- `notifylevel` will change what gets sent as part of the antivirus
notification emails based on the scan type. For example if set on
SCAN_RESULT_FOUND, it will not notify for any detections, if set to
SCAN_RESULT_ERROR, it will notify for both detections and errors.
- `threshold` will determine how far the lookback is when displaying the
status of the /reports/status (System Status) page. It will display as
an ERROR state if there has been scanner issues within this certain
threshold period
- As part of the above, scanner errors will now trigger a new event
which will be logged as antivirus_scan_data_error or
antivirus_scan_file_error. Due to the nature of it reading from the
logs table, it only works currently for the "Standard logging"
logstore.
In the initial implementation, infected file cleanup and exception throwing
was done at the plugin level. This is somewhat incorrect from plugin
responsibility perspective. The patch moves cleanup and exception logic to
the manager. Antivirus plugin responsibility is limited to perform scanning
and respond with one of the result statuses defined in the
\core\antivirus\scanner.
This implements the use of class autoloading for antivirus plugin. Base
abstract class, exception class and manager are using namespace
core\antivirus, this is because all three class files are located in
/lib/classes/antivirus/ (see \core_component::classloader for convention
details).
Kevin Pham