§ LVgA#يمَt—dZddlZddlZddlZddlmZmZddlmZddl m Z mZmZm Z ddlmZmZddlmZddlmZmZdd lmZdd lmZeje¦«Ze¦«ZGd„de¦«Zd e de de fd„Z!efd e de de fd„Z"ed„¦«Z#de$dzde$dzfd„Z%d e de defd„Z&d e de defd„Z'dede fd„Z( d0de)de)de)dzde$dzde$dzd e$dzd!e$dzd"e$dzd#e)dzd$e)dzd%e*dzd&e+fd'„Z,d(e*e de*e fd)„Z-d*e)fd+„Z.d e de$fd,„Z/d-e$dzde)fd.„Z0de$dzfd/„Z1dS)1a0Helper functions for WordPress CVE protection incidents. WordPress incidents are stored in a dedicated wordpress_incident table with plugin-specific data stored in the extra_info JSON field. This module provides helper functions to work with WordPress incidents. Available for both AV and IM360 modes. éN)ع ExitStackعcontextmanager)ع timedelta)ع CharFieldع FloatFieldعIntegerFieldع TextField)ع JSONFieldعfn)عgeo)عModelعinstance)عapply_order_by)عOrderBycَR—eZdZdZedd¬¦«Zed¬¦«Zed¬¦«Ze d¬¦«Z ed¬¦«Zed¬¦«Zed¬¦«Z ed¬¦«Zed¬¦«Zedd¬¦«Zedd¬¦«Zed¬¦«ZGd „d ¦«ZdS)عWordpressIncidentzے WordPress incident model for CVE protection. Uses dedicated wordpress_incident table created in migration 191. Unique constraint on (abuser, name, plugin, rule, severity, domain) allows deduplication similar to the aggregate plugin. T)عprimary_keyعnull)rع country_id)rعcolumn_nameN)rعdefaultcَ$—eZdZejZdZdZdS)ْWordpressIncident.Metaعwordpress_incident)))عabuserعnameعpluginعruleعseverityعdomainTN)ع__name__ع __module__ع__qualname__rعdbعdatabaseعdb_tableعindexes©َْ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/wordpress_incident.pyعMetar8s!€€€€€ط”;ˆط'ˆً ˆˆˆr)r+)r!r"r#ع__doc__rعidrrrrع timestampعretriesrrr عdescriptionrعcountryr r ع extra_infor+r(r)r*rr"s&€€€€€ًًً ˆ $¨Tذ 2ر 2ش 2€Bط ˆYکDذ !ر !ش !€Fطˆ9ک$ذرش€Dطگ ذ%ر%ش%€Iطˆl ذ%ر%ش%€Gطˆ| ذ&ر&ش&€Hطˆ9ک$ذرش€Dطگ) ذ&ر&ش&€Kط ˆYکDذ !ر !ش !€FطˆiکT¨|ذ<ر<ش<€Gط ˆYکD¨$ذ /ر /ش /€Fطگ ذ%ر%ش%€Jً ً ً ً ً ٌ ô ً ً ً r)rع incident_dataع site_infoعreturncَ—t| d¦«¦«}t| d¦«¦«}t| d¦«¦«}id| d¦«“d| d¦«“d| d¦«“d| d¦«“d| d¦«“d | d ¦«“d | d ¦«“d| d¦«“d| d¦«“d | d¦«“d| d¦«“d| d¦«“d| d¦«“d| d¦«“d| d¦«“d| d¦«“d| d¦«“| d¦«|||| d¦«dœ¥S) aI Build extra_info dict from incident data and site information. Args: incident_data: Dict with incident fields from PHP incident file site_info: Dict with site information (domain, site_path, username, user_id) Returns: Dict with all WordPress-specific fields for extra_info JSON column عFILESع GET_NAMESع POST_NAMESعcveعmodeعtargetعslugعversionعuser_logged_inعusernameعuser_idع site_pathعrequest_methodعREQUEST_METHODعscript_filenameعSCRIPT_FILENAMEعphp_selfعPHP_SELFع path_infoع PATH_INFOعrequest_uriعREQUEST_URIعquery_stringعQUERY_STRINGعhttp_x_forwarded_forعHTTP_X_FORWARDED_FORعhttp_user_agentعHTTP_USER_AGENTعHTTP_REFERERعRAW_DATA)عhttp_refererعfilesع get_namesع post_namesعraw_data)عserialize_json_fieldعget)r3r4ع files_jsonعget_names_jsonعpost_names_jsons r*عbuild_extra_infor_AsR€ُ& m×&7ز&7¸ر&@ش&@رAشA€Jف)¨-×*;ز*;¸Kر*Hش*HرIشI€Nف*¨=×+<ز+<¸\ر+Jش+JرKشK€Oًà ˆ}× ز ر'ش'ًً گ ×!ز! &ر)ش)ًً گ-×#ز# Hر-ش-ً ً گ ×!ز! &ر)ش)ًً گ=×$ز$ Yر/ش/ً ً ک-×+ز+ذ,<ر=ش=ًً گI—M’M *ر-ش-ًً گ9—=’= ر+ش+ًً گY—]’] ;ر/ش/ًً ک-×+ز+ذ,<ر=ش=ًً ک=×,ز,ذ->ر?ش?ًً گM×%ز% jر1ش1ًً گ]×&ز& {ر3ش3ًً گ}×(ز(¨ر7ش7ً!ً" ک ×)ز)¨.ر9ش9ً#ً$ × 1ز 1ذ2Hر Iش Iً%ً& ک=×,ز,ذ->ر?ش?ً'ً(&×)ز)¨.ر9ش9àط#ط%ط!×%ز% jر1ش1ً3ًًًr)cَx—| d¦«pt|¦«}t||¦«}| d¦«p| d¦«}|tur7t ¦«5}t||¦«}ddd¦«n#1swxYwYnt||¦«}d| dd¦«t | dd ¦«¦«d t| d¦«¦«d| d d¦«›‌|||| d¦«|dœS)a± Build complete incident dict ready for database insertion. This is used for both single incident creation and bulk insertion. Args: incident_data: Dict with incident fields from PHP incident file site_info: Dict with site information (domain, site_path, username, user_id) geo_reader: An open geo Reader (or None) to resolve the abuser country. Pass one from country_reader() when building many incidents in a loop to avoid reopening the mmdb per incident. When omitted, a short-lived reader is opened for this single call. Returns: Dict with all fields ready for Incident.create() or bulk insert عmessageعREMOTE_ADDRعattacker_ipNع wordpressعrule_idعunknownعtsrér;zWordPress CVE: r:عUnknownr )rrr.r/rrr0rr1r r2)r[عbuild_message_fallbackr_ع_UNSETعcountry_readerع _country_codeعfloatعcalculate_severity)r3r4ع geo_readerrar2ع abuser_ipعreaderr1s r*عbuild_incident_dictrsnsٹ€ً&×ز ر*ش*ًص.Dطٌ/ô/€Gُ" -°ر;ش;€Jط×!ز! -ر0ش0ً°M×4Eز4Eطٌ5ô5€Iً•Vذذف ر ش ً 7 ف# F¨Iر6ش6ˆGً 7ً 7ً 7ٌ 7ô 7ً 7ً 7ً 7ً 7ً 7ً 7ًّّّ 7ً 7ً 7ً 7ُّ ¨Iر6ش6ˆًط×!ز! )¨Yر7ش7فک=×,ز,¨T°1ر5ش5ر6ش6طف& }×'8ز'8¸ر'@ش'@رAشAطG -×"3ز"3°E¸9ر"Eش"EذGذGطططط—-’- ر)ش)à ًًًsء6BآBآBc#َ4K—t¦«5} | tj¦«¦«}nB#t$r5}t d|¦«dV—Yd}~ddd¦«dSd}~wwxYw|V—ddd¦«dS#1swxYwYdS)zغYield an open geo Reader, or None when the mmdb can't be opened. Lets bulk callers open the mmap'd reader once instead of per incident, while keeping enrichment non-blocking when the geo bundle is missing. zGeoIP reader unavailable: %sN)rع enter_contextrrrع Exceptionعloggerعdebug)عstackrrعexcs r*rlrl sèè€ُ ‰Œًکً ط×(ز(¬©¬ر6ش6ˆFˆFّفً ً ً فڈLٹLذ7¸ر=ش=ذ=طˆJˆJˆJطˆFˆFˆFً ًًٌôًًًًّّّّ ًّّّˆˆˆًًًٌôًًًًًًًًًًًًًّّّs7‘B “&:¹B ؛ A9ءA4ء#B ء4A9ء9B آ BآBعipcَ¢—|پ|sdS | |¦«S#t$r'}t d||¦«Yd}~dSd}~wwxYw)NzGeoIP lookup failed for %s: %s)عget_codervrwrx)rrr{rzs r*rmrm±sj€ط €~کR€~طˆtًطڈٹکrر"ش"ذ"ّفًًًفڈٹذ5°r¸3ر?ش?ذ?طˆtˆtˆtˆtˆtًّّّّّّّsˆ‌ A§A ء AcَD—t||¦«}tjdi|¤ژS)aD Create a WordPress incident in the wordpress_incident table. Args: incident_data: Dict with incident fields from PHP incident file site_info: Dict with site information (domain, site_path, username) Returns: WordpressIncident instance with WordPress fields populated in extra_info r()rsrعcreate)r3r4ع incident_dicts r*عcreate_wordpress_incidentrپ»s*€ُ(¨ °yرAشA€Mفش#ذ4ذ4 mذ4ذ4ذ4r)cَئ—t||¦«}tjdi|¤ژ tjtjtjtjtjtj gtj tj dztj|di¬¦« t¦« ¦«}t|¦«dS)ai Insert or update a WordPress incident in the wordpress_incident table. If an incident with the same aggregate key (abuser, name, plugin, rule, severity, domain) exists, increment its retries counter and update timestamp. Otherwise, create a new incident with retries=1. This implements similar deduplication logic as the aggregate plugin. Args: incident_data: Dict with incident fields from PHP incident file site_info: Dict with site information (domain, site_path, username, user_id) Returns: WordpressIncident instance (either newly created or updated) rhr.)عconflict_targetعupdaterr()rsrعinsertعon_conflictrrrrrr r/r.ع returningعexecuteعlist)r3r4r€عresults r*عupsert_wordpress_incidentr‹جs»€ُ&(¨ °yرAشA€Mُ ش ذ1ذ1 =ذ1ذ1ك ٹه!ش(ف!ش&ف!ش(ف!ش&ف!ش*ف!ش(ً ُ"ش)ص+<ش+Dہqر+Hف!ش+¨]¸;ش-Gًً ٌ ô ÷ ٹص$ر %ش %ك ٹ‰Œً#ُ*گ‰<Œ<کŒ?ذr)عincidentc َک—|j|j|j|j|j|j|j|j|j|j |j |jdœS)zأ Convert a WordpressIncident model instance to a dictionary. Args: incident: WordpressIncident model instance Returns: Dictionary representation of the incident ©r-rrr.r/rrr0rr1r r2rژ)rŒs r*عwordpress_incident_to_dictrڈüsU€ًŒkط”/ط” طش'طش#طش%ط” طش+ط”/طش#ط”/طش)ً ً ً r)éèFعlimitعoffsetrAعby_abuser_ipعby_country_codeع by_domainعsearchعsite_searchعsinceعtoعorder_byعinclude_hiddencَ—t t¦« tjdk¦«}|sR| tj ¦«tj d¦«z¦«}|پ6| tjtj d¦«|k¦«}|پ2| tj |¦«¦«}|پ#| tj|k¦«}|پ2| tj |¦«¦«}|پ’| tj |¦«tj |¦«ztj |¦«ztj |¦«z¦«}|پ6| tjtj d¦«|k¦«}|پ6| tj d¦«|k¦«}| پ6| tj d¦«| k¦«}| پpg} | D]T}t%|t&¦«r(| t+j|¦«¦«Œ?| |¦«ŒUt/| t|¦«}n1| tj ¦«¦«}| |¦«}| |¦«}d„| ¦«D¦«S)a’ Get WordPress incidents as dictionaries. Args: limit: Maximum number of incidents to return offset: Offset for pagination user_id: Filter by user ID (None = all) by_abuser_ip: Filter by abuser IP address (None = all) by_country_code: Filter by country code (None = all) by_domain: Filter by domain (None = all) search: Search in IP address, name, description, or domain (None = all) site_search: Filter by site path in extra_info (None = all) since: Filter by timestamp >= this value (unix timestamp, None = all) to: Filter by timestamp <= this value (unix timestamp, None = all) order_by: List of fields to order by (None = default order by timestamp desc). Can be either strings (e.g., ["timestamp+", "severity-"]) or OrderBy objects. Strings are automatically converted. include_hidden: When False (default), exclude incidents whose rule has the TEST- prefix (internal probe rules that the WordPress plugin hides from its admin UI). Returns: List of incident dictionaries rdzTEST-Nz $.user_idz$.site_pathعREALcَ,—g|]}t|¦«‘ŒSr(©rڈ©ع.0عincs r*ْ z+get_wordpress_incidents..zs!€ذGذGذG°ص& sر+ش+ذGذGذGr))rعselectعwhererrعis_nullع startswithrعjson_extractr2rعcontainsr1r rr0r.عcastع isinstanceعstrعappendrع fromstringrrڑعdescr‘r’rˆ)r‘r’rAr“r”r•r–r—rکr™rڑr›عqueryعconverted_order_byعitems r*عget_wordpress_incidentsr³s€ُL ×$ز$ص%6ر7ش7×=ز=ف ش ! [ز 0ٌ ô €Eًً ط—’فش"×*ز*ر,ش,ف ش%×0ز0°ر9ش9ذ9ٌ :ٌ ô ˆً ذط—’فŒOص-ش8¸+رFشFطٍ ٌ ô ˆً ذط—’ص-ش4×=ز=¸lرKشKرLشLˆàذ"ط—’ص-ش5¸زHرIشIˆàذط—’ص-ش4×=ز=¸iرHشHرIشIˆà ذط—’فش"×+ز+¨Fر3ش3فش+×4ز4°Vر<ش<ٌ =هش&×/ز/°ر7ش7ٌ 8ُ ش&×/ز/°ر7ش7ٌ 8ٌ ô ˆًذط—’فŒOص-ش8¸-رHشHطٍ ٌ ô ˆً ذط—’ص-ش7×<ز<¸VرDشDبزMرNشNˆà €~ط—’ص-ش7×<ز<¸VرDشDبزJرKشKˆًذàذطً 0ً 0ˆDفک$¥ر$ش$ً 0ط"×)ز)'ش*<¸Tر*Bش*BرCشCذCذCà"×)ز)¨$ر/ش/ذ/ذ/فذ1ص3DہeرLشLˆˆً—’ص0ش:×?ز?رAشAرBشBˆàڈKٹKکرش€EطڈLٹLکر ش €EàGذG°u·}²}±´ذGرGشGذGr)عincidents_datacَھ—|sgSt |¦« t¦« ¦«}d„|D¦«S)zش Bulk create WordPress incidents in a single transaction. Args: incidents_data: List of dictionaries containing incident field data Returns: List of created incident dictionaries cَ,—g|]}t|¦«‘ŒSr(rںr s r*r£z3bulk_create_wordpress_incidents..’s!€ذ>ذ>ذ>°ص& sر+ش+ذ>ذ>ذ>r))rعinsert_manyr‡rˆ)r´rٹs r*عbulk_create_wordpress_incidentsr¸}sV€ًًطˆ ُ ×%ز% nر5ش5ك ٹص$ر %ش %ك ٹ‰Œًً?ذ>°vذ>ر>ش>ذ>r)عdayscَR—tj¦«t|¬¦« ¦«z }t ¦« tjdktj d¦«|kz¦« ¦«}|S)N)r¹rdr‌) عtimerع total_secondsrعdeleter¥rr.rھrˆ)r¹عcutoff_timeعdeleteds r*عdelete_old_wordpress_incidentsrہ•sˆ€ف”)‘+”+¥ ¨tذ 4ر 4ش 4× Bز Bر Dش DرD€Kه× ز ر"ش"ك ٹف ش %¨ز 4ف ش*×/ز/°ر7ش7¸+زEٌ Gٌ ô ÷ ٹ‰Œً ً€Nr)cَ—dg}| d¦«r| |d¦«| d¦«r| |d¦«| d¦«r| |d¦«| d¦«r| |d¦«| d¦«r| |d¦«d |¦«S)z=Build message if plugin didn't provide one (per spec format).z IM WP plugin:rer:r=r>r;ْ )r[rعjoin)r3عpartss r*rjrj¢sû€à ذ€Eà×زکر#ش#ً/ط ڈٹگ] 9ش-ر.ش.ذ.ط×زکرشً+ط ڈٹگ] 5ش)ر*ش*ذ*ط×زکر ش ً,ط ڈٹگ] 6ش*ر+ش+ذ+ط×زکر#ش#ً/ط ڈٹگ] 9ش-ر.ش.ذ.ط×زکر ش ً,ط ڈٹگ] 6ش*ر+ش+ذ+àڈ8ٹ8گE‰?Œ?ذr)r;cَ&—|dkrdS|dkrdSdS)z!Calculate severity based on mode.عblockéعpassér()r;s r*roro´s#€àˆw‚€طˆqط گٹˆطˆqàˆqr)cَ`—|€dSt|t¦«r|Stj|¦«S)z>Serialize a value to JSON string if it's not already a string.N)r«r¬عjsonعdumps)عvalues r*rZrZ¾s3€à€}طˆtفگ%‌رشًطˆفŒ:گeرشذr))rگrNNNNNNNNNF)2r,عloggingr»rثع contextlibrrعdatetimerعpeeweerrrr عplayhouse.sqlite_extr rعdefence360agent.internalsrعdefence360agent.modelr rع$defence360agent.model.simplificationrع"defence360agent.rpc_tools.validaterع getLoggerr!rwعobjectrkrعdictr_rsrlr¬rmrپr‹rڈعintr‰عboolr³r¸rہrjrorZr(r)r*ْrـsًًًً€€€ط€€€ط€€€ط0ذ0ذ0ذ0ذ0ذ0ذ0ذ0طذذذذذًًًًًًًًًًًًً/ذ.ذ.ذ.ذ.ذ.ذ.ذ.ط)ذ)ذ)ذ)ذ)ذ)ط1ذ1ذ1ذ1ذ1ذ1ذ1ذ1ط?ذ?ذ?ذ?ذ?ذ?ط6ذ6ذ6ذ6ذ6ذ6à ˆش ک8ر $ش $€à ˆ‰Œ€ً ً ً ً ً کٌ ô ً ً>* Dً*°Tً*¸dً*ً*ً*ً*ً\6<ً/ً/طً/ط$(ً/à ً/ً/ً/ً/ًdً ً ٌ„ً ً کc D™jً¨S°4©Zًًًًً5طً5ط$(ً5àً5ً5ً5ً5ً"-طً-ط$(ً-àً-ً-ً-ً-ً`ذ):ً¸tًًًًً6ططط#ط"&ط طط"ططط ط ًdHًdHطًdHàًdHًگ4‰ZًdHًک‘*ً dHً ک4‘ZًdHًگT‰zً dHً گ$‰JًdHًگt‘ًdHًگ‰:ًdHً ˆd‰ ًdHًگT‰kًdHًًdHًdHًdHًdHًN?طک”Jً?à ˆ$„Zً?ً?ً?ً?ً0 ¨ً ً ً ً ً¨$ً°3ًًًًً$کS 4™Zً¨Cًًًًً 3¨،:ًًًًًًr)