<?php

[0] Fix | Delete

[1] Fix | Delete

class wfUpdateCheck {

[2] Fix | Delete

const VULN_SEVERITY_CRITICAL = 90;

[3] Fix | Delete

const VULN_SEVERITY_HIGH = 70;

[4] Fix | Delete

const VULN_SEVERITY_MEDIUM = 40;

[5] Fix | Delete

const VULN_SEVERITY_LOW = 1;

[6] Fix | Delete

const VULN_SEVERITY_NONE = 0;

[7] Fix | Delete

[8] Fix | Delete

const LAST_UPDATE_CHECK_ERROR_KEY = 'lastUpdateCheckError';

[9] Fix | Delete

const LAST_UPDATE_CHECK_ERROR_SLUG_KEY = 'lastUpdateCheckErrorSlug';

[10] Fix | Delete

[11] Fix | Delete

private $needs_core_update = false;

[12] Fix | Delete

private $core_update_patch_available = false;

[13] Fix | Delete

private $core_earlier_branch = false;

[14] Fix | Delete

private $core_update_version = 0;

[15] Fix | Delete

private $core_update_patch_version = 0;

[16] Fix | Delete

private $plugin_updates = array();

[17] Fix | Delete

private $all_plugins = array();

[18] Fix | Delete

private $plugin_slugs = array();

[19] Fix | Delete

private $theme_updates = array();

[20] Fix | Delete

private $api = null;

[21] Fix | Delete

[22] Fix | Delete

/**

[23] Fix | Delete

* This hook exists because some plugins override their own update check and can return invalid

[24] Fix | Delete

* responses (e.g., null) due to logic errors or their update check server being unreachable. This

[25] Fix | Delete

* can interfere with our scan running the outdated plugins check. When scanning, we adjust the

[26] Fix | Delete

* response in those cases to be `false`, which causes WP to fall back to the plugin repo data.

[27] Fix | Delete

*/

[28] Fix | Delete

public static function installPluginAPIFixer() {

[29] Fix | Delete

add_filter('plugins_api', 'wfUpdateCheck::_pluginAPIFixer', 999, 3);

[30] Fix | Delete

}

[31] Fix | Delete

[32] Fix | Delete

public static function _pluginAPIFixer($result, $action, $args) {

[33] Fix | Delete

if ($result === false || is_object($result) || is_array($result)) {

[34] Fix | Delete

return $result;

[35] Fix | Delete

}

[36] Fix | Delete

[37] Fix | Delete

if (!wfScanEngine::isScanRunning(true)) { //Skip fixing if it's not the call the scanner made

[38] Fix | Delete

return $result;

[39] Fix | Delete

}

[40] Fix | Delete

[41] Fix | Delete

$slug = null;

[42] Fix | Delete

if (is_object($args) && isset($args->slug)) {

[43] Fix | Delete

$slug = $args->slug;

[44] Fix | Delete

}

[45] Fix | Delete

else if (is_array($args) && isset($args['slug'])) {

[46] Fix | Delete

$slug = $args['slug'];

[47] Fix | Delete

}

[48] Fix | Delete

wordfence::status(2, 'info', sprintf(/* translators: 1. Plugin slug. */ __('Outdated plugin scan adjusted invalid return value in plugins_api filter for %s', 'wordfence'), $slug));

[49] Fix | Delete

return false;

[50] Fix | Delete

}

[51] Fix | Delete

[52] Fix | Delete

public static function syncAllVersionInfo() {

[53] Fix | Delete

// Load the core/plugin/theme versions into the WAF configuration.

[54] Fix | Delete

wfConfig::set('wordpressVersion', wfUtils::getWPVersion());

[55] Fix | Delete

wfWAFConfig::set('wordpressVersion', wfUtils::getWPVersion(), wfWAF::getInstance(), 'synced');

[56] Fix | Delete

[57] Fix | Delete

if (!function_exists('get_plugins')) {

[58] Fix | Delete

require_once(ABSPATH . '/wp-admin/includes/plugin.php');

[59] Fix | Delete

}

[60] Fix | Delete

[61] Fix | Delete

$pluginVersions = array();

[62] Fix | Delete

foreach (get_plugins() as $pluginFile => $pluginData) {

[63] Fix | Delete

$slug = plugin_basename($pluginFile);

[64] Fix | Delete

if (preg_match('/^([^\/]+)\//', $pluginFile, $matches)) {

[65] Fix | Delete

$slug = $matches[1];

[66] Fix | Delete

} else if (preg_match('/^([^\/.]+)\.php$/', $pluginFile, $matches)) {

[67] Fix | Delete

$slug = $matches[1];

[68] Fix | Delete

}

[69] Fix | Delete

$pluginVersions[$slug] = isset($pluginData['Version']) ? $pluginData['Version'] : null;

[70] Fix | Delete

}

[71] Fix | Delete

[72] Fix | Delete

wfConfig::set_ser('wordpressPluginVersions', $pluginVersions);

[73] Fix | Delete

wfWAFConfig::set('wordpressPluginVersions', $pluginVersions, wfWAF::getInstance(), 'synced');

[74] Fix | Delete

[75] Fix | Delete

if (!function_exists('wp_get_themes')) {

[76] Fix | Delete

require_once(ABSPATH . '/wp-includes/theme.php');

[77] Fix | Delete

}

[78] Fix | Delete

[79] Fix | Delete

$themeVersions = array();

[80] Fix | Delete

foreach (wp_get_themes() as $slug => $theme) {

[81] Fix | Delete

$themeVersions[$slug] = isset($theme['Version']) ? $theme['Version'] : null;

[82] Fix | Delete

}

[83] Fix | Delete

[84] Fix | Delete

wfConfig::set_ser('wordpressThemeVersions', $themeVersions);

[85] Fix | Delete

wfWAFConfig::set('wordpressThemeVersions', $themeVersions, wfWAF::getInstance(), 'synced');

[86] Fix | Delete

}

[87] Fix | Delete

[88] Fix | Delete

public static function cvssScoreSeverity($score) {

[89] Fix | Delete

$intScore = floor($score * 10);

[90] Fix | Delete

if ($intScore >= self::VULN_SEVERITY_CRITICAL) {

[91] Fix | Delete

return self::VULN_SEVERITY_CRITICAL;

[92] Fix | Delete

}

[93] Fix | Delete

else if ($intScore >= self::VULN_SEVERITY_HIGH) {

[94] Fix | Delete

return self::VULN_SEVERITY_HIGH;

[95] Fix | Delete

}

[96] Fix | Delete

else if ($intScore >= self::VULN_SEVERITY_MEDIUM) {

[97] Fix | Delete

return self::VULN_SEVERITY_MEDIUM;

[98] Fix | Delete

}

[99] Fix | Delete

else if ($intScore >= self::VULN_SEVERITY_LOW) {

[100] Fix | Delete

return self::VULN_SEVERITY_LOW;

[101] Fix | Delete

}

[102] Fix | Delete

[103] Fix | Delete

return self::VULN_SEVERITY_NONE;

[104] Fix | Delete

}

[105] Fix | Delete

[106] Fix | Delete

public static function cvssScoreSeverityLabel($score) {

[107] Fix | Delete

$severity = self::cvssScoreSeverity($score);

[108] Fix | Delete

switch ($severity) {

[109] Fix | Delete

case self::VULN_SEVERITY_CRITICAL:

[110] Fix | Delete

return __('Critical', 'wordfence');

[111] Fix | Delete

case self::VULN_SEVERITY_HIGH:

[112] Fix | Delete

return __('High', 'wordfence');

[113] Fix | Delete

case self::VULN_SEVERITY_MEDIUM:

[114] Fix | Delete

return __('Medium', 'wordfence');

[115] Fix | Delete

case self::VULN_SEVERITY_LOW:

[116] Fix | Delete

return __('Low', 'wordfence');

[117] Fix | Delete

}

[118] Fix | Delete

return __('None', 'wordfence');

[119] Fix | Delete

}

[120] Fix | Delete

[121] Fix | Delete

public static function cvssScoreSeverityHexColor($score) {

[122] Fix | Delete

$severity = self::cvssScoreSeverity($score);

[123] Fix | Delete

switch ($severity) {

[124] Fix | Delete

case self::VULN_SEVERITY_CRITICAL:

[125] Fix | Delete

return '#cc0500';

[126] Fix | Delete

case self::VULN_SEVERITY_HIGH:

[127] Fix | Delete

return '#df3d03';

[128] Fix | Delete

case self::VULN_SEVERITY_MEDIUM:

[129] Fix | Delete

return '#f9a009';

[130] Fix | Delete

case self::VULN_SEVERITY_LOW:

[131] Fix | Delete

return '#ffcb0d';

[132] Fix | Delete

}

[133] Fix | Delete

return '#000000';

[134] Fix | Delete

}

[135] Fix | Delete

[136] Fix | Delete

public static function cvssScoreSeverityClass($score) {

[137] Fix | Delete

$severity = self::cvssScoreSeverity($score);

[138] Fix | Delete

switch ($severity) {

[139] Fix | Delete

case self::VULN_SEVERITY_CRITICAL:

[140] Fix | Delete

return 'wf-vulnerability-severity-critical';

[141] Fix | Delete

case self::VULN_SEVERITY_HIGH:

[142] Fix | Delete

return 'wf-vulnerability-severity-high';

[143] Fix | Delete

case self::VULN_SEVERITY_MEDIUM:

[144] Fix | Delete

return 'wf-vulnerability-severity-medium';

[145] Fix | Delete

case self::VULN_SEVERITY_LOW:

[146] Fix | Delete

return 'wf-vulnerability-severity-low';

[147] Fix | Delete

}

[148] Fix | Delete

return 'wf-vulnerability-severity-none';

[149] Fix | Delete

}

[150] Fix | Delete

[151] Fix | Delete

public function __construct() {

[152] Fix | Delete

$this->api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());

[153] Fix | Delete

}

[154] Fix | Delete

[155] Fix | Delete

public function __sleep() {

[156] Fix | Delete

return array('needs_core_update', 'core_update_version', 'plugin_updates', 'all_plugins', 'plugin_slugs', 'theme_updates');

[157] Fix | Delete

}

[158] Fix | Delete

[159] Fix | Delete

public function __wakeup() {

[160] Fix | Delete

$this->api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());

[161] Fix | Delete

}

[162] Fix | Delete

[163] Fix | Delete

/**

[164] Fix | Delete

* @return bool

[165] Fix | Delete

*/

[166] Fix | Delete

public function needsAnyUpdates() {

[167] Fix | Delete

return $this->needsCoreUpdate() || count($this->getPluginUpdates()) > 0 || count($this->getThemeUpdates()) > 0;

[168] Fix | Delete

}

[169] Fix | Delete

[170] Fix | Delete

/**

[171] Fix | Delete

* Check for any core, plugin or theme updates.

[172] Fix | Delete

*

[173] Fix | Delete

* @return $this

[174] Fix | Delete

*/

[175] Fix | Delete

public function checkAllUpdates($useCachedValued = true) {

[176] Fix | Delete

if (!$useCachedValued) {

[177] Fix | Delete

wfConfig::remove(self::LAST_UPDATE_CHECK_ERROR_KEY);

[178] Fix | Delete

wfConfig::remove(self::LAST_UPDATE_CHECK_ERROR_SLUG_KEY);

[179] Fix | Delete

}

[180] Fix | Delete

[181] Fix | Delete

return $this->checkCoreUpdates($useCachedValued)

[182] Fix | Delete

->checkPluginUpdates($useCachedValued)

[183] Fix | Delete

->checkThemeUpdates($useCachedValued);

[184] Fix | Delete

}

[185] Fix | Delete

[186] Fix | Delete

/**

[187] Fix | Delete

* Check if there is an update to the WordPress core.

[188] Fix | Delete

*

[189] Fix | Delete

* @return $this

[190] Fix | Delete

*/

[191] Fix | Delete

public function checkCoreUpdates($useCachedValued = true) {

[192] Fix | Delete

$this->needs_core_update = false;

[193] Fix | Delete

[194] Fix | Delete

if (!function_exists('wp_version_check')) {

[195] Fix | Delete

require_once(ABSPATH . WPINC . '/update.php');

[196] Fix | Delete

}

[197] Fix | Delete

if (!function_exists('get_preferred_from_update_core')) {

[198] Fix | Delete

require_once(ABSPATH . 'wp-admin/includes/update.php');

[199] Fix | Delete

}

[200] Fix | Delete

[201] Fix | Delete

include(ABSPATH . WPINC . '/version.php'); /** @var $wp_version */

[202] Fix | Delete

[203] Fix | Delete

$availableUpdates = get_site_transient('update_core');

[204] Fix | Delete

/**

[205] Fix | Delete

* Sample Structure:

[206] Fix | Delete

*

[207] Fix | Delete

* class stdClass#1 (4) {

[208] Fix | Delete

public $updates =>

[209] Fix | Delete

array(3) {

[210] Fix | Delete

[0] =>

[211] Fix | Delete

class stdClass#2 (10) {

[212] Fix | Delete

public $response => string(7) "upgrade"

[213] Fix | Delete

public $version => string(5) "6.4.2"

[214] Fix | Delete

...

[215] Fix | Delete

}

[216] Fix | Delete

[1] =>

[217] Fix | Delete

class stdClass#4 (11) {

[218] Fix | Delete

public $response => string(10) "autoupdate"

[219] Fix | Delete

public $version => string(5) "6.4.2"

[220] Fix | Delete

...

[221] Fix | Delete

}

[222] Fix | Delete

[2] =>

[223] Fix | Delete

class stdClass#6 (11) {

[224] Fix | Delete

public $response => string(10) "autoupdate"

[225] Fix | Delete

public $version => string(5) "6.3.2"

[226] Fix | Delete

...

[227] Fix | Delete

}

[228] Fix | Delete

}

[229] Fix | Delete

public $last_checked => int(1703025218)

[230] Fix | Delete

public $version_checked => string(5) "6.3.1"

[231] Fix | Delete

public $translations => ...

[232] Fix | Delete

}

[233] Fix | Delete

[234] Fix | Delete

*/

[235] Fix | Delete

[236] Fix | Delete

if ($useCachedValued &&

[237] Fix | Delete

isset($availableUpdates->updates) && is_array($availableUpdates->updates) &&

[238] Fix | Delete

isset($availableUpdates->last_checked) && 12 * HOUR_IN_SECONDS > (time() - $availableUpdates->last_checked) && $availableUpdates->version_checked == $wp_version) {

[239] Fix | Delete

//Do nothing, use cached value

[240] Fix | Delete

}

[241] Fix | Delete

else {

[242] Fix | Delete

wp_version_check();

[243] Fix | Delete

$availableUpdates = get_site_transient('update_core');

[244] Fix | Delete

}

[245] Fix | Delete

[246] Fix | Delete

if (isset($availableUpdates->updates) && is_array($availableUpdates->updates)) {

[247] Fix | Delete

$current = wfUtils::parse_version($wp_version);

[248] Fix | Delete

$updates = $availableUpdates->updates;

[249] Fix | Delete

foreach ($updates as $update) {

[250] Fix | Delete

if (version_compare($update->version, $wp_version) <= 0) { continue; } //Array will contain the reinstall info for the current version if non-prerelease or the last production version if prerelease, skip

[251] Fix | Delete

[252] Fix | Delete

if (version_compare($update->version, $this->core_update_version) > 0) {

[253] Fix | Delete

$this->needs_core_update = true;

[254] Fix | Delete

$this->core_update_version = $update->version;

[255] Fix | Delete

}

[256] Fix | Delete

[257] Fix | Delete

$checking = wfUtils::parse_version($update->version);

[258] Fix | Delete

if ($checking[wfUtils::VERSION_MAJOR] == $current[wfUtils::VERSION_MAJOR] && $checking[wfUtils::VERSION_MINOR] == $current[wfUtils::VERSION_MINOR] && $checking[wfUtils::VERSION_PATCH] > $current[wfUtils::VERSION_PATCH]) {

[259] Fix | Delete

$this->core_update_patch_available = true;

[260] Fix | Delete

$this->core_update_patch_version = $update->version;

[261] Fix | Delete

}

[262] Fix | Delete

}

[263] Fix | Delete

[264] Fix | Delete

if ($this->needs_core_update && $this->core_update_patch_available && version_compare($this->core_update_version, $this->core_update_patch_version) === 0) { //Patch and edge update are the same, clear patch values

[265] Fix | Delete

$this->core_update_patch_available = false;

[266] Fix | Delete

$this->core_update_patch_version = 0;

[267] Fix | Delete

}

[268] Fix | Delete

[269] Fix | Delete

if ($this->needs_core_update) {

[270] Fix | Delete

$checking = wfUtils::parse_version($this->core_update_version);

[271] Fix | Delete

$this->core_earlier_branch = ($checking[wfUtils::VERSION_MAJOR] > $current[wfUtils::VERSION_MAJOR] || $checking[wfUtils::VERSION_MINOR] > $current[wfUtils::VERSION_MINOR]);

[272] Fix | Delete

}

[273] Fix | Delete

}

[274] Fix | Delete

[275] Fix | Delete

return $this;

[276] Fix | Delete

}

[277] Fix | Delete

[278] Fix | Delete

private function checkPluginFile($plugin, &$installedPlugins) {

[279] Fix | Delete

if (!array_key_exists($plugin, $installedPlugins))

[280] Fix | Delete

return null;

[281] Fix | Delete

$file = wfUtils::getPluginBaseDir() . $plugin;

[282] Fix | Delete

if (!file_exists($file)) {

[283] Fix | Delete

unset($installedPlugins[$plugin]);

[284] Fix | Delete

return null;

[285] Fix | Delete

}

[286] Fix | Delete

return $file;

[287] Fix | Delete

}

[288] Fix | Delete

[289] Fix | Delete

private function initializePluginUpdateData($plugin, &$installedPlugins, $checkVulnerabilities, $populator = null) {

[290] Fix | Delete

$file = $this->checkPluginFile($plugin, $installedPlugins);

[291] Fix | Delete

if ($file === null)

[292] Fix | Delete

return null;

[293] Fix | Delete

$data = $installedPlugins[$plugin];

[294] Fix | Delete

$data['pluginFile'] = $file;

[295] Fix | Delete

if ($populator !== null)

[296] Fix | Delete

$populator($data, $file);

[297] Fix | Delete

if (!array_key_exists('slug', $data) || empty($data['slug']))

[298] Fix | Delete

$data['slug'] = $this->extractSlug($plugin);

[299] Fix | Delete

$slug = $data['slug'];

[300] Fix | Delete

if ($slug !== null) {

[301] Fix | Delete

$vulnerable = $checkVulnerabilities ? $this->isPluginVulnerable($slug, $data['Version']) : null;

[302] Fix | Delete

$data['vulnerable'] = !empty($vulnerable);

[303] Fix | Delete

if ($data['vulnerable']) {

[304] Fix | Delete

if (isset($vulnerable['link']) && is_string($vulnerable['link'])) { $data['vulnerabilityLink'] = $vulnerable['link']; }

[305] Fix | Delete

if (isset($vulnerable['score'])) {

[306] Fix | Delete

$data['cvssScore'] = number_format(floatval($vulnerable['score']), 1);

[307] Fix | Delete

$data['severityColor'] = self::cvssScoreSeverityHexColor($data['cvssScore']);

[308] Fix | Delete

$data['severityLabel'] = self::cvssScoreSeverityLabel($data['cvssScore']);

[309] Fix | Delete

$data['severityClass'] = self::cvssScoreSeverityClass($data['cvssScore']);

[310] Fix | Delete

}

[311] Fix | Delete

if (isset($vulnerable['vector']) && is_string($vulnerable['vector'])) { $data['cvssVector'] = $vulnerable['vector']; }

[312] Fix | Delete

}

[313] Fix | Delete

$this->plugin_slugs[] = $slug;

[314] Fix | Delete

$this->all_plugins[$slug] = $data;

[315] Fix | Delete

}

[316] Fix | Delete

unset($installedPlugins[$plugin]);

[317] Fix | Delete

return $data;

[318] Fix | Delete

}

[319] Fix | Delete

[320] Fix | Delete

public function extractSlug($plugin, $data = null) {

[321] Fix | Delete

$slug = null;

[322] Fix | Delete

if (is_array($data) && array_key_exists('slug', $data))

[323] Fix | Delete

$slug = $data['slug'];

[324] Fix | Delete

if (!is_string($slug) || empty($slug)) {

[325] Fix | Delete

if (preg_match('/^([^\/]+)\//', $plugin, $matches)) {

[326] Fix | Delete

$slug = $matches[1];

[327] Fix | Delete

}

[328] Fix | Delete

else if (preg_match('/^([^\/.]+)\.php$/', $plugin, $matches)) {

[329] Fix | Delete

$slug = $matches[1];

[330] Fix | Delete

}

[331] Fix | Delete

}

[332] Fix | Delete

return $slug;

[333] Fix | Delete

}

[334] Fix | Delete

[335] Fix | Delete

private static function requirePluginsApi() {

[336] Fix | Delete

if (!function_exists('plugins_api'))

[337] Fix | Delete

require_once(ABSPATH . '/wp-admin/includes/plugin-install.php');

[338] Fix | Delete

}

[339] Fix | Delete

[340] Fix | Delete

private function fetchPluginUpdates($useCache = true) {

[341] Fix | Delete

$update_plugins = get_site_transient('update_plugins');

[342] Fix | Delete

if ($useCache && isset($update_plugins->last_checked) && 12 * HOUR_IN_SECONDS > (time() - $update_plugins->last_checked)) //Duplicate of _maybe_update_plugins, which is a private call

[343] Fix | Delete

return $update_plugins;

[344] Fix | Delete

if (!function_exists('wp_update_plugins'))

[345] Fix | Delete

require_once(ABSPATH . WPINC . '/update.php');

[346] Fix | Delete

try {

[347] Fix | Delete

wp_update_plugins();

[348] Fix | Delete

}

[349] Fix | Delete

catch (Exception $e) {

[350] Fix | Delete

wfConfig::set(self::LAST_UPDATE_CHECK_ERROR_KEY, $e->getMessage(), false);

[351] Fix | Delete

wfConfig::remove(self::LAST_UPDATE_CHECK_ERROR_SLUG_KEY);

[352] Fix | Delete

error_log('Caught exception while attempting to refresh plugin update status: ' . $e->getMessage());

[353] Fix | Delete

}

[354] Fix | Delete

catch (Throwable $t) {

[355] Fix | Delete

wfConfig::set(self::LAST_UPDATE_CHECK_ERROR_KEY, $t->getMessage(), false);

[356] Fix | Delete

wfConfig::remove(self::LAST_UPDATE_CHECK_ERROR_SLUG_KEY);

[357] Fix | Delete

error_log('Caught error while attempting to refresh plugin update status: ' . $t->getMessage());

[358] Fix | Delete

}

[359] Fix | Delete

return get_site_transient('update_plugins');

[360] Fix | Delete

}

[361] Fix | Delete

[362] Fix | Delete

/**

[363] Fix | Delete

* Check if any plugins need an update.

[364] Fix | Delete

*

[365] Fix | Delete

* @param bool $checkVulnerabilities whether or not to check for vulnerabilities while checking updates

[366] Fix | Delete

*

[367] Fix | Delete

* @return $this

[368] Fix | Delete

*/

[369] Fix | Delete

public function checkPluginUpdates($useCachedValued = true, $checkVulnerabilities = true) {

[370] Fix | Delete

if($checkVulnerabilities)

[371] Fix | Delete

$this->plugin_updates = array();

[372] Fix | Delete

[373] Fix | Delete

self::requirePluginsApi();

[374] Fix | Delete

[375] Fix | Delete

$update_plugins = $this->fetchPluginUpdates($useCachedValued);

[376] Fix | Delete

[377] Fix | Delete

//Get the full plugin list

[378] Fix | Delete

if (!function_exists('get_plugins')) {

[379] Fix | Delete

require_once(ABSPATH . '/wp-admin/includes/plugin.php');

[380] Fix | Delete

}

[381] Fix | Delete

$installedPlugins = get_plugins();

[382] Fix | Delete

[383] Fix | Delete

$context = $this;

[384] Fix | Delete

[385] Fix | Delete

if ($update_plugins && !empty($update_plugins->response)) {

[386] Fix | Delete

foreach ($update_plugins->response as $plugin => $vals) {

[387] Fix | Delete

$data = $this->initializePluginUpdateData($plugin, $installedPlugins, $checkVulnerabilities, function (&$data, $file) use ($context, $plugin, $vals) {

[388] Fix | Delete

$vals = (array) $vals;

[389] Fix | Delete

$data['slug'] = $context->extractSlug($plugin, $vals);

[390] Fix | Delete

$data['newVersion'] = (isset($vals['new_version']) ? $vals['new_version'] : 'Unknown');

[391] Fix | Delete

$data['wpURL'] = (isset($vals['url']) ? rtrim($vals['url'], '/') : null);

[392] Fix | Delete

$data['updateAvailable'] = true;

[393] Fix | Delete

});

[394] Fix | Delete

[395] Fix | Delete

if($checkVulnerabilities && $data !== null)

[396] Fix | Delete

$this->plugin_updates[] = $data;

[397] Fix | Delete

}

[398] Fix | Delete

}

[399] Fix | Delete

[400] Fix | Delete

//We have to grab the slugs from the update response because no built-in function exists to return the true slug from the local files

[401] Fix | Delete

if ($update_plugins && !empty($update_plugins->no_update)) {

[402] Fix | Delete

foreach ($update_plugins->no_update as $plugin => $vals) {

[403] Fix | Delete

$this->initializePluginUpdateData($plugin, $installedPlugins, $checkVulnerabilities, function (&$data, $file) use ($context, $plugin, $vals) {

[404] Fix | Delete

$vals = (array) $vals;

[405] Fix | Delete

$data['slug'] = $context->extractSlug($plugin, $vals);

[406] Fix | Delete

$data['wpURL'] = (isset($vals['url']) ? rtrim($vals['url'], '/') : null);

[407] Fix | Delete

});

[408] Fix | Delete

}

[409] Fix | Delete

}

[410] Fix | Delete

[411] Fix | Delete

//Get the remaining plugins (not in the wordpress.org repo for whatever reason)

[412] Fix | Delete

foreach ($installedPlugins as $plugin => $data) {

[413] Fix | Delete

$data = $this->initializePluginUpdateData($plugin, $installedPlugins, $checkVulnerabilities);

[414] Fix | Delete

}

[415] Fix | Delete

[416] Fix | Delete

return $this;

[417] Fix | Delete

}

[418] Fix | Delete

[419] Fix | Delete

/**

[420] Fix | Delete

* Check if any themes need an update.

[421] Fix | Delete

*

[422] Fix | Delete

* @param bool $checkVulnerabilities whether or not to check for vulnerabilities while checking for updates

[423] Fix | Delete

*

[424] Fix | Delete

* @return $this

[425] Fix | Delete

*/

[426] Fix | Delete

public function checkThemeUpdates($useCachedValued = true, $checkVulnerabilities = true) {

[427] Fix | Delete

if($checkVulnerabilities)

[428] Fix | Delete

$this->theme_updates = array();

[429] Fix | Delete

[430] Fix | Delete

if (!function_exists('wp_update_themes')) {

[431] Fix | Delete

require_once(ABSPATH . WPINC . '/update.php');

[432] Fix | Delete

}

[433] Fix | Delete

[434] Fix | Delete

$update_themes = get_site_transient('update_themes');

[435] Fix | Delete

if ($useCachedValued && isset($update_themes->last_checked) && 12 * HOUR_IN_SECONDS > (time() - $update_themes->last_checked)) { //Duplicate of _maybe_update_themes, which is a private call

[436] Fix | Delete

//Do nothing, use cached value

[437] Fix | Delete

}

[438] Fix | Delete

else {

[439] Fix | Delete

try {

[440] Fix | Delete

wp_update_themes();

[441] Fix | Delete

}

[442] Fix | Delete

catch (Exception $e) {

[443] Fix | Delete

wfConfig::set(self::LAST_UPDATE_CHECK_ERROR_KEY, $e->getMessage(), false);

[444] Fix | Delete

error_log('Caught exception while attempting to refresh theme update status: ' . $e->getMessage());

[445] Fix | Delete

}

[446] Fix | Delete

catch (Throwable $t) {

[447] Fix | Delete

wfConfig::set(self::LAST_UPDATE_CHECK_ERROR_KEY, $t->getMessage(), false);

[448] Fix | Delete

error_log('Caught error while attempting to refresh theme update status: ' . $t->getMessage());

[449] Fix | Delete

}

[450] Fix | Delete

[451] Fix | Delete

$update_themes = get_site_transient('update_themes');

[452] Fix | Delete

}

[453] Fix | Delete

[454] Fix | Delete

if ($update_themes && (!empty($update_themes->response)) && $checkVulnerabilities) {

[455] Fix | Delete

if (!function_exists('wp_get_themes')) {

[456] Fix | Delete

require_once(ABSPATH . '/wp-includes/theme.php');

[457] Fix | Delete

}

[458] Fix | Delete

$themes = wp_get_themes();

[459] Fix | Delete

foreach ($update_themes->response as $theme => $vals) {

[460] Fix | Delete

foreach ($themes as $name => $themeData) {

[461] Fix | Delete

if (strtolower($name) == $theme) {

[462] Fix | Delete

$vulnerable = false;

[463] Fix | Delete

if (isset($themeData['Version'])) {

[464] Fix | Delete

$vulnerable = $this->isThemeVulnerable($theme, $themeData['Version']);

[465] Fix | Delete

}

[466] Fix | Delete

[467] Fix | Delete

$data = array(

[468] Fix | Delete

'newVersion' => (isset($vals['new_version']) ? $vals['new_version'] : 'Unknown'),

[469] Fix | Delete

'package' => (isset($vals['package']) ? $vals['package'] : null),

[470] Fix | Delete

'URL' => (isset($vals['url']) ? $vals['url'] : null),

[471] Fix | Delete

'Name' => $themeData['Name'],

[472] Fix | Delete

'name' => $themeData['Name'],

[473] Fix | Delete

'version' => $themeData['Version'],

[474] Fix | Delete

'vulnerable' => $vulnerable

[475] Fix | Delete

);

[476] Fix | Delete

[477] Fix | Delete

$data['vulnerable'] = !empty($vulnerable);

[478] Fix | Delete

if ($data['vulnerable']) {

[479] Fix | Delete

if (isset($vulnerable['link']) && is_string($vulnerable['link'])) { $data['vulnerabilityLink'] = $vulnerable['link']; }

[480] Fix | Delete

if (isset($vulnerable['score'])) {

[481] Fix | Delete

$data['cvssScore'] = number_format(floatval($vulnerable['score']), 1);

[482] Fix | Delete

$data['severityColor'] = self::cvssScoreSeverityHexColor($data['cvssScore']);

[483] Fix | Delete

$data['severityLabel'] = self::cvssScoreSeverityLabel($data['cvssScore']);

[484] Fix | Delete

$data['severityClass'] = self::cvssScoreSeverityClass($data['cvssScore']);

[485] Fix | Delete

}

[486] Fix | Delete

if (isset($vulnerable['vector']) && is_string($vulnerable['vector'])) { $data['cvssVector'] = $vulnerable['vector']; }

[487] Fix | Delete

}

[488] Fix | Delete

[489] Fix | Delete

$this->theme_updates[] = $data;

[490] Fix | Delete

}

[491] Fix | Delete

}

[492] Fix | Delete

}

[493] Fix | Delete

}

[494] Fix | Delete

return $this;

[495] Fix | Delete

}

[496] Fix | Delete

[497] Fix | Delete

/**

[498] Fix | Delete

* @param bool $initial if true, treat as the initial scan run

[499] Fix | Delete