return;

[1000] Fix | Delete

}

[1001] Fix | Delete

[1002] Fix | Delete

// Prevent WF auto-update if the user has enabled auto-update through the plugins page.

[1003] Fix | Delete

if (version_compare(wfUtils::getWPVersion(), '5.5-x', '>=')) {

[1004] Fix | Delete

$autoUpdatePlugins = get_site_option('auto_update_plugins');

[1005] Fix | Delete

if (is_array($autoUpdatePlugins) && in_array(WORDFENCE_BASENAME, $autoUpdatePlugins)) {

[1006] Fix | Delete

return;

[1007] Fix | Delete

}

[1008] Fix | Delete

}

[1009] Fix | Delete

[1010] Fix | Delete

if (!wfConfig::get('other_bypassLitespeedNoabort', false) && getenv('noabort') != '1' && stristr($_SERVER['SERVER_SOFTWARE'], 'litespeed') !== false) {

[1011] Fix | Delete

$lastEmail = self::get('lastLiteSpdEmail', false);

[1012] Fix | Delete

if( (! $lastEmail) || (time() - (int)$lastEmail > (86400 * 30))){

[1013] Fix | Delete

self::set('lastLiteSpdEmail', time());

[1014] Fix | Delete

wordfence::alert(

[1015] Fix | Delete

/* translators: Support URL. */

[1016] Fix | Delete

__("Wordfence Upgrade not run. Please modify your .htaccess", 'wordfence'), sprintf(__("To preserve the integrity of your website we are not running Wordfence auto-update.\n" .

[1017] Fix | Delete

"You are running the LiteSpeed web server which has been known to cause a problem with Wordfence auto-update.\n" .

[1018] Fix | Delete

"Please go to your website now and make a minor change to your .htaccess to fix this.\n" .

[1019] Fix | Delete

"You can find out how to make this change at:\n" .

[1020] Fix | Delete

"%s\n" .

[1021] Fix | Delete

"\nAlternatively you can disable auto-update on your website to stop receiving this message and upgrade Wordfence manually.\n", 'wordfence'), wfSupportController::supportURL(wfSupportController::ITEM_DASHBOARD_OPTION_LITESPEED_WARNING)),

[1022] Fix | Delete

false

[1023] Fix | Delete

);

[1024] Fix | Delete

}

[1025] Fix | Delete

return;

[1026] Fix | Delete

}

[1027] Fix | Delete

[1028] Fix | Delete

$runUpdate = false;

[1029] Fix | Delete

wp_update_plugins();

[1030] Fix | Delete

$update_plugins = get_site_transient('update_plugins');

[1031] Fix | Delete

if ($update_plugins && is_array($update_plugins->response) && isset($update_plugins->response[WORDFENCE_BASENAME])) {

[1032] Fix | Delete

$status = $update_plugins->response[WORDFENCE_BASENAME];

[1033] Fix | Delete

if (is_object($status) && property_exists($status, 'new_version')) {

[1034] Fix | Delete

$runUpdate = (version_compare($status->new_version, WORDFENCE_VERSION) > 0);

[1035] Fix | Delete

}

[1036] Fix | Delete

}

[1037] Fix | Delete

[1038] Fix | Delete

if ($runUpdate) {

[1039] Fix | Delete

try {

[1040] Fix | Delete

$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());

[1041] Fix | Delete

$response = $api->call('should_auto_update', array(), array('currentVersion' => WORDFENCE_VERSION));

[1042] Fix | Delete

if (!(is_array($response) && isset($response['ok']) && wfUtils::truthyToBoolean($response['ok']))) {

[1043] Fix | Delete

$runUpdate = false;

[1044] Fix | Delete

}

[1045] Fix | Delete

}

[1046] Fix | Delete

catch (Exception $e) {

[1047] Fix | Delete

wfConfig::inc('autoUpdateAttempts');

[1048] Fix | Delete

$runUpdate = false;

[1049] Fix | Delete

}

[1050] Fix | Delete

}

[1051] Fix | Delete

[1052] Fix | Delete

if (!$runUpdate && wfConfig::get('autoUpdateAttempts') < 7) {

[1053] Fix | Delete

return;

[1054] Fix | Delete

}

[1055] Fix | Delete

[1056] Fix | Delete

try {

[1057] Fix | Delete

require_once(ABSPATH . 'wp-admin/includes/class-wp-upgrader.php');

[1058] Fix | Delete

require_once(ABSPATH . 'wp-admin/includes/misc.php');

[1059] Fix | Delete

/* We were creating show_message here so that WP did not write to STDOUT. This had the strange effect of throwing an error about redeclaring show_message function, but only when a crawler hit the site and triggered the cron job. Not a human. So we're now just require'ing misc.php which does generate output, but that's OK because it is a loopback cron request.

[1060] Fix | Delete

if(! function_exists('show_message')){

[1061] Fix | Delete

function show_message($msg = 'null'){}

[1062] Fix | Delete

}

[1063] Fix | Delete

*/

[1064] Fix | Delete

if(! defined('FS_METHOD')){

[1065] Fix | Delete

define('FS_METHOD', 'direct'); //May be defined already and might not be 'direct' so this could cause problems. But we were getting reports of a warning that this is already defined, so this check added.

[1066] Fix | Delete

}

[1067] Fix | Delete

require_once(ABSPATH . 'wp-includes/update.php');

[1068] Fix | Delete

require_once(ABSPATH . 'wp-admin/includes/file.php');

[1069] Fix | Delete

[1070] Fix | Delete

if (!self::createLock('wfAutoUpdate')) {

[1071] Fix | Delete

return;

[1072] Fix | Delete

}

[1073] Fix | Delete

[1074] Fix | Delete

ob_start();

[1075] Fix | Delete

$upgrader = new Plugin_Upgrader();

[1076] Fix | Delete

$upret = $upgrader->upgrade(WORDFENCE_BASENAME);

[1077] Fix | Delete

if($upret){

[1078] Fix | Delete

$cont = file_get_contents(WORDFENCE_FCPATH);

[1079] Fix | Delete

preg_match('/Version: (\d+\.\d+\.\d+)/', $cont, $matches);

[1080] Fix | Delete

$version = !empty($matches) ? $matches[1] : null;

[1081] Fix | Delete

$alertCallback = array(new wfAutoUpdatedAlert($version), 'send');

[1082] Fix | Delete

do_action('wordfence_security_event', 'autoUpdate', array(

[1083] Fix | Delete

'version' => $version,

[1084] Fix | Delete

), $alertCallback);

[1085] Fix | Delete

[1086] Fix | Delete

wfConfig::set('autoUpdateAttempts', 0);

[1087] Fix | Delete

}

[1088] Fix | Delete

$output = @ob_get_contents();

[1089] Fix | Delete

@ob_end_clean();

[1090] Fix | Delete

} catch(Exception $e){}

[1091] Fix | Delete

[1092] Fix | Delete

self::releaseLock('wfAutoUpdate');

[1093] Fix | Delete

}

[1094] Fix | Delete

[1095] Fix | Delete

/**

[1096] Fix | Delete

* .htaccess file contents to disable all script execution in a given directory.

[1097] Fix | Delete

*/

[1098] Fix | Delete

private static $_disable_scripts_htaccess = '# BEGIN Wordfence code execution protection

[1099] Fix | Delete

<IfModule mod_php5.c>

[1100] Fix | Delete

php_flag engine 0

[1101] Fix | Delete

</IfModule>

[1102] Fix | Delete

<IfModule mod_php7.c>

[1103] Fix | Delete

php_flag engine 0

[1104] Fix | Delete

</IfModule>

[1105] Fix | Delete

<IfModule mod_php.c>

[1106] Fix | Delete

php_flag engine 0

[1107] Fix | Delete

</IfModule>

[1108] Fix | Delete

[1109] Fix | Delete

AddHandler cgi-script .php .phtml .php3 .pl .py .jsp .asp .htm .shtml .sh .cgi

[1110] Fix | Delete

Options -ExecCGI

[1111] Fix | Delete

# END Wordfence code execution protection

[1112] Fix | Delete

';

[1113] Fix | Delete

private static $_disable_scripts_regex = '/# BEGIN Wordfence code execution protection.+?# END Wordfence code execution protection/s';

[1114] Fix | Delete

[1115] Fix | Delete

private static function _uploadsHtaccessFilePath() {

[1116] Fix | Delete

$upload_dir = wp_upload_dir();

[1117] Fix | Delete

return $upload_dir['basedir'] . '/.htaccess';

[1118] Fix | Delete

}

[1119] Fix | Delete

[1120] Fix | Delete

/**

[1121] Fix | Delete

* Add/Merge .htaccess file in the uploads directory to prevent code execution.

[1122] Fix | Delete

*

[1123] Fix | Delete

* @return bool

[1124] Fix | Delete

* @throws wfConfigException

[1125] Fix | Delete

*/

[1126] Fix | Delete

public static function disableCodeExecutionForUploads() {

[1127] Fix | Delete

$uploads_htaccess_file_path = self::_uploadsHtaccessFilePath();

[1128] Fix | Delete

$uploads_htaccess_has_content = false;

[1129] Fix | Delete

if (file_exists($uploads_htaccess_file_path)) {

[1130] Fix | Delete

$htaccess_contents = file_get_contents($uploads_htaccess_file_path);

[1131] Fix | Delete

[1132] Fix | Delete

// htaccess exists and contains our htaccess code to disable script execution, nothing more to do

[1133] Fix | Delete

if (strpos($htaccess_contents, self::$_disable_scripts_htaccess) !== false) {

[1134] Fix | Delete

return true;

[1135] Fix | Delete

}

[1136] Fix | Delete

$uploads_htaccess_has_content = strlen(trim($htaccess_contents)) > 0;

[1137] Fix | Delete

}

[1138] Fix | Delete

if (@file_put_contents($uploads_htaccess_file_path, ($uploads_htaccess_has_content ? "\n\n" : "") . self::$_disable_scripts_htaccess, FILE_APPEND | LOCK_EX) === false) {

[1139] Fix | Delete

throw new wfConfigException(__("Unable to save the .htaccess file needed to disable script execution in the uploads directory. Please check your permissions on that directory.", 'wordfence'));

[1140] Fix | Delete

}

[1141] Fix | Delete

self::set('disableCodeExecutionUploadsPHP7Migrated', true);

[1142] Fix | Delete

return true;

[1143] Fix | Delete

}

[1144] Fix | Delete

[1145] Fix | Delete

public static function migrateCodeExecutionForUploadsPHP7() {

[1146] Fix | Delete

if (self::get('disableCodeExecutionUploads')) {

[1147] Fix | Delete

if (!self::get('disableCodeExecutionUploadsPHP7Migrated')) {

[1148] Fix | Delete

$uploads_htaccess_file_path = self::_uploadsHtaccessFilePath();

[1149] Fix | Delete

if (file_exists($uploads_htaccess_file_path)) {

[1150] Fix | Delete

$htaccess_contents = file_get_contents($uploads_htaccess_file_path);

[1151] Fix | Delete

if (preg_match(self::$_disable_scripts_regex, $htaccess_contents)) {

[1152] Fix | Delete

$htaccess_contents = preg_replace(self::$_disable_scripts_regex, self::$_disable_scripts_htaccess, $htaccess_contents);

[1153] Fix | Delete

@file_put_contents($uploads_htaccess_file_path, $htaccess_contents);

[1154] Fix | Delete

self::set('disableCodeExecutionUploadsPHP7Migrated', true);

[1155] Fix | Delete

}

[1156] Fix | Delete

}

[1157] Fix | Delete

}

[1158] Fix | Delete

}

[1159] Fix | Delete

}

[1160] Fix | Delete

[1161] Fix | Delete

/**

[1162] Fix | Delete

* Remove script execution protections for our the .htaccess file in the uploads directory.

[1163] Fix | Delete

*

[1164] Fix | Delete

* @return bool

[1165] Fix | Delete

* @throws wfConfigException

[1166] Fix | Delete

*/

[1167] Fix | Delete

public static function removeCodeExecutionProtectionForUploads() {

[1168] Fix | Delete

$uploads_htaccess_file_path = self::_uploadsHtaccessFilePath();

[1169] Fix | Delete

if (file_exists($uploads_htaccess_file_path)) {

[1170] Fix | Delete

$htaccess_contents = file_get_contents($uploads_htaccess_file_path);

[1171] Fix | Delete

[1172] Fix | Delete

// Check that it is in the file

[1173] Fix | Delete

if (preg_match(self::$_disable_scripts_regex, $htaccess_contents)) {

[1174] Fix | Delete

$htaccess_contents = preg_replace(self::$_disable_scripts_regex, '', $htaccess_contents);

[1175] Fix | Delete

[1176] Fix | Delete

$error_message = __("Unable to remove code execution protections applied to the .htaccess file in the uploads directory. Please check your permissions on that file.", 'wordfence');

[1177] Fix | Delete

if (strlen(trim($htaccess_contents)) === 0) {

[1178] Fix | Delete

// empty file, remove it

[1179] Fix | Delete

if (!@unlink($uploads_htaccess_file_path)) {

[1180] Fix | Delete

throw new wfConfigException($error_message);

[1181] Fix | Delete

}

[1182] Fix | Delete

[1183] Fix | Delete

} elseif (@file_put_contents($uploads_htaccess_file_path, $htaccess_contents, LOCK_EX) === false) {

[1184] Fix | Delete

throw new wfConfigException($error_message);

[1185] Fix | Delete

}

[1186] Fix | Delete

}

[1187] Fix | Delete

}

[1188] Fix | Delete

return true;

[1189] Fix | Delete

}

[1190] Fix | Delete

[1191] Fix | Delete

/**

[1192] Fix | Delete

* Validates the array of configuration changes without applying any. All bounds checks must be performed here.

[1193] Fix | Delete

*

[1194] Fix | Delete

* @param array $changes

[1195] Fix | Delete

* @return bool|array Returns true if valid, otherwise a displayable error message per error encountered.

[1196] Fix | Delete

* @throws wfWAFStorageFileException

[1197] Fix | Delete

*/

[1198] Fix | Delete

public static function validate($changes) {

[1199] Fix | Delete

$errors = array();

[1200] Fix | Delete

$waf = wfWAF::getInstance();

[1201] Fix | Delete

$wafConfig = $waf->getStorageEngine();

[1202] Fix | Delete

[1203] Fix | Delete

foreach ($changes as $key => $value) {

[1204] Fix | Delete

$checked = false;

[1205] Fix | Delete

switch ($key) {

[1206] Fix | Delete

//============ WAF

[1207] Fix | Delete

case 'learningModeGracePeriod':

[1208] Fix | Delete

{

[1209] Fix | Delete

//If currently in or will be in learning mode, restrict the grace period to be in the future

[1210] Fix | Delete

$wafStatus = (isset($changes['wafStatus']) ? $changes['wafStatus'] : $wafConfig->getConfig('wafStatus'));

[1211] Fix | Delete

$gracePeriodEnd = strtotime($value);

[1212] Fix | Delete

if ($wafStatus == wfFirewall::FIREWALL_MODE_LEARNING && $gracePeriodEnd <= time()) {

[1213] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('The grace period end time must be in the future.', 'wordfence'));

[1214] Fix | Delete

}

[1215] Fix | Delete

[1216] Fix | Delete

$checked = true;

[1217] Fix | Delete

break;

[1218] Fix | Delete

}

[1219] Fix | Delete

case 'wafStatus':

[1220] Fix | Delete

{

[1221] Fix | Delete

if ($value != wfFirewall::FIREWALL_MODE_ENABLED && $value != wfFirewall::FIREWALL_MODE_LEARNING && $value != wfFirewall::FIREWALL_MODE_DISABLED) {

[1222] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('Unknown firewall mode.', 'wordfence'));

[1223] Fix | Delete

}

[1224] Fix | Delete

[1225] Fix | Delete

$checked = true;

[1226] Fix | Delete

break;

[1227] Fix | Delete

}

[1228] Fix | Delete

[1229] Fix | Delete

//============ Plugin

[1230] Fix | Delete

case 'alertEmails':

[1231] Fix | Delete

{

[1232] Fix | Delete

$dirtyEmails = explode(',', preg_replace('/[\r\n\s\t]+/', '', $value));

[1233] Fix | Delete

$dirtyEmails = array_filter($dirtyEmails);

[1234] Fix | Delete

$badEmails = array();

[1235] Fix | Delete

foreach ($dirtyEmails as $email) {

[1236] Fix | Delete

if (!wfUtils::isValidEmail($email)) {

[1237] Fix | Delete

$badEmails[] = $email;

[1238] Fix | Delete

}

[1239] Fix | Delete

}

[1240] Fix | Delete

if (count($badEmails) > 0) {

[1241] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('The following emails are invalid: ', 'wordfence') . esc_html(implode(', ', $badEmails), array()));

[1242] Fix | Delete

}

[1243] Fix | Delete

[1244] Fix | Delete

$checked = true;

[1245] Fix | Delete

break;

[1246] Fix | Delete

}

[1247] Fix | Delete

case 'scan_include_extra':

[1248] Fix | Delete

{

[1249] Fix | Delete

$dirtyRegexes = explode("\n", $value);

[1250] Fix | Delete

foreach ($dirtyRegexes as $regex) {

[1251] Fix | Delete

if (@preg_match("/$regex/", "") === false) {

[1252] Fix | Delete

$errors[] = array('option' => $key, 'error' => sprintf(

[1253] Fix | Delete

/* translators: Regular expression. */

[1254] Fix | Delete

__('"%s" is not a valid regular expression.', 'wordfence'), esc_html($regex)));

[1255] Fix | Delete

}

[1256] Fix | Delete

}

[1257] Fix | Delete

$checked = true;

[1258] Fix | Delete

break;

[1259] Fix | Delete

}

[1260] Fix | Delete

case 'whitelisted':

[1261] Fix | Delete

{

[1262] Fix | Delete

$dirtyWhitelisted = explode(',', preg_replace('/[\r\n\s\t]+/', ',', $value));

[1263] Fix | Delete

$dirtyWhitelisted = array_filter($dirtyWhitelisted);

[1264] Fix | Delete

$badWhiteIPs = array();

[1265] Fix | Delete

$range = new wfUserIPRange();

[1266] Fix | Delete

foreach ($dirtyWhitelisted as $whiteIP) {

[1267] Fix | Delete

$range->setIPString($whiteIP);

[1268] Fix | Delete

if (!$range->isValidRange()) {

[1269] Fix | Delete

$badWhiteIPs[] = $whiteIP;

[1270] Fix | Delete

}

[1271] Fix | Delete

}

[1272] Fix | Delete

if (count($badWhiteIPs) > 0) {

[1273] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('Please make sure you separate your IP addresses with commas. The following allowlisted IP addresses are invalid: ', 'wordfence') . esc_html(implode(', ', $badWhiteIPs), array()));

[1274] Fix | Delete

}

[1275] Fix | Delete

[1276] Fix | Delete

$checked = true;

[1277] Fix | Delete

break;

[1278] Fix | Delete

}

[1279] Fix | Delete

case 'liveTraf_ignoreUsers':

[1280] Fix | Delete

{

[1281] Fix | Delete

$dirtyUsers = explode(',', $value);

[1282] Fix | Delete

$invalidUsers = array();

[1283] Fix | Delete

foreach ($dirtyUsers as $val) {

[1284] Fix | Delete

$val = trim($val);

[1285] Fix | Delete

if (strlen($val) > 0) {

[1286] Fix | Delete

if (!get_user_by('login', $val)) {

[1287] Fix | Delete

$invalidUsers[] = $val;

[1288] Fix | Delete

}

[1289] Fix | Delete

}

[1290] Fix | Delete

}

[1291] Fix | Delete

if (count($invalidUsers) > 0) {

[1292] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('The following users you selected to ignore in live traffic reports are not valid on this system: ', 'wordfence') . esc_html(implode(', ', $invalidUsers), array()));

[1293] Fix | Delete

}

[1294] Fix | Delete

[1295] Fix | Delete

$checked = true;

[1296] Fix | Delete

break;

[1297] Fix | Delete

}

[1298] Fix | Delete

case 'liveTraf_ignoreIPs':

[1299] Fix | Delete

{

[1300] Fix | Delete

$dirtyIPs = explode(',', preg_replace('/[\r\n\s\t]+/', '', $value));

[1301] Fix | Delete

$dirtyIPs = array_filter($dirtyIPs);

[1302] Fix | Delete

$invalidIPs = array();

[1303] Fix | Delete

foreach ($dirtyIPs as $val) {

[1304] Fix | Delete

if (!wfUtils::isValidIP($val)) {

[1305] Fix | Delete

$invalidIPs[] = $val;

[1306] Fix | Delete

}

[1307] Fix | Delete

}

[1308] Fix | Delete

if (count($invalidIPs) > 0) {

[1309] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('The following IPs you selected to ignore in live traffic reports are not valid: ', 'wordfence') . esc_html(implode(', ', $invalidIPs), array()));

[1310] Fix | Delete

}

[1311] Fix | Delete

[1312] Fix | Delete

$checked = true;

[1313] Fix | Delete

break;

[1314] Fix | Delete

}

[1315] Fix | Delete

case 'howGetIPs_trusted_proxies':

[1316] Fix | Delete

{

[1317] Fix | Delete

$dirtyIPs = preg_split('/[\r\n,]+/', $value);

[1318] Fix | Delete

$dirtyIPs = array_filter($dirtyIPs);

[1319] Fix | Delete

$invalidIPs = array();

[1320] Fix | Delete

foreach ($dirtyIPs as $val) {

[1321] Fix | Delete

if (!(wfUtils::isValidIP($val) || wfUtils::isValidCIDRRange($val))) {

[1322] Fix | Delete

$invalidIPs[] = $val;

[1323] Fix | Delete

}

[1324] Fix | Delete

}

[1325] Fix | Delete

if (count($invalidIPs) > 0) {

[1326] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('The following IPs/ranges you selected to trust as proxies are not valid: ', 'wordfence') . esc_html(implode(', ', $invalidIPs), array()));

[1327] Fix | Delete

}

[1328] Fix | Delete

[1329] Fix | Delete

$checked = true;

[1330] Fix | Delete

break;

[1331] Fix | Delete

}

[1332] Fix | Delete

case 'howGetIPs_trusted_proxy_preset':

[1333] Fix | Delete

{

[1334] Fix | Delete

$presets = wfConfig::getJSON('ipResolutionList', array());

[1335] Fix | Delete

if (!is_array($presets)) {

[1336] Fix | Delete

$presets = array();

[1337] Fix | Delete

}

[1338] Fix | Delete

[1339] Fix | Delete

if (!(empty($value) /* "None" */ || isset($presets[$value]))) {

[1340] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('The selected trusted proxy preset is not valid: ', 'wordfence') . esc_html($value));

[1341] Fix | Delete

}

[1342] Fix | Delete

[1343] Fix | Delete

$checked = true;

[1344] Fix | Delete

[1345] Fix | Delete

break;

[1346] Fix | Delete

}

[1347] Fix | Delete

case 'apiKey':

[1348] Fix | Delete

{

[1349] Fix | Delete

$value = trim($value);

[1350] Fix | Delete

if (empty($value)) {

[1351] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('An empty license key was entered.', 'wordfence'));

[1352] Fix | Delete

}

[1353] Fix | Delete

else if ($value && !preg_match('/^[a-fA-F0-9]+$/', $value)) {

[1354] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('The license key entered is not in a valid format. It must contain only numbers and the letters A-F.', 'wordfence'));

[1355] Fix | Delete

}

[1356] Fix | Delete

[1357] Fix | Delete

$checked = true;

[1358] Fix | Delete

break;

[1359] Fix | Delete

}

[1360] Fix | Delete

case 'scan_exclude':

[1361] Fix | Delete

{

[1362] Fix | Delete

$exclusionList = explode("\n", trim($value));

[1363] Fix | Delete

foreach ($exclusionList as $exclusion) {

[1364] Fix | Delete

$exclusion = trim($exclusion);

[1365] Fix | Delete

if ($exclusion === '*') {

[1366] Fix | Delete

$errors[] = array('option' => $key, 'error' => __('A wildcard cannot be used to exclude all files from the scan.', 'wordfence'));

[1367] Fix | Delete

}

[1368] Fix | Delete

}

[1369] Fix | Delete

$checked = true;

[1370] Fix | Delete

break;

[1371] Fix | Delete

}

[1372] Fix | Delete

case 'scan_max_resume_attempts':

[1373] Fix | Delete

{

[1374] Fix | Delete

$value = (int) $value;

[1375] Fix | Delete

wfScanMonitor::validateResumeAttempts($value, $valid);

[1376] Fix | Delete

if (!$valid)

[1377] Fix | Delete

$errors[] = array('option' => $key, 'error' => sprintf(__('Invalid number of scan resume attempts specified: %d', 'wordfence'), $value));

[1378] Fix | Delete

break;

[1379] Fix | Delete

}

[1380] Fix | Delete

}

[1381] Fix | Delete

}

[1382] Fix | Delete

[1383] Fix | Delete

if (empty($errors)) {

[1384] Fix | Delete

return true;

[1385] Fix | Delete

}

[1386] Fix | Delete

return $errors;

[1387] Fix | Delete

}

[1388] Fix | Delete

[1389] Fix | Delete

public static function clean($changes) {

[1390] Fix | Delete

$cleaned = array();

[1391] Fix | Delete

foreach ($changes as $key => $value) {

[1392] Fix | Delete

if (preg_match('/^whitelistedServices\.([a-z0-9]+)$/i', $key, $matches)) {

[1393] Fix | Delete

if (!isset($cleaned['whitelistedServices']) || !is_array($cleaned['whitelistedServices'])) {

[1394] Fix | Delete

$cleaned['whitelistedServices'] = wfConfig::getJSON('whitelistedServices', array());

[1395] Fix | Delete

}

[1396] Fix | Delete

[1397] Fix | Delete

$cleaned['whitelistedServices'][$matches[1]] = wfUtils::truthyToBoolean($value);

[1398] Fix | Delete

}

[1399] Fix | Delete

else {

[1400] Fix | Delete

$cleaned[$key] = $value;

[1401] Fix | Delete

}

[1402] Fix | Delete

}

[1403] Fix | Delete

return $cleaned;

[1404] Fix | Delete

}

[1405] Fix | Delete

[1406] Fix | Delete

/**

[1407] Fix | Delete

* Saves the array of configuration changes in the correct place. This may currently be the wfConfig table, the WAF's config file, or both. The

[1408] Fix | Delete

* validation function will handle all bounds checks and this will be limited to normalizing the values as needed.

[1409] Fix | Delete

*

[1410] Fix | Delete

* @param array $changes

[1411] Fix | Delete

* @throws wfConfigException

[1412] Fix | Delete

* @throws wfWAFStorageFileException

[1413] Fix | Delete

*/

[1414] Fix | Delete

public static function save($changes) {

[1415] Fix | Delete

$waf = wfWAF::getInstance();

[1416] Fix | Delete

$wafConfig = $waf->getStorageEngine();

[1417] Fix | Delete

[1418] Fix | Delete

$apiKey = false;

[1419] Fix | Delete

if (isset($changes['apiKey'])) { //Defer to end

[1420] Fix | Delete

$apiKey = $changes['apiKey'];

[1421] Fix | Delete

unset($changes['apiKey']);

[1422] Fix | Delete

}

[1423] Fix | Delete

[1424] Fix | Delete

foreach ($changes as $key => $value) {

[1425] Fix | Delete

$saved = false;

[1426] Fix | Delete

switch ($key) {

[1427] Fix | Delete

//============ WAF

[1428] Fix | Delete

case 'learningModeGracePeriod':

[1429] Fix | Delete

{

[1430] Fix | Delete

$wafStatus = (isset($changes['wafStatus']) ? $changes['wafStatus'] : $wafConfig->getConfig('wafStatus'));

[1431] Fix | Delete

if ($wafStatus == wfFirewall::FIREWALL_MODE_LEARNING) {

[1432] Fix | Delete

$dt = wfUtils::parseLocalTime($value);

[1433] Fix | Delete

$gracePeriodEnd = $dt->format('U');

[1434] Fix | Delete

$wafConfig->setConfig($key, $gracePeriodEnd);

[1435] Fix | Delete

}

[1436] Fix | Delete

[1437] Fix | Delete

$saved = true;

[1438] Fix | Delete

break;

[1439] Fix | Delete

}

[1440] Fix | Delete

case 'learningModeGracePeriodEnabled':

[1441] Fix | Delete

{

[1442] Fix | Delete

$wafStatus = (isset($changes['wafStatus']) ? $changes['wafStatus'] : $wafConfig->getConfig('wafStatus'));

[1443] Fix | Delete

if ($wafStatus == wfFirewall::FIREWALL_MODE_LEARNING) {

[1444] Fix | Delete

$wafConfig->setConfig($key, wfUtils::truthyToInt($value));

[1445] Fix | Delete

}

[1446] Fix | Delete

[1447] Fix | Delete

$saved = true;

[1448] Fix | Delete

break;

[1449] Fix | Delete

}

[1450] Fix | Delete

case 'wafStatus':

[1451] Fix | Delete

{

[1452] Fix | Delete

$wafConfig->setConfig($key, $value);

[1453] Fix | Delete

if ($value != wfFirewall::FIREWALL_MODE_LEARNING) {

[1454] Fix | Delete

$wafConfig->setConfig('learningModeGracePeriodEnabled', 0);

[1455] Fix | Delete

$wafConfig->unsetConfig('learningModeGracePeriod');

[1456] Fix | Delete

}

[1457] Fix | Delete

[1458] Fix | Delete

$firewall = new wfFirewall();

[1459] Fix | Delete

$firewall->syncStatus(true);

[1460] Fix | Delete

[1461] Fix | Delete

if ($value == wfFirewall::FIREWALL_MODE_DISABLED) {

[1462] Fix | Delete

$currentUser = wp_get_current_user();

[1463] Fix | Delete

$username = $currentUser->user_login;

[1464] Fix | Delete

[1465] Fix | Delete

$alertCallback = array(new wfWafDeactivatedAlert($username, wfUtils::getIP()), 'send');

[1466] Fix | Delete

do_action('wordfence_security_event', 'wafDeactivated', array(

[1467] Fix | Delete

'username' => $username,

[1468] Fix | Delete

'ip' => wfUtils::getIP(),

[1469] Fix | Delete

), $alertCallback);

[1470] Fix | Delete

}

[1471] Fix | Delete

[1472] Fix | Delete

$saved = true;

[1473] Fix | Delete

break;

[1474] Fix | Delete

}

[1475] Fix | Delete

case 'wafRules':

[1476] Fix | Delete

{

[1477] Fix | Delete

$disabledRules = (array) $wafConfig->getConfig('disabledRules');

[1478] Fix | Delete

foreach ($value as $ruleID => $ruleEnabled) {

[1479] Fix | Delete

$ruleID = (int) $ruleID;

[1480] Fix | Delete

if ($ruleEnabled) {

[1481] Fix | Delete

unset($disabledRules[$ruleID]);

[1482] Fix | Delete

} else {

[1483] Fix | Delete

$disabledRules[$ruleID] = true;

[1484] Fix | Delete

}

[1485] Fix | Delete

}

[1486] Fix | Delete

$wafConfig->setConfig('disabledRules', $disabledRules);

[1487] Fix | Delete

[1488] Fix | Delete

$saved = true;

[1489] Fix | Delete

break;

[1490] Fix | Delete

}

[1491] Fix | Delete

case 'whitelistedURLParams':

[1492] Fix | Delete

{

[1493] Fix | Delete

$whitelistedURLParams = (array) $wafConfig->getConfig('whitelistedURLParams', null, 'livewaf');

[1494] Fix | Delete

if (isset($value['delete'])) {

[1495] Fix | Delete

foreach ($value['delete'] as $whitelistKey => $unused) {

[1496] Fix | Delete

unset($whitelistedURLParams[$whitelistKey]);

[1497] Fix | Delete

}

[1498] Fix | Delete

}

[1499] Fix | Delete