$source = 'waf-options';

[9000] Fix | Delete

}

[9001] Fix | Delete

[9002] Fix | Delete

$ruleData[] = array(

[9003] Fix | Delete

$ruleID,

[9004] Fix | Delete

$whitelistedData['timestamp'],

[9005] Fix | Delete

$source,

[9006] Fix | Delete

$whitelistedData['description'],

[9007] Fix | Delete

$whitelistedData['ip'],

[9008] Fix | Delete

isset($whitelistedData['userID']) ? $whitelistedData['userID'] : 0,

[9009] Fix | Delete

);

[9010] Fix | Delete

[9011] Fix | Delete

if ($whitelistedData['timestamp'] > $mostRecentWhitelisting) {

[9012] Fix | Delete

$mostRecentWhitelisting = $whitelistedData['timestamp'];

[9013] Fix | Delete

}

[9014] Fix | Delete

}

[9015] Fix | Delete

}

[9016] Fix | Delete

[9017] Fix | Delete

if (count($ruleData)) {

[9018] Fix | Delete

$falsePositives[] = array(

[9019] Fix | Delete

base64_decode($path),

[9020] Fix | Delete

base64_decode($paramKey),

[9021] Fix | Delete

$ruleData,

[9022] Fix | Delete

);

[9023] Fix | Delete

}

[9024] Fix | Delete

}

[9025] Fix | Delete

[9026] Fix | Delete

$data = [];

[9027] Fix | Delete

if (!empty($wafFailures))

[9028] Fix | Delete

$data['waf_failures'] = $wafFailures;

[9029] Fix | Delete

if (!empty($falsePositives))

[9030] Fix | Delete

$data['false_positives'] = $falsePositives;

[9031] Fix | Delete

[9032] Fix | Delete

if (count($data)) {

[9033] Fix | Delete

$homeurl = wfUtils::wpHomeURL();

[9034] Fix | Delete

$siteurl = wfUtils::wpSiteURL();

[9035] Fix | Delete

$installType = wfUtils::wafInstallationType();

[9036] Fix | Delete

$response = wp_remote_post(WFWAF_API_URL_SEC . "?" . http_build_query(array(

[9037] Fix | Delete

'action' => 'send_waf_false_positives',

[9038] Fix | Delete

'k' => $waf->getStorageEngine()->getConfig('apiKey', null, 'synced'),

[9039] Fix | Delete

's' => $siteurl,

[9040] Fix | Delete

'h' => $homeurl,

[9041] Fix | Delete

't' => microtime(true),

[9042] Fix | Delete

'c' => $installType,

[9043] Fix | Delete

'lang' => get_site_option('WPLANG'),

[9044] Fix | Delete

), '', '&'),

[9045] Fix | Delete

array(

[9046] Fix | Delete

'body' => json_encode($data),

[9047] Fix | Delete

'headers' => array(

[9048] Fix | Delete

'Content-Type' => 'application/json',

[9049] Fix | Delete

'Referer' => false,

[9050] Fix | Delete

),

[9051] Fix | Delete

'timeout' => 30,

[9052] Fix | Delete

));

[9053] Fix | Delete

[9054] Fix | Delete

if (!is_wp_error($response) && ($body = wp_remote_retrieve_body($response))) {

[9055] Fix | Delete

$jsonData = json_decode($body, true);

[9056] Fix | Delete

if (is_array($jsonData) && array_key_exists('success', $jsonData)) {

[9057] Fix | Delete

$purgeWafFailures();

[9058] Fix | Delete

wfConfig::set('lastFalsePositiveSendTime', $mostRecentWhitelisting);

[9059] Fix | Delete

}

[9060] Fix | Delete

}

[9061] Fix | Delete

}

[9062] Fix | Delete

}

[9063] Fix | Delete

}

[9064] Fix | Delete

else if (is_string($okToSendBody) && preg_match('/next check in: ([0-9]+)/', $okToSendBody, $matches)) {

[9065] Fix | Delete

self::delaySendAttackData(time() + $matches[1]);

[9066] Fix | Delete

}

[9067] Fix | Delete

}

[9068] Fix | Delete

else { // Could be that the server is down, so hold off on sending data for a little while

[9069] Fix | Delete

self::delaySendAttackData(time() + 7200);

[9070] Fix | Delete

}

[9071] Fix | Delete

}

[9072] Fix | Delete

else if (!wfConfig::get('other_WFNet', true)) {

[9073] Fix | Delete

wfConfig::set('lastAttackDataSendTime', time());

[9074] Fix | Delete

wfConfig::set('lastFalsePositiveSendTime', time());

[9075] Fix | Delete

self::truncateWafFailures();

[9076] Fix | Delete

}

[9077] Fix | Delete

[9078] Fix | Delete

self::trimWfHits();

[9079] Fix | Delete

}

[9080] Fix | Delete

[9081] Fix | Delete

public static function syncAttackData($exit = true) {

[9082] Fix | Delete

global $wpdb;

[9083] Fix | Delete

if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }

[9084] Fix | Delete

$log = self::getLog();

[9085] Fix | Delete

$waf = wfWAF::getInstance();

[9086] Fix | Delete

$table_wfHits = wfDB::networkTable('wfHits');

[9087] Fix | Delete

if ($waf->getStorageEngine() instanceof wfWAFStorageMySQL) {

[9088] Fix | Delete

$lastAttackMicroseconds = floatval($waf->getStorageEngine()->getConfig('lastAttackDataTruncateTime'));

[9089] Fix | Delete

} else {

[9090] Fix | Delete

$lastAttackMicroseconds = $wpdb->get_var("SELECT MAX(attackLogTime) FROM {$table_wfHits}");

[9091] Fix | Delete

}

[9092] Fix | Delete

[9093] Fix | Delete

if ($waf->getStorageEngine()->hasNewerAttackData($lastAttackMicroseconds)) {

[9094] Fix | Delete

$attackData = $waf->getStorageEngine()->getNewestAttackDataArray($lastAttackMicroseconds);

[9095] Fix | Delete

if ($attackData) {

[9096] Fix | Delete

foreach ($attackData as $request) {

[9097] Fix | Delete

if (count($request) !== 9 && count($request) !== 10 /* with metadata */ && count($request) !== 11) {

[9098] Fix | Delete

continue;

[9099] Fix | Delete

}

[9100] Fix | Delete

[9101] Fix | Delete

list($logTimeMicroseconds, $requestTime, $ip, $learningMode, $paramKey, $paramValue, $failedRules, $ssl, $requestString) = $request;

[9102] Fix | Delete

$metadata = null;

[9103] Fix | Delete

$recordID = null;

[9104] Fix | Delete

if (array_key_exists(9, $request)) {

[9105] Fix | Delete

$metadata = $request[9];

[9106] Fix | Delete

}

[9107] Fix | Delete

if (array_key_exists(10, $request)) {

[9108] Fix | Delete

$recordID = $request[10];

[9109] Fix | Delete

}

[9110] Fix | Delete

[9111] Fix | Delete

// Skip old entries and hits in learning mode, since they'll get picked up anyways.

[9112] Fix | Delete

if ($logTimeMicroseconds <= $lastAttackMicroseconds || $learningMode) {

[9113] Fix | Delete

continue;

[9114] Fix | Delete

}

[9115] Fix | Delete

[9116] Fix | Delete

$statusCode = 403;

[9117] Fix | Delete

[9118] Fix | Delete

$hit = new wfRequestModel();

[9119] Fix | Delete

if (is_numeric($recordID)) {

[9120] Fix | Delete

$hit->id = $recordID;

[9121] Fix | Delete

}

[9122] Fix | Delete

[9123] Fix | Delete

$hit->attackLogTime = $logTimeMicroseconds;

[9124] Fix | Delete

$hit->ctime = $requestTime;

[9125] Fix | Delete

$hit->IP = wfUtils::inet_pton($ip);

[9126] Fix | Delete

[9127] Fix | Delete

if (preg_match('/user\-agent:(.*?)\n/i', $requestString, $matches)) {

[9128] Fix | Delete

$hit->UA = trim($matches[1]);

[9129] Fix | Delete

$hit->isGoogle = wfCrawl::isGoogleCrawler($hit->UA);

[9130] Fix | Delete

}

[9131] Fix | Delete

[9132] Fix | Delete

if (preg_match('/Referer:(.*?)\n/i', $requestString, $matches)) {

[9133] Fix | Delete

$hit->referer = trim($matches[1]);

[9134] Fix | Delete

}

[9135] Fix | Delete

[9136] Fix | Delete

if (preg_match('/^[a-z]+\s+(.*?)\s+/i', $requestString, $uriMatches) && preg_match('/Host:(.*?)\n/i', $requestString, $hostMatches)) {

[9137] Fix | Delete

$hit->URL = 'http' . ($ssl ? 's' : '') . '://' . trim($hostMatches[1]) . trim($uriMatches[1]);

[9138] Fix | Delete

}

[9139] Fix | Delete

[9140] Fix | Delete

$hit->jsRun = (int) wfLog::isHumanRequest($ip, $hit->UA);

[9141] Fix | Delete

$isHuman = !!$hit->jsRun;

[9142] Fix | Delete

[9143] Fix | Delete

if (preg_match('/cookie:(.*?)\n/i', $requestString, $matches)) {

[9144] Fix | Delete

$authCookieName = $waf->getAuthCookieName();

[9145] Fix | Delete

$hasLoginCookie = strpos($matches[1], $authCookieName) !== false;

[9146] Fix | Delete

if ($hasLoginCookie && preg_match('/' . preg_quote($authCookieName) . '=(.*?);/', $matches[1], $cookieMatches)) {

[9147] Fix | Delete

$authCookie = rawurldecode($cookieMatches[1]);

[9148] Fix | Delete

$decodedAuthCookie = $waf->parseAuthCookie($authCookie);

[9149] Fix | Delete

if ($decodedAuthCookie !== false) {

[9150] Fix | Delete

$hit->userID = $decodedAuthCookie['userID'];

[9151] Fix | Delete

$isHuman = true;

[9152] Fix | Delete

}

[9153] Fix | Delete

}

[9154] Fix | Delete

}

[9155] Fix | Delete

[9156] Fix | Delete

$path = '/';

[9157] Fix | Delete

if (preg_match('/^[A-Z]+ (.*?) HTTP\\/1\\.1/', $requestString, $matches)) {

[9158] Fix | Delete

if (($pos = strpos($matches[1], '?')) !== false) {

[9159] Fix | Delete

$path = substr($matches[1], 0, $pos);

[9160] Fix | Delete

} else {

[9161] Fix | Delete

$path = $matches[1];

[9162] Fix | Delete

}

[9163] Fix | Delete

}

[9164] Fix | Delete

[9165] Fix | Delete

$metadata = ($metadata != null ? (array) $metadata : array());

[9166] Fix | Delete

if (isset($metadata['finalAction']) && $metadata['finalAction']) { // The request was blocked/redirected because of its IP based on the plugin's blocking settings. WAF blocks should be reported but not shown in live traffic with that as a reason.

[9167] Fix | Delete

$action = $metadata['finalAction']['action'];

[9168] Fix | Delete

$actionDescription = $action;

[9169] Fix | Delete

if (class_exists('wfWAFIPBlocksController')) {

[9170] Fix | Delete

if ($action == wfWAFIPBlocksController::WFWAF_BLOCK_UAREFIPRANGE) {

[9171] Fix | Delete

wfActivityReport::logBlockedIP($ip, null, 'advanced');

[9172] Fix | Delete

}

[9173] Fix | Delete

else if ($action == wfWAFIPBlocksController::WFWAF_BLOCK_COUNTRY_BYPASS_REDIR) {

[9174] Fix | Delete

/* Handled below */

[9175] Fix | Delete

}

[9176] Fix | Delete

else if ($action == wfWAFIPBlocksController::WFWAF_BLOCK_COUNTRY_REDIR) {

[9177] Fix | Delete

$actionDescription .= ' (' . wfConfig::get('cbl_redirURL') . ')';

[9178] Fix | Delete

wfConfig::inc('totalCountryBlocked');

[9179] Fix | Delete

wfActivityReport::logBlockedIP($ip, null, 'country');

[9180] Fix | Delete

}

[9181] Fix | Delete

else if ($action == wfWAFIPBlocksController::WFWAF_BLOCK_COUNTRY) {

[9182] Fix | Delete

wfConfig::inc('totalCountryBlocked');

[9183] Fix | Delete

wfActivityReport::logBlockedIP($ip, null, 'country');

[9184] Fix | Delete

}

[9185] Fix | Delete

else if ($action == wfWAFIPBlocksController::WFWAF_BLOCK_WFSN) {

[9186] Fix | Delete

wordfence::wfsnReportBlockedAttempt($ip, 'login');

[9187] Fix | Delete

wfActivityReport::logBlockedIP($ip, null, 'brute');

[9188] Fix | Delete

}

[9189] Fix | Delete

else if (defined('wfWAFIPBlocksController::WFWAF_BLOCK_BADPOST') && $action == wfWAFIPBlocksController::WFWAF_BLOCK_BADPOST) {

[9190] Fix | Delete

wfActivityReport::logBlockedIP($ip, null, 'badpost');

[9191] Fix | Delete

}

[9192] Fix | Delete

else if (defined('wfWAFIPBlocksController::WFWAF_BLOCK_BANNEDURL') && $action == wfWAFIPBlocksController::WFWAF_BLOCK_BANNEDURL) {

[9193] Fix | Delete

wfActivityReport::logBlockedIP($ip, null, 'bannedurl');

[9194] Fix | Delete

}

[9195] Fix | Delete

else if (defined('wfWAFIPBlocksController::WFWAF_BLOCK_FAKEGOOGLE') && $action == wfWAFIPBlocksController::WFWAF_BLOCK_FAKEGOOGLE) {

[9196] Fix | Delete

wfActivityReport::logBlockedIP($ip, null, 'fakegoogle');

[9197] Fix | Delete

}

[9198] Fix | Delete

else if ((defined('wfWAFIPBlocksController::WFWAF_BLOCK_LOGINSEC') && $action == wfWAFIPBlocksController::WFWAF_BLOCK_LOGINSEC) ||

[9199] Fix | Delete

(defined('wfWAFIPBlocksController::WFWAF_BLOCK_LOGINSEC_FORGOTPASSWD') && strpos($action, wfWAFIPBlocksController::WFWAF_BLOCK_LOGINSEC_FORGOTPASSWD) === 0) ||

[9200] Fix | Delete

(defined('wfWAFIPBlocksController::WFWAF_BLOCK_LOGINSEC_FAILURES') && strpos($action, wfWAFIPBlocksController::WFWAF_BLOCK_LOGINSEC_FAILURES) === 0)) {

[9201] Fix | Delete

wfActivityReport::logBlockedIP($ip, null, 'brute');

[9202] Fix | Delete

}

[9203] Fix | Delete

else if ((defined('wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLEGLOBAL') && $action == wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLEGLOBAL) ||

[9204] Fix | Delete

(defined('wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLESCAN') && $action == wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLESCAN) ||

[9205] Fix | Delete

(defined('wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLECRAWLER') && $action == wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLECRAWLER) ||

[9206] Fix | Delete

(defined('wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLECRAWLERNOTFOUND') && $action == wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLECRAWLERNOTFOUND) ||

[9207] Fix | Delete

(defined('wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLEHUMAN') && $action == wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLEHUMAN) ||

[9208] Fix | Delete

(defined('wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLEHUMANNOTFOUND') && $action == wfWAFIPBlocksController::WFWAF_BLOCK_THROTTLEHUMANNOTFOUND)

[9209] Fix | Delete

) {

[9210] Fix | Delete

wfConfig::inc('totalIPsThrottled');

[9211] Fix | Delete

wfActivityReport::logBlockedIP($ip, null, 'throttle');

[9212] Fix | Delete

}

[9213] Fix | Delete

else { //Manual block

[9214] Fix | Delete

wfActivityReport::logBlockedIP($ip, null, 'manual');

[9215] Fix | Delete

}

[9216] Fix | Delete

[9217] Fix | Delete

if (isset($metadata['finalAction']['id']) && $action != wfWAFIPBlocksController::WFWAF_BLOCK_COUNTRY_BYPASS_REDIR) {

[9218] Fix | Delete

$id = $metadata['finalAction']['id'];

[9219] Fix | Delete

$block = new wfBlock($id);

[9220] Fix | Delete

$block->recordBlock(1, (int) $requestTime);

[9221] Fix | Delete

}

[9222] Fix | Delete

}

[9223] Fix | Delete

[9224] Fix | Delete

if (strlen($actionDescription) == 0) {

[9225] Fix | Delete

$actionDescription = 'Blocked by Wordfence';

[9226] Fix | Delete

}

[9227] Fix | Delete

[9228] Fix | Delete

if (empty($failedRules)) { // Just a plugin block

[9229] Fix | Delete

$statusCode = 503;

[9230] Fix | Delete

$hit->action = 'blocked:wordfence';

[9231] Fix | Delete

if (class_exists('wfWAFIPBlocksController')) {

[9232] Fix | Delete

if ($action == wfWAFIPBlocksController::WFWAF_BLOCK_COUNTRY_BYPASS_REDIR) {

[9233] Fix | Delete

$statusCode = 302;

[9234] Fix | Delete

$hit->action = 'cbl:redirect';

[9235] Fix | Delete

}

[9236] Fix | Delete

else if ($action == wfWAFIPBlocksController::WFWAF_BLOCK_WFSN) {

[9237] Fix | Delete

$hit->action = 'blocked:wfsnrepeat';

[9238] Fix | Delete

wordfence::wfsnReportBlockedAttempt($ip, 'waf');

[9239] Fix | Delete

}

[9240] Fix | Delete

else if (isset($metadata['finalAction']['lockout'])) {

[9241] Fix | Delete

$hit->action = 'lockedOut';

[9242] Fix | Delete

}

[9243] Fix | Delete

else if (isset($metadata['finalAction']['block'])) {

[9244] Fix | Delete

//Do nothing

[9245] Fix | Delete

}

[9246] Fix | Delete

}

[9247] Fix | Delete

$hit->actionDescription = $actionDescription;

[9248] Fix | Delete

}

[9249] Fix | Delete

else if (preg_match('/\blogged\b/i', $failedRules)) {

[9250] Fix | Delete

$statusCode = 200;

[9251] Fix | Delete

$hit->action = 'logged:waf';

[9252] Fix | Delete

}

[9253] Fix | Delete

else { // Blocked by the WAF but would've been blocked anyway by the plugin settings so that message takes priority

[9254] Fix | Delete

$hit->action = 'blocked:waf-always';

[9255] Fix | Delete

$hit->actionDescription = $actionDescription;

[9256] Fix | Delete

}

[9257] Fix | Delete

}

[9258] Fix | Delete

else {

[9259] Fix | Delete

if (preg_match('/\blogged\b/i', $failedRules)) {

[9260] Fix | Delete

$statusCode = 200;

[9261] Fix | Delete

$hit->action = 'logged:waf';

[9262] Fix | Delete

}

[9263] Fix | Delete

else {

[9264] Fix | Delete

$hit->action = 'blocked:waf';

[9265] Fix | Delete

[9266] Fix | Delete

$type = null;

[9267] Fix | Delete

if ($failedRules == 'blocked') {

[9268] Fix | Delete

$type = 'blacklist';

[9269] Fix | Delete

}

[9270] Fix | Delete

else if (is_numeric($failedRules)) {

[9271] Fix | Delete

$type = 'waf';

[9272] Fix | Delete

}

[9273] Fix | Delete

wfActivityReport::logBlockedIP($hit->IP, null, $type);

[9274] Fix | Delete

}

[9275] Fix | Delete

}

[9276] Fix | Delete

[9277] Fix | Delete

/** @var wfWAFRule $rule */

[9278] Fix | Delete

$ruleIDs = explode('|', $failedRules);

[9279] Fix | Delete

$actionData = array(

[9280] Fix | Delete

'learningMode' => $learningMode,

[9281] Fix | Delete

'failedRules' => $failedRules,

[9282] Fix | Delete

'paramKey' => $paramKey,

[9283] Fix | Delete

'paramValue' => $paramValue,

[9284] Fix | Delete

'path' => $path,

[9285] Fix | Delete

);

[9286] Fix | Delete

if ($ruleIDs && $ruleIDs[0]) {

[9287] Fix | Delete

$rule = $waf->getRule($ruleIDs[0]);

[9288] Fix | Delete

if ($rule) {

[9289] Fix | Delete

if ($hit->action == 'logged:waf' || $hit->action == 'blocked:waf') { $hit->actionDescription = $rule->getDescription(); }

[9290] Fix | Delete

$actionData['category'] = $rule->getCategory();

[9291] Fix | Delete

$actionData['ssl'] = $ssl;

[9292] Fix | Delete

$actionData['fullRequest'] = base64_encode($requestString);

[9293] Fix | Delete

}

[9294] Fix | Delete

else if ($ruleIDs[0] == 'logged' && isset($ruleIDs[1]) && ($rule = $waf->getRule($ruleIDs[1]))) {

[9295] Fix | Delete

if ($hit->action == 'logged:waf' || $hit->action == 'blocked:waf') { $hit->actionDescription = $rule->getDescription(); }

[9296] Fix | Delete

$actionData['category'] = $rule->getCategory();

[9297] Fix | Delete

$actionData['ssl'] = $ssl;

[9298] Fix | Delete

$actionData['fullRequest'] = base64_encode($requestString);

[9299] Fix | Delete

}

[9300] Fix | Delete

else if ($ruleIDs[0] == 'logged') {

[9301] Fix | Delete

if ($hit->action == 'logged:waf' || $hit->action == 'blocked:waf') { $hit->actionDescription = 'Watched IP Traffic: ' . $ip; }

[9302] Fix | Delete

$actionData['category'] = 'logged';

[9303] Fix | Delete

$actionData['ssl'] = $ssl;

[9304] Fix | Delete

$actionData['fullRequest'] = base64_encode($requestString);

[9305] Fix | Delete

}

[9306] Fix | Delete

else if ($ruleIDs[0] == 'blocked') {

[9307] Fix | Delete

$actionData['category'] = 'blocked';

[9308] Fix | Delete

$actionData['ssl'] = $ssl;

[9309] Fix | Delete

$actionData['fullRequest'] = base64_encode($requestString);

[9310] Fix | Delete

}

[9311] Fix | Delete

}

[9312] Fix | Delete

[9313] Fix | Delete

$hit->actionData = wfRequestModel::serializeActionData($actionData, array('fullRequest', 'ssl', 'category', 'learningMode', 'paramValue'));

[9314] Fix | Delete

$hit->statusCode = $statusCode;

[9315] Fix | Delete

$hit->save();

[9316] Fix | Delete

[9317] Fix | Delete

self::scheduleSendAttackData();

[9318] Fix | Delete

}

[9319] Fix | Delete

}

[9320] Fix | Delete

$waf->getStorageEngine()->truncateAttackData();

[9321] Fix | Delete

}

[9322] Fix | Delete

update_site_option('wordfence_syncingAttackData', 0);

[9323] Fix | Delete

update_site_option('wordfence_syncAttackDataAttempts', 0);

[9324] Fix | Delete

update_site_option('wordfence_lastSyncAttackData', time());

[9325] Fix | Delete

if ($exit) {

[9326] Fix | Delete

exit;

[9327] Fix | Delete

}

[9328] Fix | Delete

}

[9329] Fix | Delete

[9330] Fix | Delete

public static function addSyncAttackDataAjax() {

[9331] Fix | Delete

$URL = home_url('/?wordfence_syncAttackData=' . microtime(true));

[9332] Fix | Delete

$URL = esc_url(preg_replace('/^https?:/i', '', $URL));

[9333] Fix | Delete

// Load as external script async so we don't slow page down.

[9334] Fix | Delete

echo "<script type=\"text/javascript\" src=\"$URL\" async></script>";

[9335] Fix | Delete

}

[9336] Fix | Delete

[9337] Fix | Delete

/**

[9338] Fix | Delete

* This is the only hook I see to tie into WP's core update process.

[9339] Fix | Delete

* Since we hide the readme.html to prevent the WordPress version from being discovered, it breaks the upgrade

[9340] Fix | Delete

* process because it cannot copy the previous readme.html.

[9341] Fix | Delete

*

[9342] Fix | Delete

* @param string $string

[9343] Fix | Delete

* @return string

[9344] Fix | Delete

*/

[9345] Fix | Delete

public static function restoreReadmeForUpgrade($string) {

[9346] Fix | Delete

static $didRun;

[9347] Fix | Delete

if (!isset($didRun)) {

[9348] Fix | Delete

$didRun = true;

[9349] Fix | Delete

wfUtils::showReadme();

[9350] Fix | Delete

register_shutdown_function('wfUtils::hideReadme');

[9351] Fix | Delete

}

[9352] Fix | Delete

[9353] Fix | Delete

return $string;

[9354] Fix | Delete

}

[9355] Fix | Delete

[9356] Fix | Delete

public static function showOnboardingBanner() {

[9357] Fix | Delete

wfOnboardingController::enqueue_assets();

[9358] Fix | Delete

if (self::isWordfencePage(false) && !self::isWordfenceInstallPage() && !self::isWordfenceSupportPage() && !self::isWordfenceSubpage('tools', 'diagnostics')) {

[9359] Fix | Delete

echo wfView::create('onboarding/disabled-overlay')->render();

[9360] Fix | Delete

}

[9361] Fix | Delete

echo wfView::create('onboarding/banner', array('dismissable' => !self::isWordfencePage(false)))->render();

[9362] Fix | Delete

}

[9363] Fix | Delete

[9364] Fix | Delete

public static function showCentralConfigurationIssueNotice() {

[9365] Fix | Delete

?>

[9366] Fix | Delete

<div class="fade error">

[9367] Fix | Delete

<p><?php echo wp_kses(sprintf(__('An error was detected with this site\'s configuration that is preventing a successful connection to Wordfence Central. Disconnecting from Central <a href="%s">on the Wordfence Dashboard</a> and reconnecting may resolve it. If the issue persists, please contact Wordfence support.', 'wordfence'), network_admin_url('admin.php?page=Wordfence#wf-central-status')), array('a' => array('href' => array()))) ?></p>

[9368] Fix | Delete

</div>

[9369] Fix | Delete

<?php

[9370] Fix | Delete

}

[9371] Fix | Delete

[9372] Fix | Delete

public static function wafAutoPrependNotice() {

[9373] Fix | Delete

$url = network_admin_url('admin.php?page=WordfenceWAF&subpage=waf_options#configureAutoPrepend');

[9374] Fix | Delete

echo '<div class="update-nag" id="wf-extended-protection-notice">' . __('To make your site as secure as possible, take a moment to optimize the Wordfence Web Application Firewall:', 'wordfence') . ' &nbsp;<a class="wf-btn wf-btn-default wf-btn-sm" href="' . esc_url($url) . '">' . __('Click here to configure', 'wordfence') . '</a>

[9375] Fix | Delete

<a class="wf-btn wf-btn-default wf-btn-sm wf-dismiss-link" href="#" onclick="wordfenceExt.setOption(\'dismissAutoPrependNotice\', 1); jQuery(\'#wf-extended-protection-notice\').fadeOut(); return false;" role="button">' . __('Dismiss', 'wordfence') . '</a>

[9376] Fix | Delete

<br>

[9377] Fix | Delete

<em style="font-size: 85%;">' . wp_kses(sprintf(/* translators: Support URL. */ __('If you cannot complete the setup process, <a target="_blank" rel="noopener noreferrer" href="%s">click here for help<span class="screen-reader-text"> (opens in new tab)</span></a>.', 'wordfence'), wfSupportController::esc_supportURL(wfSupportController::ITEM_FIREWALL_WAF_INSTALL_MANUALLY)), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()), 'span' => array('class' => array()))) . '</em>

[9378] Fix | Delete

</div>';

[9379] Fix | Delete

}

[9380] Fix | Delete

[9381] Fix | Delete

public static function wafAutoPrependVerify() {

[9382] Fix | Delete

if (WFWAF_AUTO_PREPEND && !WFWAF_SUBDIRECTORY_INSTALL) {

[9383] Fix | Delete

echo '<div class="updated is-dismissible"><p>' . __('Nice work! The firewall is now optimized.', 'wordfence') . '</p></div>';

[9384] Fix | Delete

} else {

[9385] Fix | Delete

echo '<div class="notice notice-error"><p>' . __('The changes have not yet taken effect. If you are using LiteSpeed or IIS as your web server or CGI/FastCGI interface, you may need to wait a few minutes for the changes to take effect since the configuration files are sometimes cached. You also may need to select a different server configuration in order to complete this step, but wait for a few minutes before trying. You can try refreshing this page.', 'wordfence') . '</p></div>';

[9386] Fix | Delete

}

[9387] Fix | Delete

}

[9388] Fix | Delete

[9389] Fix | Delete

public static function wafAutoPrependRemoved() {

[9390] Fix | Delete

if (!WFWAF_AUTO_PREPEND) {

[9391] Fix | Delete

echo '<div class="updated is-dismissible"><p>' . __('Uninstallation was successful!', 'wordfence') . '</p></div>';

[9392] Fix | Delete

}

[9393] Fix | Delete

else if (WFWAF_SUBDIRECTORY_INSTALL) {

[9394] Fix | Delete

echo '<div class="notice notice-warning"><p>' . __('Uninstallation from this site was successful! The Wordfence Firewall is still active because it is installed in another WordPress installation.', 'wordfence') . '</p></div>';

[9395] Fix | Delete

}

[9396] Fix | Delete

else {

[9397] Fix | Delete

echo '<div class="notice notice-error"><p>' . __('The changes have not yet taken effect. If you are using LiteSpeed or IIS as your web server or CGI/FastCGI interface, you may need to wait a few minutes for the changes to take effect since the configuration files are sometimes cached. You also may need to select a different server configuration in order to complete this step, but wait for a few minutes before trying. You can try refreshing this page.', 'wordfence') . '</p></div>';

[9398] Fix | Delete

}

[9399] Fix | Delete

}

[9400] Fix | Delete

[9401] Fix | Delete

public static function wafUpdateSuccessful() {

[9402] Fix | Delete

echo '<div class="updated is-dismissible"><p>' . __('The update was successful!', 'wordfence') . '</p></div>';

[9403] Fix | Delete

}

[9404] Fix | Delete

[9405] Fix | Delete

public static function getWAFBootstrapPath() {

[9406] Fix | Delete

if (WF_IS_PRESSABLE || WF_IS_FLYWHEEL) {

[9407] Fix | Delete

return WP_CONTENT_DIR . '/wordfence-waf.php';

[9408] Fix | Delete

}

[9409] Fix | Delete

return ABSPATH . 'wordfence-waf.php';

[9410] Fix | Delete

}

[9411] Fix | Delete

[9412] Fix | Delete

public static function getWAFBootstrapContent($currentAutoPrependedFile = null) {

[9413] Fix | Delete

$bootstrapPath = dirname(self::getWAFBootstrapPath());

[9414] Fix | Delete

$currentAutoPrepend = '';

[9415] Fix | Delete

if ($currentAutoPrependedFile && is_file($currentAutoPrependedFile) && !WFWAF_SUBDIRECTORY_INSTALL) {

[9416] Fix | Delete

$currentAutoPrepend = sprintf('

[9417] Fix | Delete

// This file was the current value of auto_prepend_file during the Wordfence WAF installation (%2$s)

[9418] Fix | Delete

if (file_exists(%1$s)) {

[9419] Fix | Delete

include_once %1$s;

[9420] Fix | Delete

}', var_export($currentAutoPrependedFile, true), date('r'));

[9421] Fix | Delete

}

[9422] Fix | Delete

return sprintf('<?php

[9423] Fix | Delete

// Before removing this file, please verify the PHP ini setting `auto_prepend_file` does not point to this.

[9424] Fix | Delete

%3$s

[9425] Fix | Delete

if (file_exists(__DIR__.%1$s)) {

[9426] Fix | Delete

define("WFWAF_LOG_PATH", __DIR__.%2$s);

[9427] Fix | Delete

include_once __DIR__.%1$s;

[9428] Fix | Delete

}',

[9429] Fix | Delete

var_export(wfUtils::relativePath(WORDFENCE_PATH . 'waf/bootstrap.php', $bootstrapPath, true), true),

[9430] Fix | Delete

var_export(wfUtils::relativePath((WFWAF_SUBDIRECTORY_INSTALL ? WP_CONTENT_DIR . '/wflogs/' : WFWAF_LOG_PATH), $bootstrapPath, true), true),

[9431] Fix | Delete

$currentAutoPrepend);

[9432] Fix | Delete

}

[9433] Fix | Delete

[9434] Fix | Delete

private static function isCurrentUserAdmin() {

[9435] Fix | Delete

return self::getCurrentUserRole() === 'administrator';

[9436] Fix | Delete

}

[9437] Fix | Delete

[9438] Fix | Delete

/**

[9439] Fix | Delete

* @return bool|string

[9440] Fix | Delete

*/

[9441] Fix | Delete

private static function getCurrentUserRole() {

[9442] Fix | Delete

if (current_user_can('administrator') || is_super_admin()) {

[9443] Fix | Delete

return 'administrator';

[9444] Fix | Delete

}

[9445] Fix | Delete

$roles = array('editor', 'author', 'contributor', 'subscriber');

[9446] Fix | Delete

foreach ($roles as $role) {

[9447] Fix | Delete

if (current_user_can($role)) {

[9448] Fix | Delete

return $role;

[9449] Fix | Delete

}

[9450] Fix | Delete

}

[9451] Fix | Delete

return 'other';

[9452] Fix | Delete

}

[9453] Fix | Delete

[9454] Fix | Delete

private static function getCurrentUserCapabilities() {

[9455] Fix | Delete

$capabilities = array(

[9456] Fix | Delete

'manage_options',

[9457] Fix | Delete

'unfiltered_html',

[9458] Fix | Delete

'edit_others_posts',

[9459] Fix | Delete

'upload_files',

[9460] Fix | Delete

'publish_posts',

[9461] Fix | Delete

'edit_posts',

[9462] Fix | Delete

'read',

[9463] Fix | Delete

'manage_network'

[9464] Fix | Delete

);

[9465] Fix | Delete

foreach ($capabilities as $index=>$capability) {

[9466] Fix | Delete

if (!current_user_can($capability)) {

[9467] Fix | Delete

unset($capabilities[$index]);

[9468] Fix | Delete

}

[9469] Fix | Delete

}

[9470] Fix | Delete

return array_values($capabilities);

[9471] Fix | Delete

}

[9472] Fix | Delete

[9473] Fix | Delete

public static function licenseStatusChanged() {

[9474] Fix | Delete

$event = new wfWAFCronFetchRulesEvent(time() - 2);

[9475] Fix | Delete

$event->setWaf(wfWAF::getInstance());

[9476] Fix | Delete

$event->fire();

[9477] Fix | Delete

[9478] Fix | Delete

//Update the WAF cron

[9479] Fix | Delete

$cron = (array) wfWAF::getInstance()->getStorageEngine()->getConfig('cron', null, 'livewaf');

[9480] Fix | Delete

if (is_array($cron)) {

[9481] Fix | Delete

/** @var wfWAFCronEvent $event */

[9482] Fix | Delete

foreach ($cron as $index => $event) {

[9483] Fix | Delete

$event->setWaf(wfWAF::getInstance());

[9484] Fix | Delete

if (!$event->isInPast()) {

[9485] Fix | Delete

$newEvent = $event->reschedule();

[9486] Fix | Delete

if ($newEvent instanceof wfWAFCronEvent && $newEvent !== $event) {

[9487] Fix | Delete

$cron[$index] = $newEvent;

[9488] Fix | Delete

} else {

[9489] Fix | Delete

unset($cron[$index]);

[9490] Fix | Delete

}

[9491] Fix | Delete

}

[9492] Fix | Delete

}

[9493] Fix | Delete

}

[9494] Fix | Delete

wfWAF::getInstance()->getStorageEngine()->setConfig('cron', $cron, 'livewaf');

[9495] Fix | Delete

}

[9496] Fix | Delete

[9497] Fix | Delete

/**

[9498] Fix | Delete

* @param string $adminURL

[9499] Fix | Delete