Wordfence Security – Firewall & Malware Scan - Version 7.4.1

Version Description

  • November 6, 2019 =
  • Improvement: Updated the bundled GeoIP database.
  • Improvement: Minor changes to ensure compatibility with PHP 7.4.
  • Improvement: Updated the WHOIS lookup for better reliability.
  • Improvement: Added better diagnostic data when the WAF MySQL storage engine is active.
  • Improvement: Improved the messaging when switching between premium and free licenses.
  • Change: Deprecated DNS changes scan.
  • Change: The plugin will no longer email alerts when Central is managing them.
  • Fix: Added error suppression to ignore_user_abort calls to silence it on hosts with it disabled.
  • Fix: Improved path generation to better avoid outputting extra slashes in URLs.
  • Fix: Applied a length limit to malware reporting to avoid failures due to large content size.
Download this release

Release Info

Developer wfryan
Plugin Icon 128x128 Wordfence Security – Firewall & Malware Scan
Version 7.4.1
Comparing to
See all releases

Code changes from version 7.4.0 to 7.4.1

Files changed (79) hide show
  1. css/{activity-report-widget.1566486436.css → activity-report-widget.1573059078.css} +0 -0
  2. css/{diff.1566486436.css → diff.1573059078.css} +0 -0
  3. css/{dt_table.1566486436.css → dt_table.1573059078.css} +0 -0
  4. css/{fullLog.1566486436.css → fullLog.1573059078.css} +0 -0
  5. css/{iptraf.1566486436.css → iptraf.1573059078.css} +0 -0
  6. css/{jquery-ui-timepicker-addon.1566486436.css → jquery-ui-timepicker-addon.1573059078.css} +0 -0
  7. css/{jquery-ui.min.1566486436.css → jquery-ui.min.1573059078.css} +0 -0
  8. css/{jquery-ui.structure.min.1566486436.css → jquery-ui.structure.min.1573059078.css} +0 -0
  9. css/{jquery-ui.theme.min.1566486436.css → jquery-ui.theme.min.1573059078.css} +0 -0
  10. css/{main.1566486436.css → main.1573059078.css} +0 -0
  11. css/{phpinfo.1566486436.css → phpinfo.1573059078.css} +0 -0
  12. css/{wf-adminbar.1566486436.css → wf-adminbar.1573059078.css} +0 -0
  13. css/{wf-colorbox.1566486436.css → wf-colorbox.1573059078.css} +0 -0
  14. css/{wf-font-awesome.1566486436.css → wf-font-awesome.1573059078.css} +0 -0
  15. css/{wf-global.1566486436.css → wf-global.1573059078.css} +0 -0
  16. css/{wf-ionicons.1566486436.css → wf-ionicons.1573059078.css} +0 -0
  17. css/{wf-onboarding.1566486436.css → wf-onboarding.1573059078.css} +0 -0
  18. css/{wf-roboto-font.1566486436.css → wf-roboto-font.1573059078.css} +0 -0
  19. css/{wfselect2.min.1566486436.css → wfselect2.min.1573059078.css} +0 -0
  20. css/{wordfenceBox.1566486436.css → wordfenceBox.1573059078.css} +0 -0
  21. js/{Chart.bundle.min.1566486436.js → Chart.bundle.min.1573059078.js} +0 -0
  22. js/{admin.1566486436.js → admin.1573059078.js} +1 -1
  23. js/{admin.ajaxWatcher.1566486436.js → admin.ajaxWatcher.1573059078.js} +0 -0
  24. js/{admin.liveTraffic.1566486436.js → admin.liveTraffic.1573059078.js} +0 -0
  25. js/{date.1566486436.js → date.1573059078.js} +0 -0
  26. js/{jquery-ui-timepicker-addon.1566486436.js → jquery-ui-timepicker-addon.1573059078.js} +0 -0
  27. js/{jquery.colorbox-min.1566486436.js → jquery.colorbox-min.1573059078.js} +0 -0
  28. js/{jquery.colorbox.1566486436.js → jquery.colorbox.1573059078.js} +0 -0
  29. js/{jquery.dataTables.min.1566486436.js → jquery.dataTables.min.1573059078.js} +0 -0
  30. js/{jquery.qrcode.min.1566486436.js → jquery.qrcode.min.1573059078.js} +0 -0
  31. js/{jquery.tmpl.min.1566486436.js → jquery.tmpl.min.1573059078.js} +0 -0
  32. js/{jquery.tools.min.1566486436.js → jquery.tools.min.1573059078.js} +0 -0
  33. js/{knockout-3.3.0.1566486436.js → knockout-3.3.0.1573059078.js} +0 -0
  34. js/{wfdashboard.1566486436.js → wfdashboard.1573059078.js} +0 -0
  35. js/{wfdropdown.1566486436.js → wfdropdown.1573059078.js} +0 -0
  36. js/{wfglobal.1566486436.js → wfglobal.1573059078.js} +0 -0
  37. js/{wfpopover.1566486436.js → wfpopover.1573059078.js} +0 -0
  38. js/{wfselect2.min.1566486436.js → wfselect2.min.1573059078.js} +0 -0
  39. lib/Diff/Renderer/Html/Array.php +1 -1
  40. lib/GeoLite2-Country.mmdb +0 -0
  41. lib/menu_options.php +0 -1
  42. lib/menu_scanner.php +0 -1
  43. lib/wfConfig.php +0 -3
  44. lib/wfDiagnostic.php +20 -0
  45. lib/wfIssues.php +2 -3
  46. lib/wfScanEngine.php +36 -108
  47. lib/wfSupportController.php +0 -2
  48. lib/wfUtils.php +12 -7
  49. lib/wordfenceClass.php +3 -3
  50. lib/wordfenceConstants.php +1 -0
  51. lib/wordfenceScanner.php +1 -1
  52. models/scanner/wfScanner.php +1 -7
  53. modules/login-security/classes/controller/wordfencels.php +1 -1
  54. modules/login-security/classes/model/crypto.php +5 -3
  55. modules/login-security/css/{admin-global.1566486436.css → admin-global.1573059078.css} +0 -0
  56. modules/login-security/css/{admin.1566486436.css → admin.1573059078.css} +0 -0
  57. modules/login-security/css/{colorbox.1566486436.css → colorbox.1573059078.css} +0 -0
  58. modules/login-security/css/{font-awesome.1566486436.css → font-awesome.1573059078.css} +0 -0
  59. modules/login-security/css/{ionicons.1566486436.css → ionicons.1573059078.css} +0 -0
  60. modules/login-security/css/{jquery-ui-timepicker-addon.1566486436.css → jquery-ui-timepicker-addon.1573059078.css} +0 -0
  61. modules/login-security/css/{jquery-ui.min.1566486436.css → jquery-ui.min.1573059078.css} +0 -0
  62. modules/login-security/css/{jquery-ui.structure.min.1566486436.css → jquery-ui.structure.min.1573059078.css} +0 -0
  63. modules/login-security/css/{jquery-ui.theme.min.1566486436.css → jquery-ui.theme.min.1573059078.css} +0 -0
  64. modules/login-security/css/{login.1566486436.css → login.1573059078.css} +0 -0
  65. modules/login-security/js/{admin-global.1566486436.js → admin-global.1573059078.js} +0 -0
  66. modules/login-security/js/{admin.1566486436.js → admin.1573059078.js} +0 -0
  67. modules/login-security/js/{jquery-ui-timepicker-addon.1566486436.js → jquery-ui-timepicker-addon.1573059078.js} +0 -0
  68. modules/login-security/js/{jquery.colorbox.1566486436.js → jquery.colorbox.1573059078.js} +0 -0
  69. modules/login-security/js/{jquery.colorbox.min.1566486436.js → jquery.colorbox.min.1573059078.js} +0 -0
  70. modules/login-security/js/{jquery.qrcode.min.1566486436.js → jquery.qrcode.min.1573059078.js} +0 -0
  71. modules/login-security/js/{jquery.tmpl.min.1566486436.js → jquery.tmpl.min.1573059078.js} +0 -0
  72. modules/login-security/js/{login.1566486436.js → login.1573059078.js} +3 -1
  73. modules/login-security/wordfence-login-security.php +2 -2
  74. readme.txt +14 -4
  75. vendor/wordfence/wf-waf/src/lib/utils.php +1 -0
  76. views/dashboard/options-group-license.php +1 -1
  77. views/scanner/issue-dnsChange.php +0 -27
  78. views/scanner/options-group-general.php +0 -1
  79. wordfence.php +3 -3
css/{activity-report-widget.1566486436.css → activity-report-widget.1573059078.css} RENAMED
File without changes
css/{diff.1566486436.css → diff.1573059078.css} RENAMED
File without changes
css/{dt_table.1566486436.css → dt_table.1573059078.css} RENAMED
File without changes
css/{fullLog.1566486436.css → fullLog.1573059078.css} RENAMED
File without changes
css/{iptraf.1566486436.css → iptraf.1573059078.css} RENAMED
File without changes
css/{jquery-ui-timepicker-addon.1566486436.css → jquery-ui-timepicker-addon.1573059078.css} RENAMED
File without changes
css/{jquery-ui.min.1566486436.css → jquery-ui.min.1573059078.css} RENAMED
File without changes
css/{jquery-ui.structure.min.1566486436.css → jquery-ui.structure.min.1573059078.css} RENAMED
File without changes
css/{jquery-ui.theme.min.1566486436.css → jquery-ui.theme.min.1573059078.css} RENAMED
File without changes
css/{main.1566486436.css → main.1573059078.css} RENAMED
File without changes
css/{phpinfo.1566486436.css → phpinfo.1573059078.css} RENAMED
File without changes
css/{wf-adminbar.1566486436.css → wf-adminbar.1573059078.css} RENAMED
File without changes
css/{wf-colorbox.1566486436.css → wf-colorbox.1573059078.css} RENAMED
File without changes
css/{wf-font-awesome.1566486436.css → wf-font-awesome.1573059078.css} RENAMED
File without changes
css/{wf-global.1566486436.css → wf-global.1573059078.css} RENAMED
File without changes
css/{wf-ionicons.1566486436.css → wf-ionicons.1573059078.css} RENAMED
File without changes
css/{wf-onboarding.1566486436.css → wf-onboarding.1573059078.css} RENAMED
File without changes
css/{wf-roboto-font.1566486436.css → wf-roboto-font.1573059078.css} RENAMED
File without changes
css/{wfselect2.min.1566486436.css → wfselect2.min.1573059078.css} RENAMED
File without changes
css/{wordfenceBox.1566486436.css → wordfenceBox.1573059078.css} RENAMED
File without changes
js/{Chart.bundle.min.1566486436.js → Chart.bundle.min.1573059078.js} RENAMED
File without changes
js/{admin.1566486436.js → admin.1573059078.js} RENAMED
@@ -46,7 +46,7 @@
46
  basePageName: '',
47
  pendingChanges: {},
48
  scanStalled: false,
49
- siteCleaningIssueTypes: ['file', 'checkGSB', 'checkSpamIP', 'commentBadURL', 'dnsChange', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'spamvertizeCheck', 'suspiciousAdminUsers'],
50
 
51
  //Screen sizes
52
  SCREEN_XS: 'xs',
46
  basePageName: '',
47
  pendingChanges: {},
48
  scanStalled: false,
49
+ siteCleaningIssueTypes: ['file', 'checkGSB', 'checkSpamIP', 'commentBadURL', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'spamvertizeCheck', 'suspiciousAdminUsers'],
50
 
51
  //Screen sizes
52
  SCREEN_XS: 'xs',
js/{admin.ajaxWatcher.1566486436.js → admin.ajaxWatcher.1573059078.js} RENAMED
File without changes
js/{admin.liveTraffic.1566486436.js → admin.liveTraffic.1573059078.js} RENAMED
File without changes
js/{date.1566486436.js → date.1573059078.js} RENAMED
File without changes
js/{jquery-ui-timepicker-addon.1566486436.js → jquery-ui-timepicker-addon.1573059078.js} RENAMED
File without changes
js/{jquery.colorbox-min.1566486436.js → jquery.colorbox-min.1573059078.js} RENAMED
File without changes
js/{jquery.colorbox.1566486436.js → jquery.colorbox.1573059078.js} RENAMED
File without changes
js/{jquery.dataTables.min.1566486436.js → jquery.dataTables.min.1573059078.js} RENAMED
File without changes
js/{jquery.qrcode.min.1566486436.js → jquery.qrcode.min.1573059078.js} RENAMED
File without changes
js/{jquery.tmpl.min.1566486436.js → jquery.tmpl.min.1573059078.js} RENAMED
File without changes
js/{jquery.tools.min.1566486436.js → jquery.tools.min.1573059078.js} RENAMED
File without changes
js/{knockout-3.3.0.1566486436.js → knockout-3.3.0.1573059078.js} RENAMED
File without changes
js/{wfdashboard.1566486436.js → wfdashboard.1573059078.js} RENAMED
File without changes
js/{wfdropdown.1566486436.js → wfdropdown.1573059078.js} RENAMED
File without changes
js/{wfglobal.1566486436.js → wfglobal.1573059078.js} RENAMED
File without changes
js/{wfpopover.1566486436.js → wfpopover.1573059078.js} RENAMED
File without changes
js/{wfselect2.min.1566486436.js → wfselect2.min.1573059078.js} RENAMED
File without changes
lib/Diff/Renderer/Html/Array.php CHANGED
@@ -150,7 +150,7 @@ class Diff_Renderer_Html_Array extends Diff_Renderer_Abstract
150
  {
151
  $start = 0;
152
  $limit = min(strlen($fromLine), strlen($toLine));
153
- while($start < $limit && $fromLine{$start} == $toLine{$start}) {
154
  ++$start;
155
  }
156
  $end = -1;
150
  {
151
  $start = 0;
152
  $limit = min(strlen($fromLine), strlen($toLine));
153
+ while($start < $limit && $fromLine[$start] == $toLine[$start]) {
154
  ++$start;
155
  }
156
  $end = -1;
lib/GeoLite2-Country.mmdb CHANGED
Binary file
lib/menu_options.php CHANGED
@@ -167,7 +167,6 @@ if (isset($_GET['source']) && wfPage::isValidPage($_GET['source'])) {
167
  'wf-option-scansEnabled-passwds' => __('Check the strength of passwords', 'wordfence'),
168
  'wf-option-scansEnabled-diskSpace' => __('Monitor disk space', 'wordfence'),
169
  'wf-option-scansEnabled-wafStatus' => __('Monitor Web Application Firewall status', 'wordfence'),
170
- 'wf-option-scansEnabled-dns' => __('Scan for unauthorized DNS changes', 'wordfence'),
171
  'wf-option-other-scanOutside' => __('Scan files outside your WordPress installation', 'wordfence'),
172
  'wf-option-scansEnabled-scanImages' => __('Scan images, binary, and other files as if they were executable', 'wordfence'),
173
  'wf-option-lowResourceScansEnabled' => __('Use low resource scanning (reduces server load by lengthening the scan duration)', 'wordfence'),
167
  'wf-option-scansEnabled-passwds' => __('Check the strength of passwords', 'wordfence'),
168
  'wf-option-scansEnabled-diskSpace' => __('Monitor disk space', 'wordfence'),
169
  'wf-option-scansEnabled-wafStatus' => __('Monitor Web Application Firewall status', 'wordfence'),
 
170
  'wf-option-other-scanOutside' => __('Scan files outside your WordPress installation', 'wordfence'),
171
  'wf-option-scansEnabled-scanImages' => __('Scan images, binary, and other files as if they were executable', 'wordfence'),
172
  'wf-option-lowResourceScansEnabled' => __('Use low resource scanning (reduces server load by lengthening the scan duration)', 'wordfence'),
lib/menu_scanner.php CHANGED
@@ -254,7 +254,6 @@ echo wfView::create('scanner/issue-knownfile')->render();
254
  echo wfView::create('scanner/issue-configReadable')->render();
255
  echo wfView::create('scanner/issue-publiclyAccessible')->render();
256
  echo wfView::create('scanner/issue-coreUnknown')->render();
257
- echo wfView::create('scanner/issue-dnsChange')->render();
258
  echo wfView::create('scanner/issue-diskSpace')->render();
259
  echo wfView::create('scanner/issue-wafStatus')->render();
260
  echo wfView::create('scanner/issue-geoipSupport')->render();
254
  echo wfView::create('scanner/issue-configReadable')->render();
255
  echo wfView::create('scanner/issue-publiclyAccessible')->render();
256
  echo wfView::create('scanner/issue-coreUnknown')->render();
 
257
  echo wfView::create('scanner/issue-diskSpace')->render();
258
  echo wfView::create('scanner/issue-wafStatus')->render();
259
  echo wfView::create('scanner/issue-geoipSupport')->render();
lib/wfConfig.php CHANGED
@@ -74,7 +74,6 @@ class wfConfig {
74
  "scansEnabled_options" => array('value' => true, 'autoload' => self::AUTOLOAD),
75
  "scansEnabled_wpscan_fullPathDisclosure" => array('value' => true, 'autoload' => self::AUTOLOAD),
76
  "scansEnabled_wpscan_directoryListingEnabled" => array('value' => true, 'autoload' => self::AUTOLOAD),
77
- "scansEnabled_dns" => array('value' => true, 'autoload' => self::AUTOLOAD),
78
  "scansEnabled_scanImages" => array('value' => false, 'autoload' => self::AUTOLOAD),
79
  "scansEnabled_highSense" => array('value' => false, 'autoload' => self::AUTOLOAD),
80
  "scansEnabled_oldVersions" => array('value' => true, 'autoload' => self::AUTOLOAD),
@@ -1924,7 +1923,6 @@ Options -ExecCGI
1924
  'scansEnabled_options',
1925
  'scansEnabled_wpscan_fullPathDisclosure',
1926
  'scansEnabled_wpscan_directoryListingEnabled',
1927
- 'scansEnabled_dns',
1928
  'scansEnabled_scanImages',
1929
  'scansEnabled_highSense',
1930
  'scansEnabled_oldVersions',
@@ -2078,7 +2076,6 @@ Options -ExecCGI
2078
  'scansEnabled_options',
2079
  'scansEnabled_wpscan_fullPathDisclosure',
2080
  'scansEnabled_wpscan_directoryListingEnabled',
2081
- 'scansEnabled_dns',
2082
  'scansEnabled_scanImages',
2083
  'scansEnabled_highSense',
2084
  'scansEnabled_oldVersions',
74
  "scansEnabled_options" => array('value' => true, 'autoload' => self::AUTOLOAD),
75
  "scansEnabled_wpscan_fullPathDisclosure" => array('value' => true, 'autoload' => self::AUTOLOAD),
76
  "scansEnabled_wpscan_directoryListingEnabled" => array('value' => true, 'autoload' => self::AUTOLOAD),
 
77
  "scansEnabled_scanImages" => array('value' => false, 'autoload' => self::AUTOLOAD),
78
  "scansEnabled_highSense" => array('value' => false, 'autoload' => self::AUTOLOAD),
79
  "scansEnabled_oldVersions" => array('value' => true, 'autoload' => self::AUTOLOAD),
1923
  'scansEnabled_options',
1924
  'scansEnabled_wpscan_fullPathDisclosure',
1925
  'scansEnabled_wpscan_directoryListingEnabled',
 
1926
  'scansEnabled_scanImages',
1927
  'scansEnabled_highSense',
1928
  'scansEnabled_oldVersions',
2076
  'scansEnabled_options',
2077
  'scansEnabled_wpscan_fullPathDisclosure',
2078
  'scansEnabled_wpscan_directoryListingEnabled',
 
2079
  'scansEnabled_scanImages',
2080
  'scansEnabled_highSense',
2081
  'scansEnabled_oldVersions',
lib/wfDiagnostic.php CHANGED
@@ -82,6 +82,7 @@ class wfDiagnostic
82
  'description' => __('Current WAF configuration.', 'wordfence'),
83
  'tests' => array(
84
  'wafAutoPrepend' => __('WAF auto prepend active', 'wordfence'),
 
85
  'wafLogPath' => __('WAF log path', 'wordfence'),
86
  'wafSubdirectoryInstall' => __('WAF subdirectory installation', 'wordfence'),
87
  'wafAutoPrependFilePath' => __('wordfence-waf.php path', 'wordfence'),
@@ -211,6 +212,10 @@ class wfDiagnostic
211
 
212
  public function isWAFReadable() {
213
  if (!is_readable(WFWAF_LOG_PATH)) {
 
 
 
 
214
  return array('test' => false, 'message' => __('No files readable', 'wordfence'));
215
  }
216
 
@@ -231,6 +236,10 @@ class wfDiagnostic
231
  }
232
 
233
  if (count($unreadable) > 0) {
 
 
 
 
234
  return array('test' => false, 'message' => implode(', ', $unreadable));
235
  }
236
 
@@ -239,6 +248,10 @@ class wfDiagnostic
239
 
240
  public function isWAFWritable() {
241
  if (!is_writable(WFWAF_LOG_PATH)) {
 
 
 
 
242
  return array('test' => false, 'message' => __('No files writable', 'wordfence'));
243
  }
244
 
@@ -259,6 +272,10 @@ class wfDiagnostic
259
  }
260
 
261
  if (count($unwritable) > 0) {
 
 
 
 
262
  return array('test' => false, 'message' => implode(', ', $unwritable));
263
  }
264
 
@@ -339,6 +356,9 @@ class wfDiagnostic
339
  public function wafAutoPrepend() {
340
  return array('test' => true, 'infoOnly' => true, 'message' => (defined('WFWAF_AUTO_PREPEND') && WFWAF_AUTO_PREPEND ? __('Yes', 'wordfence') : __('No', 'wordfence')));
341
  }
 
 
 
342
  public function wafLogPath() {
343
  $logPath = __('(not set)', 'wordfence');
344
  if (defined('WFWAF_LOG_PATH')) {
82
  'description' => __('Current WAF configuration.', 'wordfence'),
83
  'tests' => array(
84
  'wafAutoPrepend' => __('WAF auto prepend active', 'wordfence'),
85
+ 'wafStorageEngine' => __('WAF storage engine (WFWAF_STORAGE_ENGINE)', 'wordfence'),
86
  'wafLogPath' => __('WAF log path', 'wordfence'),
87
  'wafSubdirectoryInstall' => __('WAF subdirectory installation', 'wordfence'),
88
  'wafAutoPrependFilePath' => __('wordfence-waf.php path', 'wordfence'),
212
 
213
  public function isWAFReadable() {
214
  if (!is_readable(WFWAF_LOG_PATH)) {
215
+ if (defined('WFWAF_STORAGE_ENGINE') && WFWAF_STORAGE_ENGINE == 'mysqli') {
216
+ return array('test' => false, 'infoOnly' => true, 'message' => __('No files readable', 'wordfence'));
217
+ }
218
+
219
  return array('test' => false, 'message' => __('No files readable', 'wordfence'));
220
  }
221
 
236
  }
237
 
238
  if (count($unreadable) > 0) {
239
+ if (defined('WFWAF_STORAGE_ENGINE') && WFWAF_STORAGE_ENGINE == 'mysqli') {
240
+ return array('test' => false, 'infoOnly' => true, 'message' => implode(', ', $unreadable));
241
+ }
242
+
243
  return array('test' => false, 'message' => implode(', ', $unreadable));
244
  }
245
 
248
 
249
  public function isWAFWritable() {
250
  if (!is_writable(WFWAF_LOG_PATH)) {
251
+ if (defined('WFWAF_STORAGE_ENGINE') && WFWAF_STORAGE_ENGINE == 'mysqli') {
252
+ return array('test' => false, 'infoOnly' => true, 'message' => __('No files writable', 'wordfence'));
253
+ }
254
+
255
  return array('test' => false, 'message' => __('No files writable', 'wordfence'));
256
  }
257
 
272
  }
273
 
274
  if (count($unwritable) > 0) {
275
+ if (defined('WFWAF_STORAGE_ENGINE') && WFWAF_STORAGE_ENGINE == 'mysqli') {
276
+ return array('test' => false, 'infoOnly' => true, 'message' => implode(', ', $unwritable));
277
+ }
278
+
279
  return array('test' => false, 'message' => implode(', ', $unwritable));
280
  }
281
 
356
  public function wafAutoPrepend() {
357
  return array('test' => true, 'infoOnly' => true, 'message' => (defined('WFWAF_AUTO_PREPEND') && WFWAF_AUTO_PREPEND ? __('Yes', 'wordfence') : __('No', 'wordfence')));
358
  }
359
+ public function wafStorageEngine() {
360
+ return array('test' => true, 'infoOnly' => true, 'message' => (defined('WFWAF_STORAGE_ENGINE') ? WFWAF_STORAGE_ENGINE : __('(default)', 'wordfence')));
361
+ }
362
  public function wafLogPath() {
363
  $logPath = __('(not set)', 'wordfence');
364
  if (defined('WFWAF_LOG_PATH')) {
lib/wfIssues.php CHANGED
@@ -69,7 +69,6 @@ class wfIssues {
69
  'configReadable' => wfIssues::SEVERITY_CRITICAL,
70
  'wfPluginVulnerable' => wfIssues::SEVERITY_HIGH,
71
  'coreUnknown' => wfIssues::SEVERITY_HIGH,
72
- 'dnsChangeDNS' => wfIssues::SEVERITY_HIGH,
73
  'easyPasswordWeak' => wfIssues::SEVERITY_HIGH,
74
  'knownfile' => wfIssues::SEVERITY_HIGH,
75
  'optionBadURL' => wfIssues::SEVERITY_HIGH,
@@ -85,7 +84,7 @@ class wfIssues {
85
  );
86
 
87
  public static function validIssueTypes() {
88
- return array('checkHowGetIPs', 'checkSpamIP', 'commentBadURL', 'configReadable', 'coreUnknown', 'database', 'diskSpace', 'wafStatus', 'dnsChange', 'easyPassword', 'file', 'geoipSupport', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'publiclyAccessible', 'spamvertizeCheck', 'suspiciousAdminUsers', 'timelimit', 'wfPluginAbandoned', 'wfPluginRemoved', 'wfPluginUpgrade', 'wfPluginVulnerable', 'wfThemeUpgrade', 'wfUpgrade', 'wpscan_directoryList', 'wpscan_fullPathDiscl');
89
  }
90
 
91
  public static function statusPrep(){
@@ -546,7 +545,7 @@ class wfIssues {
546
  /** @var wpdb $wpdb */
547
  global $wpdb;
548
 
549
- $siteCleaningTypes = array('file', 'checkGSB', 'checkSpamIP', 'commentBadURL', 'dnsChange', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'spamvertizeCheck', 'suspiciousAdminUsers');
550
  $sortTagging = 'CASE';
551
  foreach ($siteCleaningTypes as $index => $t) {
552
  $sortTagging .= ' WHEN type = \'' . esc_sql($t) . '\' THEN ' . ((int) $index);
69
  'configReadable' => wfIssues::SEVERITY_CRITICAL,
70
  'wfPluginVulnerable' => wfIssues::SEVERITY_HIGH,
71
  'coreUnknown' => wfIssues::SEVERITY_HIGH,
 
72
  'easyPasswordWeak' => wfIssues::SEVERITY_HIGH,
73
  'knownfile' => wfIssues::SEVERITY_HIGH,
74
  'optionBadURL' => wfIssues::SEVERITY_HIGH,
84
  );
85
 
86
  public static function validIssueTypes() {
87
+ return array('checkHowGetIPs', 'checkSpamIP', 'commentBadURL', 'configReadable', 'coreUnknown', 'database', 'diskSpace', 'wafStatus', 'easyPassword', 'file', 'geoipSupport', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'publiclyAccessible', 'spamvertizeCheck', 'suspiciousAdminUsers', 'timelimit', 'wfPluginAbandoned', 'wfPluginRemoved', 'wfPluginUpgrade', 'wfPluginVulnerable', 'wfThemeUpgrade', 'wfUpgrade', 'wpscan_directoryList', 'wpscan_fullPathDiscl');
88
  }
89
 
90
  public static function statusPrep(){
545
  /** @var wpdb $wpdb */
546
  global $wpdb;
547
 
548
+ $siteCleaningTypes = array('file', 'checkGSB', 'checkSpamIP', 'commentBadURL', 'knownfile', 'optionBadURL', 'postBadTitle', 'postBadURL', 'spamvertizeCheck', 'suspiciousAdminUsers');
549
  $sortTagging = 'CASE';
550
  foreach ($siteCleaningTypes as $index => $t) {
551
  $sortTagging .= ' WHEN type = \'' . esc_sql($t) . '\' THEN ' . ((int) $index);
lib/wfScanEngine.php CHANGED
@@ -331,10 +331,45 @@ class wfScanEngine {
331
  exit(0);
332
  }
333
  public function emailNewIssues($timeLimitReached = false){
334
- $this->i->emailNewIssues($timeLimitReached, $this->scanController);
 
 
335
  }
336
  public function submitMetrics() {
337
  if (wfConfig::get('other_WFNet', true)) {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
338
  $this->api->call('record_scan_metrics', array(), array('metrics' => $this->metrics));
339
  }
340
  }
@@ -1433,113 +1468,6 @@ class wfScanEngine {
1433
  wfIssues::statusEnd($this->statusIDX['wafStatus'], $haveIssues);
1434
  $this->scanController->completeStage(wfScanner::STAGE_SERVER_STATE, $haveIssues);
1435
  }
1436
- private function scan_dns(){
1437
- if(! function_exists('dns_get_record')){
1438
- $this->status(1, 'info', "Skipping DNS scan because this system does not support dns_get_record()");
1439
- return;
1440
- }
1441
- $this->statusIDX['dns'] = wfIssues::statusStart("Scanning DNS for unauthorized changes");
1442
- $this->scanController->startStage(wfScanner::STAGE_SERVER_STATE);
1443
- $haveIssues = wfIssues::STATUS_SECURE;
1444
- $home = get_home_url();
1445
- if(preg_match('/https?:\/\/([^\/]+)/i', $home, $matches)){
1446
- $host = strtolower($matches[1]);
1447
- $this->status(2, 'info', "Starting DNS scan for $host");
1448
-
1449
- $cnameArrRec = @dns_get_record($host, DNS_CNAME);
1450
- $cnameArr = array();
1451
- $cnamesWeMustTrack = array();
1452
- if ($cnameArrRec) {
1453
- foreach($cnameArrRec as $elem){
1454
- $this->status(2, 'info', "Scanning CNAME DNS record for " . $elem['host']);
1455
- if($elem['host'] == $host){
1456
- $cnameArr[] = $elem;
1457
- $cnamesWeMustTrack[] = $elem['target'];
1458
- }
1459
- }
1460
- }
1461
-
1462
- function wfAnonFunc1($a){ return $a['host'] . ' points to ' . $a['target']; }
1463
- $cnameArr = array_map('wfAnonFunc1', $cnameArr);
1464
- sort($cnameArr, SORT_STRING);
1465
- $currentCNAME = implode(', ', $cnameArr);
1466
- $loggedCNAME = wfConfig::get('wf_dnsCNAME');
1467
- $dnsLogged = wfConfig::get('wf_dnsLogged', false);
1468
- $msg = "A change in your DNS records may indicate that a hacker has hacked into your DNS administration system and has pointed your email or website to their own server for malicious purposes. It could also indicate that your domain has expired. If you made this change yourself you can mark it 'resolved' and safely ignore it.";
1469
- if($dnsLogged && $loggedCNAME != $currentCNAME){
1470
- $added = $this->addIssue('dnsChange', wfIssues::SEVERITY_HIGH, 'dnsChanges', 'dnsChanges' . $currentCNAME, "Your DNS records have changed", "We have detected a change in the CNAME records of your DNS configuration for the domain $host. A CNAME record is an alias that is used to point a domain name to another domain name. For example foo.example.com can point to bar.example.com which then points to an IP address of 10.1.1.1. $msg", array(
1471
- 'type' => 'CNAME',
1472
- 'host' => $host,
1473
- 'oldDNS' => $loggedCNAME,
1474
- 'newDNS' => $currentCNAME
1475
- ));
1476
- if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) { $haveIssues = wfIssues::STATUS_PROBLEM; }
1477
- else if ($haveIssues != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) { $haveIssues = wfIssues::STATUS_IGNORED; }
1478
- }
1479
- wfConfig::set('wf_dnsCNAME', $currentCNAME);
1480
-
1481
- $aArrRec = @dns_get_record($host, DNS_A);
1482
- $aArr = array();
1483
- if ($aArrRec) {
1484
- foreach($aArrRec as $elem){
1485
- $this->status(2, 'info', "Scanning DNS A record for " . $elem['host']);
1486
- if($elem['host'] == $host || in_array($elem['host'], $cnamesWeMustTrack) ){
1487
- $aArr[] = $elem;
1488
- }
1489
- }
1490
- }
1491
- function wfAnonFunc2($a){ return $a['host'] . ' points to ' . $a['ip']; }
1492
- $aArr = array_map('wfAnonFunc2', $aArr);
1493
- sort($aArr, SORT_STRING);
1494
- $currentA = implode(', ', $aArr);
1495
- $loggedA = wfConfig::get('wf_dnsA');
1496
- $dnsLogged = wfConfig::get('wf_dnsLogged', false);
1497
- if($dnsLogged && $loggedA != $currentA){
1498
- $added = $this->addIssue('dnsChange', wfIssues::SEVERITY_HIGH, 'dnsChanges', 'dnsChanges' . $currentA, "Your DNS records have changed", "We have detected a change in the A records of your DNS configuration that may affect the domain $host. An A record is a record in DNS that points a domain name to an IP address. $msg", array(
1499
- 'type' => 'A',
1500
- 'host' => $host,
1501
- 'oldDNS' => $loggedA,
1502
- 'newDNS' => $currentA
1503
- ));
1504
- if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) { $haveIssues = wfIssues::STATUS_PROBLEM; }
1505
- else if ($haveIssues != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) { $haveIssues = wfIssues::STATUS_IGNORED; }
1506
- }
1507
- wfConfig::set('wf_dnsA', $currentA);
1508
-
1509
- $mxArrRec = @dns_get_record($host, DNS_MX);
1510
- $mxArr = array();
1511
- if ($mxArrRec) {
1512
- foreach ($mxArrRec as $elem)
1513
- {
1514
- $this->status(2, 'info', "Scanning DNS MX record for " . $elem['host']);
1515
- if ($elem['host'] == $host)
1516
- {
1517
- $mxArr[] = $elem;
1518
- }
1519
- }
1520
- }
1521
- function wfAnonFunc3($a){ return $a['target']; }
1522
- $mxArr = array_map('wfAnonFunc3', $mxArr);
1523
- sort($mxArr, SORT_STRING);
1524
- $currentMX = implode(', ', $mxArr);
1525
- $loggedMX = wfConfig::get('wf_dnsMX');
1526
- if($dnsLogged && $loggedMX != $currentMX){
1527
- $added = $this->addIssue('dnsChange', wfIssues::SEVERITY_HIGH, 'dnsChanges', 'dnsChanges' . $currentMX, "Your DNS records have changed", "We have detected a change in the email server (MX) records of your DNS configuration for the domain $host. $msg", array(
1528
- 'type' => 'MX',
1529
- 'host' => $host,
1530
- 'oldDNS' => $loggedMX,
1531
- 'newDNS' => $currentMX
1532
- ));
1533
- if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) { $haveIssues = wfIssues::STATUS_PROBLEM; }
1534
- else if ($haveIssues != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) { $haveIssues = wfIssues::STATUS_IGNORED; }
1535
- }
1536
- wfConfig::set('wf_dnsMX', $currentMX);
1537
-
1538
- wfConfig::set('wf_dnsLogged', 1);
1539
- }
1540
- wfIssues::statusEnd($this->statusIDX['dns'], $haveIssues);
1541
- $this->scanController->completeStage(wfScanner::STAGE_SERVER_STATE, $haveIssues);
1542
- }
1543
 
1544
  private function scan_oldVersions_init() {
1545
  $this->statusIDX['oldVersions'] = wfIssues::statusStart("Scanning for old themes, plugins and core files");
331
  exit(0);
332
  }
333
  public function emailNewIssues($timeLimitReached = false){
334
+ if (!wfCentral::pluginAlertingDisabled()) {
335
+ $this->i->emailNewIssues($timeLimitReached, $this->scanController);
336
+ }
337
  }
338
  public function submitMetrics() {
339
  if (wfConfig::get('other_WFNet', true)) {
340
+ //Trim down the malware matches if needed to allow the report call to succeed
341
+ if (isset($this->metrics['malwareSignature'])) {
342
+ //Get count
343
+ $count = 0;
344
+ $extra_count = 0;
345
+ $rules_with_extras = 0;
346
+ foreach ($this->metrics['malwareSignature'] as $rule => $payloads) {
347
+ $count += count($payloads);
348
+ $extra_count += (count($payloads) - 1);
349
+ if (count($payloads) > 1) {
350
+ $rules_with_extras++;
351
+ }
352
+ }
353
+
354
+ //Trim additional matches
355
+ $overage = $extra_count - WORDFENCE_SCAN_ISSUES_MAX_REPORT;
356
+ if ($overage > 0) {
357
+ foreach ($this->metrics['malwareSignature'] as $rule => $payloads) {
358
+ $percent = min(1, (count($payloads) - 1) / $extra_count); //Percentage of the overage this rule is responsible for
359
+ $to_remove = min(count($payloads) - 1, ceil($percent * $overage)); //Remove the lesser of (all but one, the percentage of the overage)
360
+ $sliced = array_slice($this->metrics['malwareSignature'][$rule], 0, max(1, count($payloads) - $to_remove));
361
+ $count -= (count($this->metrics['malwareSignature'][$rule]) - count($sliced));
362
+ $this->metrics['malwareSignature'][$rule] = $sliced;
363
+ }
364
+ }
365
+
366
+ //Trim single matches
367
+ if ($count > WORDFENCE_SCAN_ISSUES_MAX_REPORT) {
368
+ $sliced = array_slice($this->metrics['malwareSignature'], 0, WORDFENCE_SCAN_ISSUES_MAX_REPORT, true);
369
+ $this->metrics['malwareSignature'] = $sliced;
370
+ }
371
+ }
372
+
373
  $this->api->call('record_scan_metrics', array(), array('metrics' => $this->metrics));
374
  }
375
  }
1468
  wfIssues::statusEnd($this->statusIDX['wafStatus'], $haveIssues);
1469
  $this->scanController->completeStage(wfScanner::STAGE_SERVER_STATE, $haveIssues);
1470
  }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1471
 
1472
  private function scan_oldVersions_init() {
1473
  $this->statusIDX['oldVersions'] = wfIssues::statusStart("Scanning for old themes, plugins and core files");
lib/wfSupportController.php CHANGED
@@ -124,7 +124,6 @@ class wfSupportController {
124
  const ITEM_SCAN_OPTION_PASSWORD_STRENGTH = 'scan-option-password-strength';
125
  const ITEM_SCAN_OPTION_DISK_SPACE = 'scan-option-disk-space';
126
  const ITEM_SCAN_OPTION_WAF_STATUS = 'scan-option-waf-status';
127
- const ITEM_SCAN_OPTION_DNS_CHANGES = 'scan-option-dns-changes';
128
  const ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS = 'scan-option-outside-wordpress';
129
  const ITEM_SCAN_OPTION_IMAGES_EXECUTABLE = 'scan-option-images-executable';
130
  const ITEM_SCAN_OPTION_HIGH_SENSITIVITY = 'scan-option-high-sensitivity';
@@ -306,7 +305,6 @@ class wfSupportController {
306
  case self::ITEM_SCAN_OPTION_PASSWORD_STRENGTH:
307
  case self::ITEM_SCAN_OPTION_DISK_SPACE:
308
  case self::ITEM_SCAN_OPTION_WAF_STATUS:
309
- case self::ITEM_SCAN_OPTION_DNS_CHANGES:
310
  case self::ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS:
311
  case self::ITEM_SCAN_OPTION_IMAGES_EXECUTABLE:
312
  case self::ITEM_SCAN_OPTION_HIGH_SENSITIVITY:
124
  const ITEM_SCAN_OPTION_PASSWORD_STRENGTH = 'scan-option-password-strength';
125
  const ITEM_SCAN_OPTION_DISK_SPACE = 'scan-option-disk-space';
126
  const ITEM_SCAN_OPTION_WAF_STATUS = 'scan-option-waf-status';
 
127
  const ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS = 'scan-option-outside-wordpress';
128
  const ITEM_SCAN_OPTION_IMAGES_EXECUTABLE = 'scan-option-images-executable';
129
  const ITEM_SCAN_OPTION_HIGH_SENSITIVITY = 'scan-option-high-sensitivity';
305
  case self::ITEM_SCAN_OPTION_PASSWORD_STRENGTH:
306
  case self::ITEM_SCAN_OPTION_DISK_SPACE:
307
  case self::ITEM_SCAN_OPTION_WAF_STATUS:
 
308
  case self::ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS:
309
  case self::ITEM_SCAN_OPTION_IMAGES_EXECUTABLE:
310
  case self::ITEM_SCAN_OPTION_HIGH_SENSITIVITY:
lib/wfUtils.php CHANGED
@@ -2155,9 +2155,9 @@ class wfUtils {
2155
  else if (is_multisite()) {
2156
  $current_network = get_network();
2157
  if ( 'relative' == $scheme )
2158
- $url = $current_network->path;
2159
  else
2160
- $url = 'http://' . $current_network->domain . $current_network->path;
2161
  }
2162
 
2163
  if ( ! in_array( $scheme, array( 'http', 'https', 'relative' ) ) ) {
@@ -2187,11 +2187,12 @@ class wfUtils {
2187
  if (function_exists('get_bloginfo') && empty($homeurl)) {
2188
  if (is_multisite()) {
2189
  $homeurl = network_home_url();
2190
- $homeurl = rtrim($homeurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2191
  }
2192
  else {
2193
  $homeurl = home_url();
2194
  }
 
 
2195
  }
2196
 
2197
  if (wfConfig::get('wp_home_url') !== $homeurl) {
@@ -2204,11 +2205,12 @@ class wfUtils {
2204
  if (function_exists('get_bloginfo') && empty($homeurl)) {
2205
  if (is_multisite()) {
2206
  $homeurl = network_home_url($path, $scheme);
2207
- $homeurl = rtrim($homeurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2208
  }
2209
  else {
2210
  $homeurl = home_url($path, $scheme);
2211
  }
 
 
2212
  }
2213
  else {
2214
  $homeurl = set_url_scheme($homeurl, $scheme);
@@ -2238,9 +2240,9 @@ class wfUtils {
2238
  else if (is_multisite()) {
2239
  $current_network = get_network();
2240
  if ( 'relative' == $scheme )
2241
- $url = $current_network->path;
2242
  else
2243
- $url = 'http://' . $current_network->domain . $current_network->path;
2244
  }
2245
 
2246
  if ( ! in_array( $scheme, array( 'http', 'https', 'relative' ) ) ) {
@@ -2270,11 +2272,12 @@ class wfUtils {
2270
  if (function_exists('get_bloginfo') && empty($siteurl)) {
2271
  if (is_multisite()) {
2272
  $siteurl = network_site_url();
2273
- $siteurl = rtrim($siteurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2274
  }
2275
  else {
2276
  $siteurl = site_url();
2277
  }
 
 
2278
  }
2279
 
2280
  if (wfConfig::get('wp_site_url') !== $siteurl) {
@@ -2299,6 +2302,8 @@ class wfUtils {
2299
  else {
2300
  $siteurl = site_url($path, $scheme);
2301
  }
 
 
2302
  }
2303
  else {
2304
  $siteurl = set_url_scheme($siteurl, $scheme);
2155
  else if (is_multisite()) {
2156
  $current_network = get_network();
2157
  if ( 'relative' == $scheme )
2158
+ $url = rtrim($current_network->path, '/');
2159
  else
2160
+ $url = 'http://' . rtrim($current_network->domain, '/') . '/' . trim($current_network->path, '/');
2161
  }
2162
 
2163
  if ( ! in_array( $scheme, array( 'http', 'https', 'relative' ) ) ) {
2187
  if (function_exists('get_bloginfo') && empty($homeurl)) {
2188
  if (is_multisite()) {
2189
  $homeurl = network_home_url();
 
2190
  }
2191
  else {
2192
  $homeurl = home_url();
2193
  }
2194
+
2195
+ $homeurl = rtrim($homeurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2196
  }
2197
 
2198
  if (wfConfig::get('wp_home_url') !== $homeurl) {
2205
  if (function_exists('get_bloginfo') && empty($homeurl)) {
2206
  if (is_multisite()) {
2207
  $homeurl = network_home_url($path, $scheme);
 
2208
  }
2209
  else {
2210
  $homeurl = home_url($path, $scheme);
2211
  }
2212
+
2213
+ $homeurl = rtrim($homeurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2214
  }
2215
  else {
2216
  $homeurl = set_url_scheme($homeurl, $scheme);
2240
  else if (is_multisite()) {
2241
  $current_network = get_network();
2242
  if ( 'relative' == $scheme )
2243
+ $url = rtrim($current_network->path, '/');
2244
  else
2245
+ $url = 'http://' . rtrim($current_network->domain, '/') . '/' . trim($current_network->path, '/');
2246
  }
2247
 
2248
  if ( ! in_array( $scheme, array( 'http', 'https', 'relative' ) ) ) {
2272
  if (function_exists('get_bloginfo') && empty($siteurl)) {
2273
  if (is_multisite()) {
2274
  $siteurl = network_site_url();
 
2275
  }
2276
  else {
2277
  $siteurl = site_url();
2278
  }
2279
+
2280
+ $siteurl = rtrim($siteurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2281
  }
2282
 
2283
  if (wfConfig::get('wp_site_url') !== $siteurl) {
2302
  else {
2303
  $siteurl = site_url($path, $scheme);
2304
  }
2305
+
2306
+ $siteurl = rtrim($siteurl, '/'); //Because previously we used get_bloginfo and it returns http://example.com without a '/' char.
2307
  }
2308
  else {
2309
  $siteurl = set_url_scheme($siteurl, $scheme);
lib/wordfenceClass.php CHANGED
@@ -397,7 +397,7 @@ class wordfence {
397
  if(self::$runInstallCalled){ return; }
398
  self::$runInstallCalled = true;
399
  if (function_exists('ignore_user_abort')) {
400
- ignore_user_abort(true);
401
  }
402
  if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
403
  $previous_version = ((is_multisite() && function_exists('get_network_option')) ? get_network_option(null, 'wordfence_version', '0.0.0') : get_option('wordfence_version', '0.0.0'));
@@ -1298,7 +1298,7 @@ SQL
1298
 
1299
  add_action('wordfence_processAttackData', 'wordfence::processAttackData');
1300
  if (!empty($_GET['wordfence_syncAttackData']) && get_site_option('wordfence_syncingAttackData') <= time() - 60 && get_site_option('wordfence_lastSyncAttackData', 0) < time() - 4) {
1301
- ignore_user_abort(true);
1302
  update_site_option('wordfence_syncingAttackData', time());
1303
  header('Content-Type: text/javascript');
1304
  define('WORDFENCE_SYNCING_ATTACK_DATA', true);
@@ -1394,7 +1394,7 @@ SQL
1394
  die("WFSCANTESTOK");
1395
  }
1396
  public static function ajax_doScan_callback(){
1397
- ignore_user_abort(true);
1398
  self::$wordfence_wp_version = false;
1399
  if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
1400
  //This is messy, but not sure of a better way to do this without guaranteeing we get $wp_version
397
  if(self::$runInstallCalled){ return; }
398
  self::$runInstallCalled = true;
399
  if (function_exists('ignore_user_abort')) {
400
+ @ignore_user_abort(true);
401
  }
402
  if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
403
  $previous_version = ((is_multisite() && function_exists('get_network_option')) ? get_network_option(null, 'wordfence_version', '0.0.0') : get_option('wordfence_version', '0.0.0'));
1298
 
1299
  add_action('wordfence_processAttackData', 'wordfence::processAttackData');
1300
  if (!empty($_GET['wordfence_syncAttackData']) && get_site_option('wordfence_syncingAttackData') <= time() - 60 && get_site_option('wordfence_lastSyncAttackData', 0) < time() - 4) {
1301
+ @ignore_user_abort(true);
1302
  update_site_option('wordfence_syncingAttackData', time());
1303
  header('Content-Type: text/javascript');
1304
  define('WORDFENCE_SYNCING_ATTACK_DATA', true);
1394
  die("WFSCANTESTOK");
1395
  }
1396
  public static function ajax_doScan_callback(){
1397
+ @ignore_user_abort(true);
1398
  self::$wordfence_wp_version = false;
1399
  if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
1400
  //This is messy, but not sure of a better way to do this without guaranteeing we get $wp_version
lib/wordfenceConstants.php CHANGED
@@ -10,6 +10,7 @@ if (!defined('WORDFENCE_CENTRAL_API_URL_SEC')) { define('WORDFENCE_CENTRAL_API_U
10
  if (!defined('WORDFENCE_CENTRAL_PUBLIC_KEY')) { define('WORDFENCE_CENTRAL_PUBLIC_KEY', "\xb6\x33\x81\x05\xdf\xdf\xec\xcf\xf3\xe3\x36\xc6\xf0\x99\xc6\xf7\xca\x05\x36\xca\x87\x54\x53\x43\x31\xf2\xc6\x0d\xe1\x3d\x55\x0f"); }
11
  define('WORDFENCE_MAX_SCAN_LOCK_TIME', 86400); //Increased this from 10 mins to 1 day because very big scans run for a long time. Users can use kill.
12
  define('WORDFENCE_DEFAULT_MAX_SCAN_TIME', 10800);
 
13
  define('WORDFENCE_TRANSIENTS_TIMEOUT', 3600); //how long are items cached in seconds e.g. files downloaded for diffing
14
  define('WORDFENCE_MAX_IPLOC_AGE', 86400); //1 day
15
  define('WORDFENCE_CRAWLER_VERIFY_CACHE_TIME', 604800);
10
  if (!defined('WORDFENCE_CENTRAL_PUBLIC_KEY')) { define('WORDFENCE_CENTRAL_PUBLIC_KEY', "\xb6\x33\x81\x05\xdf\xdf\xec\xcf\xf3\xe3\x36\xc6\xf0\x99\xc6\xf7\xca\x05\x36\xca\x87\x54\x53\x43\x31\xf2\xc6\x0d\xe1\x3d\x55\x0f"); }
11
  define('WORDFENCE_MAX_SCAN_LOCK_TIME', 86400); //Increased this from 10 mins to 1 day because very big scans run for a long time. Users can use kill.
12
  define('WORDFENCE_DEFAULT_MAX_SCAN_TIME', 10800);
13
+ if (!defined('WORDFENCE_SCAN_ISSUES_MAX_REPORT')) { define('WORDFENCE_SCAN_ISSUES_MAX_REPORT', 1500); }
14
  define('WORDFENCE_TRANSIENTS_TIMEOUT', 3600); //how long are items cached in seconds e.g. files downloaded for diffing
15
  define('WORDFENCE_MAX_IPLOC_AGE', 86400); //1 day
16
  define('WORDFENCE_CRAWLER_VERIFY_CACHE_TIME', 604800);
lib/wordfenceScanner.php CHANGED
@@ -422,7 +422,7 @@ class wordfenceScanner {
422
  ));
423
  }
424
  $regexMatched = true;
425
- $this->scanEngine->recordMetric('malwareSignature', $rule[0], array('file' => $file, 'match' => $matchString, 'before' => $beforeString, 'after' => $afterString, 'md5' => $record->newMD5, 'shac' => $record->SHAC), false);
426
  break;
427
  }
428
 
422
  ));
423
  }
424
  $regexMatched = true;
425
+ $this->scanEngine->recordMetric('malwareSignature', $rule[0], array('file' => substr($file, 0, 255), 'match' => substr($matchString, 0, 65535), 'before' => $beforeString, 'after' => $afterString, 'md5' => $record->newMD5, 'shac' => $record->SHAC), false);
426
  break;
427
  }
428
 
models/scanner/wfScanner.php CHANGED
@@ -214,7 +214,6 @@ class wfScanner {
214
  'scansEnabled_passwds' => true,
215
  'scansEnabled_diskSpace' => true,
216
  'scansEnabled_wafStatus' => true,
217
- 'scansEnabled_dns' => true,
218
  'scan_exclude' => wfConfig::get('scan_exclude', ''),
219
  'scan_include_extra' => wfConfig::get('scan_include_extra', ''),
220
  'scansEnabled_geoipSupport' => true,
@@ -249,7 +248,6 @@ class wfScanner {
249
  'scansEnabled_passwds' => true,
250
  'scansEnabled_diskSpace' => true,
251
  'scansEnabled_wafStatus' => true,
252
- 'scansEnabled_dns' => true,
253
  'other_scanOutside' => true,
254
  'scansEnabled_scanImages' => true,
255
  'scan_exclude' => wfConfig::get('scan_exclude', ''),
@@ -305,7 +303,6 @@ class wfScanner {
305
  'scansEnabled_passwds' => false,
306
  'scansEnabled_diskSpace' => false,
307
  'scansEnabled_wafStatus' => false,
308
- 'scansEnabled_dns' => false,
309
  'other_scanOutside' => false,
310
  'scansEnabled_scanImages' => false,
311
  'scansEnabled_highSense' => false,
@@ -342,7 +339,7 @@ class wfScanner {
342
  'scansEnabled_plugins' => 0,
343
  'scansEnabled_coreUnknown' => 0.05,
344
  'scansEnabled_malware' => 0.05,
345
- 'scansEnabled_fileContents' => 0.05,
346
  'scan_include_extra' => 0,
347
  'scansEnabled_fileContentsGSB' => 0.05,
348
  'scansEnabled_posts' => 0.05,
@@ -352,7 +349,6 @@ class wfScanner {
352
  'scansEnabled_suspiciousAdminUsers' => 0.05,
353
  'scansEnabled_passwds' => 0.05,
354
  'scansEnabled_diskSpace' => 0.05,
355
- 'scansEnabled_dns' => 0.05,
356
  'other_scanOutside' => 0,
357
  'scansEnabled_scanImages' => 0,
358
  'scansEnabled_highSense' => 0,
@@ -505,7 +501,6 @@ class wfScanner {
505
  'scansEnabled_checkHowGetIPs',
506
  'scansEnabled_diskSpace',
507
  'scansEnabled_wafStatus',
508
- 'scansEnabled_dns',
509
  'scansEnabled_geoipSupport',
510
  );
511
  break;
@@ -864,7 +859,6 @@ class wfScanner {
864
  'checkSpamIP' => array('checkSpamIP'),
865
  'checkGSB' => array('scansEnabled_checkGSB'),
866
  'checkHowGetIPs' => array('scansEnabled_checkHowGetIPs'),
867
- 'dns' => array('scansEnabled_dns'),
868
  'diskSpace' => array('scansEnabled_diskSpace'),
869
  'wafStatus' => array('scansEnabled_wafStatus'),
870
  'geoipSupport' => array('scansEnabled_geoipSupport'),
214
  'scansEnabled_passwds' => true,
215
  'scansEnabled_diskSpace' => true,
216
  'scansEnabled_wafStatus' => true,
 
217
  'scan_exclude' => wfConfig::get('scan_exclude', ''),
218
  'scan_include_extra' => wfConfig::get('scan_include_extra', ''),
219
  'scansEnabled_geoipSupport' => true,
248
  'scansEnabled_passwds' => true,
249
  'scansEnabled_diskSpace' => true,
250
  'scansEnabled_wafStatus' => true,
 
251
  'other_scanOutside' => true,
252
  'scansEnabled_scanImages' => true,
253
  'scan_exclude' => wfConfig::get('scan_exclude', ''),
303
  'scansEnabled_passwds' => false,
304
  'scansEnabled_diskSpace' => false,
305
  'scansEnabled_wafStatus' => false,
 
306
  'other_scanOutside' => false,
307
  'scansEnabled_scanImages' => false,
308
  'scansEnabled_highSense' => false,
339
  'scansEnabled_plugins' => 0,
340
  'scansEnabled_coreUnknown' => 0.05,
341
  'scansEnabled_malware' => 0.05,
342
+ 'scansEnabled_fileContents' => 0.1,
343
  'scan_include_extra' => 0,
344
  'scansEnabled_fileContentsGSB' => 0.05,
345
  'scansEnabled_posts' => 0.05,
349
  'scansEnabled_suspiciousAdminUsers' => 0.05,
350
  'scansEnabled_passwds' => 0.05,
351
  'scansEnabled_diskSpace' => 0.05,
 
352
  'other_scanOutside' => 0,
353
  'scansEnabled_scanImages' => 0,
354
  'scansEnabled_highSense' => 0,
501
  'scansEnabled_checkHowGetIPs',
502
  'scansEnabled_diskSpace',
503
  'scansEnabled_wafStatus',
 
504
  'scansEnabled_geoipSupport',
505
  );
506
  break;
859
  'checkSpamIP' => array('checkSpamIP'),
860
  'checkGSB' => array('scansEnabled_checkGSB'),
861
  'checkHowGetIPs' => array('scansEnabled_checkHowGetIPs'),
 
862
  'diskSpace' => array('scansEnabled_diskSpace'),
863
  'wafStatus' => array('scansEnabled_wafStatus'),
864
  'geoipSupport' => array('scansEnabled_geoipSupport'),
modules/login-security/classes/controller/wordfencels.php CHANGED
@@ -176,7 +176,7 @@ END
176
  $_runInstallCalled = true;
177
 
178
  if (function_exists('ignore_user_abort')) {
179
- ignore_user_abort(true);
180
  }
181
 
182
  if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
176
  $_runInstallCalled = true;
177
 
178
  if (function_exists('ignore_user_abort')) {
179
+ @ignore_user_abort(true);
180
  }
181
 
182
  if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
modules/login-security/classes/model/crypto.php CHANGED
@@ -64,6 +64,7 @@ abstract class Model_Crypto {
64
  }
65
  }
66
  if (function_exists('mcrypt_create_iv')) {
 
67
  $rand = @mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM);
68
  if (is_string($rand) && self::strlen($rand) === $bytes) {
69
  return $rand;
@@ -163,11 +164,12 @@ abstract class Model_Crypto {
163
  static $encodings = array();
164
  static $overloaded = null;
165
 
166
- if (is_null($overloaded))
 
167
  $overloaded = function_exists('mb_internal_encoding') && (ini_get('mbstring.func_overload') & 2);
 
168
 
169
- if (false === $overloaded)
170
- return;
171
 
172
  if (!$reset) {
173
  $encoding = mb_internal_encoding();
64
  }
65
  }
66
  if (function_exists('mcrypt_create_iv')) {
67
+ // phpcs:ignore PHPCompatibility.FunctionUse.RemovedFunctions.mcrypt_create_ivDeprecatedRemoved,PHPCompatibility.Extensions.RemovedExtensions.mcryptDeprecatedRemoved,PHPCompatibility.Constants.RemovedConstants.mcrypt_dev_urandomDeprecatedRemoved
68
  $rand = @mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM);
69
  if (is_string($rand) && self::strlen($rand) === $bytes) {
70
  return $rand;
164
  static $encodings = array();
165
  static $overloaded = null;
166
 
167
+ if (is_null($overloaded)) {
168
+ // phpcs:ignore PHPCompatibility.IniDirectives.RemovedIniDirectives.mbstring_func_overloadDeprecated
169
  $overloaded = function_exists('mb_internal_encoding') && (ini_get('mbstring.func_overload') & 2);
170
+ }
171
 
172
+ if (false === $overloaded) { return; }
 
173
 
174
  if (!$reset) {
175
  $encoding = mb_internal_encoding();
modules/login-security/css/{admin-global.1566486436.css → admin-global.1573059078.css} RENAMED
File without changes
modules/login-security/css/{admin.1566486436.css → admin.1573059078.css} RENAMED
File without changes
modules/login-security/css/{colorbox.1566486436.css → colorbox.1573059078.css} RENAMED
File without changes
modules/login-security/css/{font-awesome.1566486436.css → font-awesome.1573059078.css} RENAMED
File without changes
modules/login-security/css/{ionicons.1566486436.css → ionicons.1573059078.css} RENAMED
File without changes
modules/login-security/css/{jquery-ui-timepicker-addon.1566486436.css → jquery-ui-timepicker-addon.1573059078.css} RENAMED
File without changes
modules/login-security/css/{jquery-ui.min.1566486436.css → jquery-ui.min.1573059078.css} RENAMED
File without changes
modules/login-security/css/{jquery-ui.structure.min.1566486436.css → jquery-ui.structure.min.1573059078.css} RENAMED
File without changes
modules/login-security/css/{jquery-ui.theme.min.1566486436.css → jquery-ui.theme.min.1573059078.css} RENAMED
File without changes
modules/login-security/css/{login.1566486436.css → login.1573059078.css} RENAMED
File without changes
modules/login-security/js/{admin-global.1566486436.js → admin-global.1573059078.js} RENAMED
File without changes
modules/login-security/js/{admin.1566486436.js → admin.1573059078.js} RENAMED
File without changes
modules/login-security/js/{jquery-ui-timepicker-addon.1566486436.js → jquery-ui-timepicker-addon.1573059078.js} RENAMED
File without changes
modules/login-security/js/{jquery.colorbox.1566486436.js → jquery.colorbox.1573059078.js} RENAMED
File without changes
modules/login-security/js/{jquery.colorbox.min.1566486436.js → jquery.colorbox.min.1573059078.js} RENAMED
File without changes
modules/login-security/js/{jquery.qrcode.min.1566486436.js → jquery.qrcode.min.1573059078.js} RENAMED
File without changes
modules/login-security/js/{jquery.tmpl.min.1566486436.js → jquery.tmpl.min.1573059078.js} RENAMED
File without changes
modules/login-security/js/{login.1566486436.js → login.1573059078.js} RENAMED
@@ -179,9 +179,11 @@
179
  if (!$('#wfls-token').length) {
180
  var overlay = $('<div id="wfls-prompt-overlay"></div>');
181
  var wrapper = $('<div id="wfls-prompt-wrapper"></div>');
182
- var field = $('<p><label for="wfls-token">2FA Code <a href="javascript:void(0)" class="wfls-2fa-code-help wfls-tooltip-trigger" title="The 2FA Code can be found within the authenticator app you used when first activating two-factor authentication. You may also use one of your recovery codes."><i class="dashicons dashicons-editor-help"></i></a><br/><input type="text" name="wfls-token" id="wfls-token" aria-describedby="wfls-token-error" class="input" value="" size="6" autocomplete="off"/></label></p>');
 
183
  var remember = $('<p class="wfls-remember-device-wrapper"><label for="wfls-remember-device"><input name="wfls-remember-device" type="checkbox" id="wfls-remember-device" value="1" /> Remember for 30 days</label></p>');
184
  var button = $('<p class="submit"><input type="submit" name="wfls-token-submit" id="wfls-token-submit" class="button button-primary button-large" value="Log In"/></p>');
 
185
  wrapper.append(field);
186
  if (parseInt(WFLSVars.allowremember)) {
187
  wrapper.append(remember);
179
  if (!$('#wfls-token').length) {
180
  var overlay = $('<div id="wfls-prompt-overlay"></div>');
181
  var wrapper = $('<div id="wfls-prompt-wrapper"></div>');
182
+ var label = $('<p><label for="wfls-token">2FA Code <a href="javascript:void(0)" class="wfls-2fa-code-help wfls-tooltip-trigger" title="The 2FA Code can be found within the authenticator app you used when first activating two-factor authentication. You may also use one of your recovery codes."><i class="dashicons dashicons-editor-help"></i></a></label></p>');
183
+ var field = $('<p><input type="text" name="wfls-token" id="wfls-token" aria-describedby="wfls-token-error" class="input" value="" size="6" autocomplete="off"/></p>');
184
  var remember = $('<p class="wfls-remember-device-wrapper"><label for="wfls-remember-device"><input name="wfls-remember-device" type="checkbox" id="wfls-remember-device" value="1" /> Remember for 30 days</label></p>');
185
  var button = $('<p class="submit"><input type="submit" name="wfls-token-submit" id="wfls-token-submit" class="button button-primary button-large" value="Log In"/></p>');
186
+ wrapper.append(label);
187
  wrapper.append(field);
188
  if (parseInt(WFLSVars.allowremember)) {
189
  wrapper.append(remember);
modules/login-security/wordfence-login-security.php CHANGED
@@ -26,8 +26,8 @@ if ($wfCoreActive && !(isset($wfCoreLoading) && $wfCoreLoading)) {
26
  else {
27
  define('WORDFENCE_LS_FROM_CORE', ($wfCoreActive && isset($wfCoreLoading) && $wfCoreLoading));
28
 
29
- define('WORDFENCE_LS_VERSION', '1.0.3');
30
- define('WORDFENCE_LS_BUILD_NUMBER', '1566486436');
31
 
32
  if (!defined('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES')) { define('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES', 15); }
33
 
26
  else {
27
  define('WORDFENCE_LS_FROM_CORE', ($wfCoreActive && isset($wfCoreLoading) && $wfCoreLoading));
28
 
29
+ define('WORDFENCE_LS_VERSION', '1.0.4');
30
+ define('WORDFENCE_LS_BUILD_NUMBER', '1573059078');
31
 
32
  if (!defined('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES')) { define('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES', 15); }
33
 
readme.txt CHANGED
@@ -3,8 +3,8 @@ Contributors: mmaunder, wfryan, wfmatt, wfmattr
3
  Tags: security, firewall, malware scanner, web application firewall, two factor authentication, block hackers, country blocking, clean hacked site, blacklist, waf, login security
4
  Requires at least: 3.9
5
  Requires PHP: 5.3
6
- Tested up to: 5.2
7
- Stable tag: 7.4.0
8
 
9
  Secure your website with the most comprehensive WordPress security plugin. Firewall, malware scan, blocking, live traffic, login security & more.
10
 
@@ -104,7 +104,6 @@ We offer a Premium API key that gives you real-time updates to the Threat Defens
104
  * See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
105
  * A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
106
  * Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
107
- * Monitor your DNS security for unauthorized DNS changes.
108
  * Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
109
 
110
  = What login security features are included =
@@ -112,7 +111,6 @@ We offer a Premium API key that gives you real-time updates to the Threat Defens
112
  * See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
113
  * A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
114
  * Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
115
- * Monitor your DNS security for unauthorized DNS changes.
116
  * Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
117
 
118
  = How will I be alerted if my site has a security problem? =
@@ -185,6 +183,18 @@ Secure your website with Wordfence.
185
 
186
  == Changelog ==
187
 
 
 
 
 
 
 
 
 
 
 
 
 
188
  = 7.4.0 - August 22, 2019 =
189
  * Improvement: Added a MySQL-based configuration and data storage for the WAF to expand the number of hosting environments supported. For more detail, see: https://www.wordfence.com/help/firewall/mysqli-storage-engine/
190
  * Improvement: Updated bundled GeoIP database.
3
  Tags: security, firewall, malware scanner, web application firewall, two factor authentication, block hackers, country blocking, clean hacked site, blacklist, waf, login security
4
  Requires at least: 3.9
5
  Requires PHP: 5.3
6
+ Tested up to: 5.3
7
+ Stable tag: 7.4.1
8
 
9
  Secure your website with the most comprehensive WordPress security plugin. Firewall, malware scan, blocking, live traffic, login security & more.
10
 
104
  * See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
105
  * A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
106
  * Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
 
107
  * Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
108
 
109
  = What login security features are included =
111
  * See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
112
  * A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
113
  * Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
 
114
  * Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.
115
 
116
  = How will I be alerted if my site has a security problem? =
183
 
184
  == Changelog ==
185
 
186
+ = 7.4.1 - November 6, 2019 =
187
+ * Improvement: Updated the bundled GeoIP database.
188
+ * Improvement: Minor changes to ensure compatibility with PHP 7.4.
189
+ * Improvement: Updated the WHOIS lookup for better reliability.
190
+ * Improvement: Added better diagnostic data when the WAF MySQL storage engine is active.
191
+ * Improvement: Improved the messaging when switching between premium and free licenses.
192
+ * Change: Deprecated DNS changes scan.
193
+ * Change: The plugin will no longer email alerts when Central is managing them.
194
+ * Fix: Added error suppression to ignore_user_abort calls to silence it on hosts with it disabled.
195
+ * Fix: Improved path generation to better avoid outputting extra slashes in URLs.
196
+ * Fix: Applied a length limit to malware reporting to avoid failures due to large content size.
197
+
198
  = 7.4.0 - August 22, 2019 =
199
  * Improvement: Added a MySQL-based configuration and data storage for the WAF to expand the number of hosting environments supported. For more detail, see: https://www.wordfence.com/help/firewall/mysqli-storage-engine/
200
  * Improvement: Updated bundled GeoIP database.
vendor/wordfence/wf-waf/src/lib/utils.php CHANGED
@@ -353,6 +353,7 @@ class wfWAFUtils {
353
  'off',
354
  'false'
355
  ))));
 
356
  if ((function_exists("get_magic_quotes_gpc") && get_magic_quotes_gpc()) || $sybaseEnabled) {
357
  return self::stripslashes_deep($subject);
358
  }
353
  'off',
354
  'false'
355
  ))));
356
+ // phpcs:ignore PHPCompatibility.FunctionUse.RemovedFunctions.get_magic_quotes_gpcDeprecated
357
  if ((function_exists("get_magic_quotes_gpc") && get_magic_quotes_gpc()) || $sybaseEnabled) {
358
  return self::stripslashes_deep($subject);
359
  }
views/dashboard/options-group-license.php CHANGED
@@ -146,7 +146,7 @@ if (!isset($collapseable)) {
146
  <?php
147
  echo wfView::create('common/modal-prompt', array(
148
  'title' => __('Confirm Downgrade', 'wordfence'),
149
- 'message' => __('Are you sure you want to downgrade your Wordfence Premium License? This will disable all Premium features and return you to the free version of Wordfence.', 'wordfence'),
150
  'primaryButton' => array('id' => 'wf-downgrade-prompt-cancel', 'label' => __('Cancel', 'wordfence'), 'link' => '#'),
151
  'secondaryButtons' => array(array('id' => 'wf-downgrade-prompt-downgrade', 'label' => __('Downgrade', 'wordfence'), 'link' => '#')),
152
  ))->render();
146
  <?php
147
  echo wfView::create('common/modal-prompt', array(
148
  'title' => __('Confirm Downgrade', 'wordfence'),
149
+ 'messageHTML' => __('<p>Are you sure you want to downgrade your Wordfence Premium License? This will disable all Premium features and return you to the free version of Wordfence.</p><p>If autorenew is enabled for the current premium license, the license will renew at the next expiration date. If you would like to turn renewal off or assign the license to another site, log into wordfence.com to change it.</p>', 'wordfence'),
150
  'primaryButton' => array('id' => 'wf-downgrade-prompt-cancel', 'label' => __('Cancel', 'wordfence'), 'link' => '#'),
151
  'secondaryButtons' => array(array('id' => 'wf-downgrade-prompt-downgrade', 'label' => __('Downgrade', 'wordfence'), 'link' => '#')),
152
  ))->render();
views/scanner/issue-dnsChange.php DELETED
@@ -1,27 +0,0 @@
1
- <?php
2
- if (!defined('WORDFENCE_VERSION')) { exit; }
3
- /**
4
- * Presents an issue template.
5
- */
6
- echo wfView::create('scanner/issue-base', array(
7
- 'internalType' => 'dnsChange',
8
- 'displayType' => __('DNS Change', 'wordfence'),
9
- 'iconSVG' => '<svg viewBox="0 0 116.8 91.77"><path d="M112.17,35.72A57.35,57.35,0,0,0,81.08,4.63a57.88,57.88,0,0,0-45.36,0A57.38,57.38,0,0,0,4.63,35.72,58.26,58.26,0,0,0,9.19,89.88a4,4,0,0,0,3.52,1.89h91.38a4,4,0,0,0,3.52-1.89,58.25,58.25,0,0,0,4.56-54.16ZM52.5,10.79a8.34,8.34,0,0,1,14.24,5.9,8,8,0,0,1-2.44,5.9,8.34,8.34,0,0,1-11.8,0,8,8,0,0,1-2.44-5.9,8,8,0,0,1,2.44-5.9ZM22.59,64.3a8,8,0,0,1-5.9,2.45,8,8,0,0,1-5.9-2.45,8.34,8.34,0,0,1,0-11.8,8,8,0,0,1,5.9-2.45,8,8,0,0,1,5.9,2.45,8.35,8.35,0,0,1,0,11.8ZM35.1,35.1a8.34,8.34,0,0,1-11.8,0,8.34,8.34,0,0,1,0-11.8,8.35,8.35,0,0,1,11.8,0,8.34,8.34,0,0,1,0,11.8ZM72,35.65l-6.59,24.9a12.39,12.39,0,0,1,4.7,5.93,12.54,12.54,0,0,1-5.41,15.25A12.2,12.2,0,0,1,55.21,83a12,12,0,0,1-7.63-5.8,12.49,12.49,0,0,1,2.8-15.94,12.42,12.42,0,0,1,7-2.84l6.59-24.9a4.1,4.1,0,0,1,2-2.57A3.88,3.88,0,0,1,69,30.57a4.27,4.27,0,0,1,3,5.08Zm9.68-.56a8.34,8.34,0,0,1,0-11.8,8.34,8.34,0,0,1,14.24,5.9A8.34,8.34,0,0,1,81.7,35.1ZM106,64.3a8.34,8.34,0,1,1-11.8-11.8A8.34,8.34,0,1,1,106,64.3Zm0,0"/></svg>',
10
- 'summaryControls' => array(wfView::create('scanner/issue-control-show-details')),
11
- 'detailPairs' => array(
12
- __('Old DNS Records', 'wordfence') => '${data.oldDNS}',
13
- __('New DNS Records', 'wordfence') => '${data.newDNS}',
14
- null,
15
- __('Details', 'wordfence') => '{{html longMsg}}',
16
- ),
17
- 'detailControls' => array(
18
- '<a href="#" class="wf-btn wf-btn-default wf-btn-callout-subtle wf-issue-control-mark-fixed">' . __('Mark as Fixed', 'wordfence') . '</a>',
19
- ),
20
- 'textOutput' => (isset($textOutput) ? $textOutput : null),
21
- 'textOutputDetailPairs' => array(
22
- __('Old DNS Records', 'wordfence') => '$data.oldDNS',
23
- __('New DNS Records', 'wordfence') => '$data.newDNS',
24
- null,
25
- __('Details', 'wordfence') => '$longMsg',
26
- ),
27
- ))->render();
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
views/scanner/options-group-general.php CHANGED
@@ -50,7 +50,6 @@ if (!isset($collapseable)) {
50
  array('key' => 'scansEnabled_passwds', 'label' => __('Check the strength of passwords', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_PASSWORD_STRENGTH)),
51
  array('key' => 'scansEnabled_diskSpace', 'label' => __('Monitor disk space', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_DISK_SPACE)),
52
  array('key' => 'scansEnabled_wafStatus', 'label' => __('Monitor Web Application Firewall status', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_WAF_STATUS)),
53
- array('key' => 'scansEnabled_dns', 'label' => __('Scan for unauthorized DNS changes', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_DNS_CHANGES)),
54
  array('key' => 'other_scanOutside', 'label' => __('Scan files outside your WordPress installation', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS)),
55
  array('key' => 'scansEnabled_scanImages', 'label' => __('Scan images, binary, and other files as if they were executable', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_IMAGES_EXECUTABLE)),
56
  );
50
  array('key' => 'scansEnabled_passwds', 'label' => __('Check the strength of passwords', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_PASSWORD_STRENGTH)),
51
  array('key' => 'scansEnabled_diskSpace', 'label' => __('Monitor disk space', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_DISK_SPACE)),
52
  array('key' => 'scansEnabled_wafStatus', 'label' => __('Monitor Web Application Firewall status', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_WAF_STATUS)),
 
53
  array('key' => 'other_scanOutside', 'label' => __('Scan files outside your WordPress installation', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_OUTSIDE_WORDPRESS)),
54
  array('key' => 'scansEnabled_scanImages', 'label' => __('Scan images, binary, and other files as if they were executable', 'wordfence'), 'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_SCAN_OPTION_IMAGES_EXECUTABLE)),
55
  );
wordfence.php CHANGED
@@ -4,7 +4,7 @@ Plugin Name: Wordfence Security
4
  Plugin URI: http://www.wordfence.com/
5
  Description: Wordfence Security - Anti-virus, Firewall and Malware Scan
6
  Author: Wordfence
7
- Version: 7.4.0
8
  Author URI: http://www.wordfence.com/
9
  Network: true
10
  */
@@ -15,8 +15,8 @@ if(defined('WP_INSTALLING') && WP_INSTALLING){
15
  if (!defined('ABSPATH')) {
16
  exit;
17
  }
18
- define('WORDFENCE_VERSION', '7.4.0');
19
- define('WORDFENCE_BUILD_NUMBER', '1566486436');
20
  define('WORDFENCE_BASENAME', function_exists('plugin_basename') ? plugin_basename(__FILE__) :
21
  basename(dirname(__FILE__)) . '/' . basename(__FILE__));
22
 
4
  Plugin URI: http://www.wordfence.com/
5
  Description: Wordfence Security - Anti-virus, Firewall and Malware Scan
6
  Author: Wordfence
7
+ Version: 7.4.1
8
  Author URI: http://www.wordfence.com/
9
  Network: true
10
  */
15
  if (!defined('ABSPATH')) {
16
  exit;
17
  }
18
+ define('WORDFENCE_VERSION', '7.4.1');
19
+ define('WORDFENCE_BUILD_NUMBER', '1573059078');
20
  define('WORDFENCE_BASENAME', function_exists('plugin_basename') ? plugin_basename(__FILE__) :
21
  basename(dirname(__FILE__)) . '/' . basename(__FILE__));
22