<?php
//Exit if get it directly!
if(!defined('ABSPATH')){exit;}

if( !class_exists( 'tebravo_malware_scanner' ) )
{
	class tebravo_malware_scanner extends tebravo_antivirus_utility{
		
		public $pid;
		public $file;
		public $file_report;
		public $line_number;
		public $file_content_data;
		public $skipped_list = array();
		public $max_size;
		public $timer_ajax;
		public $max_files_to_scan;
		private $_regex;
		
		//constructor
		public function __construct()
		{
			$this->_regex = $this->regex();
			$this->skipped_list = array("zip", "tar", "gz", "gz.tar", "htaccess", "exe");
			$this->max_size = 1000*1000; //in bytes
			//if( defined('TEBRAVO_MAX_SCAN_FILESIZE') ){$this->max_size= TEBRAVO_MAX_SCAN_FILESIZE;}
			$this->timer_ajax = 400; //in seconds
			$this->max_files_to_scan= 5; //digit
		}
		
		public function scan_64 ( $file )
		{
			$content = @file_get_contents( $file );
			if(preg_match('/(?<![a-z0-9_])eval\((base64|eval|\$_|\$\$|\$[A-Za-z_0-9\{]*(\(|\{|\[))/i',$content)) {
				
				return true;
			}
			
			return false;
		}
		
		public function scan( $file )
		{
			global $wpdb;
			
			//PHP settings and server resources
			$this->set_display_errors( 'off' );
			
			if( !is_readable( dirname($file)))
			{
				//
			}
			
			$scan_64 = $this-> scan_64( $file );
			$flag = $scan_64;
			
			if( $scan_64 == true)
			{
				$this->file_report = '<i>SHELL</i> ';
				$this->line_number = 'UNKNOWN';
			}
			
			if(false === strpos( basename( $file), '.htaccess')
					&& is_readable( dirname( $file ))
					&& file_exists( $file)
					&& !is_dir( $file )
					&& false === strpos(basename( $file ), $this->pid)
					&& false === strpos($file , 'scan_log.txt')
					&& false === strpos( $file, '/bravo-security/GeoIP.dat')
					&& ! $this->check_safe_list( $file)
					&& !in_array(tebravo_files::extension($file), $this->skipped_list)
					&& filesize( $file ) <= $this->max_size 
					&& is_file( $file )
					&& !empty( $file )){
				
				$content = @file_get_contents( $file );
				$this->file_content_data = $content;
				
				$lines = @file( $file );
				$tokens = @token_get_all($content);
				
				if(is_array($tokens)){
					foreach ($tokens as $token)
					{
						if( is_array($token)){
							if( $token[0] == T_STRING)
							{
								if( array_key_exists( $token[1], $this->_regex) )
								{
									$this->file_report = '<i><u>'.$token[1].'</u></i> at line: ['.$token[2].'] | Risk: <i>'.$this->get_risk($this->_regex[$token[1]][1]).'</i>';
									$this->line_number = $token[2];
									
									#echo $this->file_report.'<br />';
									
									$flag = true;
									
								}
							}
						}
					}
				}
				
			}
			
			
			return $flag;
		}
		
		public function get_risk($level){
			switch ($level) {
				case 1: $ret = 'Low'; break;
				case 2: $ret = 'Medium'; break;
				case 3: $ret = 'High'; break;
				default: $ret = 'Unknown';
			}
			return $ret;
		}
		
		public function get_linenumber( $content )
		{
			$lines = explode("\n", $content);
			
			for ($line = 0; $line < count($lines); $line++)
			{
				if (preg_match_all($this->_regex, $lines[$line], $matches)) {
					return ($line + 1);
				}
			}
		}
		
		/**
		 * This plugin was copied from plugin-inspector wordpress plugin with some updates
		 * @return string[][]|number[][]
		 */
		public function regex(){
			
			return array(
					'eval' => array('May be used to execute malicious code on the web server. Often paired with base64_decode function to execute malicious code.',3),
					'system' => array('May be used to get/change vital system information or to call unwanted system utilities.',3),
					'base64_decode' => array('Decode data encoded with MIME base64. May be used to obfuscate (hide) malicious code. Often paired with eval function to execute malicious code.',3),
					'shell_exec' => array('Execute command via shell and return the complete output as a string.',3),
					'exec' => array('Execute almost any system program on the web server.',3),
					'passthru' => array('Execute almost any system program on the web server and display raw output.',3),
					'pcntl_exec' => array('Execute specified program on the web server in current process space.',3),
					'proc_open' => array('Execute a command on the web server and open file pointers for input/output.',3),
					'popen' => array('Open process (system program) file pointer on the web server.',3),
					'dl' => array('Load a PHP extension on the web server at runtime.',3),
					'socket_create' => array('Create point for network connection with any remote host. May be used to load malicious code from the external source without any restrictions.',3),
					'curl_exec' => array('Load external data from any web server. May be used to load malicious code from the external source without any restrictions.',2),
					'create_function' => array('Create an anonymous (lambda-style) function. A native anonymous function should be used instead.',1),
			);
		}
		
		
	}
}

?>