Developers: If you prefer to edit all Wordfence options on one page, you can enable the "All Options" page here:
', 'wfplugin_devalloptions'); wfConfig::set('generateAllOptionsNotification', 1); }*/ //7.1.9 if (wfConfig::get('loginSec_maxFailures') == 1) { wfConfig::set('loginSec_maxFailures', 2); } $blocksTable = wfBlock::blocksTable(); $patternBlocks = wfBlock::patternBlocks(); foreach ($patternBlocks as $b) { if (!empty($b->ipRange) && preg_match('/^\d+\-\d+$/', $b->ipRange)) { //Old-style range block using long2ip $ipRange = new wfUserIPRange($b->ipRange); $ipRange = $ipRange->getIPString(); $parameters = $b->parameters; $parameters['ipRange'] = $ipRange; $wpdb->query($wpdb->prepare("UPDATE `{$blocksTable}` SET `parameters` = %s WHERE `id` = %d", json_encode($parameters), $b->id)); } } wfConfig::set('needsGeoIPSync', true, wfConfig::DONT_AUTOLOAD); // Set the default scan options based on scan type. if (!wfConfig::get('config720Migration', false)) { // Replace critical/warning checkboxes with setting based on numeric severity value. if (wfConfig::hasCachedOption('alertOn_critical') && wfConfig::hasCachedOption('alertOn_warnings')) { $alertOnCritical = wfConfig::get('alertOn_critical'); $alertOnWarnings = wfConfig::get('alertOn_warnings'); wfConfig::set('alertOn_scanIssues', $alertOnCritical || $alertOnWarnings); if ($alertOnCritical && ! $alertOnWarnings) { wfConfig::set('alertOn_severityLevel', wfIssues::SEVERITY_HIGH); } else { wfConfig::set('alertOn_severityLevel', wfIssues::SEVERITY_LOW); } } // Update severity for existing issues where they are still using the old severity values. foreach (wfIssues::$issueSeverities as $issueType => $severity) { $wpdb->query($wpdb->prepare("UPDATE $issuesTable SET severity = %d WHERE `type` = %s AND severity in (0,1,2) ", $severity, $issueType)); } $syncedOptions = array(); switch (wfConfig::get('scanType')) { case wfScanner::SCAN_TYPE_LIMITED: $syncedOptions = wfScanner::limitedScanTypeOptions(); break; case wfScanner::SCAN_TYPE_STANDARD: $syncedOptions = wfScanner::standardScanTypeOptions(); break; case wfScanner::SCAN_TYPE_HIGH_SENSITIVITY: $syncedOptions = wfScanner::highSensitivityScanTypeOptions(); break; } if ($syncedOptions) { foreach ($syncedOptions as $key => $value) { if (is_bool($value)) { wfConfig::set($key, $value ? 1 : 0); } } } wfConfig::set('config720Migration', true); } //7.2.3 if (wfConfig::get('waf_status') === false) { $firewall = new wfFirewall(); $firewall->syncStatus(true); } //7.3.1 //---- drop long deprecated tables $tables = array('wfBadLeechers', 'wfBlockedCommentLog', 'wfBlocks', 'wfBlocksAdv', 'wfLeechers', 'wfLockedOut', 'wfNet404s', 'wfScanners', 'wfThrottleLog', 'wfVulnScanners'); foreach ($tables as $t) { $schema->drop($t); } //7.5.10 $knownFilesTable = wfDB::networkTable('wfKnownFileList'); $wordpressPathColumn = $wpdb->get_row($wpdb->prepare("SELECT * FROM information_schema.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = %s AND COLUMN_NAME = 'wordpress_path'", $knownFilesTable)); if ($wordpressPathColumn === null) { $wpdb->query("DELETE FROM `{$knownFilesTable}`"); $wpdb->query("ALTER TABLE `{$knownFilesTable}` ADD COLUMN wordpress_path TEXT NOT NULL"); } $realPathColumn = $wpdb->get_row($wpdb->prepare("SELECT * FROM information_schema.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = %s AND COLUMN_NAME = 'real_path'", $fileModsTable)); if ($realPathColumn === null) { $wpdb->query("DELETE FROM `{$fileModsTable}`"); $wpdb->query("ALTER TABLE `{$fileModsTable}` ADD COLUMN real_path TEXT NOT NULL AFTER filename"); } //wfFileMods updates $wpdb->query("ALTER TABLE {$fileModsTable} ALTER COLUMN oldMD5 SET DEFAULT ''"); //---- enable legacy 2fa if applicable if (wfConfig::get('isPaid') && (wfCredentialsController::hasOld2FARecords() || version_compare(phpversion(), '5.3', '<'))) { wfConfig::set(wfCredentialsController::ALLOW_LEGACY_2FA_OPTION, true); } //Record the installation timestamp if activating the plugin for the first time if (get_option('wordfenceActivated') != 1 && wfConfig::get('satisfactionPromptInstallDate') == 0 && empty(wfConfig::get('apiKey'))) { wfConfig::set('satisfactionPromptInstallDate', time()); } //8.2.0 // -- in veryFirstAction since it must run on/after the `plugins_loaded` hook //Check the How does Wordfence get IPs setting wfUtils::requestDetectProxyCallback(); //Install new schedule. If schedule config is blank it will install the default 'auto' schedule. wfScanner::shared()->scheduleScans(); //Check our minimum versions and generate the necessary warnings if (!wp_next_scheduled('wordfence_version_check')) { wp_schedule_single_event(time(), 'wordfence_version_check'); } //Must be the final line } public static function _sendLegacy2FADeprecationEmail() { $message = sprintf(/* translators: 1. site URL; 2. legacy 2FA page URL */ __(<<%s
", esc_html__('Please wait 3 minutes and try again', 'wordfence'), esc_html__('You have used this form too much. Please wait 3 minutes and try again.', 'wordfence') ); exit(); } if(! $numTries){ $numTries = 1; } else { $numTries = $numTries + 1; } set_transient('wordfenceUnlockTries', $numTries, 180); $email = trim(@$_POST['email']); global $wpdb; $ws = $wpdb->get_results($wpdb->prepare("SELECT ID, user_login FROM $wpdb->users WHERE user_email = %s", $email)); $found = false; foreach($ws as $user){ $userDat = get_userdata($user->ID); if(wfUtils::isAdmin($userDat)){ if($email == $userDat->user_email){ $found = true; break; } } } if(! $found){ foreach(wfConfig::getAlertEmails() as $alertEmail){ if($alertEmail == $email){ $found = true; break; } } } if($found){ $key = wfUtils::bigRandomHex(); $IP = wfUtils::getIP(); set_transient('wfunlock_' . $key, $IP, 1800); $content = wfUtils::tmpl('email_unlockRequest.php', array( 'siteName' => get_bloginfo('name', 'raw'), 'siteURL' => wfUtils::getSiteBaseURL(), 'unlockHref' => wfUtils::getSiteBaseURL() . '?_wfsf=unlockAccess&key=' . $key, 'key' => $key, 'IP' => $IP )); wp_mail($email, __("Unlock email requested", 'wordfence'), $content, "Content-Type: text/html"); } echo "" . esc_html(sprintf(/* translators: Email address. */ __("We received a request to email \"%s\" instructions to unlock their access. If that is the email address of a site administrator or someone on the Wordfence alert list, they have been emailed instructions on how to regain access to this system. The instructions we sent will expire 30 minutes from now.", 'wordfence'), wp_kses($email, array()))) . "
"; exit(); } else if($wfFunc == 'unlockAccess'){ if (!preg_match('/^(?:(?:(?:(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){7})|(?:(?!(?:.*[a-f0-9](?::|$)){7,})(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){0,5})?::(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){0,5})?)))|(?:(?:(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){5}:)|(?:(?!(?:.*[a-f0-9]:){5,})(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){0,3})?::(?:[a-f0-9]{1,4}(?::[a-f0-9]{1,4}){0,3}:)?))?(?:(?:25[0-5])|(?:2[0-4][0-9])|(?:1[0-9]{2})|(?:[1-9]?[0-9]))(?:\.(?:(?:25[0-5])|(?:2[0-4][0-9])|(?:1[0-9]{2})|(?:[1-9]?[0-9]))){3}))$/i', get_transient('wfunlock_' . $_GET['key']))) { _e("Invalid key provided for authentication.", 'wordfence'); exit(); } if($_GET['func'] == 'unlockMyIP'){ wfBlock::unblockIP(wfUtils::getIP()); if (class_exists('wfWAFIPBlocksController')) { wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings(); } self::clearLockoutCounters(wfUtils::getIP()); header('Location: ' . wp_login_url()); exit(); } else if($_GET['func'] == 'unlockAllIPs'){ wordfence::status(1, 'info', __("Request received via unlock email link to unblock all IPs.", 'wordfence')); wfBlock::removeAllIPBlocks(); if (class_exists('wfWAFIPBlocksController')) { wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings(); } self::clearLockoutCounters(wfUtils::getIP()); header('Location: ' . wp_login_url()); exit(); } else if($_GET['func'] == 'disableRules'){ wfConfig::set('firewallEnabled', 0); wfConfig::set('loginSecurityEnabled', 0); wordfence::status(1, 'info', __("Request received via unlock email link to unblock all IPs via disabling firewall rules.", 'wordfence')); wfBlock::removeAllIPBlocks(); wfBlock::removeAllCountryBlocks(); if (class_exists('wfWAFIPBlocksController')) { wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings(); } self::clearLockoutCounters(wfUtils::getIP()); header('Location: ' . wp_login_url()); exit(); } else { _e("Invalid function specified. Please check the link we emailed you and make sure it was not cut-off by your email reader.", 'wordfence'); exit(); } } else if ($wfFunc == 'detectProxy') { wfUtils::doNotCache(); if (wfUtils::processDetectProxyCallback()) { self::getLog()->getCurrentRequest()->action = 'scan:detectproxy'; //Exempt a valid callback from live traffic echo wfConfig::get('detectProxyRecommendation', '-'); } else { echo '0'; } exit(); } else if ($wfFunc == 'removeAlertEmail') { wfUtils::doNotCache(); $payloadStatus = false; $jwt = (isset($_GET['jwt']) && is_string($_GET['jwt'])) ? $_GET['jwt'] : ''; if (!empty($jwt)) { $payload = wfUtils::decodeJWT($jwt); if ($payload && isset($payload['email'])) { $payloadStatus = true; } } if (isset($_POST['resend'])) { $email = trim(wfUtils::array_get($_POST, 'email', '')); $found = false; $alertEmails = wfConfig::getAlertEmails(); foreach ($alertEmails as $e) { if ($e == $email) { $found = true; break; } } if ($found) { $content = wfUtils::tmpl('email_unsubscribeRequest.php', array( 'siteName' => get_bloginfo('name', 'raw'), 'siteURL' => wfUtils::getSiteBaseURL(), 'IP' => wfUtils::getIP(), 'jwt' => wfUtils::generateJWT(array('email' => $email)), )); wp_mail($email, __("Unsubscribe Requested", 'wordfence'), $content, "Content-Type: text/html"); } echo wfView::create('common/unsubscribe', array( 'state' => 'resent', ))->render(); exit(); } else if (!$payloadStatus) { echo wfView::create('common/unsubscribe', array( 'state' => 'bad', ))->render(); exit(); } else if (isset($_POST['confirm'])) { $confirm = wfUtils::truthyToBoolean($_POST['confirm']); if ($confirm) { $found = false; $alertEmails = wfConfig::getAlertEmails(); $updatedAlertEmails = array(); foreach ($alertEmails as $alertEmail) { if ($alertEmail == $payload['email']) { $found = true; } else { $updatedAlertEmails[] = $alertEmail; } } if ($found) { wfConfig::set('alertEmails', implode(',', $updatedAlertEmails)); } echo wfView::create('common/unsubscribe', array( 'jwt' => $_GET['jwt'], 'email' => $payload['email'], 'state' => 'unsubscribed', ))->render(); exit(); } } echo wfView::create('common/unsubscribe', array( 'jwt' => $_GET['jwt'], 'email' => $payload['email'], 'state' => 'prompt', ))->render(); exit(); } else if ($wfFunc == 'installLicense') { if (wfUtils::isAdmin()) { wfUtils::doNotCache(); if (isset($_POST['license'])) { $nonceValid = wp_verify_nonce(@$_POST['nonce'], 'wf-form'); if (!$nonceValid) { die(__('Sorry but your browser sent an invalid security token when trying to use this form.', 'wordfence')); } $changes = array('apiKey' => $_POST['license']); $errors = wfConfig::validate($changes); if ($errors !== true) { $error = __('An error occurred while saving the license.', 'wordfence'); if (count($errors) == 1) { $error = sprintf(/* translators: Error message. */ __('An error occurred while saving the license: %s', 'wordfence'), $errors[0]['error']); } echo wfView::create('common/license', array( 'state' => 'bad', 'error' => $error, ))->render(); exit(); } try { wfConfig::save(wfConfig::clean($changes)); echo wfView::create('common/license', array( 'state' => 'installed', ))->render(); exit(); } catch (Exception $e) { echo wfView::create('common/license', array( 'state' => 'bad', 'error' => sprintf(/* translators: Error message. */ __('An error occurred while saving the license: %s', 'wordfence'), $e->getMessage()), ))->render(); exit(); } } echo wfView::create('common/license', array( 'state' => 'prompt', ))->render(); exit(); } } if (is_main_site() && wfUtils::isAdmin()) { if (wp_next_scheduled('wordfence_daily_cron') === false) { wp_schedule_event(time() + 600, 'daily', 'wordfence_daily_cron'); wordfence::status(2, 'info', __("Rescheduled missing daily cron", 'wordfence')); } if (wp_next_scheduled('wordfence_hourly_cron') === false) { wp_schedule_event(time() + 600, 'hourly', 'wordfence_hourly_cron'); wordfence::status(2, 'info', __("Rescheduled missing hourly cron", 'wordfence')); } } // Sync the WAF data with the database. if (!WFWAF_SUBDIRECTORY_INSTALL && $waf = wfWAF::getInstance()) { $homeurl = wfUtils::wpHomeURL(); $siteurl = wfUtils::wpSiteURL(); //Sync the GeoIP database if needed $destination = WFWAF_LOG_PATH . '/' . wfIpLocation::DATABASE_FILE_NAME; if (!file_exists($destination) || wfConfig::get('needsGeoIPSync')) { $allowSync = false; if (wfConfig::createLock('wfSyncGeoIP')) { $status = get_transient('wfSyncGeoIPActive'); if (!$status) { $allowSync = true; set_transient('wfSyncGeoIPActive', true, 3600); } wfConfig::releaseLock('wfSyncGeoIP'); } if ($allowSync) { wfUtils::requireIpLocator(); try { $wflogsLocator = wfIpLocator::getInstance(wfIpLocator::SOURCE_WFLOGS); $bundledLocator = wfIpLocator::getInstance(wfIpLocator::SOURCE_BUNDLED); if (!$wflogsLocator->isPreferred() || $wflogsLocator->getDatabaseVersion() !== $bundledLocator->getDatabaseVersion()) { $source = dirname(__FILE__) . '/' . wfIpLocation::DATABASE_FILE_NAME; if (copy($source, $destination)) { $shash = ''; $dhash = ''; $sp = @fopen($source, "rb"); if ($sp) { $scontext = hash_init('sha256'); while (!feof($sp)) { $data = fread($sp, 65536); if ($data === false) { $scontext = false; break; } hash_update($scontext, $data); } fclose($sp); if ($scontext !== false) { $shash = hash_final($scontext, false); } } $dp = @fopen($destination, "rb"); if ($dp) { $dcontext = hash_init('sha256'); while (!feof($dp)) { $data = fread($dp, 65536); if ($data === false) { $dcontext = false; break; } hash_update($dcontext, $data); } fclose($dp); if ($scontext !== false) { $dhash = hash_final($dcontext, false); } } if (hash_equals($shash, $dhash)) { wfConfig::remove('needsGeoIPSync'); delete_transient('wfSyncGeoIPActive'); } } } else { wfConfig::remove('needsGeoIPSync'); delete_transient('wfSyncGeoIPActive'); } } catch (Exception $e) { //Ignore } } } try { $sapi = @php_sapi_name(); if ($sapi != "cli") { $lastPermissionsTemplateCheck = wfConfig::getInt('lastPermissionsTemplateCheck', 0); if (defined('WFWAF_LOG_PATH') && ($lastPermissionsTemplateCheck + 43200) < time()) { //Run no more frequently than every 12 hours $timestamp = preg_replace('/[^0-9]/', '', microtime(false)); //We avoid using tmpfile since it can potentially create one with different permissions than the defaults $tmpTemplate = rtrim(WFWAF_LOG_PATH, '/') . "/template.{$timestamp}.tmp"; $template = rtrim(WFWAF_LOG_PATH, '/') . '/template.php'; @unlink($tmpTemplate); @file_put_contents($tmpTemplate, "\n"); $tmpStat = @stat($tmpTemplate); if ($tmpStat !== false) { $mode = $tmpStat[2] & 0777; $updatedMode = 0600; if (($mode & 0020) == 0020) { //Group writable $updatedMode = $updatedMode | 0060; } if (defined('WFWAF_LOG_FILE_MODE')) { $updatedMode = WFWAF_LOG_FILE_MODE; } $stat = @stat($template); if ($stat === false || ($stat[2] & 0777) != $updatedMode) { @chmod($tmpTemplate, $updatedMode); @unlink($template); @rename($tmpTemplate, $template); } @unlink($tmpTemplate); } else { @unlink($tmpTemplate); } wfConfig::set('lastPermissionsTemplateCheck', time()); @chmod(WFWAF_LOG_PATH, (wfWAFWordPress::permissions() | 0755)); wfWAFWordPress::writeHtaccess(); $contents = self::_wflogsContents(); if ($contents) { $validFiles = wfWAF::getInstance()->fileList(); foreach ($validFiles as &$vf) { $vf = basename($vf); } $validFiles = array_filter($validFiles); $previousWflogsFileList = wfConfig::getJSON('previousWflogsFileList', array()); $wflogs = realpath(WFWAF_LOG_PATH); $filesRemoved = array(); foreach ($contents as $f) { if (!in_array($f, $validFiles) && in_array($f, $previousWflogsFileList)) { $fullPath = $f; $removed = self::_recursivelyRemoveWflogs($f); $filesRemoved = array_merge($filesRemoved, $removed); } } $contents = self::_wflogsContents(); wfConfig::setJSON('previousWflogsFileList', $contents); if (!empty($filesRemoved)) { $removalHistory = wfConfig::getJSON('diagnosticsWflogsRemovalHistory', array()); $removalHistory = array_slice($removalHistory, 0, 4); array_unshift($removalHistory, array(time(), $filesRemoved)); wfConfig::setJSON('diagnosticsWflogsRemovalHistory', $removalHistory); } } } } } catch (Exception $e) { //Ignore } try { $configDefaults = array( 'apiKey' => wfConfig::get('apiKey'), 'isPaid' => !!wfConfig::get('isPaid'), 'siteURL' => $siteurl, 'homeURL' => $homeurl, 'whitelistedIPs' => (string) wfConfig::get('whitelisted'), 'whitelistedServiceIPs' => json_encode(wfUtils::whitelistedServiceIPs()), 'howGetIPs' => (string) wfConfig::get('howGetIPs'), 'howGetIPs_trusted_proxies_unified' => implode("\n", wfUtils::unifiedTrustedProxies()), 'detectProxyRecommendation' => (string) wfConfig::get('detectProxyRecommendation'), 'other_WFNet' => !!wfConfig::get('other_WFNet', true), 'pluginABSPATH' => ABSPATH, 'serverIPs' => json_encode(wfUtils::serverIPs()), 'blockCustomText' => wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', ''))), 'disableWAFIPBlocking' => wfConfig::get('disableWAFIPBlocking'), 'wordpressVersion' => wfConfig::get('wordpressVersion'), 'wordpressPluginVersions' => wfConfig::get_ser('wordpressPluginVersions'), 'wordpressThemeVersions' => wfConfig::get_ser('wordpressThemeVersions'), 'WPLANG' => get_site_option('WPLANG'), ); if (wfUtils::isAdmin()) { $errorNonceKey = 'errorNonce_' . get_current_user_id(); $configDefaults[$errorNonceKey] = wp_create_nonce('wf-waf-error-page'); //Used by the AJAX watcher script } foreach ($configDefaults as $key => $value) { $waf->getStorageEngine()->setConfig($key, $value, 'synced'); } if (wfConfig::get('timeoffset_wf') !== false) { $waf->getStorageEngine()->setConfig('timeoffset_wf', wfConfig::get('timeoffset_wf'), 'synced'); } else { $waf->getStorageEngine()->unsetConfig('timeoffset_wf', 'synced'); } if (class_exists('wfWAFIPBlocksController')) { wfWAFIPBlocksController::setNeedsSynchronizeConfigSettings(); } if (wfUtils::isAdmin()) { if ($waf->getStorageEngine()->getConfig('wafStatus', '') == 'learning-mode') { if ($waf->getStorageEngine()->getConfig('learningModeGracePeriodEnabled', false)) { if ($waf->getStorageEngine()->getConfig('learningModeGracePeriod', 0) <= time()) { // Reached the end of the grace period, activate the WAF. $waf->getStorageEngine()->setConfig('wafStatus', 'enabled'); $waf->getStorageEngine()->setConfig('learningModeGracePeriodEnabled', 0); $waf->getStorageEngine()->unsetConfig('learningModeGracePeriod'); $firewall = new wfFirewall(); $firewall->syncStatus(true); } } } } if (empty($_GET['wordfence_syncAttackData'])) { $table_wfHits = wfDB::networkTable('wfHits'); if ($waf->getStorageEngine() instanceof wfWAFStorageMySQL) { $lastAttackMicroseconds = floatval($waf->getStorageEngine()->getConfig('lastAttackDataTruncateTime')); } else { $lastAttackMicroseconds = $wpdb->get_var("SELECT MAX(attackLogTime) FROM {$table_wfHits}"); } if (get_site_option('wordfence_lastSyncAttackData', 0) < time() - 8) { if ($waf->getStorageEngine()->hasNewerAttackData($lastAttackMicroseconds)) { if (get_site_option('wordfence_syncingAttackData') <= time() - 60) { // Could be the request to itself is not completing, add ajax to the head as a workaround $attempts = get_site_option('wordfence_syncAttackDataAttempts', 0); if ($attempts > 10) { add_action('wp_head', 'wordfence::addSyncAttackDataAjax'); add_action('login_head', 'wordfence::addSyncAttackDataAjax'); add_action('admin_head', 'wordfence::addSyncAttackDataAjax'); } else { update_site_option('wordfence_syncAttackDataAttempts', ++$attempts); wp_remote_post(add_query_arg('wordfence_syncAttackData', microtime(true), home_url('/')), array( 'timeout' => 0.01, 'blocking' => false, 'sslverify' => apply_filters('https_local_ssl_verify', false) )); } } } } } if ($waf instanceof wfWAFWordPress && ($learningModeAttackException = $waf->getLearningModeAttackException())) { $log = self::getLog(); $log->initLogRequest(); $request = $log->getCurrentRequest(); $request->action = 'learned:waf'; $request->attackLogTime = microtime(true); $ruleIDs = array(); /** @var wfWAFRule $failedRule */ foreach ($learningModeAttackException->getFailedRules() as $failedRule) { $ruleIDs[] = $failedRule->getRuleID(); } $actionData = array( 'learningMode' => 1, 'failedRules' => $ruleIDs, 'paramKey' => $learningModeAttackException->getParamKey(), 'paramValue' => $learningModeAttackException->getParamValue(), ); if ($ruleIDs && $ruleIDs[0]) { $rule = $waf->getRule($ruleIDs[0]); if ($rule) { $request->actionDescription = $rule->getDescription(); $actionData['category'] = $rule->getCategory(); $actionData['ssl'] = $waf->getRequest()->getProtocol() === 'https'; $actionData['fullRequest'] = base64_encode($waf->getRequest()); } } $request->actionData = wfRequestModel::serializeActionData($actionData); register_shutdown_function(array($request, 'save')); self::scheduleSendAttackData(); } } catch (wfWAFStorageFileException $e) { // We don't have anywhere to write files in this scenario. } catch (wfWAFStorageEngineMySQLiException $e) { // Ignore and continue } } if(wfConfig::get('firewallEnabled')){ $wfLog = self::getLog(); $wfLog->firewallBadIPs(); $IP = wfUtils::getIP(); if (wfBlock::isWhitelisted($IP)) { return; } if (wfConfig::get('neverBlockBG') == 'neverBlockUA' && wfCrawl::isGoogleCrawler()) { return; } if (wfConfig::get('neverBlockBG') == 'neverBlockVerified' && wfCrawl::isVerifiedGoogleCrawler()) { return; } if (wfConfig::get('bannedURLs', false)) { $URLs = explode("\n", wfUtils::cleanupOneEntryPerLine(wfConfig::get('bannedURLs'))); foreach ($URLs as $URL) { if (preg_match(wfUtils::patternToRegex($URL, ''), $_SERVER['REQUEST_URI'])) { $reason = wfWAFBlockI18n::getBlockDescription(wfWAFBlockI18n::WFWAF_BLOCK_BANNEDURL); wfBlock::createIP($reason, $IP, wfBlock::blockDuration(), time(), time(), 1, wfBlock::TYPE_IP_AUTOMATIC_TEMPORARY); wfActivityReport::logBlockedIP($IP, null, 'bannedurl'); $wfLog->tagRequestForBlock($reason); $wfLog->do503(3600, $reason); //exits } } } if (wfConfig::get('other_blockBadPOST') == '1' && $_SERVER['REQUEST_METHOD'] == 'POST' && empty($_SERVER['HTTP_USER_AGENT']) && empty($_SERVER['HTTP_REFERER'])) { $reason = wfWAFBlockI18n::getBlockDescription(wfWAFBlockI18n::WFWAF_BLOCK_BADPOST); wfBlock::createIP($reason, $IP, wfBlock::blockDuration(), time(), time(), 1, wfBlock::TYPE_IP_AUTOMATIC_TEMPORARY); wfActivityReport::logBlockedIP($IP, null, 'badpost'); $wfLog->tagRequestForBlock($reason); $wfLog->do503(3600, $reason); //exits } } } private static function _wflogsContents() { $dir = opendir(WFWAF_LOG_PATH); if ($dir) { $contents = array(); while ($path = readdir($dir)) { if ($path == '.' || $path == '..') { continue; } $contents[] = $path; } closedir($dir); return $contents; } return false; } /** * Removes a path within wflogs, recursing as necessary. * * @param string $file * @param array $processedDirs * @return array The list of removed files/folders. */ private static function _recursivelyRemoveWflogs($file, $processedDirs = array()) { if (preg_match('~(?:^|/|\\\\)\.\.(?:/|\\\\|$)~', $file)) { return array(); } if (stripos(WFWAF_LOG_PATH, 'wflogs') === false) { //Sanity check -- if not in a wflogs folder, user will have to do removal manually return array(); } $path = rtrim(WFWAF_LOG_PATH, '/') . '/' . $file; if (is_link($path)) { if (@unlink($path)) { return array($file); } return array(); } if (is_dir($path)) { $real = realpath($file); if (in_array($real, $processedDirs)) { return array(); } $processedDirs[] = $real; $count = 0; $dir = opendir($path); if ($dir) { $contents = array(); while ($sub = readdir($dir)) { if ($sub == '.' || $sub == '..') { continue; } $contents[] = $sub; } closedir($dir); $filesRemoved = array(); foreach ($contents as $f) { $removed = self::_recursivelyRemoveWflogs($file . '/' . $f, $processedDirs); $filesRemoved = array($filesRemoved, $removed); } } if (@rmdir($path)) { $filesRemoved[] = $file; } return $filesRemoved; } if (@unlink($path)) { return array($file); } return array(); } public static function loginAction($username){ if(sizeof($_POST) < 1){ return; } //only execute if login form is posted if(! $username){ return; } wfConfig::inc('totalLogins'); $user = get_user_by('login', $username); $userID = $user ? $user->ID : 0; $userIsAdmin = wfUtils::isAdmin($userID); self::getLog()->logLogin('loginOK', 0, $username); if ($userIsAdmin) { wfConfig::set_ser('lastAdminLogin', array( 'userID' => $userID, 'username' => $username, 'firstName' => $user->first_name, 'lastName' => $user->last_name, 'time' => wfUtils::localHumanDateShort(), 'IP' => wfUtils::getIP() )); } $salt = wp_salt('logged_in'); $cookieName = 'wf_loginalerted_' . hash_hmac('sha256', $userID, $salt); $cookieValue = hash_hmac('sha256', $username, $salt); $firstOnly = wfConfig::get($userIsAdmin ? 'alertOn_firstAdminLoginOnly' : 'alertOn_firstNonAdminLoginOnly'); $newDevice = !isset($_COOKIE[$cookieName]) || !hash_equals($cookieValue, $_COOKIE[$cookieName]); if ($userIsAdmin) { $securityEvent = 'adminLogin'; $alertCallback = array(new wfAdminLoginAlert($cookieName, $cookieValue, $username, wfUtils::getIP()), 'send'); } else { $securityEvent = 'nonAdminLogin'; $alertCallback = array(new wfNonAdminLoginAlert($cookieName, $cookieValue, $username, wfUtils::getIP()), 'send'); } if ($newDevice && $firstOnly) { $securityEvent .= 'NewLocation'; } do_action('wordfence_security_event', $securityEvent, array( 'username' => $username, 'ip' => wfUtils::getIP(), ), $alertCallback); if ($firstOnly) { wfUtils::setcookie($cookieName, $cookieValue, time() + (86400 * 365), '/', null, wfUtils::isFullSSL(), true); } } public static function registrationFilter($errors, $sanitizedLogin, $userEmail) { if (wfConfig::get('loginSec_blockAdminReg') && $sanitizedLogin == 'admin') { $errors->add('user_login_error', __('ERROR: You can\'t register using that username', 'wordfence')); } return $errors; } public static function wooRegistrationFilter($wooCustomerData) { /* $wooCustomerData matches: array( 'user_login' => $username, 'user_pass' => $password, 'user_email' => $email, 'role' => 'customer', ) */ if (wfConfig::get('loginSec_blockAdminReg') && is_array($wooCustomerData) && isset($wooCustomerData['user_login']) && isset($wooCustomerData['user_email']) && preg_match('/^admin\d*$/i', $wooCustomerData['user_login'])) { //Converts a username of `admin` generated from something like `admin@example.com` to `adminexample` $emailComponents = explode('@', $wooCustomerData['user_email']); if (strpos(wfUtils::array_last($emailComponents), '.') === false) { //e.g., admin@localhost $wooCustomerData['user_login'] .= wfUtils::array_last($emailComponents); } else { //e.g., admin@example.com $hostComponents = explode('.', wfUtils::array_last($emailComponents)); array_pop($hostComponents); $wooCustomerData['user_login'] .= wfUtils::array_last($hostComponents); } //If it's still `admin` at this point, it will fall through and get blocked by wordfence::blacklistedUsernames } return $wooCustomerData; } public static function oembedAuthorFilter($data, $post, $width, $height) { unset($data['author_name']); unset($data['author_url']); return $data; } public static function jsonAPIAuthorFilter($response, $handler, $request) { $route = $request->get_route(); if (!current_user_can('edit_others_posts')) { $urlBase = wfWP_REST_Users_Controller::wfGetURLBase(); if (preg_match('~' . preg_quote($urlBase, '~') . '/*$~i', $route)) { $error = new WP_Error('rest_user_cannot_view', __('Sorry, you are not allowed to list users.', 'wordfence'), array('status' => rest_authorization_required_code())); $response = rest_ensure_response($error); if (!defined('WORDFENCE_REST_API_SUPPRESSED')) { define('WORDFENCE_REST_API_SUPPRESSED', true); } } else if (preg_match('~' . preg_quote($urlBase, '~') . '/+(\d+)/*$~i', $route, $matches)) { $id = (int) $matches[1]; if (get_current_user_id() !== $id) { $error = new WP_Error('rest_user_invalid_id', __('Invalid user ID.', 'wordfence'), array('status' => 404)); $response = rest_ensure_response($error); if (!defined('WORDFENCE_REST_API_SUPPRESSED')) { define('WORDFENCE_REST_API_SUPPRESSED', true); } } } } return $response; } public static function jsonAPIAdjustHeaders($response, $server, $request) { if (defined('WORDFENCE_REST_API_SUPPRESSED')) { $response->header('Allow', 'GET'); } return $response; } public static function wpSitemapUserProviderFilter($provider, $name) { if ($name === 'users') { return false; } return $provider; } public static function _filterCentralFromLiveTraffic($dispatch_result, $request, $route, $handler) { if (preg_match('~^/wordfence/v\d+/~i', $route)) { self::getLog()->canLogHit = false; } return $dispatch_result; } public static function showTwoFactorField() { $existingContents = ob_get_contents(); if (!preg_match('/wftwofactornonce:([0-9]+)\/(.+?)\s/', $existingContents, $matches)) { return; } $userID = intval($matches[1]); $twoFactorNonce = preg_replace('/[^a-f0-9]/i', '', $matches[2]); if (!self::verifyTwoFactorIntermediateValues($userID, $twoFactorNonce)) { return; } //Strip out the username and password fields $formPosition = strrpos($existingContents, '"; } private static function verifyTwoFactorIntermediateValues($userID, $twoFactorNonce) { $user = get_user_by('ID', $userID); if (!$user || get_class($user) != 'WP_User') { return false; } //Check that the user exists $expectedNonce = get_user_meta($user->ID, '_wf_twoFactorNonce', true); $twoFactorNonceTime = get_user_meta($user->ID, '_wf_twoFactorNonceTime', true); if (empty($twoFactorNonce) || empty($twoFactorNonceTime)) { return false; } //Ensure the two factor nonce and time have been set if ($twoFactorNonce != $expectedNonce) { return false; } //Verify the nonce matches the expected $twoFactorUsers = wfConfig::get_ser('twoFactorUsers', array()); if (!$twoFactorUsers || !is_array($twoFactorUsers)) { return false; } //Make sure there are two factor users configured foreach ($twoFactorUsers as &$t) { //Ensure the two factor nonce hasn't expired if ($t[0] == $user->ID && $t[3] == 'activated') { if (isset($t[5]) && $t[5] == 'authenticator') { $graceTime = WORDFENCE_TWO_FACTOR_GRACE_TIME_AUTHENTICATOR; } else { $graceTime = WORDFENCE_TWO_FACTOR_GRACE_TIME_PHONE; } return ((time() - $twoFactorNonceTime) < $graceTime); } } return false; } public static function authenticateFilter($authUser, $username, $passwd) { wfConfig::inc('totalLoginHits'); //The total hits to wp-login.php including logins, logouts and just hits. $IP = wfUtils::getIP(); $secEnabled = wfConfig::get('loginSecurityEnabled'); $twoFactorUsers = wfConfig::get_ser('twoFactorUsers', array()); $userDat = self::$userDat; $checkBreachList = $secEnabled && !wfBlock::isWhitelisted($IP) && wfConfig::get('loginSec_breachPasswds_enabled') && is_object($authUser) && get_class($authUser) == 'WP_User' && ((wfConfig::get('loginSec_breachPasswds') == 'admins' && wfUtils::isAdmin($authUser)) || (wfConfig::get('loginSec_breachPasswds') == 'pubs' && user_can($authUser, 'publish_posts'))); $usingBreachedPassword = false; if ($checkBreachList) { $cacheStatus = wfCredentialsController::cachedCredentialStatus($authUser); if ($cacheStatus != wfCredentialsController::UNCACHED) { $usingBreachedPassword = ($cacheStatus == wfCredentialsController::LEAKED); } else { if (wfCredentialsController::isLeakedPassword($authUser->username, $passwd)) { $usingBreachedPassword = true; } wfCredentialsController::setCachedCredentialStatus($authUser, $usingBreachedPassword); } } $checkTwoFactor = $secEnabled && !wfBlock::isWhitelisted($IP) && wfConfig::get('isPaid') && isset($twoFactorUsers) && is_array($twoFactorUsers) && sizeof($twoFactorUsers) > 0 && is_object($userDat) && get_class($userDat) == 'WP_User' && wfCredentialsController::useLegacy2FA(); if ($checkTwoFactor) { $twoFactorRecord = false; $hasActivatedTwoFactorUser = false; foreach ($twoFactorUsers as &$t) { if ($t[3] == 'activated') { $userID = $t[0]; $testUser = get_user_by('ID', $userID); if (is_object($testUser) && wfUtils::isAdmin($testUser)) { $hasActivatedTwoFactorUser = true; } if ($userID == $userDat->ID) { $twoFactorRecord = &$t; } } } if (isset($_POST['wordfence_authFactor']) && $_POST['wordfence_authFactor'] && $twoFactorRecord) { //User authenticated with name and password, 2FA code ready to check $userID = $userDat->ID; if (is_object($authUser) && get_class($authUser) == 'WP_User' && $authUser->ID == $userID) { //Do nothing. This is the code path the old method of including the code in the password field will take -- since we already have a valid $authUser, skip the nonce verification portion } else if (isset($_POST['wordfence_twoFactorNonce'])) { $twoFactorNonce = preg_replace('/[^a-f0-9]/i', '', $_POST['wordfence_twoFactorNonce']); if (!self::verifyTwoFactorIntermediateValues($userID, $twoFactorNonce)) { remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages self::$authError = new WP_Error('twofactor_required', wp_kses(__('VERIFICATION FAILED: Two-factor authentication verification failed. Please try again.', 'wordfence'), array('strong'=>array()))); return self::processBruteForceAttempt(self::$authError, $username, $passwd); } } else { //Code path for old method, invalid password the second time self::$authError = $authUser; if (is_wp_error(self::$authError) && (self::$authError->get_error_code() == 'invalid_username' || $authUser->get_error_code() == 'invalid_email' || self::$authError->get_error_code() == 'incorrect_password' || $authUser->get_error_code() == 'authentication_failed') && wfConfig::get('loginSec_maskLoginErrors')) { self::$authError = new WP_Error('incorrect_password', sprintf(/* translators: 1. WordPress username. 2. Password reset URL. */ wp_kses(__('ERROR: The username or password you entered is incorrect. Lost your password?', 'wordfence'), array('strong'=>array(), 'a'=>array('href'=>array(), 'title'=>array()))), $username, wp_lostpassword_url())); } return self::processBruteForceAttempt(self::$authError, $username, $passwd); } $maybeAdminUser = ($authUser instanceof WP_User) ? $authUser : get_user_by('ID', $userID); if ($maybeAdminUser && $maybeAdminUser->exists() && !wfUtils::isAdmin($maybeAdminUser)) { wfAdminNoticeQueue::removeAdminNoticeForCategory('legacy2faDeprecationUnprivileged', $maybeAdminUser->ID); wfAdminNoticeQueue::addAdminNotice(wfAdminNotice::SEVERITY_CRITICAL, __('NOTICE: This site is using Wordfence\'s legacy 2FA feature, which was replaced with an improved version in 2019. The legacy 2FA feature will be discontinued around July 1, 2026.', 'wordfence') . '
wf, and the code from your authenticator app to the end of your password (e.g., wf123456).', 'wordfence'), array('strong'=>array(), 'code'=>array())));
}
else {
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_invalid', wp_kses(__('INVALID CODE: Please sign in again and add a space, the letters wf, and the code sent to your phone to the end of your password (e.g., wf123456).', 'wordfence'), array('strong'=>array(), 'code'=>array())));
}
}
else {
$loginNonce = wfWAFUtils::random_bytes(20);
if ($loginNonce === false) { //Should never happen but is technically possible
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_required', wp_kses(__('AUTHENTICATION FAILURE: A temporary failure was encountered while trying to log in. Please try again.', 'wordfence'), array('strong'=>array())));
return self::$authError;
}
$loginNonce = bin2hex($loginNonce);
update_user_meta($userDat->ID, '_wf_twoFactorNonce', $loginNonce);
update_user_meta($userDat->ID, '_wf_twoFactorNonceTime', time());
if ($mode == 'authenticator') {
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_invalid', wp_kses(__('INVALID CODE: You need to enter the code generated by your authenticator app. The code should be a six digit number (e.g., 123456).', 'wordfence'), array('strong'=>array())) . '');
}
else {
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_invalid', wp_kses(__('INVALID CODE: You need to enter the code generated sent to your phone. The code should be a six digit number (e.g., 123456).', 'wordfence'), array('strong'=>array())) . '');
}
}
return self::processBruteForceAttempt(self::$authError, $username, $passwd);
}
}
catch (Exception $e) {
if (self::isDebugOn()) {
error_log('TOTP validation error: ' . $e->getMessage());
}
} // Couldn't connect to noc1, let them sign in since the password was correct.
}
else { //Old method phone authentication
$authFactor = $_POST['wordfence_authFactor'];
if (strlen($authFactor) == 4) {
$authFactor = 'wf' . $authFactor;
}
if ($authFactor == $twoFactorRecord[2] && $twoFactorRecord[4] > time()) { // Set this 2FA code to expire in 30 seconds (for other plugins hooking into the auth process)
$twoFactorRecord[4] = time() + 30;
wfConfig::set_ser('twoFactorUsers', $twoFactorUsers);
}
else if ($authFactor == $twoFactorRecord[2]) {
$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());
try {
$codeResult = $api->call('twoFactor_verification', array(), array('phone' => $twoFactorRecord[1]));
if (isset($codeResult['notPaid']) && $codeResult['notPaid']) {
//No longer a paid key, let them sign in without two factor
}
else if (isset($codeResult['ok']) && $codeResult['ok']) {
$twoFactorRecord[2] = $codeResult['code'];
$twoFactorRecord[4] = time() + 1800; //30 minutes until code expires
wfConfig::set_ser('twoFactorUsers', $twoFactorUsers); //save the code the user needs to enter and return an error.
$loginNonce = wfWAFUtils::random_bytes(20);
if ($loginNonce === false) { //Should never happen but is technically possible
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_required', wp_kses(__('AUTHENTICATION FAILURE: A temporary failure was encountered while trying to log in. Please try again.', 'wordfence'), array('strong'=>array())));
return self::$authError;
}
$loginNonce = bin2hex($loginNonce);
update_user_meta($userDat->ID, '_wf_twoFactorNonce', $loginNonce);
update_user_meta($userDat->ID, '_wf_twoFactorNonceTime', time());
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_required', wp_kses(__('CODE EXPIRED. CHECK YOUR PHONE: The code you entered has expired. Codes are only valid for 30 minutes for security reasons. We have sent you a new code. Please sign in using your username, password, and the new code we sent you.', 'wordfence'), array('strong'=>array())) . '');
return self::$authError;
}
//else: No new code was received. Let them sign in with the expired code.
}
catch (Exception $e) {
// Couldn't connect to noc1, let them sign in since the password was correct.
}
}
else { //Bad code, so cancel the login and return an error to user.
$loginNonce = wfWAFUtils::random_bytes(20);
if ($loginNonce === false) { //Should never happen but is technically possible
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_required', wp_kses(__('AUTHENTICATION FAILURE: A temporary failure was encountered while trying to log in. Please try again.', 'wordfence'), array('strong'=>array())));
return self::$authError;
}
$loginNonce = bin2hex($loginNonce);
update_user_meta($userDat->ID, '_wf_twoFactorNonce', $loginNonce);
update_user_meta($userDat->ID, '_wf_twoFactorNonceTime', time());
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_invalid', wp_kses(__('INVALID CODE: You need to enter your password and the code we sent to your phone. The code should start with \'wf\' and should be four characters (e.g., wfAB12).', 'wordfence'), array('strong'=>array())) . '');
return self::processBruteForceAttempt(self::$authError, $username, $passwd);
}
}
delete_user_meta($userDat->ID, '_wf_twoFactorNonce');
delete_user_meta($userDat->ID, '_wf_twoFactorNonceTime');
$authUser = $userDat; //Log in as the user we saved in the wp_authenticate action
}
else if (is_object($authUser) && get_class($authUser) == 'WP_User') { //User authenticated with name and password, prompt for the 2FA code
//Verify at least one administrator has 2FA enabled
$requireAdminTwoFactor = $hasActivatedTwoFactorUser && wfConfig::get('loginSec_requireAdminTwoFactor');
if ($twoFactorRecord) {
if ($twoFactorRecord[0] == $userDat->ID && $twoFactorRecord[3] == 'activated') { //Yup, enabled, so require the code
if ($usingBreachedPassword) {
wfAdminNoticeQueue::removeAdminNoticeForCategory('previousIPBreachPassword', $authUser->ID);
wfAdminNoticeQueue::addAdminNotice(wfAdminNotice::SEVERITY_CRITICAL, sprintf(
/* translators: 1. WordPress admin panel URL. 2. Support URL. */
__('WARNING: The password you are using exists on lists of passwords leaked in data breaches. Attackers use such lists to break into sites and install malicious code. Please change your password. Learn More (opens in new tab)', 'wordfence'), self_admin_url('profile.php'), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD)), '2faBreachPassword', array($authUser->ID));
}
$loginNonce = wfWAFUtils::random_bytes(20);
if ($loginNonce === false) { //Should never happen but is technically possible, allow login
$requireAdminTwoFactor = false;
}
else {
$loginNonce = bin2hex($loginNonce);
update_user_meta($userDat->ID, '_wf_twoFactorNonce', $loginNonce);
update_user_meta($userDat->ID, '_wf_twoFactorNonceTime', time());
if (isset($twoFactorRecord[5])) { //New method TOTP authentication
if ($twoFactorRecord[5] == 'authenticator') {
if (self::hasGDLimitLoginsMUPlugin() && function_exists('limit_login_get_address')) {
$retries = get_option('limit_login_retries', array());
$ip = limit_login_get_address();
if (!is_array($retries)) {
$retries = array();
}
if (isset($retries[$ip]) && is_int($retries[$ip])) {
$retries[$ip]--;
}
else {
$retries[$ip] = 0;
}
update_option('limit_login_retries', $retries);
}
$allowSeparatePrompt = ini_get('output_buffering') > 0;
if (wfConfig::get('loginSec_enableSeparateTwoFactor') && $allowSeparatePrompt) {
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_required', wp_kses(__('CODE REQUIRED: Please check your authenticator app for the current code. Enter it below to sign in.', 'wordfence'), array('strong'=>array())) . '');
return self::$authError;
}
else {
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_required', wp_kses(__('CODE REQUIRED: Please check your authenticator app for the current code. Please sign in again and add a space, the letters wf, and the code to the end of your password (e.g., wf123456).', 'wordfence'), array('strong'=>array(), 'code'=>array())));
return self::$authError;
}
}
else {
//Phone TOTP
$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());
try {
$codeResult = $api->call('twoFactorTOTP_sms', array(), array('totpid' => $twoFactorRecord[6]));
if (isset($codeResult['notPaid']) && $codeResult['notPaid']) {
$requireAdminTwoFactor = false;
//Let them sign in without two factor if their API key has expired or they're not paid and for some reason they have this set up.
}
else {
if (isset($codeResult['ok']) && $codeResult['ok']) {
if (self::hasGDLimitLoginsMUPlugin() && function_exists('limit_login_get_address')) {
$retries = get_option('limit_login_retries', array());
$ip = limit_login_get_address();
if (!is_array($retries)) {
$retries = array();
}
if (isset($retries[$ip]) && is_int($retries[$ip])) {
$retries[$ip]--;
}
else {
$retries[$ip] = 0;
}
update_option('limit_login_retries', $retries);
}
$allowSeparatePrompt = ini_get('output_buffering') > 0;
if (wfConfig::get('loginSec_enableSeparateTwoFactor') && $allowSeparatePrompt) {
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_required', wp_kses(__('CHECK YOUR PHONE: A code has been sent to your phone and will arrive within 30 seconds. Enter it below to sign in.', 'wordfence'), array('strong'=>array())) . '');
return self::$authError;
}
else {
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_required', wp_kses(__('CHECK YOUR PHONE: A code has been sent to your phone and will arrive within 30 seconds. Please sign in again and add a space, the letters wf, and the code to the end of your password (e.g., wf123456).', 'wordfence'), array('strong'=>array(), 'code'=>array())));
return self::$authError;
}
}
else { //oops, our API returned an error.
$requireAdminTwoFactor = false;
//Let them sign in without two factor because the API is broken and we don't want to lock users out of their own systems.
}
}
}
catch (Exception $e) {
if (self::isDebugOn()) {
error_log('TOTP SMS error: ' . $e->getMessage());
}
$requireAdminTwoFactor = false;
// Couldn't connect to noc1, let them sign in since the password was correct.
}
}
}
else { //Old method phone authentication
$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());
try {
$codeResult = $api->call('twoFactor_verification', array(), array('phone' => $twoFactorRecord[1]));
if (isset($codeResult['notPaid']) && $codeResult['notPaid']) {
$requireAdminTwoFactor = false;
//Let them sign in without two factor if their API key has expired or they're not paid and for some reason they have this set up.
}
else {
if (isset($codeResult['ok']) && $codeResult['ok']) {
$twoFactorRecord[2] = $codeResult['code'];
$twoFactorRecord[4] = time() + 1800; //30 minutes until code expires
wfConfig::set_ser('twoFactorUsers', $twoFactorUsers); //save the code the user needs to enter and return an error.
if (self::hasGDLimitLoginsMUPlugin() && function_exists('limit_login_get_address')) {
$retries = get_option('limit_login_retries', array());
$ip = limit_login_get_address();
if (!is_array($retries)) {
$retries = array();
}
if (isset($retries[$ip]) && is_int($retries[$ip])) {
$retries[$ip]--;
}
else {
$retries[$ip] = 0;
}
update_option('limit_login_retries', $retries);
}
$allowSeparatePrompt = ini_get('output_buffering') > 0;
if (wfConfig::get('loginSec_enableSeparateTwoFactor') && $allowSeparatePrompt) {
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_required', wp_kses(__('CHECK YOUR PHONE: A code has been sent to your phone and will arrive within 30 seconds. Enter it below to sign in.', 'wordfence'), array('strong'=>array())) . '');
return self::$authError;
}
else {
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('twofactor_required', wp_kses(__('CHECK YOUR PHONE: A code has been sent to your phone and will arrive within 30 seconds. Please sign in again and add a space and the code to the end of your password (e.g., wfABCD).', 'wordfence'), array('strong'=>array(), 'code'=>array())));
return self::$authError;
}
}
else { //oops, our API returned an error.
$requireAdminTwoFactor = false;
//Let them sign in without two factor because the API is broken and we don't want to lock users out of their own systems.
}
}
}
catch (Exception $e) {
$requireAdminTwoFactor = false;
// Couldn't connect to noc1, let them sign in since the password was correct.
}
} //end: Old method phone authentication
}
}
}
else if ($usingBreachedPassword) {
if (wfCredentialsController::hasPreviousLoginFromIP($authUser, wfUtils::getIP())) {
wfAdminNoticeQueue::removeAdminNoticeForCategory('2faBreachPassword', $authUser->ID);
wfAdminNoticeQueue::addAdminNotice(wfAdminNotice::SEVERITY_CRITICAL, sprintf(__('WARNING: Your login has been allowed because you have previously logged in from the same IP, but you will be blocked if your IP changes. The password you are using exists on lists of passwords leaked in data breaches. Attackers use such lists to break into sites and install malicious code. Please change your password. Learn More (opens in new tab)', 'wordfence'), self_admin_url('profile.php'), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD)), 'previousIPBreachPassword', array($authUser->ID));
}
else {
$username = $authUser->user_login;
self::getLog()->logLogin('loginFailValidUsername', 1, $username);
$alertCallback = array(new wfBreachLoginAlert($username, wp_lostpassword_url(), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD), wfUtils::getIP()), 'send');
do_action('wordfence_security_event', 'breachLogin', array(
'username' => $username,
'resetPasswordURL' => wp_lostpassword_url(),
'supportURL' => wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD),
'ip' => wfUtils::getIP(),
), $alertCallback);
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('breached_password', sprintf(
/* translators: 1. Reset password URL. 2. Support URL. */
wp_kses(__('INSECURE PASSWORD: Your login attempt has been blocked because the password you are using exists on lists of passwords leaked in data breaches. Attackers use such lists to break into sites and install malicious code. Please reset your password to reactivate your account. Learn More (opens in new tab)', 'wordfence'), array('strong'=>array(), 'a'=>array('href'=>array(), 'target'=>array(), 'rel'=>array()), 'span'=>array('style'=>array()))), wp_lostpassword_url(), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD)));
return self::$authError;
}
}
if ($requireAdminTwoFactor && wfUtils::isAdmin($authUser)) {
$username = $authUser->user_login;
self::getLog()->logLogin('loginFailValidUsername', 1, $username);
wordfence::alert(__("Admin Login Blocked", 'wordfence'), sprintf(/* translators: WordPress username. */__("A user with username \"%s\" who has administrator access tried to sign in to your WordPress site. Access was denied because all administrator accounts are required to have Cellphone Sign-in enabled but this account does not.", 'wordfence'), $username), wfUtils::getIP());
self::$authError = new WP_Error('twofactor_disabled_required', wp_kses(__('Cellphone Sign-in Required: Cellphone Sign-in is required for all administrator accounts. Please contact the site administrator to enable it for your account.', 'wordfence'), array('strong'=>array())));
return self::$authError;
}
//User is not configured for two factor. Sign in without two factor.
}
} //End: if ($checkTwoFactor)
else if ($usingBreachedPassword) {
if (wfCredentialsController::hasPreviousLoginFromIP($authUser, wfUtils::getIP())) {
wfAdminNoticeQueue::removeAdminNoticeForCategory('2faBreachPassword', $authUser->ID);
wfAdminNoticeQueue::addAdminNotice(wfAdminNotice::SEVERITY_CRITICAL, sprintf(/* translators: 1. Reset password URL. 2. Support URL. */ __('WARNING: Your login has been allowed because you have previously logged in from the same IP, but you will be blocked if your IP changes. The password you are using exists on lists of passwords leaked in data breaches. Attackers use such lists to break into sites and install malicious code. Please change your password. Learn More (opens in new tab)', 'wordfence'), self_admin_url('profile.php'), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD)), 'previousIPBreachPassword', array($authUser->ID));
}
else {
$username = $authUser->user_login;
self::getLog()->logLogin('loginFailValidUsername', 1, $username);
$alertCallback = array(new wfBreachLoginAlert($username, wp_lostpassword_url(), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD), wfUtils::getIP()), 'send');
do_action('wordfence_security_event', 'breachLogin', array(
'username' => $username,
'resetPasswordURL' => wp_lostpassword_url(),
'supportURL' => wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD),
'ip' => wfUtils::getIP(),
), $alertCallback);
remove_action('login_errors', 'limit_login_fixup_error_messages'); //We're forced to do this because limit-login-attempts does not have any allowances for legitimate error messages
self::$authError = new WP_Error('breached_password', sprintf(
/* translators: 1. Reset password URL. 2. Support URL. */
wp_kses(__('INSECURE PASSWORD: Your login attempt has been blocked because the password you are using exists on lists of passwords leaked in data breaches. Attackers use such lists to break into sites and install malicious code. Please reset your password to reactivate your account. Learn More (opens in new tab)', 'wordfence'), array('strong'=>array(), 'a'=>array('href'=>array(), 'target'=>array(), 'rel'=>array()), 'span'=>array('style'=>array()))), wp_lostpassword_url(), wfSupportController::esc_supportURL(wfSupportController::ITEM_USING_BREACH_PASSWORD)));
return self::$authError;
}
}
return self::processBruteForceAttempt($authUser, $username, $passwd);
}
public static function checkSecurityNetwork($endpointType = null) {
if (wfConfig::get('other_WFNet')) {
$IP = wfUtils::getIP();
if ($maxBlockTime = self::wfsnIsBlocked($IP, 'brute', $endpointType)) {
$secsToGo = ($maxBlockTime ? $maxBlockTime : wfBlock::blockDuration());
$reason = wfWAFBlockI18n::getBlockDescription(wfWAFBlockI18n::WFWAF_BLOCK_WFSN);
wfBlock::createWFSN($reason, $IP, $secsToGo, time(), time(), 1);
wfActivityReport::logBlockedIP($IP, null, 'brute');
self::getLog()->tagRequestForBlock($reason, true);
self::getLog()->getCurrentRequest()->action = 'blocked:wfsn';
self::getLog()->do503($secsToGo, $reason); //exits
}
}
}
public static function processBruteForceAttempt($authUser, $username, $passwd) {
$IP = wfUtils::getIP();
$secEnabled = wfConfig::get('loginSecurityEnabled');
if (wfBlock::isWhitelisted($IP)) {
return $authUser;
}
$failureErrorCodes = array('invalid_username', 'invalid_email', 'incorrect_password', 'twofactor_invalid', 'authentication_failed', 'wfls_twofactor_invalid', 'wfls_twofactor_failed', 'wfls_twofactor_blocked');
if (is_wp_error($authUser) && in_array($authUser->get_error_code(), $failureErrorCodes)) {
self::checkSecurityNetwork(); //May exit
}
if($secEnabled){
if(is_wp_error($authUser) && ($authUser->get_error_code() == 'invalid_username' || $authUser->get_error_code() == 'invalid_email')){
if($blacklist = wfConfig::get('loginSec_userBlacklist')){
$users = explode("\n", wfUtils::cleanupOneEntryPerLine($blacklist));
foreach($users as $user){
if(strtolower($username) == strtolower($user)){
$secsToGo = wfBlock::blockDuration();
$reason = wfWAFBlockI18n::getBlockDescription(wfWAFBlockI18n::WFWAF_BLOCK_LOGINSEC);
wfBlock::createIP($reason, $IP, $secsToGo, time(), time(), 1, wfBlock::TYPE_IP_AUTOMATIC_TEMPORARY);
wfActivityReport::logBlockedIP($IP, null, 'brute');
self::getLog()->tagRequestForBlock($reason);
self::getLog()->do503($secsToGo, $reason); //exits
}
}
}
if(wfConfig::get('loginSec_lockInvalidUsers')){
if(strlen($username) > 0 && preg_match('/[^\r\s\n\t]+/', $username)){
self::lockOutIP($IP, wfWAFBlockI18n::getBlockDescription(wfWAFBlockI18n::WFWAF_BLOCK_INVALIDUSERNAME, $username));
self::getLog()->logLogin('loginFailInvalidUsername', true, $username);
}
$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));
require(dirname(__FILE__) . '/wfLockedOut.php');
}
}
$tKey = self::getLoginFailureCountTransient($IP);
if(is_wp_error($authUser) && in_array($authUser->get_error_code(), $failureErrorCodes)) {
$tries = get_transient($tKey);
if($tries){
$tries++;
} else {
$tries = 1;
}
if($tries >= wfConfig::get('loginSec_maxFailures')){
self::lockOutIP($IP,
wfWAFBlockI18n::getBlockDescription(
wfWAFBlockI18n::WFWAF_BLOCK_LOGINSEC_FAILURES,
wfConfig::get('loginSec_maxFailures'),
$username
)
);
$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));
require(dirname(__FILE__) . '/wfLockedOut.php');
}
set_transient($tKey, $tries, wfConfig::get('loginSec_countFailMins') * 60);
}
}
if(is_wp_error($authUser)){
if($authUser->get_error_code() == 'invalid_username' || $authUser->get_error_code() == 'invalid_email'){
self::getLog()->logLogin('loginFailInvalidUsername', 1, $username);
} else {
self::getLog()->logLogin('loginFailValidUsername', 1, $username);
}
}
if(is_wp_error($authUser) && ($authUser->get_error_code() == 'invalid_username' || $authUser->get_error_code() == 'invalid_email' || $authUser->get_error_code() == 'incorrect_password') && wfConfig::get('loginSec_maskLoginErrors')){
return new WP_Error( 'incorrect_password', sprintf(
/* translators: 1. WordPress username. 2. Password reset URL. */
wp_kses(__( 'ERROR: The username or password you entered is incorrect. Lost your password?', 'wordfence' ), array('strong'=>array(), 'a'=>array('href'=>array(), 'title'=>array()))), $username, wp_lostpassword_url() ) );
}
return $authUser;
}
public static function wfsnBatchReportBlockedAttempts() {
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
$threshold = wfConfig::get('lastBruteForceDataSendTime', 0);;
$wfdb = new wfDB();
$table_wfHits = wfDB::networkTable('wfHits');
$rawBlocks = $wfdb->querySelect("SELECT IP, ctime, actionData FROM {$table_wfHits} WHERE ctime > %f AND action = 'blocked:wfsnrepeat' ORDER BY ctime ASC LIMIT 100", sprintf('%.6f', $threshold));
$totalRows = $wfdb->querySingle("SELECT COUNT(*) FROM {$table_wfHits} WHERE ctime > %f AND action = 'blocked:wfsnrepeat'", sprintf('%.6f', $threshold));
$ipCounts = array();
$maxctime = 0;
foreach ($rawBlocks as $record) {
$maxctime = max($maxctime, $record['ctime']);
$endpointType = 0;
if (!empty($record['actionData'])) {
$actionData = wfRequestModel::unserializeActionData($record['actionData']);
if (isset($actionData['type'])) {
$endpointType = $actionData['type'];
}
}
if (isset($ipCounts[$record['IP']])) {
$ipCounts[$record['IP']] = array();
}
if (isset($ipCounts[$record['IP']][$endpointType])) {
$ipCounts[$record['IP']][$endpointType]++;
}
else {
$ipCounts[$record['IP']][$endpointType] = 1;
}
}
$toSend = array();
foreach ($ipCounts as $IP => $endpoints) {
foreach ($endpoints as $endpointType => $count) {
$toSend[] = array('IP' => base64_encode($IP), 'count' => $count, 'blocked' => 1, 'type' => $endpointType);
}
}
try {
$response = wp_remote_post(WORDFENCE_HACKATTEMPT_URL_SEC . 'multipleHackAttempts/?k=' . rawurlencode(wfConfig::get('apiKey')) . '&t=brute', array(
'timeout' => 2,
'user-agent' => "Wordfence.com UA " . (defined('WORDFENCE_VERSION') ? WORDFENCE_VERSION : '[Unknown version]'),
'body' => 'IPs=' . rawurlencode(json_encode($toSend)),
'headers' => array('Referer' => false),
));
if (!is_wp_error($response)) {
if ($totalRows > 100) {
self::wfsnScheduleBatchReportBlockedAttempts();
}
wfConfig::set('lastBruteForceDataSendTime', $maxctime);
}
else {
self::wfsnScheduleBatchReportBlockedAttempts();
}
}
catch (Exception $err) {
//Do nothing
}
}
private static function wfsnScheduleBatchReportBlockedAttempts($timeToSend = null) {
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
if ($timeToSend === null) {
$timeToSend = time() + 30;
}
$notMainSite = is_multisite() && !is_main_site();
if ($notMainSite) {
global $current_site;
switch_to_blog($current_site->blog_id);
}
if (!wp_next_scheduled('wordfence_batchReportBlockedAttempts')) {
wp_schedule_single_event($timeToSend, 'wordfence_batchReportBlockedAttempts');
}
if ($notMainSite) {
restore_current_blog();
}
}
public static function wfsnReportBlockedAttempt($IP, $type){
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
self::wfsnScheduleBatchReportBlockedAttempts();
$endpointType = self::wfsnEndpointType();
self::getLog()->getCurrentRequest()->actionData = wfRequestModel::serializeActionData(array('type' => $endpointType));
}
public static function wfsnBatchReportFailedAttempts() {
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
$threshold = time();
$wfdb = new wfDB();
$table_wfSNIPCache = wfDB::networkTable('wfSNIPCache');
$rawRecords = $wfdb->querySelect("SELECT id, IP, type, count, 1 AS failed FROM {$table_wfSNIPCache} WHERE count > 0 AND expiration < FROM_UNIXTIME(%d) LIMIT 100", $threshold);
$toSend = array();
$toDelete = array();
if (count($rawRecords)) {
foreach ($rawRecords as $record) {
$toDelete[] = $record['id'];
unset($record['id']);
$record['IP'] = base64_encode(filter_var($record['IP'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) ? wfUtils::inet_aton($record['IP']) : wfUtils::inet_pton($record['IP']));
$key = $record['IP'] . $record['type']; //Aggregate multiple records if for some reason there are multiple for an IP/type combination
if (!isset($toSend[$key])) {
$toSend[$key] = $record;
}
else {
$toSend[$key]['count'] += $record['count'];
}
}
$toSend = array_values($toSend);
try {
$response = wp_remote_post(WORDFENCE_HACKATTEMPT_URL_SEC . 'multipleHackAttempts/?k=' . rawurlencode(wfConfig::get('apiKey')) . '&t=brute', array(
'timeout' => 2,
'user-agent' => "Wordfence.com UA " . (defined('WORDFENCE_VERSION') ? WORDFENCE_VERSION : '[Unknown version]'),
'body' => 'IPs=' . rawurlencode(json_encode($toSend)),
'headers' => array('Referer' => false),
));
if (is_wp_error($response)) {
self::wfsnScheduleBatchReportFailedAttempts();
return;
}
}
catch (Exception $err) {
//Do nothing
}
}
array_unshift($toDelete, $threshold);
$wfdb->queryWriteIgnoreError("DELETE FROM {$table_wfSNIPCache} WHERE (expiration < FROM_UNIXTIME(%d) AND count = 0)" . (count($toDelete) > 1 ? " OR id IN (" . rtrim(str_repeat('%d, ', count($toDelete) - 1), ', ') . ")" : ""), $toDelete);
$remainingRows = $wfdb->querySingle("SELECT COUNT(*) FROM {$table_wfSNIPCache}");
if ($remainingRows > 0) {
self::wfsnScheduleBatchReportFailedAttempts();
}
}
private static function wfsnScheduleBatchReportFailedAttempts($timeToSend = null) {
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
if ($timeToSend === null) {
$timeToSend = time() + 30;
}
$notMainSite = is_multisite() && !is_main_site();
if ($notMainSite) {
global $current_site;
switch_to_blog($current_site->blog_id);
}
if (!wp_next_scheduled('wordfence_batchReportFailedAttempts')) {
wp_schedule_single_event($timeToSend, 'wordfence_batchReportFailedAttempts');
}
if ($notMainSite) {
restore_current_blog();
}
}
public static function wfsnIsBlocked($IP, $hitType, $endpointType = null) {
if (!defined('DONOTCACHEDB')) { define('DONOTCACHEDB', true); }
$wfdb = new wfDB();
if ($endpointType === null) { $endpointType = self::wfsnEndpointType(); }
$table_wfSNIPCache = wfDB::networkTable('wfSNIPCache');
$cachedRecord = $wfdb->querySingleRec("SELECT id, body FROM {$table_wfSNIPCache} WHERE IP = '%s' AND type = %d AND expiration > NOW()", $IP, $endpointType);
if (isset($cachedRecord)) {
$wfdb->queryWriteIgnoreError("UPDATE {$table_wfSNIPCache} SET count = count + 1 WHERE id = %d", $cachedRecord['id']);
if (preg_match('/BLOCKED:(\d+)/', $cachedRecord['body'], $matches) && (!wfBlock::isWhitelisted($IP))) {
return $matches[1];
}
return false;
}
$backoff = get_transient('wfsn_backoff');
if ($backoff) {
return false;
}
try {
$result = wp_remote_get(WORDFENCE_HACKATTEMPT_URL_SEC . 'hackAttempt/?k=' . rawurlencode(wfConfig::get('apiKey')) .
'&IP=' . rawurlencode(filter_var($IP, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) ? wfUtils::inet_aton($IP) : wfUtils::inet_pton($IP)) .
'&t=' . rawurlencode($hitType) .
'&type=' . $endpointType,
array(
'timeout' => 3,
'user-agent' => "Wordfence.com UA " . (defined('WORDFENCE_VERSION') ? WORDFENCE_VERSION : '[Unknown version]'),
'headers' => array('Referer' => false),
));
if (is_wp_error($result)) {
set_transient('wfsn_backoff', 1, WORDFENCE_NOC3_FAILED_BACKOFF_TIME);
return false;
}
$wfdb->queryWriteIgnoreError("INSERT INTO {$table_wfSNIPCache} (IP, type, expiration, body) VALUES ('%s', %d, DATE_ADD(NOW(), INTERVAL %d SECOND), '%s')", $IP, $endpointType, 30, $result['body']);
self::wfsnScheduleBatchReportFailedAttempts();
if (preg_match('/BLOCKED:(\d+)/', $result['body'], $matches) && (!wfBlock::isWhitelisted($IP))) {
return $matches[1];
}
return false;
} catch (Exception $err) {
set_transient('wfsn_backoff', 1, WORDFENCE_NOC3_FAILED_BACKOFF_TIME);
return false;
}
}
public static function wfsnEndpointType() {
$type = 0; //Unknown
if (defined('XMLRPC_REQUEST') && XMLRPC_REQUEST) {
$type = 2;
}
else if (defined('DOING_AJAX') && DOING_AJAX) {
$type = 3;
if (isset($_REQUEST['action']) && ($_REQUEST['action'] == 'wordfence_ls_authenticate' || $_REQUEST['action'] == 'nopriv_wordfence_ls_authenticate')) {
$type = 301;
}
}
else if (strpos($_SERVER['REQUEST_URI'], '/wp-login.php') !== false) {
$type = 1;
}
return $type;
}
public static function logoutAction(){
$userID = self::getLog()->getCurrentRequest()->userID;
$userDat = get_user_by('id', $userID);
if(is_object($userDat)){
self::getLog()->logLogin('logout', 0, $userDat->user_login);
}
// Unset the roadblock cookie
if (!WFWAF_SUBDIRECTORY_INSTALL) {
wfUtils::setcookie(wfWAF::getInstance()->getAuthCookieName(), ' ', time() - (86400 * 365), '/', null, wfUtils::isFullSSL(), true);
}
}
public static function loginInitAction() {
$lockout = wfBlock::lockoutForIP(wfUtils::getIP());
if ($lockout !== false) {
$lockout->recordBlock();
$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));
require(dirname(__FILE__) . '/wfLockedOut.php');
}
self::doEarlyAccessLogging(); //Rate limiting
}
public static function authAction(&$username, &$passwd){
$lockout = wfBlock::lockoutForIP(wfUtils::getIP());
if ($lockout !== false) {
$lockout->recordBlock();
$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));
require(dirname(__FILE__) . '/wfLockedOut.php');
}
if (isset($_POST['wordfence_twoFactorUser']) && isset($_POST['wordfence_twoFactorNonce'])) { //Final stage of login -- get and verify 2fa code, make sure we load the appropriate user
$userID = intval($_POST['wordfence_twoFactorUser']);
$twoFactorNonce = preg_replace('/[^a-f0-9]/i', '', $_POST['wordfence_twoFactorNonce']);
if (self::verifyTwoFactorIntermediateValues($userID, $twoFactorNonce)) {
$user = get_user_by('ID', $userID);
$username = $user->user_login;
$passwd = $twoFactorNonce;
self::$userDat = $user;
return;
}
}
if (is_array($username) || is_array($passwd)) { return; }
//Intermediate stage of login
if(! $username){ return; }
$userDat = get_user_by('login', $username);
if (!$userDat) {
$userDat = get_user_by('email', $username);
}
self::$userDat = $userDat;
if(preg_match(self::$passwordCodePattern, $passwd, $matches)){
$_POST['wordfence_authFactor'] = $matches[1];
$passwd = preg_replace('/^(.+)\s+wf([a-z0-9 ]+)$/i', '$1', $passwd);
$_POST['pwd'] = $passwd;
}
}
public static function authUserAction($user, $password) {
$lockout = wfBlock::lockoutForIP(wfUtils::getIP());
if ($lockout !== false) {
$lockout->recordBlock();
$customText = wpautop(wp_strip_all_tags(wfConfig::get('blockCustomText', '')));
require(dirname(__FILE__) . '/wfLockedOut.php');
}
return $user;
}
public static function getWPFileContent($file, $cType, $cName, $cVersion){
if ($cType == 'plugin') {
if (preg_match('#^/?wp-content/plugins/[^/]+/#', $file)) {
$file = preg_replace('#^/?wp-content/plugins/[^/]+/#', '', $file);
}
else {
//If user is using non-standard wp-content dir, then use /plugins/ in pattern to figure out what to strip off
$file = preg_replace('#^.*[^/]+/plugins/[^/]+/#', '', $file);
}
}
else if ($cType == 'theme') {
if (preg_match('#/?wp-content/themes/[^/]+/#', $file)) {
$file = preg_replace('#/?wp-content/themes/[^/]+/#', '', $file);
}
else {
$file = preg_replace('#^.*[^/]+/themes/[^/]+/#', '', $file);
}
}
else if ($cType == 'core') {
//No special processing
}
else {
return array('errorMsg' => __('An invalid type was specified to get file.', 'wordfence'));
}
$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());
try {
$contResult = $api->binCall('get_wp_file_content', array(
'v' => wfUtils::getWPVersion(),
'file' => $file,
'cType' => $cType,
'cName' => $cName,
'cVersion' => $cVersion
));
if ($contResult['data']) {
return array('fileContent' => $contResult['data']);
}
throw new Exception(__('We could not fetch a core WordPress file from the Wordfence API.', 'wordfence'));
}
catch (Exception $e) {
return array('errorMsg' => wp_kses($e->getMessage(), array()));
}
}
public static function ajax_sendDiagnostic_callback(){
add_filter('gettext', 'wordfence::_diagnosticsTranslationDisabler', 0, 3);
$inEmail = true;
$body = "This email is the diagnostic from " . site_url() . ".\nThe IP address that requested this was: " . wfUtils::getIP() . "\nTicket Number/Forum Username: " . $_POST['ticket'];
$sendingDiagnosticEmail = true;
ob_start();
require(dirname(__FILE__) . '/menu_tools_diagnostic.php');
$body = nl2br($body) . ob_get_clean();
$findReplace = array(
'display_errors to Off in your php.ini if your site is on a VPS or dedicated server that you control.", 'wordfence'),
);
}
$issues->updateIssue($_POST['issueID'], 'delete');
wfScanEngine::refreshScanNotification($issues);
return array('ok' => 1);
}
public static function ajax_restoreFile_callback($issueID = null){
if ($issueID === null) {
$issueID = intval($_POST['issueID']);
}
$wfIssues = new wfIssues();
$issue = $wfIssues->getIssueByID($issueID);
if(! $issue){
return array('cerrorMsg' => __("We could not find that issue in our database.", 'wordfence'));
}
/** @var WP_Filesystem_Base $wp_filesystem */
global $wp_filesystem;
$adminURL = network_admin_url('admin.php?' . http_build_query(array(
'page' => 'WordfenceScan',
'subpage' => 'scan_credentials',
'action' => 'restoreFile',
'issueID' => $issueID,
'nonce' => wp_create_nonce('wp-ajax'),
)));
if (!self::requestFilesystemCredentials($adminURL, null, true, false)) {
return array(
'ok' => 1,
'needsCredentials' => true,
'redirect' => $adminURL,
);
}
$dat = $issue['data'];
$result = self::getWPFileContent($dat['file'], $dat['cType'], (isset($dat['cName']) ? $dat['cName'] : ''), (isset($dat['cVersion']) ? $dat['cVersion'] : ''));
$file = $dat['file'];
if(isset($result['errorMsg']) && $result['errorMsg']){
return $result;
} else if(! $result['fileContent']){
return array('errorMsg' => __("We could not get the original file to do a repair.", 'wordfence'));
}
if(preg_match('/\.\./', $file)){
return array('errorMsg' => __("An invalid file was specified for repair.", 'wordfence'));
}
if (array_key_exists('realFile', $dat)) {
$localFile = $dat['realFile'];
}
else {
$localFile = rtrim(ABSPATH, '/') . '/' . preg_replace('/^[\.\/]+/', '', $file);
}
if ($wp_filesystem->put_contents($localFile, $result['fileContent'])) {
$wfIssues->updateIssue($issueID, 'delete');
$counts = $wfIssues->getIssueCounts();
wfScanEngine::refreshScanNotification($wfIssues);
return array(
'ok' => 1,
'localFile' => $localFile,
'file' => $file,
'issueCounts' => $counts,
);
}
return array(
'errorMsg' => __("We could not write to that file. You may not have permission to modify files on your WordPress server.", 'wordfence'),
);
}
public static function ajax_scan_callback(){
self::status(4, 'info', __("Ajax request received to start scan.", 'wordfence'));
$err = wfScanEngine::startScan();
if ($err) {
return array('errorMsg' => wp_kses($err, array()));
}
else {
$issueCounts = array_merge(array('new' => 0, 'ignoreP' => 0, 'ignoreC' => 0), wfIssues::shared()->getIssueCounts());
return array("ok" => 1, 'issueCounts' => $issueCounts);
}
}
public static function ajax_exportSettings_callback() {
$result = wfImportExportController::shared()->export();
return $result;
}
public static function ajax_importSettings_callback(){
$token = $_POST['token'];
return self::importSettings($token);
}
public static function importSettings($token) { //Documented call for external interfacing.
return wfImportExportController::shared()->import($token);
}
public static function ajax_dismissNotification_callback() {
$id = $_POST['id'];
$n = wfNotification::getNotificationForID($id);
if ($n !== null) {
$n->markAsRead();
}
return array(
'ok' => 1,
);
}
public static function ajax_utilityScanForBlacklisted_callback() {
if (wfScanner::shared()->isRunning()) {
return array('wait' => 2); //Can't run while a scan is running since the URL hoover is currently implemented like a singleton
}
$pageURL = stripslashes($_POST['url']);
$source = stripslashes($_POST['source']);
$apiKey = wfConfig::get('apiKey');
$wp_version = wfUtils::getWPVersion();
$h = new wordfenceURLHoover($apiKey, $wp_version);
$h->hoover(1, $source);
$hooverResults = $h->getBaddies();
if ($h->errorMsg) {
$h->cleanup();
return array('wait' => 3, 'errorMsg' => $h->errorMsg); //Unable to contact noc1 to verify
}
$h->cleanup();
if (sizeof($hooverResults) > 0 && isset($hooverResults[1])) {
$hresults = $hooverResults[1];
$count = count($hresults);
if ($count > 0) {
new wfNotification(
null,
wfNotification::PRIORITY_HIGH_WARNING,
sprintf(/* translators: Number of URLs. */ _n("Page contains %d malware URL: ", "Page contains %d malware URLs: ", $count, 'wordfence') . esc_html($pageURL)),
'wfplugin_malwareurl_' . md5($pageURL),
null,
array(array('link' => wfUtils::wpAdminURL('admin.php?page=WordfenceScan'), 'label' => __('Run a Scan', 'wordfence'))));
return array('bad' => $count);
}
}
return array('ok' => 1);
}
public static function ajax_dashboardShowMore_callback() {
$grouping = $_POST['grouping'];
$period = $_POST['period'];
$dashboard = new wfDashboard();
if ($grouping == 'ips') {
$data = null;
if ($period == '24h') { $data = $dashboard->ips24h; }
else if ($period == '7d') { $data = $dashboard->ips7d; }
else if ($period == '30d') { $data = $dashboard->ips30d; }
if ($data !== null) {
return array('ok' => 1, 'data' => $data);
}
}
else if ($grouping == 'logins') {
$data = null;
if ($period == 'success') { $data = $dashboard->loginsSuccess; }
else if ($period == 'fail') { $data = $dashboard->loginsFail; }
if ($data !== null) {
$data = array_slice($data, 0, 100);
return array('ok' => 1, 'data' => $data);
}
}
return array('error' => __('Unknown dashboard data set.', 'wordfence'));
}
public static function templateRedir(){
if (!empty($_GET['wordfence_lh'])) {
self::ajax_lh_callback();
exit;
}
if (!empty($_GET['wfcentral_admin_redirect'])) {
wp_safe_redirect(remove_query_arg('wfcentral_admin_redirect', network_admin_url('admin.php?page=Wordfence' . rawurlencode(ucwords(preg_replace('/\W/', '', $_GET['wfcentral_admin_redirect']))) . '&' . $_SERVER['QUERY_STRING'])));
exit;
}
$wfFunc = !empty($_GET['_wfsf']) && is_string($_GET['_wfsf']) ? $_GET['_wfsf'] : '';
//Logging
self::doEarlyAccessLogging();
//End logging
if(! ($wfFunc == 'diff' || $wfFunc == 'view' || $wfFunc == 'viewOption' || $wfFunc == 'sysinfo' || $wfFunc == 'IPTraf' || $wfFunc == 'viewActivityLog' || $wfFunc == 'testmem' || $wfFunc == 'testtime' || $wfFunc == 'download' || $wfFunc == 'blockedIPs' || ($wfFunc == 'debugWAF' && WFWAF_DEBUG))){
return;
}
if(! wfUtils::isAdmin()){
return;
}
$nonce = $_GET['nonce'];
if(! wp_verify_nonce($nonce, 'wp-ajax')){
_e("Bad security token. It may have been more than 12 hours since you reloaded the page you came from. Try reloading the page you came from. If that doesn't work, please sign out and sign-in again.", 'wordfence');
exit(0);
}
if($wfFunc == 'diff'){
self::wfFunc_diff();
} else if($wfFunc == 'view'){
self::wfFunc_view();
} else if($wfFunc == 'viewOption'){
self::wfFunc_viewOption();
} else if($wfFunc == 'sysinfo') {
require(dirname(__FILE__) . '/sysinfo.php' );
} else if($wfFunc == 'IPTraf'){
self::wfFunc_IPTraf();
} else if($wfFunc == 'viewActivityLog'){
self::wfFunc_viewActivityLog();
} else if($wfFunc == 'testmem'){
self::wfFunc_testmem();
} else if($wfFunc == 'testtime'){
self::wfFunc_testtime();
} else if($wfFunc == 'download'){
self::wfFunc_download();
} else if($wfFunc == 'blockedIPs'){
self::wfFunc_blockedIPs();
} else if($wfFunc == 'debugWAF' && WFWAF_DEBUG){
self::wfFunc_debugWAF();
}
exit(0);
}
public static function memtest_error_handler($errno, $errstr, $errfile, $errline){
echo "Error received: $errstr\n";
}
private static function wfFunc_testtime(){
header('Content-Type: text/plain');
@error_reporting(E_ALL);
wfUtils::iniSet('display_errors','On');
set_error_handler('wordfence::memtest_error_handler', E_ALL);
echo "Wordfence process duration benchmarking utility version " . WORDFENCE_VERSION . ".\n";
echo "This utility tests how long your WordPress host allows a process to run.\n\n--Starting test--\n";
echo "Starting timed test. This will take at least three minutes. Seconds elapsed are printed below.\nAn error after this line is not unusual. Read it and the elapsed seconds to determine max process running time on your host.\n";
for($i = 1; $i <= 180; $i++){
echo "\n$i:";
for($j = 0; $j < 1000; $j++){
echo '.';
}
flush();
sleep(1);
}
echo "\n--Test complete.--\n\nCongratulations, your web host allows your PHP processes to run at least 3 minutes.\n";
exit();
}
private static function wfFunc_testmem() {
header('Content-Type: text/plain');
@error_reporting(E_ALL);
wfUtils::iniSet('display_errors','On');
set_error_handler('wordfence::memtest_error_handler', E_ALL);
$memoryLimit = wfUtils::memoryLimit(); //bytes
$configuredMax = wfConfig::getInt('maxMem', 0) * 1024 * 1024; //bytes
if ($configuredMax <= 0) {
$configuredMax = $memoryLimit;
}
$stepSize = 5242880; //5 MB
echo "Wordfence Memory benchmarking utility version " . WORDFENCE_VERSION . ".\n";
echo "This utility tests if your WordPress host respects the maximum memory configured\nin their php.ini file, or if they are using other methods to limit your access to memory.\n\n--Starting test--\n";
echo "Current maximum memory configured in php.ini: " . ini_get('memory_limit') . "\n";
echo "Current memory usage: " . sprintf('%.2f', memory_get_usage(true) / (1024 * 1024)) . "M\n";
echo sprintf("Attempting to set max memory to %s.\n", wfUtils::formatBytes($configuredMax));
wfUtils::iniSet('memory_limit', ($configuredMax + $stepSize)); //Allow a little extra for testing overhead
echo sprintf("Starting memory benchmark. Seeing an error after this line is not unusual. Read the error carefully\nto determine how much memory your host allows. We have requested %s.\n", wfUtils::formatBytes($configuredMax));
if (memory_get_usage(true) < 1) {
echo "Exiting test because memory_get_usage() returned a negative number\n";
exit();
}
if (memory_get_usage(true) > (1024 * 1024 * 1024)) {
echo "Exiting because current memory usage is greater than a gigabyte.\n";
exit();
}
if (!defined('WP_SANDBOX_SCRAPING')) { define('WP_SANDBOX_SCRAPING', true); } //Disables the WP error handler in somewhat of a hacky way
$accumulatedMemory = array_fill(0, ceil($configuredMax / $stepSize), '');
$currentUsage = memory_get_usage(true);
$tenMB = 10 * 1024 * 1024;
$start = ceil($currentUsage / $tenMB) * $tenMB - $currentUsage; //Start at the closest 10 MB increment to the current usage
$testLimit = $configuredMax - memory_get_usage(true);
$finalUsage = '0';
$previous = 0;
$chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ012345678900000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111111222222222222222222233333333333333334444444444444444444444444555555555555666666666666666666";
$index = 0;
while ($start <= $testLimit) {
$accumulatedMemory[$index] = str_repeat($chars, ($start - $previous) / 256);
$finalUsage = sprintf('%.2f', (memory_get_usage(true) / 1024 / 1024));
echo "Tested up to " . $finalUsage . " megabytes.\n";
if ($start == $testLimit) { break; }
$previous = $start;
$start = min($start + $stepSize, $testLimit);
if (memory_get_usage(true) > $configuredMax) { break; }
$index++;
}
echo "--Test complete.--\n\nYour web host allows you to use at least {$finalUsage} megabytes of memory for each PHP process hosting your WordPress site.\n";
exit();
}
public static function wfLogHumanHeader(){
//Final check in case this was added as an action before the request was fully initialized
if (self::getLog()->getCurrentRequest()->jsRun || !wfConfig::liveTrafficEnabled()) {
return;
}
self::$hitID = self::getLog()->logHit();
if (self::$hitID) {
$URL = home_url('/?wordfence_lh=1&hid=' . wfUtils::encrypt(self::$hitID));
$URL = addslashes(preg_replace('/^https?:/i', '', $URL));
#Load as external script async so we don't slow page down.
echo <<
(function(url){
if(/(?:Chrome\/26\.0\.1410\.63 Safari\/537\.31|WordfenceTestMonBot)/.test(navigator.userAgent)){ return; }
var addEvent = function(evt, handler) {
if (window.addEventListener) {
document.addEventListener(evt, handler, false);
} else if (window.attachEvent) {
document.attachEvent('on' + evt, handler);
}
};
var removeEvent = function(evt, handler) {
if (window.removeEventListener) {
document.removeEventListener(evt, handler, false);
} else if (window.detachEvent) {
document.detachEvent('on' + evt, handler);
}
};
var evts = 'contextmenu dblclick drag dragend dragenter dragleave dragover dragstart drop keydown keypress keyup mousedown mousemove mouseout mouseover mouseup mousewheel scroll'.split(' ');
var logHuman = function() {
if (window.wfLogHumanRan) { return; }
window.wfLogHumanRan = true;
var wfscr = document.createElement('script');
wfscr.type = 'text/javascript';
wfscr.async = true;
wfscr.src = url + '&r=' + Math.random();
(document.getElementsByTagName('head')[0]||document.getElementsByTagName('body')[0]).appendChild(wfscr);
for (var i = 0; i < evts.length; i++) {
removeEvent(evts[i], logHuman);
}
};
for (var i = 0; i < evts.length; i++) {
addEvent(evts[i], logHuman);
}
})('$URL');
HTML;
}
}
public static function shutdownAction(){
}
public static function wfFunc_viewActivityLog(){
require(dirname(__FILE__) . '/viewFullActivityLog.php');
exit(0);
}
public static function wfFunc_IPTraf(){
$IP = $_GET['IP'];
try {
$response = self::IPTraf($IP);
$reverseLookup = $response['reverseLookup'];
$results = $response['results'];
require(dirname(__FILE__) . '/IPTraf.php');
exit(0);
} catch (InvalidArgumentException $e) {
echo $e->getMessage();
exit;
}
}
private static function IPTraf($ip) {
if(!wfUtils::isValidIP($ip)){
throw new InvalidArgumentException(__("An invalid IP address was specified.", 'wordfence'));
}
$reverseLookup = wfUtils::reverseLookup($ip);
$wfLog = wfLog::shared();
$results = array_merge(
$wfLog->getHits('hits', '404', 0, 10000, $ip),
$wfLog->getHits('hits', 'hit', 0, 10000, $ip)
);
usort($results, 'wordfence::iptrafsort');
$ids = array();
foreach ($results as $k => $r) {
if (isset($ids[$r['id']])) {
unset($results[$k]);
}
else {
$ids[$r['id']] = 1;
}
}
$results = array_values($results);
for ($i = 0; $i < count($results); $i++){
if(array_key_exists($i + 1, $results)){
$results[$i]['timeSinceLastHit'] = sprintf('%.4f', $results[$i]['ctime'] - $results[$i + 1]['ctime']);
} else {
$results[$i]['timeSinceLastHit'] = '';
}
}
return compact('reverseLookup', 'results');
}
public static function iptrafsort($b, $a){
if($a['ctime'] == $b['ctime']){ return 0; }
return ($a['ctime'] < $b['ctime']) ? -1 : 1;
}
private static function checkRealFileParameters() {
if (array_key_exists('realFile', $_GET)) {
$realFile = stripslashes($_GET['realFile']);
$token = array_key_exists('realFileToken', $_GET) ? $_GET['realFileToken'] : '';
if (!wfIssues::verifyRealFileToken($token, $realFile)) {
esc_html_e('This link has expired. Refresh the scan results page and try again.', 'wordfence');
exit(0);
}
return $realFile;
}
return null;
}
public static function wfFunc_viewOption() {
/** @var wpdb $wpdb */
global $wpdb;
$site_id = !empty($_GET['site_id']) ? absint($_GET['site_id']) : get_current_blog_id();
$option_name = !empty($_GET['option']) ? $_GET['option'] : false;
$table_options = wfDB::blogTable('options', $site_id);
$option_value = $wpdb->get_var($wpdb->prepare("SELECT option_value FROM {$table_options} WHERE option_name = %s", $option_name));
header('Content-type: text/plain');
exit($option_value);
}
public static function wfFunc_view(){
wfUtils::doNotCache();
if (WORDFENCE_DISABLE_FILE_VIEWER) {
_e("File access blocked. (WORDFENCE_DISABLE_FILE_VIEWER is true)", 'wordfence');
exit();
}
$localFile = self::checkRealFileParameters();
if ($localFile === null)
$localFile = ABSPATH . preg_replace('/^(?:\.\.|[\/]+)/', '', sanitize_text_field($_GET['file']));
if(strpos($localFile, '..') !== false){
_e("Invalid file requested. (Relative paths not allowed)", 'wordfence');
exit();
}
if(preg_match('/[\'\"<>\!\{\}\(\)\&\@\%\$\*\+\[\]\?]+/', $localFile)){
_e("File contains illegal characters.", 'wordfence');
exit();
}
$cont = @file_get_contents($localFile);
$isEmpty = false;
if(! $cont){
if(file_exists($localFile) && filesize($localFile) === 0){ //There's a remote possibility that very large files on 32 bit systems will return 0 here, but it's about 1 in 2 billion
$isEmpty = true;
} else {
$err = error_get_last();
printf(/* translators: Error message. */ __("We could not open the requested file for reading. The error was: %s", 'wordfence'), $err['message']);
exit(0);
}
}
$fileMTime = @filemtime($localFile);
$fileMTime = date('l jS \of F Y h:i:s A', $fileMTime);
try {
if(wfUtils::fileOver2Gigs($localFile)){
$fileSize = __("Greater than 2 Gigs", 'wordfence');
} else {
$fileSize = @filesize($localFile); //Checked if over 2 gigs above
$fileSize = number_format($fileSize, 0, '', ',') . ' bytes';
}
} catch(Exception $e){ $fileSize = __('Unknown file size.', 'wordfence'); }
require(dirname(__FILE__) . '/wfViewResult.php');
exit(0);
}
public static function wfFunc_diff(){
wfUtils::doNotCache();
if (WORDFENCE_DISABLE_FILE_VIEWER) {
esc_html_e("File access blocked. (WORDFENCE_DISABLE_FILE_VIEWER is true)", 'wordfence');
exit();
}
if(preg_match('/[\'\"<>\!\{\}\(\)\&\@\%\$\*\+\[\]\?]+/', $_GET['file'])){
esc_html_e("File contains illegal characters.", 'wordfence');
exit();
}
$result = self::getWPFileContent($_GET['file'], $_GET['cType'], wp_unslash($_GET['cName']), $_GET['cVersion']);
if( isset( $result['errorMsg'] ) && $result['errorMsg']){
echo wp_kses($result['errorMsg'], array());
exit(0);
} else if(! $result['fileContent']){
esc_html_e("We could not get the contents of the original file to do a comparison.", 'wordfence');
exit(0);
}
$localFile = self::checkRealFileParameters();
if ($localFile === null) {
$localFile = realpath(ABSPATH . '/' . preg_replace('/^[\.\/]+/', '', $_GET['file']));
}
if (empty($localFile)) {
esc_html_e('Empty file path provided', 'wordfence');
exit(0);
}
$localContents = file_get_contents($localFile);
if ($localContents === false) {
esc_html_e('Unable to read file contents', 'wordfence');
exit(0);
}
if($localContents == $result['fileContent']){
$diffResult = '';
} else {
$diff = new Diff(
//Treat DOS and Unix files the same
preg_split("/(?:\r\n|\n)/", $result['fileContent']),
preg_split("/(?:\r\n|\n)/", $localContents),
array()
);
$renderer = new Diff_Renderer_Html_SideBySide;
$diffResult = $diff->Render($renderer);
}
require(dirname(__FILE__) . '/diffResult.php');
exit(0);
}
public static function wfFunc_download() {
wfUtils::doNotCache();
if (WORDFENCE_DISABLE_FILE_VIEWER) {
esc_html_e("File access blocked. (WORDFENCE_DISABLE_FILE_VIEWER is true)", 'wordfence');
exit();
}
$localFile = self::checkRealFileParameters();
if ($localFile === null)
$localFile = ABSPATH . preg_replace('/^(?:\.\.|[\/]+)/', '', sanitize_text_field($_GET['file']));
if (strpos($localFile, '..') !== false) {
esc_html_e("Invalid file requested. (Relative paths not allowed)", 'wordfence');
exit();
}
if (preg_match('/[\'\"<>\!\{\}\(\)\&\@\%\$\*\+\[\]\?]+/', $localFile)) {
esc_html_e("File contains illegal characters.", 'wordfence');
exit();
}
if (!file_exists($localFile)) {
_e('File does not exist.', 'wordfence');
exit();
}
$filename = basename($localFile);
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . $filename . '"');
header('Content-Length: ' . filesize($localFile));
readfile($localFile);
exit;
}
public static function wfFunc_blockedIPs() {
$blocks = wfBlock::ipBlocks(true);
$output = '';
if (is_array($blocks)) {
foreach ($blocks as $entry) {
$output .= $entry->ip . "\n";
}
}
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . get_bloginfo('name', 'raw') . ' - Blocked IPs.txt"');
header('Content-Length: ' . strlen($output));
echo $output;
exit;
}
/**
*
*/
public static function wfFunc_debugWAF() {
$data = array();
if (!empty($_GET['hitid'])) {
$data['hit'] = new wfRequestModel($_GET['hitid']);
if ($data['hit']->actionData) {
$data['hitData'] = (object) wfRequestModel::unserializeActionData($data['hit']->actionData);
}
echo wfView::create('waf/debug', $data);
}
}
public static function isWafFailureLoggingEnabled() {
return wfConfig::get('other_WFNet', true);
}
private static function purgeWafFailures() {
global $wpdb;
$table = wfDB::networkTable('wfWafFailures');
$wpdb->query("DELETE FROM {$table} WHERE `timestamp` < DATE_SUB(NOW(), INTERVAL 1 DAY)");
}
private static function capWafFailures() {
global $wpdb;
$table = wfDB::networkTable('wfWafFailures');
$highestDeletableId = $wpdb->get_var("SELECT id FROM {$table} ORDER BY id DESC LIMIT 1 OFFSET 25");
if ($highestDeletableId === null)
return;
$wpdb->query(
$wpdb->prepare(
"DELETE FROM {$table} WHERE id <= %d",
$highestDeletableId
)
);
}
public static function logWafFailure() {
global $wf_waf_failure, $wpdb;
if (!self::isWafFailureLoggingEnabled())
return;
if (is_array($wf_waf_failure) && array_key_exists('throwable', $wf_waf_failure)) {
$throwable = $wf_waf_failure['throwable'];
if (!($throwable instanceof Throwable || $throwable instanceof Exception))
return;
$table = wfDB::networkTable('wfWafFailures');
$data = [
'throwable' => (string) $throwable
];
if (array_key_exists('rule_id', $wf_waf_failure)) {
$ruleId = $wf_waf_failure['rule_id'];
if (is_int($ruleId) || $ruleId >= 0)
$data['rule_id'] = (int) $ruleId;
}
$wpdb->insert($table, $data);
self::capWafFailures();
self::scheduleSendAttackData();
}
}
public static function initAction(){
self::logWafFailure();
load_plugin_textdomain('wordfence', false, basename(WORDFENCE_PATH) . '/languages');
$firewall = new wfFirewall();
define('WFWAF_OPERATIONAL', $firewall->testConfig());
$currentUserID = get_current_user_id();
$role = wordfence::getCurrentUserRole();
if (!WFWAF_SUBDIRECTORY_INSTALL) {
try {
$authCookie = wfWAF::getInstance()->parseAuthCookie();
$capabilities = wordfence::getCurrentUserCapabilities();
if (is_user_logged_in() &&
(
!$authCookie ||
(int) $currentUserID !== (int) $authCookie['userID'] ||
$role !== $authCookie['role'] ||
$authCookie['capabilities'] !== $capabilities //Capability ordering is fixed so a direct equality check is valid
)
) {
wfUtils::setcookie(wfWAF::getInstance()->getAuthCookieName(),
$currentUserID . '|' . $role . '|' . implode(',', $capabilities) . '|' .
wfWAF::getInstance()->getAuthCookieValue($currentUserID, $role, $capabilities),
time() + 43200, COOKIEPATH, COOKIE_DOMAIN, wfUtils::isFullSSL(), true);
}
} catch (wfWAFStorageFileException $e) {
error_log($e->getMessage());
} catch (wfWAFStorageEngineMySQLiException $e) {
error_log($e->getMessage());
}
}
if (wfConfig::get('other_hideWPVersion')) {
global $wp_version;
global $wp_styles;
if (!($wp_styles instanceof WP_Styles)) {
$wp_styles = new WP_Styles();
}
if ($wp_styles->default_version === $wp_version) {
$wp_styles->default_version = wp_hash($wp_styles->default_version);
}
foreach ($wp_styles->registered as $key => $val) {
if ($wp_styles->registered[$key]->ver === $wp_version) {
$wp_styles->registered[$key]->ver = wp_hash($wp_styles->registered[$key]->ver);
}
}
global $wp_scripts;
if (!($wp_scripts instanceof WP_Scripts)) {
$wp_scripts = new WP_Scripts();
}
if ($wp_scripts->default_version === $wp_version) {
$wp_scripts->default_version = wp_hash($wp_scripts->default_version);
}
foreach ($wp_scripts->registered as $key => $val) {
if ($wp_scripts->registered[$key]->ver === $wp_version) {
$wp_scripts->registered[$key]->ver = wp_hash($wp_scripts->registered[$key]->ver);
}
}
}
}
public static function hasWordfenceAssistant($plugins) {
foreach ($plugins as $plugin) {
if ($plugin["Name"] == "Wordfence Assistant")
return true;
}
return false;
}
private static function isWordfenceAssistantInstalled() {
$plugins = get_plugins();
return self::hasWordfenceAssistant($plugins);
}
public static function admin_init() {
$ajaxActions = self::_ajaxActions();
$hasRegisteredAJAX = false;
foreach ($ajaxActions as $action => $config) {
if (call_user_func($config['permissions'])) {
add_action('wp_ajax_wordfence_' . $action, 'wordfence::ajaxReceiver');
$hasRegisteredAJAX = true;
}
}
if (!wfUtils::isAdmin()) {
if ($hasRegisteredAJAX) {
wp_enqueue_script('wfi18njs', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/wfi18n.js'), array(), WORDFENCE_VERSION);
wp_enqueue_script('wordfenceAdminExtjs', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/wfglobal.js'), array('jquery'), WORDFENCE_VERSION);
wp_localize_script('wordfenceAdminExtjs', 'WordfenceAdminVars', array(
'ajaxURL' => admin_url('admin-ajax.php'),
'firstNonce' => self::ajaxNonces(),
'siteBaseURL' => wfUtils::getSiteBaseURL(),
));
}
return;
}
wfOnboardingController::initialize();
if (is_admin() && isset($_GET['page'])) {
switch ($_GET['page']) {
case 'WordfenceBlocking':
wp_redirect(network_admin_url('admin.php?page=WordfenceWAF#top#blocking'));
die;
case 'WordfenceAuditLog':
wp_redirect(network_admin_url('admin.php?page=WordfenceTools&subpage=auditlog'));
die;
case 'WordfenceLiveTraffic':
wp_redirect(network_admin_url('admin.php?page=WordfenceTools&subpage=livetraffic'));
die;
case 'WordfenceTools':
if (wfOnboardingController::shouldShowAttempt3() && !array_key_exists('subpage', $_GET)) {
wp_redirect(add_query_arg('subpage', 'diagnostics'));
die;
}
}
}
if (wfConfig::get('touppBypassNextCheck')) {
wfConfig::set('touppBypassNextCheck', 0);
wfConfig::set('touppPromptNeeded', 0);
}
wp_register_script('chart-js', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/chart.umd.js'), array('jquery'), '4.2.1');
wp_register_style('wordfence-font-awesome-style', wfUtils::getBaseURL() . wfUtils::versionedAsset('css/wf-font-awesome.css'), '', WORDFENCE_VERSION);
if (self::isWordfencePage()) {
wp_enqueue_style('wp-pointer');
wp_enqueue_script('wp-pointer');
wp_enqueue_style('wordfence-font', wfUtils::getBaseURL() . wfUtils::versionedAsset('css/wf-roboto-font.css'), '', WORDFENCE_VERSION);
wp_enqueue_style('wordfence-font-awesome-style');
wp_enqueue_style('wordfence-main-style', wfUtils::getBaseURL() . wfUtils::versionedAsset('css/main.css'), '', WORDFENCE_VERSION);
wp_enqueue_style('wordfence-ionicons-style', wfUtils::getBaseURL() . wfUtils::versionedAsset('css/wf-ionicons.css'), '', WORDFENCE_VERSION);
wp_enqueue_style('wordfence-license-style', wfLicense::current()->getStylesheet());
wp_enqueue_script('jquery-ui-core');
wp_enqueue_script('jquery-ui-menu');
wp_enqueue_script('jquery.qrcode', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/jquery.qrcode.min.js'), array('jquery'), WORDFENCE_VERSION);
wp_enqueue_script('wfi18njs', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/wfi18n.js'), array(), WORDFENCE_VERSION);
wp_enqueue_script('wordfenceAdminExtjs', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/wfglobal.js'), array('jquery'), WORDFENCE_VERSION);
wp_enqueue_script('wordfenceAdminjs', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/admin.js'), array('jquery', 'jquery-ui-core', 'jquery-ui-menu'), WORDFENCE_VERSION);
wp_enqueue_script('wordfenceDropdownjs', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/wfdropdown.js'), array('jquery'), WORDFENCE_VERSION);
wp_enqueue_script('wordfenceVuejs', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/wordfence.js'), array('jquery', 'jquery-ui-core', 'jquery-ui-menu', 'jquery-ui-tooltip'), WORDFENCE_VERSION);
self::setupAdminVars();
if (wfConfig::get('touppPromptNeeded')) {
add_filter('admin_body_class', 'wordfence::showTOUPPOverlay', 99, 1);
}
if (self::checkAlertRateLimit()) {
add_action(is_multisite() ? "network_admin_notices" : "admin_notices", "wordfence::alertRateLimitNotice");
}
} else {
wp_enqueue_style('wp-pointer');
wp_enqueue_script('wp-pointer');
wp_enqueue_script('wfi18njs', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/wfi18n.js'), array(), WORDFENCE_VERSION);
wp_enqueue_script('wordfenceAdminExtjs', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/wfglobal.js'), array('jquery'), WORDFENCE_VERSION);
wp_enqueue_style('wordfence-font-awesome-style');
wp_enqueue_style('wordfence-global-style', wfUtils::getBaseURL() . wfUtils::versionedAsset('css/wf-global.css'), '', WORDFENCE_VERSION);
self::setupAdminVars();
}
if (is_admin()) { //Back end only
if (wfOnboardingController::shouldShowAnyAttempt()) {
wp_enqueue_script('wordfenceOnboardingjs', wfUtils::getBaseURL() . wfUtils::versionedAsset('js/wfonboarding.js'), array('jquery', 'wordfenceAdminExtjs'), WORDFENCE_VERSION);
}
if (preg_match('/\/wp-admin(\/network)?\/plugins.php$/', parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH))) {
wp_enqueue_script('jquery-ui-dialog');
wp_enqueue_style('wp-jquery-ui-dialog');
wp_enqueue_style('wordfence-deactivation-style', wfUtils::getBaseURL() . wfUtils::versionedAsset('css/wf-deactivation.css'), '', WORDFENCE_VERSION);
}
wfUtils::refreshCachedHomeURL();
wfUtils::refreshCachedSiteURL();
}
if (self::isWordfenceInstallPage())
return;
//Early WAF configuration actions
if (wfOnboardingController::shouldShowAttempt3(!self::isWordfencePage(false))) {
add_action(is_multisite() ? 'network_admin_notices' : 'admin_notices', 'wordfence::showOnboardingBanner');
}
elseif ((!WFWAF_AUTO_PREPEND || WFWAF_SUBDIRECTORY_INSTALL) && empty($_GET['wafAction']) && !wfConfig::get('dismissAutoPrependNotice') && !wfConfig::get('touppPromptNeeded')) {
if (is_multisite()) {
add_action('network_admin_notices', 'wordfence::wafAutoPrependNotice');
} else {
add_action('admin_notices', 'wordfence::wafAutoPrependNotice');
}
}
if (wfConfig::get('wordfenceCentralConfigurationIssue')) {
add_action(is_multisite() ? 'network_admin_notices' : 'admin_notices', 'wordfence::showCentralConfigurationIssueNotice');
}
if (self::isWordfencePage(false) && self::isWordfenceAssistantInstalled()) {
add_action(is_multisite() ? 'network_admin_notices' : 'admin_notices', 'wordfence::showWordfenceAssistantNotice');
}
if (isset($_GET['page']) && $_GET['page'] == 'WordfenceWAF' && isset($_GET['subpage']) && $_GET['subpage'] == 'waf_options') {
if (!WFWAF_AUTO_PREPEND || WFWAF_SUBDIRECTORY_INSTALL) { //Not yet installed
if (isset($_GET['action']) && $_GET['action'] == 'configureAutoPrepend') {
check_admin_referer('wfWAFAutoPrepend', 'wfnonce');
if (isset($_GET['serverConfiguration']) && wfWAFAutoPrependHelper::isValidServerConfig($_GET['serverConfiguration'])) {
$helper = new wfWAFAutoPrependHelper($_GET['serverConfiguration']);
if (isset($_GET['downloadBackup'])) {
$helper->downloadBackups(isset($_GET['backupIndex']) ? absint($_GET['backupIndex']) : 0);
}
}
}
}
else { //Already installed
if (isset($_GET['action']) && $_GET['action'] == 'removeAutoPrepend') {
check_admin_referer('wfWAFRemoveAutoPrepend', 'wfnonce');
if (isset($_GET['serverConfiguration']) && wfWAFAutoPrependHelper::isValidServerConfig($_GET['serverConfiguration'])) {
$helper = new wfWAFAutoPrependHelper($_GET['serverConfiguration']);
if (isset($_GET['downloadBackup'])) {
$helper->downloadBackups(isset($_GET['backupIndex']) ? absint($_GET['backupIndex']) : 0);
}
}
}
}
}
}
private static function setupAdminVars(){
$updateInt = max(absint(wfConfig::getInt('actUpdateInterval', 2)), 2) * 1000; //ms
wp_localize_script('wordfenceAdminExtjs', 'WordfenceAdminVars', array(
'ajaxURL' => admin_url('admin-ajax.php'),
'firstNonce' => self::ajaxNonces(),
'siteBaseURL' => wfUtils::getSiteBaseURL(),
'debugOn' => wfConfig::get('debugOn', 0),
'actUpdateInterval' => $updateInt,
'cacheType' => wfConfig::get('cacheType'),
'liveTrafficEnabled' => wfConfig::liveTrafficEnabled(),
'scanIssuesPerPage' => WORDFENCE_SCAN_ISSUES_PER_PAGE,
'allowsPausing' => wfConfig::get('liveActivityPauseEnabled'),
'scanRunning' => wfScanner::shared()->isRunning() ? '1' : '0',
'alertEmailBlacklist' => wfConfig::alertEmailBlacklist(),
'supportURLs' => array(
'scan-result-repair-modified-files' => esc_url_raw(wfSupportController::supportURL(wfSupportController::ITEM_SCAN_RESULT_REPAIR_MODIFIED_FILES)),
),
));
self::setupI18nJSStrings();
self::setupJSConstants();
}
/**
* Leverages an internalized version of `wp_localize_script` to pass through a set of constants for the Vue side to
* avoid hardcoding values.
*/
private static function setupJSConstants() {
static $called;
if ($called) {
return;
}
$called = true;
global $wp_scripts;
try {
$script = "var WordfenceJSConstants = " . wp_json_encode(wfJavascriptBridge::WordfenceJSConstants()) . ";\n";
}
catch (Exception $e) {
$details = self::prepareJavascriptBridgeError($e);
$details['errorMessage'] = 'Error initializing WordfenceJSConstants';
$script = "var WordfenceJSConstants = " . wp_json_encode($details) . ";\n";
}
catch (Throwable $t) {
$details = self::prepareJavascriptBridgeError($t);
$details['errorMessage'] = 'Error initializing WordfenceJSConstants';
$script = "var WordfenceJSConstants = " . wp_json_encode($details) . ";\n";
}
$data = $wp_scripts->get_data('wordfenceVuejs', 'data');
if (!empty($data)) {
$script = "$data\n$script";
}
$wp_scripts->add_data('wordfenceVuejs', 'data', $script);
}
private static function setupI18nJSStrings() {
static $called;
if ($called) {
return;
}
$called = true;
wp_localize_script('wfi18njs', 'WordfenceI18nStrings', wfJavascriptBridge::WordfenceI18nStrings());
}
private static function prepareJavascriptBridgeError($e) {
if (!wfUtils::isAdmin()) {
return array('hasGlobalError' => true);
}
$trace = $e->getTrace();
foreach ($trace as &$t) {
unset($t['args']);
}
return array(
'hasGlobalError' => true,
'errorDetails' => array(
'code' => $e->getCode(),
'message' => $e->getMessage(),
'file' => $e->getFile(),
'line' => $e->getLine(),
'trace' => $trace,
),
);
}
public static function _setupImportMap() {
if (self::isWordfencePage()) {
echo "\n";
}
}
public static function _tagVueScriptAsModule($tag, $handle, $src) {
if ('wordfenceVuejs' == $handle && strpos($tag, 'module') === false) {
if (($typeIndex = strpos($tag, 'type=')) !== false) {
$quoteChar = substr($tag, $typeIndex + 5, 1);
$closingQuoteIndex = strpos($tag, $quoteChar, $typeIndex + 6);
$tag = str_replace(substr($tag, $typeIndex, $closingQuoteIndex - $typeIndex + 1), 'type="module"', $tag);
}
else {
$tag = str_replace(' src', ' type="module" src', $tag);
}
}
return $tag;
}
public static function showTOUPPOverlay($classList) {
return trim($classList . ' wf-toupp-required');
}
public static function activation_warning(){
$activationError = get_option('wf_plugin_act_error', '');
if(strlen($activationError) > 400){
$activationError = substr($activationError, 0, 400) . '...[output truncated]';
}
if($activationError){
echo '' . __('Wordfence generated an error on activation. The output we received during activation was:', 'wordfence') . ' ' . wp_kses($activationError, array()) . '
' . sprintf('%s ', __("Wordfence's license key is missing.", 'wordfence')) . wp_kses(sprintf(/* translators: support URL */ __("This could be caused by a database problem. You may need to repair your \"wfconfig\" database table or fix your database user's privileges if they have changed recently, or you may need to reinstall Wordfence. Please contact Wordfence support (opens in new tab) if you need help.", 'wordfence'), wfSupportController::esc_supportURL()), array('a' => array('href' => array(), 'target' => array(), 'rel' => array()), 'span' => array('class' => array()))) . '
' . __('The Wordfence Web Application Firewall cannot run.', 'wordfence') . ' ' . sprintf( /* translators: 1. WordPress admin panel URL. 2. Support URL. */ __('The configuration files are corrupt or inaccessible by the web server, which is preventing the WAF from functioning. Please verify the web server has permission to access the configuration files. You may also try to rebuild the configuration file by clicking here. It will automatically resume normal operation when it is fixed. (opens in new tab)', 'wordfence'), $wafMenuURL, wfSupportController::esc_supportURL(wfSupportController::ITEM_NOTICE_WAF_INACCESSIBLE_CONFIG) ) . '
'.__('The WAF storage engine is currently set to mysqli, but Wordfence is unable to use the database. The WAF will fall back to using local file system storage instead.', 'wordfence').'
' . __('The Wordfence Web Application Firewall needs a configuration update.', 'wordfence') . ' ' . sprintf( /* translators: 1. WordPress admin panel URL. 2. Support URL. */ __('It is currently configured to use an older version of PHP and may become deactivated if PHP is updated. You may perform the configuration update automatically by clicking here. (opens in new tab)', 'wordfence'), $wafMenuURL, wfSupportController::esc_supportURL(wfSupportController::ITEM_NOTICE_WAF_MOD_PHP_FIX) ) . '
' . __('The Wordfence Web Application Firewall needs a configuration update.', 'wordfence') . ' ' . sprintf( /* translators: 1. WordPress admin panel URL. 2. Support URL. */ __('It is not currently in extended protection mode but was configured to use an older version of PHP and may have become deactivated when PHP was updated. You may perform the configuration update automatically by clicking here or use the "Optimize the Wordfence Firewall" button on the Firewall Options page. (opens in new tab)', 'wordfence'), $wafMenuURL, wfSupportController::esc_supportURL(wfSupportController::ITEM_NOTICE_WAF_MOD_PHP_FIX) ) . '
' . __('The Wordfence Web Application Firewall is in read-only mode.', 'wordfence') . ' ' . sprintf('PHP is currently running as a command line user and to avoid file permission issues, the WAF is running in read-only mode. It will automatically resume normal operation when run normally by a web server. (opens in new tab)', wfSupportController::esc_supportURL(wfSupportController::ITEM_NOTICE_WAF_READ_ONLY_WARNING)) . '
' . __('Your \'How does Wordfence get IPs\' setting is misconfigured.', 'wordfence') . ' ' . $existingMsg . ' ' . $recommendationMsg . ' ' . __('Click here to use the recommended setting', 'wordfence') . ' ' . __('or', 'wordfence') . ' ' . __('visit the options page', 'wordfence') . ' ' . __('to manually update it.', 'wordfence') . '
' . __('Do you want Wordfence to stay up-to-date automatically?', 'wordfence') . ' '. __('Yes, enable auto-update.', 'wordfence') . ' | ' . __('No thanks.', 'wordfence') . '
' . esc_html($e->getMessage()) . ''; } require(dirname(__FILE__) . '/menu_options.php'); } public static function menu_blocking() { // Do nothing -- this action is forwarded in admin_init } public static function menu_firewall() { wp_enqueue_script('chart-js'); try { $wafData = self::_getWAFData(); } catch (wfWAFStorageFileConfigException $e) { // We don't have anywhere to write files in this scenario. Let's notify the user to update the permissions. $wafData = array( 'learningMode' => false, 'rules' => array(), 'whitelistedURLParams' => array(), 'disabledRules' => array(), 'isPaid' => (bool) wfConfig::get('isPaid', 0), ); $logPath = str_replace(ABSPATH, '~/', WFWAF_LOG_PATH); if (function_exists('network_admin_url') && is_multisite()) { $wafMenuURL = network_admin_url('admin.php?page=WordfenceWAF&wafconfigrebuild=1'); } else { $wafMenuURL = admin_url('admin.php?page=WordfenceWAF&wafconfigrebuild=1'); } $wafMenuURL = add_query_arg(array( 'waf-nonce' => wp_create_nonce('wafconfigrebuild'), ), $wafMenuURL); $storageExceptionMessage = $e->getMessage() . ' ' . sprintf(/* translators: WordPress admin panel URL. */ __('Click here to rebuild the configuration file.', 'wordfence'), esc_url($wafMenuURL)); } catch (wfWAFStorageFileException $e) { // We don't have anywhere to write files in this scenario. Let's notify the user to update the permissions. $wafData = array( 'learningMode' => false, 'rules' => array(), 'whitelistedURLParams' => array(), 'disabledRules' => array(), 'isPaid' => (bool) wfConfig::get('isPaid', 0), ); $logPath = str_replace(ABSPATH, '~/', WFWAF_LOG_PATH); $storageExceptionMessage = sprintf(/* translators: File path. */ __('We were unable to write to %s which the WAF uses for storage. Please update permissions on the parent directory so the web server can write to it.', 'wordfence'), $logPath); } catch (wfWAFStorageEngineMySQLiException $e) { $wafData = array( 'learningMode' => false, 'rules' => array(), 'whitelistedURLParams' => array(), 'disabledRules' => array(), 'isPaid' => (bool) wfConfig::get('isPaid', 0), ); $logPath = null; $storageExceptionMessage = __('An error occured when fetching the WAF configuration from the database.', 'wordfence') . '
' . esc_html($e->getMessage()) . ''; } if (isset($_GET['subpage']) && $_GET['subpage'] == 'waf_options') { require(dirname(__FILE__) . '/menu_firewall_waf_options.php'); } else if (isset($_GET['subpage']) && $_GET['subpage'] == 'blocking_options') { require(dirname(__FILE__) . '/menu_firewall_blocking_options.php'); } else { require(dirname(__FILE__) . '/menu_firewall.php'); } } public static function liveTrafficW3TCWarning() { echo self::cachingWarning("W3 Total Cache"); } public static function liveTrafficSuperCacheWarning(){ echo self::cachingWarning("WP Super Cache"); } public static function cachingWarning($plugin){ return '
' . sprintf(/* translators: Plugin name. */ __('The Wordfence Live Traffic feature has been disabled because you have %s active which is not compatible with Wordfence Live Traffic.', 'wordfence'), $plugin) . ' ' . sprintf(/* translators: 1. Plugin name. */ __('If you want to reenable Wordfence Live Traffic, you need to deactivate %1$s and then go to the Wordfence options page and reenable Live Traffic there. Wordfence does work with %1$s, however Live Traffic will be disabled and the Wordfence firewall will also count less hits per visitor because of the %1$s caching function. All other functions should work correctly.', 'wordfence'), $plugin) . '
' . /* translators: File path. */ __('The file %s was restored successfully.', 'wordfence') . '
' . /* translators: File path. */ __('The file %s was deleted successfully.', 'wordfence') . '
Options -Indexes to your httpd.conf if using Apache, or find documentation on how to disable directory listing for your web server.", 'wordfence'),
);
}
}
return array(
'err' => 1,
'errorMsg' => __("There was an error writing to your .htaccess file.", 'wordfence'),
);
}
/**
* Modify the query to prevent username enumeration.
*
* @param array $query_vars
* @return array
*/
public static function preventAuthorNScans($query_vars) {
if (wfConfig::get('loginSec_disableAuthorScan') && !is_admin() &&
!empty($query_vars['author']) && (is_array($query_vars['author']) || is_numeric(preg_replace('/[^0-9]/', '', $query_vars['author']))) &&
(
(isset($_GET['author']) && (is_array($_GET['author']) || is_numeric(preg_replace('/[^0-9]/', '', $_GET['author'])))) ||
(isset($_POST['author']) && (is_array($_POST['author']) || is_numeric(preg_replace('/[^0-9]/', '', $_POST['author']))))
)
) {
global $wp_query;
$wp_query->set_404();
status_header(404);
nocache_headers();
$template = get_404_template();
if ($template && file_exists($template)) {
include($template);
}
exit;
}
return $query_vars;
}
/**
* @param WP_Upgrader $updater
* @param array $hook_extra
*/
public static function hideReadme($updater, $hook_extra = null) {
if (wfConfig::get('other_hideWPVersion')) {
wfUtils::hideReadme();
}
}
public static function ajax_saveDisclosureState_callback() {
if (isset($_POST['name']) && isset($_POST['state'])) {
$name = preg_replace('/[^a-zA-Z0-9_\-]/', '', $_POST['name']);
$state = wfUtils::truthyToBoolean($_POST['state']);
if (!empty($name)) {
$disclosureStates = wfConfig::get_ser('disclosureStates', array());
$disclosureStates[$name] = $state;
wfConfig::set_ser('disclosureStates', $disclosureStates);
return array('ok' => 1);
}
}
else if (isset($_POST['names']) && isset($_POST['state'])) {
$rawNames = $_POST['names'];
if (is_array($rawNames)) {
$filteredNames = array();
foreach ($rawNames as $name) {
$name = preg_replace('/[^a-zA-Z0-9_\-]/', '', $name);
if (!empty($name)) {
$filteredNames[] = $name;
}
}
$state = wfUtils::truthyToBoolean($_POST['state']);
if (!empty($filteredNames)) {
$disclosureStates = wfConfig::get_ser('disclosureStates', array());
foreach ($filteredNames as $name) {
$disclosureStates[$name] = $state;
}
wfConfig::set_ser('disclosureStates', $disclosureStates);
return array('ok' => 1);
}
}
}
return array(
'err' => 1,
'errorMsg' => __("Required parameters not sent.", 'wordfence'),
);
}
public static function ajax_updateWAFRules_callback() {
try {
$event = new wfWAFCronFetchRulesEvent(time() - 2, true);
$event->setWaf(wfWAF::getInstance());
$success = $event->fire();
$failureReason = false;
if (!$success && method_exists($event, 'getResponse')) {
$response = $event->getResponse();
if ($response === false) {
$failureReason = wfFirewall::UPDATE_FAILURE_UNREACHABLE;
}
else {
$jsonData = @json_decode($response->getBody(), true);
if (is_array($jsonData) && isset($jsonData['errorMessage']) && strpos($jsonData['errorMessage'], 'rate limit') !== false) {
$failureReason = wfFirewall::UPDATE_FAILURE_RATELIMIT;
}
else if (is_array($jsonData) && isset($jsonData['data']['signature'])) {
$failureReason = wfFirewall::UPDATE_FAILURE_FILESYSTEM;
}
else {
$failureReason = wfFirewall::UPDATE_FAILURE_FILESYSTEM;
}
}
}
return self::_getWAFData($success, $failureReason);
}
catch (Exception $e) {
$wafData = array(
'learningMode' => false,
'rules' => array(),
'whitelistedURLParams' => array(),
'disabledRules' => array(),
'isPaid' => (bool) wfConfig::get('isPaid', 0),
);
return $wafData;
}
}
public static function ajax_loadLiveTraffic_callback() {
$return = array();
$filters = new wfLiveTrafficQueryFilterCollection();
$query = new wfLiveTrafficQuery(self::getLog());
$query->setFilters($filters);
if (array_key_exists('groupby', $_REQUEST)) {
$param = $_REQUEST['groupby'];
if ($param != 'none') {
if ($param === 'type') {
$param = 'jsRun';
}
$query->setGroupBy(new wfLiveTrafficQueryGroupBy($query, $param));
}
}
$query->setLimit(isset($_REQUEST['limit']) ? absint($_REQUEST['limit']) : 20);
$query->setOffset(isset($_REQUEST['offset']) ? absint($_REQUEST['offset']) : 0);
if (!empty($_REQUEST['since'])) {
$query->setStartDate($_REQUEST['since']);
} else if (!empty($_REQUEST['startDate'])) {
$query->setStartDate(is_numeric($_REQUEST['startDate']) ? $_REQUEST['startDate'] : strtotime($_REQUEST['startDate']));
}
if (!empty($_REQUEST['endDate'])) {
$query->setEndDate(is_numeric($_REQUEST['endDate']) ? $_REQUEST['endDate'] : strtotime($_REQUEST['endDate']));
}
if (
array_key_exists('param', $_REQUEST) && is_array($_REQUEST['param']) &&
array_key_exists('operator', $_REQUEST) && is_array($_REQUEST['operator']) &&
array_key_exists('value', $_REQUEST) && is_array($_REQUEST['value'])
) {
for ($i = 0; $i < count($_REQUEST['param']); $i++) {
if (
array_key_exists($i, $_REQUEST['param']) &&
array_key_exists($i, $_REQUEST['operator']) &&
array_key_exists($i, $_REQUEST['value'])
) {
$param = $_REQUEST['param'][$i];
$operator = $_REQUEST['operator'][$i];
$value = $_REQUEST['value'][$i];
switch (strtolower($param)) {
case 'type':
$param = 'jsRun';
$value = strtolower($value) === 'human' ? 1 : 0;
break;
case 'isgoogle':
$value = wfUtils::truthyToBoolean($value) ? 1 : 0;
break;
case 'ip':
$ip = $value;
if (strpos($ip, '*') !== false) { //If the IP contains a *, treat it as a wildcard for that segment and silently adjust the rule
if (preg_match('/^(?:(?:\d{1,3}|\*)(?:\.|$)){2,4}/', $ip)) { //IPv4
$value = array('00', '00', '00', '00', '00', '00', '00', '00', '00', '00', 'FF', 'FF');
$octets = explode('.', $ip);
foreach ($octets as $o)
{
if (strpos($o, '*') !== false) {
$value[] = '..';
}
else {
$value[] = strtoupper(str_pad(dechex($o), 2, '0', STR_PAD_LEFT));
}
}
$value = '^' . implode('', array_pad($value, 16, '..')) . '$';
$operator = ($operator == '!=' ? 'hnotregexp' : 'hregexp');
}
else if (!empty($ip) && preg_match('/^((?:[\da-f*]{1,4}(?::|)){0,8})(::)?((?:[\da-f*]{1,4}(?::|)){0,8})$/i', $ip)) { //IPv6
if ($ip === '::') {
$value = '^' . str_repeat('00', 16) . '$';
}
else {
$colon_count = substr_count($ip, ':');
$dbl_colon_pos = strpos($ip, '::');
if ($dbl_colon_pos !== false) {
$ip = str_replace('::', str_repeat(':0000', (($dbl_colon_pos === 0 || $dbl_colon_pos === strlen($ip) - 2) ? 9 : 8) - $colon_count) . ':', $ip);
$ip = trim($ip, ':');
}
$ip_groups = explode(':', $ip);
$value = array();
foreach ($ip_groups as $ip_group) {
if (strpos($ip_group, '*') !== false) {
$value[] = '..';
$value[] = '..';
}
else {
$ip_group = strtoupper(str_pad($ip_group, 4, '0', STR_PAD_LEFT));
$value[] = substr($ip_group, 0, 2);
$value[] = substr($ip_group, -2);
}
}
$value = '^' . implode('', array_pad($value, 16, '..')) . '$';
}
$operator = ($operator == '=' ? 'hregexp' : 'hnotregexp');
}
else if (preg_match('/^((?:0{1,4}(?::|)){0,5})(::)?ffff:((?:\d{1,3}(?:\.|$)){4})$/i', $ip, $matches)) { //IPv4 mapped IPv6
$value = array('00', '00', '00', '00', '00', '00', '00', '00', '00', '00', 'FF', 'FF');
$octets = explode('.', $matches[3]);
foreach ($octets as $o)
{
if (strpos($o, '*') !== false) {
$value[] = '..';
}
else {
$value[] = strtoupper(str_pad(dechex($o), 2, '0', STR_PAD_LEFT));
}
}
$value = '^' . implode('', array_pad($value, 16, '.')) . '$';
$operator = ($operator == '=' ? 'hregexp' : 'hnotregexp');
}
else {
$value = false;
}
}
else {
$value = wfUtils::inet_pton($ip);
}
break;
case 'userid':
$value = absint($value);
break;
}
if (($operator === 'match' || $operator === '!match') && $param !== 'ip') {
$value = str_replace('*', '%', $value);
}
$filters->addFilter(new wfLiveTrafficQueryFilter($query, $param, $operator, $value));
}
}
}
try {
$return['data'] = $query->execute();
/*if (defined('WP_DEBUG') && WP_DEBUG) {
$return['sql'] = $query->buildQuery();
}*/
} catch (wfLiveTrafficQueryException $e) {
$return['data'] = array();
$return['sql'] = $e->getMessage();
}
$return['serverMicrotime'] = microtime(true);
$return['success'] = true;
return $return;
}
public static function ajax_whitelistWAFParamKey_callback() {
if (class_exists('wfWAF') && $waf = wfWAF::getInstance()) {
if (isset($_POST['path']) && isset($_POST['paramKey']) && isset($_POST['failedRules'])) {
$ruleIDs = is_array($_POST['failedRules']) ? array_map('intval', $_POST['failedRules']) : intval($_POST['failedRules']);
$data = array(
'timestamp' => time(),
'description' => __('Allowlisted via Live Traffic', 'wordfence'),
'source' => 'live-traffic',
'ip' => wfUtils::getIP(),
);
if (function_exists('get_current_user_id')) {
$data['userID'] = get_current_user_id();
}
$waf->whitelistRuleForParam(base64_decode($_POST['path']), base64_decode($_POST['paramKey']),
$ruleIDs, $data);
/**
* @see wfConfig.php::wordfence_waf_toggled_allow_entry
*/
do_action('wordfence_waf_created_allow_entry', array(array_merge(array('rule' => $ruleIDs, 'path' => $_POST['path'], 'paramKey' => $_POST['paramKey']), $data)));
return array(
'success' => true,
);
}
}
return false;
}
public static function _getWAFData($updated = null, $failureReason = false) {
$data['learningMode'] = wfWAF::getInstance()->isInLearningMode();
$data['rules'] = wfWAF::getInstance()->getRules();
/** @var wfWAFRule $rule */
foreach ($data['rules'] as $ruleID => $rule) {
$data['rules'][$ruleID] = $rule->toArray();
}
$whitelistedURLParams = wfWAF::getInstance()->getStorageEngine()->getConfig('whitelistedURLParams', array(), 'livewaf');
if (is_object($whitelistedURLParams)) {
$whitelistedURLParams = (array) $whitelistedURLParams;
}
$data['whitelistedURLParams'] = array();
if (is_array($whitelistedURLParams)) {
foreach ($whitelistedURLParams as $urlParamKey => $rules) {
$components = explode('|', $urlParamKey);
if ($components && count($components) > 1 && is_array($rules)) {
list($path, $paramKey) = $components;
$whitelistData = null;
foreach ($rules as $ruleID => $whitelistedData) {
if ($whitelistData === null) {
$whitelistData = $whitelistedData;
continue;
}
if ($ruleID === 'all') {
$whitelistData = $whitelistedData;
break;
}
}
if (is_array($whitelistData) && array_key_exists('userID', $whitelistData) && function_exists('get_user_by')) {
$user = get_user_by('id', $whitelistData['userID']);
if ($user) {
$whitelistData['username'] = $user->user_login;
}
}
$data['whitelistedURLParams'][] = array(
'path' => $path,
'paramKey' => $paramKey,
'ruleID' => array_keys($rules),
'data' => $whitelistData,
);
}
}
}
$data['disabledRules'] = (array) wfWAF::getInstance()->getStorageEngine()->getConfig('disabledRules');
if ($lastUpdated = wfWAF::getInstance()->getStorageEngine()->getConfig('rulesLastUpdated', null, 'transient')) {
$data['rulesLastUpdated'] = (int) $lastUpdated;
}
$data['isPaid'] = (bool) wfConfig::get('isPaid', 0);
if ($updated !== null) {
$data['updated'] = (bool) $updated;
if (!$updated) {
$data['failure'] = $failureReason;
}
}
return $data;
}
public static function ajax_wafStatus_callback() {
if (!empty($_REQUEST['nonce']) && hash_equals($_REQUEST['nonce'], wfConfig::get('wafStatusCallbackNonce', ''))) {
wfConfig::set('wafStatusCallbackNonce', '');
wfUtils::send_json(array('active' => WFWAF_AUTO_PREPEND, 'subdirectory' => WFWAF_SUBDIRECTORY_INSTALL));
}
wfUtils::send_json(false);
}
public static function ajax_installAutoPrepend_callback() {
global $wp_filesystem;
$currentAutoPrependFile = ini_get('auto_prepend_file');
$currentAutoPrepend = null;
if (isset($_POST['currentAutoPrepend']) && !WF_IS_WP_ENGINE && !WF_IS_PRESSABLE && !WF_IS_FLYWHEEL) {
$currentAutoPrepend = $_POST['currentAutoPrepend'];
}
$serverConfiguration = null;
if (isset($_POST['serverConfiguration']) && wfWAFAutoPrependHelper::isValidServerConfig($_POST['serverConfiguration'])) {
$serverConfiguration = $_POST['serverConfiguration'];
}
if ($serverConfiguration === null) {
return array('errorMsg' => __('A valid server configuration was not provided.', 'wordfence'));
}
$helper = new wfWAFAutoPrependHelper($serverConfiguration, $currentAutoPrepend === 'override' ? null : $currentAutoPrependFile);
ob_start();
$ajaxURL = admin_url('admin-ajax.php');
$allow_relaxed_file_ownership = true;
if (false === ($credentials = request_filesystem_credentials($ajaxURL, '', false, ABSPATH, array('version', 'locale', 'action', 'serverConfiguration', 'currentAutoPrepend'), $allow_relaxed_file_ownership))) {
$credentialsContent = ob_get_clean();
return array('needsCredentials' => 1, 'html' => $credentialsContent, 'formURL' => $ajaxURL);
}
ob_end_clean();
if (!WP_Filesystem($credentials, ABSPATH, $allow_relaxed_file_ownership) && $wp_filesystem->errors->get_error_code()) {
$credentialsErrors = [];
foreach ($wp_filesystem->errors->get_error_messages() as $message) {
if (is_wp_error($message)) {
if ($message->get_error_data() && is_string($message->get_error_data())) {
$message = $message->get_error_message() . ': ' . $message->get_error_data();
}
else {
$message = $message->get_error_message();
}
}
$credentialsErrors[] = $message;
}
return array('credentialsFailed' => 1, 'credentialsErrors' => $credentialsErrors);
}
try {
$helper->performInstallation($wp_filesystem);
$nonce = bin2hex(wfWAFUtils::random_bytes(32));
wfConfig::set('wafStatusCallbackNonce', $nonce);
$verifyURL = add_query_arg(array('action' => 'wordfence_wafStatus', 'nonce' => $nonce), $ajaxURL);
$response = wp_remote_get($verifyURL, array('headers' => array('Referer' => false/*, 'Cookie' => 'XDEBUG_SESSION=1'*/)));
$active = false;
if (!is_wp_error($response)) {
$wafStatus = @json_decode(wp_remote_retrieve_body($response), true);
if (is_array($wafStatus) && isset($wafStatus['active']) && isset($wafStatus['subdirectory'])) {
$active = $wafStatus['active'] && !$wafStatus['subdirectory'];
}
}
if ($serverConfiguration == 'manual') {
$postInstallAction = 'show-manual-install';
$postInstallActionData = array('autoPrependPath' => addcslashes(wordfence::getWAFBootstrapPath(), "'"));
}
else {
$postInstallAction = 'show-install-success';
$postInstallActionData = array('active' => $active);
}
/**
* Fires when the WAF protection level changes due to user action.
*
* @since 8.0.0
*
* @param string $before The previous mode.
* @param string $after The new mode.
*/
do_action('wordfence_waf_changed_protection_level', wfFirewall::PROTECTION_MODE_BASIC, wfFirewall::PROTECTION_MODE_EXTENDED);
return array('ok' => 1, 'postInstallAction' => $postInstallAction, 'postInstallActionData' => $postInstallActionData);
}
catch (wfWAFAutoPrependHelperException $e) {
return array('installationFailed' => 1, 'error' => $e->getMessage());
}
}
public static function ajax_uninstallAutoPrepend_callback() {
global $wp_filesystem;
$serverConfiguration = null;
if (isset($_POST['serverConfiguration']) && wfWAFAutoPrependHelper::isValidServerConfig($_POST['serverConfiguration'])) {
$serverConfiguration = $_POST['serverConfiguration'];
}
if ($serverConfiguration === null) {
return array('errorMsg' => __('A valid server configuration was not provided.', 'wordfence'));
}
$helper = new wfWAFAutoPrependHelper($serverConfiguration, null);
if (isset($_POST['credentials']) && isset($_POST['credentialsSignature'])) {
$salt = wp_salt('logged_in');
$expectedSignature = hash_hmac('sha256', $_POST['credentials'], $salt);
if (hash_equals($expectedSignature, $_POST['credentialsSignature'])) {
$decrypted = wfUtils::decrypt($_POST['credentials']);
$credentials = @json_decode($decrypted, true);
}
}
$ajaxURL = admin_url('admin-ajax.php');
if (!isset($credentials)) {
$allow_relaxed_file_ownership = true;
ob_start();
if (false === ($credentials = request_filesystem_credentials($ajaxURL, '', false, ABSPATH, array('version', 'locale', 'action', 'serverConfiguration', 'iniModified'), $allow_relaxed_file_ownership))) {
$credentialsContent = ob_get_clean();
return array('needsCredentials' => 1, 'html' => $credentialsContent, 'formURL' => $ajaxURL);
}
ob_end_clean();
}
if (!WP_Filesystem($credentials, ABSPATH, $allow_relaxed_file_ownership) && $wp_filesystem->errors->get_error_code()) {
$credentialsErrors = [];
foreach ($wp_filesystem->errors->get_error_messages() as $message) {
if (is_wp_error($message)) {
if ($message->get_error_data() && is_string($message->get_error_data())) {
$message = $message->get_error_message() . ': ' . $message->get_error_data();
}
else {
$message = $message->get_error_message();
}
}
$credentialsErrors[] = $message;
}
return array('credentialsFailed' => 1, 'credentialsErrors' => $credentialsErrors);
}
try {
if ((!isset($_POST['iniModified']) || (isset($_POST['iniModified']) && !$_POST['iniModified'])) && !WF_IS_PRESSABLE) { //Uses .user.ini but not yet modified
$hasPreviousAutoPrepend = $helper->performIniRemoval($wp_filesystem);
$iniTTL = intval(ini_get('user_ini.cache_ttl'));
if ($iniTTL == 0) {
$iniTTL = 300; //The PHP default
}
if (!$helper->usesUserIni()) {
$iniTTL = 0; //.htaccess
}
$timeout = max(30, $iniTTL);
$response = array(
'uninstallationWaiting' => true,
'timeout' => $timeout,
'hasPreviousAutoPrepend' => $hasPreviousAutoPrepend,
'refreshPayload' => array(
'serverConfiguration' => $_POST['serverConfiguration'],
),
);
if (isset($credentials) && is_array($credentials)) {
$salt = wp_salt('logged_in');
$json = json_encode($credentials);
$encrypted = wfUtils::encrypt($json);
$signature = hash_hmac('sha256', $encrypted, $salt);
$response['refreshPayload']['credentials'] = $encrypted;
$response['refreshPayload']['credentialsSignature'] = $signature;
}
/**
* Fires when the WAF protection level changes due to user action.
*
* @since 8.0.0
*
* @param string $before The previous mode.
* @param string $after The new mode.
*/
do_action('wordfence_waf_changed_protection_level', wfFirewall::PROTECTION_MODE_EXTENDED, wfFirewall::PROTECTION_MODE_BASIC);
return $response;
}
else { //.user.ini and .htaccess modified if applicable and waiting period elapsed or otherwise ready to advance to next step
if (WFWAF_AUTO_PREPEND && !WFWAF_SUBDIRECTORY_INSTALL && !WF_IS_WP_ENGINE && !WF_IS_PRESSABLE) { //.user.ini modified, but the WAF is still enabled
return array('uninstallationFailed' => true, 'errorMsg' => __('Extended Protection Mode has not been disabled. This may be because auto_prepend_file is configured somewhere else or the value is still cached by PHP.', 'wordfence'));
}
$helper->performAutoPrependFileRemoval($wp_filesystem);
$nonce = bin2hex(wfWAFUtils::random_bytes(32));
wfConfig::set('wafStatusCallbackNonce', $nonce);
$verifyURL = add_query_arg(array('action' => 'wordfence_wafStatus', 'nonce' => $nonce), $ajaxURL);
$response = wp_remote_get($verifyURL, array('headers' => array('Referer' => false/*, 'Cookie' => 'XDEBUG_SESSION=1'*/)));
$active = true;
$subdirectory = WFWAF_SUBDIRECTORY_INSTALL;
if (!is_wp_error($response)) {
$wafStatus = @json_decode(wp_remote_retrieve_body($response), true);
if (is_array($wafStatus) && isset($wafStatus['active']) && isset($wafStatus['subdirectory'])) {
$active = $wafStatus['active'] && !$wafStatus['subdirectory'];
$subdirectory = $wafStatus['subdirectory'];
}
}
return array('ok' => 1, 'active' => $active, 'subdirectory' => $subdirectory);
}
}
catch (wfWAFAutoPrependHelperException $e) {
return array('uninstallationFailed' => true, 'errorMsg' => $e->getMessage());
}
}
public static function actionUserRegistration($user_id) {
if (wfUtils::isAdmin($user_id) && ($request = self::getLog()->getCurrentRequest())) {
//self::getLog()->canLogHit = true;
$request->action = 'user:adminCreate';
$request->save();
}
}
public static function actionPasswordReset($user = null, $new_pass = null) {
if ($request = self::getLog()->getCurrentRequest()) {
//self::getLog()->canLogHit = true;
$request->action = 'user:passwordReset';
$request->save();
}
}
public static function trimWfHits($force = false) {
if(!$force && self::isApiDelayed())
return;
$wfdb = new wfDB();
$lastAggregation = wfConfig::get('lastBlockAggregation', 0);
$table_wfHits = wfDB::networkTable('wfHits');
$count = $wfdb->querySingle("select count(*) as cnt from {$table_wfHits}");
$liveTrafficMaxRows = absint(wfConfig::get('liveTraf_maxRows', 2000));
if ($count > $liveTrafficMaxRows * 10) {
self::_aggregateBlockStats($lastAggregation);
$wfdb->truncate($table_wfHits); //So we don't slow down sites that have very large wfHits tables
}
else if ($count > $liveTrafficMaxRows) {
self::_aggregateBlockStats($lastAggregation);
$wfdb->queryWrite("delete from {$table_wfHits} order by id asc limit %d", ($count - $liveTrafficMaxRows) + ($liveTrafficMaxRows * .2));
}
else if ($lastAggregation < (time() - 86400)) {
self::_aggregateBlockStats($lastAggregation);
}
$maxAge = wfConfig::get('liveTraf_maxAge', 30);
if ($maxAge <= 0 || $maxAge > 30) {
$maxAge = 30;
}
$wfdb->queryWrite("DELETE FROM {$table_wfHits} WHERE ctime < %d", time() - ($maxAge * 86400));
}
private static function _aggregateBlockStats($since = false) {
global $wpdb;
if (!wfConfig::get('other_WFNet', true)) {
return;
}
if ($since === false) {
$since = wfConfig::get('lastBlockAggregation', 0);
}
$hitsTable = wfDB::networkTable('wfHits');
$query = $wpdb->prepare("SELECT COUNT(*) AS cnt, CASE WHEN (jsRun = 1 OR userID > 0) THEN 1 ELSE 0 END AS isHuman, statusCode FROM {$hitsTable} WHERE ctime > %d GROUP BY isHuman, statusCode", $since);
$rows = $wpdb->get_results($query, ARRAY_A);
if (count($rows)) {
try {
$api = new wfAPI(wfConfig::get('apiKey'), wfUtils::getWPVersion());
$api->call('aggregate_stats', array(), array('stats' => json_encode($rows)));
}
catch (Exception $e) {
// Do nothing
}
}
wfConfig::set('lastBlockAggregation', time());
}
private static function isApiDelayed() {
return wfConfig::get('apiDelayedUntil', 0) > time();
}
private static function delaySendAttackData($until) {
wfConfig::set('apiDelayedUntil', $until);
self::scheduleSendAttackData($until);
}
private static function scheduleSendAttackData($timeToSend = null) {
if ($timeToSend === null) {
$timeToSend = time() + (60 * 5);
}
$notMainSite = is_multisite() && !is_main_site();
if ($notMainSite) {
global $current_site;
switch_to_blog($current_site->blog_id);
}
if (!wp_next_scheduled('wordfence_processAttackData')) {
wp_schedule_single_event($timeToSend, 'wordfence_processAttackData');
}
if ($notMainSite) {
restore_current_blog();
}
}
private static function truncateWafFailures() {
wfDB::shared()->truncate(wfDB::networkTable('wfWafFailures'));
}
private static function loadWafFailures(&$purgeCallable = null) {
global $wpdb;
$table = wfDB::networkTable('wfWafFailures');
$query = <<on the Wordfence Dashboard and reconnecting may resolve it. If the issue persists, please contact Wordfence support.', 'wordfence'), network_admin_url('admin.php?page=Wordfence#wf-central-status')), array('a' => array('href' => array()))) ?>
' . esc_html(sprintf(/* translators: %d maximum alerts per hour */__("The rate limit for alert emails of %d alert(s) per hour from Wordfence has been reached. No alerts will be sent for the remainer of the hour.", "wordfence"), self::getAlertRateLimit())) . '
' . __('Nice work! The firewall is now optimized.', 'wordfence') . '
' . __('The changes have not yet taken effect. If you are using LiteSpeed or IIS as your web server or CGI/FastCGI interface, you may need to wait a few minutes for the changes to take effect since the configuration files are sometimes cached. You also may need to select a different server configuration in order to complete this step, but wait for a few minutes before trying. You can try refreshing this page.', 'wordfence') . '
' . wp_kses(sprintf(/* translators: Help URL. */__('The Wordfence Assistant plugin is currently installed. It should only be retained during use and should be removed once it\'s no longer needed. Click here to learn more.', "wordfence"), "https://www.wordfence.com/help/scan/scan-results/#assistant-plugin-removed"), ['a' => ['href' => [], 'target' => []]]) . '
' . __('Uninstallation was successful!', 'wordfence') . '
' . __('Uninstallation from this site was successful! The Wordfence Firewall is still active because it is installed in another WordPress installation.', 'wordfence') . '
' . __('The changes have not yet taken effect. If you are using LiteSpeed or IIS as your web server or CGI/FastCGI interface, you may need to wait a few minutes for the changes to take effect since the configuration files are sometimes cached. You also may need to select a different server configuration in order to complete this step, but wait for a few minutes before trying. You can try refreshing this page.', 'wordfence') . '
' . __('The update was successful!', 'wordfence') . '
wordfence-waf.php file in the root of the WordPress installation. It\'s possible WordPress cannot write to the wordfence-waf.php file because of file permissions. Please verify the permissions are correct and retry the installation.', 'wordfence'));
}
$serverConfig = $this->getServerConfig();
$htaccessPath = wfWAFAutoPrependHelper::getHtaccessPath();
$homePath = dirname($htaccessPath);
$userIniPath = wfWAFAutoPrependHelper::getUserIniPath();
$userIni = ini_get('user_ini.filename');
$userIniHtaccessDirectives = '';
if ($userIni) {
$userIniHtaccessDirectives = sprintf('wordfence-waf.php file in the root of the WordPress installation. It\'s possible WordPress cannot remove the wordfence-waf.php file because of file permissions. Please verify the permissions are correct and retry the removal.', 'wordfence'));
}
}
public static function getHtaccessPath() {
return wfUtils::getHomePath() . '.htaccess';
}
public static function getUserIniPath() {
$userIni = ini_get('user_ini.filename');
if ($userIni) {
return wfUtils::getHomePath() . $userIni;
}
return false;
}
/**
* Extracts the WAF section from the .htaccess content and returns it (inclusive of the section markers). If not
* present, returns false.
*
* @param string $htaccessContent
* @return false|string
*/
public static function getHtaccessSectionContent($htaccessContent) {
$regex = '/# Wordfence WAF.*?# END Wordfence WAF/is';
if (preg_match($regex, $htaccessContent, $matches)) {
return $matches[0];
}
return false;
}
/**
* Extracts the WAF section from the .user.ini content and returns it (inclusive of the section markers). If not
* present, returns false.
*
* @param string $userIniContent
* @return false|string
*/
public static function getUserIniSectionContent($userIniContent) {
$regex = '/; Wordfence WAF.*?; END Wordfence WAF/is';
if (preg_match($regex, $userIniContent, $matches)) {
return $matches[0];
}
return false;
}
public function usesUserIni() {
$userIni = ini_get('user_ini.filename');
if (!$userIni) {
return false;
}
switch ($this->getServerConfig()) {
case 'cgi':
case 'apache-suphp':
case 'nginx':
case 'litespeed':
case 'iis':
return true;
}
return false;
}
public function uninstall() {
/** @var WP_Filesystem_Base $wp_filesystem */
global $wp_filesystem;
$htaccessPath = wfWAFAutoPrependHelper::getHtaccessPath();
$userIniPath = wfWAFAutoPrependHelper::getUserIniPath();
$adminURL = admin_url('/');
$allow_relaxed_file_ownership = true;
$homePath = dirname($htaccessPath);
ob_start();
if (false === ($credentials = request_filesystem_credentials($adminURL, '', false, $homePath,
array('version', 'locale'), $allow_relaxed_file_ownership))
) {
ob_end_clean();
return false;
}
if (!WP_Filesystem($credentials, $homePath, $allow_relaxed_file_ownership)) {
// Failed to connect, Error and request again
request_filesystem_credentials($adminURL, '', true, ABSPATH, array('version', 'locale'),
$allow_relaxed_file_ownership);
ob_end_clean();
return false;
}
if ($wp_filesystem->errors->get_error_code()) {
ob_end_clean();
return false;
}
ob_end_clean();
if ($wp_filesystem->is_file($htaccessPath)) {
$htaccessContent = $wp_filesystem->get_contents($htaccessPath);
$regex = '/# Wordfence WAF.*?# END Wordfence WAF/is';
if (preg_match($regex, $htaccessContent, $matches)) {
$htaccessContent = preg_replace($regex, '', $htaccessContent);
if (!$wp_filesystem->put_contents($htaccessPath, $htaccessContent)) {
return false;
}
}
}
if ($wp_filesystem->is_file($userIniPath)) {
$userIniContent = $wp_filesystem->get_contents($userIniPath);
$regex = '/; Wordfence WAF.*?; END Wordfence WAF/is';
if (preg_match($regex, $userIniContent, $matches)) {
$userIniContent = preg_replace($regex, '', $userIniContent);
if (!$wp_filesystem->put_contents($userIniPath, $userIniContent)) {
return false;
}
}
}
$bootstrapPath = wordfence::getWAFBootstrapPath();
if ($wp_filesystem->is_file($bootstrapPath)) {
$wp_filesystem->delete($bootstrapPath);
}
return true;
}
}
class wfWAFAutoPrependHelperException extends Exception {
}