))->render();

[8500] Fix | Delete

[8501] Fix | Delete

$response = array('uninstallationFailed' => 1, 'html' => $html, 'serverConfiguration' => $_POST['serverConfiguration']);

[8502] Fix | Delete

if (isset($credentials) && is_array($credentials)) {

[8503] Fix | Delete

$salt = wp_salt('logged_in');

[8504] Fix | Delete

$json = json_encode($credentials);

[8505] Fix | Delete

$encrypted = wfUtils::encrypt($json);

[8506] Fix | Delete

$signature = hash_hmac('sha256', $encrypted, $salt);

[8507] Fix | Delete

$response['credentials'] = $encrypted;

[8508] Fix | Delete

$response['credentialsSignature'] = $signature;

[8509] Fix | Delete

}

[8510] Fix | Delete

return $response;

[8511] Fix | Delete

}

[8512] Fix | Delete

[8513] Fix | Delete

$helper->performAutoPrependFileRemoval($wp_filesystem);

[8514] Fix | Delete

[8515] Fix | Delete

$nonce = bin2hex(wfWAFUtils::random_bytes(32));

[8516] Fix | Delete

wfConfig::set('wafStatusCallbackNonce', $nonce);

[8517] Fix | Delete

$verifyURL = add_query_arg(array('action' => 'wordfence_wafStatus', 'nonce' => $nonce), $ajaxURL);

[8518] Fix | Delete

$response = wp_remote_get($verifyURL, array('headers' => array('Referer' => false/*, 'Cookie' => 'XDEBUG_SESSION=1'*/)));

[8519] Fix | Delete

[8520] Fix | Delete

$active = true;

[8521] Fix | Delete

$subdirectory = WFWAF_SUBDIRECTORY_INSTALL;

[8522] Fix | Delete

if (!is_wp_error($response)) {

[8523] Fix | Delete

$wafStatus = @json_decode(wp_remote_retrieve_body($response), true);

[8524] Fix | Delete

if (isset($wafStatus['active']) && isset($wafStatus['subdirectory'])) {

[8525] Fix | Delete

$active = $wafStatus['active'] && !$wafStatus['subdirectory'];

[8526] Fix | Delete

$subdirectory = $wafStatus['subdirectory'];

[8527] Fix | Delete

}

[8528] Fix | Delete

}

[8529] Fix | Delete

[8530] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8531] Fix | Delete

'title' => __('Uninstallation Complete', 'wordfence'),

[8532] Fix | Delete

'html' => wfView::create('waf/waf-uninstall-success', array('active' => $active, 'subdirectory' => $subdirectory))->render(),

[8533] Fix | Delete

'footerButtonTitle' => __('Close', 'wordfence'),

[8534] Fix | Delete

))->render();

[8535] Fix | Delete

return array('ok' => 1, 'html' => $html);

[8536] Fix | Delete

}

[8537] Fix | Delete

}

[8538] Fix | Delete

catch (wfWAFAutoPrependHelperException $e) {

[8539] Fix | Delete

$installError = "<p>" . $e->getMessage() . "</p>";

[8540] Fix | Delete

$html = wfView::create('waf/waf-modal-wrapper', array(

[8541] Fix | Delete

'title' => __('Uninstallation Failed', 'wordfence'),

[8542] Fix | Delete

'html' => $installError,

[8543] Fix | Delete

'helpHTML' => wp_kses(sprintf(/* translators: Support URL. */ __('If you cannot complete the uninstall process, <a target="_blank" rel="noopener noreferrer" href="%s">click here for help<span class="screen-reader-text"> (opens in new tab)</span></a>', 'wordfence'), wfSupportController::esc_supportURL(wfSupportController::ITEM_FIREWALL_WAF_REMOVE_MANUALLY)), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()), 'span' => array('class' => array()))),

[8544] Fix | Delete

'footerButtonTitle' => __('Cancel', 'wordfence'),

[8545] Fix | Delete

))->render();

[8546] Fix | Delete

return array('uninstallationFailed' => 1, 'html' => $html);

[8547] Fix | Delete

}

[8548] Fix | Delete

}

[8549] Fix | Delete

[8550] Fix | Delete

public static function actionUserRegistration($user_id) {

[8551] Fix | Delete

if (wfUtils::isAdmin($user_id) && ($request = self::getLog()->getCurrentRequest())) {

[8552] Fix | Delete

//self::getLog()->canLogHit = true;

[8553] Fix | Delete

$request->action = 'user:adminCreate';

[8554] Fix | Delete

$request->save();

[8555] Fix | Delete

}

[8556] Fix | Delete

}

[8557] Fix | Delete

[8558] Fix | Delete

public static function actionPasswordReset($user = null, $new_pass = null) {

[8559] Fix | Delete

if ($request = self::getLog()->getCurrentRequest()) {

[8560] Fix | Delete

//self::getLog()->canLogHit = true;

[8561] Fix | Delete

$request->action = 'user:passwordReset';

[8562] Fix | Delete

$request->save();

[8563] Fix | Delete

}

[8564] Fix | Delete

}

[8565] Fix | Delete

[8566] Fix | Delete

public static function trimWfHits($force = false) {

[8567] Fix | Delete

if(!$force && self::isApiDelayed())

[8568] Fix | Delete

return;

[8569] Fix | Delete

$wfdb = new wfDB();

[8570] Fix | Delete

$lastAggregation = wfConfig::get('lastBlockAggregation', 0);

[8571] Fix | Delete

$table_wfHits = wfDB::networkTable('wfHits');

[8572] Fix | Delete

$count = $wfdb->querySingle("select count(*) as cnt from {$table_wfHits}");

[8573] Fix | Delete

$liveTrafficMaxRows = absint(wfConfig::get('liveTraf_maxRows', 2000));

[8574] Fix | Delete

if ($count > $liveTrafficMaxRows * 10) {

[8575] Fix | Delete

self::_aggregateBlockStats($lastAggregation);

[8576] Fix | Delete

$wfdb->truncate($table_wfHits); //So we don't slow down sites that have very large wfHits tables

[8577] Fix | Delete

}

[8578] Fix | Delete

else if ($count > $liveTrafficMaxRows) {

[8579] Fix | Delete

self::_aggregateBlockStats($lastAggregation);

[8580] Fix | Delete

$wfdb->queryWrite("delete from {$table_wfHits} order by id asc limit %d", ($count - $liveTrafficMaxRows) + ($liveTrafficMaxRows * .2));

[8581] Fix | Delete

}

[8582] Fix | Delete

else if ($lastAggregation < (time() - 86400)) {

[8583] Fix | Delete

self::_aggregateBlockStats($lastAggregation);

[8584] Fix | Delete

}

[8585] Fix | Delete

[8586] Fix | Delete

$maxAge = wfConfig::get('liveTraf_maxAge', 30);

[8587] Fix | Delete

if ($maxAge <= 0 || $maxAge > 30) {

[8588] Fix | Delete

$maxAge = 30;

[8589] Fix | Delete

}

[8590] Fix | Delete

$wfdb->queryWrite("DELETE FROM {$table_wfHits} WHERE ctime < %d", time() - ($maxAge * 86400));

[8591] Fix | Delete

}

[8592] Fix | Delete

[8593] Fix | Delete

private static function _aggregateBlockStats($since = false) {

[8594] Fix | Delete

global $wpdb;

[8595] Fix | Delete

[8596] Fix | Delete

if (!wfConfig::get('other_WFNet', true)) {

[8597] Fix | Delete

return;

[8598] Fix | Delete

}

[8599] Fix | Delete

[8600] Fix | Delete

if ($since === false) {

[8601] Fix | Delete

$since = wfConfig::get('lastBlockAggregation', 0);

[8602] Fix | Delete

}

[8603] Fix | Delete

[8604] Fix | Delete

$hitsTable = wfDB::networkTable('wfHits');

[8605] Fix | Delete

$query = $wpdb->prepare("SELECT COUNT(*) AS cnt, CASE WHEN (jsRun = 1 OR userID > 0) THEN 1 ELSE 0 END AS isHuman, statusCode FROM {$hitsTable} WHERE ctime > %d GROUP BY isHuman, statusCode", $since);

[8606] Fix | Delete

$rows = $wpdb->get_results($query, ARRAY_A);

[8607] Fix | Delete

if (count($rows)) {

[8608] Fix | Delete

try {

[8609] Fix | Delete

$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());

[8610] Fix | Delete

$api->call('aggregate_stats', array(), array('stats' => json_encode($rows)));

[8611] Fix | Delete

}

[8612] Fix | Delete

catch (Exception $e) {

[8613] Fix | Delete

// Do nothing

[8614] Fix | Delete

}

[8615] Fix | Delete

}

[8616] Fix | Delete

[8617] Fix | Delete

wfConfig::set('lastBlockAggregation', time());

[8618] Fix | Delete

}

[8619] Fix | Delete

[8620] Fix | Delete

private static function isApiDelayed() {

[8621] Fix | Delete

return wfConfig::get('apiDelayedUntil', 0) > time();

[8622] Fix | Delete

}

[8623] Fix | Delete

[8624] Fix | Delete

private static function delaySendAttackData($until) {

[8625] Fix | Delete

wfConfig::set('apiDelayedUntil', $until);

[8626] Fix | Delete

self::scheduleSendAttackData($until);

[8627] Fix | Delete

}

[8628] Fix | Delete

[8629] Fix | Delete

private static function scheduleSendAttackData($timeToSend = null) {

[8630] Fix | Delete

if ($timeToSend === null) {

[8631] Fix | Delete

$timeToSend = time() + (60 * 5);

[8632] Fix | Delete

}

[8633] Fix | Delete

$notMainSite = is_multisite() && !is_main_site();

[8634] Fix | Delete

if ($notMainSite) {

[8635] Fix | Delete

global $current_site;

[8636] Fix | Delete

switch_to_blog($current_site->blog_id);

[8637] Fix | Delete

}

[8638] Fix | Delete

if (!wp_next_scheduled('wordfence_processAttackData')) {

[8639] Fix | Delete

wp_schedule_single_event($timeToSend, 'wordfence_processAttackData');

[8640] Fix | Delete

}

[8641] Fix | Delete

if ($notMainSite) {

[8642] Fix | Delete

restore_current_blog();

[8643] Fix | Delete

}

[8644] Fix | Delete

}

[8645] Fix | Delete

[8646] Fix | Delete

private static function truncateWafFailures() {

[8647] Fix | Delete

wfDB::shared()->truncate(wfDB::networkTable('wfWafFailures'));

[8648] Fix | Delete

}

[8649] Fix | Delete

[8650] Fix | Delete

private static function loadWafFailures(&$purgeCallable = null) {

[8651] Fix | Delete

global $wpdb;

[8652] Fix | Delete

$table = wfDB::networkTable('wfWafFailures');

[8653] Fix | Delete

$query = <<<SQL

[8654] Fix | Delete

SELECT

[8655] Fix | Delete

id,

[8656] Fix | Delete

failures.rule_id,

[8657] Fix | Delete

throwable AS latest_throwable,

[8658] Fix | Delete

UNIX_TIMESTAMP(latest_occurrence) AS latest_occurrence,

[8659] Fix | Delete

occurrences

[8660] Fix | Delete

FROM

[8661] Fix | Delete

{$table} failures

[8662] Fix | Delete

JOIN (

[8663] Fix | Delete

SELECT

[8664] Fix | Delete

rule_id,

[8665] Fix | Delete

MAX(id) AS max_id,

[8666] Fix | Delete

MAX(timestamp) AS latest_occurrence,

[8667] Fix | Delete

COUNT(*) AS occurrences

[8668] Fix | Delete

FROM

[8669] Fix | Delete

{$table}

[8670] Fix | Delete

GROUP BY

[8671] Fix | Delete

rule_id

[8672] Fix | Delete

) aggregate ON failures.id = aggregate.max_id

[8673] Fix | Delete

SQL;

[8674] Fix | Delete

$results = $wpdb->get_results($query);

[8675] Fix | Delete

$maxId = null;

[8676] Fix | Delete

foreach ($results as $row) {

[8677] Fix | Delete

if ($maxId === null) {

[8678] Fix | Delete

$maxId = $row->id;

[8679] Fix | Delete

}

[8680] Fix | Delete

else {

[8681] Fix | Delete

$maxId = max($maxId, $row->id);

[8682] Fix | Delete

}

[8683] Fix | Delete

}

[8684] Fix | Delete

if ($maxId === null) {

[8685] Fix | Delete

$purgeCallable = function() { /* Nothing to delete */ };

[8686] Fix | Delete

}

[8687] Fix | Delete

else {

[8688] Fix | Delete

$purgeCallable = function() use ($table, $maxId, $wpdb) {

[8689] Fix | Delete

$wpdb->query(

[8690] Fix | Delete

$wpdb->prepare(

[8691] Fix | Delete

"DELETE FROM {$table} WHERE id <= %d",

[8692] Fix | Delete

$maxId

[8693] Fix | Delete

)

[8694] Fix | Delete

);

[8695] Fix | Delete

};

[8696] Fix | Delete

}

[8697] Fix | Delete

return $results;

[8698] Fix | Delete

}

[8699] Fix | Delete

[8700] Fix | Delete

/**

[8701] Fix | Delete

*

[8702] Fix | Delete

*/

[8703] Fix | Delete

public static function processAttackData() {

[8704] Fix | Delete

global $wpdb;

[8705] Fix | Delete

$table_wfHits = wfDB::networkTable('wfHits');

[8706] Fix | Delete

if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }

[8707] Fix | Delete

[8708] Fix | Delete

$waf = wfWAF::getInstance();

[8709] Fix | Delete

if ($waf->getStorageEngine()->getConfig('attackDataKey', false) === false) {

[8710] Fix | Delete

$waf->getStorageEngine()->setConfig('attackDataKey', mt_rand(0, 0xfff));

[8711] Fix | Delete

}

[8712] Fix | Delete

[8713] Fix | Delete

//Send alert email if needed

[8714] Fix | Delete

if (wfConfig::get('wafAlertOnAttacks')) {

[8715] Fix | Delete

$alertInterval = wfConfig::get('wafAlertInterval', 0);

[8716] Fix | Delete

$cutoffTime = max(time() - $alertInterval, wfConfig::get('wafAlertLastSendTime'));

[8717] Fix | Delete

$wafAlertWhitelist = wfConfig::get('wafAlertWhitelist', '');

[8718] Fix | Delete

$wafAlertWhitelist = preg_split("/[,\r\n]+/", $wafAlertWhitelist);

[8719] Fix | Delete

foreach ($wafAlertWhitelist as $index => &$entry) {

[8720] Fix | Delete

$entry = trim($entry);

[8721] Fix | Delete

if (empty($entry) || (!preg_match('/^(?:\d{1,3}(?:\.|$)){4}/', $entry) && !preg_match('/^((?:[\da-f]{1,4}(?::|)){0,8})(::)?((?:[\da-f]{1,4}(?::|)){0,8})$/i', $entry))) {

[8722] Fix | Delete

unset($wafAlertWhitelist[$index]);

[8723] Fix | Delete

continue;

[8724] Fix | Delete

}

[8725] Fix | Delete

[8726] Fix | Delete

$packed = @wfUtils::inet_pton($entry);

[8727] Fix | Delete

if ($packed === false) {

[8728] Fix | Delete

unset($wafAlertWhitelist[$index]);

[8729] Fix | Delete

continue;

[8730] Fix | Delete

}

[8731] Fix | Delete

$entry = bin2hex($packed);

[8732] Fix | Delete

}

[8733] Fix | Delete

$wafAlertWhitelist = array_filter($wafAlertWhitelist);

[8734] Fix | Delete

$attackDataQuery = $wpdb->prepare(

[8735] Fix | Delete

"SELECT * FROM {$table_wfHits}

[8736] Fix | Delete

WHERE action = 'blocked:waf' " .

[8737] Fix | Delete

(count($wafAlertWhitelist) ? "AND HEX(IP) NOT IN (" . implode(", ", array_fill(0, count($wafAlertWhitelist), '%s')) . ")" : "")

[8738] Fix | Delete

. " AND attackLogTime > %f

[8739] Fix | Delete

ORDER BY attackLogTime DESC

[8740] Fix | Delete

LIMIT 10",

[8741] Fix | Delete

array_merge($wafAlertWhitelist, array(sprintf('%.6f', $cutoffTime))));

[8742] Fix | Delete

$attackDataCountQuery = str_replace(

[8743] Fix | Delete

array(

[8744] Fix | Delete

"SELECT * FROM",

[8745] Fix | Delete

"ORDER BY attackLogTime DESC",

[8746] Fix | Delete

"LIMIT 10",

[8747] Fix | Delete

),

[8748] Fix | Delete

array( "SELECT COUNT(*) FROM", "", "" ), $attackDataQuery

[8749] Fix | Delete

);

[8750] Fix | Delete

$attackData = $wpdb->get_results($attackDataQuery);

[8751] Fix | Delete

$attackCount = $wpdb->get_var($attackDataCountQuery);

[8752] Fix | Delete

unset( $attackDataQuery, $attackDataCountQuery );

[8753] Fix | Delete

$threshold = (int) wfConfig::get('wafAlertThreshold');

[8754] Fix | Delete

if ($threshold < 1) {

[8755] Fix | Delete

$threshold = 100;

[8756] Fix | Delete

}

[8757] Fix | Delete

if ($attackCount >= $threshold) {

[8758] Fix | Delete

$durationMessage = wfUtils::makeDuration($alertInterval);

[8759] Fix | Delete

$message = sprintf(

[8760] Fix | Delete

/* translators: 1. Number of attacks/blocks. 2. Time since. */

[8761] Fix | Delete

__('The Wordfence Web Application Firewall has blocked %1$d attacks over the last %2$s.', 'wordfence'),

[8762] Fix | Delete

$attackCount,

[8763] Fix | Delete

$durationMessage

[8764] Fix | Delete

);

[8765] Fix | Delete

$message .= "\n\n";

[8766] Fix | Delete

$message .= __('Wordfence is blocking these attacks, and we\'re sending this notice to make you aware that there is a higher volume of the attacks than usual. Additionally, the Wordfence Real-Time IP Blocklist can block known attackers\' IP addresses automatically for Premium users, including any probing requests that may not be malicious on their own. All Wordfence users can also opt to block the attacking IPs manually if desired. As always, be sure to watch your scan results and keep your plugins, themes and WordPress core version updated.', 'wordfence');

[8767] Fix | Delete

$message .= "\n\n";

[8768] Fix | Delete

$message .= __('Below is a sample of these recent attacks:', 'wordfence');

[8769] Fix | Delete

$attackTable = array();

[8770] Fix | Delete

$dateMax = $ipMax = $countryMax = 0;

[8771] Fix | Delete

foreach ($attackData as $row) {

[8772] Fix | Delete

$actionData = json_decode($row->actionData, true);

[8773] Fix | Delete

if (!is_array($actionData) || !isset($actionData['paramKey']) || !isset($actionData['paramValue'])) {

[8774] Fix | Delete

continue;

[8775] Fix | Delete

}

[8776] Fix | Delete

[8777] Fix | Delete

if (isset($actionData['failedRules']) && $actionData['failedRules'] == 'blocked') {

[8778] Fix | Delete

$row->longDescription = __("Blocked because the IP is blocklisted", 'wordfence');

[8779] Fix | Delete

}

[8780] Fix | Delete

else {

[8781] Fix | Delete

$row->longDescription = sprintf(/* translators: Reason for firewall action. */ __("Blocked for %s", 'wordfence'), $row->actionDescription);

[8782] Fix | Delete

}

[8783] Fix | Delete

[8784] Fix | Delete

$paramKey = base64_decode($actionData['paramKey']);

[8785] Fix | Delete

$paramValue = base64_decode($actionData['paramValue']);

[8786] Fix | Delete

if (strlen($paramValue) > 100) {

[8787] Fix | Delete

$paramValue = substr($paramValue, 0, 100) . '...';

[8788] Fix | Delete

}

[8789] Fix | Delete

[8790] Fix | Delete

if (preg_match('/([a-z0-9_]+\.[a-z0-9_]+)(?:\[(.+?)\](.*))?/i', $paramKey, $matches)) {

[8791] Fix | Delete

switch ($matches[1]) {

[8792] Fix | Delete

case 'request.queryString':

[8793] Fix | Delete

$row->longDescription = sprintf(

[8794] Fix | Delete

/* translators: 1. Reason for firewall action. 2. Input parameter. 2. Input parameter value. */

[8795] Fix | Delete

__('Blocked for %1$s in query string: %2$s = %3$s', 'wordfence'), $row->actionDescription, $matches[2], $paramValue);

[8796] Fix | Delete

break;

[8797] Fix | Delete

case 'request.body':

[8798] Fix | Delete

$row->longDescription = sprintf(

[8799] Fix | Delete

/* translators: 1. Reason for firewall action. 2. Input parameter. 2. Input parameter value. */

[8800] Fix | Delete

__('Blocked for %1$s in POST body: %2$s = %3$s', 'wordfence'), $row->actionDescription, $matches[2], $paramValue);

[8801] Fix | Delete

break;

[8802] Fix | Delete

case 'request.cookie':

[8803] Fix | Delete

$row->longDescription = sprintf(

[8804] Fix | Delete

/* translators: 1. Reason for firewall action. 2. Input parameter. 2. Input parameter value. */

[8805] Fix | Delete

__('Blocked for %1$s in cookie: %2$s = %3$s', 'wordfence'), $row->actionDescription, $matches[2], $paramValue);

[8806] Fix | Delete

break;

[8807] Fix | Delete

case 'request.fileNames':

[8808] Fix | Delete

$row->longDescription = sprintf(

[8809] Fix | Delete

/* translators: 1. Reason for firewall action. 2. Input parameter. 2. Input parameter value. */

[8810] Fix | Delete

__('Blocked for %1$s in file: %2$s = %3$s', 'wordfence'), $row->actionDescription, $matches[2], $paramValue);

[8811] Fix | Delete

break;

[8812] Fix | Delete

}

[8813] Fix | Delete

}

[8814] Fix | Delete

[8815] Fix | Delete

$date = date_i18n('F j, Y g:ia', floor($row->attackLogTime)); $dateMax = max(strlen($date), $dateMax);

[8816] Fix | Delete

$ip = wfUtils::inet_ntop($row->IP); $ipMax = max(strlen($ip), $ipMax);

[8817] Fix | Delete

$country = wfUtils::countryCode2Name(wfUtils::IP2Country($ip)); $country = (empty($country) ? 'Unknown' : $country); $countryMax = max(strlen($country), $countryMax);

[8818] Fix | Delete

$attackTable[] = array('date' => $date, 'IP' => $ip, 'country' => $country, 'message' => $row->longDescription);

[8819] Fix | Delete

}

[8820] Fix | Delete

[8821] Fix | Delete

foreach ($attackTable as $row) {

[8822] Fix | Delete

$date = str_pad($row['date'], $dateMax + 2);

[8823] Fix | Delete

$ip = str_pad($row['IP'] . " ({$row['country']})", $ipMax + $countryMax + 8);

[8824] Fix | Delete

$attackMessage = $row['message'];

[8825] Fix | Delete

$message .= "\n" . $date . $ip . $attackMessage;

[8826] Fix | Delete

}

[8827] Fix | Delete

[8828] Fix | Delete

$alertCallback = array(new wfIncreasedAttackRateAlert($message), 'send');

[8829] Fix | Delete

do_action('wordfence_security_event', 'increasedAttackRate', array(

[8830] Fix | Delete

'attackCount' => $attackCount,

[8831] Fix | Delete

'attackTable' => $attackTable,

[8832] Fix | Delete

'duration' => $alertInterval,

[8833] Fix | Delete

'ip' => wfUtils::getIP(),

[8834] Fix | Delete

), $alertCallback);

[8835] Fix | Delete

[8836] Fix | Delete

wfConfig::set('wafAlertLastSendTime', time());

[8837] Fix | Delete

}

[8838] Fix | Delete

}

[8839] Fix | Delete

[8840] Fix | Delete

if (wfConfig::get('other_WFNet', true)) {

[8841] Fix | Delete

$response = wp_remote_get(sprintf(WFWAF_API_URL_SEC . "waf-rules/%d.txt", $waf->getStorageEngine()->getConfig('attackDataKey')), array('headers' => array('Referer' => false)));

[8842] Fix | Delete

if (!is_wp_error($response)) {

[8843] Fix | Delete

$okToSendBody = wp_remote_retrieve_body($response);

[8844] Fix | Delete

if ($okToSendBody === 'ok') {

[8845] Fix | Delete

//Send attack data

[8846] Fix | Delete

$limit = 500;

[8847] Fix | Delete

$lastSendTime = wfConfig::get('lastAttackDataSendTime');

[8848] Fix | Delete

$lastSendId = wfConfig::get('lastAttackDataSendId');

[8849] Fix | Delete

if($lastSendId===false){

[8850] Fix | Delete

$query=$wpdb->prepare("SELECT * FROM {$table_wfHits}

[8851] Fix | Delete

WHERE action in ('blocked:waf', 'learned:waf', 'logged:waf', 'blocked:waf-always')

[8852] Fix | Delete

AND attackLogTime > %f

[8853] Fix | Delete

LIMIT %d", sprintf('%.6f', $lastSendTime), $limit);

[8854] Fix | Delete

[8855] Fix | Delete

$count_query = str_replace(

[8856] Fix | Delete

array(

[8857] Fix | Delete

"SELECT * FROM",

[8858] Fix | Delete

"LIMIT " . $limit,

[8859] Fix | Delete

),

[8860] Fix | Delete

array( "SELECT COUNT(*) FROM", "" ), $query

[8861] Fix | Delete

);

[8862] Fix | Delete

}

[8863] Fix | Delete

else{

[8864] Fix | Delete

$query=$wpdb->prepare("SELECT * FROM {$table_wfHits}

[8865] Fix | Delete

WHERE action in ('blocked:waf', 'learned:waf', 'logged:waf', 'blocked:waf-always')

[8866] Fix | Delete

AND id > %d

[8867] Fix | Delete

ORDER BY id LIMIT %d", $lastSendId, $limit);

[8868] Fix | Delete

[8869] Fix | Delete

$count_query = str_replace(

[8870] Fix | Delete

array(

[8871] Fix | Delete

"SELECT * FROM",

[8872] Fix | Delete

"ORDER BY id LIMIT " . $limit,

[8873] Fix | Delete

),

[8874] Fix | Delete

array( "SELECT COUNT(*) FROM", "" ), $query

[8875] Fix | Delete

);

[8876] Fix | Delete

}

[8877] Fix | Delete

[8878] Fix | Delete

$params[]=$limit;

[8879] Fix | Delete

$attackData = $wpdb->get_results($query);

[8880] Fix | Delete

$totalRows = $wpdb->get_var($count_query);

[8881] Fix | Delete

[8882] Fix | Delete

if ($attackData) { // Build JSON to send

[8883] Fix | Delete

$dataToSend = array();

[8884] Fix | Delete

$attackDataToUpdate = array();

[8885] Fix | Delete

foreach ($attackData as $attackDataRow) {

[8886] Fix | Delete

$actionData = (array) wfRequestModel::unserializeActionData($attackDataRow->actionData);

[8887] Fix | Delete

$dataToSend[] = array(

[8888] Fix | Delete

$attackDataRow->attackLogTime,

[8889] Fix | Delete

$attackDataRow->ctime,

[8890] Fix | Delete

wfUtils::inet_ntop($attackDataRow->IP),

[8891] Fix | Delete

(array_key_exists('learningMode', $actionData) ? $actionData['learningMode'] : 0),

[8892] Fix | Delete

(array_key_exists('paramKey', $actionData) ? base64_encode($actionData['paramKey']) : false),

[8893] Fix | Delete

(array_key_exists('paramValue', $actionData) ? base64_encode($actionData['paramValue']) : false),

[8894] Fix | Delete

(array_key_exists('failedRules', $actionData) ? $actionData['failedRules'] : ''),

[8895] Fix | Delete

strpos($attackDataRow->URL, 'https') === 0 ? 1 : 0,

[8896] Fix | Delete

(array_key_exists('fullRequest', $actionData) ? $actionData['fullRequest'] : ''),

[8897] Fix | Delete

);

[8898] Fix | Delete

if (array_key_exists('fullRequest', $actionData)) {

[8899] Fix | Delete

unset($actionData['fullRequest']);

[8900] Fix | Delete

$attackDataToUpdate[$attackDataRow->id] = array(

[8901] Fix | Delete

'actionData' => wfRequestModel::serializeActionData($actionData),

[8902] Fix | Delete

);

[8903] Fix | Delete

}

[8904] Fix | Delete

if ($attackDataRow->attackLogTime > $lastSendTime) {

[8905] Fix | Delete

$lastSendTime = $attackDataRow->attackLogTime;

[8906] Fix | Delete

}

[8907] Fix | Delete

}

[8908] Fix | Delete

[8909] Fix | Delete

$bodyLimit=self::ATTACK_DATA_BODY_LIMIT;

[8910] Fix | Delete

$response=null;

[8911] Fix | Delete

do {

[8912] Fix | Delete

$bodyData=null;

[8913] Fix | Delete

do {

[8914] Fix | Delete

if($bodyData!==null)

[8915] Fix | Delete

array_splice($dataToSend, floor(count($dataToSend)/2));

[8916] Fix | Delete

$bodyData=json_encode($dataToSend);

[8917] Fix | Delete

} while(strlen($bodyData)>$bodyLimit&&count($dataToSend)>1);

[8918] Fix | Delete

[8919] Fix | Delete

$homeurl = wfUtils::wpHomeURL();

[8920] Fix | Delete

$siteurl = wfUtils::wpSiteURL();

[8921] Fix | Delete

$installType = wfUtils::wafInstallationType();

[8922] Fix | Delete

$response = wp_remote_post(WFWAF_API_URL_SEC . "?" . http_build_query(array(

[8923] Fix | Delete

'action' => 'send_waf_attack_data',

[8924] Fix | Delete

'k' => $waf->getStorageEngine()->getConfig('apiKey', null, 'synced'),

[8925] Fix | Delete

's' => $siteurl,

[8926] Fix | Delete

'h' => $homeurl,

[8927] Fix | Delete

't' => microtime(true),

[8928] Fix | Delete

'c' => $installType,

[8929] Fix | Delete

'lang' => get_site_option('WPLANG'),

[8930] Fix | Delete

), '', '&'),

[8931] Fix | Delete

array(

[8932] Fix | Delete

'body' => $bodyData,

[8933] Fix | Delete

'headers' => array(

[8934] Fix | Delete

'Content-Type' => 'application/json',

[8935] Fix | Delete

'Referer' => false,

[8936] Fix | Delete

),

[8937] Fix | Delete

'timeout' => 30,

[8938] Fix | Delete

));

[8939] Fix | Delete

$bodyLimit/=2;

[8940] Fix | Delete

} while(wp_remote_retrieve_response_code($response)===413&&count($dataToSend)>1);

[8941] Fix | Delete

[8942] Fix | Delete

if (!is_wp_error($response) && ($body = wp_remote_retrieve_body($response))) {

[8943] Fix | Delete

$jsonData = json_decode($body, true);

[8944] Fix | Delete

if (is_array($jsonData) && array_key_exists('success', $jsonData)) {

[8945] Fix | Delete

wfConfig::set('lastAttackDataSendTime', $lastSendTime);

[8946] Fix | Delete

$lastSendIndex=count($dataToSend)-1;

[8947] Fix | Delete

if($lastSendIndex>=0){

[8948] Fix | Delete

$lastSendId = $attackData[$lastSendIndex]->id;

[8949] Fix | Delete

wfConfig::set('lastAttackDataSendId', $lastSendId);

[8950] Fix | Delete

// Successfully sent data, remove the full request from the table to reduce storage size

[8951] Fix | Delete

foreach ($attackDataToUpdate as $hitID => $dataToUpdate) {

[8952] Fix | Delete

if ($hitID <= $lastSendId) {

[8953] Fix | Delete

$wpdb->update($table_wfHits, $dataToUpdate, array(

[8954] Fix | Delete

'id' => $hitID,

[8955] Fix | Delete

));

[8956] Fix | Delete

}

[8957] Fix | Delete

}

[8958] Fix | Delete

}

[8959] Fix | Delete

if (count($dataToSend) < $totalRows) {

[8960] Fix | Delete

self::scheduleSendAttackData();

[8961] Fix | Delete

}

[8962] Fix | Delete

[8963] Fix | Delete

if (array_key_exists('data', $jsonData) && array_key_exists('watchedIPList', $jsonData['data'])) {

[8964] Fix | Delete

$waf->getStorageEngine()->setConfig('watchedIPs', $jsonData['data']['watchedIPList'], 'transient');

[8965] Fix | Delete

}

[8966] Fix | Delete

}

[8967] Fix | Delete

}

[8968] Fix | Delete

else{

[8969] Fix | Delete

//Delay interactions for 30 minutes if an error occurs

[8970] Fix | Delete

self::delaySendAttackData(time() + 30*60);

[8971] Fix | Delete

}

[8972] Fix | Delete

}

[8973] Fix | Delete

[8974] Fix | Delete

//Send false positives and WAF failures

[8975] Fix | Delete

$lastSendTime = wfConfig::get('lastFalsePositiveSendTime');

[8976] Fix | Delete

$whitelistedURLParams = (array) wfWAF::getInstance()->getStorageEngine()->getConfig('whitelistedURLParams', array(), 'livewaf');

[8977] Fix | Delete

$wafFailures = self::loadWafFailures($purgeWafFailures);

[8978] Fix | Delete

if (count($whitelistedURLParams) || !empty($wafFailures)) {

[8979] Fix | Delete

$falsePositives = array();

[8980] Fix | Delete

$mostRecentWhitelisting = $lastSendTime;

[8981] Fix | Delete

foreach ($whitelistedURLParams as $urlParamKey => $rules) {

[8982] Fix | Delete

list($path, $paramKey) = explode('|', $urlParamKey);

[8983] Fix | Delete

$ruleData = array();

[8984] Fix | Delete

foreach ($rules as $ruleID => $whitelistedData) {

[8985] Fix | Delete

if ($whitelistedData['timestamp'] > $lastSendTime && (!isset($whitelistedData['disabled']) || !$whitelistedData['disabled'])) {

[8986] Fix | Delete

if (isset($whitelistedData['source'])) {

[8987] Fix | Delete

$source = $whitelistedData['source'];

[8988] Fix | Delete

}

[8989] Fix | Delete

else if ($whitelistedData['description'] == 'Allowlisted via false positive dialog') {

[8990] Fix | Delete

$source = 'false-positive';

[8991] Fix | Delete

}

[8992] Fix | Delete

else if ($whitelistedData['description'] == 'Allowlisted via Live Traffic') {

[8993] Fix | Delete

$source = 'live-traffic';

[8994] Fix | Delete

}

[8995] Fix | Delete

else if ($whitelistedData['description'] == 'Allowlisted while in Learning Mode.') {

[8996] Fix | Delete

$source = 'learning-mode';

[8997] Fix | Delete

}

[8998] Fix | Delete

else { //A user-entered description or Whitelisted via Firewall Options page

[8999] Fix | Delete