Anti-Malware Security and Brute-Force Firewall - Version 4.17.69

Version Description

  • Updated code for compatibility with WP 4.9.8 (latest release).
  • Fixed PHP Notice for the unknown offset of SERVER_parts.
  • Escaped single-quotes in translated strings for use within JavaScript.
Download this release

Release Info

Developer scheeeli
Plugin Icon 128x128 Anti-Malware Security and Brute-Force Firewall
Version 4.17.69
Comparing to
See all releases

Code changes from version 4.17.68 to 4.17.69

Files changed (3) hide show
  1. images/index.php +1 -1
  2. index.php +18 -3
  3. readme.txt +15 -57
images/index.php CHANGED
@@ -57,7 +57,7 @@ else
57
  $SERVER_HTTP = "NULL://not.anything.com";
58
  if (isset($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"])
59
  $SERVER_HTTP .= ":".$_SERVER["SERVER_PORT"];
60
- $SERVER_parts = explode(":", $SERVER_HTTP);
61
  if ((isset($_SERVER["HTTPS"]) && ($_SERVER["HTTPS"] == "on" || $_SERVER["HTTPS"] == 1)) || (count($SERVER_parts) > 2 && $SERVER_parts[2] == "443"))
62
  $GLOBALS["GOTMLS"]["tmp"]["protocol"] = "https:";
63
  else
57
  $SERVER_HTTP = "NULL://not.anything.com";
58
  if (isset($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"])
59
  $SERVER_HTTP .= ":".$_SERVER["SERVER_PORT"];
60
+ $SERVER_parts = explode(":", $SERVER_HTTP.":");
61
  if ((isset($_SERVER["HTTPS"]) && ($_SERVER["HTTPS"] == "on" || $_SERVER["HTTPS"] == 1)) || (count($SERVER_parts) > 2 && $SERVER_parts[2] == "443"))
62
  $GLOBALS["GOTMLS"]["tmp"]["protocol"] = "https:";
63
  else
index.php CHANGED
@@ -8,7 +8,7 @@ Author URI: http://wordpress.ieonly.com/category/my-plugins/anti-malware/
8
  Contributors: scheeeli, gotmls
9
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=QZHD8QHZ2E7PE
10
  Description: This Anti-Virus/Anti-Malware plugin searches for Malware and other Virus like threats and vulnerabilities on your server and helps you remove them. It's always growing and changing to adapt to new threats so let me know if it's not working for you.
11
- Version: 4.17.68
12
  */
13
  if (isset($_SERVER["DOCUMENT_ROOT"]) && ($SCRIPT_FILE = str_replace($_SERVER["DOCUMENT_ROOT"], "", isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:isset($_SERVER["SCRIPT_NAME"])?$_SERVER["SCRIPT_NAME"]:"")) && strlen($SCRIPT_FILE) > strlen("/".basename(__FILE__)) && substr(__FILE__, -1 * strlen($SCRIPT_FILE)) == substr($SCRIPT_FILE, -1 * strlen(__FILE__)))
14
  include(dirname(__FILE__)."/safe-load/index.php");
@@ -949,6 +949,21 @@ function GOTMLS_update_definitions() {
949
  $finJS .= "\nif (foundUpdates = document.getElementById('GOTMLS_definitions_date')) foundUpdates.innerHTML = '$new_ver';";
950
  } elseif (is_array($GOTnew_definitions) && count($GOTnew_definitions))
951
  $finJS .= "\nalert('Definition update $new_ver could not be saved because update_option Failed! $debug');";
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
952
  die('//<![CDATA[
953
  var inc_form = "";
954
  if (foundUpdates = document.getElementById("autoUpdateDownload"))
@@ -1231,13 +1246,13 @@ function update_status(title, time) {
1231
  if ($MAX++ == 6) {
1232
  $quarantineCountOnly = GOTMLS_get_quarantine(true);
1233
  $vars .= ", $scan_group=$quarantineCountOnly";
1234
- echo "/*--{$gt}*"."/\n\tif ($scan_group > 0)\n\t\tscan_state = ' potential'; \n\telse\n\t\tscan_state = '';\n\tdivHTML += '</ul><ul style=\"text-align: left;\"><li class=\"GOTMLS_li\"><a href=\"admin.php?page=GOTMLS-View-Quarantine\" class=\"GOTMLS_plugin".("'+scan_state+'\" title=\"".GOTMLS_View_Quarantine_LANGUAGE)."\">'+$scan_group+'&nbsp;'+($scan_group==1?('$scan_name').slice(0,-1):'$scan_name')+'</a></li>';\n/*{$lt}!--*"."/";
1235
  $found = "Found ";
1236
  $fix_button_js = "\n\t\tdis='block';";
1237
  } else {
1238
  $vars .= ", $scan_group=0";
1239
  if ($found && !in_array($scan_group, $GLOBALS["GOTMLS"]["log"]["settings"]["check"]))
1240
- $potential_threat = ' potential" title="'.__("You are not currently scanning for this type of threat!",'gotmls');
1241
  else
1242
  $potential_threat = "";
1243
  echo "/*--{$gt}*"."/\n\tif ($scan_group > 0) {\n\t\tscan_state = ' href=\"#found_$scan_group\" onclick=\"$li_js showhide(\\'found_$scan_group\\', true);\" class=\"GOTMLS_plugin $scan_group\"';$fix_button_js".($MAX>6?"\n\tshowhide('found_$scan_group', true);":"")."\n\t} else\n\t\tscan_state = ' class=\"GOTMLS_plugin$potential_threat\"';\n\tdivHTML += '<li class=\"GOTMLS_li\"".(($found && $scan_group == "potential" && !in_array($scan_group, $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check"]))?' style="display: none;"':"")."><a'+scan_state+'>$found'+$scan_group+'&nbsp;'+($scan_group==1?('$scan_name').slice(0,-1):'$scan_name')+'</a></li>';\n/*{$lt}!--*"."/";
8
  Contributors: scheeeli, gotmls
9
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=QZHD8QHZ2E7PE
10
  Description: This Anti-Virus/Anti-Malware plugin searches for Malware and other Virus like threats and vulnerabilities on your server and helps you remove them. It's always growing and changing to adapt to new threats so let me know if it's not working for you.
11
+ Version: 4.17.69
12
  */
13
  if (isset($_SERVER["DOCUMENT_ROOT"]) && ($SCRIPT_FILE = str_replace($_SERVER["DOCUMENT_ROOT"], "", isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:isset($_SERVER["SCRIPT_NAME"])?$_SERVER["SCRIPT_NAME"]:"")) && strlen($SCRIPT_FILE) > strlen("/".basename(__FILE__)) && substr(__FILE__, -1 * strlen($SCRIPT_FILE)) == substr($SCRIPT_FILE, -1 * strlen(__FILE__)))
14
  include(dirname(__FILE__)."/safe-load/index.php");
949
  $finJS .= "\nif (foundUpdates = document.getElementById('GOTMLS_definitions_date')) foundUpdates.innerHTML = '$new_ver';";
950
  } elseif (is_array($GOTnew_definitions) && count($GOTnew_definitions))
951
  $finJS .= "\nalert('Definition update $new_ver could not be saved because update_option Failed! $debug');";
952
+ if (isset($_REQUEST["UPDATE_core"]) && ($_REQUEST["UPDATE_core"] == $wp_version) && isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"][$wp_version])) {
953
+ foreach ($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"][$_REQUEST["UPDATE_core"]] as $file => $md5) {
954
+ if (is_file(ABSPATH.$file)) {
955
+ $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = file_get_contents(ABSPATH.$file);
956
+ if (GOTMLS_check_threat($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"], ABSPATH.$file)) {
957
+ if (isset($GLOBALS["GOTMLS"]["tmp"]["new_contents"]) && isset($_REQUEST["UPDATE_restore"]) && (md5($GLOBALS["GOTMLS"]["tmp"]["new_contents"])."O".strlen($GLOBALS["GOTMLS"]["tmp"]["new_contents"]) == $_REQUEST["UPDATE_restore"]))
958
+ $autoUpJS .= "<li>Core File Restored: $file</li>";
959
+ else
960
+ $autoUpJS .= "<li>Core File MODIFIED: $file (".md5($GLOBALS["GOTMLS"]["tmp"]["file_contents"])."O".strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"])." => $md5)</li>";
961
+ }
962
+ } else
963
+ $autoUpJS .= "<li>Core File MISSING: $file</li>";
964
+ }
965
+ $autoUpJS .= '<div class="update">Definition update: '.$_REQUEST["UPDATE_core"].' checked '.count($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"][$_REQUEST["UPDATE_core"]]).' core files!</div>';
966
+ }
967
  die('//<![CDATA[
968
  var inc_form = "";
969
  if (foundUpdates = document.getElementById("autoUpdateDownload"))
1246
  if ($MAX++ == 6) {
1247
  $quarantineCountOnly = GOTMLS_get_quarantine(true);
1248
  $vars .= ", $scan_group=$quarantineCountOnly";
1249
+ echo "/*--{$gt}*"."/\n\tif ($scan_group > 0)\n\t\tscan_state = ' potential'; \n\telse\n\t\tscan_state = '';\n\tdivHTML += '</ul><ul style=\"text-align: left;\"><li class=\"GOTMLS_li\"><a href=\"admin.php?page=GOTMLS-View-Quarantine\" class=\"GOTMLS_plugin".("'+scan_state+'\" title=\"".GOTMLS_strip4java(GOTMLS_View_Quarantine_LANGUAGE))."\">'+$scan_group+'&nbsp;'+($scan_group==1?('$scan_name').slice(0,-1):'$scan_name')+'</a></li>';\n/*{$lt}!--*"."/";
1250
  $found = "Found ";
1251
  $fix_button_js = "\n\t\tdis='block';";
1252
  } else {
1253
  $vars .= ", $scan_group=0";
1254
  if ($found && !in_array($scan_group, $GLOBALS["GOTMLS"]["log"]["settings"]["check"]))
1255
+ $potential_threat = ' potential" title="'.GOTMLS_strip4java(__("You are not currently scanning for this type of threat!",'gotmls'));
1256
  else
1257
  $potential_threat = "";
1258
  echo "/*--{$gt}*"."/\n\tif ($scan_group > 0) {\n\t\tscan_state = ' href=\"#found_$scan_group\" onclick=\"$li_js showhide(\\'found_$scan_group\\', true);\" class=\"GOTMLS_plugin $scan_group\"';$fix_button_js".($MAX>6?"\n\tshowhide('found_$scan_group', true);":"")."\n\t} else\n\t\tscan_state = ' class=\"GOTMLS_plugin$potential_threat\"';\n\tdivHTML += '<li class=\"GOTMLS_li\"".(($found && $scan_group == "potential" && !in_array($scan_group, $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check"]))?' style="display: none;"':"")."><a'+scan_state+'>$found'+$scan_group+'&nbsp;'+($scan_group==1?('$scan_name').slice(0,-1):'$scan_name')+'</a></li>';\n/*{$lt}!--*"."/";
readme.txt CHANGED
@@ -5,10 +5,10 @@ Author URI: http://wordpress.ieonly.com/category/my-plugins/anti-malware/
5
  Contributors: scheeeli, gotmls
6
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=QZHD8QHZ2E7PE
7
  Tags: security, firewall, anti-malware, scanner, automatic, repair, remove, malware, virus, threat, hacked, malicious, infection, timthumb, exploit, block, brute-force, wp-login, patch, antimalware, revslider, Revolution Slider
8
- Version: 4.17.68
9
- Stable tag: 4.17.68
10
  Requires at least: 3.3
11
- Tested up to: 4.9.7
12
 
13
  This Anti-Malware scanner searches for Malware, Viruses, and other security threats and vulnerabilities on your server and it helps you fix them.
14
 
@@ -27,7 +27,7 @@ This Anti-Malware scanner searches for Malware, Viruses, and other security thre
27
  * Check the integrity of your WordPress Core files.
28
  * Automatically download new Definition Updates when running a Complete Scan.
29
 
30
- Updated July 28th
31
 
32
  Register this plugin at [GOTMLS.NET](http://gotmls.net/) and get access to new definitions of "Known Threats" and added features like Automatic Removal, plus patches for specific security vulnerabilities like old versions of timthumb. Updated definition files can be downloaded automatically within the admin once your Key is registered. Otherwise, this plugin just scans for "Potential Threats" and leaves it up to you to identify and remove the malicious ones.
33
 
@@ -94,6 +94,11 @@ sucuri.net caches their scan results and will not refresh the scan until you cli
94
 
95
  == Changelog ==
96
 
 
 
 
 
 
97
  = 4.17.68 =
98
  * Updated code for compatibility with WP 4.9.7 (latest release).
99
  * Removed wrong size dashicon from Settings link in plugin list.
@@ -242,45 +247,25 @@ sucuri.net caches their scan results and will not refresh the scan until you cli
242
  * Automatically whitelisted the unmodified WordPress Core files.
243
  * Made more improvements to the Brute-Force protection patch and other minor cosmetic changes to the interface.
244
  * Protected the HTML in my plugin from filter injections and fixed a few other minor bugs.
245
-
246
- = 4.14.65 =
247
  * Fixed a problem with deleting files from the Quarantine folder.
248
  * Added a descriptive reason to the error displayed if the fix was unsuccessful.
249
  * Added link to restore the default location of the Examine Results window.
250
-
251
- = 4.14.64 =
252
  * Improved the encoding of definition updates so that they would not be blocked by poorly written firewall rules.
253
  * Suppressed the "Please make a donation" nag if the fix was unsuccessful, to avoid confusion over premium services.
254
-
255
- = 4.14.63 =
256
  * Removed debug alert from initial session check.
257
-
258
- = 4.14.62 =
259
  * Improved rewrite compatibility of session check for the Brute-Force Protection Installation.
260
-
261
- = 4.14.59 =
262
  * Improved session check for the option to Install Brute-Force Protection and added an error message on failure.
263
  * Improved support for Multisite by only allowing Network Admins access to the Anti-Malware menu.
264
-
265
- = 4.14.55 =
266
  * Added link to view a simple scan history on the Quarantine page.
267
  * Updated firewall to better protect agains new variations of the RevSlider Exploit.
268
  * Improved check for session support before giving the option to Install Brute-Force patch.
269
-
270
- = 4.14.54 =
271
  * Added option to skip scanning the Quarantined files.
272
  * Updated Brute-Force patch to fix the problem of being included more that once.
273
  * Fixed a few minor bugs (better window positioning and css, cleaner results page, updated new help tab, etc.).
274
  * Made sure that the plugin does not check my servers for updates unless you have registered (this opt-in requirement is part of the WordPress Repository Guidelines).
275
-
276
- = 4.14.52 =
277
  * Added exception for the social.png files to the skip files by extension list.
278
  * Fixed removal of Known Threats from files in the Quarantine directory.
279
-
280
- = 4.14.51 =
281
  * Block SoakSoak and other malware from exploiting the Slider Revolution Vulnerability (THIS IS A WIDESPREAD THREAT RIGHT NOW).
282
-
283
- = 4.14.50 =
284
  * Enabled the Brute-Force protection option directly from the Settings page.
285
  * Fixed window position to auto-adjust on small screens.
286
 
@@ -358,6 +343,9 @@ sucuri.net caches their scan results and will not refresh the scan until you cli
358
 
359
  == Upgrade Notice ==
360
 
 
 
 
361
  = 4.17.68 =
362
  Updated code for compatibility with WP 4.9.7, removed dashicon from Settings link and the broken vote WORKS link, and reordered priorety on fixing Known Threats.
363
 
@@ -452,46 +440,16 @@ Hardened against XSS in the admin, changed encoding of the index.php file in the
452
  Extended execution_time during the Fix process, added a Quarantine log to the database, and fixed a couple of minor bugs.
453
 
454
  = 4.15.16 =
455
- Created automatic definition updates that include WordPress Core files for integrity checking and whitelisting, made more improvements to the Brute-Force protection patch, and a few other cosmetic changes and minor bug fixes.
456
-
457
- = 4.14.65 =
458
- Fixed a problem with deleting files from the Quarantine folder, added more descriptive errors and a link to restore the default location of the Examine Results window.
459
-
460
- = 4.14.64 =
461
- Improved the encoding of definition updates and suppressed the "Please make a donation" nag if the fix was unsuccessful.
462
-
463
- = 4.14.63 =
464
- Removed debug alert from initial session check.
465
-
466
- = 4.14.62 =
467
- Improved rewrite compatibility of session check for the Brute-Force Protection Installation.
468
-
469
- = 4.14.59 =
470
- Improved session check for the Brute-Force Protection and support for Multisite menu.
471
-
472
- = 4.14.55 =
473
- Added link to scan history, improved check for session support before giving installing Brute-Force patch, and updated firewall to better protect agains the RevSlider Exploit.
474
-
475
- = 4.14.54 =
476
- Added option to skip scanning the Quarantine, updated Brute-Force patch, and fixed a few minor bugs.
477
-
478
- = 4.14.52 =
479
- Added exception for the social.png files to the skip files by extension list, and fixed removal of Known Threats from files in the Quarantine directory.
480
-
481
- = 4.14.51 =
482
- Block SoakSoak and other malware from exploiting the Slider Revolution Vulnerability (THIS IS A WIDESPREAD THREAT RIGHT NOW).
483
-
484
- = 4.14.50 =
485
- Enabled the Brute-Force protection from the Settings page and fixed window position on small screens.
486
 
487
  = 4.14.47 =
488
  Major upgrade to the protection for Brute-Force attempts, and a bug fix for resetting the permissions of read-only files (Plus many other improvement from v3.X: see Changelog for details).
489
 
490
  = 3.07.06 =
491
- Added SSL support for definition updates and upgraded the Whitelist feature (Plus many other improvement from v1.3: see Changelog for details).
492
 
493
  = 1.3.02.15 =
494
- Improved security on the Quarantine directory to fix the 500 error on some servers (Plus many other improvement from v1.2: see Changelog for details).
495
 
496
  = 1.2.03.23 =
497
  First versions available for WordPress (code removed, no longer compatible).
5
  Contributors: scheeeli, gotmls
6
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=QZHD8QHZ2E7PE
7
  Tags: security, firewall, anti-malware, scanner, automatic, repair, remove, malware, virus, threat, hacked, malicious, infection, timthumb, exploit, block, brute-force, wp-login, patch, antimalware, revslider, Revolution Slider
8
+ Version: 4.17.69
9
+ Stable tag: 4.17.69
10
  Requires at least: 3.3
11
+ Tested up to: 4.9.8
12
 
13
  This Anti-Malware scanner searches for Malware, Viruses, and other security threats and vulnerabilities on your server and it helps you fix them.
14
 
27
  * Check the integrity of your WordPress Core files.
28
  * Automatically download new Definition Updates when running a Complete Scan.
29
 
30
+ Updated August 7th
31
 
32
  Register this plugin at [GOTMLS.NET](http://gotmls.net/) and get access to new definitions of "Known Threats" and added features like Automatic Removal, plus patches for specific security vulnerabilities like old versions of timthumb. Updated definition files can be downloaded automatically within the admin once your Key is registered. Otherwise, this plugin just scans for "Potential Threats" and leaves it up to you to identify and remove the malicious ones.
33
 
94
 
95
  == Changelog ==
96
 
97
+ = 4.17.69 =
98
+ * Updated code for compatibility with WP 4.9.8 (latest release).
99
+ * Fixed PHP Notice for the unknown offset of SERVER_parts.
100
+ * Escaped single-quotes in translated strings for use within JavaScript.
101
+
102
  = 4.17.68 =
103
  * Updated code for compatibility with WP 4.9.7 (latest release).
104
  * Removed wrong size dashicon from Settings link in plugin list.
247
  * Automatically whitelisted the unmodified WordPress Core files.
248
  * Made more improvements to the Brute-Force protection patch and other minor cosmetic changes to the interface.
249
  * Protected the HTML in my plugin from filter injections and fixed a few other minor bugs.
 
 
250
  * Fixed a problem with deleting files from the Quarantine folder.
251
  * Added a descriptive reason to the error displayed if the fix was unsuccessful.
252
  * Added link to restore the default location of the Examine Results window.
 
 
253
  * Improved the encoding of definition updates so that they would not be blocked by poorly written firewall rules.
254
  * Suppressed the "Please make a donation" nag if the fix was unsuccessful, to avoid confusion over premium services.
 
 
255
  * Removed debug alert from initial session check.
 
 
256
  * Improved rewrite compatibility of session check for the Brute-Force Protection Installation.
 
 
257
  * Improved session check for the option to Install Brute-Force Protection and added an error message on failure.
258
  * Improved support for Multisite by only allowing Network Admins access to the Anti-Malware menu.
 
 
259
  * Added link to view a simple scan history on the Quarantine page.
260
  * Updated firewall to better protect agains new variations of the RevSlider Exploit.
261
  * Improved check for session support before giving the option to Install Brute-Force patch.
 
 
262
  * Added option to skip scanning the Quarantined files.
263
  * Updated Brute-Force patch to fix the problem of being included more that once.
264
  * Fixed a few minor bugs (better window positioning and css, cleaner results page, updated new help tab, etc.).
265
  * Made sure that the plugin does not check my servers for updates unless you have registered (this opt-in requirement is part of the WordPress Repository Guidelines).
 
 
266
  * Added exception for the social.png files to the skip files by extension list.
267
  * Fixed removal of Known Threats from files in the Quarantine directory.
 
 
268
  * Block SoakSoak and other malware from exploiting the Slider Revolution Vulnerability (THIS IS A WIDESPREAD THREAT RIGHT NOW).
 
 
269
  * Enabled the Brute-Force protection option directly from the Settings page.
270
  * Fixed window position to auto-adjust on small screens.
271
 
343
 
344
  == Upgrade Notice ==
345
 
346
+ = 4.17.69 =
347
+ Updated code for compatibility with WP 4.9.8, fixed PHP Notice and escaped single-quotes in translated strings.
348
+
349
  = 4.17.68 =
350
  Updated code for compatibility with WP 4.9.7, removed dashicon from Settings link and the broken vote WORKS link, and reordered priorety on fixing Known Threats.
351
 
440
  Extended execution_time during the Fix process, added a Quarantine log to the database, and fixed a couple of minor bugs.
441
 
442
  = 4.15.16 =
443
+ Created automatic definition updates that include WordPress Core files, more improvements to the Brute-Force protection patch (Plus many other improvement from v4.14.X: see Changelog for details).
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
444
 
445
  = 4.14.47 =
446
  Major upgrade to the protection for Brute-Force attempts, and a bug fix for resetting the permissions of read-only files (Plus many other improvement from v3.X: see Changelog for details).
447
 
448
  = 3.07.06 =
449
+ Added SSL support for definition updates and upgraded the Whitelist feature (Plus many other improvement from v1.3.X: see Changelog for details).
450
 
451
  = 1.3.02.15 =
452
+ Improved security on the Quarantine directory to fix the 500 error on some servers (Plus many other improvement from v1.2.X: see Changelog for details).
453
 
454
  = 1.2.03.23 =
455
  First versions available for WordPress (code removed, no longer compatible).