}

[1000] Fix | Delete

}

[1001] Fix | Delete

catch (wfInaccessibleDirectoryException $e) {

[1002] Fix | Delete

throw new Exception(__("Wordfence could not read the content of your WordPress directory. This usually indicates your permissions are so strict that your web server can't read your WordPress directory.", 'wordfence'));

[1003] Fix | Delete

}

[1004] Fix | Delete

}

[1005] Fix | Delete

else {

[1006] Fix | Delete

try {

[1007] Fix | Delete

$entrypoint = new wfScanEntrypoint($scanPath->createScanFile('/'), true);

[1008] Fix | Delete

$entrypoint->addTo($entrypoints);

[1009] Fix | Delete

}

[1010] Fix | Delete

catch (wfInvalidPathException $e) {

[1011] Fix | Delete

wordfence::status(4, 'info', sprintf(__("Ignoring invalid base scan file: %s", 'wordfence'), $e->getPath()));

[1012] Fix | Delete

}

[1013] Fix | Delete

}

[1014] Fix | Delete

}

[1015] Fix | Delete

$_cache = wfScanEntrypoint::getScannedSkippedFiles($entrypoints);

[1016] Fix | Delete

}

[1017] Fix | Delete

return $_cache;

[1018] Fix | Delete

}

[1019] Fix | Delete

[1020] Fix | Delete

private function scan_checkSkippedFiles() {

[1021] Fix | Delete

$haveIssues = wfIssues::STATUS_SECURE;

[1022] Fix | Delete

$status = wfIssues::statusStart(__("Checking for paths skipped due to scan settings", 'wordfence'));

[1023] Fix | Delete

$this->scanController->startStage(wfScanner::STAGE_SERVER_STATE);

[1024] Fix | Delete

[1025] Fix | Delete

$paths = $this->_scannedSkippedPaths();

[1026] Fix | Delete

if (!empty($paths['skipped'])) {

[1027] Fix | Delete

$skippedList = '';

[1028] Fix | Delete

foreach ($paths['skipped'] as $index => $file) {

[1029] Fix | Delete

$path = esc_html($file->getDisplayPath());

[1030] Fix | Delete

[1031] Fix | Delete

if ($index >= 10) {

[1032] Fix | Delete

$skippedList .= sprintf(/* translators: Number of paths skipped in scan. */ __(', and %d more.', 'wordfence'), count($paths['skipped']) - 10);

[1033] Fix | Delete

break;

[1034] Fix | Delete

}

[1035] Fix | Delete

[1036] Fix | Delete

if (!empty($skippedList)) {

[1037] Fix | Delete

if (count($paths['skipped']) == 2) {

[1038] Fix | Delete

$skippedList .= ' and ';

[1039] Fix | Delete

} else if ($index == count($paths['skipped']) - 1) {

[1040] Fix | Delete

$skippedList .= ', and ';

[1041] Fix | Delete

} else {

[1042] Fix | Delete

$skippedList .= ', ';

[1043] Fix | Delete

}

[1044] Fix | Delete

}

[1045] Fix | Delete

[1046] Fix | Delete

$skippedList .= $path;

[1047] Fix | Delete

}

[1048] Fix | Delete

[1049] Fix | Delete

$c = count($paths['skipped']);

[1050] Fix | Delete

$key = "skippedPaths";

[1051] Fix | Delete

$added = $this->addIssue(

[1052] Fix | Delete

'skippedPaths',

[1053] Fix | Delete

wfIssues::SEVERITY_LOW,

[1054] Fix | Delete

$key,

[1055] Fix | Delete

$key,

[1056] Fix | Delete

sprintf(/* translators: Number of paths skipped in scan. */ _n('%d path was skipped for the malware scan due to scan settings', '%d paths were skipped for the malware scan due to scan settings', $c, 'wordfence'), $c),

[1057] Fix | Delete

sprintf(

[1058] Fix | Delete

/* translators: 1. Number of paths skipped in scan. 2. Support URL. 3. List of skipped paths. */

[1059] Fix | Delete

_n(

[1060] Fix | Delete

'The option "Scan files outside your WordPress installation" is off by default, which means %1$d path and its file(s) will not be scanned for malware or unauthorized changes. To continue skipping this path, you may ignore this issue. Or to start scanning it, enable the option and subsequent scans will include it. Some paths may not be necessary to scan, so this is optional. <a href="%2$s" target="_blank" rel="noopener noreferrer">Learn More<span class="screen-reader-text"> (' . esc_html__('opens in new tab', 'wordfence') . ')</span></a><br><br>The path skipped is %3$s',

[1061] Fix | Delete

'The option "Scan files outside your WordPress installation" is off by default, which means %1$d paths and their file(s) will not be scanned for malware or unauthorized changes. To continue skipping these paths, you may ignore this issue. Or to start scanning them, enable the option and subsequent scans will include them. Some paths may not be necessary to scan, so this is optional. <a href="%2$s" target="_blank" rel="noopener noreferrer">Learn More<span class="screen-reader-text"> (' . esc_html__('opens in new tab', 'wordfence') . ')</span></a><br><br>The paths skipped are %3$s',

[1062] Fix | Delete

$c,

[1063] Fix | Delete

'wordfence'

[1064] Fix | Delete

),

[1065] Fix | Delete

$c,

[1066] Fix | Delete

wfSupportController::esc_supportURL(wfSupportController::ITEM_SCAN_RESULT_SKIPPED_PATHS),

[1067] Fix | Delete

$skippedList

[1068] Fix | Delete

),

[1069] Fix | Delete

array()

[1070] Fix | Delete

);

[1071] Fix | Delete

[1072] Fix | Delete

if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) {

[1073] Fix | Delete

$haveIssues = wfIssues::STATUS_PROBLEM;

[1074] Fix | Delete

} else if ($haveIssues != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) {

[1075] Fix | Delete

$haveIssues = wfIssues::STATUS_IGNORED;

[1076] Fix | Delete

}

[1077] Fix | Delete

}

[1078] Fix | Delete

[1079] Fix | Delete

wfIssues::statusEnd($status, $haveIssues);

[1080] Fix | Delete

$this->scanController->completeStage(wfScanner::STAGE_SERVER_STATE, $haveIssues);

[1081] Fix | Delete

}

[1082] Fix | Delete

[1083] Fix | Delete

private function scan_knownFiles_init() {

[1084] Fix | Delete

$paths = $this->_scannedSkippedPaths();

[1085] Fix | Delete

$includeInKnownFilesScan = $paths['scanned'];

[1086] Fix | Delete

if ($this->scanController->scanOutsideWordPress()) {

[1087] Fix | Delete

wordfence::status(2, 'info', __("Including files that are outside the WordPress installation in the scan.", 'wordfence'));

[1088] Fix | Delete

}

[1089] Fix | Delete

[1090] Fix | Delete

$this->status(2, 'info', __("Getting plugin list from WordPress", 'wordfence'));

[1091] Fix | Delete

$knownFilesPlugins = $this->getPlugins();

[1092] Fix | Delete

$this->status(2, 'info', sprintf(/* translators: Number of plugins. */ _n("Found %d plugin", "Found %d plugins", sizeof($knownFilesPlugins), 'wordfence'), sizeof($knownFilesPlugins)));

[1093] Fix | Delete

[1094] Fix | Delete

$this->status(2, 'info', __("Getting theme list from WordPress", 'wordfence'));

[1095] Fix | Delete

$knownFilesThemes = $this->getThemes();

[1096] Fix | Delete

$this->status(2, 'info', sprintf(/* translators: Number of themes. */ _n("Found %d theme", "Found %d themes", sizeof($knownFilesThemes), 'wordfence'), sizeof($knownFilesThemes)));

[1097] Fix | Delete

[1098] Fix | Delete

$this->hasher = new wordfenceHash($includeInKnownFilesScan, $this, wfUtils::hex2bin($this->malwarePrefixesHash), $this->coreHashesHash, $this->scanMode);

[1099] Fix | Delete

}

[1100] Fix | Delete

[1101] Fix | Delete

private function scan_knownFiles_main() {

[1102] Fix | Delete

$this->hasher->run($this); //Include this so we can call addIssue and ->api->

[1103] Fix | Delete

$this->suspectedFiles = $this->hasher->getSuspectedFiles();

[1104] Fix | Delete

$this->hasher = false;

[1105] Fix | Delete

}

[1106] Fix | Delete

[1107] Fix | Delete

private function scan_knownFiles_finish() {

[1108] Fix | Delete

}

[1109] Fix | Delete

[1110] Fix | Delete

private function scan_fileContents_init() {

[1111] Fix | Delete

$options = $this->scanController->scanOptions();

[1112] Fix | Delete

if ($options['scansEnabled_fileContents']) {

[1113] Fix | Delete

$this->statusIDX['infect'] = wfIssues::statusStart(__('Scanning file contents for infections and vulnerabilities', 'wordfence'));

[1114] Fix | Delete

//This stage is marked as started earlier in the hasher rather than here

[1115] Fix | Delete

} else {

[1116] Fix | Delete

wfIssues::statusDisabled(__("Skipping scan of file contents for infections and vulnerabilities", 'wordfence'));

[1117] Fix | Delete

}

[1118] Fix | Delete

[1119] Fix | Delete

if ($options['scansEnabled_fileContentsGSB']) {

[1120] Fix | Delete

$this->statusIDX['GSB'] = wfIssues::statusStart(__('Scanning file contents for URLs on a domain blocklist', 'wordfence'));

[1121] Fix | Delete

//This stage is marked as started earlier in the hasher rather than here

[1122] Fix | Delete

} else {

[1123] Fix | Delete

wfIssues::statusDisabled(__("Skipping scan of file contents for URLs on a domain blocklist", 'wordfence'));

[1124] Fix | Delete

}

[1125] Fix | Delete

[1126] Fix | Delete

if ($options['scansEnabled_fileContents'] || $options['scansEnabled_fileContentsGSB']) {

[1127] Fix | Delete

$this->scanner = new wordfenceScanner($this->apiKey, $this->wp_version, ABSPATH, $this);

[1128] Fix | Delete

$this->status(2, 'info', __("Starting scan of file contents", 'wordfence'));

[1129] Fix | Delete

} else {

[1130] Fix | Delete

$this->scanner = false;

[1131] Fix | Delete

}

[1132] Fix | Delete

}

[1133] Fix | Delete

[1134] Fix | Delete

private function scan_fileContents_main() {

[1135] Fix | Delete

$options = $this->scanController->scanOptions();

[1136] Fix | Delete

if ($options['scansEnabled_fileContents'] || $options['scansEnabled_fileContentsGSB']) {

[1137] Fix | Delete

$this->fileContentsResults = $this->scanner->scan($this);

[1138] Fix | Delete

}

[1139] Fix | Delete

}

[1140] Fix | Delete

[1141] Fix | Delete

private function scan_fileContents_finish() {

[1142] Fix | Delete

$options = $this->scanController->scanOptions();

[1143] Fix | Delete

if ($options['scansEnabled_fileContents'] || $options['scansEnabled_fileContentsGSB']) {

[1144] Fix | Delete

$this->status(2, 'info', __("Done file contents scan", 'wordfence'));

[1145] Fix | Delete

if ($this->scanner->errorMsg) {

[1146] Fix | Delete

throw new Exception($this->scanner->errorMsg);

[1147] Fix | Delete

}

[1148] Fix | Delete

$this->scanner = null;

[1149] Fix | Delete

$haveIssues = wfIssues::STATUS_SECURE;

[1150] Fix | Delete

$haveIssuesGSB = wfIssues::STATUS_SECURE;

[1151] Fix | Delete

foreach ($this->fileContentsResults as $issue) {

[1152] Fix | Delete

$this->status(2, 'info', sprintf(/* translators: Scan result description. */ __("Adding issue: %s", 'wordfence'), $issue['shortMsg']));

[1153] Fix | Delete

$added = $this->addIssue($issue['type'], $issue['severity'], $issue['ignoreP'], $issue['ignoreC'], $issue['shortMsg'], $issue['longMsg'], $issue['data']);

[1154] Fix | Delete

[1155] Fix | Delete

if (isset($issue['data']['gsb'])) {

[1156] Fix | Delete

if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) {

[1157] Fix | Delete

$haveIssuesGSB = wfIssues::STATUS_PROBLEM;

[1158] Fix | Delete

} else if ($haveIssuesGSB != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) {

[1159] Fix | Delete

$haveIssuesGSB = wfIssues::STATUS_IGNORED;

[1160] Fix | Delete

}

[1161] Fix | Delete

} else {

[1162] Fix | Delete

if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) {

[1163] Fix | Delete

$haveIssues = wfIssues::STATUS_PROBLEM;

[1164] Fix | Delete

} else if ($haveIssues != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) {

[1165] Fix | Delete

$haveIssues = wfIssues::STATUS_IGNORED;

[1166] Fix | Delete

}

[1167] Fix | Delete

}

[1168] Fix | Delete

}

[1169] Fix | Delete

$this->fileContentsResults = null;

[1170] Fix | Delete

[1171] Fix | Delete

if ($options['scansEnabled_fileContents']) {

[1172] Fix | Delete

wfIssues::statusEnd($this->statusIDX['infect'], $haveIssues);

[1173] Fix | Delete

$this->scanController->completeStage(wfScanner::STAGE_MALWARE_SCAN, $haveIssues);

[1174] Fix | Delete

}

[1175] Fix | Delete

[1176] Fix | Delete

if ($options['scansEnabled_fileContentsGSB']) {

[1177] Fix | Delete

wfIssues::statusEnd($this->statusIDX['GSB'], $haveIssuesGSB);

[1178] Fix | Delete

$this->scanController->completeStage(wfScanner::STAGE_CONTENT_SAFETY, $haveIssuesGSB);

[1179] Fix | Delete

}

[1180] Fix | Delete

}

[1181] Fix | Delete

}

[1182] Fix | Delete

[1183] Fix | Delete

private function scan_suspectedFiles() {

[1184] Fix | Delete

$haveIssues = wfIssues::STATUS_SECURE;

[1185] Fix | Delete

$status = wfIssues::statusStart(__("Scanning for publicly accessible quarantined files", 'wordfence'));

[1186] Fix | Delete

$this->scanController->startStage(wfScanner::STAGE_PUBLIC_FILES);

[1187] Fix | Delete

[1188] Fix | Delete

if (is_array($this->suspectedFiles) && count($this->suspectedFiles) > 0) {

[1189] Fix | Delete

foreach ($this->suspectedFiles as $file) {

[1190] Fix | Delete

wordfence::status(4, 'info', sprintf(/* translators: File path. */ __("Testing accessibility of: %s", 'wordfence'), $file));

[1191] Fix | Delete

$test = wfPubliclyAccessibleFileTest::createFromRootPath($file);

[1192] Fix | Delete

if ($test->fileExists() && $test->isPubliclyAccessible()) {

[1193] Fix | Delete

$key = "publiclyAccessible" . bin2hex($test->getUrl());

[1194] Fix | Delete

$added = $this->addIssue(

[1195] Fix | Delete

'publiclyAccessible',

[1196] Fix | Delete

wfIssues::SEVERITY_HIGH,

[1197] Fix | Delete

$key,

[1198] Fix | Delete

$key,

[1199] Fix | Delete

sprintf(/* translators: File path. */ __('Publicly accessible quarantined file found: %s', 'wordfence'), esc_html($file)),

[1200] Fix | Delete

sprintf(

[1201] Fix | Delete

/* translators: URL to publicly accessible file. */

[1202] Fix | Delete

__('<a href="%1$s" target="_blank" rel="noopener noreferrer">%1$s<span class="screen-reader-text"> (' . esc_html__('opens in new tab', 'wordfence') . ')</span></a> is publicly accessible and may expose source code or sensitive information about your site. Files such as this one are commonly checked for by scanners and should be removed or made inaccessible.', 'wordfence'),

[1203] Fix | Delete

$test->getUrl()

[1204] Fix | Delete

),

[1205] Fix | Delete

array(

[1206] Fix | Delete

'url' => $test->getUrl(),

[1207] Fix | Delete

'file' => $file,

[1208] Fix | Delete

'canDelete' => true,

[1209] Fix | Delete

)

[1210] Fix | Delete

);

[1211] Fix | Delete

[1212] Fix | Delete

if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) {

[1213] Fix | Delete

$haveIssues = wfIssues::STATUS_PROBLEM;

[1214] Fix | Delete

} else if ($haveIssues != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) {

[1215] Fix | Delete

$haveIssues = wfIssues::STATUS_IGNORED;

[1216] Fix | Delete

}

[1217] Fix | Delete

}

[1218] Fix | Delete

}

[1219] Fix | Delete

}

[1220] Fix | Delete

[1221] Fix | Delete

wfIssues::statusEnd($status, $haveIssues);

[1222] Fix | Delete

$this->scanController->completeStage(wfScanner::STAGE_PUBLIC_FILES, $haveIssues);

[1223] Fix | Delete

}

[1224] Fix | Delete

[1225] Fix | Delete

private function scan_posts_init() {

[1226] Fix | Delete

$this->statusIDX['posts'] = wfIssues::statusStart(__('Scanning posts for URLs on a domain blocklist', 'wordfence'));

[1227] Fix | Delete

$this->scanController->startStage(wfScanner::STAGE_CONTENT_SAFETY);

[1228] Fix | Delete

$blogsToScan = self::getBlogsToScan('posts');

[1229] Fix | Delete

$this->scanQueue = '';

[1230] Fix | Delete

$wfdb = new wfDB();

[1231] Fix | Delete

$this->hoover = new wordfenceURLHoover($this->apiKey, $this->wp_version);

[1232] Fix | Delete

foreach ($blogsToScan as $blog) {

[1233] Fix | Delete

$q1 = $wfdb->querySelect("select ID from " . $blog['table'] . " where post_type IN ('page', 'post') and post_status = 'publish'");

[1234] Fix | Delete

foreach ($q1 as $idRow) {

[1235] Fix | Delete

$this->scanQueue .= pack('LL', $blog['blog_id'], $idRow['ID']);

[1236] Fix | Delete

}

[1237] Fix | Delete

}

[1238] Fix | Delete

}

[1239] Fix | Delete

[1240] Fix | Delete

private function scan_posts_main() {

[1241] Fix | Delete

global $wpdb;

[1242] Fix | Delete

$wfdb = new wfDB();

[1243] Fix | Delete

while (strlen($this->scanQueue) > 0) {

[1244] Fix | Delete

$segment = substr($this->scanQueue, 0, 8);

[1245] Fix | Delete

$this->scanQueue = substr($this->scanQueue, 8);

[1246] Fix | Delete

$elem = unpack('Lblog/Lpost', $segment);

[1247] Fix | Delete

$queueSize = strlen($this->scanQueue) / 8;

[1248] Fix | Delete

if ($queueSize > 0 && $queueSize % 1000 == 0) {

[1249] Fix | Delete

wordfence::status(2, 'info', sprintf(/* translators: Number of posts left to scan. */ __("Scanning posts with %d left to scan.", 'wordfence'), $queueSize));

[1250] Fix | Delete

}

[1251] Fix | Delete

[1252] Fix | Delete

$this->scanController->incrementSummaryItem(wfScanner::SUMMARY_SCANNED_POSTS);

[1253] Fix | Delete

[1254] Fix | Delete

$blogID = $elem['blog'];

[1255] Fix | Delete

$postID = $elem['post'];

[1256] Fix | Delete

[1257] Fix | Delete

$blogs = self::getBlogsToScan('posts', $blogID);

[1258] Fix | Delete

$blog = array_shift($blogs);

[1259] Fix | Delete

[1260] Fix | Delete

$table = wfDB::blogTable('posts', $blogID);

[1261] Fix | Delete

[1262] Fix | Delete

$row = $wfdb->querySingleRec("select ID, post_title, post_type, post_date, post_content from {$table} where ID = %d", $postID);

[1263] Fix | Delete

$found = $this->hoover->hoover($blogID . '-' . $row['ID'], $row['post_title'] . ' ' . $row['post_content'], wordfenceURLHoover::standardExcludedHosts());

[1264] Fix | Delete

$this->scanController->incrementSummaryItem(wfScanner::SUMMARY_SCANNED_URLS, $found);

[1265] Fix | Delete

if (preg_match('/(?:<[\s\n\r\t]*script[\r\s\n\t]+.*>|<[\s\n\r\t]*meta.*refresh)/i', $row['post_title'])) {

[1266] Fix | Delete

$this->addIssue(

[1267] Fix | Delete

'postBadTitle',

[1268] Fix | Delete

wfIssues::SEVERITY_HIGH,

[1269] Fix | Delete

$row['ID'],

[1270] Fix | Delete

md5($row['post_title']),

[1271] Fix | Delete

__("Post title contains suspicious code", 'wordfence'),

[1272] Fix | Delete

__("This post contains code that is suspicious. Please check the title of the post and confirm that the code in the title is not malicious.", 'wordfence'),

[1273] Fix | Delete

array(

[1274] Fix | Delete

'postID' => $postID,

[1275] Fix | Delete

'postTitle' => $row['post_title'],

[1276] Fix | Delete

'permalink' => get_permalink($postID),

[1277] Fix | Delete

'editPostLink' => get_edit_post_link($postID),

[1278] Fix | Delete

'type' => $row['post_type'],

[1279] Fix | Delete

'postDate' => $row['post_date'],

[1280] Fix | Delete

'isMultisite' => $blog['isMultisite'],

[1281] Fix | Delete

'domain' => $blog['domain'],

[1282] Fix | Delete

'path' => $blog['path'],

[1283] Fix | Delete

'blog_id' => $blog['blog_id']

[1284] Fix | Delete

)

[1285] Fix | Delete

);

[1286] Fix | Delete

}

[1287] Fix | Delete

[1288] Fix | Delete

$this->forkIfNeeded();

[1289] Fix | Delete

}

[1290] Fix | Delete

}

[1291] Fix | Delete

[1292] Fix | Delete

private function scan_posts_finish() {

[1293] Fix | Delete

global $wpdb;

[1294] Fix | Delete

$wfdb = new wfDB();

[1295] Fix | Delete

$this->status(2, 'info', __("Examining URLs found in posts we scanned for dangerous websites", 'wordfence'));

[1296] Fix | Delete

$hooverResults = $this->hoover->getBaddies();

[1297] Fix | Delete

$this->status(2, 'info', __("Done examining URLs", 'wordfence'));

[1298] Fix | Delete

if ($this->hoover->errorMsg) {

[1299] Fix | Delete

wfIssues::statusEndErr();

[1300] Fix | Delete

throw new Exception($this->hoover->errorMsg);

[1301] Fix | Delete

}

[1302] Fix | Delete

$this->hoover->cleanup();

[1303] Fix | Delete

$haveIssues = wfIssues::STATUS_SECURE;

[1304] Fix | Delete

foreach ($hooverResults as $idString => $hresults) {

[1305] Fix | Delete

$arr = explode('-', $idString);

[1306] Fix | Delete

$blogID = $arr[0];

[1307] Fix | Delete

$postID = $arr[1];

[1308] Fix | Delete

$table = wfDB::blogTable('posts', $blogID);

[1309] Fix | Delete

$blog = null;

[1310] Fix | Delete

$post = null;

[1311] Fix | Delete

foreach ($hresults as $result) {

[1312] Fix | Delete

if ($result['badList'] != 'goog-malware-shavar' && $result['badList'] != 'googpub-phish-shavar' && $result['badList'] != 'wordfence-dbl') {

[1313] Fix | Delete

continue; //A list type that may be new and the plugin has not been upgraded yet.

[1314] Fix | Delete

}

[1315] Fix | Delete

[1316] Fix | Delete

if ($blog === null) {

[1317] Fix | Delete

$blogs = self::getBlogsToScan('posts', $blogID);

[1318] Fix | Delete

$blog = array_shift($blogs);

[1319] Fix | Delete

}

[1320] Fix | Delete

[1321] Fix | Delete

if ($post === null) {

[1322] Fix | Delete

$post = $wfdb->querySingleRec("select ID, post_title, post_type, post_date, post_content from {$table} where ID = %d", $postID);

[1323] Fix | Delete

$type = $post['post_type'] ? $post['post_type'] : 'comment';

[1324] Fix | Delete

$uctype = ucfirst($type);

[1325] Fix | Delete

$postDate = $post['post_date'];

[1326] Fix | Delete

$title = $post['post_title'];

[1327] Fix | Delete

$contentMD5 = md5($post['post_content']);

[1328] Fix | Delete

}

[1329] Fix | Delete

[1330] Fix | Delete

if ($result['badList'] == 'goog-malware-shavar') {

[1331] Fix | Delete

$shortMsg = sprintf(

[1332] Fix | Delete

/* translators: 1. WordPress Post type. 2. URL. */

[1333] Fix | Delete

__('%1$s contains a suspected malware URL: %2$s', 'wordfence'),

[1334] Fix | Delete

$uctype,

[1335] Fix | Delete

esc_html($title)

[1336] Fix | Delete

);

[1337] Fix | Delete

$longMsg = sprintf(

[1338] Fix | Delete

/* translators: 1. WordPress Post type. 2. URL. 3. URL. */

[1339] Fix | Delete

__('This %1$s contains a suspected malware URL listed on Google\'s list of malware sites. The URL is: %2$s - More info available at <a href="http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=%3$s&client=googlechrome&hl=en-US" target="_blank" rel="noopener noreferrer">Google Safe Browsing diagnostic page<span class="screen-reader-text"> (' . esc_html__('opens in new tab', 'wordfence') . ')</span></a>.', 'wordfence'),

[1340] Fix | Delete

esc_html($type),

[1341] Fix | Delete

esc_html($result['URL']),

[1342] Fix | Delete

urlencode($result['URL'])

[1343] Fix | Delete

);

[1344] Fix | Delete

} else if ($result['badList'] == 'googpub-phish-shavar') {

[1345] Fix | Delete

$shortMsg = sprintf(/* translators: 1. WordPress Post type. 2. URL. */ __('%1$s contains a suspected phishing site URL: %2$s', 'wordfence'), $uctype, esc_html($title));

[1346] Fix | Delete

$longMsg = sprintf(

[1347] Fix | Delete

/* translators: 1. WordPress Post type. 2. URL. */

[1348] Fix | Delete

__('This %1$s contains a URL that is a suspected phishing site that is currently listed on Google\'s list of known phishing sites. The URL is: %2$s', 'wordfence'),

[1349] Fix | Delete

esc_html($type),

[1350] Fix | Delete

esc_html($result['URL'])

[1351] Fix | Delete

);

[1352] Fix | Delete

} else if ($result['badList'] == 'wordfence-dbl') {

[1353] Fix | Delete

$shortMsg = sprintf(/* translators: 1. WordPress Post type. 2. URL. */ __('%1$s contains a suspected malware URL: %2$s', 'wordfence'), $uctype, esc_html($title));

[1354] Fix | Delete

$longMsg = sprintf(

[1355] Fix | Delete

/* translators: 1. WordPress Post type. 2. URL. */

[1356] Fix | Delete

__('This %1$s contains a URL that is currently listed on Wordfence\'s domain blocklist. The URL is: %2$s', 'wordfence'),

[1357] Fix | Delete

esc_html($type),

[1358] Fix | Delete

esc_html($result['URL'])

[1359] Fix | Delete

);

[1360] Fix | Delete

} else {

[1361] Fix | Delete

//A list type that may be new and the plugin has not been upgraded yet.

[1362] Fix | Delete

continue;

[1363] Fix | Delete

}

[1364] Fix | Delete

[1365] Fix | Delete

$this->status(2, 'info', sprintf(/* translators: Scan result description. */ __('Adding issue: %1$s', 'wordfence'), $shortMsg));

[1366] Fix | Delete

if (is_multisite()) {

[1367] Fix | Delete

switch_to_blog($blogID);

[1368] Fix | Delete

}

[1369] Fix | Delete

$ignoreP = $idString;

[1370] Fix | Delete

$ignoreC = $idString . $contentMD5;

[1371] Fix | Delete

$added = $this->addIssue('postBadURL', wfIssues::SEVERITY_HIGH, $ignoreP, $ignoreC, $shortMsg, $longMsg, array(

[1372] Fix | Delete

'postID' => $postID,

[1373] Fix | Delete

'badURL' => $result['URL'],

[1374] Fix | Delete

'postTitle' => $title,

[1375] Fix | Delete

'type' => $type,

[1376] Fix | Delete

'uctype' => $uctype,

[1377] Fix | Delete

'permalink' => get_permalink($postID),

[1378] Fix | Delete

'editPostLink' => get_edit_post_link($postID),

[1379] Fix | Delete

'postDate' => $postDate,

[1380] Fix | Delete

'isMultisite' => $blog['isMultisite'],

[1381] Fix | Delete

'domain' => $blog['domain'],

[1382] Fix | Delete

'path' => $blog['path'],

[1383] Fix | Delete

'blog_id' => $blogID

[1384] Fix | Delete

));

[1385] Fix | Delete

if ($added == wfIssues::ISSUE_ADDED || $added == wfIssues::ISSUE_UPDATED) {

[1386] Fix | Delete

$haveIssues = wfIssues::STATUS_PROBLEM;

[1387] Fix | Delete

} else if ($haveIssues != wfIssues::STATUS_PROBLEM && ($added == wfIssues::ISSUE_IGNOREP || $added == wfIssues::ISSUE_IGNOREC)) {

[1388] Fix | Delete

$haveIssues = wfIssues::STATUS_IGNORED;

[1389] Fix | Delete

}

[1390] Fix | Delete

if (is_multisite()) {

[1391] Fix | Delete

restore_current_blog();

[1392] Fix | Delete

}

[1393] Fix | Delete

}

[1394] Fix | Delete

}

[1395] Fix | Delete

wfIssues::statusEnd($this->statusIDX['posts'], $haveIssues);

[1396] Fix | Delete

$this->scanController->completeStage(wfScanner::STAGE_CONTENT_SAFETY, $haveIssues);

[1397] Fix | Delete

$this->scanQueue = '';

[1398] Fix | Delete

}

[1399] Fix | Delete

[1400] Fix | Delete

private function scan_comments_init() {

[1401] Fix | Delete

$this->statusIDX['comments'] = wfIssues::statusStart(__('Scanning comments for URLs on a domain blocklist', 'wordfence'));

[1402] Fix | Delete

$this->scanController->startStage(wfScanner::STAGE_CONTENT_SAFETY);

[1403] Fix | Delete

$this->scanData = array();

[1404] Fix | Delete

$this->scanQueue = '';

[1405] Fix | Delete

$this->hoover = new wordfenceURLHoover($this->apiKey, $this->wp_version);

[1406] Fix | Delete

$blogsToScan = self::getBlogsToScan('comments');

[1407] Fix | Delete

$wfdb = new wfDB();

[1408] Fix | Delete

foreach ($blogsToScan as $blog) {

[1409] Fix | Delete

$q1 = $wfdb->querySelect("select comment_ID from " . $blog['table'] . " where comment_approved=1 and not comment_type = 'order_note'");

[1410] Fix | Delete

foreach ($q1 as $idRow) {

[1411] Fix | Delete

$this->scanQueue .= pack('LL', $blog['blog_id'], $idRow['comment_ID']);

[1412] Fix | Delete

}

[1413] Fix | Delete

}

[1414] Fix | Delete

}

[1415] Fix | Delete

[1416] Fix | Delete

private function scan_comments_main() {

[1417] Fix | Delete

global $wpdb;

[1418] Fix | Delete

$wfdb = new wfDB();

[1419] Fix | Delete

while (strlen($this->scanQueue) > 0) {

[1420] Fix | Delete

$segment = substr($this->scanQueue, 0, 8);

[1421] Fix | Delete

$this->scanQueue = substr($this->scanQueue, 8);

[1422] Fix | Delete

$elem = unpack('Lblog/Lcomment', $segment);

[1423] Fix | Delete

$queueSize = strlen($this->scanQueue) / 8;

[1424] Fix | Delete

if ($queueSize > 0 && $queueSize % 1000 == 0) {

[1425] Fix | Delete

wordfence::status(2, 'info', sprintf(/* translators: Number of comments left to scan. */ __("Scanning comments with %d left to scan.", 'wordfence'), $queueSize));

[1426] Fix | Delete

}

[1427] Fix | Delete

[1428] Fix | Delete

$this->scanController->incrementSummaryItem(wfScanner::SUMMARY_SCANNED_COMMENTS);

[1429] Fix | Delete

[1430] Fix | Delete

$blogID = $elem['blog'];

[1431] Fix | Delete

$commentID = $elem['comment'];

[1432] Fix | Delete

[1433] Fix | Delete

$table = wfDB::blogTable('comments', $blogID);

[1434] Fix | Delete

[1435] Fix | Delete

$row = $wfdb->querySingleRec("select comment_ID, comment_date, comment_type, comment_author, comment_author_url, comment_content from {$table} where comment_ID=%d", $commentID);

[1436] Fix | Delete

$found = $this->hoover->hoover($blogID . '-' . $row['comment_ID'], $row['comment_author_url'] . ' ' . $row['comment_author'] . ' ' . $row['comment_content'], wordfenceURLHoover::standardExcludedHosts());

[1437] Fix | Delete

$this->scanController->incrementSummaryItem(wfScanner::SUMMARY_SCANNED_URLS, $found);

[1438] Fix | Delete

$this->forkIfNeeded();

[1439] Fix | Delete

}

[1440] Fix | Delete

}

[1441] Fix | Delete

[1442] Fix | Delete

private function scan_comments_finish() {

[1443] Fix | Delete

$wfdb = new wfDB();

[1444] Fix | Delete

$hooverResults = $this->hoover->getBaddies();

[1445] Fix | Delete

if ($this->hoover->errorMsg) {

[1446] Fix | Delete

wfIssues::statusEndErr();

[1447] Fix | Delete

throw new Exception($this->hoover->errorMsg);

[1448] Fix | Delete

}

[1449] Fix | Delete

$this->hoover->cleanup();

[1450] Fix | Delete

$haveIssues = wfIssues::STATUS_SECURE;

[1451] Fix | Delete

foreach ($hooverResults as $idString => $hresults) {

[1452] Fix | Delete

$arr = explode('-', $idString);

[1453] Fix | Delete

$blogID = $arr[0];

[1454] Fix | Delete

$commentID = $arr[1];

[1455] Fix | Delete

$blog = null;

[1456] Fix | Delete

$comment = null;

[1457] Fix | Delete

foreach ($hresults as $result) {

[1458] Fix | Delete

if ($result['badList'] != 'goog-malware-shavar' && $result['badList'] != 'googpub-phish-shavar' && $result['badList'] != 'wordfence-dbl') {

[1459] Fix | Delete

continue; //A list type that may be new and the plugin has not been upgraded yet.

[1460] Fix | Delete

}

[1461] Fix | Delete

[1462] Fix | Delete

if ($blog === null) {

[1463] Fix | Delete

$blogs = self::getBlogsToScan('comments', $blogID);

[1464] Fix | Delete

$blog = array_shift($blogs);

[1465] Fix | Delete

}

[1466] Fix | Delete

[1467] Fix | Delete

if ($comment === null) {

[1468] Fix | Delete

$comment = $wfdb->querySingleRec("select comment_ID, comment_date, comment_type, comment_author, comment_author_url, comment_content from " . $blog['table'] . " where comment_ID=%d", $commentID);

[1469] Fix | Delete

$type = $comment['comment_type'] ? $comment['comment_type'] : 'comment';

[1470] Fix | Delete

$uctype = ucfirst($type);

[1471] Fix | Delete

$author = $comment['comment_author'];

[1472] Fix | Delete

$date = $comment['comment_date'];

[1473] Fix | Delete

$contentMD5 = md5($comment['comment_content'] . $comment['comment_author'] . $comment['comment_author_url']);

[1474] Fix | Delete

}

[1475] Fix | Delete

[1476] Fix | Delete

if ($result['badList'] == 'goog-malware-shavar') {

[1477] Fix | Delete

$shortMsg = sprintf(

[1478] Fix | Delete

/* translators: 1. WordPress post type. 2. WordPress author username. */

[1479] Fix | Delete

__('%1$s with author %2$s contains a suspected malware URL.', 'wordfence'), $uctype, esc_html($author));

[1480] Fix | Delete

$longMsg = sprintf(

[1481] Fix | Delete

/* translators: 1. WordPress post type. 2. URL. 3. URL. */

[1482] Fix | Delete

__('This %1$s contains a suspected malware URL listed on Google\'s list of malware sites. The URL is: %2$s - More info available at <a href="http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=%3$s&client=googlechrome&hl=en-US" target="_blank" rel="noopener noreferrer">Google Safe Browsing diagnostic page<span class="screen-reader-text"> (' . esc_html__('opens in new tab', 'wordfence') . ')</span></a>.', 'wordfence'),

[1483] Fix | Delete

esc_html($type),

[1484] Fix | Delete

esc_html($result['URL']),

[1485] Fix | Delete

urlencode($result['URL'])

[1486] Fix | Delete

);

[1487] Fix | Delete

} else if ($result['badList'] == 'googpub-phish-shavar') {

[1488] Fix | Delete

$shortMsg = sprintf(/* translators: WordPress post type. */ __("%s contains a suspected phishing site URL.", 'wordfence'), $uctype);

[1489] Fix | Delete

$longMsg = sprintf(

[1490] Fix | Delete

/* translators: 1. WordPress post type. 2. URL. */

[1491] Fix | Delete

__('This %1$s contains a URL that is a suspected phishing site that is currently listed on Google\'s list of known phishing sites. The URL is: %2$s', 'wordfence'),

[1492] Fix | Delete

esc_html($type),

[1493] Fix | Delete

esc_html($result['URL'])

[1494] Fix | Delete

);

[1495] Fix | Delete

} else if ($result['badList'] == 'wordfence-dbl') {

[1496] Fix | Delete

$shortMsg = sprintf(/* translators: URL. */ __("%s contains a suspected malware URL.", 'wordfence'), $uctype);

[1497] Fix | Delete

$longMsg = sprintf(

[1498] Fix | Delete

/* translators: 1. WordPress post type. 2. URL. */

[1499] Fix | Delete