: str_replace(): Passing null to parameter #2 ($replace) of type array|string is deprecated in
* @param string|null $serverConfig
* @param string|null $currentAutoPrependedFile
public function __construct($serverConfig = null, $currentAutoPrependedFile = null) {
$this->serverConfig = $serverConfig;
$this->currentAutoPrependedFile = $currentAutoPrependedFile;
public function getFilesNeededForBackup() {
$htaccess = wfWAFAutoPrependHelper::getHtaccessPath();
switch ($this->getServerConfig()) {
if (file_exists($htaccess)) {
if ($userIni = ini_get('user_ini.filename')) {
$userIniPath = wfWAFAutoPrependHelper::getUserIniPath();
switch ($this->getServerConfig()) {
if (file_exists($userIniPath)) {
$backups[] = $userIniPath;
public function downloadBackups($index = 0) {
$backups = $this->getFilesNeededForBackup();
if ($backups && array_key_exists($index, $backups)) {
$url = preg_replace('/^https?:\/\//i', '', $url);
$url = preg_replace('/[^a-zA-Z0-9\.]+/', '_', $url);
$url = preg_replace('/^_+/', '', $url);
$url = preg_replace('/_+$/', '', $url);
header('Content-Type: application/octet-stream');
$backupFileName = ltrim(basename($backups[$index]), '.');
header('Content-Disposition: attachment; filename="' . $backupFileName . '_Backup_for_' . $url . '.txt"');
readfile($backups[$index]);
public function getServerConfig() {
return $this->serverConfig;
* @param mixed $serverConfig
public function setServerConfig($serverConfig) {
$this->serverConfig = $serverConfig;
* @param WP_Filesystem_Base $wp_filesystem
* @throws wfWAFAutoPrependHelperException
public function performInstallation($wp_filesystem) {
$bootstrapPath = wordfence::getWAFBootstrapPath();
if (!$wp_filesystem->put_contents($bootstrapPath, wordfence::getWAFBootstrapContent($this->currentAutoPrependedFile))) {
throw new wfWAFAutoPrependHelperException(__('We were unable to create the <code>wordfence-waf.php</code> file in the root of the WordPress installation. It\'s possible WordPress cannot write to the <code>wordfence-waf.php</code> file because of file permissions. Please verify the permissions are correct and retry the installation.', 'wordfence'));
$serverConfig = $this->getServerConfig();
$htaccessPath = wfWAFAutoPrependHelper::getHtaccessPath();
$homePath = dirname($htaccessPath);
$userIniPath = wfWAFAutoPrependHelper::getUserIniPath();
$userIni = ini_get('user_ini.filename');
$userIniHtaccessDirectives = '';
$userIniHtaccessDirectives = sprintf('<Files "%s">
<IfModule mod_authz_core.c>
<IfModule !mod_authz_core.c>
', addcslashes($userIni, '"'));
// .htaccess configuration
$autoPrependDirective = sprintf("# Wordfence WAF
php_value auto_prepend_file '%1\$s'
php_value auto_prepend_file '%1\$s'
php_value auto_prepend_file '%1\$s'
$userIniHtaccessDirectives
", addcslashes($bootstrapPath, "'"));
$escapedBootstrapPath = addcslashes($bootstrapPath, "'");
$autoPrependDirective = sprintf("# Wordfence WAF
php_value auto_prepend_file '%s'
php_value auto_prepend_file '%s'
$userIniHtaccessDirectives
", $escapedBootstrapPath, $escapedBootstrapPath);
$autoPrependDirective = sprintf("# Wordfence WAF
$userIniHtaccessDirectives
", addcslashes($homePath, "'"));
if ($userIniHtaccessDirectives) {
$autoPrependDirective = sprintf("# Wordfence WAF
$userIniHtaccessDirectives
", addcslashes($homePath, "'"));
if (!empty($autoPrependDirective)) {
$htaccessContent = $wp_filesystem->get_contents($htaccessPath);
$regex = '/# Wordfence WAF.*?# END Wordfence WAF/is';
if (preg_match($regex, $htaccessContent, $matches)) {
$htaccessContent = preg_replace($regex, $autoPrependDirective, $htaccessContent);
$htaccessContent .= "\n\n" . $autoPrependDirective;
$htaccessContent = $autoPrependDirective;
if (!$wp_filesystem->put_contents($htaccessPath, $htaccessContent)) {
throw new wfWAFAutoPrependHelperException(__('We were unable to make changes to the .htaccess file. It\'s possible WordPress cannot write to the .htaccess file because of file permissions, which may have been set by another security plugin, or you may have set them manually. Please verify the permissions allow the web server to write to the file, and retry the installation.', 'wordfence'));
if ($serverConfig == 'litespeed') {
$wp_filesystem->touch($htaccessPath);
// .user.ini configuration
$autoPrependIni = sprintf("; Wordfence WAF
", addcslashes($bootstrapPath, "'"));
if (!empty($autoPrependIni)) {
$userIniContent = $wp_filesystem->get_contents($userIniPath);
if (is_string($userIniContent)) {
$userIniContent = str_replace('auto_prepend_file', ';auto_prepend_file', $userIniContent);
$regex = '/; Wordfence WAF.*?; END Wordfence WAF/is';
if (preg_match($regex, $userIniContent, $matches)) {
$userIniContent = preg_replace($regex, $autoPrependIni, $userIniContent);
$userIniContent .= "\n\n" . $autoPrependIni;
$userIniContent = $autoPrependIni;
if (!$wp_filesystem->put_contents($userIniPath, $userIniContent)) {
throw new wfWAFAutoPrependHelperException(sprintf(/* translators: File path. */ __('We were unable to make changes to the %1$s file. It\'s possible WordPress cannot write to the %1$s file because of file permissions. Please verify the permissions are correct and retry the installation.', 'wordfence'), basename($userIniPath)));
* @param WP_Filesystem_Base $wp_filesystem
* @throws wfWAFAutoPrependHelperException
* @return bool Whether or not the .user.ini still has a commented-out auto_prepend_file setting
public function performIniRemoval($wp_filesystem) {
$serverConfig = $this->getServerConfig();
$htaccessPath = wfWAFAutoPrependHelper::getHtaccessPath();
$userIniPath = wfWAFAutoPrependHelper::getUserIniPath();
$userIni = ini_get('user_ini.filename');
$htaccessContent = $wp_filesystem->get_contents($htaccessPath);
if (is_string($htaccessContent)) {
$htaccessContent = preg_replace('/# Wordfence WAF.*?# END Wordfence WAF/is', '', $htaccessContent);
if (!$wp_filesystem->put_contents($htaccessPath, $htaccessContent)) {
throw new wfWAFAutoPrependHelperException(__('We were unable to make changes to the .htaccess file. It\'s possible WordPress cannot write to the .htaccess file because of file permissions, which may have been set by another security plugin, or you may have set them manually. Please verify the permissions allow the web server to write to the file, and retry the installation.', 'wordfence'));
if ($serverConfig == 'litespeed') {
$wp_filesystem->touch($htaccessPath);
$userIniContent = $wp_filesystem->get_contents($userIniPath);
if (is_string($userIniContent)) {
$userIniContent = preg_replace('/; Wordfence WAF.*?; END Wordfence WAF/is', '', $userIniContent);
$userIniContent = str_replace('auto_prepend_file', ';auto_prepend_file', $userIniContent);
if (!$wp_filesystem->put_contents($userIniPath, $userIniContent)) {
throw new wfWAFAutoPrependHelperException(sprintf(/* translators: File path. */ __('We were unable to make changes to the %1$s file. It\'s possible WordPress cannot write to the %1$s file because of file permissions. Please verify the permissions are correct and retry the installation.', 'wordfence'), basename($userIniPath)));
return strpos($userIniContent, 'auto_prepend_file') !== false;
* @param WP_Filesystem_Base $wp_filesystem
* @throws wfWAFAutoPrependHelperException
public function performAutoPrependFileRemoval($wp_filesystem) {
$bootstrapPath = wordfence::getWAFBootstrapPath();
if (!$wp_filesystem->delete($bootstrapPath)) {
throw new wfWAFAutoPrependHelperException(__('We were unable to remove the <code>wordfence-waf.php</code> file in the root of the WordPress installation. It\'s possible WordPress cannot remove the <code>wordfence-waf.php</code> file because of file permissions. Please verify the permissions are correct and retry the removal.', 'wordfence'));
public static function getHtaccessPath() {
return wfUtils::getHomePath() . '.htaccess';
public static function getUserIniPath() {
$userIni = ini_get('user_ini.filename');
return wfUtils::getHomePath() . $userIni;
* Extracts the WAF section from the .htaccess content and returns it (inclusive of the section markers). If not
* present, returns false.
* @param string $htaccessContent
public static function getHtaccessSectionContent($htaccessContent) {
$regex = '/# Wordfence WAF.*?# END Wordfence WAF/is';
if (preg_match($regex, $htaccessContent, $matches)) {
* Extracts the WAF section from the .user.ini content and returns it (inclusive of the section markers). If not
* present, returns false.
* @param string $userIniContent
public static function getUserIniSectionContent($userIniContent) {
$regex = '/; Wordfence WAF.*?; END Wordfence WAF/is';
if (preg_match($regex, $userIniContent, $matches)) {
public function usesUserIni() {
$userIni = ini_get('user_ini.filename');
switch ($this->getServerConfig()) {
public function uninstall() {
/** @var WP_Filesystem_Base $wp_filesystem */
$htaccessPath = wfWAFAutoPrependHelper::getHtaccessPath();
$userIniPath = wfWAFAutoPrependHelper::getUserIniPath();
$adminURL = admin_url('/');
$allow_relaxed_file_ownership = true;
$homePath = dirname($htaccessPath);
if (false === ($credentials = request_filesystem_credentials($adminURL, '', false, $homePath,
array('version', 'locale'), $allow_relaxed_file_ownership))
if (!WP_Filesystem($credentials, $homePath, $allow_relaxed_file_ownership)) {
// Failed to connect, Error and request again
request_filesystem_credentials($adminURL, '', true, ABSPATH, array('version', 'locale'),
$allow_relaxed_file_ownership);
if ($wp_filesystem->errors->get_error_code()) {
if ($wp_filesystem->is_file($htaccessPath)) {
$htaccessContent = $wp_filesystem->get_contents($htaccessPath);
$regex = '/# Wordfence WAF.*?# END Wordfence WAF/is';
if (preg_match($regex, $htaccessContent, $matches)) {
$htaccessContent = preg_replace($regex, '', $htaccessContent);
if (!$wp_filesystem->put_contents($htaccessPath, $htaccessContent)) {
if ($wp_filesystem->is_file($userIniPath)) {
$userIniContent = $wp_filesystem->get_contents($userIniPath);
$regex = '/; Wordfence WAF.*?; END Wordfence WAF/is';
if (preg_match($regex, $userIniContent, $matches)) {
$userIniContent = preg_replace($regex, '', $userIniContent);
if (!$wp_filesystem->put_contents($userIniPath, $userIniContent)) {
$bootstrapPath = wordfence::getWAFBootstrapPath();
if ($wp_filesystem->is_file($bootstrapPath)) {
$wp_filesystem->delete($bootstrapPath);
class wfWAFAutoPrependHelperException extends Exception {