[3500] Fix | Delete

//Intermediate stage of login

[3501] Fix | Delete

if(! $username){ return; }

[3502] Fix | Delete

$userDat = get_user_by('login', $username);

[3503] Fix | Delete

if (!$userDat) {

[3504] Fix | Delete

$userDat = get_user_by('email', $username);

[3505] Fix | Delete

}

[3506] Fix | Delete

[3507] Fix | Delete

self::$userDat = $userDat;

[3508] Fix | Delete

if(preg_match(self::$passwordCodePattern, $passwd, $matches)){

[3509] Fix | Delete

$_POST['wordfence_authFactor'] = $matches[1];

[3510] Fix | Delete

$passwd = preg_replace('/^(.+)\s+wf([a-z0-9 ]+)$/i', '$1', $passwd);

[3511] Fix | Delete

$_POST['pwd'] = $passwd;

[3512] Fix | Delete

}

[3513] Fix | Delete

}

[3514] Fix | Delete

public static function authUserAction($user, $password) {

[3515] Fix | Delete

$lockout = wfBlock::lockoutForIP(wfUtils::getIP());

[3516] Fix | Delete

if ($lockout !== false) {

[3517] Fix | Delete

$lockout->recordBlock();

[3518] Fix | Delete

$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));

[3519] Fix | Delete

require(dirname(__FILE__) . '/wfLockedOut.php');

[3520] Fix | Delete

}

[3521] Fix | Delete

return $user;

[3522] Fix | Delete

}

[3523] Fix | Delete

public static function getWPFileContent($file, $cType, $cName, $cVersion){

[3524] Fix | Delete

if ($cType == 'plugin') {

[3525] Fix | Delete

if (preg_match('#^/?wp-content/plugins/[^/]+/#', $file)) {

[3526] Fix | Delete

$file = preg_replace('#^/?wp-content/plugins/[^/]+/#', '', $file);

[3527] Fix | Delete

}

[3528] Fix | Delete

else {

[3529] Fix | Delete

//If user is using non-standard wp-content dir, then use /plugins/ in pattern to figure out what to strip off

[3530] Fix | Delete

$file = preg_replace('#^.*[^/]+/plugins/[^/]+/#', '', $file);

[3531] Fix | Delete

}

[3532] Fix | Delete

}

[3533] Fix | Delete

else if ($cType == 'theme') {

[3534] Fix | Delete

if (preg_match('#/?wp-content/themes/[^/]+/#', $file)) {

[3535] Fix | Delete

$file = preg_replace('#/?wp-content/themes/[^/]+/#', '', $file);

[3536] Fix | Delete

}

[3537] Fix | Delete

else {

[3538] Fix | Delete

$file = preg_replace('#^.*[^/]+/themes/[^/]+/#', '', $file);

[3539] Fix | Delete

}

[3540] Fix | Delete

}

[3541] Fix | Delete

else if ($cType == 'core') {

[3542] Fix | Delete

//No special processing

[3543] Fix | Delete

}

[3544] Fix | Delete

else {

[3545] Fix | Delete

return array('errorMsg' => __('An invalid type was specified to get file.', 'wordfence'));

[3546] Fix | Delete

}

[3547] Fix | Delete

[3548] Fix | Delete

$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());

[3549] Fix | Delete

try {

[3550] Fix | Delete

$contResult = $api->binCall('get_wp_file_content', array(

[3551] Fix | Delete

'v' => wfUtils::getWPVersion(),

[3552] Fix | Delete

'file' => $file,

[3553] Fix | Delete

'cType' => $cType,

[3554] Fix | Delete

'cName' => $cName,

[3555] Fix | Delete

'cVersion' => $cVersion

[3556] Fix | Delete

));

[3557] Fix | Delete

if ($contResult['data']) {

[3558] Fix | Delete

return array('fileContent' => $contResult['data']);

[3559] Fix | Delete

}

[3560] Fix | Delete

[3561] Fix | Delete

throw new Exception(__('We could not fetch a core WordPress file from the Wordfence API.', 'wordfence'));

[3562] Fix | Delete

}

[3563] Fix | Delete

catch (Exception $e) {

[3564] Fix | Delete

return array('errorMsg' => wp_kses($e->getMessage(), array()));

[3565] Fix | Delete

}

[3566] Fix | Delete

}

[3567] Fix | Delete

public static function ajax_sendDiagnostic_callback(){

[3568] Fix | Delete

add_filter('gettext', 'wordfence::_diagnosticsTranslationDisabler', 0, 3);

[3569] Fix | Delete

$inEmail = true;

[3570] Fix | Delete

$body = "<style>.screen-reader-text{ display: none !important; }</style>This email is the diagnostic from " . site_url() . ".\nThe IP address that requested this was: " . wfUtils::getIP() . "\nTicket Number/Forum Username: " . $_POST['ticket'];

[3571] Fix | Delete

$sendingDiagnosticEmail = true;

[3572] Fix | Delete

ob_start();

[3573] Fix | Delete

require(dirname(__FILE__) . '/menu_tools_diagnostic.php');

[3574] Fix | Delete

$body = nl2br($body) . ob_get_clean();

[3575] Fix | Delete

$findReplace = array(

[3576] Fix | Delete

'<div class="wf-block-header">' => '<div style="margin:20px 0px 0px;padding:6px 4px;background-color:#222;color:#fff;width:926px;">',

[3577] Fix | Delete

'<th ' => '<th style="text-align:left;background-color:#222;color:#fff;"',

[3578] Fix | Delete

'<th>' => '<th style="text-align:left;background-color:#222;color:#fff;">',

[3579] Fix | Delete

' class="wf-result-success"' => ' style="font-weight:bold;color:#008c10;" class="wf-result-success"',

[3580] Fix | Delete

' class="wf-result-error"' => ' style="font-weight:bold;color:#d0514c;" class="wf-result-error"',

[3581] Fix | Delete

' class="wf-result-inactive"' => ' style="font-weight:bold;color:#666666;" class="wf-result-inactive"',

[3582] Fix | Delete

);

[3583] Fix | Delete

$body = str_replace(array_keys($findReplace), array_values($findReplace), $body);

[3584] Fix | Delete

$result = wfUtils::htmlEmail($_POST['email'], '[Wordfence] Diagnostic results (' . $_POST['ticket'] . ')', $body);

[3585] Fix | Delete

if (function_exists('remove_filter')) { remove_filter('gettext', 'wordfence::_diagnosticsTranslationDisabler', 0); } //Remove for consistency. It's okay if it doesn't pre-4.7.0 since the call exits anyway.

[3586] Fix | Delete

return compact('result');

[3587] Fix | Delete

}

[3588] Fix | Delete

public static function ajax_exportDiagnostics_callback(){

[3589] Fix | Delete

add_filter('gettext', 'wordfence::_diagnosticsTranslationDisabler', 0, 3);

[3590] Fix | Delete

[3591] Fix | Delete

$url = site_url();

[3592] Fix | Delete

$url = preg_replace('/^https?:\/\//i', '', $url);

[3593] Fix | Delete

$url = preg_replace('/[^a-zA-Z0-9\.]+/', '_', $url);

[3594] Fix | Delete

$url = preg_replace('/^_+/', '', $url);

[3595] Fix | Delete

$url = preg_replace('/_+$/', '', $url);

[3596] Fix | Delete

[3597] Fix | Delete

header('Content-Type: application/octet-stream');

[3598] Fix | Delete

header('Content-Disposition: attachment; filename="diagnostics_for_' . $url . '.txt"');

[3599] Fix | Delete

[3600] Fix | Delete

echo wfView::create('diagnostics/text', array(

[3601] Fix | Delete

'diagnostic' => new wfDiagnostic,

[3602] Fix | Delete

'plugins' => get_plugins(),

[3603] Fix | Delete

));

[3604] Fix | Delete

exit;

[3605] Fix | Delete

}

[3606] Fix | Delete

public static function _diagnosticsTranslationDisabler($translation, $text, $domain) {

[3607] Fix | Delete

return $text;

[3608] Fix | Delete

}

[3609] Fix | Delete

public static function ajax_sendTestEmail_callback(){

[3610] Fix | Delete

$rawEmails = explode(",", $_POST['email']);

[3611] Fix | Delete

$emails = array();

[3612] Fix | Delete

foreach ($rawEmails as $e) {

[3613] Fix | Delete

$e = trim($e);

[3614] Fix | Delete

if (wfUtils::isValidEmail($e)) {

[3615] Fix | Delete

$emails[] = $e;

[3616] Fix | Delete

}

[3617] Fix | Delete

}

[3618] Fix | Delete

$result = false;

[3619] Fix | Delete

if (count($emails)) {

[3620] Fix | Delete

$result = wp_mail(implode(', ', $emails), __('Wordfence Test Email', 'wordfence'), sprintf(/* translators: 1. Site URL. 2. IP address. */ __("This is a test email from %1\$s.\nThe IP address that requested this was: %2\$s", 'wordfence'), site_url(), wfUtils::getIP()));

[3621] Fix | Delete

}

[3622] Fix | Delete

$result = $result ? 'True' : 'False';

[3623] Fix | Delete

return array('result' => $result);

[3624] Fix | Delete

}

[3625] Fix | Delete

public static function ajax_addTwoFactor_callback(){

[3626] Fix | Delete

if(! wfConfig::get('isPaid')){

[3627] Fix | Delete

return array('errorMsg' => __('Cellphone Sign-in is only available to paid members. <a href="https://www.wordfence.com/gnl1twoFac3/wordfence-signup/" target="_blank" rel="noopener noreferrer">Click here to upgrade now.<span class="screen-reader-text"> (' . esc_html__('opens in new tab', 'wordfence') . ')</span></a>', 'wordfence'));

[3628] Fix | Delete

}

[3629] Fix | Delete

$username = sanitize_text_field($_POST['username']);

[3630] Fix | Delete

$phone = sanitize_text_field($_POST['phone']);

[3631] Fix | Delete

$mode = sanitize_text_field($_POST['mode']);

[3632] Fix | Delete

$user = get_user_by('login', $username);

[3633] Fix | Delete

if(! $user){

[3634] Fix | Delete

return array('errorMsg' => __("The username you specified does not exist.", 'wordfence'));

[3635] Fix | Delete

}

[3636] Fix | Delete

[3637] Fix | Delete

$twoFactorUsers = wfConfig::get_ser('twoFactorUsers', array());

[3638] Fix | Delete

if (!is_array($twoFactorUsers)) {

[3639] Fix | Delete

$twoFactorUsers = array();

[3640] Fix | Delete

}

[3641] Fix | Delete

for ($i = 0; $i < sizeof($twoFactorUsers); $i++) {

[3642] Fix | Delete

if ($twoFactorUsers[$i][0] == $user->ID) {

[3643] Fix | Delete

return array('errorMsg' => __("The username you specified is already enabled.", 'wordfence'));

[3644] Fix | Delete

}

[3645] Fix | Delete

}

[3646] Fix | Delete

[3647] Fix | Delete

if ($mode != 'phone' && $mode != 'authenticator') {

[3648] Fix | Delete

return array('errorMsg' => __("Unknown authentication mode.", 'wordfence'));

[3649] Fix | Delete

}

[3650] Fix | Delete

[3651] Fix | Delete

if ($mode == 'phone') {

[3652] Fix | Delete

if (!preg_match('/^\+\d[\d\-\(\)\s]+$/', $phone)) {

[3653] Fix | Delete

return array('errorMsg' => __("The phone number you entered must start with a '+', then country code and then area code and number. For example, a number in the United States with country code '1' would look like this: +1-123-555-1234", 'wordfence'));

[3654] Fix | Delete

}

[3655] Fix | Delete

$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());

[3656] Fix | Delete

try {

[3657] Fix | Delete

$codeResult = $api->call('twoFactorTOTP_register', array(), array('phone' => $phone, 'mode' => $mode));

[3658] Fix | Delete

}

[3659] Fix | Delete

catch (Exception $e) {

[3660] Fix | Delete

return array('errorMsg' => sprintf(__("Could not contact Wordfence servers to generate a verification code: %s", 'wordfence'), wp_kses($e->getMessage(), array())));

[3661] Fix | Delete

}

[3662] Fix | Delete

[3663] Fix | Delete

$recoveryCodes = preg_replace('/[^a-f0-9]/i', '', $codeResult['recoveryCodes']);

[3664] Fix | Delete

[3665] Fix | Delete

if (isset($codeResult['ok']) && $codeResult['ok']) {

[3666] Fix | Delete

$secretID = $codeResult['id'];

[3667] Fix | Delete

}

[3668] Fix | Delete

else if (isset($codeResult['errorMsg']) && $codeResult['errorMsg']) {

[3669] Fix | Delete

return array('errorMsg' => wp_kses($codeResult['errorMsg'], array()));

[3670] Fix | Delete

}

[3671] Fix | Delete

else {

[3672] Fix | Delete

wordfence::status(4, 'info', sprintf(__("Could not generate verification code: %s", 'wordfence'), var_export($codeResult, true)));

[3673] Fix | Delete

return array('errorMsg' => __("We could not generate a verification code.", 'wordfence'));

[3674] Fix | Delete

}

[3675] Fix | Delete

self::twoFactorAdd($user->ID, $phone, '', 'phone', $secretID);

[3676] Fix | Delete

return array(

[3677] Fix | Delete

'ok' => 1,

[3678] Fix | Delete

'userID' => $user->ID,

[3679] Fix | Delete

'username' => $username,

[3680] Fix | Delete

'homeurl' => preg_replace('#.*?//#', '', get_home_url()),

[3681] Fix | Delete

'mode' => $mode,

[3682] Fix | Delete

'phone' => $phone,

[3683] Fix | Delete

'recoveryCodes' => $recoveryCodes,

[3684] Fix | Delete

);

[3685] Fix | Delete

}

[3686] Fix | Delete

else if ($mode == 'authenticator') {

[3687] Fix | Delete

$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());

[3688] Fix | Delete

try {

[3689] Fix | Delete

$codeResult = $api->call('twoFactorTOTP_register', array(), array('mode' => $mode));

[3690] Fix | Delete

}

[3691] Fix | Delete

catch (Exception $e) {

[3692] Fix | Delete

return array('errorMsg' => sprintf(/* translators: Error message. */ __("Could not contact Wordfence servers to generate a verification code: %s", 'wordfence'), wp_kses($e->getMessage(), array())));

[3693] Fix | Delete

}

[3694] Fix | Delete

[3695] Fix | Delete

/* Expected Fields:

[3696] Fix | Delete

'ok' => 1,

[3697] Fix | Delete

'secret' => $secret,

[3698] Fix | Delete

'base32Secret' => $base32Secret,

[3699] Fix | Delete

'recoveryCodes' => $codes,

[3700] Fix | Delete

'uriQueryString' => $uriQueryString,

[3701] Fix | Delete

'id' => $recordID,

[3702] Fix | Delete

*/

[3703] Fix | Delete

[3704] Fix | Delete

$secret = preg_replace('/[^a-f0-9]/i', '', $codeResult['secret']);

[3705] Fix | Delete

$base32Secret = preg_replace('/[^a-z2-7]/i', '', $codeResult['base32Secret']); //Encoded in base32

[3706] Fix | Delete

$recoveryCodes = preg_replace('/[^a-f0-9]/i', '', $codeResult['recoveryCodes']);

[3707] Fix | Delete

$uriQueryString = preg_replace('/[^a-z0-9=&]/i', '', $codeResult['uriQueryString']);

[3708] Fix | Delete

[3709] Fix | Delete

if (isset($codeResult['ok']) && $codeResult['ok']) {

[3710] Fix | Delete

$secretID = $codeResult['id'];

[3711] Fix | Delete

}

[3712] Fix | Delete

else if (isset($codeResult['errorMsg']) && $codeResult['errorMsg']) {

[3713] Fix | Delete

return array('errorMsg' => wp_kses($codeResult['errorMsg'], array()));

[3714] Fix | Delete

}

[3715] Fix | Delete

else {

[3716] Fix | Delete

wordfence::status(4, 'info', sprintf(/* translators: Error message. */ __("Could not generate verification code: %s", 'wordfence'), var_export($codeResult, true)));

[3717] Fix | Delete

return array('errorMsg' => __("We could not generate a verification code.", 'wordfence'));

[3718] Fix | Delete

}

[3719] Fix | Delete

self::twoFactorAdd($user->ID, '', '', 'authenticator', $secretID);

[3720] Fix | Delete

return array(

[3721] Fix | Delete

'ok' => 1,

[3722] Fix | Delete

'userID' => $user->ID,

[3723] Fix | Delete

'username' => $username,

[3724] Fix | Delete

'homeurl' => preg_replace('#.*?//#', '', get_home_url()),

[3725] Fix | Delete

'mode' => $mode,

[3726] Fix | Delete

'secret' => $secret,

[3727] Fix | Delete

'base32Secret' => $base32Secret,

[3728] Fix | Delete

'recoveryCodes' => $recoveryCodes,

[3729] Fix | Delete

'uriQueryString' => $uriQueryString,

[3730] Fix | Delete

);

[3731] Fix | Delete

}

[3732] Fix | Delete

[3733] Fix | Delete

return array('errorMsg' => __("Unknown two-factor authentication mode.", 'wordfence'));

[3734] Fix | Delete

}

[3735] Fix | Delete

public static function ajax_twoFacActivate_callback() {

[3736] Fix | Delete

$userID = sanitize_text_field($_POST['userID']);

[3737] Fix | Delete

$code = sanitize_text_field($_POST['code']);

[3738] Fix | Delete

$twoFactorUsers = wfConfig::get_ser('twoFactorUsers', array());

[3739] Fix | Delete

if (!is_array($twoFactorUsers)) {

[3740] Fix | Delete

$twoFactorUsers = array();

[3741] Fix | Delete

}

[3742] Fix | Delete

$found = false;

[3743] Fix | Delete

$user = false;

[3744] Fix | Delete

for ($i = 0; $i < sizeof($twoFactorUsers); $i++) {

[3745] Fix | Delete

if ($twoFactorUsers[$i][0] == $userID) {

[3746] Fix | Delete

$mode = 'phone';

[3747] Fix | Delete

if (isset($twoFactorUsers[$i][5]) && $twoFactorUsers[$i][5] == 'authenticator') {

[3748] Fix | Delete

$mode = 'authenticator';

[3749] Fix | Delete

}

[3750] Fix | Delete

$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());

[3751] Fix | Delete

try {

[3752] Fix | Delete

$codeResult = $api->call('twoFactorTOTP_verify', array(), array('totpid' => $twoFactorUsers[$i][6], 'code' => $code, 'mode' => $mode));

[3753] Fix | Delete

}

[3754] Fix | Delete

catch (Exception $e) {

[3755] Fix | Delete

return array('errorMsg' => sprintf(/* translators: Error message. */ __("Could not contact Wordfence servers to generate a verification code: %s", 'wordfence'), wp_kses($e->getMessage(), array())));

[3756] Fix | Delete

}

[3757] Fix | Delete

[3758] Fix | Delete

if (isset($codeResult['ok']) && $codeResult['ok']) {

[3759] Fix | Delete

$twoFactorUsers[$i][3] = 'activated';

[3760] Fix | Delete

$twoFactorUsers[$i][4] = 0;

[3761] Fix | Delete

$found = true;

[3762] Fix | Delete

$user = $twoFactorUsers[$i];

[3763] Fix | Delete

break;

[3764] Fix | Delete

}

[3765] Fix | Delete

else {

[3766] Fix | Delete

return array('errorMsg' => __("The code you entered is invalid. Cellphone sign-in will not be enabled for this user until you enter a valid code.", 'wordfence'));

[3767] Fix | Delete

}

[3768] Fix | Delete

}

[3769] Fix | Delete

}

[3770] Fix | Delete

if(! $found){

[3771] Fix | Delete

return array('errorMsg' => __("We could not find the user you are trying to activate. They may have been removed from the list of Cellphone Sign-in users. Please reload this page.", 'wordfence'));

[3772] Fix | Delete

}

[3773] Fix | Delete

wfConfig::set_ser('twoFactorUsers', $twoFactorUsers);

[3774] Fix | Delete

$WPuser = get_userdata($userID);

[3775] Fix | Delete

if ($mode == 'authenticator') {

[3776] Fix | Delete

return array(

[3777] Fix | Delete

'ok' => 1,

[3778] Fix | Delete

'userID' => $userID,

[3779] Fix | Delete

'username' => $WPuser->user_login,

[3780] Fix | Delete

'status' => 'activated',

[3781] Fix | Delete

'mode' => 'authenticator'

[3782] Fix | Delete

);

[3783] Fix | Delete

}

[3784] Fix | Delete

[3785] Fix | Delete

return array(

[3786] Fix | Delete

'ok' => 1,

[3787] Fix | Delete

'userID' => $userID,

[3788] Fix | Delete

'username' => $WPuser->user_login,

[3789] Fix | Delete

'phone' => $user[1],

[3790] Fix | Delete

'status' => 'activated',

[3791] Fix | Delete

'mode' => 'phone'

[3792] Fix | Delete

);

[3793] Fix | Delete

}

[3794] Fix | Delete

private static function twoFactorAdd($ID, $phone, $code, $mode, $totpID){

[3795] Fix | Delete

$twoFactorUsers = wfConfig::get_ser('twoFactorUsers', array());

[3796] Fix | Delete

if(! is_array($twoFactorUsers)){

[3797] Fix | Delete

$twoFactorUsers = array();

[3798] Fix | Delete

}

[3799] Fix | Delete

for($i = 0; $i < sizeof($twoFactorUsers); $i++){

[3800] Fix | Delete

if($twoFactorUsers[$i][0] == $ID || (! $twoFactorUsers[$i][0]) ){

[3801] Fix | Delete

array_splice($twoFactorUsers, $i, 1);

[3802] Fix | Delete

$i--;

[3803] Fix | Delete

}

[3804] Fix | Delete

}

[3805] Fix | Delete

$twoFactorUsers[] = array($ID, $phone, $code /* deprecated parameter */, 'notActivated', time() + (86400 * 30) /* deprecated parameter */, $mode, $totpID); //expiry of code is 30 days in future

[3806] Fix | Delete

wfConfig::set_ser('twoFactorUsers', $twoFactorUsers);

[3807] Fix | Delete

}

[3808] Fix | Delete

public static function ajax_loadTwoFactor_callback() {

[3809] Fix | Delete

$users = wfConfig::get_ser('twoFactorUsers', array());

[3810] Fix | Delete

$ret = array();

[3811] Fix | Delete

foreach ($users as $user) {

[3812] Fix | Delete

$WPuser = get_userdata($user[0]);

[3813] Fix | Delete

if ($user) {

[3814] Fix | Delete

if (isset($user[5]) && $user[5] == 'authenticator') {

[3815] Fix | Delete

$ret[] = array(

[3816] Fix | Delete

'userID' => $user[0],

[3817] Fix | Delete

'username' => $WPuser->user_login,

[3818] Fix | Delete

'status' => $user[3],

[3819] Fix | Delete

'mode' => 'authenticator'

[3820] Fix | Delete

);

[3821] Fix | Delete

}

[3822] Fix | Delete

else {

[3823] Fix | Delete

$ret[] = array(

[3824] Fix | Delete

'userID' => $user[0],

[3825] Fix | Delete

'username' => $WPuser->user_login,

[3826] Fix | Delete

'phone' => $user[1],

[3827] Fix | Delete

'status' => $user[3],

[3828] Fix | Delete

'mode' => 'phone'

[3829] Fix | Delete

);

[3830] Fix | Delete

}

[3831] Fix | Delete

}

[3832] Fix | Delete

}

[3833] Fix | Delete

return array('ok' => 1, 'users' => $ret);

[3834] Fix | Delete

}

[3835] Fix | Delete

public static function ajax_twoFacDel_callback(){

[3836] Fix | Delete

$ID = $_POST['userID'];

[3837] Fix | Delete

$twoFactorUsers = wfConfig::get_ser('twoFactorUsers', array());

[3838] Fix | Delete

if(! is_array($twoFactorUsers)){

[3839] Fix | Delete

$twoFactorUsers = array();

[3840] Fix | Delete

}

[3841] Fix | Delete

$deleted = false;

[3842] Fix | Delete

for($i = 0; $i < sizeof($twoFactorUsers); $i++){

[3843] Fix | Delete

if($twoFactorUsers[$i][0] == $ID){

[3844] Fix | Delete

array_splice($twoFactorUsers, $i, 1);

[3845] Fix | Delete

$deleted = true;

[3846] Fix | Delete

$i--;

[3847] Fix | Delete

}

[3848] Fix | Delete

}

[3849] Fix | Delete

wfConfig::set_ser('twoFactorUsers', $twoFactorUsers);

[3850] Fix | Delete

if($deleted){

[3851] Fix | Delete

return array('ok' => 1, 'userID' => $ID);

[3852] Fix | Delete

} else {

[3853] Fix | Delete

return array('errorMsg' => __("That user has already been removed from the list.", 'wordfence'));

[3854] Fix | Delete

}

[3855] Fix | Delete

}

[3856] Fix | Delete

public static function getNextScanStartTimestamp() {

[3857] Fix | Delete

$nextTime = false;

[3858] Fix | Delete

$cron = _get_cron_array();

[3859] Fix | Delete

foreach($cron as $key => $val){

[3860] Fix | Delete

if(isset($val['wordfence_start_scheduled_scan'])){

[3861] Fix | Delete

$nextTime = $key;

[3862] Fix | Delete

break;

[3863] Fix | Delete

}

[3864] Fix | Delete

}

[3865] Fix | Delete

return $nextTime;

[3866] Fix | Delete

}

[3867] Fix | Delete

public static function getNextScanStartTime($nextTime = null) {

[3868] Fix | Delete

if ($nextTime === null) {

[3869] Fix | Delete

$nextTime = wfScanner::shared()->nextScheduledScanTime();

[3870] Fix | Delete

}

[3871] Fix | Delete

[3872] Fix | Delete

if (!$nextTime) {

[3873] Fix | Delete

return __('No scan is scheduled', 'wordfence');

[3874] Fix | Delete

}

[3875] Fix | Delete

[3876] Fix | Delete

$difference = $nextTime - time();

[3877] Fix | Delete

if ($difference < 1) {

[3878] Fix | Delete

return __("Next scan is starting now", 'wordfence');

[3879] Fix | Delete

}

[3880] Fix | Delete

[3881] Fix | Delete

return sprintf(/* translators: 1. Time until. 2. Localized date. */ __('Next scan in %1$s (%2$s)', 'wordfence'), wfUtils::makeDuration($difference), date_i18n('M j, Y g:i:s A', $nextTime + (3600 * get_option('gmt_offset'))));

[3882] Fix | Delete

}

[3883] Fix | Delete

public static function wordfenceStartScheduledScan($scheduledStartTime) {

[3884] Fix | Delete

[3885] Fix | Delete

//If scheduled scans are not enabled in the global config option, then don't run a scheduled scan.

[3886] Fix | Delete

if(wfConfig::get('scheduledScansEnabled') != '1'){

[3887] Fix | Delete

return;

[3888] Fix | Delete

}

[3889] Fix | Delete

[3890] Fix | Delete

$minimumFrequency = (wfScanner::shared()->schedulingMode() == wfScanner::SCAN_SCHEDULING_MODE_MANUAL ? 1800 : 43200);

[3891] Fix | Delete

$lastScanStart = wfConfig::get('lastScheduledScanStart', 0);

[3892] Fix | Delete

if($lastScanStart && (time() - $lastScanStart) < $minimumFrequency){

[3893] Fix | Delete

//A scheduled scan was started in the last 30 mins (manual schedule) or 12 hours (automatic schedule), so skip this one.

[3894] Fix | Delete

return;

[3895] Fix | Delete

}

[3896] Fix | Delete

wfConfig::set('originalScheduledScanStart', $scheduledStartTime);

[3897] Fix | Delete

wfConfig::set('lastScheduledScanStart', time());

[3898] Fix | Delete

wordfence::status(1, 'info', sprintf(/* translators: Localized date. */ __("Scheduled Wordfence scan starting at %s", 'wordfence'), date('l jS \of F Y h:i:s A', current_time('timestamp'))) );

[3899] Fix | Delete

[3900] Fix | Delete

//We call this before the scan actually starts to advance the schedule for the next week.

[3901] Fix | Delete

//This ensures that if the scan crashes for some reason, the schedule will hold.

[3902] Fix | Delete

wfScanner::shared()->scheduleScans();

[3903] Fix | Delete

[3904] Fix | Delete

try {

[3905] Fix | Delete

wfScanEngine::startScan();

[3906] Fix | Delete

}

[3907] Fix | Delete

catch (wfScanEngineTestCallbackFailedException $e) {

[3908] Fix | Delete

wfConfig::set('lastScanCompleted', $e->getMessage());

[3909] Fix | Delete

wfConfig::set('lastScanFailureType', wfIssues::SCAN_FAILED_CALLBACK_TEST_FAILED);

[3910] Fix | Delete

wfUtils::clearScanLock();

[3911] Fix | Delete

}

[3912] Fix | Delete

catch (Exception $e) {

[3913] Fix | Delete

if ($e->getCode() != wfScanEngine::SCAN_MANUALLY_KILLED) {

[3914] Fix | Delete

wfConfig::set('lastScanCompleted', $e->getMessage());

[3915] Fix | Delete

wfConfig::set('lastScanFailureType', wfIssues::SCAN_FAILED_GENERAL);

[3916] Fix | Delete

}

[3917] Fix | Delete

}

[3918] Fix | Delete

}

[3919] Fix | Delete

public static function ajax_saveCountryBlocking_callback(){

[3920] Fix | Delete

if(! wfConfig::get('isPaid')){

[3921] Fix | Delete

return array('errorMsg' => __("Sorry but this feature is only available for paid customers.", 'wordfence'));

[3922] Fix | Delete

}

[3923] Fix | Delete

wfConfig::set('cbl_action', $_POST['blockAction']);

[3924] Fix | Delete

wfConfig::set('cbl_countries', $_POST['codes']);

[3925] Fix | Delete

wfConfig::set('cbl_redirURL', $_POST['redirURL']);

[3926] Fix | Delete

wfConfig::set('cbl_loggedInBlocked', $_POST['loggedInBlocked']);

[3927] Fix | Delete

wfConfig::set('cbl_loginFormBlocked', $_POST['loginFormBlocked']);

[3928] Fix | Delete

wfConfig::set('cbl_restOfSiteBlocked', $_POST['restOfSiteBlocked']);

[3929] Fix | Delete

wfConfig::set('cbl_bypassRedirURL', $_POST['bypassRedirURL']);

[3930] Fix | Delete

wfConfig::set('cbl_bypassRedirDest', $_POST['bypassRedirDest']);

[3931] Fix | Delete

wfConfig::set('cbl_bypassViewURL', $_POST['bypassViewURL']);

[3932] Fix | Delete

return array('ok' => 1);

[3933] Fix | Delete

}

[3934] Fix | Delete

public static function ajax_sendActivityLog_callback(){

[3935] Fix | Delete

$content = sprintf(/* translators: Site URL. */ __('SITE: %s', 'wordfence'), site_url()) . "\n";

[3936] Fix | Delete

$content .= sprintf(/* translators: Plugin version. */ __('PLUGIN VERSION: %s', 'wordfence'), WORDFENCE_VERSION) . "\n";

[3937] Fix | Delete

$content .= sprintf(/* translators: WordPress version. */ __('WORDPRESS VERSION: %s', 'wordfence'), wfUtils::getWPVersion()) . "\n";

[3938] Fix | Delete

$content .= sprintf(/* translators: Wordfence license key. */ __('LICENSE KEY: %s', 'wordfence'), wfConfig::get('apiKey')) . "\n";

[3939] Fix | Delete

$content .= sprintf(/* translators: Email address. */ __('ADMIN EMAIL: %s', 'wordfence'), get_option('admin_email')) . "\n";

[3940] Fix | Delete

$content .= __('LOG:', 'wordfence') . "\n\n";

[3941] Fix | Delete

[3942] Fix | Delete

$wfdb = new wfDB();

[3943] Fix | Delete

$table_wfStatus = wfDB::networkTable('wfStatus');

[3944] Fix | Delete

$q = $wfdb->querySelect("select ctime, level, type, msg from {$table_wfStatus} order by ctime desc limit 10000");

[3945] Fix | Delete

$timeOffset = 3600 * get_option('gmt_offset');

[3946] Fix | Delete

foreach($q as $r){

[3947] Fix | Delete

if($r['type'] == 'error'){

[3948] Fix | Delete

$content .= "\n";

[3949] Fix | Delete

}

[3950] Fix | Delete

$content .= date(DATE_RFC822, intval($r['ctime']) + $timeOffset) . '::' . sprintf('%.4f', $r['ctime']) . ':' . $r['level'] . ':' . $r['type'] . '::' . wp_kses_data( (string) $r['msg']) . "\n";

[3951] Fix | Delete

}

[3952] Fix | Delete

$content .= "\n\n";

[3953] Fix | Delete

$content .= str_repeat('-', 80);

[3954] Fix | Delete

$content .= "\n\n";

[3955] Fix | Delete

[3956] Fix | Delete

$content .= __('# Scan Issues', 'wordfence') . "\n\n";

[3957] Fix | Delete

$issues = wfIssues::shared()->getIssues(0, 50, 0, 50);

[3958] Fix | Delete

$issueCounts = array_merge(array('new' => 0, 'ignoreP' => 0, 'ignoreC' => 0), wfIssues::shared()->getIssueCounts());

[3959] Fix | Delete

$issueTypes = wfIssues::validIssueTypes();

[3960] Fix | Delete

[3961] Fix | Delete

$content .= sprintf(/* translators: Number of scan results. */ __('## New Issues (%d total)', 'wordfence'), $issueCounts['new']) . "\n\n";

[3962] Fix | Delete

if (isset($issues['new']) && count($issues['new'])) {

[3963] Fix | Delete

foreach ($issues['new'] as $i) {

[3964] Fix | Delete

if (!in_array($i['type'], $issueTypes)) {

[3965] Fix | Delete

continue;

[3966] Fix | Delete

}

[3967] Fix | Delete

[3968] Fix | Delete

$viewContent = '';

[3969] Fix | Delete

try {

[3970] Fix | Delete

$viewContent = wfView::create('scanner/issue-' . $i['type'], array('textOutput' => $i))->render();

[3971] Fix | Delete

}

[3972] Fix | Delete

catch (wfViewNotFoundException $e) {

[3973] Fix | Delete

//Ignore -- should never happen since we validate the type

[3974] Fix | Delete

}

[3975] Fix | Delete

[3976] Fix | Delete

if (!empty($viewContent)) {

[3977] Fix | Delete

$content .= $viewContent . "\n\n";

[3978] Fix | Delete

}

[3979] Fix | Delete

}

[3980] Fix | Delete

}

[3981] Fix | Delete

else {

[3982] Fix | Delete

$content .= __('No New Issues', 'wordfence') . "\n\n";

[3983] Fix | Delete

}

[3984] Fix | Delete

[3985] Fix | Delete

$content .= str_repeat('-', 10);

[3986] Fix | Delete

$content .= "\n\n";

[3987] Fix | Delete

[3988] Fix | Delete

$content .= sprintf(/* translators: Number of scan results. */ __('## Ignored Issues (%d total)', 'wordfence'), $issueCounts['ignoreP'] + $issueCounts['ignoreC']) . "\n\n";

[3989] Fix | Delete

if (isset($issues['new']) && count($issues['new'])) {

[3990] Fix | Delete

foreach ($issues['ignored'] as $i) {

[3991] Fix | Delete

if (!in_array($i['type'], $issueTypes)) {

[3992] Fix | Delete

continue;

[3993] Fix | Delete

}

[3994] Fix | Delete

[3995] Fix | Delete

$viewContent = '';

[3996] Fix | Delete

try {

[3997] Fix | Delete

$viewContent = wfView::create('scanner/issue-' . $i['type'], array('textOutput' => $i))->render();

[3998] Fix | Delete

}

[3999] Fix | Delete