<?php
/**
 * Check covering filesystem permissions of critical files.
 *
 * @package AardwolfSecurityScanner
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * wp-config.php and key directories have overly permissive permissions.
 */
class Aardwolf_Check_File_Permissions extends Aardwolf_Check {

	public function id() {
		return 'file_permissions';
	}

	public function label() {
		return __( 'Critical file permissions are sane', 'aardwolf-security-scanner' );
	}

	public function category() {
		return __( 'Configuration Hardening', 'aardwolf-security-scanner' );
	}

	public function run() {
		$findings = array();

		// Locate wp-config.php — it may live one level above ABSPATH.
		$config_path = '';
		if ( file_exists( ABSPATH . 'wp-config.php' ) ) {
			$config_path = ABSPATH . 'wp-config.php';
		} elseif ( file_exists( dirname( ABSPATH ) . '/wp-config.php' ) ) {
			$config_path = dirname( ABSPATH ) . '/wp-config.php';
		}

		if ( $config_path && is_readable( $config_path ) ) {
			$perms = fileperms( $config_path ) & 0777;
			// World-readable or world-writable wp-config is dangerous on shared
			// hosting where other accounts share the filesystem.
			if ( $perms & 0004 || $perms & 0002 ) {
				$findings[] = sprintf(
					/* translators: %s: octal permissions. */
					__( 'wp-config.php is %s — it is readable or writable by other users on the server. Its database credentials and salts could be stolen on a shared host.', 'aardwolf-security-scanner' ),
					decoct( $perms )
				);
			}
		}

		// ABSPATH should not be world-writable.
		if ( is_dir( ABSPATH ) ) {
			$dir_perms = fileperms( ABSPATH ) & 0777;
			if ( $dir_perms & 0002 ) {
				$findings[] = sprintf(
					/* translators: %s: octal permissions. */
					__( 'The WordPress root directory is world-writable (%s), which would let any local user drop malicious files into your site.', 'aardwolf-security-scanner' ),
					decoct( $dir_perms )
				);
			}
		}

		if ( ! empty( $findings ) ) {
			return $this->fail(
				Aardwolf_Check_Result::SEVERITY_HIGH,
				implode( "\n", $findings ),
				__( 'Tighten permissions: wp-config.php should be 0640 or 0600, directories 0755 and files 0644. Never use 0777. On shared hosting confirm your files are owned by your account and not group/other accessible. Your host can help apply the correct ownership.', 'aardwolf-security-scanner' ),
				'https://wordpress.org/documentation/article/changing-file-permissions/'
			);
		}

		return $this->pass( __( 'wp-config.php and the WordPress root have safe permissions.', 'aardwolf-security-scanner' ) );
	}
}