feat: Support for Contact Form 7 (#6)

Author: michaelwittig

README.md

@@ -25,18 +25,39 @@ Please contact [hello@attachmentav.com](mailto:hello@attachmentav.com) in case y
 
 ## Development
 
+To clear the database, run:
+
+```
+docker compose down --volumes
+```
+
 Use the following command to spin up a development environment.
 
 ```
 docker compose up
 ```
 
+To make email work:
+
+```
+docker ps
+CONTAINER ID   IMAGE                  COMMAND  
+93b4f65875ae   wordpress:latest       "docker-entrypoint.s…"   6 hours ago   Up 6 hours   0.0.0.0:80->80/tcp                  attachmentav-wordpress-wordpress-1
+
+docker exec -it 93b4f65875ae /bin/bash
+
+apt-get update && apt-get install -y sendmail && apt-get clean
+/usr/sbin/sendmail -bd
+```
+
 Optionally use `ngrok` to get a publicly reachable development domain.
 
 ```
 ngrok http http://localhost:80
 ```
 
+> You might need to set the `siteurl` an `home` option in [phpMyAdmin](http://localhost:8081/index.php?route=/sql&pos=0&db=wordpress&table=wp_options) to `http://localhost` or the ngrok URL if this changed since last time.
+
 Inside PHP, use `error_log('log line');` or `error_log(print_r($var, true));` to print debug logs.
 
 ### Release

compose.yaml

@@ -33,9 +33,9 @@ services:
   phpmyadmin:
     image: 'phpmyadmin:5.2.2'
     ports:
-    - '8081:80'
+      - '8081:80'
     depends_on:
-    - db
+      - db
     environment:
       PMA_HOST: db
 volumes:

plugin/README.txt

@@ -3,7 +3,7 @@ Contributors: andreaswittig,michaelwittig
 Tags: malware,virus,antivirus,malware scanner,security
 Requires at least: 6.0
 Tested up to: 6.8
-Stable tag: 1.3
+Stable tag: 1.4
 License: GPLv2
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -45,6 +45,7 @@ attachmentAV scans all files uploaded via:
 * The plugin [WPForms](https://wpforms.com/)
 * The plugin [Formidable Forms](https://formidableforms.com/)
 * The plugin [WordPress File Upload](https://wordpress.org/plugins/wp-file-upload/)
+* The plugin [Contact Form 7](https://contactform7.com/)
 
 == Screenshots ==
 
@@ -53,6 +54,9 @@ attachmentAV scans all files uploaded via:
 
 == Changelog ==
 
+= 1.4.0 =
+* Support for plugin Contact Form 7 added
+
 = 1.3.0 =
 * Support Wordpress 6.8
 

plugin/admin/class-attachmentav-admin.php

@@ -119,12 +119,18 @@ public function page_init() {
 			array( $this, 'sanitize_text' ) // Sanitize
 		);
 
+		register_setting(
+			'attachmentav', // Option group
+			'attachmentav_scan_wpcf7', // Option name
+			array( $this, 'sanitize_text' ) // Sanitize
+		);
+
 		add_settings_section(
 			'attachmentav_subscription', // ID
 			'Subscription', // Title
 			array( $this, 'print_subscription_section' ), // Callback
 			'attachmentav' // Page
-		);  
+		);
 
 		add_settings_field(
 			'attachmentav_api_key', // ID
@@ -134,6 +140,14 @@ public function page_init() {
 			'attachmentav_subscription' // Section           
 		);
 
+		add_settings_field(
+			'attachmentav_upsell', // ID
+			'API Integration Available', // Title 
+			array( $this, 'print_block_upsell' ), // Callback
+			'attachmentav', // Page
+			'attachmentav_subscription' // Section           
+		);
+
 		add_settings_section(
 			'attachmentav_general', // ID
 			'General', // Title
@@ -172,6 +186,14 @@ public function page_init() {
 			'attachmentav_plugins' // Section           
 		);
 
+		add_settings_field(
+			'attachmentav_scan_wpcf7', // ID
+			'Scan files uploaded with plugin "Contact Form 7"?', // Title 
+			array( $this, 'print_block_scan_wpcf7' ), // Callback
+			'attachmentav', // Page
+			'attachmentav_plugins' // Section           
+		);
+
 		add_settings_field(
 			'attachmentav_scan_formidable', // ID
 			'Scan files uploaded with plugin "Formidable Forms"?', // Title 
@@ -195,6 +217,11 @@ public function print_subscription_section()
 		print '<a target="_blank" href="https://attachmentav.com/subscribe/wordpress/">Subscribe to attachmentAV</a> and enter the API key below.';
 	}
 
+	public function print_block_upsell()
+	{
+		print 'Take our antivirus protection beyond WordPress. Our API integrates with any workflow or application to secure your data wherever it lives. <a target="_blank" href="https://attachmentav.com/solution/virus-malware-scan-api/?utm_source=dashboard&utm_campaign=upsell">Learn more</a>!';
+	}
+
 	public function print_general_section()
 	{
 		print 'Enter your settings below:';
@@ -236,6 +263,14 @@ public function print_block_scan_wpfileupload() {
 		}
 	}
 
+	public function print_block_scan_wpcf7() {
+		if (get_option('attachmentav_scan_wpcf7') != 'false') {
+			print('<select name="attachmentav_scan_wpcf7"><option value="true" selected>Yes</option><option value="false">No</option></select>');
+		} else {
+			print('<select name="attachmentav_scan_wpcf7"><option value="true">Yes</option><option value="false" selected>No</option></select>');
+		}
+	}
+
 	public function print_block_scan_formidable() {
 		print('Always active');
 	}

plugin/attachmentav.php

@@ -16,7 +16,7 @@
  * Plugin Name:       attachmentAV
  * Plugin URI:        https://attachmentav.com/solution/malware-protection-for-wordpress/
  * Description:       Protect your blog from malware. Scan attachments for viruses, worms, and trojans by sending them to the attachmentAV API powered by Sophos. To get started, please go to your <a href="/wp-admin/admin.php?page=attachmentav">attachmentAV Settings page</a> to set up your API key.
- * Version:           1.3.0
+ * Version:           1.4.0
  * Author:            widdix GmbH
  * License:           GPL-2.0+
  * License URI:       http://www.gnu.org/licenses/gpl-2.0.txt
@@ -34,7 +34,7 @@
  * Start at version 1.0.0 and use SemVer - https://semver.org
  * Rename this for your plugin and update it as you release new versions.
  */
-define( 'ATTACHMENTAV_VERSION', '1.3.0' );
+define( 'ATTACHMENTAV_VERSION', '1.4.0' );
 
 /**
  * The code that runs during plugin activation.

plugin/includes/class-attachmentav-loader.php

@@ -350,6 +350,45 @@ function wfu_after_file_loaded($changable_data, $additional_data) {
 		if (get_option('attachmentav_scan_wpfileupload') != 'false') {
 			add_filter('wfu_after_file_loaded', 'wfu_after_file_loaded', 10, 2);
 		}
+
+		function wpcf7_validate_file($result, $tag, $additional_data) {
+			foreach ($additional_data['uploaded_files'] as $file) {
+				$endpoint = 'https://eu.developer.attachmentav.com/v1/scan/sync/binary';
+				$response = wp_remote_post( $endpoint, array(
+					'timeout' => 30,
+					'body'    => file_get_contents($file),
+					'headers' => array(
+						'x-api-key' => get_option('attachmentav_api_key'),
+						'x-wordpress-site-url' => get_site_url(),
+						'Content-Type' => 'application/octet-stream',
+					),
+				));
+				if (is_wp_error($response)) {
+					$error_messages = implode(',', $response->get_error_messages());
+					$result->invalidate($tag, "Failed to scan uploaded file for malware ({$error_messages}).");
+				} else {
+					if ($response['response']['code'] == 200) {
+						$body = json_decode($response['body'], true);
+						if ($body['status'] == 'no' && get_option('attachmentav_block_unscannable') == 'true') {
+							$result->invalidate($tag, "Could not scan file (e.g., encrypted files). Upload blocked.");
+						} else if ($body['status'] == 'infected') {
+							$result->invalidate($tag, "Uploaded file is infected ({$body['finding']}). Upload blocked.");
+						}
+					} else if ($response['response']['code'] == 401) {
+						$result->invalidate($tag, "Could not scan uploaded file for malware as license key is missing or invalid.");
+					} else if ($response['response']['code'] == 429) {
+						$result->invalidate($tag, "You've reached the maximum number of malware scans.");
+					} else {
+						$result->invalidate($tag, "Failed to scan uploaded file for malware due to unknown error.");
+					}
+				}
+			}
+			return $result;
+		}
+		if (get_option('attachmentav_scan_wpcf7') != 'false') {
+			add_filter('wpcf7_validate_file*', 'wpcf7_validate_file', 20, 3);
+			add_filter('wpcf7_validate_file', 'wpcf7_validate_file', 20, 3);
+		}
 	}
 
 }