v1.0.0
This commit is contained in:
parent
3291a5f7d2
commit
212d64abfa
27 changed files with 8654 additions and 2 deletions
410
includes/class-audit-log.php
Normal file
410
includes/class-audit-log.php
Normal file
|
|
@ -0,0 +1,410 @@
|
|||
<?php
|
||||
/**
|
||||
* Audit log class
|
||||
*
|
||||
* @package TwoFactorExtended
|
||||
* @since 0.1.0
|
||||
*/
|
||||
|
||||
// Prevent direct access.
|
||||
if ( ! defined( 'ABSPATH' ) ) {
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Class Two_Factor_Extended_Audit_Log
|
||||
*
|
||||
* Logs 2FA configuration changes and enforcement actions.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*/
|
||||
class Two_Factor_Extended_Audit_Log {
|
||||
|
||||
/**
|
||||
* Option key for audit logs.
|
||||
*
|
||||
* @since 0.1.0
|
||||
* @var string
|
||||
*/
|
||||
const OPTION_KEY = 'two_factor_extended_audit_logs';
|
||||
|
||||
/**
|
||||
* Maximum number of logs to keep.
|
||||
*
|
||||
* @since 0.1.0
|
||||
* @var int
|
||||
*/
|
||||
const MAX_LOGS = 1000;
|
||||
|
||||
/**
|
||||
* Log retention period in days.
|
||||
*
|
||||
* @since 0.1.0
|
||||
* @var int
|
||||
*/
|
||||
const RETENTION_DAYS = 90;
|
||||
|
||||
/**
|
||||
* Constructor.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*/
|
||||
public function __construct() {
|
||||
$this->init_hooks();
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize WordPress hooks.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*/
|
||||
private function init_hooks(): void {
|
||||
// Log 2FA configuration changes.
|
||||
add_action( 'two_factor_user_options_update', array( $this, 'log_user_2fa_change' ), 10, 1 );
|
||||
|
||||
// Log settings changes.
|
||||
add_action( 'update_option_' . TWO_FACTOR_EXTENDED_OPTION_SETTINGS, array( $this, 'log_settings_change' ), 10, 2 );
|
||||
|
||||
// Log enforcement actions.
|
||||
add_action( 'wp_login_failed', array( $this, 'log_login_failure' ), 10, 1 );
|
||||
|
||||
// Daily cleanup of old logs.
|
||||
add_action( 'two_factor_extended_daily_cleanup', array( $this, 'cleanup_old_logs' ) );
|
||||
}
|
||||
|
||||
/**
|
||||
* Log an event.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param string $action Action type.
|
||||
* @param string $description Event description.
|
||||
* @param int $user_id User ID (optional).
|
||||
* @param array $metadata Additional metadata (optional).
|
||||
*/
|
||||
public function log_event( string $action, string $description, int $user_id = 0, array $metadata = array() ): void {
|
||||
$logs = $this->get_logs();
|
||||
|
||||
$log_entry = array(
|
||||
'timestamp' => current_time( 'timestamp' ),
|
||||
'action' => sanitize_key( $action ),
|
||||
'description' => sanitize_text_field( $description ),
|
||||
'user_id' => $user_id,
|
||||
'actor_id' => get_current_user_id(),
|
||||
'ip_address' => $this->get_client_ip(),
|
||||
'metadata' => $metadata,
|
||||
);
|
||||
|
||||
// Add to beginning of array.
|
||||
array_unshift( $logs, $log_entry );
|
||||
|
||||
// Trim to max logs.
|
||||
if ( count( $logs ) > self::MAX_LOGS ) {
|
||||
$logs = array_slice( $logs, 0, self::MAX_LOGS );
|
||||
}
|
||||
|
||||
update_option( self::OPTION_KEY, $logs, false );
|
||||
}
|
||||
|
||||
/**
|
||||
* Log user 2FA configuration change.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param int $user_id User ID.
|
||||
*/
|
||||
public function log_user_2fa_change( int $user_id ): void {
|
||||
$user = get_userdata( $user_id );
|
||||
|
||||
if ( ! $user ) {
|
||||
return;
|
||||
}
|
||||
|
||||
$providers = Two_Factor_Extended_Provider_Detector::get_user_enabled_providers( $user_id );
|
||||
$provider_names = array();
|
||||
|
||||
foreach ( array_keys( $providers ) as $class ) {
|
||||
$names = Two_Factor_Extended_Provider_Detector::get_provider_names();
|
||||
$provider_names[] = $names[ $class ] ?? $class;
|
||||
}
|
||||
|
||||
$this->log_event(
|
||||
'2fa_config_changed',
|
||||
sprintf(
|
||||
'User %s changed 2FA configuration',
|
||||
$user->user_login
|
||||
),
|
||||
$user_id,
|
||||
array(
|
||||
'enabled_providers' => $provider_names,
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Log plugin settings change.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param mixed $old_value Old settings value.
|
||||
* @param mixed $new_value New settings value.
|
||||
*/
|
||||
public function log_settings_change( $old_value, $new_value ): void {
|
||||
$this->log_event(
|
||||
'settings_changed',
|
||||
'Plugin settings were updated',
|
||||
0,
|
||||
array(
|
||||
'changed_keys' => $this->get_changed_keys( $old_value, $new_value ),
|
||||
)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Log login failure related to 2FA requirements.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param string $username Username.
|
||||
*/
|
||||
public function log_login_failure( string $username ): void {
|
||||
$user = get_user_by( 'login', $username );
|
||||
|
||||
if ( ! $user ) {
|
||||
return;
|
||||
}
|
||||
|
||||
// Check if failure was due to 2FA requirements.
|
||||
$enforcement = two_factor_extended()->get_enforcement();
|
||||
$required = $enforcement->get_required_providers_for_user( $user->ID );
|
||||
|
||||
if ( ! empty( $required ) && ! $enforcement->user_meets_requirements( $user->ID, $required ) ) {
|
||||
$this->log_event(
|
||||
'login_blocked',
|
||||
sprintf(
|
||||
'Login blocked for user %s due to missing 2FA requirements',
|
||||
$username
|
||||
),
|
||||
$user->ID,
|
||||
array(
|
||||
'required_providers' => $required,
|
||||
)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all audit logs.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param array $filters Optional filters (action, user_id, date_from, date_to).
|
||||
*
|
||||
* @return array Array of log entries.
|
||||
*/
|
||||
public function get_logs( array $filters = array() ): array {
|
||||
$logs = get_option( self::OPTION_KEY, array() );
|
||||
|
||||
if ( ! is_array( $logs ) ) {
|
||||
return array();
|
||||
}
|
||||
|
||||
// Apply filters.
|
||||
if ( ! empty( $filters ) ) {
|
||||
$logs = $this->filter_logs( $logs, $filters );
|
||||
}
|
||||
|
||||
return $logs;
|
||||
}
|
||||
|
||||
/**
|
||||
* Filter logs based on criteria.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param array $logs Log entries.
|
||||
* @param array $filters Filter criteria.
|
||||
*
|
||||
* @return array Filtered logs.
|
||||
*/
|
||||
private function filter_logs( array $logs, array $filters ): array {
|
||||
return array_filter(
|
||||
$logs,
|
||||
function ( $log ) use ( $filters ) {
|
||||
// Filter by action.
|
||||
if ( ! empty( $filters['action'] ) && $log['action'] !== $filters['action'] ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Filter by user_id.
|
||||
if ( ! empty( $filters['user_id'] ) && $log['user_id'] !== (int) $filters['user_id'] ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Filter by date range.
|
||||
if ( ! empty( $filters['date_from'] ) && $log['timestamp'] < strtotime( $filters['date_from'] ) ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if ( ! empty( $filters['date_to'] ) && $log['timestamp'] > strtotime( $filters['date_to'] ) ) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear all logs.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @return bool True on success.
|
||||
*/
|
||||
public function clear_logs(): bool {
|
||||
return delete_option( self::OPTION_KEY );
|
||||
}
|
||||
|
||||
/**
|
||||
* Cleanup old logs based on retention period.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*/
|
||||
public function cleanup_old_logs(): void {
|
||||
$logs = $this->get_logs();
|
||||
$cutoff_time = current_time( 'timestamp' ) - ( self::RETENTION_DAYS * DAY_IN_SECONDS );
|
||||
|
||||
$filtered_logs = array_filter(
|
||||
$logs,
|
||||
function ( $log ) use ( $cutoff_time ) {
|
||||
return $log['timestamp'] >= $cutoff_time;
|
||||
}
|
||||
);
|
||||
|
||||
update_option( self::OPTION_KEY, array_values( $filtered_logs ), false );
|
||||
}
|
||||
|
||||
/**
|
||||
* Export logs to CSV.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param array $filters Optional filters.
|
||||
*
|
||||
* @return string CSV content.
|
||||
*/
|
||||
public function export_to_csv( array $filters = array() ): string {
|
||||
$logs = $this->get_logs( $filters );
|
||||
|
||||
$csv = array();
|
||||
$csv[] = array( 'Timestamp', 'Action', 'Description', 'User', 'Actor', 'IP Address' );
|
||||
|
||||
foreach ( $logs as $log ) {
|
||||
$user = $log['user_id'] ? get_userdata( $log['user_id'] ) : null;
|
||||
$actor = $log['actor_id'] ? get_userdata( $log['actor_id'] ) : null;
|
||||
|
||||
$csv[] = array(
|
||||
gmdate( 'Y-m-d H:i:s', $log['timestamp'] ),
|
||||
$log['action'],
|
||||
$log['description'],
|
||||
$user ? $user->user_login : '-',
|
||||
$actor ? $actor->user_login : 'System',
|
||||
$log['ip_address'],
|
||||
);
|
||||
}
|
||||
|
||||
// Convert to CSV string.
|
||||
ob_start();
|
||||
$handle = fopen( 'php://output', 'w' );
|
||||
|
||||
foreach ( $csv as $row ) {
|
||||
fputcsv( $handle, $row );
|
||||
}
|
||||
|
||||
fclose( $handle ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Simple CSV export
|
||||
|
||||
return ob_get_clean();
|
||||
}
|
||||
|
||||
/**
|
||||
* Get client IP address.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @return string IP address.
|
||||
*/
|
||||
private function get_client_ip(): string {
|
||||
$ip = '';
|
||||
|
||||
if ( ! empty( $_SERVER['HTTP_CLIENT_IP'] ) ) {
|
||||
$ip = sanitize_text_field( wp_unslash( $_SERVER['HTTP_CLIENT_IP'] ) );
|
||||
} elseif ( ! empty( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
|
||||
$ip = sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FORWARDED_FOR'] ) );
|
||||
} elseif ( ! empty( $_SERVER['REMOTE_ADDR'] ) ) {
|
||||
$ip = sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
|
||||
}
|
||||
|
||||
return filter_var( $ip, FILTER_VALIDATE_IP ) ? $ip : '';
|
||||
}
|
||||
|
||||
/**
|
||||
* Get changed keys between old and new settings.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @param mixed $old_value Old value.
|
||||
* @param mixed $new_value New value.
|
||||
*
|
||||
* @return array Changed keys.
|
||||
*/
|
||||
private function get_changed_keys( $old_value, $new_value ): array {
|
||||
if ( ! is_array( $old_value ) || ! is_array( $new_value ) ) {
|
||||
return array();
|
||||
}
|
||||
|
||||
$changed = array();
|
||||
|
||||
foreach ( $new_value as $key => $value ) {
|
||||
if ( ! isset( $old_value[ $key ] ) || $old_value[ $key ] !== $value ) {
|
||||
$changed[] = $key;
|
||||
}
|
||||
}
|
||||
|
||||
return $changed;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get log statistics.
|
||||
*
|
||||
* @since 0.1.0
|
||||
*
|
||||
* @return array Statistics.
|
||||
*/
|
||||
public function get_statistics(): array {
|
||||
$logs = $this->get_logs();
|
||||
|
||||
$stats = array(
|
||||
'total' => count( $logs ),
|
||||
'by_action' => array(),
|
||||
'recent_count' => 0,
|
||||
);
|
||||
|
||||
$recent_cutoff = current_time( 'timestamp' ) - ( 7 * DAY_IN_SECONDS );
|
||||
|
||||
foreach ( $logs as $log ) {
|
||||
// Count by action.
|
||||
if ( ! isset( $stats['by_action'][ $log['action'] ] ) ) {
|
||||
$stats['by_action'][ $log['action'] ] = 0;
|
||||
}
|
||||
$stats['by_action'][ $log['action'] ]++;
|
||||
|
||||
// Count recent logs (last 7 days).
|
||||
if ( $log['timestamp'] >= $recent_cutoff ) {
|
||||
$stats['recent_count']++;
|
||||
}
|
||||
}
|
||||
|
||||
return $stats;
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue