: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
if (defined('WORDFENCE_VERSION')) {
const BLOCK_TYPE_COMPLEX = 'complex';
const BLOCK_TYPE_BRUTE_FORCE = 'bruteforce';
const BLOCK_TYPE_BLACKLIST = 'blacklist';
public function __construct($limit = 10) {
* Schedule the activity report cron job.
public static function scheduleCronJob() {
if (!wfConfig::get('email_summary_enabled', 1)) {
list(, $end_time) = wfActivityReport::getReportDateRange();
wp_schedule_single_event($end_time, 'wordfence_email_activity_report');
* Remove the activity report cron job.
public static function disableCronJob() {
public static function clearCronJobs() {
wp_clear_scheduled_hook('wordfence_email_activity_report');
* Send out the report and reschedule the next report's cron job.
public static function executeCronJob() {
if (!wfConfig::get('email_summary_enabled', 1)) {
$emails = wfConfig::getAlertEmails();
$report->sendReportViaEmail($emails);
* Output a compact version of the email for the WP dashboard.
public static function outputDashboardWidget() {
echo $report->toWidgetView();
public static function getReportDateRange() {
$interval = wfConfig::get('email_summary_interval', 'weekly');
$offset = get_option('gmt_offset');
return self::_getReportDateRange($interval, $offset);
* @param string $interval
public static function _getReportDateRange($interval = 'weekly', $offset = 0, $time = null) {
$day = (int) gmdate('w', $time);
$month = (int) gmdate("n", $time);
$day_of_month = (int) gmdate("j", $time);
$year = (int) gmdate("Y", $time);
// Send a report 4pm every day
$start_time = gmmktime(16, 0, 0, $month, $day_of_month, $year) + (-$offset * 60 * 60);
$end_time = $start_time + 86400;
// Send a report 4pm every Monday
$start_time = gmmktime(16, 0, 0, $month, $day_of_month - $day + 1, $year) + (-$offset * 60 * 60);
$end_time = $start_time + (86400 * 7);
// Send a report at 4pm the first of every month
$start_time = gmmktime(16, 0, 0, $month, 1, $year) + (-$offset * 60 * 60);
$end_time = gmmktime(16, 0, 0, $month + 1, 1, $year) + (-$offset * 60 * 60);
return array($start_time, $end_time);
public static function getReportDateFrom() {
$interval = wfConfig::get('email_summary_interval', 'weekly');
return self::_getReportDateFrom($interval);
* @param string $interval
public static function _getReportDateFrom($interval = 'weekly', $time = null) {
$from = $time - (86400 * 7);
// Send a report at 4pm the first of every month
$from = strtotime('-1 month', $time);
public function getFullReport() {
$start_time = microtime(true);
$recent_firewall_activity = $this->getRecentFirewallActivity($this->limit, $remainder);
'top_ips_blocked' => $this->getTopIPsBlocked($this->limit),
'top_countries_blocked' => $this->getTopCountriesBlocked($this->limit),
'top_failed_logins' => $this->getTopFailedLogins($this->limit),
'recent_firewall_activity' => $recent_firewall_activity,
'omitted_firewall_activity'=> $remainder,
'recently_modified_files' => $this->getRecentFilesModified($this->limit),
'updates_needed' => $this->getUpdatesNeeded(),
'microseconds' => microtime(true) - $start_time,
public function getWidgetReport() {
$start_time = microtime(true);
'top_ips_blocked' => $this->getTopIPsBlocked($this->limit),
'top_countries_blocked' => $this->getTopCountriesBlocked($this->limit),
'top_failed_logins' => $this->getTopFailedLogins($this->limit),
'updates_needed' => $this->getUpdatesNeeded(),
'microseconds' => microtime(true) - $start_time,
public function getBlockedCount($maxAgeDays = null, $grouping = null) {
$maxAgeDays = (int) $maxAgeDays;
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 7 day)) / 86400)';
switch (wfConfig::get('email_summary_interval', 'weekly')) {
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 1 day)) / 86400)';
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 1 month)) / 86400)';
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval ' . $maxAgeDays . ' day)) / 86400)';
//Possible values for blockType: throttle, manual, brute, fakegoogle, badpost, country, advanced, blacklist, waf
case self::BLOCK_TYPE_COMPLEX:
$groupingWHERE = ' AND blockType IN ("fakegoogle", "badpost", "country", "advanced", "waf")';
case self::BLOCK_TYPE_BRUTE_FORCE:
$groupingWHERE = ' AND blockType IN ("throttle", "brute")';
case self::BLOCK_TYPE_BLACKLIST:
$groupingWHERE = ' AND blockType IN ("blacklist", "manual")';
$table_wfBlockedIPLog = wfDB::networkTable('wfBlockedIPLog');
$count = $this->db->get_var(<<<SQL
SELECT SUM(blockCount) as blockCount
FROM {$table_wfBlockedIPLog}
WHERE unixday >= {$interval}{$groupingWHERE}
public function getTopIPsBlocked($limit = 10, $maxAgeDays = null) {
$maxAgeDays = (int) $maxAgeDays;
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 7 day)) / 86400)';
switch (wfConfig::get('email_summary_interval', 'weekly')) {
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 1 day)) / 86400)';
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 1 month)) / 86400)';
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval ' . $maxAgeDays . ' day)) / 86400)';
$table_wfBlockedIPLog = wfDB::networkTable('wfBlockedIPLog');
SELECT IP, countryCode, unixday, blockType,
SUM(blockCount) as blockCount
FROM {$table_wfBlockedIPLog}
WHERE unixday >= {$interval}
$results = $this->db->get_results($this->db->prepare($query, $limit));
foreach ($results as &$row) {
$row->countryName = $this->getCountryNameByCode($row->countryCode);
public function getTopCountriesBlocked($limit = 10, $maxAgeDays = null) {
$maxAgeDays = (int) $maxAgeDays;
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 7 day)) / 86400)';
switch (wfConfig::get('email_summary_interval', 'weekly')) {
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 1 day)) / 86400)';
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 1 month)) / 86400)';
$interval = 'FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval ' . $maxAgeDays . ' day)) / 86400)';
$table_wfBlockedIPLog = wfDB::networkTable('wfBlockedIPLog');
SELECT *, COUNT(IP) as totalIPs, SUM(ipBlockCount) as totalBlockCount
FROM (SELECT *, SUM(blockCount) AS ipBlockCount FROM {$table_wfBlockedIPLog} WHERE unixday >= {$interval} GROUP BY IP) t
ORDER BY totalBlockCount DESC
$results = $this->db->get_results($this->db->prepare($query, $limit));
foreach ($results as &$row) {
$row->countryName = $this->getCountryNameByCode($row->countryCode);
public function getTopFailedLogins($limit = 10) {
$interval = 'UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 7 day))';
switch (wfConfig::get('email_summary_interval', 'weekly')) {
$interval = 'UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 1 day))';
$interval = 'UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 1 month))';
$table_wfLogins = wfDB::networkTable('wfLogins');
$failedLogins = $this->db->get_results($this->db->prepare(<<<SQL
sum(wfl.fail) as fail_count
FROM {$table_wfLogins} wfl
AND wfl.ctime > $interval
foreach ($failedLogins as &$login) {
$exists = $this->db->get_var($this->db->prepare(<<<SQL
SELECT !ISNULL(ID) FROM {$this->db->users} WHERE user_login = '%s' OR user_email = '%s'
, $login->username, $login->username));
$login->is_valid_user = $exists;
* Returns any updates needs or false if everything is up to date.
public function getUpdatesNeeded($useCachedValued = true) {
$update_check = new wfUpdateCheck();
$needs_update = $update_check->checkAllUpdates($useCachedValued)
'core' => $update_check->getCoreUpdateVersion(),
'plugins' => $update_check->getPluginUpdates(),
'themes' => $update_check->getThemeUpdates(),
* Returns list of firewall activity up to $limit number of entries.
* @param int $limit Max events to return in results
public function getRecentFirewallActivity($limit, &$remainder) {
$dateRange = wfActivityReport::getReportDateRange();
$recent_firewall_activity = new wfRecentFirewallActivity(null, max(604800, $dateRange[1] - $dateRange[0]));
$recent_firewall_activity->run();
return $recent_firewall_activity->mostRecentActivity($limit, $remainder);
* Returns list of files modified within given timeframe.
* @todo Add option to configure the regex used to filter files allowed in this list.
* @todo Add option to exclude directories (such as cache directories).
* @param string $directory Search for files within this directory
* @param int $time_range One week
* @param int $limit Max files to return in results
* @param int $directory_limit Hard limit for number of files to search within a directory.
public function getRecentFilesModified($limit = 300, $directory = ABSPATH, $time_range = 604800, $directory_limit = 20000) {
$recently_modified = new wfRecentlyModifiedFiles($directory);
$recently_modified->run();
return $recently_modified->mostRecentFiles($limit);
* Remove entries older than a month in the IP log.
public function rotateIPLog() {
$table_wfBlockedIPLog = wfDB::networkTable('wfBlockedIPLog');
DELETE FROM {$table_wfBlockedIPLog}
WHERE unixday < FLOOR(UNIX_TIMESTAMP(DATE_SUB(NOW(), interval 1 month)) / 86400)
* @param mixed $ip_address
* @param int|null $unixday
public static function logBlockedIP($ip_address, $unixday = null, $type = null) {
//Possible values for $type: throttle, manual, brute, fakegoogle, badpost, country, advanced, blacklist, waf
if (wfUtils::isValidIP($ip_address)) {
$ip_bin = wfUtils::inet_pton($ip_address);
$ip_address = wfUtils::inet_ntop($ip_bin);
$blocked_table = wfDB::networkTable('wfBlockedIPLog');
$unixday_insert = 'FLOOR(UNIX_TIMESTAMP() / 86400)';
$unixday_insert = absint($unixday);
$country = wfUtils::IP2Country($ip_address);
$ipHex = wfDB::binaryValueToSQLHex($ip_bin);
$wpdb->query($wpdb->prepare(<<<SQL
INSERT INTO $blocked_table (IP, countryCode, blockCount, unixday, blockType)
VALUES ({$ipHex}, %s, 1, $unixday_insert, %s)
ON DUPLICATE KEY UPDATE blockCount = blockCount + 1
public function getCountryNameByCode($code) {
if (!isset($wfBulkCountries)) {
include(dirname(__FILE__) . '/wfBulkCountries.php');
return array_key_exists($code, $wfBulkCountries) ? $wfBulkCountries[$code] : "";
* @return wfActivityReportView
public function toView() {
return new wfActivityReportView('reports/activity-report', $this->getFullReport() + array(
'limit' => $this->getLimit(),
* @return wfActivityReportView
public function toWidgetView() {
return new wfActivityReportView('reports/activity-report', $this->getWidgetReport() + array(
'limit' => $this->getLimit(),
* @return wfActivityReportView
public function toEmailView() {
return new wfActivityReportView('reports/activity-report-email-inline', $this->getFullReport());
* @param $email_addresses string|array
public function sendReportViaEmail($email_addresses) {