: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
if (isset($value['enabled'])) {
foreach ($value['enabled'] as $whitelistKey => $enabled) {
if (array_key_exists($whitelistKey, $whitelistedURLParams) && is_array($whitelistedURLParams[$whitelistKey])) {
foreach ($whitelistedURLParams[$whitelistKey] as $ruleID => $data) {
$whitelistedURLParams[$whitelistKey][$ruleID]['disabled'] = !$enabled;
$wafConfig->setConfig('whitelistedURLParams', $whitelistedURLParams, 'livewaf');
if (isset($value['add'])) {
foreach ($value['add'] as $entry) {
$path = @base64_decode($entry['path']);
$paramKey = @base64_decode($entry['paramKey']);
if (!$path || !$paramKey) {
'timestamp' => (int) $entry['data']['timestamp'],
'description' => $entry['data']['description'],
'ip' => wfUtils::getIP(),
'disabled' => !!$entry['data']['disabled'],
if (function_exists('get_current_user_id')) {
$data['userID'] = get_current_user_id();
$waf->whitelistRuleForParam($path, $paramKey, 'all', $data);
case 'disableWAFBlacklistBlocking':
$wafConfig->setConfig($key, wfUtils::truthyToInt($value));
if (method_exists(wfWAF::getInstance()->getStorageEngine(), 'purgeIPBlocks')) {
wfWAF::getInstance()->getStorageEngine()->purgeIPBlocks(wfWAFStorageInterface::IP_BLOCKS_BLACKLIST);
$cron = wfWAF::getInstance()->getStorageEngine()->getConfig('cron', array(), 'livewaf');
foreach ($cron as $cronKey => $cronJob) {
if ($cronJob instanceof wfWAFCronFetchBlacklistPrefixesEvent) {
$cron[] = new wfWAFCronFetchBlacklistPrefixesEvent(time() - 1);
wfWAF::getInstance()->getStorageEngine()->setConfig('cron', $cron, 'livewaf');
$wafConfig->setConfig($key, wfUtils::truthyToInt($value));
//============ Plugin (specialty treatment)
$emails = explode(',', preg_replace('/[\r\n\s\t]+/', '', $value));
$emails = array_filter($emails); //Already validated above
if (count($emails) > 0) {
wfConfig::set($key, implode(',', $emails));
case 'loginSec_userBlacklist':
case 'email_summary_excluded_directories':
$value = implode("\n", $value);
wfConfig::set($key, wfUtils::cleanupOneEntryPerLine($value));
$whiteIPs = explode(',', preg_replace('/[\r\n\s\t]+/', ',', $value));
$whiteIPs = array_filter($whiteIPs); //Already validated above
if (count($whiteIPs) > 0) {
wfConfig::set($key, implode(',', $whiteIPs));
if (method_exists(wfWAF::getInstance()->getStorageEngine(), 'purgeIPBlocks')) {
wfWAF::getInstance()->getStorageEngine()->purgeIPBlocks(wfWAFStorageInterface::IP_BLOCKS_BLACKLIST);
case 'whitelistedServices':
if (is_string($value)) { //Already JSON (import/export settings)
wfConfig::set($key, $value);
wfConfig::setJSON($key, (array) $value);
$wafConfig->setConfig('whitelistedServiceIPs', @json_encode(wfUtils::whitelistedServiceIPs()), 'synced');
if (method_exists(wfWAF::getInstance()->getStorageEngine(), 'purgeIPBlocks')) {
wfWAF::getInstance()->getStorageEngine()->purgeIPBlocks(wfWAFStorageInterface::IP_BLOCKS_BLACKLIST);
case 'liveTraf_ignoreUsers':
$dirtyUsers = explode(',', $value);
foreach ($dirtyUsers as $val) {
$validUsers[] = $val; //Already validated above
if (count($validUsers) > 0) {
wfConfig::set($key, implode(',', $validUsers));
case 'liveTraf_ignoreIPs':
$validIPs = explode(',', preg_replace('/[\r\n\s\t]+/', '', $value));
$validIPs = array_filter($validIPs); //Already validated above
if (count($validIPs) > 0) {
wfConfig::set($key, implode(',', $validIPs));
case 'liveTraf_ignoreUA':
if (preg_match('/[a-zA-Z0-9\d]+/', $value)) {
wfConfig::set($key, trim($value));
case 'howGetIPs_trusted_proxies':
$validIPs = preg_split('/[\r\n,]+/', $value);
$validIPs = array_filter($validIPs); //Already validated above
if (count($validIPs) > 0) {
wfConfig::set($key, implode("\n", $validIPs));
$value = wfUtils::truthyToBoolean($value);
wfConfig::set($key, $value);
wfBlock::removeTemporaryWFSNBlocks();
wfConfig::set($key, $value);
wfConfig::set('detectProxyNextCheck', false, wfConfig::DONT_AUTOLOAD);
wfConfig::set($key, preg_replace('/[\n\r]+/', ',', $value));
if (wfUtils::truthyToBoolean($value)) {
wfConfig::enableAutoUpdate(); //Also sets the option
wfConfig::disableAutoUpdate();
case 'disableCodeExecutionUploads':
$value = wfUtils::truthyToBoolean($value);
wfConfig::set($key, $value);
wfConfig::disableCodeExecutionForUploads(); //Can throw wfConfigException
wfConfig::removeCodeExecutionProtectionForUploads();
case 'email_summary_interval':
wfConfig::set($key, $value);
wfActivityReport::scheduleCronJob();
case 'email_summary_enabled':
$value = wfUtils::truthyToBoolean($value);
wfConfig::set($key, $value);
wfActivityReport::scheduleCronJob();
wfActivityReport::disableCronJob();
case 'other_hideWPVersion':
$value = wfUtils::truthyToBoolean($value);
wfConfig::set($key, $value);
case 'scheduledScansEnabled':
wfScanner::setNeedsRescheduling();
//Letting these fall through to the default save handler
//============ Plugin (default treatment)
if (isset(self::$defaultConfig['checkboxes'][$key]) ||
(isset(self::$defaultConfig['otherParams'][$key]) && self::$defaultConfig['otherParams'][$key]['validation']['type'] == self::TYPE_BOOL) ||
(isset(self::$defaultConfig['defaultsOnly'][$key]) && self::$defaultConfig['defaultsOnly'][$key]['validation']['type'] == self::TYPE_BOOL)) { //Boolean
wfConfig::set($key, wfUtils::truthyToInt($value));
else if ((isset(self::$defaultConfig['otherParams'][$key]) && self::$defaultConfig['otherParams'][$key]['validation']['type'] == self::TYPE_INT) ||
(isset(self::$defaultConfig['defaultsOnly'][$key]) && self::$defaultConfig['defaultsOnly'][$key]['validation']['type'] == self::TYPE_INT)) {
wfConfig::set($key, (int) $value);
else if ((isset(self::$defaultConfig['otherParams'][$key]) && (self::$defaultConfig['otherParams'][$key]['validation']['type'] == self::TYPE_FLOAT || self::$defaultConfig['otherParams'][$key]['validation']['type'] == self::TYPE_DOUBLE)) ||
(isset(self::$defaultConfig['defaultsOnly'][$key]) && (self::$defaultConfig['defaultsOnly'][$key]['validation']['type'] == self::TYPE_FLOAT || self::$defaultConfig['defaultsOnly'][$key]['validation']['type'] == self::TYPE_DOUBLE))) {
wfConfig::set($key, (double) $value);
else if ((isset(self::$defaultConfig['otherParams'][$key]) && self::$defaultConfig['otherParams'][$key]['validation']['type'] == self::TYPE_STRING) ||
(isset(self::$defaultConfig['defaultsOnly'][$key]) && self::$defaultConfig['defaultsOnly'][$key]['validation']['type'] == self::TYPE_STRING)) {
wfConfig::set($key, (string) $value);
else if (in_array($key, self::$serializedOptions)) {
wfConfig::set_ser($key, $value);
else if (in_array($key, self::$wfCentralInternalConfig)) {
wfConfig::set($key, $value);
error_log("*** DEBUG: Config option '{$key}' missing save handler.");
$existingAPIKey = wfConfig::get('apiKey', '');
$apiKey = strtolower(trim($apiKey)); //Already validated above
if (empty($apiKey)) { //Empty, try getting a free key
$api = new wfAPI('', wfUtils::getWPVersion());
$keyData = $api->call('get_anon_api_key');
if ($keyData['ok'] && $keyData['apiKey']) {
wfConfig::set('apiKey', $keyData['apiKey']);
wfConfig::set('isPaid', false);
wfConfig::set('keyType', wfLicense::KEY_TYPE_FREE);
wordfence::licenseStatusChanged();
wfConfig::set('touppPromptNeeded', true);
throw new Exception(__("The Wordfence server's response did not contain the expected elements.", 'wordfence'));
throw new wfConfigException(__('Your options have been saved, but you left your license key blank, so we tried to get you a free license key from the Wordfence servers. There was a problem fetching the free key: ', 'wordfence') . wp_kses($e->getMessage(), array()));
else if ($existingAPIKey != $apiKey) { //Key changed, try activating
$api = new wfAPI($apiKey, wfUtils::getWPVersion());
$res = $api->call('check_api_key', array(), array('previousLicense' => $existingAPIKey));
if ($res['ok'] && isset($res['isPaid'])) {
$isPaid = wfUtils::truthyToBoolean($res['isPaid']);
wfConfig::set('apiKey', $apiKey);
wfConfig::set('isPaid', $isPaid); //res['isPaid'] is boolean coming back as JSON and turned back into PHP struct. Assuming JSON to PHP handles bools.
wordfence::licenseStatusChanged();
wfConfig::set('keyType', wfLicense::KEY_TYPE_FREE);
throw new Exception(__("The Wordfence server's response did not contain the expected elements.", 'wordfence'));
throw new wfConfigException(__('Your options have been saved. However we noticed you changed your license key, and we tried to verify it with the Wordfence servers but received an error: ', 'wordfence') . wp_kses($e->getMessage(), array()));
else { //Key unchanged, just ping it
$api = new wfAPI($apiKey, wfUtils::getWPVersion());
$keyType = wfLicense::KEY_TYPE_FREE;
$keyData = $api->call('ping_api_key', array(), array('supportHash' => wfConfig::get('supportHash', ''), 'whitelistHash' => wfConfig::get('whitelistHash', ''), 'tldlistHash' => wfConfig::get('tldlistHash', ''), 'ipResolutionListHash' => wfConfig::get('ipResolutionListHash', '')));
if (isset($keyData['_isPaidKey'])) {
$keyType = wfConfig::get('keyType');
if (isset($keyData['dashboard'])) {
wfConfig::set('lastDashboardCheck', time());
wfDashboard::processDashboardResponse($keyData['dashboard']);
if (isset($keyData['support']) && isset($keyData['supportHash'])) {
wfConfig::set('supportContent', $keyData['support'], wfConfig::DONT_AUTOLOAD);
wfConfig::set('supportHash', $keyData['supportHash']);
if (isset($keyData['_whitelist']) && isset($keyData['_whitelistHash'])) {
wfConfig::setJSON('whitelistPresets', $keyData['_whitelist']);
wfConfig::set('whitelistHash', $keyData['_whitelistHash']);
if (isset($keyData['_tldlist']) && isset($keyData['_tldlistHash'])) {
wfConfig::set('tldlist', $keyData['_tldlist'], wfConfig::DONT_AUTOLOAD);
wfConfig::set('tldlistHash', $keyData['_tldlistHash']);
if (isset($keyData['_ipResolutionList']) && isset($keyData['_ipResolutionListHash'])) {
wfConfig::setJSON('ipResolutionList', $keyData['_ipResolutionList']);
wfConfig::set('ipResolutionListHash', $keyData['_ipResolutionListHash']);
if (isset($keyData['scanSchedule']) && is_array($keyData['scanSchedule'])) {
wfConfig::set_ser('noc1ScanSchedule', $keyData['scanSchedule']);
if (wfScanner::shared()->schedulingMode() == wfScanner::SCAN_SCHEDULING_MODE_AUTOMATIC) {
wfScanner::shared()->scheduleScans();
if (isset($keyData['showWfCentralUI'])) {
wfConfig::set('showWfCentralUI', (int) $keyData['showWfCentralUI']);
wfConfig::set('keyType', $keyType);
throw new wfConfigException(__('Your options have been saved. However we tried to verify your license key with the Wordfence servers and received an error: ', 'wordfence') . wp_kses($e->getMessage(), array()));
wfNotification::reconcileNotificationsWithOptions();
wfCentral::requestConfigurationSync();
public static function restoreDefaults($section) {
case self::OPTIONS_TYPE_GLOBAL:
'alertOn_lostPasswdForm',
'alertOn_firstAdminLoginOnly',
'alertOn_firstNonAdminLoginOnly',
'alertOn_wordfenceDeactivated',
'liveActivityPauseEnabled',
'notification_updatesNeeded',
'notification_securityAlerts',
'notification_promotions',
'notification_blogHighlights',
'notification_productUpdates',
'notification_scanStatus',
'other_bypassLitespeedNoabort',
'disableCodeExecutionUploads',
'email_summary_dashboard_widget_enabled',
'email_summary_interval',
'email_summary_excluded_directories',
'howGetIPs_trusted_proxies',
'howGetIPs_trusted_proxy_preset',
'displayTopLevelOptions',
case self::OPTIONS_TYPE_FIREWALL:
'loginSec_strongPasswds_enabled',
'loginSec_breachPasswds_enabled',
'loginSec_lockInvalidUsers',
'loginSec_maskLoginErrors',
'loginSec_blockAdminReg',
'loginSec_disableAuthorScan',
'loginSec_disableOEmbedAuthor',
'other_pwStrengthOnUpdate',
'ajaxWatcherDisabled_front',
'ajaxWatcherDisabled_admin',
'loginSec_userBlacklist',
'loginSec_countFailMins',
'loginSec_strongPasswds',
'loginSec_breachPasswds',
'loginSec_maxForgotPasswd',
'maxGlobalRequests_action',
'maxRequestsCrawlers_action',
'maxRequestsHumans_action',