($default_file, false, null, 0, 500 );
	return trim( $content ) !== 'Access denied';
}

/**
 * @return string
 * Test if code execution is allowed in /uploads folder
 */
function rsssl_code_execution_allowed()
{
	$code_execution_allowed = get_transient('rsssl_code_execution_allowed_status');
	if ( !$code_execution_allowed ) {
		$upload_dir = wp_get_upload_dir();
		//set a default, in case of timeouts
		$code_execution_allowed = 'not-allowed';
		set_transient( 'rsssl_code_execution_allowed_status', $code_execution_allowed, DAY_IN_SECONDS );

$test_file = $upload_dir['basedir'] . '/' . 'code-execution.php';
		if ( is_writable($upload_dir['basedir'] ) && ! file_exists( $test_file ) ) {
			try {
				copy( rsssl_path . 'security/tests/code-execution.php', $test_file );
			} catch (Exception $e) {
				$code_execution_allowed = 'not-allowed';
			}
		}

if ( file_exists( $test_file ) ) {
			$uploads    = wp_upload_dir();
			$upload_url = trailingslashit($uploads['baseurl']).'code-execution.php';
			$response = wp_remote_get($upload_url);
			if ( !is_wp_error($response) ) {
				if ( is_array( $response ) ) {
					$status = wp_remote_retrieve_response_code( $response );
					$web_source = wp_remote_retrieve_body( $response );
				}

if ( $status != 200 ) {
					//Could not connect to website
					$code_execution_allowed = 'not-allowed';
				} elseif ( strpos( $web_source, "RSSSL CODE EXECUTION MARKER" ) === false ) {
					//Mixed content fixer marker not found in the websource
					$code_execution_allowed = 'not-allowed';
				} else {
					$code_execution_allowed = 'allowed';
				}
			} else {
				$code_execution_allowed = 'not-allowed';
			}
		}

//clean up file again
		if ( file_exists($test_file) ) {
			unlink($test_file);
		}
		set_transient('rsssl_code_execution_allowed_status', $code_execution_allowed, DAY_IN_SECONDS);
	}

return $code_execution_allowed === 'allowed';
}

/**
 * Test if directory indexing is allowed
 * We assume allowed if test is not possible due to restrictions. Only an explicity 403 on the response results in "forbidden".
 * On non htaccess servers, the default is non indexing, so we return forbidden.
 *
 * @return bool
 */
function rsssl_directory_indexing_allowed() {
	$status = get_transient('rsssl_directory_indexing_status');
	if ( !$status ) {
		if ( !rsssl_uses_htaccess() ) {
			$status = 'forbidden';
		} else {
			$status = 'allowed';
			//set a default, in case of timeouts
			set_transient( 'rsssl_directory_indexing_status', $status, DAY_IN_SECONDS );

try {
				$test_folder = 'indexing-test';
				$test_dir = trailingslashit(ABSPATH) . $test_folder;
				if ( ! is_dir( $test_dir ) ) {
					mkdir( $test_dir, 0755 );
				}

$response = wp_remote_get(trailingslashit( site_url($test_folder) ) );
				if ( is_dir( $test_dir )  ) {
					rmdir( $test_dir );
				}

// WP_Error doesn't contain response code, return false
				if ( !is_wp_error( $response ) ) {
					$response_code = $response['response']['code'];
					if ( $response_code === 403 ) {
						$status = 'forbidden';
					}
				}
			} catch( Exception $e ) {

}
		}
		set_transient('rsssl_directory_indexing_status', $status, DAY_IN_SECONDS );
	}

return $status !== 'forbidden';
}

/**
 * Check if file editing is allowed
 * @return bool
 */
function rsssl_file_editing_allowed()
{
	if ( function_exists('wp_is_block_theme') && wp_is_block_theme() ) {
		return false;
	}
	return !defined('DISALLOW_FILE_EDIT' ) || !DISALLOW_FILE_EDIT;
}

/**
 * Check if user registration is allowed
 * @return bool
 */
function rsssl_user_registration_allowed()
{
	return get_option( 'users_can_register' );
}

/**
 * Check if page source contains WordPress version information
 * @return bool
 */

function rsssl_src_contains_wp_version() {
	$result = get_option('rsssl_wp_version_detected' );
	if ( $result===false ) {
		$result = 'no-response';
		update_option( 'rsssl_wp_version_detected', 'no-response', false );
		try {
			$wp_version = get_bloginfo( 'version' );
			$web_source = "";
			$response = wp_remote_get( home_url() );
			if ( ! is_wp_error( $response ) ) {
				if ( is_array( $response ) ) {
					$status     = wp_remote_retrieve_response_code( $response );
					$web_source = wp_remote_retrieve_body( $response );
				}

if ( $status != 200 ) {
					$result = 'no-response';
				} elseif ( strpos( $web_source, 'ver='.$wp_version ) === false ) {
					$result = 'not-found';
				} else {
					$result = 'found';
				}
			}
			update_option( 'rsssl_wp_version_detected', $result, false );
		} catch(Exception $e) {
			update_option( 'rsssl_wp_version_detected', 'no-response', false );
		}
	}
	return $result==='found';
}

/**
 * Count the number of open hardening features
 * @return int
 */
function rsssl_count_open_hardening_features() {
	$open   = 0;
	$fields = rsssl_fields( false );

// Filter out unused fields
	$recommended_hardening_fields = array_filter($fields, function($field){
		return isset($field['recommended']) && $field['recommended'];
	});

// Create $hardening_options dynamically based on recommended field IDs
	$hardening_options = array_map(function($field) {
		return $field['id'];
	}, $recommended_hardening_fields);

foreach ( $hardening_options as $option ) {

// Get the field
		$field = array_filter( $fields, function ( $f ) use ( $option ) {
			return $f['id'] === $option;
		} );

if ( ! empty( $field ) ) {
			$field = reset( $field );
			// Apply the rsssl_disable_fields filter
			$field = apply_filters( 'rsssl_field', $field, $field['id'] );

// Check if the option is not set to true and the field is not disabled
			if ( rsssl_get_option( $option ) !== true &&
			     ( ! isset( $field['disabled'] ) || $field['disabled'] !== true ) &&
			     ( ! isset( $field['value'] ) || $field['value'] !== true ) ) {
				$open ++;
			}
		}
	}

return $open;
}

function rsssl_has_open_hardening_features() {
	return rsssl_count_open_hardening_features() > 0;
}

cmd: