Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-2916: core.class.php in iwp-client/tags/1.11.1 – WordPress Plugin Repository

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the ‘admin_notice’ function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.

CVE
#sql#vulnerability#web#google#redis#java#wordpress#php#auth#webkit#ssl

1<?php2/************************************************************3 * This plugin was modified by Revmakx *4 * Copyright © 2012 Revmakx *5 * www.revmakx.com *6 * *7 ************************************************************/8/*************************************************************9 * 10 * core.class.php11 * 12 * Upgrade Plugins13 * 14 * 15 * Copyright © 2011 Prelovac Media16 * www.prelovac.com17 **************************************************************/18 if(basename($_SERVER[‘SCRIPT_FILENAME’]) == “core.class.php”):19 exit;20endif;21class IWP_MMB_Core extends IWP_MMB_Helper22{23 var $name;24 var $slug;25 var $settings;26 var $remote_client;27 var $comment_instance;28 var $plugin_instance;29 var $theme_instance;30 var $wp_instance;31 var $post_instance;32 var $stats_instance;33 var $search_instance;34 var $links_instance;35 var $user_instance;36 var $backup_instance;37 var $backup_new_instance;38 var $wordfence_instance;39 var $sucuri_instance;40 var $installer_instance;41 var $iwp_mmb_multisite;42 var $network_admin_install;43 44 var $ithemessec_instance;45 var $backup_repository_instance;46 var $optimize_instance;47 var $wp_purge_cache_instance;48 49 private $action_call;50 public $request_params;51 public $error_notice;52 private $action_params;53 private $iwp_mmb_pre_init_actions;54 private $iwp_mmb_pre_init_filters;55 private $iwp_mmb_init_actions;56 57 58 function __construct()59 {60 global $iwp_mmb_plugin_dir, $wpmu_version, $blog_id, $_iwp_mmb_plugin_actions, $_iwp_mmb_item_filter;61 62 $_iwp_mmb_plugin_actions = array();63 $this->name = 'Manage Multiple Blogs’;64 $this->slug = 'manage-multiple-blogs’;65 $this->action_call = null;66 $this->action_params = null;67 68 69 $this->settings = get_option($this->slug);70 if (!$this->settings) {71 $this->settings = array(72 ‘blogs’ => array(),73 ‘current_blog’ => array(74 ‘type’ => null75 )76 );77 $this->save_options();78 }79 if ( function_exists(‘is_multisite’) ) {80 if ( is_multisite() ) {81 $this->iwp_mmb_multisite = $blog_id;82 $this->network_admin_install = get_option(‘iwp_client_network_admin_install’);83 add_action('wpmu_new_blog’, array(&$this, ‘updateKeys’));84 }85 } else if (!empty($wpmu_version)) {86 $this->iwp_mmb_multisite = $blog_id;87 $this->network_admin_install = get_option(‘iwp_client_network_admin_install’);88 } else {89 $this->iwp_mmb_multisite = false;90 $this->network_admin_install = null;91 }92 93 // admin notices94 if ( !get_option(‘iwp_client_public_key’) ){95 if( $this->iwp_mmb_multisite ){96 if( is_network_admin() && $this->network_admin_install == ‘1’){97 //add_action('network_admin_notices’, array( &$this, ‘network_admin_notice’ ));// We implemented network activation so no need to show this notification98 add_action('network_admin_notices’, array( &$this, ‘admin_notice’ ));99 } else if( $this->network_admin_install != ‘1’ ){100 //$parent_key = $this->get_parent_blog_option(‘iwp_client_public_key’);//IWP commented to show notice to all subsites of network101 //if(empty($parent_key))//IWP commented to show notice to all subsites of network102 $parent_key = $this->get_parent_blog_option(‘iwp_client_public_key’);103 if (empty($parent_key)) {104 add_action('admin_notices’, array(&$this, ‘admin_notice’));105 }106 }107 } else {108 add_action('admin_notices’, array( &$this, ‘admin_notice’ ));109 }110 }111 112 // default filters113 //$this->iwp_mmb_pre_init_filters[‘get_stats’][‘iwp_mmb_stats_filter’][] = array('IWP_MMB_Stats’, ‘pre_init_stats’); // called with class name, use global $iwp_mmb_core inside the function instead of $this114 $this->iwp_mmb_pre_init_filters[‘get_stats’][‘iwp_mmb_stats_filter’][] = 'iwp_mmb_pre_init_stats’;115 116 $_iwp_mmb_item_filter[‘pre_init_stats’] = array( 'core_update’, 'hit_counter’, 'comments’, 'backups’, 'posts’, 'drafts’, ‘scheduled’ );117 $_iwp_mmb_item_filter[‘get’] = array( 'updates’, ‘errors’,’plugins_status’,’themes_status’ );118 119 $this->iwp_mmb_pre_init_actions = array(120 ‘backup_req’ => 'iwp_mmb_get_backup_req’,121 );122 123 $this->iwp_mmb_init_actions = array(124 ‘do_upgrade’ => 'iwp_mmb_do_upgrade’,125 ‘get_stats’ => 'iwp_mmb_stats_get’,126 ‘remove_site’ => 'iwp_mmb_remove_site’,127 ‘backup_clone’ => 'iwp_mmb_backup_now’,128 ‘restore’ => 'iwp_mmb_restore_now’,129 ‘optimize_tables’ => 'iwp_mmb_optimize_tables’,130 ‘check_wp_version’ => 'iwp_mmb_wp_checkversion’,131 ‘create_post’ => 'iwp_mmb_post_create’,132 ‘update_client’ => 'iwp_mmb_update_client_plugin’,133 134 ‘change_comment_status’ => 'iwp_mmb_change_comment_status’,135 ‘change_post_status’ => 'iwp_mmb_change_post_status’,136 ‘get_comment_stats’ => 'iwp_mmb_comment_stats_get’,137 138 ‘get_links’ => 'iwp_mmb_get_links’,139 ‘add_link’ => 'iwp_mmb_add_link’,140 ‘delete_link’ => 'iwp_mmb_delete_link’,141 ‘delete_links’ => 'iwp_mmb_delete_links’,142 143 ‘create_post’ => 'iwp_mmb_post_create’,144 ‘get_posts’ => 'iwp_mmb_get_posts’,145 ‘delete_post’ => 'iwp_mmb_delete_post’,146 ‘delete_posts’ => 'iwp_mmb_delete_posts’,147 ‘edit_posts’ => 'iwp_mmb_edit_posts’,148 ‘get_pages’ => 'iwp_mmb_get_pages’,149 ‘delete_page’ => 'iwp_mmb_delete_page’,150 151 ‘install_addon’ => 'iwp_mmb_install_addon’,152 153 ‘add_user’ => 'iwp_mmb_add_user’,154 ‘email_backup’ => 'iwp_mmb_email_backup’,155 ‘check_backup_compat’ => 'iwp_mmb_check_backup_compat’,156 ‘scheduled_backup’ => 'iwp_mmb_scheduled_backup’,157 ‘new_scheduled_backup’ => 'iwp_mmb_new_scheduled_backup’,158 ‘run_task’ => 'iwp_mmb_run_task_now’,159 ‘new_run_task’ => 'iwp_mmb_new_run_task_now’,160 ‘delete_schedule_task’ => 'iwp_mmb_delete_task_now’,161 ‘execute_php_code’ => 'iwp_mmb_execute_php_code’,162 ‘delete_backup’ => 'iwp_mmb_delete_backup’,163 ‘delete_backup_new’ => 'iwp_mmb_delete_backup_new’,164 ‘kill_new_backup’ => 'iwp_mmb_kill_new_backup’,165 ‘remote_backup_now’ => 'iwp_mmb_remote_backup_now’,166 ‘set_notifications’ => 'iwp_mmb_set_notifications’,167 ‘clean_orphan_backups’ => 'iwp_mmb_clean_orphan_backups’,168 ‘get_users’ => 'iwp_mmb_get_users’,169 ‘edit_users’ => 'iwp_mmb_edit_users’,170 ‘get_plugins_themes’ => 'iwp_mmb_get_plugins_themes’,171 ‘edit_plugins_themes’ => 'iwp_mmb_edit_plugins_themes’,172 ‘get_comments’ => 'iwp_mmb_get_comments’,173 ‘action_comment’ => 'iwp_mmb_action_comment’,174 ‘bulk_action_comments’ => 'iwp_mmb_bulk_action_comments’,175 ‘replyto_comment’ => 'iwp_mmb_reply_comment’,176 ‘client_brand’ => 'iwp_mmb_client_brand’,177 ‘set_alerts’ => 'iwp_mmb_set_alerts’,178 ‘maintenance’ => 'iwp_mmb_maintenance_mode’,179 180 ‘wp_optimize’ => 'iwp_mmb_wp_optimize’,181 ‘wp_purge_cache’ => 'iwp_mmb_wp_purge_cache’,182 183 ‘backup_repository’ => 'iwp_mmb_backup_repository’,184 ‘trigger_backup_multi’ => 'iwp_mmb_trigger_check’,185 ‘trigger_backup_multi_new’ => 'iwp_mmb_trigger_check_new’,186 ‘get_all_links’ => 'iwp_mmb_get_all_links’,187 ‘update_broken_link’ => 'iwp_mmb_update_broken_link’,188 ‘unlink_broken_link’ => 'iwp_mmb_unlink_broken_link’,189 ‘markasnot_broken_link’ => 'iwp_mmb_markasnot_broken_link’,190 ‘dismiss_broken_link’ => 'iwp_mmb_dismiss_broken_link’,191 ‘undismiss_broken_link’ => 'iwp_mmb_undismiss_broken_link’,192 ‘bulk_actions_processor’ => 'iwp_mmb_bulk_actions_processor’,193194 ‘file_editor_upload’ => 'iwp_mmb_file_editor_upload’,195196 ‘put_redirect_url’ => 'iwp_mmb_gwmt_redirect_url’,197 'put_redirect_url_again’=> 'iwp_mmb_gwmt_redirect_url_again’,198 ‘wordfence_scan’ => 'iwp_mmb_wordfence_scan’,199 ‘wordfence_load’ => 'iwp_mmb_wordfence_load’,200 ‘sucuri_fetch_result’ => 'iwp_mmb_sucuri_fetch_result’,201 ‘backup_test_site’ => 'iwp_mmb_backup_test_site’,202 ‘ithemes_security_check’ => 'iwp_phx_ithemes_security_check’,203 ‘get_seo_info’ => 'iwp_mmb_yoast_get_seo_info’,204 ‘save_seo_info’ => 'iwp_mmb_yoast_save_seo_info’,205 ‘fetch_activities_log’ => 'iwp_mmb_fetch_activities_log’,206 ‘sucuri_scan’ => 'iwp_mmb_sucuri_scan’,207 ‘sucuri_change_alert’ => 'iwp_mmb_sucuri_change_alert’,208 ‘backup_downlaod’ => 'iwp_mmb_backup_downlaod’,209 ‘cronDoAction’ => 'iwp_pheonix_backup_cron_do_action’,210 ‘get_additional_stats’ => 'iwp_get_additional_stats’,211 ‘get_db_details’ => 'iwp_get_db_details’,212 ‘client_report_delete_log’ => 'iwp_client_report_delete_log’213 );214 215 add_action('rightnow_end’, array( &$this, ‘add_right_now_info’ )); 216 if( $this->iwp_mmb_multisite ){217 add_action(‘network_admin_menu’, array($this,’iwp_admin_menu_actions’), 10, 1);218 }else{219 add_action(‘admin_menu’, array($this,’iwp_admin_menu_actions’), 10, 1);220 } 221 add_action(‘init’, array($this,’iwp_cpb_hide_updates’), 10, 1);222 add_action(‘admin_init’, array(&$this,’admin_actions’)); 223 add_action(‘admin_init’, array(&$this,’enqueueConnectionModalOpenScripts’)); 224 add_action(‘admin_init’, array(&$this,’enqueueConnectionModalOpenStyles’)); 225 add_filter('deprecated_function_trigger_error’, ‘__return_false’);226 add_filter('plugin_row_meta’, array($this, ‘addConnectionKeyLink’), 10, 2);227 add_action('admin_head’, array($this, ‘printConnectionModalOpenScript’));228 add_action('admin_footer’, array($this, ‘printConnectionModalDialog’));229 // add_action('wp_loaded’, array( &$this, ‘iwp_mmb_remote_action’), 2147483650);230 add_action('setup_theme’, ‘iwp_mmb_set_request’);231 add_action('setup_theme’, ‘iwp_mmb_add_readd_request’);232 add_action('set_auth_cookie’, array( &$this, ‘iwp_mmb_set_auth_cookie’));233 add_action('wp_loaded’, array( &$this, ‘load_mu_loader_error’));234 add_action('set_logged_in_cookie’, array( &$this, ‘iwp_mmb_set_logged_in_cookie’));235 236 }237 238 function admin_wp_loaded_iwp(){239 if (!defined(‘WP_ADMIN’)) {240 define('WP_ADMIN’, true);241 }242 if (is_multisite() && !defined(‘WP_NETWORK_ADMIN’)) {243 define('WP_NETWORK_ADMIN’, true);244 }245 if (!defined(‘WP_BLOG_ADMIN’)) {246 define('WP_BLOG_ADMIN’, true);247 }248 require_once ABSPATH.’wp-admin/includes/admin.php’;249 // define(‘DOING_AJAX’, true);250 do_action(‘admin_init’);251 if (function_exists(‘wp_clean_update_cache’)) {252 /** @handled function */253 wp_clean_update_cache();254 }255256 /** @handled function */257 wp_update_plugins();258259 /** @handled function */260 set_current_screen();261 do_action(‘load-update-core.php’);262263 /** @handled function */264 wp_version_check();265266 /** @handled function */267 wp_version_check(array(), true);268 }269 270 function iwp_mmb_remote_action(){271 global $iwp_mmb_core;272 if (!empty($iwp_mmb_core->request_params)) {273 $params = $iwp_mmb_core->request_params;274 $action = $iwp_mmb_core->request_params[‘iwp_action’];275 if( isset($this->iwp_mmb_pre_init_filters[$action]) && !empty($this->iwp_mmb_pre_init_filters[$action])){276 global $iwp_mmb_filters;277 foreach($this->iwp_mmb_pre_init_filters[$action] as $_name => $_functions){278 if(!empty($_functions)){279 $data = array();280 281 foreach($_functions as $_k => $_callback){282 if(is_array($_callback) && method_exists($_callback[0], $_callback[1]) ){283 $data = call_user_func( $_callback, $params );284 } elseif (is_string($_callback) && function_exists( $_callback )){285 $data = call_user_func( $_callback, $params );286 }287 $iwp_mmb_filters[$_name] = isset($iwp_mmb_filters[$_name]) && !empty($iwp_mmb_filters[$_name]) ? array_merge($iwp_mmb_filters[$_name], $data) : $data;288 add_filter( $_name, function($a) use ($_name){289 global $iwp_mmb_filters;290 return array_merge($a,$iwp_mmb_filters[$_name]);291 });292 // $_name closure variable, $a is an arg293 }294 }295 296 }297 }298 }299 if($this->action_call != null){300 $params = isset($this->action_params) && $this->action_params != null ? $this->action_params : array();301 call_user_func($this->action_call, $params);302 }303 }304305 function iwp_mmb_manual_wp_upgrade(){306 /* in case database upgrade required, do database backup and perform upgrade ( wordpress wp_upgrade() function ) */307 global $wp_db_version, $wpmu_version;308 if( strlen(trim($wp_db_version)) && !defined(‘ACX_PLUGIN_DIR’) ){309 if ( get_option(‘db_version’) != $wp_db_version ) {310 /* in multisite network, please update database manualy */311 if (empty($wpmu_version) || (function_exists(‘is_multisite’) && !is_multisite())){312 if( ! function_exists(‘wp_upgrade’))313 include_once(ABSPATH.’wp-admin/includes/upgrade.php’);314 ob_clean();315 @wp_upgrade();316 @do_action(‘after_db_upgrade’);317 ob_end_clean();318 }319 }320 }321 }322 323 function register_action_params( $action = false, $params = array() ){324 if ($action == ‘get_stats’ || $action == ‘do_upgrade’) {325 add_action('wp_loaded’, array( &$this, ‘iwp_mmb_remote_action’), 2147483650);326 add_action('wp_loaded’, array( &$this, ‘admin_wp_loaded_iwp’), 2147483649);327 if($action == ‘get_stats’ && !isset( $_GET[‘step’])){328 add_action('wp_loaded’, array( &$this, ‘iwp_mmb_manual_wp_upgrade’),2147483648);329 }330 }elseif ($action == ‘install_addon’) {331 add_action('wp_loaded’, array( &$this, ‘iwp_mmb_remote_action’));332 }elseif ($action == ‘new_run_task’ || $action == ‘new_scheduled_backup’) {333 add_action('after_setup_theme’, array( &$this, ‘iwp_mmb_remote_action’), 9999);334 }else{335 add_action('init’, array( &$this, ‘iwp_mmb_remote_action’), 9999);336 }337 338 if(isset($this->iwp_mmb_pre_init_actions[$action]) && function_exists($this->iwp_mmb_pre_init_actions[$action])){339 call_user_func($this->iwp_mmb_pre_init_actions[$action], $params);340 }341 342 if(isset($this->iwp_mmb_init_actions[$action]) && function_exists($this->iwp_mmb_init_actions[$action])){343 $this->action_call = $this->iwp_mmb_init_actions[$action];344 $this->action_params = $params;345 return true;346 } 347 return false;348 }349 350 /**351 * Add notice to network admin dashboard for security reasons 352 * 353 */354 function network_admin_notice()355 {356 echo '<div class="error" style="text-align: center;"><p style="font-size: 14px; font-weight: bold; color:#c00;">Attention !</p>357 <p>The InfiniteWP client plugin has to be activated on individual sites. Kindly deactivate the plugin from the network admin dashboard and activate them from the individual dashboards.</p></div>’;358 }359 360 361 /**362 * Add notice to admin dashboard for security reasons 363 * 364 */365 function admin_notice()366 {367 /* IWP */368 if(defined(‘MULTISITE’) && MULTISITE == true){ 369 global $blog_id; 370 $details = get_user_by( 'email’,get_blog_option($blog_id, ‘admin_email’));371 //$details = get_userdata($user_id_from_email->ID);372 $username = $details->user_login; 373 }374 else{375 $current_user = wp_get_current_user(); 376 $username = $current_user->data->user_login;377 } 378 379 $iwp_client_activate_key = get_option(‘iwp_client_activate_key’);380 if (!is_admin()) {381 return false;382 }383 //check BWP 384 $bwp = get_option(“bit51_bwps”);385 $notice_display_URL=admin_url();386 if(!empty($bwp))387 {388 //$bwpArray = @unserialize($bwp);389 if($bwp[‘hb_enabled’]==1)390 $notice_display_URL = get_option(‘home’);391 }392 393 $notice_display_URL = rtrim($notice_display_URL, ‘/’).’/’;394 $website_URL = rtrim(get_option(‘home’), ‘/’).’/’;395 396 397 echo '<div class="updated" style="text-align: center; display:block !important; “><p style="color: green; font-size: 14px; font-weight: bold;">Add this site to IWP Admin panel</p><p>398 <table border="0” align="center" cellpadding="5">’;399 if(!empty($iwp_client_activate_key)){400 echo '<tr><td align="right">WP-ADMIN URL:</td><td align="left"><strong>’.$notice_display_URL.’</strong></td></tr>401 <tr><td align="right">WEBSITE URL:</td><td align="left"><strong>’.$website_URL.’</strong></td></tr>402 <tr><td align="right">ADMIN USERNAME:</td><td align="left"><strong>’.$username.’</strong> (or any admin id)</td></tr>403 <tr><td align="right">ACTIVATION KEY:</td><td align="left"><strong>’.$iwp_client_activate_key.’</strong></td></tr>404 <tr class="only_flash"><td></td><td align="left" style="position:relative;">405 <tr id="copy_at_once"><td align="right">To quick add, copy this</td><td align="left" style="position:relative;"><input type="text" style="width:295px;" class="read_creds" readonly value="’.$notice_display_URL.’|^|’.$username.’|^|’.$iwp_client_activate_key.’|^|’.$website_URL.’" /></td></tr>406 <tr class="only_flash"><td></td><td align="left" style="position:relative;"><div id="copy_details" data-clipboard-text="’.$notice_display_URL.’|^|’.$username.’|^|’.$iwp_client_activate_key.’|^|’.$website_URL.’" style="background:#008000;display: inline-block;padding: 4px 10px;border-radius: 5px;color:#fff;font-weight:600;cursor:pointer;">Copy details</div><span class="copy_message" style="display:none;margin-left:10px;color:#008000;">Copied :)</span></td></tr>407408 <script type="text/javascript">409 (function(){410 var onhoverMsg = “<span class=\"aftercopy_instruction\” style=\"position: absolute;top: 32px;left:20px;background:#fff;border:1px solid #000;-webkit-border-radius: 5px;-moz-border-radius: 5px;border-radius: 5px;padding:2px;margin:2px;text-align:center;\">Paste this in any field in the Add Website dialogue in the InfiniteWP admin panel.</span>";411 var clipboard = new Clipboard(“#copy_details”);412 if (clipboard != undefined) {413 clipboard.on(“success", function(e) {414 jQuery(“.copy_message”).show();415 setTimeout(\’jQuery(“.copy_message”).hide();\’,1000);416417 e.clearSelection();418419 });420 clipboard.on(“error", function(e) {421 jQuery(“.only_flash”).remove();422 jQuery(“.read_creds”).click(function(){jQuery(this).select();});423 });424 jQuery(“#copy_at_once”).hide();425 jQuery(“#copy_details”).mouseenter(function(){jQuery(onhoverMsg).appendTo(jQuery(this).parent());}).mouseleave(function(){jQuery(“.aftercopy_instruction”).remove();});426 }else{427 jQuery(“.only_flash”).remove();428 jQuery(“.read_creds”).click(function(){jQuery(this).select();});429 jQuery(“.read_creds”).mouseenter(function(e){jQuery(onhoverMsg).appendTo(jQuery(this).parent());}).mouseleave(function(){jQuery(“.aftercopy_instruction”).remove();});430 }431 })();432433 </script>’;434 }435 else{436 echo '<tr><td align="center">Please deactivate and then activate InfiniteWP Client plugin.</td></tr>’;437 } 438 439 echo ‘</table>440 </p></div>’; 441 442 }443 444 /**445 * Add an item into the Right Now Dashboard widget 446 * to inform that the blog can be managed remotely447 * 448 */449 function add_right_now_info()450 {451 echo ‘<div class="iwp_mmb-slave-info">452 <p>This site can be managed remotely.</p>453 </div>’;454 }455 456 /**457 * Get parent blog options458 * 459 */460 private function get_parent_blog_option( $option_name = ‘’ )461 {462 global $wpdb;463 $option = $wpdb->get_var( $wpdb->prepare( "SELECT `option_value` FROM {$wpdb->base_prefix}options WHERE option_name = %s LIMIT 1", $option_name ) );464 return $option;465 }466 467 468 /**469 * Gets an instance of the WP_Optimize class470 * 471 */472 function wp_optimize_instance()473 {474 if (!isset($this->optimize_instance)) {475 $this->optimize_instance = new IWP_MMB_Optimize();476 }477 478 return $this->optimize_instance;479 }480 481 function wp_purge_cache_instance()482 {483 global $iwp_mmb_plugin_dir;484 require_once(“$iwp_mmb_plugin_dir/addons/wp_optimize/purge-plugins-cache-class.php”);485 if (!isset($this->wp_purge_cache_instance)) {486 $this->wp_purge_cache_instance = new IWP_MMB_PURGE_CACHE();487 }488 489 return $this->wp_purge_cache_instance;490 }491 /**492 * Gets an instance of the WP_BrokenLinks class493 * 494 */495 function wp_blc_get_blinks()496 {497 global $iwp_mmb_plugin_dir;498 require_once(“$iwp_mmb_plugin_dir/addons/brokenlinks/brokenlinks.class.php”);499 if (!isset($this->blc_get_blinks)) {500 $this->blc_get_blinks = new IWP_MMB_BLC();501 }502 503 return $this->blc_get_blinks;504 }505 506507 /**508 * Gets an instance of the WP_BrokenLinks class509 * 510 */511 function wp_google_webmasters_crawls()512 {513 global $iwp_mmb_plugin_dir;514 require_once(“$iwp_mmb_plugin_dir/addons/google_webmasters/google_webmasters.class.php”);515 if (!isset($this->get_google_webmasters_crawls)) {516 $this->get_google_webmasters_crawls = new IWP_MMB_GWMT();517 }518 519 return $this->get_google_webmasters_crawls;520 }521 522 /**523 * Gets an instance of the fileEditor class524 * 525 */526 function wp_get_file_editor()527 {528 global $iwp_mmb_plugin_dir;529 require_once(“$iwp_mmb_plugin_dir/addons/file_editor/file_editor.class.php”);530 if (!isset($this->get_file_editor)) {531 $this->get_file_editor = new IWP_MMB_fileEditor();532 }533 534 return $this->get_file_editor;535 }536 537 538 /**539 * Gets an instance of the yoastWpSeo class540 * 541 */542 function wp_get_yoast_seo()543 {544 global $iwp_mmb_plugin_dir;545 require_once(“$iwp_mmb_plugin_dir/addons/yoast_wp_seo/yoast_wp_seo.class.php”);546 if (!isset($this->get_yoast_seo)) {547 $this->get_yoast_seo = new IWP_MMB_YWPSEO();548 }549 550 return $this->get_yoast_seo;551 }552 553554 /**555 * Gets an instance of the Comment class556 * 557 */558 function get_comment_instance()559 {560 if (!isset($this->comment_instance)) {561 $this->comment_instance = new IWP_MMB_Comment();562 }563 564 return $this->comment_instance;565 }566 567 /**568 * Gets an instance of the Plugin class569 * 570 */571 function get_plugin_instance()572 {573 if (!isset($this->plugin_instance)) {574 $this->plugin_instance = new IWP_MMB_Plugin();575 }576 577 return $this->plugin_instance;578 }579 580 /**581 * Gets an instance of the Theme class582 * 583 */584 function get_theme_instance()585 {586 if (!isset($this->theme_instance)) {587 $this->theme_instance = new IWP_MMB_Theme();588 }589 590 return $this->theme_instance;591 }592 593 594 /**595 * Gets an instance of IWP_MMB_Post class596 * 597 */598 function get_post_instance()599 {600 if (!isset($this->post_instance)) {601 $this->post_instance = new IWP_MMB_Post();602 }603 604 return $this->post_instance;605 }606 607 /**608 * Gets an instance of Blogroll class609 * 610 */611 function get_blogroll_instance()612 {613 if (!isset($this->blogroll_instance)) {614 $this->blogroll_instance = new IWP_MMB_Blogroll();615 }616 617 return $this->blogroll_instance;618 }619 620 621 622 /**623 * Gets an instance of the WP class624 * 625 */626 function get_wp_instance()627 {628 if (!isset($this->wp_instance)) {629 $this->wp_instance = new IWP_MMB_WP();630 }631 632 return $this->wp_instance;633 }634 635 /**636 * Gets an instance of User637 * 638 */639 function get_user_instance()640 {641 if (!isset($this->user_instance)) {642 $this->user_instance = new IWP_MMB_User();643 }644 645 return $this->user_instance;646 }647 648 /**649 * Gets an instance of stats class650 * 651 */652 function get_stats_instance()653 {654 if (!isset($this->stats_instance)) {655 $this->stats_instance = new IWP_MMB_Stats();656 }657 return $this->stats_instance;658 }659 /**660 * Gets an instance of search class661 * 662 */663 function get_search_instance()664 {665 if (!isset($this->search_instance)) {666 $this->search_instance = new IWP_MMB_Search();667 }668 //return $this->search_instance;669 return $this->search_instance;670 }671 /**672 * Gets an instance of stats class673 *674 */675 function get_new_backup_instance($params = array())676 {677 if ((isset($iwp_backup_core) && is_object($iwp_backup_core) && is_a($iwp_backup_core, ‘IWP_MMB_Backup_Core’))) return $iwp_backup_core;678679 require_once($GLOBALS[‘iwp_mmb_plugin_dir’].’/backup/backup.core.class.php’);680 iwp_mmb_define_constant();681 $iwp_backup_core = new IWP_MMB_Backup_Core();682 $GLOBALS[‘iwp_backup_core’] = $iwp_backup_core;683 $this->backup_new_instance = $iwp_backup_core;684 if (!$iwp_backup_core->memory_check(192)) {685 if (!$iwp_backup_core->memory_check($iwp_backup_core->memory_check_current(WP_MAX_MEMORY_LIMIT))) {686 $new = absint($iwp_backup_core->memory_check_current(WP_MAX_MEMORY_LIMIT));687 if ($new>32 && $new<100000) {688 @ini_set(‘memory_limit’, $new.’M’);689 }690 }691 }692 return $this->backup_new_instance;693 }694695 function get_backup_instance($mechanism=’’)696 {697 require_once($GLOBALS[‘iwp_mmb_plugin_dir’]."/backup.class.singlecall.php”);698 require_once($GLOBALS[‘iwp_mmb_plugin_dir’]."/backup.class.multicall.php”);699 require_once($GLOBALS[‘iwp_mmb_plugin_dir’]."/backup/backup-repo-test.php");700 //$mechanism = ‘multiCall’;701 if (!isset($this->backup_instance)) {702 if($mechanism == ‘singleCall’ || $mechanism == ‘’){703 $this->backup_instance = new IWP_MMB_Backup_Singlecall();704 }705 elseif($mechanism == ‘multiCall’){706 $this->backup_instance = new IWP_MMB_Backup_Multicall();707 }708 else{709 iwp_mmb_response(array(‘error’ => ‘mechanism not found’), true);710 //return false;711 }712 }713 714 return $this->backup_instance;715 }716717 function get_ithemessec_instance() {718 require_once($GLOBALS[‘iwp_mmb_plugin_dir’] . “/addons/itheme_security/class-iwp-client-ithemes-security-class.php”);719 if (!isset($this->ithemessec_instance)) {720 $this->ithemessec_instance = new IWP_MMB_IThemes_security();721 }722 return $this->ithemessec_instance;723 }724725 function get_backup_repository_instance()726 {727 require_once($GLOBALS[‘iwp_mmb_plugin_dir’]."/backup.class.singlecall.php");728 require_once($GLOBALS[‘iwp_mmb_plugin_dir’]."/backup.class.multicall.php");729 if (!isset($this->backup_repository_instance)) {730 $this->backup_repository_instance = new IWP_MMB_Backup_Repository();731 }732 733 return $this->backup_repository_instance;734 }735 736 /**737 * Gets an instance of links class738 *739 */740 function get_link_instance()741 {742 if (!isset($this->link_instance)) {743 $this->link_instance = new IWP_MMB_Link();744 }745 746 return $this->link_instance;747 }748 749 function get_installer_instance()750 {751 if (!isset($this->installer_instance)) {752 $this->installer_instance = new IWP_MMB_Installer();753 }754 return $this->installer_instance;755 }756757 function check_plugin_activated($pluginBasename){758 if(is_plugin_active_for_network($pluginBasename)){759 return true;760 }else if(is_plugin_active($pluginBasename)){761 return true;762 }763 return false;764 }765 766 /*767 * Get an instance of WordFence 768 */769 function get_wordfence_instance()770 {771 if (!isset($this->wordfence_instance)) {772 $this->wordfence_instance = new IWP_WORDFENCE();773 }774 return $this->wordfence_instance;775 }776 /*777 * Get an instance of WordFence 778 */779 function get_sucuri_instance()780 {781 if (!isset($this->sucuri_instance)) {782 $this->sucuri_instance = new IWP_MMB_Sucuri();783 }784 return $this->sucuri_instance;785 }786 787 public function buildLoaderContent($pluginBasename)788 {789 $loader = <<<EOF790<?php791792/*793Plugin Name: InfiniteWP - Client Loader794Plugin URI: https://infinitewp.com/795Description: This plugin will be created automatically when you activate your InfiniteWP Client plugin to improve the performance. And it will be deleted when you deactivate the client plugin.796Author: Revmakx797Version: 1.0.1798Author URI: https://infinitewp.com/799*/800801if (!function_exists(‘untrailingslashit’) || !defined(‘WP_PLUGIN_DIR’)) {802 // WordPress is probably not bootstrapped.803 exit;804}805806if (file_exists(untrailingslashit(WP_PLUGIN_DIR).’/$pluginBasename’)) {807 if (in_array('$pluginBasename’, (array) get_option(‘active_plugins’)) ||808 (function_exists(‘get_site_option’) && array_key_exists('iwp-client/init.php’, (array) get_site_option(‘active_sitewide_plugins’)))) {809 \$GLOBALS[‘iwp_is_mu’] = true;810 include_once untrailingslashit(WP_PLUGIN_DIR).’/$pluginBasename’;811 }812}813814EOF;815816 return $loader;817 }818819 public function registerMustUse($loaderName, $loaderContent)820 {821 $mustUsePluginDir = rtrim(WPMU_PLUGIN_DIR, ‘/’);822 $loaderPath = $mustUsePluginDir.’/’.$loaderName;823824 if (file_exists($loaderPath) && md5($loaderContent) === md5_file($loaderPath)) {825 return;826 }827828 if (!is_dir($mustUsePluginDir)) {829 $dirMade = @mkdir($mustUsePluginDir);830831 if (!$dirMade) {832 $error = error_get_last();833 return array(‘’);834 throw new Exception(sprintf('Unable to create loader directory: %s’, $error[‘message’]));835 }836 }837838 if (!is_writable($mustUsePluginDir)) {839 throw new Exception(‘MU-plugin directory is not writable.’);840 }841842 $loaderWritten = @file_put_contents($loaderPath, $loaderContent);843844 if (!$loaderWritten) {845 $error = error_get_last();846 throw new Exception(sprintf('Unable to write loader: %s’, $error[‘message’]));847 }848 update_option(‘iwp_mu_plugin_version’,’1.0.1’);849 }850851 function error_notices()852 {853 $error_notice = get_transient( ‘iwp_mu_plugin_loader’ );854 echo '<div class="error" style="text-align: center;"><p style="font-size: 14px; font-weight: bold; color:#c00;">Attention !</p>855 <p>Unable to write InfiniteWP Client loader: '.$error_notice.’</p></div>’;856 }857858 function load_mu_loader_error(){859 $error_notice = get_transient( ‘iwp_mu_plugin_loader’ );860 if( !empty($error_notice) ){861 add_action('admin_notices’, array( &$this, ‘error_notices’ ));862 }863 }864 /**865 * Plugin install callback function866 * Check PHP version867 */868 function install() {869 870 global $wpdb, $_wp_using_ext_object_cache, $current_user, $iwp_mmb_activities_log;871 $_wp_using_ext_object_cache = false;872 try {873 $this->registerMustUse('mu-iwp-client.php’, $this->buildLoaderContent(‘iwp-client/init.php’));874 } catch (Exception $e) {875 set_transient( 'iwp_mu_plugin_loader’, $e->getMessage(), 30 );876 }877 //delete plugin options, just in case878 if ($this->iwp_mmb_multisite != false) {879 $network_blogs = $wpdb->get_results(“select `blog_id`, `site_id` from `{$wpdb->blogs}`”);880 if(!empty($network_blogs)){881 if( is_network_admin() ){882 update_option('iwp_client_network_admin_install’, 1);883 $mainBlogId = defined(‘BLOG_ID_CURRENT_SITE’) ? BLOG_ID_CURRENT_SITE : false;884 foreach($network_blogs as $details){885 if (($mainBlogId !== false && $details->blog_id == $mainBlogId) || ($mainBlogId === false && $details->site_id == $details->blog_id)) {886 update_blog_option($details->blog_id, 'iwp_client_network_admin_install’, 1);887 }888 else {889 update_blog_option($details->blog_id, 'iwp_client_network_admin_install’, -1);890 }891 892 delete_blog_option($details->blog_id, 'iwp_client_nossl_key’, ‘’);893 delete_blog_option($details->blog_id, 'iwp_client_public_key’, ‘’);894 delete_blog_option($details->blog_id, ‘iwp_client_action_message_id’);895 }896 } else {897 update_option('iwp_client_network_admin_install’, -1);898 delete_option(‘iwp_client_nossl_key’);899 delete_option(‘iwp_client_public_key’);900 delete_option(‘iwp_client_action_message_id’);901 }902 }903 } else {904 delete_option(‘iwp_client_nossl_key’);905 delete_option(‘iwp_client_public_key’);906 delete_option(‘iwp_client_action_message_id’);907 }908 909 //delete_option(‘iwp_client_backup_tasks’);910 delete_option(‘iwp_client_notifications’);911 delete_option(‘iwp_client_brand’);912 delete_option(‘iwp_client_public_key’);913 delete_option(‘iwp_client_pageview_alerts’);914 915 $this->update_option('iwp_client_activate_key’, sha1( rand(1, 99999). uniqid('’, true) . get_option(‘siteurl’) ) );916 917 $iwp_mmb_activities_log->iwp_mmb_save_options_for_activity_log(‘install’);918 }919 920 /**921 * Saves the (modified) options into the database922 * 923 */924 function save_options()925 {926 if (get_option($this->slug)) {927 update_option($this->slug, $this->settings);928 } else {929 add_option($this->slug, $this->settings);930 }931 }932 933 /**934 * Deletes options for communication with IWP Admin panel935 * 936 */937 function uninstall( $deactivate = false )938 {939 global $current_user, $wpdb, $_wp_using_ext_object_cache;940 $_wp_using_ext_object_cache = false;941 942 if ($this->iwp_mmb_multisite != false) {943 $network_blogs = $wpdb->get_col(“select `blog_id` from `{$wpdb->blogs}`”);944 if(!empty($network_blogs)){945 if( is_network_admin() ){946 if( $deactivate ) {947 delete_option(‘iwp_client_network_admin_install’);948 foreach($network_blogs as $blog_id){949 delete_blog_option($blog_id, ‘iwp_client_network_admin_install’);950 delete_blog_option($blog_id, ‘iwp_client_nossl_key’);951 delete_blog_option($blog_id, ‘iwp_client_public_key’);952 delete_blog_option($blog_id, ‘iwp_client_action_message_id’);953 delete_blog_option($blog_id, ‘iwp_client_maintenace_mode’);954 }955 }956 } else {957 if( $deactivate )958 delete_option(‘iwp_client_network_admin_install’);959 960 delete_option(‘iwp_client_nossl_key’);961 delete_option(‘iwp_client_public_key’);962 delete_option(‘iwp_client_action_message_id’);963 }964 }965 } else {966 delete_option(‘iwp_client_nossl_key’);967 delete_option(‘iwp_client_public_key’);968 delete_option(‘iwp_client_action_message_id’);969 }970 971 //Delete options972 delete_option(‘iwp_client_maintenace_mode’);973 //delete_option(‘iwp_client_backup_tasks’);974 wp_clear_scheduled_hook(‘iwp_client_backup_tasks’);975 delete_option(‘iwp_client_notifications’);976 wp_clear_scheduled_hook(‘iwp_client_notifications’); 977 delete_option(‘iwp_client_brand’);978 delete_option(‘iwp_client_pageview_alerts’);979 980 delete_option(‘iwp_client_activate_key’);981 delete_option(‘iwp_client_all_themes_history’);982 delete_option(‘iwp_client_all_plugins_history’);983 delete_option(‘iwp_client_wp_version_old’);984 delete_option(‘is_save_activity_log’);985 $loaderName = 'mu-iwp-client.php’;986 try {987 $mustUsePluginDir = rtrim(WPMU_PLUGIN_DIR, ‘/’);988 $loaderPath = $mustUsePluginDir.’/’.$loaderName;989990 if (!file_exists($loaderPath)) {991 return;992 }993994 $removed = @unlink($loaderPath);995996 if (!$removed) {997 $error = error_get_last();998 throw new Exception(sprintf('Unable to remove loader: %s’, $error[‘message’]));999 }1000 } catch (Exception $e) {1001 mwp_logger()->error('Unable to remove loader’, array(‘exception’ => $e));1002 }1003 }1004 1005 1006 /**1007 * Constructs a url (for ajax purpose)1008 * 1009 * @param mixed $base_page1010 */1011 function construct_url($params = array(), $base_page = ‘index.php’)1012 {1013 $url = “$base_page?_wpnonce=” . wp_create_nonce($this->slug);1014 foreach ($params as $key => $value) {1015 $url .= “&$key=$value";1016 }1017 1018 return $url;1019 }1020 1021 /**1022 * Client update1023 * 1024 */1025 function update_client_plugin($params)1026 {1027 global $iwp_mmb_activities_log;1028 extract($params);1029 if ($download_url) {1030 @include_once ABSPATH . 'wp-admin/includes/file.php’;1031 @include_once ABSPATH . 'wp-admin/includes/plugin.php’;1032 @include_once ABSPATH . 'wp-admin/includes/misc.php’;1033 @include_once ABSPATH . 'wp-admin/includes/template.php’;1034 @include_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php’;1035 @include_once ABSPATH . 'wp-admin/includes/screen.php’;1036 if (!$this->define_ftp_constants($params)) {1037 return array(1038 ‘error’ => 'FTP constant define failed’, ‘error_code’ => 'ftp constant define failed’1039 );1040 }1041 if (!$this->is_server_writable()) {1042 return array(1043 ‘error’ => 'Failed, please add FTP details’, ‘error_code’ => 'automatic_upgrade_failed_add_ftp_details’1044 );1045 }10461047 ob_start();1048 @unlink(dirname(__FILE__));1049 $upgrader = new Plugin_Upgrader();1050 $result = $upgrader->run(array(1051 ‘package’ => $download_url,1052 ‘destination’ => WP_PLUGIN_DIR,1053 ‘clear_destination’ => true,1054 ‘clear_working’ => true,1055 ‘hook_extra’ => array(1056 ‘plugin’ => 'iwp-client/init.php’1057 )1058 ));1059 ob_end_clean();1060 @wp_update_plugins();1061 1062 if (is_wp_error($result) || !$result) {1063 return array(1064 ‘error’ => 'InfiniteWP Client plugin could not be updated.’, ‘error_code’ => 'client_plugin_could_not_be_updated’1065 );1066 } else {1067 1068 $iwp_mmb_activities_log->iwp_mmb_save_options_for_activity_log(‘update_client_plugin’);1069 1070 return array(1071 ‘success’ => 'InfiniteWP Client plugin successfully updated.’1072 );1073 }1074 }1075 return array(1076 ‘error’ => 'Bad download path for client installation file.’, ‘error_code’ => 'client_plugin_bad_download_path’1077 );1078 }1079 1080 /**1081 * Automatically logs in when called from IWP Admin panel1082 * 1083 */1084 function automatic_login()1085 {1086 $where = isset($_GET[‘iwp_goto’]) ? $_GET[‘iwp_goto’] : false;1087 $username = isset($_GET[‘username’]) ? $_GET[‘username’] : '’;1088 $auto_login = isset($_GET[‘auto_login’]) ? $_GET[‘auto_login’] : 0;1089 $page = isset($_GET[‘page’]) ? '?page=’.$_GET[‘page’] : '’;1090 $action = isset($_GET[‘action’]) ? '?action=’.$_GET[‘action’] : '’;1091 $post = isset($_GET[‘post’]) ? '&post=’.$_GET[‘post’] : ‘’;1092 $_SERVER[‘HTTP_REFERER’]=’’;1093 if( !function_exists(‘is_user_logged_in’) )1094 include_once( ABSPATH.’wp-includes/pluggable.php’ );1095 1096 if (( $auto_login && strlen(trim($username)) && !is_user_logged_in() ) || (isset($this->iwp_mmb_multisite) && $this->iwp_mmb_multisite )) {1097 $signature = base64_decode($_GET[‘signature’]);1098 $message_id = trim($_GET[‘message_id’]);1099 1100 $auth = $this->authenticate_message($where . $message_id, $signature, $message_id);1101 if ($auth === true) {1102 1103 if (!headers_sent())1104 header(‘P3P: CP="CAO PSA OUR"’);1105 1106 if(!defined(‘IWP_MMB_USER_LOGIN’))1107 define('IWP_MMB_USER_LOGIN’, true);1108 1109 $siteurl = function_exists(‘get_site_option’) ? get_site_option( ‘siteurl’ ) : get_option(‘siteurl’);1110 $user = $this->iwp_mmb_get_user_info($username);1111 wp_set_current_user($user->ID);1112 1113 if(!defined(‘COOKIEHASH’) || (isset($this->iwp_mmb_multisite) && $this->iwp_mmb_multisite) )1114 wp_cookie_constants();1115 1116 wp_set_auth_cookie($user->ID);1117 @iwp_mmb_client_header();1118 1119 //if((isset($this->iwp_mmb_multisite) && $this->iwp_mmb_multisite ) || isset($_REQUEST[‘iwpredirect’])){//comment makes force redirect, which fix bug https dashboard1120 if(function_exists(‘wp_safe_redirect’) && function_exists(‘admin_url’)){1121 wp_safe_redirect(admin_url($where.$page.$action.$post));1122 exit();1123 }1124 //}1125 } else {1126 wp_die($auth[‘error’]);1127 }1128 } elseif( is_user_logged_in() ) {1129 @iwp_mmb_client_header();1130 if(isset($_REQUEST[‘iwpredirect’])){1131 if(function_exists(‘wp_safe_redirect’) && function_exists(‘admin_url’)){1132 wp_safe_redirect(admin_url($where.$page.$action.$post));1133 exit();1134 }1135 }1136 }1137 }1138 1139 function iwp_mmb_set_auth_cookie( $auth_cookie ){1140 if(!defined(‘IWP_MMB_USER_LOGIN’))1141 return false;1142 1143 if( !defined(‘COOKIEHASH’) )1144 wp_cookie_constants();1145 1146 $_COOKIE['wordpress_’.COOKIEHASH] = $auth_cookie;1147 1148 }1149 function iwp_mmb_set_logged_in_cookie( $logged_in_cookie ){1150 if(!defined(‘IWP_MMB_USER_LOGIN’))1151 return false;1152 1153 if( !defined(‘COOKIEHASH’) )1154 wp_cookie_constants();1155 1156 $_COOKIE['wordpress_logged_in_’.COOKIEHASH] = $logged_in_cookie;1157 }1158 1159 function admin_actions(){1160 $replace = get_option(“iwp_client_brand”);1161 if(!empty($replace)){1162 if(!empty($replace[‘hideUpdatesCPB’])){1163 //define('DISALLOW_FILE_MODS’,true); //for hiding updates old method1164 }1165 if(!empty($replace[‘hideFWPCPB’])){1166 //define('DISALLOW_FILE_EDIT’,true); //for hiding file writing permissions old method1167 }1168 if(!empty($replace[‘doChangesCPB’]) || ( !isset($replace[‘doChangesCPB’]) && (!empty($replace[‘name’]) || !empty($replace[‘desc’]) || !empty($replace[‘author’]) || !empty($replace[‘author_url’])))){1169 add_filter('plugin_row_meta’, array($this, ‘iwp_client_replace_row_meta’), 10, 2); //for hiding the view details alone.1170 add_filter('site_transient_update_plugins’, array($this, ‘iwp_site_transient_update_plugins’), 10, 2); //for hiding the infiniteWP update details.1171 add_filter('admin_url’, array($this, ‘iwp_user_admin_url’), 10, 2); //for modifying the link available in plugin’s view version details link.1172 }1173 add_filter('all_plugins’, array($this, ‘client_replace’)); //for replacing name and all.1174 add_filter('show_advanced_plugins’, array($this, ‘muPluginListFilter’), 10, 2); //for replacing name and all.1175 }1176 }1177 1178 function iwp_remove_core_updates($value){1179 if(isset($value->response)){1180 $old_response = $value->response;1181 unset($value->response);1182 }1183 if(isset($value->updates)){1184 unset($value->updates);1185 }1186 return $value;1187 }1188 1189 function iwp_admin_menu_actions($args){1190 //to hide all updates1191 global $iwp_mmb_core;1192 $replace = get_option(“iwp_client_brand”);1193 if(empty($iwp_mmb_core->request_params) && !empty($replace)){1194 if(!empty($replace[‘hideUpdatesCPB’])){1195 //add_filter('wp_get_update_data’, array($this, ‘iwp_wp_get_update_data’), 10, 2);1196 $page = remove_submenu_page( 'index.php’, ‘update-core.php’ );1197 add_filter('transient_update_plugins’, array($this, ‘iwp_remove_core_updates’), 999999, 1);1198 add_filter('site_transient_update_core’, array($this, ‘iwp_remove_core_updates’), 999999, 1);1199 add_filter('site_transient_update_plugins’, array($this, ‘iwp_remove_core_updates’), 999999, 1);1200 add_filter('site_transient_update_themes’, array($this, ‘iwp_remove_core_updates’), 999999, 1);1201 }1202 if(!empty($replace[‘hideFWPCPB’])){1203 // remove_submenu_page(‘themes.php’,’theme-editor.php’);1204 // remove_submenu_page(‘plugins.php’,’plugin-editor.php’); // this is old method this allows editor in direct URL1205 if (!defined(‘DISALLOW_FILE_EDIT’)) {1206 define('DISALLOW_FILE_EDIT’, true);1207 }1208 add_filter('plugin_action_links’, array($this, ‘iwp_client_replace_action_links’), 10, 2);1209 }1210 }1211 }12121213 function iwp_cpb_hide_updates($args){1214 global $iwp_mmb_core;1215 $replace = get_option(“iwp_client_brand”);1216 if(empty($iwp_mmb_core->request_params) && !empty($replace)){1217 if(!empty($replace[‘hideUpdatesCPB’])){1218 add_filter('transient_update_plugins’, array($this, ‘iwp_remove_core_updates’), 999999, 1);1219 add_filter('site_transient_update_core’, array($this, ‘iwp_remove_core_updates’), 999999, 1);1220 add_filter('site_transient_update_plugins’, array($this, ‘iwp_remove_core_updates’), 999999, 1);1221 add_filter('site_transient_update_themes’, array($this, ‘iwp_remove_core_updates’), 999999, 1);1222 }1223 }1224 }1225 1226 function iwp_user_admin_url($args, $args2){1227 //for modifying the link available in plugin’s view version details link.1228 if(strpos($args2, ‘plugin-install.php?tab=plugin-information&plugin’) !== false){1229 $replace = get_option(“iwp_client_brand”);1230 if(!empty($replace) && is_array($replace)){1231 if(!empty($replace[‘name’])){1232 $search_str = 'plugin-install.php?tab=plugin-information&plugin=’.$replace[‘name’].’&section=changelog’;1233 if(strpos($args2, $search_str) !== false){1234 $return_var = plugins_url( ‘/iwp-client/readme.txt’ ) . 'TB_iframe=true&width=600&height=550’;1235 return $return_var;1236 }1237 }1238 }1239 }1240 return $args;1241 }1242 1243 function iwp_site_transient_update_plugins($value){1244 if(!empty($value->response[‘iwp-client/init.php’])){1245 $replace = get_option(“iwp_client_brand”);1246 if(!empty($replace) && is_array($replace)){1247 if(!empty($replace[‘name’])){1248 $file_traces = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS);1249 $called_by_file = array_pop($file_traces);1250 $called_by_file = basename($called_by_file[‘file’]);1251 if($called_by_file == “update-core.php”){1252 unset($value->response[‘iwp-client/init.php’]); //for hiding the updates available in updates dashboard section1253 }1254 else if($called_by_file == “plugins.php”){1255 $value->response[‘iwp-client/init.php’]->slug = $replace[‘name’]; ////for hiding the updates available in plugins section1256 $value->response[‘iwp-client/init.php’]->Name = $replace[‘name’];1257 //unset($value->response[‘iwp-client/init.php’]);1258 }1259 }1260 }1261 }1262 return $value;1263 }1264 1265 function iwp_client_replace_action_links($links, $file){1266 //for hiding edit on plugins page.1267 if(!empty($links[‘edit’])){1268 unset($links[‘edit’]);1269 }1270 return $links;1271 }1272 1273 function iwp_client_replace_row_meta($links, $file) {1274 //for hiding the view details alone.1275 if($file == ‘iwp-client/init.php’){1276 if(!empty($links[2])){1277 unset($links[2]);1278 }1279 }1280 return $links;1281 }1282 1283 function client_replace($all_plugins){1284 $replace = get_option(“iwp_client_brand”);1285 if(is_array($replace)){1286 if(!empty($replace[‘doChangesCPB’]) || (!isset($replace[‘doChangesCPB’]) && (!empty($replace[‘name’]) || !empty($replace[‘desc’]) || !empty($replace[‘author’]) || !empty($replace[‘author_url’])))){1287 $all_plugins[‘iwp-client/init.php’][‘Name’] = $replace[‘name’];1288 $all_plugins[‘iwp-client/init.php’][‘Title’] = $replace[‘name’];1289 $all_plugins[‘iwp-client/init.php’][‘Description’] = $replace[‘desc’];1290 $all_plugins[‘iwp-client/init.php’][‘AuthorURI’] = $replace[‘author_url’];1291 $all_plugins[‘iwp-client/init.php’][‘Author’] = $replace[‘author’];1292 $all_plugins[‘iwp-client/init.php’][‘AuthorName’] = $replace[‘author’];1293 $all_plugins[‘iwp-client/init.php’][‘PluginURI’] = '’;1294 }1295 1296 if(!empty($replace[‘hide’])){1297 if (!function_exists(‘get_plugins’)){1298 include_once(ABSPATH . ‘wp-admin/includes/plugin.php’);1299 }1300 if( $this->iwp_mmb_multisite ){1301 if(is_plugin_active_for_network(‘iwp-client/init.php’)){1302 unset($all_plugins[‘iwp-client/init.php’]);1303 }1304 }else{1305 $activated_plugins = get_option(‘active_plugins’);1306 if (!$activated_plugins){1307 $activated_plugins = array();1308 }1309 if(in_array('iwp-client/init.php’,$activated_plugins)){1310 unset($all_plugins[‘iwp-client/init.php’]);1311 }1312 }1313 }1314 }1315 1316 return $all_plugins;1317 }13181319 function add_login_action(){1320 add_action('plugins_loaded’, array( &$this, ‘automatic_login’), 10);1321 }13221323 function muPluginListFilter($previousValue, $type)1324 {1325 // Drop-in’s are filtered after MU plugins.1326 if ($type !== ‘dropins’) {1327 return $previousValue;1328 }13291330 if (!empty($previousValue[‘iwp-client/init.php’])) {1331 return $previousValue;1332 }1333 $replace = get_option(“iwp_client_brand”);13341335 if (!empty($replace[‘hide’])) {1336 unset($GLOBALS[‘plugins’][‘mustuse’][‘mu-iwp-client.php’]);1337 } elseif(!empty($replace[‘doChangesCPB’]) || (!isset($replace[‘doChangesCPB’]) && (!empty($replace[‘name’]) || !empty($replace[‘desc’]) || !empty($replace[‘author’]) || !empty($replace[‘author_url’])))){ 1338 $GLOBALS[‘plugins’][‘mustuse’][‘mu-iwp-client.php’][‘Name’] = $replace[‘name’];1339 $GLOBALS[‘plugins’][‘mustuse’][‘mu-iwp-client.php’][‘Title’] = $replace[‘name’];1340 $GLOBALS[‘plugins’][‘mustuse’][‘mu-iwp-client.php’][‘Description’] = $replace[‘desc’];1341 $GLOBALS[‘plugins’][‘mustuse’][‘mu-iwp-client.php’][‘AuthorURI’] = $replace[‘author_url’];1342 $GLOBALS[‘plugins’][‘mustuse’][‘mu-iwp-client.php’][‘Author’] = $replace[‘author’];1343 $GLOBALS[‘plugins’][‘mustuse’][‘mu-iwp-client.php’][‘AuthorName’] = $replace[‘author’];1344 $GLOBALS[‘plugins’][‘mustuse’][‘mu-iwp-client.php’][‘PluginURI’] = '’;1345 }13461347 return $previousValue;1348 }1349 function updateKeys()1350 {1351 if (!$this->iwp_mmb_multisite) {1352 return;1353 }13541355 global $wpdb;13561357 $publicKey = $this->get_parent_blog_option(‘iwp_client_public_key’);13581359 if (empty($publicKey)) {1360 return;1361 }13621363 $networkBlogs = $wpdb->get_results(“select `blog_id` from `{$wpdb->blogs}`”);13641365 if (empty($networkBlogs)) {1366 return;1367 }13681369 foreach ($networkBlogs as $details) {1370 update_blog_option($details->blog_id, 'iwp_client_public_key’, $publicKey);1371 }13721373 return;1374 }13751376 function addConnectionKeyLink($meta, $slug)1377 {1378 if (is_multisite() && !is_network_admin()) {1379 return $meta;1380 }13811382 if ($slug !== ‘iwp-client/init.php’) {1383 return $meta;1384 }13851386 if (!current_user_can(‘activate_plugins’)) {1387 return $meta;1388 }13891390 $meta[] = '<a href="#” id="iwp-view-connection-key" iwp-key="’.get_option(‘iwp_client_activate_key’).’">View activation key</a>’;13911392 return $meta;1393 }13941395 function printConnectionModalOpenScript()1396 {1397 if (!current_user_can(‘activate_plugins’)) {1398 return;1399 }14001401 ob_start()1402 ?>1403 <script type="text/javascript">1404 jQuery(document).ready(function($) {1405 var $iwpconnectionKeyDialog = $(‘#iwp_connection_key_dialog’);1406 $(‘#iwp-view-connection-key’).click(function(e) {1407 e.preventDefault();1408 $iwpconnectionKeyDialog.dialog({1409 draggable: false,1410 resizable: false,1411 modal: true,1412 width: '530px’,1413 height: 'auto’,1414 title: 'Activation Key’,1415 close: function() {1416 $(this).dialog(“destroy”);1417 }1418 });1419 });1420 $(‘button.copy-key-button’).click(function() {1421 $(‘#activation-key’).select();1422 document.execCommand(‘copy’);1423 });1424 });1425 </script>1426 <?php14271428 $content = ob_get_clean();1429 print $content;1430 }14311432 function printConnectionModalDialog()1433 {1434 if (is_multisite() && !is_network_admin()) {1435 return;1436 }14371438 if (!current_user_can(‘activate_plugins’)) {1439 return;1440 }14411442 ob_start();1443 ?>1444 <div id="iwp_connection_key_dialog" style="display: none;">14451446 <div style="text-align: center;font-weight: bold;"><p style="margin-bottom: 4px;margin-top: 20px;">Activation Key</p></div>1447 <input id="activation-key" rows="1" style="padding: 10px;background-color: #fafafa;border: 1px solid black;border-radius: 10px;font-weight: bold;font-size: 14px;text-align: center; width: 85%; margin-right: 5px" onclick="this.focus();this.select()" readonly="readonly" value="<?php echo get_option(‘iwp_client_activate_key’); ?>">1448 <button class="copy-key-button" data-clipboard-target="#activation-key" style="padding: 10px;background-color: #fafafa;border: 1px solid black;border-radius: 10px;font-weight: bold;font-size: 14px;text-align: center;">Copy</button>1449 </div>1450 <?php14511452 $content = ob_get_clean();1453 print $content;1454 } 14551456 function get_option($option){1457 if (is_multisite()) {1458 return get_site_option($option);1459 }14601461 return get_option($option);1462 }14631464 function update_option($option, $option_value){1465 if (is_multisite()) {1466 global $wpdb;1467 $blogIDs = $wpdb->get_col(“SELECT blog_id FROM $wpdb->blogs”);1468 foreach ($blogIDs as $blogID) {1469 update_blog_option($blogID, $option, $option_value);1470 }1471 return true;1472 } else {1473 update_option($option, $option_value);1474 return true;1475 }1476 return false;1477 }14781479 function enqueueConnectionModalOpenScripts(){1480 wp_enqueue_script(‘jquery’);1481 wp_enqueue_script(‘jquery-ui-core’);1482 wp_enqueue_script(‘jquery-ui-dialog’);1483 }14841485 function enqueueConnectionModalOpenStyles(){1486 wp_enqueue_style(‘wp-jquery-ui’);1487 wp_enqueue_style(‘wp-jquery-ui-dialog’);1488 }1489 1490 function get_db_details($params){1491 global $wpdb;1492 $result = array();1493 if (defined(‘DB_HOST’)) {1494 $result[‘dbHost’] = DB_HOST;1495 $result[‘dbName’] = DB_NAME;1496 $result[‘dbUser’] = DB_USER;1497 $result[‘dbPassword’] = DB_PASSWORD;1498 $result[‘db_table_prefix’] = $wpdb->base_prefix;1499 $result[‘site_url’] = site_url();1500 $result[‘home_url’] = home_url();1501 }15021503 return $result;1504 }15051506 function flush_redis_cache(){1507 @include_once( ABSPATH . ‘wp-admin/includes/plugin.php’ );1508 if ( is_plugin_active( ‘redis-cache/redis-cache.php’ ) ) {1509 @include_once(WP_PLUGIN_DIR . ‘/redis-cache/redis-cache.php’);1510 if(method_exists( $GLOBALS[ ‘wp_object_cache’ ], ‘redis_status’ )) {1511 wp_cache_flush();1512 }1513 }1514 }15151516 function iwp_delete_option($option_name){1517 if(!empty($option_name)){1518 global $wpdb;15191520 $delete_query = "DELETE FROM $wpdb->options WHERE option_name = ‘".$option_name."’";1521 $affected = $wpdb->query($delete_query);1522 if(!$affected){1523 global $iwp_backup_core;1524 $iwp_backup_core->log(“Failed to delete $option_name option”);1525 $bt = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS);1526 $log = $bt[0][‘file’].’-- line–’.$bt[0][‘line’].’–function–’.$bt[0][‘function’];1527 $iwp_backup_core->log(“$log”);1528 $iwp_backup_core->log(“Retry delete $option_name option”);1529 // retry operation1530 $query = "SELECT * FROM $wpdb->options WHERE option_name = ‘".$option_name."’";1531 $temp_row = $wpdb->get_row($query);1532 if(!empty($temp_row)){1533 $wpdb->query($delete_query);1534 }1535 }1536 }1537 }15381539 function iwp_update_option($option_name,$option_value){1540 if(!empty($option_name)){1541 global $wpdb;1542 $sql = "INSERT INTO `$wpdb->options` (option_name,option_value) VALUES (%s,%s) ON DUPLICATE KEY UPDATE option_value = %s";1543 $sql = $wpdb->prepare($sql,$option_name,$option_value,$option_value);1544 $affected = $wpdb->query($sql);1545 if(!$affected){1546 global $iwp_backup_core;1547 $iwp_backup_core->log(“Failed to update $option_name option and value $option_value”);1548 $bt = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS);1549 $log = $bt[0][‘file’].’-- line–’.$bt[0][‘line’].’–function–’.$bt[0][‘function’];1550 $iwp_backup_core->log(“$log”);1551 // retry operation1552 $affected = $wpdb->query($sql);1553 }1554 }1555 }15561557 function get_max_allowed_packet(){1558 global $wpdb;1559 $query = "SHOW VARIABLES LIKE 'max_allowed_packet’";1560 $temp_row = $wpdb->get_row($query);1561 if(!empty($temp_row)){1562 return $temp_row->Value; //1048576 1563 // $temp_row->Value/(1024*1024); // 1M1564 }else{1565 return '128M’; //Default 8M, so we tried with increase max_allowed_packet size1566 }1567 }1568 1569}1570?>

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907