Edit File by line

<?php

[0] Fix | Delete

require_once(dirname(__FILE__) . '/wordfenceConstants.php');

[1] Fix | Delete

require_once(dirname(__FILE__) . '/wordfenceClass.php');

[2] Fix | Delete

require_once(dirname(__FILE__) . '/wordfenceURLHoover.php');

[3] Fix | Delete

class wordfenceScanner {

[4] Fix | Delete

[5] Fix | Delete

* Mask to return all patterns in the exclusion list.

[6] Fix | Delete

* @var int

[7] Fix | Delete

[8] Fix | Delete

const EXCLUSION_PATTERNS_ALL = PHP_INT_MAX;

[9] Fix | Delete

[10] Fix | Delete

* Mask for patterns that the user has added.

[11] Fix | Delete

[12] Fix | Delete

const EXCLUSION_PATTERNS_USER = 0x1;

[13] Fix | Delete

[14] Fix | Delete

* Mask for patterns that should be excluded from the known files scan.

[15] Fix | Delete

[16] Fix | Delete

const EXCLUSION_PATTERNS_KNOWN_FILES = 0x2;

[17] Fix | Delete

[18] Fix | Delete

* Mask for patterns that should be excluded from the malware scan.

[19] Fix | Delete

[20] Fix | Delete

const EXCLUSION_PATTERNS_MALWARE = 0x4;

[21] Fix | Delete

[22] Fix | Delete

//serialized:

[23] Fix | Delete

protected $path = '';

[24] Fix | Delete

protected $results = [];

[25] Fix | Delete

protected $resultFilesByShac = [];

[26] Fix | Delete

public $errorMsg = false;

[27] Fix | Delete

protected $apiKey = false;

[28] Fix | Delete

protected $wordpressVersion = '';

[29] Fix | Delete

protected $totalFilesScanned = 0;

[30] Fix | Delete

protected $startTime = false;

[31] Fix | Delete

protected $lastStatusTime = false;

[32] Fix | Delete

protected $patterns = "";

[33] Fix | Delete

protected $api = false;

[34] Fix | Delete

protected static $excludePatterns = array();

[35] Fix | Delete

protected static $builtinExclusions = array(

[36] Fix | Delete

array('pattern' => 'wp\-includes\/version\.php', 'include' => self::EXCLUSION_PATTERNS_KNOWN_FILES), //Excluded from the known files scan because non-en_US installations will have extra content that fails the check, still in malware scan

[37] Fix | Delete

[38] Fix | Delete

);

[39] Fix | Delete

/** @var wfScanEngine */

[40] Fix | Delete

protected $scanEngine;

[41] Fix | Delete

private $urlHoover;

[42] Fix | Delete

[43] Fix | Delete

public function __sleep(){

[44] Fix | Delete

return array('path', 'results', 'resultFilesByShac', 'errorMsg', 'apiKey', 'wordpressVersion', 'urlHoover', 'totalFilesScanned',

[45] Fix | Delete

'startTime', 'lastStatusTime', 'patterns', 'scanEngine');

[46] Fix | Delete

}

[47] Fix | Delete

public function __wakeup(){

[48] Fix | Delete

}

[49] Fix | Delete

public function __construct($apiKey, $wordpressVersion, $path, $scanEngine) {

[50] Fix | Delete

$this->apiKey = $apiKey;

[51] Fix | Delete

$this->wordpressVersion = $wordpressVersion;

[52] Fix | Delete

$this->api = new wfAPI($this->apiKey, $this->wordpressVersion);

[53] Fix | Delete

if($path[strlen($path) - 1] != '/'){

[54] Fix | Delete

$path .= '/';

[55] Fix | Delete

}

[56] Fix | Delete

$this->path = $path;

[57] Fix | Delete

$this->scanEngine = $scanEngine;

[58] Fix | Delete

[59] Fix | Delete

$this->errorMsg = false;

[60] Fix | Delete

//First extract hosts or IPs and their URLs into $this->hostsFound and URL's into $this->urlsFound

[61] Fix | Delete

$options = $this->scanEngine->scanController()->scanOptions();

[62] Fix | Delete

if ($options['scansEnabled_fileContentsGSB']) {

[63] Fix | Delete

$this->urlHoover = new wordfenceURLHoover($this->apiKey, $this->wordpressVersion);

[64] Fix | Delete

}

[65] Fix | Delete

else {

[66] Fix | Delete

$this->urlHoover = false;

[67] Fix | Delete

}

[68] Fix | Delete

[69] Fix | Delete

if ($options['scansEnabled_fileContents']) {

[70] Fix | Delete

$this->setupSigs();

[71] Fix | Delete

}

[72] Fix | Delete

else {

[73] Fix | Delete

$this->patterns = array();

[74] Fix | Delete

}

[75] Fix | Delete

}

[76] Fix | Delete

[77] Fix | Delete

/**

[78] Fix | Delete

* Get scan regexes from noc1 and add any user defined regexes, including descriptions, ID's and time added.

[79] Fix | Delete

* @todo add caching to this.

[80] Fix | Delete

* @throws Exception

[81] Fix | Delete

[82] Fix | Delete

protected function setupSigs() {

[83] Fix | Delete

$sigData = $this->api->call('get_patterns', array(), array());

[84] Fix | Delete

if(! (is_array($sigData) && isset($sigData['rules'])) ){

[85] Fix | Delete

throw new Exception(__('Wordfence could not get the attack signature patterns from the scanning server.', 'wordfence'));

[86] Fix | Delete

}

[87] Fix | Delete

[88] Fix | Delete

if (is_array($sigData['rules'])) {

[89] Fix | Delete

$wafPatterns = array();

[90] Fix | Delete

$wafCommonStringIndexes = array();

[91] Fix | Delete

foreach ($sigData['rules'] as $key => $signatureRow) {

[92] Fix | Delete

list($id, , $pattern) = $signatureRow;

[93] Fix | Delete

if (empty($pattern)) {

[94] Fix | Delete

throw new Exception(__('Wordfence received malformed attack signature patterns from the scanning server.', 'wordfence'));

[95] Fix | Delete

}

[96] Fix | Delete

[97] Fix | Delete

$logOnly = (isset($signatureRow[5]) && !empty($signatureRow[5])) ? $signatureRow[5] : false;

[98] Fix | Delete

$commonStringIndexes = (isset($signatureRow[8]) && is_array($signatureRow[8])) ? $signatureRow[8] : array();

[99] Fix | Delete

if (@preg_match('/' . $pattern . '/iS', '') === false) {

[100] Fix | Delete

wordfence::status(1, 'error', sprintf(__('Regex compilation failed for signature %d', 'wordfence'), (int) $id));

[101] Fix | Delete

unset($sigData['rules'][$key]);

[102] Fix | Delete

}

[103] Fix | Delete

else if (!$logOnly) {

[104] Fix | Delete

$wafPatterns[] = $pattern;

[105] Fix | Delete

$wafCommonStringIndexes[] = $commonStringIndexes;

[106] Fix | Delete

}

[107] Fix | Delete

}

[108] Fix | Delete

}

[109] Fix | Delete

[110] Fix | Delete

$userSignatures = wfScanner::shared()->userScanSignatures();

[111] Fix | Delete

foreach ($userSignatures as $s) {

[112] Fix | Delete

$sigData['rules'][] = $s;

[113] Fix | Delete

}

[114] Fix | Delete

[115] Fix | Delete

$this->patterns = $sigData;

[116] Fix | Delete

if (isset($this->patterns['signatureUpdateTime'])) {

[117] Fix | Delete

wfConfig::set('signatureUpdateTime', $this->patterns['signatureUpdateTime']);

[118] Fix | Delete

}

[119] Fix | Delete

}

[120] Fix | Delete

[121] Fix | Delete

/**

[122] Fix | Delete

* Return regular expression to exclude files or false if

[123] Fix | Delete

* there is no pattern

[124] Fix | Delete

[125] Fix | Delete

* @param $whichPatterns int Bitmask indicating which patterns to include.

[126] Fix | Delete

* @return array|boolean

[127] Fix | Delete

[128] Fix | Delete

public static function getExcludeFilePattern($whichPatterns = self::EXCLUSION_PATTERNS_USER) {

[129] Fix | Delete

if (isset(self::$excludePatterns[$whichPatterns])) {

[130] Fix | Delete

return self::$excludePatterns[$whichPatterns];

[131] Fix | Delete

}

[132] Fix | Delete

[133] Fix | Delete

$exParts = array();

[134] Fix | Delete

if (($whichPatterns & self::EXCLUSION_PATTERNS_USER) > 0)

[135] Fix | Delete

{

[136] Fix | Delete

$exParts = wfScanner::shared()->userExclusions();

[137] Fix | Delete

}

[138] Fix | Delete

[139] Fix | Delete

$exParts = array_filter($exParts);

[140] Fix | Delete

foreach ($exParts as $key => &$exPart) {

[141] Fix | Delete

$exPart = trim($exPart);

[142] Fix | Delete

if ($exPart === '*') {

[143] Fix | Delete

unset($exParts[$key]);

[144] Fix | Delete

continue;

[145] Fix | Delete

}

[146] Fix | Delete

$exPart = preg_quote($exPart, '/');

[147] Fix | Delete

$exPart = preg_replace('/\\\\\*/', '.*', $exPart);

[148] Fix | Delete

}

[149] Fix | Delete

[150] Fix | Delete

foreach (self::$builtinExclusions as $pattern) {

[151] Fix | Delete

if (($pattern['include'] & $whichPatterns) > 0) {

[152] Fix | Delete

$exParts[] = $pattern['pattern'];

[153] Fix | Delete

}

[154] Fix | Delete

}

[155] Fix | Delete

[156] Fix | Delete

$exParts = array_filter($exParts);

[157] Fix | Delete

if (!empty($exParts)) {

[158] Fix | Delete

$chunks = array_chunk($exParts, 100);

[159] Fix | Delete

self::$excludePatterns[$whichPatterns] = array();

[160] Fix | Delete

foreach ($chunks as $parts) {

[161] Fix | Delete

self::$excludePatterns[$whichPatterns][] = '/(?:' . implode('|', $parts) . ')$/i';

[162] Fix | Delete

}

[163] Fix | Delete

}

[164] Fix | Delete

else {

[165] Fix | Delete

self::$excludePatterns[$whichPatterns] = false;

[166] Fix | Delete

}

[167] Fix | Delete

[168] Fix | Delete

return self::$excludePatterns[$whichPatterns];

[169] Fix | Delete

}

[170] Fix | Delete

[171] Fix | Delete

/**

[172] Fix | Delete

* @param wfScanEngine $forkObj

[173] Fix | Delete

* @return array

[174] Fix | Delete

[175] Fix | Delete

public function scan($forkObj){

[176] Fix | Delete

$this->scanEngine = $forkObj;

[177] Fix | Delete

$loader = $this->scanEngine->getKnownFilesLoader();

[178] Fix | Delete

if(! $this->startTime){

[179] Fix | Delete

$this->startTime = microtime(true);

[180] Fix | Delete

}

[181] Fix | Delete

if(! $this->lastStatusTime){

[182] Fix | Delete

$this->lastStatusTime = microtime(true);

[183] Fix | Delete

}

[184] Fix | Delete

[185] Fix | Delete

//The site's own URL is checked in an earlier scan stage so we exclude it here.

[186] Fix | Delete

$options = $this->scanEngine->scanController()->scanOptions();

[187] Fix | Delete

$hooverExclusions = array();

[188] Fix | Delete

if ($options['scansEnabled_fileContentsGSB']) {

[189] Fix | Delete

$hooverExclusions = wordfenceURLHoover::standardExcludedHosts();

[190] Fix | Delete

}

[191] Fix | Delete

[192] Fix | Delete

$backtrackLimit = ini_get('pcre.backtrack_limit');

[193] Fix | Delete

if (is_numeric($backtrackLimit)) {

[194] Fix | Delete

$backtrackLimit = (int) $backtrackLimit;

[195] Fix | Delete

if ($backtrackLimit > 10000000) {

[196] Fix | Delete

ini_set('pcre.backtrack_limit', 1000000);

[197] Fix | Delete

wordfence::status(4, 'info', sprintf(/* translators: PHP ini setting (number). */ __('Backtrack limit is %d, reducing to 1000000', 'wordfence'), $backtrackLimit));

[198] Fix | Delete

}

[199] Fix | Delete

}

[200] Fix | Delete

else {

[201] Fix | Delete

$backtrackLimit = false;

[202] Fix | Delete

}

[203] Fix | Delete

[204] Fix | Delete

$lastCount = 'whatever';

[205] Fix | Delete

$excludePatterns = self::getExcludeFilePattern(self::EXCLUSION_PATTERNS_USER | self::EXCLUSION_PATTERNS_MALWARE);

[206] Fix | Delete

while (true) {

[207] Fix | Delete

$thisCount = wordfenceMalwareScanFile::countRemaining();

[208] Fix | Delete

if ($thisCount == $lastCount) {

[209] Fix | Delete

//count should always be decreasing. If not, we're in an infinite loop so lets catch it early

[210] Fix | Delete

wordfence::status(4, 'info', __('Detected loop in malware scan, aborting.', 'wordfence'));

[211] Fix | Delete

break;

[212] Fix | Delete

}

[213] Fix | Delete

$lastCount = $thisCount;

[214] Fix | Delete

[215] Fix | Delete

$files = wordfenceMalwareScanFile::files();

[216] Fix | Delete

if (count($files) < 1) {

[217] Fix | Delete

wordfence::status(4, 'info', __('No files remaining for malware scan.', 'wordfence'));

[218] Fix | Delete

break;

[219] Fix | Delete

}

[220] Fix | Delete

[221] Fix | Delete

$completed = [];

[222] Fix | Delete

foreach ($files as $record) {

[223] Fix | Delete

$file = $record->filename;

[224] Fix | Delete

if ($excludePatterns) {

[225] Fix | Delete

foreach ($excludePatterns as $pattern) {

[226] Fix | Delete

if (preg_match($pattern, $file)) {

[227] Fix | Delete

$completed[] = $record;

[228] Fix | Delete

continue 2;

[229] Fix | Delete

}

[230] Fix | Delete

}

[231] Fix | Delete

}

[232] Fix | Delete

if (!file_exists($record->realPath)) {

[233] Fix | Delete

$completed[] = $record;

[234] Fix | Delete

continue;

[235] Fix | Delete

}

[236] Fix | Delete

$fileSum = $record->newMD5;

[237] Fix | Delete

[238] Fix | Delete

$fileExt = '';

[239] Fix | Delete

if(preg_match('/\.([a-zA-Z\d\-]{1,7})$/', $file, $matches)){

[240] Fix | Delete

$fileExt = strtolower($matches[1]);

[241] Fix | Delete

}

[242] Fix | Delete

$isPHP = false;

[243] Fix | Delete

if(preg_match('/\.(?:php(?:\d+)?|phtml)(\.|$)/i', $file)) {

[244] Fix | Delete

$isPHP = true;

[245] Fix | Delete

}

[246] Fix | Delete

$isHTML = false;

[247] Fix | Delete

if(preg_match('/\.(?:html?)(\.|$)/i', $file)) {

[248] Fix | Delete

$isHTML = true;

[249] Fix | Delete

}

[250] Fix | Delete

$isJS = false;

[251] Fix | Delete

if(preg_match('/\.(?:js|svg)(\.|$)/i', $file)) {

[252] Fix | Delete

$isJS = true;

[253] Fix | Delete

}

[254] Fix | Delete

$dontScanForURLs = false;

[255] Fix | Delete

if (!$options['scansEnabled_highSense'] && (preg_match('/^(?:\.htaccess|wp\-config\.php)$/', $file) || $file === ini_get('user_ini.filename'))) {

[256] Fix | Delete

$dontScanForURLs = true;

[257] Fix | Delete

}

[258] Fix | Delete

[259] Fix | Delete

$isScanImagesFile = false;

[260] Fix | Delete

if (!$isPHP && preg_match('/^(?:jpg|jpeg|mp3|avi|m4v|mov|mp4|gif|png|tiff?|svg|sql|js|tbz2?|bz2?|xz|zip|tgz|gz|tar|log|err\d+)$/', $fileExt)) {

[261] Fix | Delete

if ($options['scansEnabled_scanImages']) {

[262] Fix | Delete

$isScanImagesFile = true;

[263] Fix | Delete

}

[264] Fix | Delete

else if (!$isJS) {

[265] Fix | Delete

$completed[] = $record;

[266] Fix | Delete

continue;

[267] Fix | Delete

}

[268] Fix | Delete

}

[269] Fix | Delete

$isHighSensitivityFile = false;

[270] Fix | Delete

if (strtolower($fileExt) == 'sql') {

[271] Fix | Delete

if ($options['scansEnabled_highSense']) {

[272] Fix | Delete

$isHighSensitivityFile = true;

[273] Fix | Delete

}

[274] Fix | Delete

else {

[275] Fix | Delete

$completed[] = $record;

[276] Fix | Delete

continue;

[277] Fix | Delete

}

[278] Fix | Delete

}

[279] Fix | Delete

if(wfUtils::fileTooBig($record->realPath, $fsize, $fh)){ //We can't use filesize on 32 bit systems for files > 2 gigs

[280] Fix | Delete

//We should not need this check because files > 2 gigs are not hashed and therefore won't be received back as unknowns from the API server

[281] Fix | Delete

//But we do it anyway to be safe.

[282] Fix | Delete

wordfence::status(2, 'error', sprintf(/* translators: File path. */ __('Encountered file that is too large: %s - Skipping.', 'wordfence'), $file));

[283] Fix | Delete

$completed[] = $record;

[284] Fix | Delete

continue;

[285] Fix | Delete

}

[286] Fix | Delete

[287] Fix | Delete

$fsize = wfUtils::formatBytes($fsize);

[288] Fix | Delete

if (function_exists('memory_get_usage')) {

[289] Fix | Delete

wordfence::status(4, 'info', sprintf(

[290] Fix | Delete

/* translators: 1. File path. 2. File size. 3. Memory in bytes. */

[291] Fix | Delete

__('Scanning contents: %1$s (Size: %2$s Mem: %3$s)', 'wordfence'),

[292] Fix | Delete

$file,

[293] Fix | Delete

$fsize,

[294] Fix | Delete

wfUtils::formatBytes(memory_get_usage(true))

[295] Fix | Delete

));

[296] Fix | Delete

} else {

[297] Fix | Delete

wordfence::status(4, 'info', sprintf(

[298] Fix | Delete

/* translators: 1. File path. 2. File size. */

[299] Fix | Delete

__('Scanning contents: %1$s (Size: %2$s)', 'wordfence'),

[300] Fix | Delete

$file,

[301] Fix | Delete

$fsize

[302] Fix | Delete

));

[303] Fix | Delete

}

[304] Fix | Delete

[305] Fix | Delete

$stime = microtime(true);

[306] Fix | Delete

if (!$fh) {

[307] Fix | Delete

$completed[] = $record;

[308] Fix | Delete

continue;

[309] Fix | Delete

}

[310] Fix | Delete

$totalRead = (int) $record->stoppedOnPosition;

[311] Fix | Delete

if ($totalRead > 0) {

[312] Fix | Delete

if (@fseek($fh, $totalRead, SEEK_SET) !== 0) {

[313] Fix | Delete

$totalRead = 0;

[314] Fix | Delete

}

[315] Fix | Delete

}

[316] Fix | Delete

if ($totalRead === 0 && @fseek($fh, $totalRead, SEEK_SET) !== 0) {

[317] Fix | Delete

wordfence::status(2, 'error', sprintf(/* translators: File path. */ __('Seek error occurred in file: %s - Skipping.', 'wordfence'), $file));

[318] Fix | Delete

$completed[] = $record;

[319] Fix | Delete

continue;

[320] Fix | Delete

}

[321] Fix | Delete

[322] Fix | Delete

$dataForFile = $this->dataForFile($file);

[323] Fix | Delete

[324] Fix | Delete

$first = true;

[325] Fix | Delete

while (!feof($fh)) {

[326] Fix | Delete

$data = fread($fh, 1 * 1024 * 1024); //read 1 megs max per chunk

[327] Fix | Delete

$readSize = wfUtils::strlen($data);

[328] Fix | Delete

$currentPosition = $totalRead;

[329] Fix | Delete

$totalRead += $readSize;

[330] Fix | Delete

if ($readSize < 1) {

[331] Fix | Delete

break;

[332] Fix | Delete

}

[333] Fix | Delete

[334] Fix | Delete

$extraMsg = '';

[335] Fix | Delete

if ($isScanImagesFile) {

[336] Fix | Delete

$extraMsg = ' ' . __('This file was detected because you have enabled "Scan images, binary, and other files as if they were executable", which treats non-PHP files as if they were PHP code. This option is more aggressive than the usual scans, and may cause false positives.', 'wordfence');

[337] Fix | Delete

}

[338] Fix | Delete

else if ($isHighSensitivityFile) {

[339] Fix | Delete

$extraMsg = ' ' . __('This file was detected because you have enabled HIGH SENSITIVITY scanning. This option is more aggressive than the usual scans, and may cause false positives.', 'wordfence');

[340] Fix | Delete

}

[341] Fix | Delete

[342] Fix | Delete

$treatAsBinary = ($isPHP || $isHTML || $options['scansEnabled_scanImages']);

[343] Fix | Delete

if ($options['scansEnabled_fileContents']) {

[344] Fix | Delete

$allCommonStrings = $this->patterns['commonStrings'];

[345] Fix | Delete

$commonStringsFound = array_fill(0, count($allCommonStrings), null); //Lazily looked up below

[346] Fix | Delete

[347] Fix | Delete

$regexMatched = false;

[348] Fix | Delete

foreach ($this->patterns['rules'] as $rule) {

[349] Fix | Delete

$stoppedOnSignature = $record->stoppedOnSignature;

[350] Fix | Delete

if (!empty($stoppedOnSignature)) { //Advance until we find the rule we stopped on last time

[351] Fix | Delete

//wordfence::status(4, 'info', "Searching for malware scan resume point (". $stoppedOnSignature . ") at rule " . $rule[0]);

[352] Fix | Delete

if ($stoppedOnSignature == $rule[0]) {

[353] Fix | Delete

$record->updateStoppedOn('', $currentPosition);

[354] Fix | Delete

wordfence::status(4, 'info', sprintf(/* translators: Malware signature rule ID. */ __('Resuming malware scan at rule %s.', 'wordfence'), $rule[0]));

[355] Fix | Delete

}

[356] Fix | Delete

continue;

[357] Fix | Delete

}

[358] Fix | Delete

[359] Fix | Delete

$type = (isset($rule[4]) && !empty($rule[4])) ? $rule[4] : 'server';

[360] Fix | Delete

$logOnly = (isset($rule[5]) && !empty($rule[5])) ? $rule[5] : false;

[361] Fix | Delete

$commonStringIndexes = (isset($rule[8]) && is_array($rule[8])) ? $rule[8] : array();

[362] Fix | Delete

if ($type == 'server' && !$treatAsBinary) { continue; }

[363] Fix | Delete

else if (($type == 'both' || $type == 'browser') && $isJS) { $extraMsg = ''; }

[364] Fix | Delete

else if (($type == 'both' || $type == 'browser') && !$treatAsBinary) { continue; }

[365] Fix | Delete

[366] Fix | Delete

if (!$first && substr($rule[2], 0, 1) == '^') {

[367] Fix | Delete

//wordfence::status(4, 'info', "Skipping malware signature ({$rule[0]}) because it only applies to the file beginning.");

[368] Fix | Delete

continue;

[369] Fix | Delete

}

[370] Fix | Delete

[371] Fix | Delete

foreach ($commonStringIndexes as $i) {

[372] Fix | Delete

if ($commonStringsFound[$i] === null) {

[373] Fix | Delete

$s = $allCommonStrings[$i];

[374] Fix | Delete

$commonStringsFound[$i] = (preg_match('/' . $s . '/i', $data) == 1);

[375] Fix | Delete

}

[376] Fix | Delete

[377] Fix | Delete

if (!$commonStringsFound[$i]) {

[378] Fix | Delete

//wordfence::status(4, 'info', "Skipping malware signature ({$rule[0]}) due to short circuit.");

[379] Fix | Delete

continue 2;

[380] Fix | Delete

}

[381] Fix | Delete

}

[382] Fix | Delete

[383] Fix | Delete

/*if (count($commonStringIndexes) > 0) {

[384] Fix | Delete

wordfence::status(4, 'info', "Processing malware signature ({$rule[0]}) because short circuit matched.");

[385] Fix | Delete

}*/

[386] Fix | Delete

[387] Fix | Delete

if (preg_match('/(' . $rule[2] . ')/iS', $data, $matches, PREG_OFFSET_CAPTURE)) {

[388] Fix | Delete

$customMessage = isset($rule[9]) ? $rule[9] : __('This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans.', 'wordfence');

[389] Fix | Delete

$matchString = $matches[1][0];

[390] Fix | Delete

$matchOffset = $matches[1][1];

[391] Fix | Delete

$beforeString = wfWAFUtils::substr($data, max(0, $matchOffset - 100), $matchOffset - max(0, $matchOffset - 100));

[392] Fix | Delete

$afterString = wfWAFUtils::substr($data, $matchOffset + strlen($matchString), 100);

[393] Fix | Delete

if (!$logOnly) {

[394] Fix | Delete

$this->addResult(array(

[395] Fix | Delete

'type' => 'file',

[396] Fix | Delete

'severity' => wfIssues::SEVERITY_CRITICAL,

[397] Fix | Delete

'ignoreP' => $record->realPath,

[398] Fix | Delete

'ignoreC' => $fileSum,

[399] Fix | Delete

'shortMsg' => sprintf(__('File appears to be malicious or unsafe: %s', 'wordfence'), esc_html($record->getDisplayPath())),

[400] Fix | Delete

'longMsg' => $customMessage . ' ' . sprintf(__('The matched text in this file is: %s', 'wordfence'), '' . wfUtils::potentialBinaryStringToHTML((wfUtils::strlen($matchString) > 200 ? wfUtils::substr($matchString, 0, 200) . '...' : $matchString)) . '') . ' ' . ' ' . sprintf(/* translators: Scan result type. */ __('The issue type is: %s', 'wordfence'), '' . esc_html($rule[7]) . '') . ' ' . sprintf(/* translators: Scan result description. */ __('Description: %s', 'wordfence'), '' . esc_html($rule[3]) . '') . $extraMsg,

[401] Fix | Delete

'data' => array_merge(array(

[402] Fix | Delete

'file' => $file,

[403] Fix | Delete

'realFile' => $record->realPath,

[404] Fix | Delete

'shac' => $record->SHAC,

[405] Fix | Delete

'highSense' => $options['scansEnabled_highSense']

[406] Fix | Delete

), $dataForFile),

[407] Fix | Delete

));

[408] Fix | Delete

}

[409] Fix | Delete

$regexMatched = true;

[410] Fix | Delete

$this->scanEngine->recordMetric('malwareSignature', $rule[0], array('file' => substr($file, 0, 255), 'match' => substr($matchString, 0, 65535), 'before' => $beforeString, 'after' => $afterString, 'md5' => $record->newMD5, 'shac' => $record->SHAC), false);

[411] Fix | Delete

break;

[412] Fix | Delete

}

[413] Fix | Delete

[414] Fix | Delete

if ($forkObj->shouldFork()) {

[415] Fix | Delete

$record->updateStoppedOn($rule[0], $currentPosition);

[416] Fix | Delete

fclose($fh);

[417] Fix | Delete

[418] Fix | Delete

wordfenceMalwareScanFile::markCompleteBatch($completed);

[419] Fix | Delete

[420] Fix | Delete

wordfence::status(4, 'info', sprintf(/* translators: Malware signature rule ID. */ __('Forking during malware scan (%s) to ensure continuity.', 'wordfence'), $rule[0]));

[421] Fix | Delete

$forkObj->fork(); //exits

[422] Fix | Delete

}

[423] Fix | Delete

}

[424] Fix | Delete

if ($regexMatched) { break; }

[425] Fix | Delete

if ($treatAsBinary && $options['scansEnabled_highSense']) {

[426] Fix | Delete

$badStringFound = false;

[427] Fix | Delete

if (strpos($data, $this->patterns['badstrings'][0]) !== false) {

[428] Fix | Delete

for ($i = 1; $i < sizeof($this->patterns['badstrings']); $i++) {

[429] Fix | Delete

if (wfUtils::strpos($data, $this->patterns['badstrings'][$i]) !== false) {

[430] Fix | Delete

$badStringFound = $this->patterns['badstrings'][$i];

[431] Fix | Delete

break;

[432] Fix | Delete

}

[433] Fix | Delete

}

[434] Fix | Delete

}

[435] Fix | Delete

if ($badStringFound) {

[436] Fix | Delete

$this->addResult(array(

[437] Fix | Delete

'type' => 'file',

[438] Fix | Delete

'severity' => wfIssues::SEVERITY_CRITICAL,

[439] Fix | Delete

'ignoreP' => $record->realPath,

[440] Fix | Delete

'ignoreC' => $fileSum,

[441] Fix | Delete

'shortMsg' => __('This file may contain malicious executable code: ', 'wordfence') . esc_html($record->getDisplayPath()),

[442] Fix | Delete

'longMsg' => sprintf(/* translators: Malware signature matched text. */ __('This file is a PHP executable file and contains the word "eval" (without quotes) and the word "%s" (without quotes). The eval() function along with an encoding function like the one mentioned are commonly used by hackers to hide their code. If you know about this file you can choose to ignore it to exclude it from future scans. This file was detected because you have enabled HIGH SENSITIVITY scanning. This option is more aggressive than the usual scans, and may cause false positives.', 'wordfence'), '' . esc_html($badStringFound) . ''),

[443] Fix | Delete

'data' => array_merge(array(

[444] Fix | Delete

'file' => $file,

[445] Fix | Delete

'realFile' => $record->realPath,

[446] Fix | Delete

'shac' => $record->SHAC,

[447] Fix | Delete

'highSense' => $options['scansEnabled_highSense']

[448] Fix | Delete

), $dataForFile),

[449] Fix | Delete

));

[450] Fix | Delete

break;

[451] Fix | Delete

}

[452] Fix | Delete

}

[453] Fix | Delete

}

[454] Fix | Delete

[455] Fix | Delete

if (!$dontScanForURLs && $options['scansEnabled_fileContentsGSB']) {

[456] Fix | Delete

$found = $this->urlHoover->hoover($file, $data, $hooverExclusions);

[457] Fix | Delete

$this->scanEngine->scanController()->incrementSummaryItem(wfScanner::SUMMARY_SCANNED_URLS, $found);

[458] Fix | Delete

}

[459] Fix | Delete

[460] Fix | Delete

if ($totalRead > 2 * 1024 * 1024) {

[461] Fix | Delete

break;

[462] Fix | Delete

}

[463] Fix | Delete

[464] Fix | Delete

$first = false;

[465] Fix | Delete

}

[466] Fix | Delete

fclose($fh);

[467] Fix | Delete

$this->totalFilesScanned++;

[468] Fix | Delete

if(microtime(true) - $this->lastStatusTime > 1){

[469] Fix | Delete

$this->lastStatusTime = microtime(true);

[470] Fix | Delete

$this->writeScanningStatus();

[471] Fix | Delete

}

[472] Fix | Delete

[473] Fix | Delete

$completed[] = $record;

[474] Fix | Delete

$shouldFork = $forkObj->shouldFork();

[475] Fix | Delete

if ($shouldFork || count($completed) > 100) {

[476] Fix | Delete

wordfenceMalwareScanFile::markCompleteBatch($completed);

[477] Fix | Delete

$completed = [];

[478] Fix | Delete

if ($shouldFork) {

[479] Fix | Delete

wordfence::status(4, 'info', __("Forking during malware scan to ensure continuity.", 'wordfence'));

[480] Fix | Delete

$forkObj->fork();

[481] Fix | Delete

}

[482] Fix | Delete

}

[483] Fix | Delete

}

[484] Fix | Delete

wordfenceMalwareScanFile::markCompleteBatch($completed);

[485] Fix | Delete

}

[486] Fix | Delete

$this->writeScanningStatus();

[487] Fix | Delete

if ($options['scansEnabled_fileContentsGSB']) {

[488] Fix | Delete

wordfence::status(2, 'info', __('Asking Wordfence to check URLs against malware list.', 'wordfence'));

[489] Fix | Delete

$hooverResults = $this->urlHoover->getBaddies();

[490] Fix | Delete

if($this->urlHoover->errorMsg){

[491] Fix | Delete

$this->errorMsg = $this->urlHoover->errorMsg;

[492] Fix | Delete

if ($backtrackLimit !== false) { ini_set('pcre.backtrack_limit', $backtrackLimit); }

[493] Fix | Delete

return false;

[494] Fix | Delete

}

[495] Fix | Delete

$this->urlHoover->cleanup();

[496] Fix | Delete

[497] Fix | Delete

foreach($hooverResults as $file => $hresults){

[498] Fix | Delete

$record = wordfenceMalwareScanFile::fileForPath($file);

[499] Fix | Delete