[8000] Fix | Delete

if (!empty($_REQUEST['endDate'])) {

[8001] Fix | Delete

$query->setEndDate(is_numeric($_REQUEST['endDate']) ? $_REQUEST['endDate'] : strtotime($_REQUEST['endDate']));

[8002] Fix | Delete

}

[8003] Fix | Delete

[8004] Fix | Delete

if (

[8005] Fix | Delete

array_key_exists('param', $_REQUEST) && is_array($_REQUEST['param']) &&

[8006] Fix | Delete

array_key_exists('operator', $_REQUEST) && is_array($_REQUEST['operator']) &&

[8007] Fix | Delete

array_key_exists('value', $_REQUEST) && is_array($_REQUEST['value'])

[8008] Fix | Delete

) {

[8009] Fix | Delete

for ($i = 0; $i < count($_REQUEST['param']); $i++) {

[8010] Fix | Delete

if (

[8011] Fix | Delete

array_key_exists($i, $_REQUEST['param']) &&

[8012] Fix | Delete

array_key_exists($i, $_REQUEST['operator']) &&

[8013] Fix | Delete

array_key_exists($i, $_REQUEST['value'])

[8014] Fix | Delete

) {

[8015] Fix | Delete

$param = $_REQUEST['param'][$i];

[8016] Fix | Delete

$operator = $_REQUEST['operator'][$i];

[8017] Fix | Delete

$value = $_REQUEST['value'][$i];

[8018] Fix | Delete

[8019] Fix | Delete

switch (strtolower($param)) {

[8020] Fix | Delete

case 'type':

[8021] Fix | Delete

$param = 'jsRun';

[8022] Fix | Delete

$value = strtolower($value) === 'human' ? 1 : 0;

[8023] Fix | Delete

break;

[8024] Fix | Delete

case 'ip':

[8025] Fix | Delete

$ip = $value;

[8026] Fix | Delete

[8027] Fix | Delete

if (strpos($ip, '*') !== false) { //If the IP contains a *, treat it as a wildcard for that segment and silently adjust the rule

[8028] Fix | Delete

if (preg_match('/^(?:(?:\d{1,3}|\*)(?:\.|$)){2,4}/', $ip)) { //IPv4

[8029] Fix | Delete

$value = array('00', '00', '00', '00', '00', '00', '00', '00', '00', '00', 'FF', 'FF');

[8030] Fix | Delete

$octets = explode('.', $ip);

[8031] Fix | Delete

foreach ($octets as $o)

[8032] Fix | Delete

{

[8033] Fix | Delete

if (strpos($o, '*') !== false) {

[8034] Fix | Delete

$value[] = '..';

[8035] Fix | Delete

}

[8036] Fix | Delete

else {

[8037] Fix | Delete

$value[] = strtoupper(str_pad(dechex($o), 2, '0', STR_PAD_LEFT));

[8038] Fix | Delete

}

[8039] Fix | Delete

}

[8040] Fix | Delete

$value = '^' . implode('', array_pad($value, 16, '..')) . '$';

[8041] Fix | Delete

$operator = ($operator == '!=' ? 'hnotregexp' : 'hregexp');

[8042] Fix | Delete

}

[8043] Fix | Delete

else if (!empty($ip) && preg_match('/^((?:[\da-f*]{1,4}(?::|)){0,8})(::)?((?:[\da-f*]{1,4}(?::|)){0,8})$/i', $ip)) { //IPv6

[8044] Fix | Delete

if ($ip === '::') {

[8045] Fix | Delete

$value = '^' . str_repeat('00', 16) . '$';

[8046] Fix | Delete

}

[8047] Fix | Delete

else {

[8048] Fix | Delete

$colon_count = substr_count($ip, ':');

[8049] Fix | Delete

$dbl_colon_pos = strpos($ip, '::');

[8050] Fix | Delete

if ($dbl_colon_pos !== false) {

[8051] Fix | Delete

$ip = str_replace('::', str_repeat(':0000', (($dbl_colon_pos === 0 || $dbl_colon_pos === strlen($ip) - 2) ? 9 : 8) - $colon_count) . ':', $ip);

[8052] Fix | Delete

$ip = trim($ip, ':');

[8053] Fix | Delete

}

[8054] Fix | Delete

[8055] Fix | Delete

$ip_groups = explode(':', $ip);

[8056] Fix | Delete

$value = array();

[8057] Fix | Delete

foreach ($ip_groups as $ip_group) {

[8058] Fix | Delete

if (strpos($ip_group, '*') !== false) {

[8059] Fix | Delete

$value[] = '..';

[8060] Fix | Delete

$value[] = '..';

[8061] Fix | Delete

}

[8062] Fix | Delete

else {

[8063] Fix | Delete

$ip_group = strtoupper(str_pad($ip_group, 4, '0', STR_PAD_LEFT));

[8064] Fix | Delete

$value[] = substr($ip_group, 0, 2);

[8065] Fix | Delete

$value[] = substr($ip_group, -2);

[8066] Fix | Delete

}

[8067] Fix | Delete

}

[8068] Fix | Delete

[8069] Fix | Delete

$value = '^' . implode('', array_pad($value, 16, '..')) . '$';

[8070] Fix | Delete

}

[8071] Fix | Delete

$operator = ($operator == '=' ? 'hregexp' : 'hnotregexp');

[8072] Fix | Delete

}

[8073] Fix | Delete

else if (preg_match('/^((?:0{1,4}(?::|)){0,5})(::)?ffff:((?:\d{1,3}(?:\.|$)){4})$/i', $ip, $matches)) { //IPv4 mapped IPv6

[8074] Fix | Delete

$value = array('00', '00', '00', '00', '00', '00', '00', '00', '00', '00', 'FF', 'FF');

[8075] Fix | Delete

$octets = explode('.', $matches[3]);

[8076] Fix | Delete

foreach ($octets as $o)

[8077] Fix | Delete

{

[8078] Fix | Delete

if (strpos($o, '*') !== false) {

[8079] Fix | Delete

$value[] = '..';

[8080] Fix | Delete

}

[8081] Fix | Delete

else {

[8082] Fix | Delete

$value[] = strtoupper(str_pad(dechex($o), 2, '0', STR_PAD_LEFT));

[8083] Fix | Delete

}

[8084] Fix | Delete

}

[8085] Fix | Delete

$value = '^' . implode('', array_pad($value, 16, '.')) . '$';

[8086] Fix | Delete

$operator = ($operator == '=' ? 'hregexp' : 'hnotregexp');

[8087] Fix | Delete

}

[8088] Fix | Delete

else {

[8089] Fix | Delete

$value = false;

[8090] Fix | Delete

}

[8091] Fix | Delete

}

[8092] Fix | Delete

else {

[8093] Fix | Delete

$value = wfUtils::inet_pton($ip);

[8094] Fix | Delete

}

[8095] Fix | Delete

break;

[8096] Fix | Delete

case 'userid':

[8097] Fix | Delete

$value = absint($value);

[8098] Fix | Delete

break;

[8099] Fix | Delete

}

[8100] Fix | Delete

if ($operator === 'match' && $param !== 'ip') {

[8101] Fix | Delete

$value = str_replace('*', '%', $value);

[8102] Fix | Delete

}

[8103] Fix | Delete

$filters->addFilter(new wfLiveTrafficQueryFilter($query, $param, $operator, $value));

[8104] Fix | Delete

}

[8105] Fix | Delete

}

[8106] Fix | Delete

}

[8107] Fix | Delete

[8108] Fix | Delete

try {

[8109] Fix | Delete

$return['data'] = $query->execute();

[8110] Fix | Delete

/*if (defined('WP_DEBUG') && WP_DEBUG) {

[8111] Fix | Delete

$return['sql'] = $query->buildQuery();

[8112] Fix | Delete

}*/

[8113] Fix | Delete

} catch (wfLiveTrafficQueryException $e) {

[8114] Fix | Delete

$return['data'] = array();

[8115] Fix | Delete

$return['sql'] = $e->getMessage();

[8116] Fix | Delete

}

[8117] Fix | Delete

[8118] Fix | Delete

$return['success'] = true;

[8119] Fix | Delete

[8120] Fix | Delete

return $return;

[8121] Fix | Delete

}

[8122] Fix | Delete

[8123] Fix | Delete

public static function ajax_whitelistWAFParamKey_callback() {

[8124] Fix | Delete

if (class_exists('wfWAF') && $waf = wfWAF::getInstance()) {

[8125] Fix | Delete

if (isset($_POST['path']) && isset($_POST['paramKey']) && isset($_POST['failedRules'])) {

[8126] Fix | Delete

$data = array(

[8127] Fix | Delete

'timestamp' => time(),

[8128] Fix | Delete

'description' => __('Allowlisted via Live Traffic', 'wordfence'),

[8129] Fix | Delete

'source' => 'live-traffic',

[8130] Fix | Delete

'ip' => wfUtils::getIP(),

[8131] Fix | Delete

);

[8132] Fix | Delete

if (function_exists('get_current_user_id')) {

[8133] Fix | Delete

$data['userID'] = get_current_user_id();

[8134] Fix | Delete

}

[8135] Fix | Delete

$waf->whitelistRuleForParam(base64_decode($_POST['path']), base64_decode($_POST['paramKey']),

[8136] Fix | Delete

$_POST['failedRules'], $data);

[8137] Fix | Delete

[8138] Fix | Delete

return array(

[8139] Fix | Delete

'success' => true,

[8140] Fix | Delete

);

[8141] Fix | Delete

}

[8142] Fix | Delete

}

[8143] Fix | Delete

return false;

[8144] Fix | Delete

}

[8145] Fix | Delete

[8146] Fix | Delete

public static function ajax_whitelistBulkDelete_callback() {

[8147] Fix | Delete

if (class_exists('wfWAF') && $waf = wfWAF::getInstance()) {

[8148] Fix | Delete

if (!empty($_POST['items']) && ($items = json_decode(stripslashes($_POST['items']), true)) !== false) {

[8149] Fix | Delete

$whitelist = (array) $waf->getStorageEngine()->getConfig('whitelistedURLParams', null, 'livewaf');

[8150] Fix | Delete

if (!is_array($whitelist)) {

[8151] Fix | Delete

$whitelist = array();

[8152] Fix | Delete

}

[8153] Fix | Delete

foreach ($items as $key) {

[8154] Fix | Delete

list($path, $paramKey, ) = $key;

[8155] Fix | Delete

$whitelistKey = $path . '|' . $paramKey;

[8156] Fix | Delete

if (array_key_exists($whitelistKey, $whitelist)) {

[8157] Fix | Delete

unset($whitelist[$whitelistKey]);

[8158] Fix | Delete

}

[8159] Fix | Delete

}

[8160] Fix | Delete

$waf->getStorageEngine()->setConfig('whitelistedURLParams', $whitelist, 'livewaf');

[8161] Fix | Delete

return array(

[8162] Fix | Delete

'data' => self::_getWAFData(),

[8163] Fix | Delete

'success' => true,

[8164] Fix | Delete

);

[8165] Fix | Delete

}

[8166] Fix | Delete

}

[8167] Fix | Delete

return false;

[8168] Fix | Delete

}

[8169] Fix | Delete

[8170] Fix | Delete

public static function ajax_whitelistBulkEnable_callback() {

[8171] Fix | Delete

if (class_exists('wfWAF') && $waf = wfWAF::getInstance()) {

[8172] Fix | Delete

if (!empty($_POST['items']) && ($items = json_decode(stripslashes($_POST['items']), true)) !== false) {

[8173] Fix | Delete

self::_whitelistBulkToggle($items, true);

[8174] Fix | Delete

return array(

[8175] Fix | Delete

'data' => self::_getWAFData(),

[8176] Fix | Delete

'success' => true,

[8177] Fix | Delete

);

[8178] Fix | Delete

}

[8179] Fix | Delete

}

[8180] Fix | Delete

return false;

[8181] Fix | Delete

}

[8182] Fix | Delete

[8183] Fix | Delete

public static function ajax_whitelistBulkDisable_callback() {

[8184] Fix | Delete

if (class_exists('wfWAF') && $waf = wfWAF::getInstance()) {

[8185] Fix | Delete

if (!empty($_POST['items']) && ($items = json_decode(stripslashes($_POST['items']), true)) !== false) {

[8186] Fix | Delete

self::_whitelistBulkToggle($items, false);

[8187] Fix | Delete

return array(

[8188] Fix | Delete

'data' => self::_getWAFData(),

[8189] Fix | Delete

'success' => true,

[8190] Fix | Delete

);

[8191] Fix | Delete

}

[8192] Fix | Delete

}

[8193] Fix | Delete

return false;

[8194] Fix | Delete

}

[8195] Fix | Delete

[8196] Fix | Delete

private static function _whitelistBulkToggle($items, $enabled) {

[8197] Fix | Delete

$waf = wfWAF::getInstance();

[8198] Fix | Delete

$whitelist = (array) $waf->getStorageEngine()->getConfig('whitelistedURLParams', null, 'livewaf');

[8199] Fix | Delete

if (!is_array($whitelist)) {

[8200] Fix | Delete

$whitelist = array();

[8201] Fix | Delete

}

[8202] Fix | Delete

foreach ($items as $key) {

[8203] Fix | Delete

list($path, $paramKey, ) = $key;

[8204] Fix | Delete

$whitelistKey = $path . '|' . $paramKey;

[8205] Fix | Delete

if (array_key_exists($whitelistKey, $whitelist) && is_array($whitelist[$whitelistKey])) {

[8206] Fix | Delete

foreach ($whitelist[$whitelistKey] as $ruleID => $data) {

[8207] Fix | Delete

$whitelist[$whitelistKey][$ruleID]['disabled'] = !$enabled;

[8208] Fix | Delete

}

[8209] Fix | Delete

}

[8210] Fix | Delete

}

[8211] Fix | Delete

$waf->getStorageEngine()->setConfig('whitelistedURLParams', $whitelist, 'livewaf');

[8212] Fix | Delete

}

[8213] Fix | Delete

[8214] Fix | Delete

private static function _getWAFData($updated = null, $failureReason = false) {

[8215] Fix | Delete

$data['learningMode'] = wfWAF::getInstance()->isInLearningMode();

[8216] Fix | Delete

$data['rules'] = wfWAF::getInstance()->getRules();

[8217] Fix | Delete

/** @var wfWAFRule $rule */

[8218] Fix | Delete

foreach ($data['rules'] as $ruleID => $rule) {

[8219] Fix | Delete

$data['rules'][$ruleID] = $rule->toArray();

[8220] Fix | Delete

}

[8221] Fix | Delete

[8222] Fix | Delete

$whitelistedURLParams = (array) wfWAF::getInstance()->getStorageEngine()->getConfig('whitelistedURLParams', array(), 'livewaf');

[8223] Fix | Delete

$data['whitelistedURLParams'] = array();

[8224] Fix | Delete

if (is_array($whitelistedURLParams)) {

[8225] Fix | Delete

foreach ($whitelistedURLParams as $urlParamKey => $rules) {

[8226] Fix | Delete

list($path, $paramKey) = explode('|', $urlParamKey);

[8227] Fix | Delete

$whitelistData = null;

[8228] Fix | Delete

foreach ($rules as $ruleID => $whitelistedData) {

[8229] Fix | Delete

if ($whitelistData === null) {

[8230] Fix | Delete

$whitelistData = $whitelistedData;

[8231] Fix | Delete

continue;

[8232] Fix | Delete

}

[8233] Fix | Delete

if ($ruleID === 'all') {

[8234] Fix | Delete

$whitelistData = $whitelistedData;

[8235] Fix | Delete

break;

[8236] Fix | Delete

}

[8237] Fix | Delete

}

[8238] Fix | Delete

[8239] Fix | Delete

if (is_array($whitelistData) && array_key_exists('userID', $whitelistData) && function_exists('get_user_by')) {

[8240] Fix | Delete

$user = get_user_by('id', $whitelistData['userID']);

[8241] Fix | Delete

if ($user) {

[8242] Fix | Delete

$whitelistData['username'] = $user->user_login;

[8243] Fix | Delete

}

[8244] Fix | Delete

}

[8245] Fix | Delete

[8246] Fix | Delete

$data['whitelistedURLParams'][] = array(

[8247] Fix | Delete

'path' => $path,

[8248] Fix | Delete

'paramKey' => $paramKey,

[8249] Fix | Delete

'ruleID' => array_keys($rules),

[8250] Fix | Delete

'data' => $whitelistData,

[8251] Fix | Delete

);

[8252] Fix | Delete

}

[8253] Fix | Delete

}

[8254] Fix | Delete

[8255] Fix | Delete

$data['disabledRules'] = (array) wfWAF::getInstance()->getStorageEngine()->getConfig('disabledRules');

[8256] Fix | Delete

if ($lastUpdated = wfWAF::getInstance()->getStorageEngine()->getConfig('rulesLastUpdated', null, 'transient')) {

[8257] Fix | Delete

$data['rulesLastUpdated'] = $lastUpdated;

[8258] Fix | Delete

}

[8259] Fix | Delete

$data['isPaid'] = (bool) wfConfig::get('isPaid', 0);

[8260] Fix | Delete

if ($updated !== null) {

[8261] Fix | Delete

$data['updated'] = (bool) $updated;

[8262] Fix | Delete

if (!$updated) {

[8263] Fix | Delete

$data['failure'] = $failureReason;

[8264] Fix | Delete

}

[8265] Fix | Delete

}

[8266] Fix | Delete

return $data;

[8267] Fix | Delete

}

[8268] Fix | Delete

[8269] Fix | Delete

public static function ajax_wafStatus_callback() {

[8270] Fix | Delete

if (!empty($_REQUEST['nonce']) && hash_equals($_REQUEST['nonce'], wfConfig::get('wafStatusCallbackNonce', ''))) {

[8271] Fix | Delete

wfConfig::set('wafStatusCallbackNonce', '');

[8272] Fix | Delete

wfUtils::send_json(array('active' => WFWAF_AUTO_PREPEND, 'subdirectory' => WFWAF_SUBDIRECTORY_INSTALL));

[8273] Fix | Delete

}

[8274] Fix | Delete

wfUtils::send_json(false);

[8275] Fix | Delete

}

[8276] Fix | Delete

[8277] Fix | Delete

public static function ajax_installAutoPrepend_callback() {

[8278] Fix | Delete

global $wp_filesystem;

[8279] Fix | Delete

[8280] Fix | Delete

$currentAutoPrependFile = ini_get('auto_prepend_file');

[8281] Fix | Delete

$currentAutoPrepend = null;

[8282] Fix | Delete

if (isset($_POST['currentAutoPrepend']) && !WF_IS_WP_ENGINE && !WF_IS_PRESSABLE && !WF_IS_FLYWHEEL) {

[8283] Fix | Delete

$currentAutoPrepend = $_POST['currentAutoPrepend'];

[8284] Fix | Delete

}

[8285] Fix | Delete

[8286] Fix | Delete

$serverConfiguration = null;

[8287] Fix | Delete

if (isset($_POST['serverConfiguration']) && wfWAFAutoPrependHelper::isValidServerConfig($_POST['serverConfiguration'])) {

[8288] Fix | Delete

$serverConfiguration = $_POST['serverConfiguration'];

[8289] Fix | Delete

}

[8290] Fix | Delete

[8291] Fix | Delete

if ($serverConfiguration === null) {

[8292] Fix | Delete

return array('errorMsg' => __('A valid server configuration was not provided.', 'wordfence'));

[8293] Fix | Delete

}

[8294] Fix | Delete

[8295] Fix | Delete

$helper = new wfWAFAutoPrependHelper($serverConfiguration, $currentAutoPrepend === 'override' ? null : $currentAutoPrependFile);

[8296] Fix | Delete

[8297] Fix | Delete

ob_start();

[8298] Fix | Delete

$ajaxURL = admin_url('admin-ajax.php');

[8299] Fix | Delete

$allow_relaxed_file_ownership = true;

[8300] Fix | Delete

if (false === ($credentials = request_filesystem_credentials($ajaxURL, '', false, ABSPATH, array('version', 'locale', 'action', 'serverConfiguration', 'currentAutoPrepend'), $allow_relaxed_file_ownership))) {

[8301] Fix | Delete

$credentialsContent = ob_get_clean();

[8302] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8303] Fix | Delete

'title' => __('Filesystem Credentials Required', 'wordfence'),

[8304] Fix | Delete

'html' => $credentialsContent,

[8305] Fix | Delete

'helpHTML' => wp_kses(sprintf(/* translators: Support URL. */ __('If you cannot complete the setup process, <a target="_blank" rel="noopener noreferrer" href="%s">click here for help<span class="screen-reader-text"> (opens in new tab)</span></a>', 'wordfence'), wfSupportController::esc_supportURL(wfSupportController::ITEM_FIREWALL_WAF_INSTALL_MANUALLY)), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()), 'span' => array('class' => array()))),

[8306] Fix | Delete

'footerHTML' => esc_html__('Once you have entered credentials, click Continue to complete the setup.', 'wordfence'),

[8307] Fix | Delete

))->render();

[8308] Fix | Delete

return array('needsCredentials' => 1, 'html' => $html);

[8309] Fix | Delete

}

[8310] Fix | Delete

ob_end_clean();

[8311] Fix | Delete

[8312] Fix | Delete

if (!WP_Filesystem($credentials, ABSPATH, $allow_relaxed_file_ownership) && $wp_filesystem->errors->get_error_code()) {

[8313] Fix | Delete

$credentialsError = '';

[8314] Fix | Delete

foreach ($wp_filesystem->errors->get_error_messages() as $message) {

[8315] Fix | Delete

if (is_wp_error($message)) {

[8316] Fix | Delete

if ($message->get_error_data() && is_string($message->get_error_data())) {

[8317] Fix | Delete

$message = $message->get_error_message() . ': ' . $message->get_error_data();

[8318] Fix | Delete

}

[8319] Fix | Delete

else {

[8320] Fix | Delete

$message = $message->get_error_message();

[8321] Fix | Delete

}

[8322] Fix | Delete

}

[8323] Fix | Delete

$credentialsError .= "<p>$message</p>\n";

[8324] Fix | Delete

}

[8325] Fix | Delete

[8326] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8327] Fix | Delete

'title' => __('Filesystem Permission Error', 'wordfence'),

[8328] Fix | Delete

'html' => $credentialsError,

[8329] Fix | Delete

'helpHTML' => wp_kses(sprintf(/* translators: Support URL. */ __('If you cannot complete the setup process, <a target="_blank" rel="noopener noreferrer" href="%s">click here for help<span class="screen-reader-text"> (opens in new tab)</span></a>', 'wordfence'), wfSupportController::esc_supportURL(wfSupportController::ITEM_FIREWALL_WAF_INSTALL_MANUALLY)), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()), 'span' => array('class' => array()))),

[8330] Fix | Delete

'footerButtonTitle' => __('Cancel', 'wordfence'),

[8331] Fix | Delete

))->render();

[8332] Fix | Delete

return array('credentialsFailed' => 1, 'html' => $html);

[8333] Fix | Delete

}

[8334] Fix | Delete

[8335] Fix | Delete

try {

[8336] Fix | Delete

$helper->performInstallation($wp_filesystem);

[8337] Fix | Delete

[8338] Fix | Delete

$nonce = bin2hex(wfWAFUtils::random_bytes(32));

[8339] Fix | Delete

wfConfig::set('wafStatusCallbackNonce', $nonce);

[8340] Fix | Delete

$verifyURL = add_query_arg(array('action' => 'wordfence_wafStatus', 'nonce' => $nonce), $ajaxURL);

[8341] Fix | Delete

$response = wp_remote_get($verifyURL, array('headers' => array('Referer' => false/*, 'Cookie' => 'XDEBUG_SESSION=1'*/)));

[8342] Fix | Delete

[8343] Fix | Delete

$active = false;

[8344] Fix | Delete

if (!is_wp_error($response)) {

[8345] Fix | Delete

$wafStatus = @json_decode(wp_remote_retrieve_body($response), true);

[8346] Fix | Delete

if (isset($wafStatus['active']) && isset($wafStatus['subdirectory'])) {

[8347] Fix | Delete

$active = $wafStatus['active'] && !$wafStatus['subdirectory'];

[8348] Fix | Delete

}

[8349] Fix | Delete

}

[8350] Fix | Delete

[8351] Fix | Delete

if ($serverConfiguration == 'manual') {

[8352] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8353] Fix | Delete

'title' => __('Manual Installation Instructions', 'wordfence'),

[8354] Fix | Delete

'html' => wfView::create('waf/waf-install-manual')->render(),

[8355] Fix | Delete

'footerButtonTitle' => __('Close', 'wordfence'),

[8356] Fix | Delete

))->render();

[8357] Fix | Delete

}

[8358] Fix | Delete

else {

[8359] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8360] Fix | Delete

'title' => __('Installation Successful', 'wordfence'),

[8361] Fix | Delete

'html' => wfView::create('waf/waf-install-success', array('active' => $active))->render(),

[8362] Fix | Delete

'footerButtonTitle' => __('Close', 'wordfence'),

[8363] Fix | Delete

))->render();

[8364] Fix | Delete

}

[8365] Fix | Delete

[8366] Fix | Delete

return array('ok' => 1, 'html' => $html);

[8367] Fix | Delete

}

[8368] Fix | Delete

catch (wfWAFAutoPrependHelperException $e) {

[8369] Fix | Delete

$installError = "<p>" . $e->getMessage() . "</p>";

[8370] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8371] Fix | Delete

'title' => __('Installation Failed', 'wordfence'),

[8372] Fix | Delete

'html' => $installError,

[8373] Fix | Delete

'helpHTML' => wp_kses(sprintf(/* translators: Support URL. */ __('If you cannot complete the setup process, <a target="_blank" rel="noopener noreferrer" href="%s">click here for help<span class="screen-reader-text"> (opens in new tab)</span></a>', 'wordfence'), wfSupportController::esc_supportURL(wfSupportController::ITEM_FIREWALL_WAF_INSTALL_MANUALLY)), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()), 'span' => array('class' => array()))),

[8374] Fix | Delete

'footerButtonTitle' => __('Cancel', 'wordfence'),

[8375] Fix | Delete

))->render();

[8376] Fix | Delete

return array('installationFailed' => 1, 'html' => $html);

[8377] Fix | Delete

}

[8378] Fix | Delete

}

[8379] Fix | Delete

[8380] Fix | Delete

public static function ajax_uninstallAutoPrepend_callback() {

[8381] Fix | Delete

global $wp_filesystem;

[8382] Fix | Delete

[8383] Fix | Delete

$serverConfiguration = null;

[8384] Fix | Delete

if (isset($_POST['serverConfiguration']) && wfWAFAutoPrependHelper::isValidServerConfig($_POST['serverConfiguration'])) {

[8385] Fix | Delete

$serverConfiguration = $_POST['serverConfiguration'];

[8386] Fix | Delete

}

[8387] Fix | Delete

[8388] Fix | Delete

if ($serverConfiguration === null) {

[8389] Fix | Delete

return array('errorMsg' => __('A valid server configuration was not provided.', 'wordfence'));

[8390] Fix | Delete

}

[8391] Fix | Delete

[8392] Fix | Delete

$helper = new wfWAFAutoPrependHelper($serverConfiguration, null);

[8393] Fix | Delete

[8394] Fix | Delete

if (isset($_POST['credentials']) && isset($_POST['credentialsSignature'])) {

[8395] Fix | Delete

$salt = wp_salt('logged_in');

[8396] Fix | Delete

$expectedSignature = hash_hmac('sha256', $_POST['credentials'], $salt);

[8397] Fix | Delete

if (hash_equals($expectedSignature, $_POST['credentialsSignature'])) {

[8398] Fix | Delete

$decrypted = wfUtils::decrypt($_POST['credentials']);

[8399] Fix | Delete

$credentials = @json_decode($decrypted, true);

[8400] Fix | Delete

}

[8401] Fix | Delete

}

[8402] Fix | Delete

[8403] Fix | Delete

$ajaxURL = admin_url('admin-ajax.php');

[8404] Fix | Delete

if (!isset($credentials)) {

[8405] Fix | Delete

$allow_relaxed_file_ownership = true;

[8406] Fix | Delete

ob_start();

[8407] Fix | Delete

if (false === ($credentials = request_filesystem_credentials($ajaxURL, '', false, ABSPATH, array('version', 'locale', 'action', 'serverConfiguration', 'iniModified'), $allow_relaxed_file_ownership))) {

[8408] Fix | Delete

$credentialsContent = ob_get_clean();

[8409] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8410] Fix | Delete

'title' => __('Filesystem Credentials Required', 'wordfence'),

[8411] Fix | Delete

'html' => $credentialsContent,

[8412] Fix | Delete

'helpHTML' => wp_kses(sprintf(/* translators: Support URL. */ __('If you cannot complete the uninstall process, <a target="_blank" rel="noopener noreferrer" href="%s">click here for help<span class="screen-reader-text"> (opens in new tab)</span></a>', 'wordfence'), wfSupportController::esc_supportURL(wfSupportController::ITEM_FIREWALL_WAF_REMOVE_MANUALLY)), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()), 'span' => array('class' => array()))),

[8413] Fix | Delete

'footerHTML' => esc_html__('Once you have entered credentials, click Continue to complete uninstallation.', 'wordfence'),

[8414] Fix | Delete

))->render();

[8415] Fix | Delete

return array('needsCredentials' => 1, 'html' => $html);

[8416] Fix | Delete

}

[8417] Fix | Delete

ob_end_clean();

[8418] Fix | Delete

}

[8419] Fix | Delete

[8420] Fix | Delete

if (!WP_Filesystem($credentials, ABSPATH, $allow_relaxed_file_ownership) && $wp_filesystem->errors->get_error_code()) {

[8421] Fix | Delete

$credentialsError = '';

[8422] Fix | Delete

foreach ($wp_filesystem->errors->get_error_messages() as $message) {

[8423] Fix | Delete

if (is_wp_error($message)) {

[8424] Fix | Delete

if ($message->get_error_data() && is_string($message->get_error_data())) {

[8425] Fix | Delete

$message = $message->get_error_message() . ': ' . $message->get_error_data();

[8426] Fix | Delete

}

[8427] Fix | Delete

else {

[8428] Fix | Delete

$message = $message->get_error_message();

[8429] Fix | Delete

}

[8430] Fix | Delete

}

[8431] Fix | Delete

$credentialsError .= "<p>$message</p>\n";

[8432] Fix | Delete

}

[8433] Fix | Delete

[8434] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8435] Fix | Delete

'title' => __('Filesystem Permission Error', 'wordfence'),

[8436] Fix | Delete

'html' => $credentialsError,

[8437] Fix | Delete

'helpHTML' => wp_kses(sprintf(/* translators: Support URL. */ __('If you cannot complete the uninstall process, <a target="_blank" rel="noopener noreferrer" href="%s">click here for help<span class="screen-reader-text"> (opens in new tab)</span></a>', 'wordfence'), wfSupportController::esc_supportURL(wfSupportController::ITEM_FIREWALL_WAF_REMOVE_MANUALLY)), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()), 'span' => array('class' => array()))),

[8438] Fix | Delete

'footerButtonTitle' => __('Cancel', 'wordfence'),

[8439] Fix | Delete

))->render();

[8440] Fix | Delete

return array('credentialsFailed' => 1, 'html' => $html);

[8441] Fix | Delete

}

[8442] Fix | Delete

[8443] Fix | Delete

try {

[8444] Fix | Delete

if ((!isset($_POST['iniModified']) || (isset($_POST['iniModified']) && !$_POST['iniModified'])) && !WF_IS_PRESSABLE) { //Uses .user.ini but not yet modified

[8445] Fix | Delete

$hasPreviousAutoPrepend = $helper->performIniRemoval($wp_filesystem);

[8446] Fix | Delete

[8447] Fix | Delete

$iniTTL = intval(ini_get('user_ini.cache_ttl'));

[8448] Fix | Delete

if ($iniTTL == 0) {

[8449] Fix | Delete

$iniTTL = 300; //The PHP default

[8450] Fix | Delete

}

[8451] Fix | Delete

if (!$helper->usesUserIni()) {

[8452] Fix | Delete

$iniTTL = 0; //.htaccess

[8453] Fix | Delete

}

[8454] Fix | Delete

$timeout = max(30, $iniTTL);

[8455] Fix | Delete

$timeoutString = wfUtils::makeDuration($timeout);

[8456] Fix | Delete

[8457] Fix | Delete

$waitingResponse = '<p>' . __('The <code>auto_prepend_file</code> setting has been successfully removed from <code>.htaccess</code> and <code>.user.ini</code>. Once this change takes effect, Extended Protection Mode will be disabled.', 'wordfence') . '</p>';

[8458] Fix | Delete

if ($hasPreviousAutoPrepend) {

[8459] Fix | Delete

$waitingResponse .= '<p>' . __('Any previous value for <code>auto_prepend_file</code> will need to be re-enabled manually if still needed.', 'wordfence') . '</p>';

[8460] Fix | Delete

}

[8461] Fix | Delete

[8462] Fix | Delete

$spinner = wfView::create('common/indeterminate-progress', array('size' => 32))->render();

[8463] Fix | Delete

$waitingResponse .= '<ul class="wf-flex-horizontal"><li>' . $spinner . '</li><li class="wf-padding-add-left">' . sprintf(/* translators: Time until. */ __('Waiting for it to take effect. This may take up to %s.', 'wordfence'), $timeoutString) . '</li></ul>';

[8464] Fix | Delete

[8465] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8466] Fix | Delete

'title' => __('Waiting for Changes', 'wordfence'),

[8467] Fix | Delete

'html' => $waitingResponse,

[8468] Fix | Delete

'helpHTML' => wp_kses(sprintf(/* translators: Support URL. */ __('If you cannot complete the uninstall process, <a target="_blank" rel="noopener noreferrer" href="%s">click here for help<span class="screen-reader-text"> (opens in new tab)</span></a>', 'wordfence'), wfSupportController::esc_supportURL(wfSupportController::ITEM_FIREWALL_WAF_REMOVE_MANUALLY)), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()), 'span' => array('class' => array()))),

[8469] Fix | Delete

'footerButtonTitle' => __('Close', 'wordfence'),

[8470] Fix | Delete

'noX' => true,

[8471] Fix | Delete

))->render();

[8472] Fix | Delete

[8473] Fix | Delete

$response = array('uninstallationWaiting' => 1, 'html' => $html, 'timeout' => $timeout, 'serverConfiguration' => $_POST['serverConfiguration']);

[8474] Fix | Delete

if (isset($credentials) && is_array($credentials)) {

[8475] Fix | Delete

$salt = wp_salt('logged_in');

[8476] Fix | Delete

$json = json_encode($credentials);

[8477] Fix | Delete

$encrypted = wfUtils::encrypt($json);

[8478] Fix | Delete

$signature = hash_hmac('sha256', $encrypted, $salt);

[8479] Fix | Delete

$response['credentials'] = $encrypted;

[8480] Fix | Delete

$response['credentialsSignature'] = $signature;

[8481] Fix | Delete

}

[8482] Fix | Delete

return $response;

[8483] Fix | Delete

}

[8484] Fix | Delete

else { //.user.ini and .htaccess modified if applicable and waiting period elapsed or otherwise ready to advance to next step

[8485] Fix | Delete

if (WFWAF_AUTO_PREPEND && !WFWAF_SUBDIRECTORY_INSTALL && !WF_IS_WP_ENGINE && !WF_IS_PRESSABLE) { //.user.ini modified, but the WAF is still enabled

[8486] Fix | Delete

$retryAttempted = (isset($_POST['retryAttempted']) && $_POST['retryAttempted']);

[8487] Fix | Delete

$userIniError = '<p class="wf-error">';

[8488] Fix | Delete

$userIniError .= __('Extended Protection Mode has not been disabled. This may be because <code>auto_prepend_file</code> is configured somewhere else or the value is still cached by PHP.', 'wordfence');

[8489] Fix | Delete

if ($retryAttempted) {

[8490] Fix | Delete

$userIniError .= ' <strong>' . __('Retrying Failed.', 'wordfence') . '</strong>';

[8491] Fix | Delete

}

[8492] Fix | Delete

$userIniError .= ' <a href="#" class="wf-waf-uninstall-try-again" role="button">' . __('Try Again', 'wordfence') . '</a>';

[8493] Fix | Delete

$userIniError .= '</p>';

[8494] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8495] Fix | Delete

'title' => __('Unable to Uninstall', 'wordfence'),

[8496] Fix | Delete

'html' => $userIniError,

[8497] Fix | Delete

'helpHTML' => wp_kses(sprintf(/* translators: Support URL. */ __('If you cannot complete the uninstall process, <a target="_blank" rel="noopener noreferrer" href="%s">click here for help<span class="screen-reader-text"> (opens in new tab)</span></a>', 'wordfence'), wfSupportController::esc_supportURL(wfSupportController::ITEM_FIREWALL_WAF_REMOVE_MANUALLY)), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()), 'span' => array('class' => array()))),

[8498] Fix | Delete

'footerButtonTitle' => __('Cancel', 'wordfence'),

[8499] Fix | Delete