JezK

Edit File: class-letsencrypt-handler.php

<?php defined('ABSPATH') or die("you do not have access to this page!"); require_once rsssl_le_path . 'vendor/autoload.php'; require_once rsssl_path . 'lib/admin/class-encryption.php'; use RSSSL\lib\admin\Encryption; use LE_ACME2\Account; use LE_ACME2\Authorizer\AbstractDNSWriter; use LE_ACME2\Authorizer\DNS; use LE_ACME2\Authorizer\HTTP; use LE_ACME2\Connector\Connector; use LE_ACME2\Order; use LE_ACME2\Utilities\Certificate; use LE_ACME2\Utilities\Logger; use RSSSL\Security\RSSSL_Htaccess_File_Manager; class rsssl_letsencrypt_handler { use Encryption; private static $_this; /** * Account object * @var bool|LE_ACME2\Account */ public $account = false; public $challenge_directory = false; public $key_directory = false; public $certs_directory = false; public $subjects = array(); public $htaccess_file_manager; public function __construct() { if ( isset( self::$_this ) ) { wp_die(); } $this->htaccess_file_manager = Rsssl_Htaccess_File_Manager::get_instance(); add_action('admin_init', array($this, 'upgrade')); //loading of these hooks is stricter. The class can be used in the notices, which are needed on the generic dashboard //These functionality is not needed on the dashboard, so should only be loaded in strict circumstances if ( rsssl_letsencrypt_generation_allowed( true ) ) { add_action( 'rsssl_after_save_field', array( $this, 'after_save_field' ), 10, 4 ); add_action( 'admin_init', array( $this, 'maybe_queue_root_htaccess_acme_exclusion_update' ) ); add_action( 'admin_init', array( $this, 'maybe_queue_letsencrypt_directory_htaccess_files' ) ); add_filter( 'rsssl_htaccess_security_rules', array( $this, 'add_root_htaccess_acme_exclusion_rule' ) ); $this->key_directory = $this->key_directory(); $this->challenge_directory = $this->challenge_directory(); $this->certs_directory = $this->certs_directory(); // Config the desired paths if ( $this->key_directory ) { Account::setCommonKeyDirectoryPath( $this->key_directory ); } if ( $this->challenge_directory ) { HTTP::setDirectoryPath( $this->challenge_directory ); } // General configs //$use_staging = defined('RSSSL_LE_DEBUG'); Connector::getInstance()->useStagingServer( false ); Logger::getInstance()->setDesiredLevel( Logger::LEVEL_DISABLED ); if ( !rsssl_get_option( 'disable_ocsp' ) ) { Certificate::enableFeatureOCSPMustStaple(); } Order::setPreferredChain('ISRG Root X1'); $this->subjects = $this->get_subjects(); } self::$_this = $this; } /** * Queue a root `.htaccess` refresh when the ACME HTTP-01 bypass block is missing or stale. * * This method only schedules the centralized root writer. It does not modify the root file directly. * The actual ACME block is emitted through the shared root rule filter and committed together with the * rest of the desired root marker set in the single atomic root write. */ public function maybe_queue_root_htaccess_acme_exclusion_update(): void { if ( ! rsssl_user_can_manage() ) { return; } if ( ! function_exists( 'rsssl_schedule_htaccess_update' ) ) { return; } if ( ! $this->should_include_root_htaccess_acme_exclusion_rule() ) { return; } $htaccess_file = $this->htaccess_file_manager->determineExistingRootHtaccessFilePath(); if ( ! $this->htaccess_file_manager->is_valid_htaccess_file_path( $htaccess_file ) ) { return; } // Normalize per line so indentation differences do not keep re-queueing the same marker block. $current_lines = array_map( 'trim', $this->htaccess_file_manager->get_rule_lines_for_path( $htaccess_file, 'Really Simple Security LETS ENCRYPT' ) ); $expected_lines = array_map( 'trim', $this->get_root_htaccess_acme_exclusion_rule_lines() ); if ( $current_lines === $expected_lines ) { return; } // Queue the shared root writer so ACME exclusions use the same lock/commit path as other root updates. rsssl_schedule_htaccess_update(); } /** * Add the root-level ACME bypass block through the shared `.htaccess` rule filter. * HTTP-01 validation must reach `/.well-known/` before the plugin's broader root rewrites or protections run. */ public function add_root_htaccess_acme_exclusion_rule( array $rules ): array { if ( ! $this->should_include_root_htaccess_acme_exclusion_rule() ) { return $rules; } $rules[] = [ 'identifier' => 'Really Simple Security LETS ENCRYPT', 'rules' => implode( "\n", $this->get_root_htaccess_acme_exclusion_rule_lines() ), ]; return $rules; } /** * Only emit the ACME bypass block when the installation uses a real root `.htaccess` target. */ private function should_include_root_htaccess_acme_exclusion_rule(): bool { if ( ! RSSSL()->server->uses_htaccess() ) { return false; } return $this->htaccess_file_manager->determineExistingRootHtaccessFilePath() !== ''; } /** * Return the literal ACME bypass lines that the shared root writer should own. */ private function get_root_htaccess_acme_exclusion_rule_lines(): array { return [ 'RewriteRule ^.well-known/(.*)$ - [L]', ]; } /** * Check if we have an installation failed state. * @return bool */ public function installation_failed(){ $installation_active = get_option("rsssl_le_start_installation"); $installation_failed = get_option("rsssl_installation_error"); return $installation_active && $installation_failed; } /** * Cleanup. If user did not consent to storage, all password fields should be removed on activation, unless they're needed for renewals * * @return bool */ public function cleanup_on_ssl_activation(){ if ( !current_user_can('manage_security') ) { return false; } $delete_credentials = !rsssl_get_option('store_credentials'); $le_fields = rsssl_le_add_fields([]); if ( !$this->certificate_automatic_install_possible() || !$this->certificate_install_required() || $delete_credentials ) { $le_fields = array_filter($le_fields, function($i){ return isset( $i['type'] ) && $i['type'] === 'password'; }); $options = get_option( 'rsssl_options' ); foreach ($le_fields as $field ) { unset($options[$field['id']]); } update_option( 'rsssl_options', $options, false ); } return true; } /** * some custom actions after a field has been saved * @param string $fieldname * @param mixed $fieldvalue * @param mixed $prev_value * @param string $type * * @return void */ public function after_save_field( $fieldname, $fieldvalue, $prev_value, $type ) { rsssl_progress_add( 'domain' ); //only run when changes have been made if ( $fieldvalue === $prev_value ) { return; } $options = [ 'directadmin_password', 'cpanel_password', 'cloudways_api_key', 'plesk_password', ]; if ( in_array($fieldname, $options) && strpos( $fieldvalue, 'rsssl_' ) === false ) { rsssl_update_option($fieldname, $this->encrypt_with_prefix($fieldvalue) ); } if ( $fieldname==='other_host_type' ){ if ( !rsssl_do_local_lets_encrypt_generation() ) { rsssl_progress_add('directories'); rsssl_progress_add('generation'); rsssl_progress_add('dns-verification'); } } if ( $fieldname==='email' ){ if ( !is_email($fieldvalue) ) { rsssl_progress_remove('domain'); } } } /** * Test for localhost or subfolder usage * @return RSSSL_RESPONSE */ public function check_domain(){ $details = parse_url(site_url()); $path = isset($details['path']) ? $details['path'] : ''; if ( strpos(site_url(), 'localhost')!==false ) { rsssl_progress_remove( 'system-status' ); $action = 'stop'; $status = 'error'; $message = __( "It is not possible to install Let's Encrypt on a localhost environment.", "really-simple-ssl" ); } else if (is_multisite() && get_current_blog_id() !== get_main_site_id() ) { rsssl_progress_remove('system-status'); $action = 'stop'; $status = 'error'; $message = __("It is not possible to install Let's Encrypt on a subsite. Please go to the main site of your website.", "really-simple-ssl" ); } else if ( strlen($path)>0 ) { rsssl_progress_remove('system-status'); $action = 'stop'; $status = 'error'; $message = __("It is not possible to install Let's Encrypt on a subfolder configuration.", "really-simple-ssl" ).rsssl_le_read_more(rsssl_link('install-ssl-on-subfolders') ); } elseif ( rsssl_caa_record_prevents_le() ) { $action = 'stop'; $status = 'error'; $message = __("Please adjust the CAA records via your DNS provider to allow Let’s Encrypt SSL certificates", "really-simple-ssl" ).rsssl_le_read_more(rsssl_link('instructions/edit-dns-caa-records-to-allow-lets-encrypt-ssl-certificates/') ); } else { $action = 'continue'; $status = 'success'; $message = __("Your domain meets the requirements for Let's Encrypt.", "really-simple-ssl" ); } return new RSSSL_RESPONSE($status, $action, $message); } /** * Get certificate installation URL * @return RSSSL_RESPONSE */ public function search_ssl_installation_url(){ //start with most generic, then more specific if possible. $url = rsssl_link('install-ssl-certificate'); $host = 'enter-your-dashboard-url-here'; if (function_exists('wp_get_direct_update_https_url') && !empty(wp_get_direct_update_https_url())) { $url = wp_get_direct_update_https_url(); } if ( rsssl_is_cpanel() ) { $cpanel = new rsssl_cPanel(); $host = $cpanel->host; $url = $cpanel->ssl_installation_url; } else if ( rsssl_is_plesk() ) { $plesk = new rsssl_plesk(); $host = $plesk->host; $url = $plesk->ssl_installation_url; } else if ( rsssl_is_directadmin() ) { $directadmin = new rsssl_directadmin(); $host = $directadmin->host; $url = $directadmin->ssl_installation_url; } $hosting_company = rsssl_get_other_host(); if ( $hosting_company && $hosting_company !== 'none' ) { $hosting_specific_link = RSSSL_LE()->hosts->getKnownHosts()[$hosting_company]['ssl_installation_link']; if ($hosting_specific_link) { $site = trailingslashit( str_replace(array('https://','http://', 'www.'),'', site_url()) ); if ( strpos($hosting_specific_link,'{host}') !==false && empty($host) ) { $url = ''; } else { $url = str_replace(array('{host}', '{domain}'), array($host, $site), $hosting_specific_link); } } } $action = 'continue'; $status = 'warning'; $message = rsssl_get_manual_instructions_text($url); $output = $url; return new RSSSL_RESPONSE($status, $action, $message, $output ); } /** * Test for localhost usage * @return RSSSL_RESPONSE */ public function certificate_status(){ delete_transient('rsssl_certinfo'); if ( RSSSL()->certificate->is_valid() ) { //we have now renewed the cert info transient $certinfo = get_transient('rsssl_certinfo'); $end_date = isset($certinfo['validTo_time_t']) ? $certinfo['validTo_time_t'] : false; $grace_period = strtotime('+'.rsssl_le_manual_generation_renewal_check.' days'); $expiry_date = !empty($end_date) ? date( get_option('date_format'), $end_date ) : __("(unknown)","really-simple-ssl"); //if the certificate expires within the grace period, allow renewal //e.g. expiry date 30 may, now = 10 may => grace period 9 june. if ( $grace_period > $end_date ) { $action = 'continue'; $status = 'success'; $message = sprintf(__("Your certificate will expire on %s.", "really-simple-ssl" ).' '.__("Continue to renew.", "really-simple-ssl" ), $expiry_date); ; } else { $action = 'continue'; $status = 'error'; $message = __("You already have a valid SSL certificate.", "really-simple-ssl" ); } } else { $action = 'continue'; $status = 'success'; $message = __("SSL certificate should be generated and installed.", "really-simple-ssl" ); } return new RSSSL_RESPONSE($status, $action, $message); } /** * Test for server software * @return RSSSL_RESPONSE */ public function server_software(){ $action = 'continue'; $status = 'warning'; $message = __("The Hosting Panel software was not recognized. Depending on your hosting provider, the generated certificate may need to be installed manually.", "really-simple-ssl" ); if ( rsssl_is_cpanel() ) { $status = 'success'; $message = __("CPanel recognized. Possibly the certificate can be installed automatically.", "really-simple-ssl" ); } else if ( rsssl_is_plesk() ) { $status = 'success'; $message = __("Plesk recognized. Possibly the certificate can be installed automatically.", "really-simple-ssl" ); } else if ( rsssl_is_directadmin() ) { $status = 'success'; $message = __("DirectAdmin recognized. Possibly the certificate can be installed automatically.", "really-simple-ssl" ); } return new RSSSL_RESPONSE($status, $action, $message); } /** * Check if CURL is available * * @return RSSSL_RESPONSE */ public function curl_exists() { if( function_exists('curl_init') === false ){ $action = 'stop'; $status = 'error'; $message = __("The PHP function CURL is not available on your server, which is required. Please contact your hosting provider.", "really-simple-ssl" ); } else { $action = 'continue'; $status = 'success'; $message = __("The PHP function CURL has successfully been detected.", "really-simple-ssl" ); } return new RSSSL_RESPONSE($status, $action, $message); } /** * Get or create an account * @return RSSSL_RESPONSE */ public function get_account() { $account_email = $this->account_email(); if ( is_email($account_email) ) { try { $this->account = ! Account::exists( $account_email ) ? Account::create( $account_email ) : Account::get( $account_email ); $status = 'success'; $action = 'continue'; $message = __("Successfully retrieved account", "really-simple-ssl"); } catch(Exception $e) { $response = $this->get_error($e); $status = 'error'; $action = 'retry'; if ( strpos($response, 'invalid contact domain')) { $action = 'stop'; $response = __("The used domain for your email address is not allowed.","really-simple-ssl").'&nbsp;'. sprintf(__("Please change your email address %shere%s and try again.", "really-simple-ssl"),'<a href="'.rsssl_letsencrypt_wizard_url().'&step=2'.'">','</a>'); } $message = $response; } } else { $status = 'error'; $action = 'stop'; $message = __("The email address was not set. Please set the email address",'really-simple-ssl'); } return new RSSSL_RESPONSE($status, $action, $message); } /** * @return RSSSL_RESPONSE */ public function get_dns_token() { if ( rsssl_is_ready_for('dns-verification') ) { $use_dns = rsssl_dns_verification_required(); $challenge_type = $use_dns ? Order::CHALLENGE_TYPE_DNS : Order::CHALLENGE_TYPE_HTTP; if ( $use_dns ) { try { $this->get_account(); $dnsWriter = new class extends AbstractDNSWriter { public function write( Order $order, string $identifier, string $digest ): bool { $tokens = get_option( 'rsssl_le_dns_tokens', [] ); $tokens[ $identifier ] = $digest; update_option( "rsssl_le_dns_tokens", $tokens, false ); rsssl_progress_add( 'dns-verification' ); //return false, as we will continue later on. return false; } }; DNS::setWriter( $dnsWriter ); $response = $this->get_order(); $order = $response->output; $response->output = false; if ( $order ) { try { if ( $order->authorize( $challenge_type ) ) { $response = new RSSSL_RESPONSE( 'success', 'continue', __( "Token successfully retrieved. Click the refresh button if it's not visible yet.", 'really-simple-ssl' ), $this->get_dns_tokens() ); } else { if ( get_option( 'rsssl_le_dns_tokens' ) ) { $response = new RSSSL_RESPONSE( 'success', 'continue', __( "Token successfully retrieved. Click the refresh button if it's not visible yet.", 'really-simple-ssl' ), $this->get_dns_tokens() ); } else { $response = new RSSSL_RESPONSE( 'error', 'retry', __( "Token not received yet.", 'really-simple-ssl' ) ); } } } catch ( Exception $e ) { $error = $this->get_error( $e ); if ( strpos( $error, 'No challenge found with given type')!==false ) { //Maybe it was first set to HTTP challenge. retry after clearing the order. $this->clear_order(true); } else if (strpos($error, 'Keys exist already')!==false) { $this->clear_order(true); $error = __("DNS token not retrieved.", 'really-simple-ssl').' '.__("There are existing keys, the order had to be cleared first.","really-simple-ssl")." ".__("Please start at the previous step.","really-simple-ssl"); } else if (strpos($error, 'Order has status "invalid"')!==false) { $this->clear_order(); $error = __("DNS token not retrieved.", 'really-simple-ssl').' '.__("The order is invalid, possibly due to too many failed authorization attempts. Please start at the previous step.","really-simple-ssl"); } else //fixing a plesk bug if ( strpos($error, 'No order for ID ') !== FALSE){ $error .= '&nbsp;'.__("Order ID mismatch, regenerate order.","really-simple-ssl"); $this->clear_order(); rsssl_progress_remove('dns-verification'); $error .= '&nbsp;'.__("If you entered your DNS records before, they need to be changed.","really-simple-ssl"); } $response = new RSSSL_RESPONSE( 'error', 'retry', $error ); } } else { if (strpos($response->message, 'Keys exist already')!==false) { $this->clear_order(true); $response->message = __("DNS token not retrieved.", 'really-simple-ssl').' '.__("There are existing keys, the order had to be cleared first.","really-simple-ssl")." ".__("Please start at the previous step.","really-simple-ssl"); } return $response; } } catch ( Exception $e ) { rsssl_progress_remove( 'dns-verification' ); $response = $this->get_error( $e ); $response = new RSSSL_RESPONSE( 'error', 'retry', $response ); } } else { $response = new RSSSL_RESPONSE( 'error', 'stop', __( "Configured for HTTP challenge", 'really-simple-ssl' ) ); } } else { rsssl_progress_remove( 'dns-verification' ); $response = new RSSSL_RESPONSE( 'error', 'stop', $this->not_completed_steps_message('dns-verification') ); } return $response; } /** * Get the DNS tokens */ public function get_dns_tokens(): array { $tokens = get_option( 'rsssl_le_dns_tokens', [] ); $output = []; foreach ($tokens as $domain => $token ) { $output[] = [ 'domain' => $domain, 'token' => $token, ]; } return $output; } /** * Check DNS txt records. */ public function verify_dns(): RSSSL_RESPONSE { if ( rsssl_is_ready_for('generation') ) { // Reset state at the start of every verification run; we only // flip it back to true if every non-wildcard identifier matches. update_option('rsssl_le_dns_records_verified', false, false ); $tokens = get_option('rsssl_le_dns_tokens'); if ( !$tokens) { $status = 'error'; $action = 'stop'; $message = __('Token not generated. Please complete the previous step.',"really-simple-ssl"); return new RSSSL_RESPONSE($status, $action, $message); } $skip_dns_check = (bool) get_option('rsssl_skip_dns_check'); $failure_action = $skip_dns_check ? 'continue' : 'stop'; $all_verified = true; $last_failure = null; $last_success_message = ''; $checked_count = 0; foreach ($tokens as $identifier => $token){ if (strpos($identifier, '*') !== false) { continue; } $checked_count++; set_error_handler(array($this, 'custom_error_handling')); ini_set('dns_cache_expiry', 0); $dns_records = dns_get_record( "_acme-challenge.$identifier", DNS_TXT ); restore_error_handler(); if ( ! is_array( $dns_records ) ) { $dns_records = array(); } $txt_values = array_values( array_filter( array_column( $dns_records, 'txt' ), static function ( $value ) { return is_string( $value ) && $value !== ''; } ) ); if ( in_array( $token, $txt_values, true ) ) { $last_success_message = sprintf( __('Successfully verified DNS records', "really-simple-ssl"), "_acme-challenge.$identifier" ); continue; } $all_verified = false; if ( ! empty( $txt_values ) ) { // We found TXT records but none match our token. Surface // the first one so the user has a concrete hint. $ttl = $dns_records[0]['ttl'] ?? 0; $ttl = $this->format_duration( $ttl ); $last_failure = new RSSSL_RESPONSE( 'error', $failure_action, sprintf( __('The DNS response for %s was %s, while it should be %s.', "really-simple-ssl"), "_acme-challenge.$identifier", implode( ', ', $txt_values ), $token ) . ' ' . sprintf( __("Please wait %s before trying again, as this is the expiration of the DNS record currently.", 'really-simple-ssl'), $ttl ) ); } else { $last_failure = new RSSSL_RESPONSE( 'warning', $failure_action, sprintf( __('Could not verify TXT record for domain %s', "really-simple-ssl"), "_acme-challenge.$identifier" ) ); } } if ( $checked_count === 0 ) { // All identifiers were wildcards; nothing to verify locally. update_option('rsssl_le_dns_records_verified', true, false ); return new RSSSL_RESPONSE( 'success', 'continue', __('Successfully verified DNS records', "really-simple-ssl") ); } if ( $all_verified ) { update_option('rsssl_le_dns_records_verified', true, false ); return new RSSSL_RESPONSE( 'success', 'continue', $last_success_message !== '' ? $last_success_message : __('Successfully verified DNS records', "really-simple-ssl") ); } return $last_failure; } return new RSSSL_RESPONSE( 'error', 'stop', $this->not_completed_steps_message('dns-verification') ); } private function format_duration($seconds) { $seconds = (int) $seconds; if ($seconds >= 3600) { $hours = floor($seconds / 3600); $minutes = floor(($seconds % 3600) / 60); $secs = $seconds % 3600 % 60; return sprintf(__("%d:%02d:%02d hours", 'really-simple-ssl'), $hours, $minutes, $secs); } elseif ($seconds >= 60) { $minutes = floor($seconds / 60); $secs = $seconds % 60; return sprintf(__("%d:%02d minutes", 'really-simple-ssl'), $minutes, $secs); } else { return sprintf(__("%d seconds", 'really-simple-ssl'), $seconds); } } /** * Clear an existing order */ public function clear_order( $clear_keys = false ) { if ( $clear_keys ) { $this->clear_keys_directory(); } $this->get_account(); if ( $this->account ) { $response = $this->get_order(); $order = $response->output; if ( $order ) { $order->clear(); } } } /** * Authorize the order */ public function create_bundle_or_renew(): RSSSL_RESPONSE { $bundle_completed = false; $use_dns = rsssl_dns_verification_required(); $attempt_count = (int) get_transient( 'rsssl_le_generate_attempt_count' ); if ( $attempt_count>10 ){ delete_option("rsssl_le_start_renewal"); $message = __("The certificate generation was rate limited for 5 minutes because the authorization failed.",'really-simple-ssl'); if ($use_dns){ $message .= '&nbsp;'.__("Please double check your DNS txt record.",'really-simple-ssl'); } return new RSSSL_RESPONSE( 'error', 'stop', $message ); } if ( !get_option('rsssl_skip_dns_check') ) { if ( $use_dns && ! get_option( 'rsssl_le_dns_records_verified' ) ) { return new RSSSL_RESPONSE( 'error', 'stop', __( "DNS records were not verified yet. Please complete the previous step.", 'really-simple-ssl' ) ); } } if ( rsssl_is_ready_for('generation') ) { $this->get_account(); if ( $use_dns ) { if ( defined('WP_DEBUG') && WP_DEBUG ) { error_log( "DNS verified: " . get_option( 'rsssl_le_dns_records_verified' ) ); error_log( "Skip DNS check: " . get_option( 'rsssl_skip_dns_check' ) ); } $dnsWriter = new class extends AbstractDNSWriter { public function write( Order $order, string $identifier, string $digest): bool { $status = false; if ( get_option('rsssl_le_dns_tokens') ) { $status = true; } return $status; } }; DNS::setWriter($dnsWriter); } $response = $this->get_order(); $order = $response->output; $response->output = false; if ( $order ) { if ( $order->isCertificateBundleAvailable() ) { try { $order->enableAutoRenewal(); $bundle_completed = $this->update_certificate_paths($order); if ( $bundle_completed ) { $response = new RSSSL_RESPONSE( 'success', 'continue', __("Certificate already generated. It was renewed if required.",'really-simple-ssl') ); } else { $response = new RSSSL_RESPONSE( 'error', 'retry', __("Files not created yet...",'really-simple-ssl') ); } } catch ( Exception $e ) { $response = new RSSSL_RESPONSE( 'error', 'retry', $this->get_error( $e ) ); $bundle_completed = false; } } else { $finalized = false; $challenge_type = $use_dns ? Order::CHALLENGE_TYPE_DNS : Order::CHALLENGE_TYPE_HTTP; try { if ( $order->authorize( $challenge_type ) ) { $order->finalize(); $this->reset_attempt(); $finalized = true; } else { $this->count_attempt(); $response = new RSSSL_RESPONSE( 'error', 'retry', __('Authorization not completed yet.',"really-simple-ssl") ); $bundle_completed = false; } } catch ( Exception $e ) { $this->count_attempt(); $message = $this->get_error( $e ); if ( defined('WP_DEBUG') && WP_DEBUG ) { error_log("Really Simple Security: ".$message); } $response = new RSSSL_RESPONSE( 'error', 'stop', $message ); if ( strpos( $message, 'No challenge found with given type')!==false ) { //Maybe it was first set to HTTP challenge. retry after clearing the order. $response->message = __("Due to a change in challenge type, the order had to be reset. Please start at the previous step.","really-simple-ssl"); $this->clear_order(true); } else if ( strpos($message, 'Order has status "invalid"')!==false) { $this->clear_order(); $response->message = __("Certificate not created.", 'really-simple-ssl').' '.__("The order is invalid, possibly due to too many failed authorization attempts. Please start at the previous step.","really-simple-ssl"); if ($use_dns) { rsssl_progress_remove('dns-verification'); $response->message .= '&nbsp;'.__("As your order will be regenerated, you'll need to update your DNS text records.","really-simple-ssl"); } } else { //if OCSP is not disabled yet, and the order status is not invalid, we disable ocsp, and try again. if ( !rsssl_get_option( 'disable_ocsp' ) ) { rsssl_update_option( 'disable_ocsp', true ); $response->action = 'retry'; $response->status = 'warning'; $response->message = __("OCSP not supported, the certificate will be generated without OCSP.","really-simple-ssl"); } } } if ( $finalized ) { try { if ( $order->isCertificateBundleAvailable() ) { $bundle_completed = $this->update_certificate_paths($order); if ( $bundle_completed ) { $response = new RSSSL_RESPONSE( 'success', 'continue', __("Successfully generated certificate.",'really-simple-ssl') ); } else { $response = new RSSSL_RESPONSE( 'error', 'retry', __("Files not created yet...",'really-simple-ssl') ); } } else { $response = new RSSSL_RESPONSE( 'error', 'retry', __("Bundle not available yet...",'really-simple-ssl') ); } } catch ( Exception $e ) { $response = new RSSSL_RESPONSE( 'error', 'retry', $this->get_error( $e ) ); } } } } } else { $response = new RSSSL_RESPONSE( 'error', 'stop', $this->not_completed_steps_message('generation') ); } if ( $bundle_completed ){ rsssl_progress_add('generation'); update_option('rsssl_le_certificate_generated_by_rsssl', true, false); delete_option("rsssl_le_start_renewal"); } else { rsssl_progress_remove('generation'); } return $response; } /** * For each file, check if the path exists, update the path options, and * return success or false accordingly */ private function update_certificate_paths($order): bool { $bundle = $order->getCertificateBundle(); $pathToPrivateKey = $bundle->path . $bundle->private; $pathToCertificate = $bundle->path . $bundle->certificate; $pathToIntermediate = $bundle->path . $bundle->intermediate; $success_private = $success_cert = $success_intermediate = false; if ( file_exists( $pathToPrivateKey ) ) { $success_private = true; update_option( 'rsssl_private_key_path', $pathToPrivateKey, false ); } if ( file_exists( $pathToCertificate ) ) { $success_cert = true; update_option( 'rsssl_certificate_path', $pathToCertificate, false ); } if ( file_exists( $pathToIntermediate ) ) { $success_intermediate = true; update_option( 'rsssl_intermediate_path', $pathToIntermediate, false ); } $bundle_completed = true; if ( ! $success_cert || ! $success_private || ! $success_intermediate ) { $bundle_completed = false; } return $bundle_completed; } /** * Get the order object */ public function get_order(): RSSSL_RESPONSE { // if we don't have an account, try to retrieve it if ( !$this->account ) { $this->get_account(); } // still no account, then exit if ( !$this->account ) { return new RSSSL_RESPONSE( 'error', 'retry', __( "Failed retrieving account.", 'really-simple-ssl' ) ); } if ( ! Order::exists( $this->account, $this->subjects ) ) { try { $response = new RSSSL_RESPONSE( 'success', 'continue', __("Order successfully created.",'really-simple-ssl') ); $response->output = Order::create( $this->account, $this->subjects ); } catch(Exception $e) { $response = new RSSSL_RESPONSE( 'error', 'retry', $this->get_error($e) ); } } else { //order exists already $response = new RSSSL_RESPONSE( 'success', 'continue', __( "Order successfully retrieved.", 'really-simple-ssl' ) ); $response->output = Order::get( $this->account, $this->subjects ); } return $response; } /** * Keep track of certain request counts, to prevent rate limiting by LE */ public function count_attempt() { $attempt_count = (int) get_transient( 'rsssl_le_generate_attempt_count' ); $attempt_count++; set_transient('rsssl_le_generate_attempt_count', $attempt_count, 5 * MINUTE_IN_SECONDS); } public function reset_attempt(){ delete_transient('rsssl_le_generate_attempt_count'); } /** * Check if SSL generation renewal can be handled automatically */ public function ssl_generation_can_auto_renew(): bool { if ( rsssl_get_option('verification_type')==='dns' && !get_option('rsssl_le_dns_configured_by_rsssl') ) { return false; } return true; } /** * Check if it's possible to autorenew */ public function certificate_automatic_install_possible(): bool { $install_method = get_option('rsssl_le_certificate_installed_by_rsssl'); //if it was never auto installed, we probably can't autorenew. if ($install_method === false ) { return false; } return true; } public function should_start_manual_ssl_generation() { return get_option( "rsssl_le_start_renewal" ); } /** * Only used if * - SSL generated by RSSSL * - certificate is about to expire */ public function certificate_renewal_status_notice(): string { if ( !RSSSL_LE()->letsencrypt_handler->ssl_generation_can_auto_renew()){ return 'manual-generation'; } if ( $this->certificate_install_required() && $this->certificate_automatic_install_possible() && $this->installation_failed() ){ return 'automatic-installation-failed'; } if ( $this->certificate_install_required() && !$this->certificate_automatic_install_possible() ) { return 'manual-installation'; } return 'automatic'; } /** * Check if the certificate has to be installed on each renewal defaults to * true. */ public function certificate_install_required(): bool { $install_method = get_option('rsssl_le_certificate_installed_by_rsssl'); $hosting_company = rsssl_get_other_host(); $hosts = RSSSL_LE()->hosts; if ( in_array($install_method, $hosts->no_installation_renewal_needed) || in_array($hosting_company, $hosts->no_installation_renewal_needed)) { return false; } return true; } /** * Check if the certificate needs renewal. */ public function cron_certificate_needs_renewal(): bool { $cert_file = get_option('rsssl_certificate_path'); if ( empty($cert_file) ) { return false; } $certificate = file_get_contents($cert_file); $certificateInfo = openssl_x509_parse($certificate); $valid_to = $certificateInfo['validTo_time_t']; $in_expiry_days = strtotime( "+".rsssl_le_cron_generation_renewal_check." days" ); if ( $in_expiry_days > $valid_to ) { return true; } return false; } /** * Get account email * @return string */ public function account_email() { //don't use the default value: we want users to explicitly enter a value return rsssl_get_option('email_address'); } /** * Get terms accepted */ public function terms_accepted(): RSSSL_RESPONSE { //don't use the default value: we want users to explicitly enter a value $accepted = rsssl_get_option('accept_le_terms'); if ( $accepted ) { $status = 'success'; $action = 'continue'; $message = __("Terms & Conditions are accepted.",'really-simple-ssl'); } else { $status = 'error'; $action = 'stop'; $message = __("The Terms & Conditions were not accepted. Please accept in the general settings.",'really-simple-ssl'); } return new RSSSL_RESPONSE($status, $action, $message); } /** * Change the email address in an account * @param $new_email */ public function update_account( $new_email ) { if (!$this->account) return; try { $this->account->update($new_email); } catch (Exception $e) { } } /** * Get list of common names on the certificate */ public function get_subjects(): array { $subjects = array(); $domain = rsssl_get_domain(); $root = str_replace( 'www.', '', $domain );; $subjects[] = $domain; //don't offer aliasses for subdomains if ( !rsssl_is_subdomain() ) { if (rsssl_get_option( 'include_alias' )) { //main is www. if ( strpos( $domain, 'www.' ) !== false ) { $alias_domain = $root; } else { $alias_domain = 'www.'.$root; } $subjects[] = $alias_domain; } } if ( rsssl_wildcard_certificate_required() ) { $domain = rsssl_get_domain(); //in theory, the main site of a subdomain setup can be a www. domain. But we have to request a certificate without the www. $domain = str_replace( 'www.', '', $domain ); $subjects = array( $domain, '*.' . $domain, ); } return apply_filters('rsssl_le_subjects', $subjects); } /** * Catch errors * * @since 3.0 * * @access public * @param $errno * @param $errstr * @param $errfile * @param $errline * @param array $errcontext * * @return bool */ public function custom_error_handling( $errno, $errstr, $errfile, $errline, $errcontext = array() ) { return true; } public function not_completed_steps_message($step) { $not_completed_steps = rsssl_get_not_completed_steps($step); $nice_names = array(); $steps = rsssl_le_steps(); foreach ($not_completed_steps as $not_completed_step ) { $index = array_search($not_completed_step, array_column( $steps, 'id')); $nice_names[] = $steps[$index]['title']; } return sprintf(__('Please complete the following step(s) first: %s', "really-simple-ssl"), implode(", ", $nice_names) ); } /** * Test for writing permissions * @return RSSSL_RESPONSE */ public function check_writing_permissions(): RSSSL_RESPONSE { $directories_without_permissions = $this->directories_without_writing_permissions(); $has_missing_permissions = count($directories_without_permissions)>0; if ( $has_missing_permissions ) { rsssl_progress_remove('directories'); $action = 'stop'; $status = 'error'; $message = __("The following directories do not have the necessary writing permissions.", "really-simple-ssl" )."&nbsp;".__("Set permissions to 644 to enable SSL generation.", "really-simple-ssl" ); foreach ($directories_without_permissions as $directories_without_permission) { $message .= "<br> - ".$directories_without_permission; } } else { $action = 'continue'; $status = 'success'; $message = __("The required directories have the necessary writing permissions.", "really-simple-ssl" ); } return new RSSSL_RESPONSE($status, $action, $message); } /** * Verify if a host has been selected, and if so, if this host supports LE, or if it's already active */ public function check_host(): RSSSL_RESPONSE { $action = 'continue'; $status = 'success'; $message = __("We have not detected any known hosting limitations.", "really-simple-ssl" ); $host = rsssl_get_other_host(); if ( $host === 'none' ) $host = false; $known_hosts = RSSSL_LE()->hosts->getKnownHosts(); if ( isset($known_hosts[$host]) ){ if ( $known_hosts[$host]['free_ssl_available'] === 'paid_only' ) { $action = 'stop'; $status = 'error'; $message = sprintf(__("According to our information, your hosting provider does not allow any kind of SSL installation, other than their own paid certificate. For an alternative hosting provider with SSL, see this %sarticle%s.","really-simple-ssl"), '<a target="_blank" href="https://really-simple-ssl.com/hosting-providers-with-free-ssl">', '</a>'); } if ( $known_hosts[$host]['free_ssl_available'] === 'activated_by_default' ) { $url = $known_hosts[$host]['ssl_installation_link']; $action = 'continue'; $status = 'error'; $message = sprintf(__("According to our information, your hosting provider supplies your account with an SSL certificate by default. Please contact your %shosting support%s if this is not the case.","really-simple-ssl"), '<a target="_blank" href="'.$url.'">', '</a>').'&nbsp'. __("After completing the installation, you can let Really Simple Security automatically configure your site for SSL by using the 'Activate SSL' button.","really-simple-ssl"); } } return new RSSSL_RESPONSE($status, $action, $message); } /** * Test for directory */ public function check_challenge_directory(): RSSSL_RESPONSE { if ( !$this->challenge_directory() ) { rsssl_progress_remove('directories'); $action = 'stop'; $status = 'error'; $message = __("The challenge directory is not created yet.", "really-simple-ssl" ); } else { $action = 'continue'; $status = 'success'; $message = __("The challenge directory was successfully created.", "really-simple-ssl" ); } return new RSSSL_RESPONSE($status, $action, $message); } /** * Test for directory */ public function check_key_directory(): RSSSL_RESPONSE { $action = 'stop'; $status = 'error'; $message = __("The key directory is not created yet.", "really-simple-ssl" ); //this option is set in the key_dir function, so we need to check it now. if ( !get_option('rsssl_create_folders_in_root')) { $action = 'retry'; $message = __("Trying to create directory in root of website.", "really-simple-ssl" ); } if ( !$this->key_directory() ) { rsssl_progress_remove('directories'); } else { $action = 'continue'; $status = 'success'; $message = __("The key directory was successfully created.", "really-simple-ssl" ); } return new RSSSL_RESPONSE($status, $action, $message); } /** * Test for directory */ public function check_certs_directory(): RSSSL_RESPONSE { if ( !$this->certs_directory() ) { rsssl_progress_remove('directories'); $action = 'stop'; $status = 'error'; $message = __("The certs directory is not created yet.", "really-simple-ssl" ); } else { $action = 'continue'; $status = 'success'; $message = __("The certs directory was successfully created.", "really-simple-ssl" ); } return new RSSSL_RESPONSE($status, $action, $message); } /** * Check if our created directories have the necessary writing permissions */ public function directories_without_writing_permissions( ){ $required_folders = array( $this->key_directory, $this->certs_directory, ); if ( !rsssl_dns_verification_required() ) { $required_folders[] = $this->challenge_directory; } $no_writing_permissions = array(); foreach ($required_folders as $required_folder){ if (!$this->directory_has_writing_permissions( $required_folder )) { $no_writing_permissions[] = $required_folder; } } return $no_writing_permissions; } /** * Check if a directory has writing permissions * @param string $directory * * @return bool */ public function directory_has_writing_permissions( $directory ){ set_error_handler(array($this, 'custom_error_handling')); $test_file = fopen( $directory . "/really-simple-ssl-permissions-check.txt", "w" ); if ( !$test_file ) { return false; } fwrite($test_file, 'file to test writing permissions for Really Simple Security'); fclose( $test_file ); restore_error_handler(); if (!file_exists($directory . "/really-simple-ssl-permissions-check.txt")) { return false; } return true; } /** * Check if the challenge directory is reachable over the http protocol * @return RSSSL_RESPONSE */ public function challenge_directory_reachable() { $file_content = false; $status_code = __('no response','really-simple-ssl'); //make sure we request over http, otherwise the request might fail if the url is already https. $url = str_replace('https://', 'http://', site_url('.well-known/acme-challenge/really-simple-ssl-permissions-check.txt')); $error_message = sprintf(__( "Could not reach challenge directory over %s.", "really-simple-ssl"), '<a target="_blank" href="'.$url.'">'.$url.'</a>'); $test_string = 'Really Simple Security'; $folders = $this->directories_without_writing_permissions(); if ( !$this->challenge_directory() || count($folders) !==0 ) { $status = 'error'; $action = 'stop'; $message = __( "Challenge directory not writable.", "really-simple-ssl"); return new RSSSL_RESPONSE($status, $action, $message); } $response = wp_remote_get( $url ); if ( is_array( $response ) ) { $status_code = wp_remote_retrieve_response_code( $response ); $file_content = wp_remote_retrieve_body( $response ); } if ( $status_code !== 200 ) { if (get_option('rsssl_skip_challenge_directory_request')) { $status = 'warning'; $action = 'continue'; $message = $error_message.' '.sprintf( __( "Error code %s", "really-simple-ssl" ), $status_code ); } else { $status = 'error'; $action = 'stop'; $message = $error_message.' '.sprintf( __( "Error code %s", "really-simple-ssl" ), $status_code ); rsssl_progress_remove('directories'); } } else { if ( ! is_wp_error( $response ) && ( strpos( $file_content, $test_string ) !== false ) ) { $status = 'success'; $action = 'continue'; $message = __( "Successfully verified alias domain.", "really-simple-ssl" ); set_transient('rsssl_alias_domain_available', 'available', 30 * MINUTE_IN_SECONDS ); } else { $status = 'error'; $action = 'stop'; $message = $error_message; rsssl_progress_remove('directories'); } } return new RSSSL_RESPONSE($status, $action, $message); } /** * Check if exists, create .well-known/acme-challenge directory if not * existing * @return bool|string */ public function challenge_directory() { $root_directory = trailingslashit(ABSPATH); if ( ! file_exists( $root_directory . '.well-known' ) ) { mkdir( $root_directory . '.well-known', 0755 ); } if ( ! file_exists( $root_directory . '.well-known/acme-challenge' ) ) { mkdir( $root_directory . '.well-known/acme-challenge', 0755 ); } if ( file_exists( $root_directory . '.well-known/acme-challenge' ) ){ return $root_directory . '.well-known/acme-challenge'; } return false; } /** * Get path to location where to create the directories. * @uses apply_filters 'rsssl_le_directory_path' */ public function get_directory_path(): string { $root_directory = trailingslashit(ABSPATH); $directoryPath = trailingslashit(dirname($root_directory)); if ( get_option('rsssl_create_folders_in_root') ) { if ( !get_option('rsssl_ssl_dirname') ) { $token = str_shuffle ( time() ); update_option('rsssl_ssl_dirname', $token, false ); } if ( ! file_exists( $root_directory . get_option('rsssl_ssl_dirname') ) ) { mkdir( $root_directory . get_option('rsssl_ssl_dirname'), 0755 ); } $directoryPath = ($root_directory . trailingslashit( get_option('rsssl_ssl_dirname') )); } /** * Filter: 'rsssl_le_directory_path' * Can be used to change the directory path where the ssl/keys directory * is created. * * @param string $directoryPath * @return string */ return apply_filters('rsssl_le_directory_path', $directoryPath); } /** * Get path to ssl directory. Note that here is NO trailing slash. * @uses apply_filters 'rsssl_le_ssl_path' */ public function get_ssl_path(): string { $directoryPath = $this->get_directory_path(); $sslPath = ($directoryPath . 'ssl'); /** * Filter: 'rsssl_le_ssl_path' * Can be used to change the ssl path where the ssl/keys directory * is created. * * @param string $sslPath * @param string $directoryPath * @return string */ return apply_filters('rsssl_le_ssl_path', $sslPath, $directoryPath); } /** * Check if exists, create ssl/certs directory above the wp root if not existing * @return bool|string */ public function certs_directory() { $sslPath = $this->get_ssl_path(); if (!file_exists($sslPath)) { mkdir($sslPath, 0755 ); } if (!file_exists( $sslPath . '/certs')) { mkdir( $sslPath . '/certs', 0755 ); } if (file_exists($sslPath . '/certs')) { return $sslPath . '/certs'; } return false; } /** * Check if exists, create ssl/keys directory above the wp root if not * @return bool|string */ public function key_directory() { $directory = $this->get_directory_path(); $sslPath = $this->get_ssl_path(); try { $openbasedirHasRestrictions = $this->openbasedir_restriction($directory); if ($openbasedirHasRestrictions === false) { if (!file_exists($sslPath) && is_writable($directory)) { mkdir($sslPath, 0755); } if (!file_exists($sslPath . '/keys') && is_writable($sslPath)) { mkdir($sslPath . '/keys', 0755); } if (file_exists($sslPath . '/keys')) { return $sslPath . '/keys'; } } // If creating the folder has failed, we're on apache, and can write // to these folders, we create a root directory. $has_writing_permissions = $this->directory_has_writing_permissions($this->challenge_directory); // We're guessing that if the challenge dir has writing permissions, // the new dir will also have it. if (RSSSL()->server->uses_htaccess() && $has_writing_permissions) { update_option('rsssl_create_folders_in_root', true, false); } } catch ( Exception $e ) { return false; } return false; } /** * Check for openbasedir restrictions */ private function openbasedir_restriction(string $path): bool { // Default error handler is required set_error_handler(null); // Clean last error info. error_clear_last(); // Testing... @file_exists($path); // Restore previous error handler restore_error_handler(); // Return `true` if error has occurred return ($error = error_get_last()) && $error['message'] !== '__clean_error_info'; } /** * Clear the keys directory, used in reset function * @since 5.0 */ public function clear_keys_directory() { if (!rsssl_user_can_manage()) { return; } $dir = $this->key_directory(); $this->delete_files_directories_recursively( $dir ); } /** * @param $dir * Delete files and directories recursively. Used to clear the order from keys directory * @since 5.0.11 */ private function delete_files_directories_recursively( $dir ) { if ( strpos( $dir, 'ssl/keys' ) !== false ) { foreach ( glob( $dir . '/*' ) as $file ) { if ( is_dir( $file ) ) { $this->delete_files_directories_recursively( $file ); } else { unlink( $file ); } } rmdir( $dir ); } } /** * Queue the shared managed-htaccess executor when a plugin-owned LE directory `.htaccess` file is missing or stale. * * These files are auxiliary managed targets. They are not folded into the root `.htaccess` write itself, * but they do run through the same centralized executor and atomic file manager. */ public function maybe_queue_letsencrypt_directory_htaccess_files(): void { if ( ! rsssl_user_can_manage() ) { return; } if ( ! RSSSL()->server->uses_htaccess() ) { return; } if ( ! get_option( 'rsssl_create_folders_in_root' ) ) { return; } if ( ! function_exists( 'rsssl_schedule_htaccess_update' ) ) { return; } if ( ! empty( $this->get_directory_path() ) && $this->should_sync_letsencrypt_directory_htaccess_file( $this->get_directory_path() . 'ssl/.htaccess' ) ) { rsssl_schedule_htaccess_update(); return; } if ( ! empty( $this->key_directory() ) && $this->should_sync_letsencrypt_directory_htaccess_file( trailingslashit( $this->key_directory() ) . '.htaccess' ) ) { rsssl_schedule_htaccess_update(); return; } if ( ! empty( $this->certs_directory() ) && $this->should_sync_letsencrypt_directory_htaccess_file( trailingslashit( $this->certs_directory() ) . '.htaccess' ) ) { rsssl_schedule_htaccess_update(); } } /** * Ensure the plugin-owned LE directories keep their deny-all `.htaccess` files in sync. * * The executor calls this after uploads and before root so the overall target order stays deterministic. * Each auxiliary file still gets its own atomic commit; there is no cross-file transaction. */ public function sync_letsencrypt_directory_htaccess_files(): bool { if ( ! RSSSL()->server->uses_htaccess() ) { return true; } if ( ! get_option( 'rsssl_create_folders_in_root' ) ) { return true; } $success = true; if ( ! empty( $this->get_directory_path() ) ) { $success = $this->sync_letsencrypt_directory_htaccess_file( $this->get_directory_path() . 'ssl/.htaccess', 'ssl' ) && $success; } if ( ! empty( $this->key_directory() ) ) { $success = $this->sync_letsencrypt_directory_htaccess_file( trailingslashit( $this->key_directory() ) . '.htaccess', 'key' ) && $success; } if ( ! empty( $this->certs_directory() ) ) { $success = $this->sync_letsencrypt_directory_htaccess_file( trailingslashit( $this->certs_directory() ) . '.htaccess', 'certs' ) && $success; } return $success; } /** * Check whether a plugin-owned LE directory `.htaccess` file is missing or diverges from the managed rule block. */ private function should_sync_letsencrypt_directory_htaccess_file( string $path ): bool { if ( $path === '' ) { return false; } if ( ! is_file( $path ) ) { return true; } return ! $this->has_expected_letsencrypt_directory_htaccess_rules( $path ); } /** * Validate that the managed LE marker block exactly matches the expected deny-all lines. */ private function has_expected_letsencrypt_directory_htaccess_rules( string $path ): bool { return $this->htaccess_file_manager->get_rule_lines_for_path( $path, 'Really Simple Security LETS ENCRYPT' ) === $this->get_letsencrypt_directory_htaccess_lines(); } /** * Write one plugin-owned LE directory `.htaccess` file through the shared atomic manager path. * * This is intentionally path-scoped. LE directory files reuse the same lock hierarchy and atomic writer as * root/uploads, but create permission is granted only for the current auxiliary target. */ public function sync_letsencrypt_directory_htaccess_file( string $path, string $type ): bool { if ( $path === '' ) { return true; } // Keep preconditions local so LE directory writes do not rely on global root .htaccess state. if ( ! $this->ensure_htaccess_directory_is_ready( $path ) ) { update_option( 'rsssl_htaccess_file_set_' . $type, false, false ); return false; } // Use the manager atomic write path to avoid partial/competing writes on concurrent requests. if ( ! $this->write_letsencrypt_htaccess_rules_atomic( $path ) ) { update_option( 'rsssl_htaccess_file_set_' . $type, false, false ); return false; } if ( ! $this->has_expected_letsencrypt_directory_htaccess_rules( $path ) ) { update_option( 'rsssl_htaccess_file_set_' . $type, false, false ); return false; } update_option( 'rsssl_htaccess_file_set_' . $type, true, false ); return true; } /** * Remove empty plugin-owned LE placeholders left behind by an interrupted guarded create. * Empty files are never a valid end state here, and removing them lets the next write recreate the file cleanly. */ private function ensure_htaccess_directory_is_ready( string $path ): bool { if ( is_link( $path ) ) { return false; } $directory = dirname( $path ); if ( ! is_dir( $directory ) && ! wp_mkdir_p( $directory ) ) { return false; } if ( ! is_file( $path ) ) { return true; } $content = @file_get_contents( $path ); if ( $content === false ) { return true; } if ( trim( $content ) !== '' ) { return true; } // These per-directory files are plugin-owned. An interrupted guarded create can leave an empty file behind, // and clearing that placeholder lets the next write use the same guarded create path again. if ( ! $this->is_plugin_owned_letsencrypt_htaccess_path( $path ) ) { return false; } return @unlink( $path ); } /** * Only allow placeholder cleanup for the exact plugin-owned LE `.htaccess` targets. */ private function is_plugin_owned_letsencrypt_htaccess_path( string $path ): bool { if ( basename( $path ) !== '.htaccess' ) { return false; } if ( ! get_option( 'rsssl_create_folders_in_root' ) ) { return false; } $ssl_dirname = get_option( 'rsssl_ssl_dirname' ); if ( ! is_string( $ssl_dirname ) || $ssl_dirname === '' ) { return false; } $ssl_dirname = trim( $ssl_dirname, "/\\" ); if ( $ssl_dirname === '' || strpos( $ssl_dirname, '/' ) !== false || strpos( $ssl_dirname, '\\' ) !== false || strpos( $ssl_dirname, '..' ) !== false ) { return false; } $normalized_path = $this->normalize_htaccess_target_path( $path ); // Use the canonical root-owned LE directory here, not the filtered runtime paths, so cleanup never // expands the unlink scope beyond the plugin-managed targets created under ABSPATH. $ssl_root = trailingslashit( trailingslashit( ABSPATH ) . $ssl_dirname ) . 'ssl'; $allowed_paths = [ $this->normalize_htaccess_target_path( $ssl_root . '/.htaccess' ), $this->normalize_htaccess_target_path( $ssl_root . '/keys/.htaccess' ), $this->normalize_htaccess_target_path( $ssl_root . '/certs/.htaccess' ), ]; return in_array( $normalized_path, $allowed_paths, true ); } /** * Normalize `.htaccess` target paths before comparing scoped create permissions. */ private function normalize_htaccess_target_path( string $path ): string { $normalized_path = function_exists( 'wp_normalize_path' ) ? wp_normalize_path( $path ) : str_replace( '\\', '/', $path ); return rtrim( $normalized_path, '/' ); } /** * Scope create permission to the current LE directory target without leaking that allowance to root/uploads writes. * * `write_rule_for_path()` still reaches the shared atomic manager path, so LE writes keep the same advisory * locking, temp-swap commit, and fallback semantics as the rest of the `.htaccess` system. */ private function write_letsencrypt_htaccess_rules_atomic( string $path ): bool { $manager = $this->htaccess_file_manager; $normalized_path = $this->normalize_htaccess_target_path( $path ); // Temporarily allow creation only for this LE directory file. The shared manager also writes root // and uploads rules, so this filter must stay scoped to the current target and be removed again. $allow_create_filter = function( bool $allow, string $candidate_path ) use ( $normalized_path ): bool { if ( $this->normalize_htaccess_target_path( $candidate_path ) !== $normalized_path ) { return $allow; } return true; }; add_filter( 'rsssl_allow_create_htaccess', $allow_create_filter, 9999, 2 ); try { return $manager->write_rule_for_path( $path, [ 'marker' => 'Really Simple Security LETS ENCRYPT', 'lines' => $this->get_letsencrypt_directory_htaccess_lines(), ] ); } finally { remove_filter( 'rsssl_allow_create_htaccess', $allow_create_filter, 9999 ); } } /** * Return the deny-all block that protects plugin-owned LE directories from direct web access. */ private function get_letsencrypt_directory_htaccess_lines(): array { return [ '<IfModule mod_authz_core.c>', ' Require all denied', '</IfModule>', '<IfModule !mod_authz_core.c>', ' Deny from all', '</IfModule>', ]; } /** * Check if it's a subdomain multisite * @return RSSSL_RESPONSE */ public function is_subdomain_setup(){ if ( !is_multisite() ) { $is_subdomain = false; } else { if ( defined('SUBDOMAIN_INSTALL') && SUBDOMAIN_INSTALL ) { $is_subdomain = true; } else { $is_subdomain = false; } } if ($is_subdomain) { $status = 'error'; $action = 'stop'; $message = sprintf(__("This is a multisite configuration with subdomains. You should generate a wildcard certificate on the root domain.",'really-simple-ssl'), '<a href="'.rsssl_link('pro','error', 'letsencrypt').'" target="_blank">','</a>'); rsssl_progress_remove('system-status'); } else { $status = 'success'; $action = 'continue'; $message = __("No subdomain setup detected.","really-simple-ssl"); } return new RSSSL_RESPONSE($status, $action, $message); } /** * Check if we're about to create a wilcard certificate * @return bool */ public function is_wildcard(){ $subjects = $this->get_subjects(); $is_wildcard = false; foreach ($subjects as $domain ) { if ( strpos($domain, '*') !== false ) { $is_wildcard = true; } } return $is_wildcard; } /** * Check if the alias domain is available * * @return RSSSL_RESPONSE */ public function alias_domain_available(){ if ( rsssl_is_subdomain() ) { return new RSSSL_RESPONSE('success', 'continue',__("Alias domain check is not relevant for a subdomain","really-simple-ssl")); } //write a test file to the uploads directory $uploads = wp_upload_dir(); $upload_dir = trailingslashit($uploads['basedir']); $upload_url = trailingslashit($uploads['baseurl']); $file_content = false; $status_code = __('no response','really-simple-ssl'); $domain = rsssl_get_domain(); if ( strpos( $domain, 'www.' ) !== false ) { $is_www = true; $alias_domain = str_replace( 'www.', '', $domain ); } else { $is_www = false; $alias_domain = 'www.'.$domain; } if ( $is_www ) { $message = __("Please check if the non www version of your site also points to this website.", "really-simple-ssl" ); } else { $message = __("Please check if the www version of your site also points to this website.", "really-simple-ssl" ); } $error_message = __( "Could not verify alias domain.", "really-simple-ssl") .' '. $message.' '. __( "If this is not the case, don't add this alias to your certificate.", "really-simple-ssl"); //get cached status first. $cached_status = get_transient('rsssl_alias_domain_available'); if ( $cached_status ) { if ( $cached_status === 'available' ) { $status = 'success'; $action = 'continue'; $message = __( "Successfully verified alias domain.", "really-simple-ssl" ); } else { $status = 'warning'; $action = 'continue'; $message = $error_message; } return new RSSSL_RESPONSE($status, $action, $message); } if ( ! file_exists( $upload_dir . 'rsssl' ) ) { mkdir( $upload_dir . 'rsssl', 0755 ); } $test_string = 'file to test alias domain existence'; $test_file = $upload_dir . 'rsssl/test.txt'; file_put_contents($test_file, $test_string ); $test_url = $upload_url . 'rsssl/test.txt'; if ( ! file_exists( $test_file ) ) { $status = 'error'; $action = 'stop'; $message = __("Could not create test folder and file.", "really-simple-ssl").' '. __("Please create a folder 'rsssl' in the uploads directory, with 644 permissions.", "really-simple-ssl"); } else { set_transient('rsssl_alias_domain_available', 'not-available', 30 * MINUTE_IN_SECONDS ); $alias_test_url = str_replace( $domain, $alias_domain, $test_url ); //always over http: $alias_test_url = str_replace('https://','http://', $alias_test_url); $response = wp_remote_get( $alias_test_url ); if ( is_array( $response ) ) { $status_code = wp_remote_retrieve_response_code( $response ); $file_content = wp_remote_retrieve_body( $response ); } if ( $status_code !== 200 ) { $status = 'warning'; $action = 'continue'; $message = $error_message; if (intval($status_code) != 0 ) { $message .= ' '.sprintf( __( "Error code %s", "really-simple-ssl" ), $status_code ); } } else { if ( ! is_wp_error( $response ) && ( strpos( $file_content, $test_string ) !== false ) ) { //make sure we only set this value once, during first setup. if ( !get_option('rsssl_initial_alias_domain_value_set') ) { rsssl_update_option('include_alias', true); update_option('rsssl_initial_alias_domain_value_set', true, false); } $status = 'success'; $action = 'continue'; $message = __( "Successfully verified alias domain.", "really-simple-ssl" ); set_transient('rsssl_alias_domain_available', 'available', 30 * MINUTE_IN_SECONDS ); } else { $status = 'warning'; $action = 'continue'; $message = $error_message; } } } return new RSSSL_RESPONSE($status, $action, $message); } /** * Get string error from error message. * @param mixed|LE_ACME2\Exception\InvalidResponse $e * * @return string */ private function get_error($e){ $is_raw_response = false; if (method_exists($e, 'getRawResponse') && isset($e->getRawResponse()->body['detail'])) { $is_raw_response = true; $error = $e->getRawResponse()->body['detail']; //check for subproblems if (isset($e->getRawResponse()->body['subproblems'])){ $error .= '<ul>'; foreach(array_keys($e->getRawResponse()->body['subproblems']) as $index) { $error .= '<li>'. $this->cleanup_error_message($e->getRawResponse()->body['subproblems'][$index]['detail']).'</li>'; } $error .= '</ul>'; } } else { $error = $e->getMessage(); } $max = strpos($error, 'CURL response'); if ($max===false) { $max = 200; } if (!$is_raw_response){ $error = substr( $error, 0, $max); } return $error; } /** * Generic SSL cert installation function * * @return RSSSL_RESPONSE */ public function cron_renew_installation() { $install_method = get_option('rsssl_le_certificate_installed_by_rsssl'); $data = explode(':', $install_method ); $server = isset($data[0]) ? $data[0] : false; $type = isset($data[1]) ? $data[1] : false; $attempt_count = (int) get_transient( 'rsssl_le_install_attempt_count' ); $attempt_count++; set_transient('rsssl_le_install_attempt_count', $attempt_count, DAY_IN_SECONDS); if ( $attempt_count>10 ){ delete_option("rsssl_le_start_installation"); $status = 'error'; $action = 'stop'; $message = __("The certificate installation was rate limited. Please try again later.",'really-simple-ssl'); return new RSSSL_RESPONSE($status, $action, $message); } if (rsssl_is_ready_for('installation')) { try { if ( $server === 'cpanel' ) { if ($type==='default') { $response = rsssl_install_cpanel_default(); } else if ( function_exists('rsssl_shell_installSSL') ) { $response = rsssl_shell_installSSL(); } else { //in case of auto ssl. $response = new RSSSL_RESPONSE('error', 'stop', ''); delete_option( "rsssl_le_start_installation" ); } if ( $response->status === 'success' ) { delete_option( "rsssl_le_start_installation" ); } return $response; } else if ( $server === 'plesk') { $response = rsssl_plesk_install(); if ( $response->status === 'success' ) { delete_option( "rsssl_le_start_installation" ); } return $response; } else { $status = 'error'; $action = 'stop'; $message = __("Not recognized server.", "really-simple-ssl"); } } catch (Exception $e) { $status = 'error'; $action = 'stop'; $message = __("Installation failed.", "really-simple-ssl"); } } else { $status = 'error'; $action = 'stop'; $message = __("The system is not ready for the installation yet. Please run the wizard again.", "really-simple-ssl"); } return new RSSSL_RESPONSE($status, $action, $message); } public function upgrade(){ if ( get_option('rsssl_upgrade_le_key') ) { // Check if the encryption key is not empty before upgrading. On slow servers, the write to wp-config.php can be // incomplete before the plugin gets here $key = $this->get_encryption_key(); if ( empty( $key ) ) { return; } delete_option('rsssl_upgrade_le_key'); $site_key = get_site_option( 'rsssl_le_key'); if ( $site_key ) { $options = [ 'directadmin_password', 'cpanel_password', 'cloudways_api_key', 'plesk_password', ]; foreach ( $options as $option ) { $option_value = rsssl_get_option( $option ); if ( $option_value ) { $decrypted = $this->decrypt_if_prefixed( $option_value, 'rsssl_', $site_key); $encrypted = $this->encrypt_with_prefix($decrypted); rsssl_update_option($option, $encrypted); } } delete_site_option( 'rsssl_le_key'); } } } /** * Cleanup the default message a bit * * @param $msg * * @return string|string[] */ private function cleanup_error_message($msg){ return str_replace(array( 'Refer to sub-problems for more information.', 'Error creating new order ::', ), '', $msg); } }
https://validator.w3.org/feed/docs/rss2.html