Wordfence Security – Firewall & Malware Scan - Version 7.4.1

Version Description

  • November 6, 2019 =
  • Improvement: Updated the bundled GeoIP database.
  • Improvement: Minor changes to ensure compatibility with PHP 7.4.
  • Improvement: Updated the WHOIS lookup for better reliability.
  • Improvement: Added better diagnostic data when the WAF MySQL storage engine is active.
  • Improvement: Improved the messaging when switching between premium and free licenses.
  • Change: Deprecated DNS changes scan.
  • Change: The plugin will no longer email alerts when Central is managing them.
  • Fix: Added error suppression to ignore_user_abort calls to silence it on hosts with it disabled.
  • Fix: Improved path generation to better avoid outputting extra slashes in URLs.
  • Fix: Applied a length limit to malware reporting to avoid failures due to large content size.
Download this release

Release Info

Developer wfryan
Plugin Icon 128x128 Wordfence Security – Firewall & Malware Scan
Version 7.4.1
Comparing to
See all releases

Code changes from version 7.4.0 to 7.4.1

Files changed (79) hide show
  1. css/{activity-report-widget.1566486436.css → activity-report-widget.1573059078.css} +0 -0
  2. css/{diff.1566486436.css → diff.1573059078.css} +0 -0
  3. css/{dt_table.1566486436.css → dt_table.1573059078.css} +0 -0
  4. css/{fullLog.1566486436.css → fullLog.1573059078.css} +0 -0
  5. css/{iptraf.1566486436.css → iptraf.1573059078.css} +0 -0
  6. css/{jquery-ui-timepicker-addon.1566486436.css → jquery-ui-timepicker-addon.1573059078.css} +0 -0
  7. css/{jquery-ui.min.1566486436.css → jquery-ui.min.1573059078.css} +0 -0
  8. css/{jquery-ui.structure.min.1566486436.css → jquery-ui.structure.min.1573059078.css} +0 -0
  9. css/{jquery-ui.theme.min.1566486436.css → jquery-ui.theme.min.1573059078.css} +0 -0
  10. css/{main.1566486436.css → main.1573059078.css} +0 -0
  11. css/{phpinfo.1566486436.css → phpinfo.1573059078.css} +0 -0
  12. css/{wf-adminbar.1566486436.css → wf-adminbar.1573059078.css} +0 -0
  13. css/{wf-colorbox.1566486436.css → wf-colorbox.1573059078.css} +0 -0
  14. css/{wf-font-awesome.1566486436.css → wf-font-awesome.1573059078.css} +0 -0
  15. css/{wf-global.1566486436.css → wf-global.1573059078.css} +0 -0
  16. css/{wf-ionicons.1566486436.css → wf-ionicons.1573059078.css} +0 -0
  17. css/{wf-onboarding.1566486436.css → wf-onboarding.1573059078.css} +0 -0
  18. css/{wf-roboto-font.1566486436.css → wf-roboto-font.1573059078.css} +0 -0
  19. css/{wfselect2.min.1566486436.css → wfselect2.min.1573059078.css} +0 -0
  20. css/{wordfenceBox.1566486436.css → wordfenceBox.1573059078.css} +0 -0
  21. js/{Chart.bundle.min.1566486436.js → Chart.bundle.min.1573059078.js} +0 -0
  22. js/{admin.1566486436.js → admin.1573059078.js} +1 -1
  23. js/{admin.ajaxWatcher.1566486436.js → admin.ajaxWatcher.1573059078.js} +0 -0
  24. js/{admin.liveTraffic.1566486436.js → admin.liveTraffic.1573059078.js} +0 -0
  25. js/{date.1566486436.js → date.1573059078.js} +0 -0
  26. js/{jquery-ui-timepicker-addon.1566486436.js → jquery-ui-timepicker-addon.1573059078.js} +0 -0
  27. js/{jquery.colorbox-min.1566486436.js → jquery.colorbox-min.1573059078.js} +0 -0
  28. js/{jquery.colorbox.1566486436.js → jquery.colorbox.1573059078.js} +0 -0
  29. js/{jquery.dataTables.min.1566486436.js → jquery.dataTables.min.1573059078.js} +0 -0
  30. js/{jquery.qrcode.min.1566486436.js → jquery.qrcode.min.1573059078.js} +0 -0
  31. js/{jquery.tmpl.min.1566486436.js → jquery.tmpl.min.1573059078.js} +0 -0
  32. js/{jquery.tools.min.1566486436.js → jquery.tools.min.1573059078.js} +0 -0
  33. js/{knockout-3.3.0.1566486436.js → knockout-3.3.0.1573059078.js} +0 -0
  34. js/{wfdashboard.1566486436.js → wfdashboard.1573059078.js} +0 -0
  35. js/{wfdropdown.1566486436.js → wfdropdown.1573059078.js} +0 -0
  36. js/{wfglobal.1566486436.js → wfglobal.1573059078.js} +0 -0
  37. js/{wfpopover.1566486436.js → wfpopover.1573059078.js} +0 -0
  38. js/{wfselect2.min.1566486436.js → wfselect2.min.1573059078.js} +0 -0
  39. lib/Diff/Renderer/Html/Array.php +1 -1
  40. lib/GeoLite2-Country.mmdb +0 -0
  41. lib/menu_options.php +0 -1
  42. lib/menu_scanner.php +0 -1
  43. lib/wfConfig.php +0 -3
  44. lib/wfDiagnostic.php +20 -0
  45. lib/wfIssues.php +2 -3
  46. lib/wfScanEngine.php +36 -108
  47. lib/wfSupportController.php +0 -2
  48. lib/wfUtils.php +12 -7
  49. lib/wordfenceClass.php +3 -3
  50. lib/wordfenceConstants.php +1 -0
  51. lib/wordfenceScanner.php +1 -1
  52. models/scanner/wfScanner.php +1 -7
  53. modules/login-security/classes/controller/wordfencels.php +1 -1
  54. modules/login-security/classes/model/crypto.php +5 -3
  55. modules/login-security/css/{admin-global.1566486436.css → admin-global.1573059078.css} +0 -0
  56. modules/login-security/css/{admin.1566486436.css → admin.1573059078.css} +0 -0
  57. modules/login-security/css/{colorbox.1566486436.css → colorbox.1573059078.css} +0 -0
  58. modules/login-security/css/{font-awesome.1566486436.css → font-awesome.1573059078.css} +0 -0
  59. modules/login-security/css/{ionicons.1566486436.css → ionicons.1573059078.css} +0 -0
  60. modules/login-security/css/{jquery-ui-timepicker-addon.1566486436.css → jquery-ui-timepicker-addon.1573059078.css} +0 -0
  61. modules/login-security/css/{jquery-ui.min.1566486436.css → jquery-ui.min.1573059078.css} +0 -0
  62. modules/login-security/css/{jquery-ui.structure.min.1566486436.css → jquery-ui.structure.min.1573059078.css} +0 -0
  63. modules/login-security/css/{jquery-ui.theme.min.1566486436.css → jquery-ui.theme.min.1573059078.css} +0 -0
  64. modules/login-security/css/{login.1566486436.css → login.1573059078.css} +0 -0
  65. modules/login-security/js/{admin-global.1566486436.js → admin-global.1573059078.js} +0 -0
  66. modules/login-security/js/{admin.1566486436.js → admin.1573059078.js} +0 -0
  67. modules/login-security/js/{jquery-ui-timepicker-addon.1566486436.js → jquery-ui-timepicker-addon.1573059078.js} +0 -0
  68. modules/login-security/js/{jquery.colorbox.1566486436.js → jquery.colorbox.1573059078.js} +0 -0
  69. modules/login-security/js/{jquery.colorbox.min.1566486436.js → jquery.colorbox.min.1573059078.js} +0 -0
  70. modules/login-security/js/{jquery.qrcode.min.1566486436.js → jquery.qrcode.min.1573059078.js} +0 -0
  71. modules/login-security/js/{jquery.tmpl.min.1566486436.js → jquery.tmpl.min.1573059078.js} +0 -0
  72. modules/login-security/js/{login.1566486436.js → login.1573059078.js} +3 -1
  73. modules/login-security/wordfence-login-security.php +2 -2
  74. readme.txt +14 -4
  75. vendor/wordfence/wf-waf/src/lib/utils.php +1 -0
  76. views/dashboard/options-group-license.php +1 -1
  77. views/scanner/issue-dnsChange.php +0 -27
  78. views/scanner/options-group-general.php +0 -1
  79. wordfence.php +3 -3
css/{activity-report-widget.1566486436.css → activity-report-widget.1573059078.css} RENAMED
File without changes
css/{diff.1566486436.css → diff.1573059078.css} RENAMED
File without changes
css/{dt_table.1566486436.css → dt_table.1573059078.css} RENAMED
File without changes
css/{fullLog.1566486436.css → fullLog.1573059078.css} RENAMED
File without changes
css/{iptraf.1566486436.css → iptraf.1573059078.css} RENAMED
File without changes
css/{jquery-ui-timepicker-addon.1566486436.css → jquery-ui-timepicker-addon.1573059078.css} RENAMED
File without changes
css/{jquery-ui.min.1566486436.css → jquery-ui.min.1573059078.css} RENAMED
File without changes
css/{jquery-ui.structure.min.1566486436.css → jquery-ui.structure.min.1573059078.css} RENAMED
File without changes
css/{jquery-ui.theme.min.1566486436.css → jquery-ui.theme.min.1573059078.css} RENAMED
File without changes
css/{main.1566486436.css → main.1573059078.css} RENAMED
File without changes
css/{phpinfo.1566486436.css → phpinfo.1573059078.css} RENAMED
File without changes
css/{wf-adminbar.1566486436.css → wf-adminbar.1573059078.css} RENAMED
File without changes
css/{wf-colorbox.1566486436.css → wf-colorbox.1573059078.css} RENAMED
File without changes
css/{wf-font-awesome.1566486436.css → wf-font-awesome.1573059078.css} RENAMED
File without changes
css/{wf-global.1566486436.css → wf-global.1573059078.css} RENAMED
File without changes
css/{wf-ionicons.1566486436.css → wf-ionicons.1573059078.css} RENAMED
File without changes
css/{wf-onboarding.1566486436.css → wf-onboarding.1573059078.css} RENAMED
File without changes
css/{wf-roboto-font.1566486436.css → wf-roboto-font.1573059078.css} RENAMED
File without changes
css/{wfselect2.min.1566486436.css → wfselect2.min.1573059078.css} RENAMED
File without changes
css/{wordfenceBox.1566486436.css → wordfenceBox.1573059078.css} RENAMED
File without changes
js/{Chart.bundle.min.1566486436.js → Chart.bundle.min.1573059078.js} RENAMED
File without changes
js/{admin.1566486436.js → admin.1573059078.js} RENAMED
@@ -46,7 +46,7 @@
46
basePageName: '',
47
pendingChanges: {},
48
scanStalled: false,
49
- siteCleaningIssueTypes: ['file', 'checkGSB', 'checkSpamIP', 'commentBadURL', 'dnsChange', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'spamvertizeCheck', 'suspiciousAdminUsers'],
50
51
//Screen sizes
52
SCREEN_XS: 'xs',
46
basePageName: '',
47
pendingChanges: {},
48
scanStalled: false,
49
+ siteCleaningIssueTypes: ['file', 'checkGSB', 'checkSpamIP', 'commentBadURL', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'spamvertizeCheck', 'suspiciousAdminUsers'],
50
51
//Screen sizes
52
SCREEN_XS: 'xs',
js/{admin.ajaxWatcher.1566486436.js → admin.ajaxWatcher.1573059078.js} RENAMED
File without changes
js/{admin.liveTraffic.1566486436.js → admin.liveTraffic.1573059078.js} RENAMED
File without changes
js/{date.1566486436.js → date.1573059078.js} RENAMED
File without changes
js/{jquery-ui-timepicker-addon.1566486436.js → jquery-ui-timepicker-addon.1573059078.js} RENAMED
File without changes
js/{jquery.colorbox-min.1566486436.js → jquery.colorbox-min.1573059078.js} RENAMED
File without changes
js/{jquery.colorbox.1566486436.js → jquery.colorbox.1573059078.js} RENAMED
File without changes
js/{jquery.dataTables.min.1566486436.js → jquery.dataTables.min.1573059078.js} RENAMED
File without changes
js/{jquery.qrcode.min.1566486436.js → jquery.qrcode.min.1573059078.js} RENAMED
File without changes
js/{jquery.tmpl.min.1566486436.js → jquery.tmpl.min.1573059078.js} RENAMED
File without changes
js/{jquery.tools.min.1566486436.js → jquery.tools.min.1573059078.js} RENAMED
File without changes
js/{knockout-3.3.0.1566486436.js → knockout-3.3.0.1573059078.js} RENAMED
File without changes
js/{wfdashboard.1566486436.js → wfdashboard.1573059078.js} RENAMED
File without changes
js/{wfdropdown.1566486436.js → wfdropdown.1573059078.js} RENAMED
File without changes
js/{wfglobal.1566486436.js → wfglobal.1573059078.js} RENAMED
File without changes
js/{wfpopover.1566486436.js → wfpopover.1573059078.js} RENAMED
File without changes
js/{wfselect2.min.1566486436.js → wfselect2.min.1573059078.js} RENAMED
File without changes
lib/Diff/Renderer/Html/Array.php CHANGED
@@ -150,7 +150,7 @@ class Diff_Renderer_Html_Array extends Diff_Renderer_Abstract
150
{
151
$start = 0;
152
$limit = min(strlen($fromLine), strlen($toLine));
153
- while($start < $limit && $fromLine{$start} == $toLine{$start}) {
154
++$start;
155
}
156
$end = -1;
150
{
151
$start = 0;
152
$limit = min(strlen($fromLine), strlen($toLine));
153
+ while($start < $limit && $fromLine[$start] == $toLine[$start]) {
154
++$start;
155
}
156
$end = -1;
lib/GeoLite2-Country.mmdb CHANGED
Binary file
lib/menu_options.php CHANGED
@@ -167,7 +167,6 @@ if (isset($_GET['source']) && wfPage::isValidPage($_GET['source'])) {
167
'wf-option-scansEnabled-passwds' => __('Check the strength of passwords', 'wordfence'),
168
'wf-option-scansEnabled-diskSpace' => __('Monitor disk space', 'wordfence'),
169
'wf-option-scansEnabled-wafStatus' => __('Monitor Web Application Firewall status', 'wordfence'),
170
- 'wf-option-scansEnabled-dns' => __('Scan for unauthorized DNS changes', 'wordfence'),
171
'wf-option-other-scanOutside' => __('Scan files outside your WordPress installation', 'wordfence'),
172
'wf-option-scansEnabled-scanImages' => __('Scan images, binary, and other files as if they were executable', 'wordfence'),
173
'wf-option-lowResourceScansEnabled' => __('Use low resource scanning (reduces server load by lengthening the scan duration)', 'wordfence'),
167
'wf-option-scansEnabled-passwds' => __('Check the strength of passwords', 'wordfence'),
168
'wf-option-scansEnabled-diskSpace' => __('Monitor disk space', 'wordfence'),
169
'wf-option-scansEnabled-wafStatus' => __('Monitor Web Application Firewall status', 'wordfence'),
170
'wf-option-other-scanOutside' => __('Scan files outside your WordPress installation', 'wordfence'),
171
'wf-option-scansEnabled-scanImages' => __('Scan images, binary, and other files as if they were executable', 'wordfence'),
172
'wf-option-lowResourceScansEnabled' => __('Use low resource scanning (reduces server load by lengthening the scan duration)', 'wordfence'),
lib/menu_scanner.php CHANGED
@@ -254,7 +254,6 @@ echo wfView::create('scanner/issue-knownfile')->render();
254
echo wfView::create('scanner/issue-configReadable')->render();
255
echo wfView::create('scanner/issue-publiclyAccessible')->render();
256
echo wfView::create('scanner/issue-coreUnknown')->render();
257
- echo wfView::create('scanner/issue-dnsChange')->render();
258
echo wfView::create('scanner/issue-diskSpace')->render();
259
echo wfView::create('scanner/issue-wafStatus')->render();
260
echo wfView::create('scanner/issue-geoipSupport')->render();
254
echo wfView::create('scanner/issue-configReadable')->render();
255
echo wfView::create('scanner/issue-publiclyAccessible')->render();
256
echo wfView::create('scanner/issue-coreUnknown')->render();
257
echo wfView::create('scanner/issue-diskSpace')->render();
258
echo wfView::create('scanner/issue-wafStatus')->render();
259
echo wfView::create('scanner/issue-geoipSupport')->render();
lib/wfConfig.php CHANGED
@@ -74,7 +74,6 @@ class wfConfig {
74
"scansEnabled_options" => array('value' => true, 'autoload' => self::AUTOLOAD),
75
"scansEnabled_wpscan_fullPathDisclosure" => array('value' => true, 'autoload' => self::AUTOLOAD),
76
"scansEnabled_wpscan_directoryListingEnabled" => array('value' => true, 'autoload' => self::AUTOLOAD),
77
- "scansEnabled_dns" => array('value' => true, 'autoload' => self::AUTOLOAD),
78
"scansEnabled_scanImages" => array('value' => false, 'autoload' => self::AUTOLOAD),
79
"scansEnabled_highSense" => array('value' => false, 'autoload' => self::AUTOLOAD),
80
"scansEnabled_oldVersions" => array('value' => true, 'autoload' => self::AUTOLOAD),
@@ -1924,7 +1923,6 @@ Options -ExecCGI
1924
'scansEnabled_options',
1925
'scansEnabled_wpscan_fullPathDisclosure',
1926
'scansEnabled_wpscan_directoryListingEnabled',
1927
- 'scansEnabled_dns',
1928
'scansEnabled_scanImages',
1929
'scansEnabled_highSense',
1930
'scansEnabled_oldVersions',
@@ -2078,7 +2076,6 @@ Options -ExecCGI
2078
'scansEnabled_options',
2079
'scansEnabled_wpscan_fullPathDisclosure',
2080
'scansEnabled_wpscan_directoryListingEnabled',
2081
- 'scansEnabled_dns',
2082
'scansEnabled_scanImages',
2083
'scansEnabled_highSense',
2084
'scansEnabled_oldVersions',
74
"scansEnabled_options" => array('value' => true, 'autoload' => self::AUTOLOAD),
75
"scansEnabled_wpscan_fullPathDisclosure" => array('value' => true, 'autoload' => self::AUTOLOAD),
76
"scansEnabled_wpscan_directoryListingEnabled" => array('value' => true, 'autoload' => self::AUTOLOAD),
77
"scansEnabled_scanImages" => array('value' => false, 'autoload' => self::AUTOLOAD),
78
"scansEnabled_highSense" => array('value' => false, 'autoload' => self::AUTOLOAD),
79
"scansEnabled_oldVersions" => array('value' => true, 'autoload' => self::AUTOLOAD),
1923
'scansEnabled_options',
1924
'scansEnabled_wpscan_fullPathDisclosure',
1925
'scansEnabled_wpscan_directoryListingEnabled',
1926
'scansEnabled_scanImages',
1927
'scansEnabled_highSense',
1928
'scansEnabled_oldVersions',
2076
'scansEnabled_options',
2077
'scansEnabled_wpscan_fullPathDisclosure',
2078
'scansEnabled_wpscan_directoryListingEnabled',
2079
'scansEnabled_scanImages',
2080
'scansEnabled_highSense',
2081
'scansEnabled_oldVersions',
lib/wfDiagnostic.php CHANGED
@@ -82,6 +82,7 @@ class wfDiagnostic
82
'description' => __('Current WAF configuration.', 'wordfence'),
83
'tests' => array(
84
'wafAutoPrepend' => __('WAF auto prepend active', 'wordfence'),
85
'wafLogPath' => __('WAF log path', 'wordfence'),
86
'wafSubdirectoryInstall' => __('WAF subdirectory installation', 'wordfence'),
87
'wafAutoPrependFilePath' => __('wordfence-waf.php path', 'wordfence'),
@@ -211,6 +212,10 @@ class wfDiagnostic
211
212
public function isWAFReadable() {
213
if (!is_readable(WFWAF_LOG_PATH)) {
214
return array('test' => false, 'message' => __('No files readable', 'wordfence'));
215
}
216
@@ -231,6 +236,10 @@ class wfDiagnostic
231
}
232
233
if (count($unreadable) > 0) {
234
return array('test' => false, 'message' => implode(', ', $unreadable));
235
}
236
@@ -239,6 +248,10 @@ class wfDiagnostic
239
240
public function isWAFWritable() {
241
if (!is_writable(WFWAF_LOG_PATH)) {
242
return array('test' => false, 'message' => __('No files writable', 'wordfence'));
243
}
244
@@ -259,6 +272,10 @@ class wfDiagnostic
259
}
260
261
if (count($unwritable) > 0) {
262
return array('test' => false, 'message' => implode(', ', $unwritable));
263
}
264
@@ -339,6 +356,9 @@ class wfDiagnostic
339
public function wafAutoPrepend() {
340
return array('test' => true, 'infoOnly' => true, 'message' => (defined('WFWAF_AUTO_PREPEND') && WFWAF_AUTO_PREPEND ? __('Yes', 'wordfence') : __('No', 'wordfence')));
341
}
342
public function wafLogPath() {
343
$logPath = __('(not set)', 'wordfence');
344
if (defined('WFWAF_LOG_PATH')) {
82
'description' => __('Current WAF configuration.', 'wordfence'),
83
'tests' => array(
84
'wafAutoPrepend' => __('WAF auto prepend active', 'wordfence'),
85
+ 'wafStorageEngine' => __('WAF storage engine (WFWAF_STORAGE_ENGINE)', 'wordfence'),
86
'wafLogPath' => __('WAF log path', 'wordfence'),
87
'wafSubdirectoryInstall' => __('WAF subdirectory installation', 'wordfence'),
88
'wafAutoPrependFilePath' => __('wordfence-waf.php path', 'wordfence'),
212
213
public function isWAFReadable() {
214
if (!is_readable(WFWAF_LOG_PATH)) {
215
+ if (defined('WFWAF_STORAGE_ENGINE') && WFWAF_STORAGE_ENGINE == 'mysqli') {
216
+ return array('test' => false, 'infoOnly' => true, 'message' => __('No files readable', 'wordfence'));
217
+ }
218
+
219
return array('test' => false, 'message' => __('No files readable', 'wordfence'));
220
}
221
236
}
237
238
if (count($unreadable) > 0) {
239
+ if (defined('WFWAF_STORAGE_ENGINE') && WFWAF_STORAGE_ENGINE == 'mysqli') {
240
+ return array('test' => false, 'infoOnly' => true, 'message' => implode(', ', $unreadable));
241
+ }
242
+
243
return array('test' => false, 'message' => implode(', ', $unreadable));
244
}
245
248
249
public function isWAFWritable() {
250
if (!is_writable(WFWAF_LOG_PATH)) {
251
+ if (defined('WFWAF_STORAGE_ENGINE') && WFWAF_STORAGE_ENGINE == 'mysqli') {
252
+ return array('test' => false, 'infoOnly' => true, 'message' => __('No files writable', 'wordfence'));
253
+ }
254
+
255
return array('test' => false, 'message' => __('No files writable', 'wordfence'));
256
}
257
272
}
273
274
if (count($unwritable) > 0) {
275
+ if (defined('WFWAF_STORAGE_ENGINE') && WFWAF_STORAGE_ENGINE == 'mysqli') {
276
+ return array('test' => false, 'infoOnly' => true, 'message' => implode(', ', $unwritable));
277
+ }
278
+
279
return array('test' => false, 'message' => implode(', ', $unwritable));
280
}
281
356
public function wafAutoPrepend() {
357
return array('test' => true, 'infoOnly' => true, 'message' => (defined('WFWAF_AUTO_PREPEND') && WFWAF_AUTO_PREPEND ? __('Yes', 'wordfence') : __('No', 'wordfence')));
358
}
359
+ public function wafStorageEngine() {
360
+ return array('test' => true, 'infoOnly' => true, 'message' => (defined('WFWAF_STORAGE_ENGINE') ? WFWAF_STORAGE_ENGINE : __('(default)', 'wordfence')));
361
+ }
362
public function wafLogPath() {
363
$logPath = __('(not set)', 'wordfence');
364
if (defined('WFWAF_LOG_PATH')) {
lib/wfIssues.php CHANGED
@@ -69,7 +69,6 @@ class wfIssues {
69
'configReadable' => wfIssues::SEVERITY_CRITICAL,
70
'wfPluginVulnerable' => wfIssues::SEVERITY_HIGH,
71
'coreUnknown' => wfIssues::SEVERITY_HIGH,
72
- 'dnsChangeDNS' => wfIssues::SEVERITY_HIGH,
73
'easyPasswordWeak' => wfIssues::SEVERITY_HIGH,
74
'knownfile' => wfIssues::SEVERITY_HIGH,
75
'optionBadURL' => wfIssues::SEVERITY_HIGH,
@@ -85,7 +84,7 @@ class wfIssues {
85
);
86
87
public static function validIssueTypes() {
88
- return array('checkHowGetIPs', 'checkSpamIP', 'commentBadURL', 'configReadable', 'coreUnknown', 'database', 'diskSpace', 'wafStatus', 'dnsChange', 'easyPassword', 'file', 'geoipSupport', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'publiclyAccessible', 'spamvertizeCheck', 'suspiciousAdminUsers', 'timelimit', 'wfPluginAbandoned', 'wfPluginRemoved', 'wfPluginUpgrade', 'wfPluginVulnerable', 'wfThemeUpgrade', 'wfUpgrade', 'wpscan_directoryList', 'wpscan_fullPathDiscl');
89
}
90
91
public static function statusPrep(){
@@ -546,7 +545,7 @@ class wfIssues {
546
/** @var wpdb $wpdb */
547
global $wpdb;
548
549
- $siteCleaningTypes = array('file', 'checkGSB', 'checkSpamIP', 'commentBadURL', 'dnsChange', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'spamvertizeCheck', 'suspiciousAdminUsers');
550
$sortTagging = 'CASE';
551
foreach ($siteCleaningTypes as $index => $t) {
552
$sortTagging .= ' WHEN type = \'' . esc_sql($t) . '\' THEN ' . ((int) $index);
69
'configReadable' => wfIssues::SEVERITY_CRITICAL,
70
'wfPluginVulnerable' => wfIssues::SEVERITY_HIGH,
71
'coreUnknown' => wfIssues::SEVERITY_HIGH,
72
'easyPasswordWeak' => wfIssues::SEVERITY_HIGH,
73
'knownfile' => wfIssues::SEVERITY_HIGH,
74
'optionBadURL' => wfIssues::SEVERITY_HIGH,
84
);
85
86
public static function validIssueTypes() {
87
+ return array('checkHowGetIPs', 'checkSpamIP', 'commentBadURL', 'configReadable', 'coreUnknown', 'database', 'diskSpace', 'wafStatus', 'easyPassword', 'file', 'geoipSupport', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'publiclyAccessible', 'spamvertizeCheck', 'suspiciousAdminUsers', 'timelimit', 'wfPluginAbandoned', 'wfPluginRemoved', 'wfPluginUpgrade', 'wfPluginVulnerable', 'wfThemeUpgrade', 'wfUpgrade', 'wpscan_directoryList', 'wpscan_fullPathDiscl');
88
}
89
90
public static function statusPrep(){
545
/** @var wpdb $wpdb */
546
global $wpdb;
547
548
+ $siteCleaningTypes = array('file', 'checkGSB', 'checkSpamIP', 'commentBadURL', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'spamvertizeCheck', 'suspiciousAdminUsers');
549
$sortTagging = 'CASE';
550
foreach ($siteCleaningTypes as $index => $t) {
551
$sortTagging .= ' WHEN type = \'' . esc_sql($t) . '\' THEN ' . ((int) $index);
lib/wfScanEngine.php CHANGED
@@ -331,10 +331,45 @@ class wfScanEngine {
331
exit(0);
332
}
333
public function emailNewIssues($timeLimitReached = false){
334
- $this->i->emailNewIssues($timeLimitReached, $this->scanController);
335
}
336
public function submitMetrics() {
337
if (wfConfig::get('other_WFNet', true)) {
338
$this->api->call('record_scan_metrics', array(), array('metrics' => $this->metrics));
339
}
340
}
@@ -1433,113 +1468,6 @@ class wfScanEngine {
1433
wfIssues::statusEnd($this->statusIDX['wafStatus'], $haveIssues);
1434
$this->scanController->completeStage(wfScanner::STAGE_SERVER_STATE, $haveIssues);
1435
}
1436
- private function scan_dns(){
1437
- if(! function_exists('dns_get_record')){
1438
- $this->status(1, 'info', "Skipping DNS scan because this system does not support dns_get_record()");
1439
- return;
1440
- }
1441
- $this->statusIDX['dns'] = wfIssues::statusStart("Scanning DNS for unauthorized changes");
1442
- $this->scanController->startStage(wfScanner::STAGE_SERVER_STATE);
1443
- $haveIssues = wfIssues::STATUS_SECURE;
1444
- $home = get_home_url();
1445
- if(preg_match('/https?:\/\/([^\/]+)/i', $home, $matches)){
1446
- $host = strtolower($matches[1]);
1447
- $this->status(2, 'info', "Starting DNS scan for $host");
1448
-
1449
- $cnameArrRec = @dns_get_record($host, DNS_CNAME);
1450
- $cnameArr = array();
1451
- $cnamesWeMustTrack = array();
1452
- if ($cnameArrRec) {
1453
- foreach($cnameArrRec as $elem){
1454
- $this->status(2, 'info', "Scanning CNAME DNS record for " . $elem['host']);
1455
- if($elem['host'] == $host){
1456
- $cnameArr[] = $elem;
1457
- $cnamesWeMustTrack[] = $elem['target'];
1458
- }
1459
- }
1460
- }
1461
-
1462
- function wfAnonFunc1($a){ return $a['host'] . ' points to ' . $a['target']; }
1463
- $cnameArr = array_map('wfAnonFunc1', $cnameArr);
1464
- sort($cnameArr, SORT_STRING);
1465
- $currentCNAME = implode(', ', $cnameArr);
1466
- $loggedCNAME = wfConfig::get('wf_dnsCNAME');
1467
- $dnsLogged = wfConfig::get('wf_dnsLogged', false);
1468
- $msg = "A change in your DNS records may indicate that a hacker has hacked into your DNS administration system and has pointed your email or website to their own server for malicious purposes. It could also indicate that your domain has expired. If you made this change yourself you can mark it 'resolved' and safely ignore it.";
1469
- if($dnsLogged && $loggedCNAME != $currentCNAME){
1470
- $added = $this->addIssue('dnsChange', wfIssues::SEVERITY_HIGH, 'dnsChanges', 'dnsChanges' . $currentCNAME, "Your DNS records have changed", "We have detected a change in the CNAME records of your DNS configuration for the domain $host. A CNAME record is an alias that is used to point a domain name to another domain name. For example foo.example.com can point to bar.example.com which then points to an IP address of 10.1.1.1. $msg", array(
1471
- 'type' => 'CNAME',
1472
- 'host' => $host,
1473
- 'oldDNS' => $loggedCNAME,
1474
- 'newDNS' => $currentCNAME
1475
- ));
1476
- if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) { $haveIssues = wfIssues::STATUS_PROBLEM; }
1477
- else if ($haveIssues != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) { $haveIssues = wfIssues::STATUS_IGNORED; }
1478
- }
1479
- wfConfig::set('wf_dnsCNAME', $currentCNAME);
1480
-
1481
- $aArrRec = @dns_get_record($host, DNS_A);
1482
- $aArr = array();
1483
- if ($aArrRec) {
1484
- foreach($aArrRec as $elem){
1485
- $this->status(2, 'info', "Scanning DNS A record for " . $elem['host']);
1486
- if($elem['host'] == $host || in_array($elem['host'], $cnamesWeMustTrack) ){
1487
- $aArr[] = $elem;
1488
- }
1489
- }
1490
- }
1491
- function wfAnonFunc2($a){ return $a['host'] . ' points to ' . $a['ip']; }
1492
- $aArr = array_map('wfAnonFunc2', $aArr);
1493
- sort($aArr, SORT_STRING);
1494
- $currentA = implode(', ', $aArr);
1495
- $loggedA = wfConfig::get('wf_dnsA');
1496
- $dnsLogged = wfConfig::get('wf_dnsLogged', false);
1497
- if($dnsLogged && $loggedA != $currentA){
1498
- $added = $this->addIssue('dnsChange', wfIssues::SEVERITY_HIGH, 'dnsChanges', 'dnsChanges' . $currentA, "Your DNS records have changed", "We have detected a change in the A records of your DNS configuration that may affect the domain $host. An A record is a record in DNS that points a domain name to an IP address. $msg", array(
1499
- 'type' => 'A',
1500
- 'host' => $host,
1501
- 'oldDNS' => $loggedA,
1502
- 'newDNS' => $currentA
1503
- ));
1504
- if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) { $haveIssues = wfIssues::STATUS_PROBLEM; }
1505
- else if ($haveIssues != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) { $haveIssues = wfIssues::STATUS_IGNORED; }
1506
- }
1507
- wfConfig::set('wf_dnsA', $currentA);
1508
-
1509
- $mxArrRec = @dns_get_record($host, DNS_MX);
1510
- $mxArr = array();
1511
- if ($mxArrRec) {
1512
- foreach ($mxArrRec as $elem)
1513
- {
1514
- $this->status(2, 'info', "Scanning DNS MX record for " . $elem['host']);
1515
- if ($elem['host'] == $host)
1516
- {
1517
- $mxArr[] = $elem;
1518
- }
1519
- }
1520
- }
1521
- function wfAnonFunc3($a){ return $a['target']; }
1522
- $mxArr = array_map('wfAnonFunc3', $mxArr);
1523
- sort($mxArr, SORT_STRING);
1524
- $currentMX = implode(', ', $mxArr);
1525
- $loggedMX = wfConfig::get('wf_dnsMX');
1526
- if($dnsLogged && $loggedMX != $currentMX){
1527
- $added = $this->addIssue('dnsChange', wfIssues::SEVERITY_HIGH, 'dnsChanges', 'dnsChanges' . $currentMX, "Your DNS records have changed", "We have detected a change in the email server (MX) records of your DNS configuration for the domain $host. $msg", array(
1528
- 'type' => 'MX',
1529
- 'host' => $host,
1530
- 'oldDNS' => $loggedMX,
1531
- 'newDNS' => $currentMX
1532
- ));
1533
- if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) { $haveIssues = wfIssues::STATUS_PROBLEM; }
1534
- else if ($haveIssues != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) { $haveIssues = wfIssues::STATUS_IGNORED; }
1535
- }
1536
- wfConfig::set('wf_dnsMX', $currentMX);
1537
-
1538
- wfConfig::set('wf_dnsLogged', 1);
1539
- }
1540
- wfIssues::statusEnd($this->statusIDX['dns'], $haveIssues);
1541
- $this->scanController->completeStage(wfScanner::STAGE_SERVER_STATE, $haveIssues);
1542
- }
1543
1544
private function scan_oldVersions_init() {
1545
$this->statusIDX['oldVersions'] = wfIssues::statusStart("Scanning for old themes, plugins and core files");
331
exit(0);
332
}
333
public function emailNewIssues($timeLimitReached = false){
334
+ if (!wfCentral::pluginAlertingDisabled()) {
335
+ $this->i->emailNewIssues($timeLimitReached, $this->scanController);
336
+ }
337
}
338
public function submitMetrics() {
339
if (wfConfig::get('other_WFNet', true)) {
340
+ //Trim down the malware matches if needed to allow the report call to succeed
341
+ if (isset($this->metrics['malwareSignature'])) {
342
+ //Get count
343
+ $count = 0;
344
+ $extra_count = 0;
345
+ $rules_with_extras = 0;
346
+ foreach ($this->metrics['malwareSignature'] as $rule => $payloads) {
347
+ $count += count($payloads);
348
+ $extra_count += (count($payloads) - 1);
349
+ if (count($payloads) > 1) {
350
+ $rules_with_extras++;
351
+ }
352
+ }
353
+
354
+ //Trim additional matches
355
+ $overage = $extra_count - WORDFENCE_SCAN_ISSUES_MAX_REPORT;
356
+ if ($overage > 0) {
357
+ foreach ($this->metrics['malwareSignature'] as $rule => $payloads) {
358
+ $percent = min(1, (count($payloads) - 1) / $extra_count); //Percentage of the overage this rule is responsible for
359
+ $to_remove = min(count($payloads) - 1, ceil($percent * $overage)); //Remove the lesser of (all but one, the percentage of the overage)
360
+ $sliced = array_slice($this->metrics['malwareSignature'][$rule], 0, max(1, count($payloads) - $to_remove));
361
+ $count -= (count($this->metrics['malwareSignature'][$rule]) - count($sliced));
362
+ $this->metrics['malwareSignature'][$rule] = $sliced;
363
+ }
364
+ }
365
+
366
+ //Trim single matches
367
+ if ($count > WORDFENCE_SCAN_ISSUES_MAX_REPORT) {
368
+ $sliced = array_slice($this->metrics['malwareSignature'], 0, WORDFENCE_SCAN_ISSUES_MAX_REPORT, true);
369
+ $this->metrics['malwareSignature'] = $sliced;
370
+ }
371
+ }
372
+
373
$this->api->call('record_scan_metrics', array(), array('metrics' => $this->metrics));
374
}
375
}
1468
wfIssues::statusEnd($this->statusIDX['wafStatus'], $haveIssues);
1469
$this->scanController->completeStage(wfScanner::STAGE_SERVER_STATE, $haveIssues);
1470
}
1471
1472
private function scan_oldVersions_init() {
1473
$this->statusIDX['oldVersions'] = wfIssues::statusStart("Scanning for old themes, plugins and core files");
lib/wfSupportController.php CHANGED
@@ -124,7 +124,6 @@ class wfSupportController {
124
const ITEM_SCAN_OPTION_PASSWORD_STRENGTH = 'scan-option-password-strength';
125
const ITEM_SCAN_OPTION_DISK_SPACE = 'scan-option-disk-space';
126
const ITEM_SCAN_OPTION_WAF_STATUS = 'scan-option-waf-status';
127
- const ITEM_SCAN_OPTION_DNS_CHANGES = 'scan-option-dns-changes';
128
const ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS = 'scan-option-outside-wordpress';
129
const ITEM_SCAN_OPTION_IMAGES_EXECUTABLE = 'scan-option-images-executable';
130
const ITEM_SCAN_OPTION_HIGH_SENSITIVITY = 'scan-option-high-sensitivity';
@@ -306,7 +305,6 @@ class wfSupportController {
306
case self::ITEM_SCAN_OPTION_PASSWORD_STRENGTH:
307
case self::ITEM_SCAN_OPTION_DISK_SPACE:
308
case self::ITEM_SCAN_OPTION_WAF_STATUS:
309
- case self::ITEM_SCAN_OPTION_DNS_CHANGES:
310
case self::ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS:
311
case self::ITEM_SCAN_OPTION_IMAGES_EXECUTABLE:
312
case self::ITEM_SCAN_OPTION_HIGH_SENSITIVITY:
124
const ITEM_SCAN_OPTION_PASSWORD_STRENGTH = 'scan-option-password-strength';
125
const ITEM_SCAN_OPTION_DISK_SPACE = 'scan-option-disk-space';
126
const ITEM_SCAN_OPTION_WAF_STATUS = 'scan-option-waf-status';
127
const ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS = 'scan-option-outside-wordpress';
128
const ITEM_SCAN_OPTION_IMAGES_EXECUTABLE = 'scan-option-images-executable';
129
const ITEM_SCAN_OPTION_HIGH_SENSITIVITY = 'scan-option-high-sensitivity';
305
case self::ITEM_SCAN_OPTION_PASSWORD_STRENGTH:
306
case self::ITEM_SCAN_OPTION_DISK_SPACE:
307
case self::ITEM_SCAN_OPTION_WAF_STATUS:
308
case self::ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS:
309
case self::ITEM_SCAN_OPTION_IMAGES_EXECUTABLE:
310
case self::ITEM_SCAN_OPTION_HIGH_SENSITIVITY:
lib/wfUtils.php CHANGED
@@ -2155,9 +2155,9 @@ class wfUtils {
2155
else if (is_multisite()) {
2156
$current_network = get_network();
2157
if ( 'relative' == $scheme )
2158
- $url = $current_network->path;
2159
else
2160
- $url = 'http://' . $current_network->domain . $current_network->path;
2161
}
2162
2163
if ( ! in_array( $scheme, array( 'http', 'https', 'relative' ) ) ) {
@@ -2187,11 +2187,12 @@ class wfUtils {
2187
if (function_exists('get_bloginfo') && empty($homeurl)) {
2188
if (is_multisite()) {
2189
$homeurl = network_home_url();
2190
- $homeurl = rtrim($homeurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2191
}
2192
else {
2193
$homeurl = home_url();
2194
}
2195
}
2196
2197
if (wfConfig::get('wp_home_url') !== $homeurl) {
@@ -2204,11 +2205,12 @@ class wfUtils {
2204
if (function_exists('get_bloginfo') && empty($homeurl)) {
2205
if (is_multisite()) {
2206
$homeurl = network_home_url($path, $scheme);
2207
- $homeurl = rtrim($homeurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2208
}
2209
else {
2210
$homeurl = home_url($path, $scheme);
2211
}
2212
}
2213
else {
2214
$homeurl = set_url_scheme($homeurl, $scheme);
@@ -2238,9 +2240,9 @@ class wfUtils {
2238
else if (is_multisite()) {
2239
$current_network = get_network();
2240
if ( 'relative' == $scheme )
2241
- $url = $current_network->path;
2242
else
2243
- $url = 'http://' . $current_network->domain . $current_network->path;
2244
}
2245
2246
if ( ! in_array( $scheme, array( 'http', 'https', 'relative' ) ) ) {
@@ -2270,11 +2272,12 @@ class wfUtils {
2270
if (function_exists('get_bloginfo') && empty($siteurl)) {
2271
if (is_multisite()) {
2272
$siteurl = network_site_url();
2273
- $siteurl = rtrim($siteurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2274
}
2275
else {
2276
$siteurl = site_url();
2277
}
2278
}
2279
2280
if (wfConfig::get('wp_site_url') !== $siteurl) {
@@ -2299,6 +2302,8 @@ class wfUtils {
2299
else {
2300
$siteurl = site_url($path, $scheme);
2301
}
2302
}
2303
else {
2304
$siteurl = set_url_scheme($siteurl, $scheme);
2155
else if (is_multisite()) {
2156
$current_network = get_network();
2157
if ( 'relative' == $scheme )
2158
+ $url = rtrim($current_network->path, '/');
2159
else
2160
+ $url = 'http://' . rtrim($current_network->domain, '/') . '/' . trim($current_network->path, '/');
2161
}
2162
2163
if ( ! in_array( $scheme, array( 'http', 'https', 'relative' ) ) ) {
2187
if (function_exists('get_bloginfo') && empty($homeurl)) {
2188
if (is_multisite()) {
2189
$homeurl = network_home_url();
2190
}
2191
else {
2192
$homeurl = home_url();
2193
}
2194
+
2195
+ $homeurl = rtrim($homeurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2196
}
2197
2198
if (wfConfig::get('wp_home_url') !== $homeurl) {
2205
if (function_exists('get_bloginfo') && empty($homeurl)) {
2206
if (is_multisite()) {
2207
$homeurl = network_home_url($path, $scheme);
2208
}
2209
else {
2210
$homeurl = home_url($path, $scheme);
2211
}
2212
+
2213
+ $homeurl = rtrim($homeurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2214
}
2215
else {
2216
$homeurl = set_url_scheme($homeurl, $scheme);
2240
else if (is_multisite()) {
2241
$current_network = get_network();
2242
if ( 'relative' == $scheme )
2243
+ $url = rtrim($current_network->path, '/');
2244
else
2245
+ $url = 'http://' . rtrim($current_network->domain, '/') . '/' . trim($current_network->path, '/');
2246
}
2247
2248
if ( ! in_array( $scheme, array( 'http', 'https', 'relative' ) ) ) {
2272
if (function_exists('get_bloginfo') && empty($siteurl)) {
2273
if (is_multisite()) {
2274
$siteurl = network_site_url();
2275
}
2276
else {
2277
$siteurl = site_url();
2278
}
2279
+
2280
+ $siteurl = rtrim($siteurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2281
}
2282
2283
if (wfConfig::get('wp_site_url') !== $siteurl) {
2302
else {
2303
$siteurl = site_url($path, $scheme);
2304
}
2305
+
2306
+ $siteurl = rtrim($siteurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2307
}
2308
else {
2309
$siteurl = set_url_scheme($siteurl, $scheme);
lib/wordfenceClass.php CHANGED
@@ -397,7 +397,7 @@ class wordfence {
397
if(self::$runInstallCalled){ return; }
398
self::$runInstallCalled = true;
399
if (function_exists('ignore_user_abort')) {
400
- ignore_user_abort(true);
401
}
402
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
403
$previous_version = ((is_multisite() && function_exists('get_network_option')) ? get_network_option(null, 'wordfence_version', '0.0.0') : get_option('wordfence_version', '0.0.0'));
@@ -1298,7 +1298,7 @@ SQL
1298
1299
add_action('wordfence_processAttackData', 'wordfence::processAttackData');
1300
if (!empty($_GET['wordfence_syncAttackData']) && get_site_option('wordfence_syncingAttackData') <= time() - 60 && get_site_option('wordfence_lastSyncAttackData', 0) < time() - 4) {
1301
- ignore_user_abort(true);
1302
update_site_option('wordfence_syncingAttackData', time());
1303
header('Content-Type: text/javascript');
1304
define('WORDFENCE_SYNCING_ATTACK_DATA', true);
@@ -1394,7 +1394,7 @@ SQL
1394
die("WFSCANTESTOK");
1395
}
1396
public static function ajax_doScan_callback(){
1397
- ignore_user_abort(true);
1398
self::$wordfence_wp_version = false;
1399
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
1400
//This is messy, but not sure of a better way to do this without guaranteeing we get $wp_version
397
if(self::$runInstallCalled){ return; }
398
self::$runInstallCalled = true;
399
if (function_exists('ignore_user_abort')) {
400
+ @ignore_user_abort(true);
401
}
402
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
403
$previous_version = ((is_multisite() && function_exists('get_network_option')) ? get_network_option(null, 'wordfence_version', '0.0.0') : get_option('wordfence_version', '0.0.0'));
1298
1299
add_action('wordfence_processAttackData', 'wordfence::processAttackData');
1300
if (!empty($_GET['wordfence_syncAttackData']) && get_site_option('wordfence_syncingAttackData') <= time() - 60 && get_site_option('wordfence_lastSyncAttackData', 0) < time() - 4) {
1301
+ @ignore_user_abort(true);
1302
update_site_option('wordfence_syncingAttackData', time());
1303
header('Content-Type: text/javascript');
1304
define('WORDFENCE_SYNCING_ATTACK_DATA', true);
1394
die("WFSCANTESTOK");
1395
}
1396
public static function ajax_doScan_callback(){
1397
+ @ignore_user_abort(true);
1398
self::$wordfence_wp_version = false;
1399
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
1400
//This is messy, but not sure of a better way to do this without guaranteeing we get $wp_version
lib/wordfenceConstants.php CHANGED
@@ -10,6 +10,7 @@ if (!defined('WORDFENCE_CENTRAL_API_URL_SEC')) { define('WORDFENCE_CENTRAL_API_U
10
if (!defined('WORDFENCE_CENTRAL_PUBLIC_KEY')) { define('WORDFENCE_CENTRAL_PUBLIC_KEY', "\xb6\x33\x81\x05\xdf\xdf\xec\xcf\xf3\xe3\x36\xc6\xf0\x99\xc6\xf7\xca\x05\x36\xca\x87\x54\x53\x43\x31\xf2\xc6\x0d\xe1\x3d\x55\x0f"); }
11
define('WORDFENCE_MAX_SCAN_LOCK_TIME', 86400); //Increased this from 10 mins to 1 day because very big scans run for a long time. Users can use kill.
12
define('WORDFENCE_DEFAULT_MAX_SCAN_TIME', 10800);
13
define('WORDFENCE_TRANSIENTS_TIMEOUT', 3600); //how long are items cached in seconds e.g. files downloaded for diffing
14
define('WORDFENCE_MAX_IPLOC_AGE', 86400); //1 day
15
define('WORDFENCE_CRAWLER_VERIFY_CACHE_TIME', 604800);
10
if (!defined('WORDFENCE_CENTRAL_PUBLIC_KEY')) { define('WORDFENCE_CENTRAL_PUBLIC_KEY', "\xb6\x33\x81\x05\xdf\xdf\xec\xcf\xf3\xe3\x36\xc6\xf0\x99\xc6\xf7\xca\x05\x36\xca\x87\x54\x53\x43\x31\xf2\xc6\x0d\xe1\x3d\x55\x0f"); }
11
define('WORDFENCE_MAX_SCAN_LOCK_TIME', 86400); //Increased this from 10 mins to 1 day because very big scans run for a long time. Users can use kill.
12
define('WORDFENCE_DEFAULT_MAX_SCAN_TIME', 10800);
13
+ if (!defined('WORDFENCE_SCAN_ISSUES_MAX_REPORT')) { define('WORDFENCE_SCAN_ISSUES_MAX_REPORT', 1500); }
14
define('WORDFENCE_TRANSIENTS_TIMEOUT', 3600); //how long are items cached in seconds e.g. files downloaded for diffing
15
define('WORDFENCE_MAX_IPLOC_AGE', 86400); //1 day
16
define('WORDFENCE_CRAWLER_VERIFY_CACHE_TIME', 604800);
lib/wordfenceScanner.php CHANGED
@@ -422,7 +422,7 @@ class wordfenceScanner {
422
));
423
}
424
$regexMatched = true;
425
- $this->scanEngine->recordMetric('malwareSignature', $rule[0], array('file' => $file, 'match' => $matchString, 'before' => $beforeString, 'after' => $afterString, 'md5' => $record->newMD5, 'shac' => $record->SHAC), false);
426
break;
427
}
428
422
));
423
}
424
$regexMatched = true;
425
+ $this->scanEngine->recordMetric('malwareSignature', $rule[0], array('file' => substr($file, 0, 255), 'match' => substr($matchString, 0, 65535), 'before' => $beforeString, 'after' => $afterString, 'md5' => $record->newMD5, 'shac' => $record->SHAC), false);
426
break;
427
}
428
models/scanner/wfScanner.php CHANGED
@@ -214,7 +214,6 @@ class wfScanner {
214
'scansEnabled_passwds' => true,
215
'scansEnabled_diskSpace' => true,
216
'scansEnabled_wafStatus' => true,
217
- 'scansEnabled_dns' => true,
218
'scan_exclude' => wfConfig::get('scan_exclude', ''),
219
'scan_include_extra' => wfConfig::get('scan_include_extra', ''),
220
'scansEnabled_geoipSupport' => true,
@@ -249,7 +248,6 @@ class wfScanner {
249
'scansEnabled_passwds' => true,
250
'scansEnabled_diskSpace' => true,
251
'scansEnabled_wafStatus' => true,
252
- 'scansEnabled_dns' => true,
253
'other_scanOutside' => true,
254
'scansEnabled_scanImages' => true,
255
'scan_exclude' => wfConfig::get('scan_exclude', ''),
@@ -305,7 +303,6 @@ class wfScanner {
305
'scansEnabled_passwds' => false,
306
'scansEnabled_diskSpace' => false,
307
'scansEnabled_wafStatus' => false,
308
- 'scansEnabled_dns' => false,
309
'other_scanOutside' => false,
310
'scansEnabled_scanImages' => false,
311
'scansEnabled_highSense' => false,
@@ -342,7 +339,7 @@ class wfScanner {
342
'scansEnabled_plugins' => 0,
343
'scansEnabled_coreUnknown' => 0.05,
344
'scansEnabled_malware' => 0.05,
345
- 'scansEnabled_fileContents' => 0.05,
346
'scan_include_extra' => 0,
347
'scansEnabled_fileContentsGSB' => 0.05,
348
'scansEnabled_posts' => 0.05,
@@ -352,7 +349,6 @@ class wfScanner {
352
'scansEnabled_suspiciousAdminUsers' => 0.05,
353
'scansEnabled_passwds' => 0.05,
354
'scansEnabled_diskSpace' => 0.05,
355
- 'scansEnabled_dns' => 0.05,
356
'other_scanOutside' => 0,
357
'scansEnabled_scanImages' => 0,
358
'scansEnabled_highSense' => 0,
@@ -505,7 +501,6 @@ class wfScanner {
505
'scansEnabled_checkHowGetIPs',
506
'scansEnabled_diskSpace',
507
'scansEnabled_wafStatus',
508
- 'scansEnabled_dns',
509
'scansEnabled_geoipSupport',
510
);
511
break;
@@ -864,7 +859,6 @@ class wfScanner {
864
'checkSpamIP' => array('checkSpamIP'),
865
'checkGSB' => array('scansEnabled_checkGSB'),
866
'checkHowGetIPs' => array('scansEnabled_checkHowGetIPs'),
867
- 'dns' => array('scansEnabled_dns'),
868
'diskSpace' => array('scansEnabled_diskSpace'),
869
'wafStatus' => array('scansEnabled_wafStatus'),
870
'geoipSupport' => array('scansEnabled_geoipSupport'),
214
'scansEnabled_passwds' => true,
215
'scansEnabled_diskSpace' => true,
216
'scansEnabled_wafStatus' => true,
217
'scan_exclude' => wfConfig::get('scan_exclude', ''),
218
'scan_include_extra' => wfConfig::get('scan_include_extra', ''),
219
'scansEnabled_geoipSupport' => true,
248
'scansEnabled_passwds' => true,
249
'scansEnabled_diskSpace' => true,
250
'scansEnabled_wafStatus' => true,
251
'other_scanOutside' => true,
252
'scansEnabled_scanImages' => true,
253
'scan_exclude' => wfConfig::get('scan_exclude', ''),
303
'scansEnabled_passwds' => false,
304
'scansEnabled_diskSpace' => false,
305
'scansEnabled_wafStatus' => false,
306
'other_scanOutside' => false,
307
'scansEnabled_scanImages' => false,
308
'scansEnabled_highSense' => false,
339
'scansEnabled_plugins' => 0,
340
'scansEnabled_coreUnknown' => 0.05,
341
'scansEnabled_malware' => 0.05,
342
+ 'scansEnabled_fileContents' => 0.1,
343
'scan_include_extra' => 0,
344
'scansEnabled_fileContentsGSB' => 0.05,
345
'scansEnabled_posts' => 0.05,
349
'scansEnabled_suspiciousAdminUsers' => 0.05,
350
'scansEnabled_passwds' => 0.05,
351
'scansEnabled_diskSpace' => 0.05,
352
'other_scanOutside' => 0,
353
'scansEnabled_scanImages' => 0,
354
'scansEnabled_highSense' => 0,
501
'scansEnabled_checkHowGetIPs',
502
'scansEnabled_diskSpace',
503
'scansEnabled_wafStatus',
504
'scansEnabled_geoipSupport',
505
);
506
break;
859
'checkSpamIP' => array('checkSpamIP'),
860
'checkGSB' => array('scansEnabled_checkGSB'),
861
'checkHowGetIPs' => array('scansEnabled_checkHowGetIPs'),
862
'diskSpace' => array('scansEnabled_diskSpace'),
863
'wafStatus' => array('scansEnabled_wafStatus'),
864
'geoipSupport' => array('scansEnabled_geoipSupport'),
modules/login-security/classes/controller/wordfencels.php CHANGED
@@ -176,7 +176,7 @@ END
176
$_runInstallCalled = true;
177
178
if (function_exists('ignore_user_abort')) {
179
- ignore_user_abort(true);
180
}
181
182
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
176
$_runInstallCalled = true;
177
178
if (function_exists('ignore_user_abort')) {
179
+ @ignore_user_abort(true);
180
}
181
182
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
modules/login-security/classes/model/crypto.php CHANGED
@@ -64,6 +64,7 @@ abstract class Model_Crypto {
64
}
65
}
66
if (function_exists('mcrypt_create_iv')) {
67
$rand = @mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM);
68
if (is_string($rand) && self::strlen($rand) === $bytes) {
69
return $rand;
@@ -163,11 +164,12 @@ abstract class Model_Crypto {
163
static $encodings = array();
164
static $overloaded = null;
165
166
- if (is_null($overloaded))
167
$overloaded = function_exists('mb_internal_encoding') && (ini_get('mbstring.func_overload') & 2);
168
169
- if (false === $overloaded)
170
- return;
171
172
if (!$reset) {
173
$encoding = mb_internal_encoding();
64
}
65
}
66
if (function_exists('mcrypt_create_iv')) {
67
+ // phpcs:ignore PHPCompatibility.FunctionUse.RemovedFunctions.mcrypt_create_ivDeprecatedRemoved,PHPCompatibility.Extensions.RemovedExtensions.mcryptDeprecatedRemoved,PHPCompatibility.Constants.RemovedConstants.mcrypt_dev_urandomDeprecatedRemoved
68
$rand = @mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM);
69
if (is_string($rand) && self::strlen($rand) === $bytes) {
70
return $rand;
164
static $encodings = array();
165
static $overloaded = null;
166
167
+ if (is_null($overloaded)) {
168
+ // phpcs:ignore PHPCompatibility.IniDirectives.RemovedIniDirectives.mbstring_func_overloadDeprecated
169
$overloaded = function_exists('mb_internal_encoding') && (ini_get('mbstring.func_overload') & 2);
170
+ }
171
172
+ if (false === $overloaded) { return; }
173
174
if (!$reset) {
175
$encoding = mb_internal_encoding();
modules/login-security/css/{admin-global.1566486436.css → admin-global.1573059078.css} RENAMED
File without changes
modules/login-security/css/{admin.1566486436.css → admin.1573059078.css} RENAMED
File without changes
modules/login-security/css/{colorbox.1566486436.css → colorbox.1573059078.css} RENAMED
File without changes
modules/login-security/css/{font-awesome.1566486436.css → font-awesome.1573059078.css} RENAMED
File without changes
modules/login-security/css/{ionicons.1566486436.css → ionicons.1573059078.css} RENAMED
File without changes
modules/login-security/css/{jquery-ui-timepicker-addon.1566486436.css → jquery-ui-timepicker-addon.1573059078.css} RENAMED
File without changes
modules/login-security/css/{jquery-ui.min.1566486436.css → jquery-ui.min.1573059078.css} RENAMED
File without changes
modules/login-security/css/{jquery-ui.structure.min.1566486436.css → jquery-ui.structure.min.1573059078.css} RENAMED
File without changes
modules/login-security/css/{jquery-ui.theme.min.1566486436.css → jquery-ui.theme.min.1573059078.css} RENAMED
File without changes
modules/login-security/css/{login.1566486436.css → login.1573059078.css} RENAMED
File without changes
modules/login-security/js/{admin-global.1566486436.js → admin-global.1573059078.js} RENAMED
File without changes
modules/login-security/js/{admin.1566486436.js → admin.1573059078.js} RENAMED
File without changes
modules/login-security/js/{jquery-ui-timepicker-addon.1566486436.js → jquery-ui-timepicker-addon.1573059078.js} RENAMED
File without changes
modules/login-security/js/{jquery.colorbox.1566486436.js → jquery.colorbox.1573059078.js} RENAMED
File without changes
modules/login-security/js/{jquery.colorbox.min.1566486436.js → jquery.colorbox.min.1573059078.js} RENAMED
File without changes
modules/login-security/js/{jquery.qrcode.min.1566486436.js → jquery.qrcode.min.1573059078.js} RENAMED
File without changes
modules/login-security/js/{jquery.tmpl.min.1566486436.js → jquery.tmpl.min.1573059078.js} RENAMED
File without changes
modules/login-security/js/{login.1566486436.js → login.1573059078.js} RENAMED
@@ -179,9 +179,11 @@
179
if (!$('#wfls-token').length) {
180
var overlay = $('<div id="wfls-prompt-overlay"></div>');
181
var wrapper = $('<div id="wfls-prompt-wrapper"></div>');
182
- var field = $('<p><label for="wfls-token">2FA Code <a href="javascript:void(0)" class="wfls-2fa-code-help wfls-tooltip-trigger" title="The 2FA Code can be found within the authenticator app you used when first activating two-factor authentication. You may also use one of your recovery codes."><i class="dashicons dashicons-editor-help"></i></a><br/><input type="text" name="wfls-token" id="wfls-token" aria-describedby="wfls-token-error" class="input" value="" size="6" autocomplete="off"/></label></p>');
183
var remember = $('<p class="wfls-remember-device-wrapper"><label for="wfls-remember-device"><input name="wfls-remember-device" type="checkbox" id="wfls-remember-device" value="1" /> Remember for 30 days</label></p>');
184
var button = $('<p class="submit"><input type="submit" name="wfls-token-submit" id="wfls-token-submit" class="button button-primary button-large" value="Log In"/></p>');
185
wrapper.append(field);
186
if (parseInt(WFLSVars.allowremember)) {
187
wrapper.append(remember);
179
if (!$('#wfls-token').length) {
180
var overlay = $('<div id="wfls-prompt-overlay"></div>');
181
var wrapper = $('<div id="wfls-prompt-wrapper"></div>');
182
+ var label = $('<p><label for="wfls-token">2FA Code <a href="javascript:void(0)" class="wfls-2fa-code-help wfls-tooltip-trigger" title="The 2FA Code can be found within the authenticator app you used when first activating two-factor authentication. You may also use one of your recovery codes."><i class="dashicons dashicons-editor-help"></i></a></label></p>');
183
+ var field = $('<p><input type="text" name="wfls-token" id="wfls-token" aria-describedby="wfls-token-error" class="input" value="" size="6" autocomplete="off"/></p>');
184
var remember = $('<p class="wfls-remember-device-wrapper"><label for="wfls-remember-device"><input name="wfls-remember-device" type="checkbox" id="wfls-remember-device" value="1" /> Remember for 30 days</label></p>');
185
var button = $('<p class="submit"><input type="submit" name="wfls-token-submit" id="wfls-token-submit" class="button button-primary button-large" value="Log In"/></p>');
186
+ wrapper.append(label);
187
wrapper.append(field);
188
if (parseInt(WFLSVars.allowremember)) {
189
wrapper.append(remember);
modules/login-security/wordfence-login-security.php CHANGED
@@ -26,8 +26,8 @@ if ($wfCoreActive && !(isset($wfCoreLoading) && $wfCoreLoading)) {
26
else {
27
define('WORDFENCE_LS_FROM_CORE', ($wfCoreActive && isset($wfCoreLoading) && $wfCoreLoading));
28
29
- define('WORDFENCE_LS_VERSION', '1.0.3');
30
- define('WORDFENCE_LS_BUILD_NUMBER', '1566486436');
31
32
if (!defined('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES')) { define('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES', 15); }
33
26
else {
27
define('WORDFENCE_LS_FROM_CORE', ($wfCoreActive && isset($wfCoreLoading) && $wfCoreLoading));
28
29
+ define('WORDFENCE_LS_VERSION', '1.0.4');
30
+ define('WORDFENCE_LS_BUILD_NUMBER', '1573059078');
31
32
if (!defined('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES')) { define('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES', 15); }
33
readme.txt CHANGED
@@ -3,8 +3,8 @@ Contributors: mmaunder, wfryan, wfmatt, wfmattr
3
Tags: security, firewall, malware scanner, web application firewall, two factor authentication, block hackers, country blocking, clean hacked site, blacklist, waf, login security
4
Requires at least: 3.9
5
Requires PHP: 5.3
6
- Tested up to: 5.2
7
- Stable tag: 7.4.0
8
9
Secure your website with the most comprehensive WordPress security plugin. Firewall, malware scan, blocking, live traffic, login security & more.
10
@@ -104,7 +104,6 @@ We offer a Premium API key that gives you real-time updates to the Threat Defens
104
* See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
105
* A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
106
* Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
107
- * Monitor your DNS security for unauthorized DNS changes.
108
* Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
109
110
= What login security features are included =
@@ -112,7 +111,6 @@ We offer a Premium API key that gives you real-time updates to the Threat Defens
112
* See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
113
* A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
114
* Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
115
- * Monitor your DNS security for unauthorized DNS changes.
116
* Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
117
118
= How will I be alerted if my site has a security problem? =
@@ -185,6 +183,18 @@ Secure your website with Wordfence.
185
186
== Changelog ==
187
188
= 7.4.0 - August 22, 2019 =
189
* Improvement: Added a MySQL-based configuration and data storage for the WAF to expand the number of hosting environments supported. For more detail, see: https://www.wordfence.com/help/firewall/mysqli-storage-engine/
190
* Improvement: Updated bundled GeoIP database.
3
Tags: security, firewall, malware scanner, web application firewall, two factor authentication, block hackers, country blocking, clean hacked site, blacklist, waf, login security
4
Requires at least: 3.9
5
Requires PHP: 5.3
6
+ Tested up to: 5.3
7
+ Stable tag: 7.4.1
8
9
Secure your website with the most comprehensive WordPress security plugin. Firewall, malware scan, blocking, live traffic, login security & more.
10
104
* See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
105
* A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
106
* Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
107
* Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
108
109
= What login security features are included =
111
* See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
112
* A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
113
* Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
114
* Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
115
116
= How will I be alerted if my site has a security problem? =
183
184
== Changelog ==
185
186
+ = 7.4.1 - November 6, 2019 =
187
+ * Improvement: Updated the bundled GeoIP database.
188
+ * Improvement: Minor changes to ensure compatibility with PHP 7.4.
189
+ * Improvement: Updated the WHOIS lookup for better reliability.
190
+ * Improvement: Added better diagnostic data when the WAF MySQL storage engine is active.
191
+ * Improvement: Improved the messaging when switching between premium and free licenses.
192
+ * Change: Deprecated DNS changes scan.
193
+ * Change: The plugin will no longer email alerts when Central is managing them.
194
+ * Fix: Added error suppression to ignore_user_abort calls to silence it on hosts with it disabled.
195
+ * Fix: Improved path generation to better avoid outputting extra slashes in URLs.
196
+ * Fix: Applied a length limit to malware reporting to avoid failures due to large content size.
197
+
198
= 7.4.0 - August 22, 2019 =
199
* Improvement: Added a MySQL-based configuration and data storage for the WAF to expand the number of hosting environments supported. For more detail, see: https://www.wordfence.com/help/firewall/mysqli-storage-engine/
200
* Improvement: Updated bundled GeoIP database.
vendor/wordfence/wf-waf/src/lib/utils.php CHANGED
@@ -353,6 +353,7 @@ class wfWAFUtils {
353
'off',
354
'false'
355
))));
356
if ((function_exists("get_magic_quotes_gpc") && get_magic_quotes_gpc()) || $sybaseEnabled) {
357
return self::stripslashes_deep($subject);
358
}
353
'off',
354
'false'
355
))));
356
+ // phpcs:ignore PHPCompatibility.FunctionUse.RemovedFunctions.get_magic_quotes_gpcDeprecated
357
if ((function_exists("get_magic_quotes_gpc") && get_magic_quotes_gpc()) || $sybaseEnabled) {
358
return self::stripslashes_deep($subject);
359
}
views/dashboard/options-group-license.php CHANGED
@@ -146,7 +146,7 @@ if (!isset($collapseable)) {
146
<?php
147
echo wfView::create('common/modal-prompt', array(
148
'title' => __('Confirm Downgrade', 'wordfence'),
149
- 'message' => __('Are you sure you want to downgrade your Wordfence Premium License? This will disable all Premium features and return you to the free version of Wordfence.', 'wordfence'),
150
'primaryButton' => array('id' => 'wf-downgrade-prompt-cancel', 'label' => __('Cancel', 'wordfence'), 'link' => '#'),
151
'secondaryButtons' => array(array('id' => 'wf-downgrade-prompt-downgrade', 'label' => __('Downgrade', 'wordfence'), 'link' => '#')),
152
))->render();
146
<?php
147
echo wfView::create('common/modal-prompt', array(
148
'title' => __('Confirm Downgrade', 'wordfence'),
149
+ 'messageHTML' => __('<p>Are you sure you want to downgrade your Wordfence Premium License? This will disable all Premium features and return you to the free version of Wordfence.</p><p>If autorenew is enabled for the current premium license, the license will renew at the next expiration date. If you would like to turn renewal off or assign the license to another site, log into wordfence.com to change it.</p>', 'wordfence'),
150
'primaryButton' => array('id' => 'wf-downgrade-prompt-cancel', 'label' => __('Cancel', 'wordfence'), 'link' => '#'),
151
'secondaryButtons' => array(array('id' => 'wf-downgrade-prompt-downgrade', 'label' => __('Downgrade', 'wordfence'), 'link' => '#')),
152
))->render();
views/scanner/issue-dnsChange.php DELETED
@@ -1,27 +0,0 @@
1
- <?php
2
- if (!defined('WORDFENCE_VERSION')) { exit; }
3
- /**
4
- * Presents an issue template.
5
- */
6
- echo wfView::create('scanner/issue-base', array(
7
- 'internalType' => 'dnsChange',
8
- 'displayType' => __('DNS Change', 'wordfence'),
9
- 'iconSVG' => '<svg viewBox="0 0 116.8 91.77"><path d="M112.17,35.72A57.35,57.35,0,0,0,81.08,4.63a57.88,57.88,0,0,0-45.36,0A57.38,57.38,0,0,0,4.63,35.72,58.26,58.26,0,0,0,9.19,89.88a4,4,0,0,0,3.52,1.89h91.38a4,4,0,0,0,3.52-1.89,58.25,58.25,0,0,0,4.56-54.16ZM52.5,10.79a8.34,8.34,0,0,1,14.24,5.9,8,8,0,0,1-2.44,5.9,8.34,8.34,0,0,1-11.8,0,8,8,0,0,1-2.44-5.9,8,8,0,0,1,2.44-5.9ZM22.59,64.3a8,8,0,0,1-5.9,2.45,8,8,0,0,1-5.9-2.45,8.34,8.34,0,0,1,0-11.8,8,8,0,0,1,5.9-2.45,8,8,0,0,1,5.9,2.45,8.35,8.35,0,0,1,0,11.8ZM35.1,35.1a8.34,8.34,0,0,1-11.8,0,8.34,8.34,0,0,1,0-11.8,8.35,8.35,0,0,1,11.8,0,8.34,8.34,0,0,1,0,11.8ZM72,35.65l-6.59,24.9a12.39,12.39,0,0,1,4.7,5.93,12.54,12.54,0,0,1-5.41,15.25A12.2,12.2,0,0,1,55.21,83a12,12,0,0,1-7.63-5.8,12.49,12.49,0,0,1,2.8-15.94,12.42,12.42,0,0,1,7-2.84l6.59-24.9a4.1,4.1,0,0,1,2-2.57A3.88,3.88,0,0,1,69,30.57a4.27,4.27,0,0,1,3,5.08Zm9.68-.56a8.34,8.34,0,0,1,0-11.8,8.34,8.34,0,0,1,14.24,5.9A8.34,8.34,0,0,1,81.7,35.1ZM106,64.3a8.34,8.34,0,1,1-11.8-11.8A8.34,8.34,0,1,1,106,64.3Zm0,0"/></svg>',
10
- 'summaryControls' => array(wfView::create('scanner/issue-control-show-details')),
11
- 'detailPairs' => array(
12
- __('Old DNS Records', 'wordfence') => '${data.oldDNS}',
13
- __('New DNS Records', 'wordfence') => '${data.newDNS}',
14
- null,
15
- __('Details', 'wordfence') => '{{html longMsg}}',
16
- ),
17
- 'detailControls' => array(
18
- '<a href="#" class="wf-btn wf-btn-default wf-btn-callout-subtle wf-issue-control-mark-fixed">' . __('Mark as Fixed', 'wordfence') . '</a>',
19
- ),
20
- 'textOutput' => (isset($textOutput) ? $textOutput : null),
21
- 'textOutputDetailPairs' => array(
22
- __('Old DNS Records', 'wordfence') => '$data.oldDNS',
23
- __('New DNS Records', 'wordfence') => '$data.newDNS',
24
- null,
25
- __('Details', 'wordfence') => '$longMsg',
26
- ),
27
- ))->render();
views/scanner/options-group-general.php CHANGED
@@ -50,7 +50,6 @@ if (!isset($collapseable)) {
50
array('key' => 'scansEnabled_passwds', 'label' => __('Check the strength of passwords', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_PASSWORD_STRENGTH)),
51
array('key' => 'scansEnabled_diskSpace', 'label' => __('Monitor disk space', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_DISK_SPACE)),
52
array('key' => 'scansEnabled_wafStatus', 'label' => __('Monitor Web Application Firewall status', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_WAF_STATUS)),
53
- array('key' => 'scansEnabled_dns', 'label' => __('Scan for unauthorized DNS changes', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_DNS_CHANGES)),
54
array('key' => 'other_scanOutside', 'label' => __('Scan files outside your WordPress installation', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS)),
55
array('key' => 'scansEnabled_scanImages', 'label' => __('Scan images, binary, and other files as if they were executable', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_IMAGES_EXECUTABLE)),
56
);
50
array('key' => 'scansEnabled_passwds', 'label' => __('Check the strength of passwords', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_PASSWORD_STRENGTH)),
51
array('key' => 'scansEnabled_diskSpace', 'label' => __('Monitor disk space', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_DISK_SPACE)),
52
array('key' => 'scansEnabled_wafStatus', 'label' => __('Monitor Web Application Firewall status', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_WAF_STATUS)),
53
array('key' => 'other_scanOutside', 'label' => __('Scan files outside your WordPress installation', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS)),
54
array('key' => 'scansEnabled_scanImages', 'label' => __('Scan images, binary, and other files as if they were executable', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_IMAGES_EXECUTABLE)),
55
);
wordfence.php CHANGED
@@ -4,7 +4,7 @@ Plugin Name: Wordfence Security
4
Plugin URI: http://www.wordfence.com/
5
Description: Wordfence Security - Anti-virus, Firewall and Malware Scan
6
Author: Wordfence
7
- Version: 7.4.0
8
Author URI: http://www.wordfence.com/
9
Network: true
10
*/
@@ -15,8 +15,8 @@ if(defined('WP_INSTALLING') && WP_INSTALLING){
15
if (!defined('ABSPATH')) {
16
exit;
17
}
18
- define('WORDFENCE_VERSION', '7.4.0');
19
- define('WORDFENCE_BUILD_NUMBER', '1566486436');
20
define('WORDFENCE_BASENAME', function_exists('plugin_basename') ? plugin_basename(__FILE__) :
21
basename(dirname(__FILE__)) . '/' . basename(__FILE__));
22
4
Plugin URI: http://www.wordfence.com/
5
Description: Wordfence Security - Anti-virus, Firewall and Malware Scan
6
Author: Wordfence
7
+ Version: 7.4.1
8
Author URI: http://www.wordfence.com/
9
Network: true
10
*/
15
if (!defined('ABSPATH')) {
16
exit;
17
}
18
+ define('WORDFENCE_VERSION', '7.4.1');
19
+ define('WORDFENCE_BUILD_NUMBER', '1573059078');
20
define('WORDFENCE_BASENAME', function_exists('plugin_basename') ? plugin_basename(__FILE__) :
21
basename(dirname(__FILE__)) . '/' . basename(__FILE__));
22