JezK

Edit File: class-file-edits-logger.php

<?php
namespace Simple_History\Loggers;

use Simple_History\Event_Details\Event_Details_Group;
use Simple_History\Event_Details\Event_Details_Group_Diff_Table_Formatter;
use Simple_History\Event_Details\Event_Details_Item;

/**
 * Logs edits to theme or plugin files done from Appearance -> Editor or Plugins -> Editor
 */
class File_Edits_Logger extends Logger {
	/** @var string Logger slug */
	public $slug = 'FileEditsLogger';

/**
	 * Get array with information about this logger
	 *
	 * @return array<string, mixed>
	 */
	public function get_info() {
		return array(
			'name'        => _x( 'File edits Logger', 'Logger: FileEditsLogger', 'simple-history' ),
			'description' => __( 'Logs edits to theme and plugin files', 'simple-history' ),
			'capability'  => 'manage_options',
			'messages'    => array(
				'theme_file_edited'  => __( 'Edited file "{file_name}" in theme "{theme_name}"', 'simple-history' ),
				'plugin_file_edited' => __( 'Edited file "{file_name}" in plugin "{plugin_name}"', 'simple-history' ),
			),
			'labels'      => array(
				'search' => array(
					'label'     => _x( 'Edited theme and plugin files', 'Plugin logger: file edits', 'simple-history' ),
					'label_all' => _x( 'All file edits', 'Plugin logger: file edits', 'simple-history' ),
					'options'   => array(
						_x( 'Edited theme files', 'Plugin logger: file edits', 'simple-history' ) => array(
							'theme_file_edited',
						),
						_x( 'Edited plugin files', 'Plugin logger: file edits', 'simple-history' ) => array(
							'plugin_file_edited',
						),
					),
				),
			),
		);
	}

/**
	 * Called when logger is loaded.
	 */
	public function loaded() {
		// Capture old file contents before WordPress saves the edit.
		// Priority 0 runs before WP's handler at priority 1.
		add_action( 'wp_ajax_edit-theme-plugin-file', array( $this, 'on_file_edit_ajax' ), 0 );
	}

/**
	 * Capture file contents before the AJAX edit handler saves.
	 *
	 * Runs at priority 0 on wp_ajax_edit-theme-plugin-file,
	 * before WordPress's own handler which writes the file.
	 */
	public function on_file_edit_ajax() {
		// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		$file = isset( $_POST['file'] ) ? wp_unslash( $_POST['file'] ) : '';

// Validate file path (same check WordPress core uses).
		if ( ! $file || validate_file( $file ) !== 0 ) {
			return;
		}

// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		$new_contents = isset( $_POST['newcontent'] ) ? wp_unslash( $_POST['newcontent'] ) : '';

// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		$plugin = isset( $_POST['plugin'] ) ? wp_unslash( $_POST['plugin'] ) : '';
		// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		$theme = isset( $_POST['theme'] ) ? wp_unslash( $_POST['theme'] ) : '';

// Gate on the same capabilities WP core's handler enforces, so this
		// priority-0 hook can't be used by lower-privileged users to trigger
		// file reads before core's own check runs.
		if ( $plugin && current_user_can( 'edit_plugins' ) && validate_file( $plugin ) === 0 ) {
			$this->capture_plugin_file_edit( $file, $plugin, $new_contents );
		} elseif ( $theme && current_user_can( 'edit_themes' ) && validate_file( $theme ) === 0 ) {
			$this->capture_theme_file_edit( $file, $theme, $new_contents );
		}
	}

/**
	 * Capture and log a plugin file edit.
	 *
	 * @param string $file Relative file name.
	 * @param string $plugin Plugin file path.
	 * @param string $new_contents New file contents.
	 */
	private function capture_plugin_file_edit( $file, $plugin, $new_contents ) {
		$file_full_path = WP_PLUGIN_DIR . '/' . $file;

$plugin_info = get_plugin_data( WP_PLUGIN_DIR . '/' . $plugin );

// phpcs:ignore WordPressVIPMinimum.Performance.FetchingRemoteData.FileGetContentsUnknown
		$old_contents = file_get_contents( $file_full_path );

if ( $old_contents === false || $old_contents === $new_contents ) {
			return;
		}

$this->info_message(
			'plugin_file_edited',
			array(
				'file_name'         => $file,
				'plugin_name'       => $plugin_info['Name'] ?? '',
				'plugin_version'    => $plugin_info['Version'] ?? '',
				'old_file_contents' => $old_contents,
				'new_file_contents' => $new_contents,
				'_occasionsID'      => self::class . "/file-edit/plugin/$plugin/$file",
			)
		);
	}

/**
	 * Capture and log a theme file edit.
	 *
	 * @param string $file Relative file name.
	 * @param string $stylesheet Theme stylesheet slug.
	 * @param string $new_contents New file contents.
	 */
	private function capture_theme_file_edit( $file, $stylesheet, $new_contents ) {
		$theme = wp_get_theme( $stylesheet );

if ( ! $theme->exists() ) {
			return;
		}

$file_full_path = $theme->get_stylesheet_directory() . '/' . $file;

// phpcs:ignore WordPressVIPMinimum.Performance.FetchingRemoteData.FileGetContentsUnknown
		$old_contents = file_get_contents( $file_full_path );

if ( $old_contents === false || $old_contents === $new_contents ) {
			return;
		}

$this->info_message(
			'theme_file_edited',
			array(
				'theme_name'            => $theme->name,
				'theme_stylesheet_path' => $theme->get_stylesheet(),
				'theme_stylesheet_dir'  => $theme->get_stylesheet_directory(),
				'file_name'             => $file,
				'file_dir'              => $file_full_path,
				'old_file_contents'     => $old_contents,
				'new_file_contents'     => $new_contents,
				'_occasionsID'          => self::class . "/file-edit/theme/$stylesheet/$file",
			)
		);
	}

/**
	 * Get output for row details
	 *
	 * @param object $row Log row.
	 * @return Event_Details_Group|string
	 */
	public function get_log_row_details_output( $row ) {
		$context     = $row->context;
		$message_key = $context['_message_key'] ?? null;

if ( ! $message_key ) {
			return '';
		}

return ( new Event_Details_Group() )
			->set_formatter( new Event_Details_Group_Diff_Table_Formatter() )
			->add_items(
				[
					new Event_Details_Item(
						[ 'new_file_contents', 'old_file_contents' ],
						__( 'File contents', 'simple-history' ),
					),
				]
			);
	}
}