New. DBTriggerScan.

inc/spbc-settings.php

@@ -10,6 +10,7 @@
 use CleantalkSP\SpbctWP\LinkConstructor;
 use CleantalkSP\SpbctWP\ListTable;
 use CleantalkSP\SpbctWP\Scanner;
+use CleantalkSP\SpbctWP\Scanner\DBTrigger\DBTriggerView;
 use CleantalkSP\SpbctWP\Scanner\OSCron\Storages\OsCronTasksStorage;
 use CleantalkSP\SpbctWP\Scanner\OSCron\View\OSCronView;
 use CleantalkSP\SpbctWP\Scanner\ScanningLog\ScanningLogFacade;
@@ -18,6 +19,7 @@
 use CleantalkSP\SpbctWP\VulnerabilityAlarm\VulnerabilityAlarmView;
 use CleantalkSP\Variables\Post;
 use CleantalkSP\Variables\Server;
+use CleantalkSP\SpbctWP\Scanner\DBTrigger\DBTriggerService;
 
 // Scanner AJAX actions
 require_once(SPBC_PLUGIN_DIR . 'inc/spbc-scanner.php');
@@ -689,6 +691,12 @@ function spbc_settings__register()
                                 'description'      => Scanner\OSCron\View\OSCronLocale::getInstance()->settings__option_description,
                                 'long_description' => false,
                             ),
+                            'scanner__db_trigger_analysis'                    => array(
+                                'type'             => 'field',
+                                'title'            => __('DB Trigger analysis', 'security-malware-firewall'),
+                                'description'      => __('Will search for known malicious signatures in database triggers.', 'security-malware-firewall'),
+                                'long_description' => false,
+                            ),
                             'scanner__dir_exclusions_view'                        => array(
                                 'type'        => 'field',
                                 'input_type'  => 'textarea',
@@ -1350,7 +1358,7 @@ function spbc_settings__draw_elements($elems_to_draw = null, $direct_call = fals
                 echo '</div>';
                 break;
             case 'section_banner':
-                spbc_settings__create_notice_on_tab('found_critical_files');
+                spbc_settings__create_notice_on_tab();
                 break;
             case 'field':
                 call_user_func($elem['callback'], $elem);
@@ -2607,52 +2615,49 @@ function spbc_field_traffic_control_logs__prepare_data(&$table)
 
 /**
  * Creates a banner with a notification
- * @param string $flag_text_banner which banner text to show
  * @return void
  */
-function spbc_settings__create_notice_on_tab($flag_text_banner)
+function spbc_settings__create_notice_on_tab()
 {
     global $spbc;
 
-    switch ($flag_text_banner) {
-        case 'found_critical_files': // Creates a banner with a notification if important files are found and if the banner has not already been closed
-            if ($spbc->data['display_scanner_warnings']['critical'] > 0 &&
-                Cookie::getString('spbct_notice-found_critical_files') != '1') {
-                $email = spbc_get_admin_email();
-                $website = get_home_url();
-                $text = __("There's a high probability that your website has been compromised, as critical files show signs of infection. Take action now by ordering malware removal from our experienced security specialists.", 'security-malware-firewall');
-                //generate button
-                $landing_page_link = LinkConstructor::buildCleanTalkLink(
-                    'banner_link_for_treatment',
-                    'website-malware-removal',
-                    array(
-                        'email' => esc_attr($email),
-                        'website' => esc_attr($website),
-                    ),
-                    $domain = 'https://l.cleantalk.org'
-                );
-                $button_text = __('Request Malware removal', 'security-malware-firewall');
-                $button_div = '<div style="align-content: center;margin: 0 30px;">';
-                $button_div .= '
-                    <a class="spbc_manual_link" target="_blank" href="' . $landing_page_link . '">'
-                    . '<i class="spbc-icon-link-ext"></i>&nbsp;&nbsp;'
-                    . $button_text
-                    . '</a>
-                    ';
-                $button_div .= '</div>';
-                $text .= $button_div;
-            } else {
-                return;
-            }
+    $flag_text_banner = '';
 
-            break;
+    if ($spbc->data['display_scanner_warnings']['critical'] > 0 &&
+        Cookie::getString('spbct_notice-found_critical_files') != '1') {
+        $flag_text_banner = 'found_critical_files';
+        $text = __("There's a high probability that your website has been compromised, as critical files show signs of infection. Take action now by ordering malware removal from our experienced security specialists.", 'security-malware-firewall');
+    }
 
-        default:
-            $text = false;
-            break;
+    if ( $spbc->data['display_scanner_warnings']['db_triggers'] > 0 &&
+         Cookie::getString('spbct_notice-found_db_triggers') != '1') {
+        $flag_text_banner = 'found_db_triggers';
+        $text = DBTriggerView::getWarningTextForMalwareRemovalBanner();
     }
 
-    if ($text != false) {
+    if (!empty($text)) {
+        $email = spbc_get_admin_email();
+        $website = get_home_url();
+        $button_text = __('Request Malware removal', 'security-malware-firewall');
+        $landing_page_link = LinkConstructor::buildCleanTalkLink(
+            'banner_link_for_treatment',
+            'website-malware-removal',
+            array(
+                'email' => esc_attr($email),
+                'website' => esc_attr($website),
+            ),
+            $domain = 'https://l.cleantalk.org'
+        );
+        $button_div = '<div style="align-content: center;margin: 0 30px;">';
+        $button_div .= '
+                    <a class="spbc_manual_link" target="_blank" href="' . $landing_page_link . '">'
+                       . '<i class="spbc-icon-link-ext"></i>&nbsp;&nbsp;'
+                       . $button_text
+                       . '</a>
+                    ';
+        $button_div .= '</div>';
+        $text .= $button_div;
+
         $template = '
             <div class="spbc_tab_fields_group">
                 <div class="spbc_group_header"></div>
@@ -2665,8 +2670,6 @@ function spbc_settings__create_notice_on_tab($flag_text_banner)
             </div>
         ';
         printf($template, $flag_text_banner, $flag_text_banner, $text);
-    } else {
-        return;
     }
 }
 
@@ -3090,6 +3093,33 @@ function spbc_scanner_oscron_prepare_data(&$table)
     $table = OSCronView::prepareTableData($table);
 }
 
+/**
+ * Settings function wrapper. Get count found in db trigger.
+ * @return int
+ */
+function spbc_scanner_db_trigger_count_found()
+{
+    return DBTriggerService::countTriggersStorage();
+}
+
+/**
+ * Settings function wrapper. Get data for db trigger.
+ * @return array
+ */
+function spbc_scanner_db_trigger_get_scanned()
+{
+    return DBTriggerService::loadTriggersStorage();
+}
+
+/**
+ * Settings function wrapper. Modify data in triggers table.
+ * @param $table
+ */
+function spbc_scanner_db_trigger_prepare_data(&$table)
+{
+    $table = DBTriggerView::prepareTableData($table);
+}
+
 function spbc_field_scanner__prepare_data__files_quarantine(&$table)
 {
     global $spbc;
@@ -3437,6 +3467,10 @@ function spbc_field_scanner()
         echo '<span class="spbc_overall_scan_status_os_cron_analysis">' . __('OS Cron Analysis', 'security-malware-firewall') . '</span> -> ';
     }
 
+    if ($spbc->settings['scanner__db_trigger_analysis']) {
+        echo '<span class="spbc_overall_scan_status_db_trigger_analysis">' . __('DB Trigger Analysis', 'security-malware-firewall') . '</span> -> ';
+    }
+
     echo
         '<span class="spbc_overall_scan_status_get_denied_hashes">' . __('Updating statuses for the denied files', 'security-malware-firewall') . '</span> -> '
         . '<span class="spbc_overall_scan_status_get_approved_hashes">' . __('Updating statuses for the approved files', 'security-malware-firewall') . '</span> -> ';
@@ -3678,6 +3712,7 @@ function spbc_field_scanner__show_accordion($direct_call = false)
         'quarantined'  => __('Punished files.', 'security-malware-firewall'),
         'analysis_log' => $analysis_log_description,
         'cure_log'     => $cure_log_description,
+        'db_trigger'   => DBTriggerView::getScannerTabDescription(),
         'skipped'     => __('List of files that were not checked by the scanner.', 'security-malware-firewall'),
     );
 
@@ -3750,6 +3785,13 @@ function spbc_field_scanner__show_accordion($direct_call = false)
             ),
             'display' => (bool) $spbc->settings['scanner__os_cron_analysis']
         ),
+        'db_trigger_analysis' => array(
+            'category_description' => __('DB Trigger Analysis', 'security-malware-firewall'),
+            'types' => array(
+                'db_trigger',
+            ),
+            'display' => (bool) $spbc->settings['scanner__db_trigger_analysis']
+        ),
         'pages' => array(
             'category_description' => __('Pages scan results', 'security-malware-firewall'),
             'types' => array(
@@ -3793,6 +3835,7 @@ function spbc_field_scanner__show_accordion($direct_call = false)
                 || ($type_name === 'frontend_malware' && $spbc->data['display_scanner_warnings']['frontend'])
                 || ($type_name === 'analysis_log' && $spbc->data['display_scanner_warnings']['analysis'])
                 || ($type_name === 'oscron' && $spbc->data['display_scanner_warnings']['oscron'])
+                || ($type_name === 'db_trigger' && $spbc->data['display_scanner_warnings']['db_triggers'])
             ) {
                 $danger_dot = '<span class="red_dot"></span>';
             }
@@ -4243,6 +4286,30 @@ function spbc_list_table__get_args_by_type($table_type)
             );
             break;
 
+        case 'db_trigger':
+            $args = array(
+                'func_data_total'   => 'spbc_scanner_db_trigger_count_found',
+                'func_data_get'     => 'spbc_scanner_db_trigger_get_scanned',
+                'func_data_prepare' => 'spbc_scanner_db_trigger_prepare_data',
+                'if_empty_items'    => '<div class="notice notice-info spbc-icon-info" style="padding: 10px; margin: 10px 0px;">'
+                                       . __('DB Trigger not found in the server environment or is unavailable to read/write.', 'security-malware-firewall')
+                                       . '</div>',
+                'columns'           => array(
+                    'cb'         => array('heading' => '<input type=checkbox>', 'class' => 'check-column',  'width_percent' => 2),
+                    'about_trigger'   => array( 'heading' => 'About trigger', 'width_percent' => 30 ), // name, table, time, action
+                    'code'            => array( 'heading' => 'Code', 'width_percent' => 43 ),
+                    'signature'       => array( 'heading' => 'Signature', 'width_percent' => 10 ),
+                    'analysis_status' => array( 'heading' => 'Verdict', 'width_percent' => 15 ),
+                ),
+                'actions'           => array(
+                    'delete'   => array('name' => 'Delete',),
+                ),
+                'bulk_actions'      => array(
+                    'delete'  => array('name' => 'Delete',),
+                ),
+            );
+            break;
+
         case 'approved':
             $args = array_replace_recursive(
                 $accordion_default_args,

js/src/spbc-scanner-plugin.js

@@ -23,6 +23,7 @@ class SpbcMalwareScanner {/* eslint-disable-line no-unused-vars */
         'auto_cure_backup',
         'auto_cure',
         'os_cron_analysis',
+        'db_trigger_analysis',
         'outbound_links',
         'frontend_analysis',
         'important_files_listing',

lib/CleantalkSP/SpbctWP/ListTable.php

@@ -3,6 +3,7 @@
 namespace CleantalkSP\SpbctWP;
 
 use CleantalkSP\SpbctWP\Scanner\Cure;
+use CleantalkSP\SpbctWP\Scanner\DBTrigger\DBTriggerService;
 use CleantalkSP\SpbctWP\Scanner\OSCron\OSCronController;
 use CleantalkSP\SpbctWP\Scanner\OSCron\View\OSCronLocale;
 use CleantalkSP\Variables\Post;
@@ -652,7 +653,10 @@ public static function ajaxRowActionHandler()
         $action = Post::getString('add_action');
         $is_frontend_malware_action = $action === 'disapprove_page' || $action === 'approve_page';
 
-        if ( $action !== 'restore' && ! $is_frontend_malware_action && strpos($action, 'oscron_task') === false ) {
+        if ( $action !== 'restore' && ! $is_frontend_malware_action &&
+            strpos($action, 'oscron_task') === false &&
+            strpos($action, 'delete-trigger') === false
+        ) {
             $check_file_exist_result = self::spbcCheckFileExist();
 
             if (isset($check_file_exist_result['error'])) {
@@ -713,6 +717,9 @@ public static function ajaxRowActionHandler()
                 case 'enable_oscron_task':
                     self::ajaxRowActionHandlerApproveOSCronTask();
                     break;
+                case 'delete-trigger':
+                    self::ajaxRowActionHandlerDeleteTrigger();
+                    break;
                 default:
                     wp_send_json(array('temp_html' => '<div class="spbc-popup-msg popup--red">UNKNOWN ACTION</div>'));
             }
@@ -740,6 +747,22 @@ public static function ajaxRowActionHandlerApproveOSCronTask()
         }
     }
 
+    public static function ajaxRowActionHandlerDeleteTrigger()
+    {
+        global $spbc;
+        $result = DBTriggerService::deleteTrigger(Post::get('id', null, 'word'));
+        if ($result) {
+            $out = array(
+                'html' => '<div class="spbc-popup-msg popup--red">'
+                    . __('Trigger has been deleted.', 'security-malware-firewall')
+                    . '</div>',
+            );
+            wp_send_json($out);
+        } else {
+            wp_send_json_error(esc_html((string)$result));
+        }
+    }
+
     public static function ajaxRowActionHandlerDisableOSCronTask()
     {
         global $spbc;