array("HeadersError"=>"", "onLoad"=>"", "file_contents"=>"", "new_contents"=>"", "threats_found"=>array(), "skip_dirs" => array(".", ".."), "scanfiles" => array(), "nonce"=>array(), "mt" => ((isset($_REQUEST["mt"])&&is_numeric($_REQUEST["mt"]))?$_REQUEST["mt"]:microtime(true)), "threat_files" => array("htaccess"=>".htaccess","timthumb"=>"thumb.php"), "threat_levels" => array(__("Database Injections",'gotmls')=>"db_scan",__("htaccess Threats",'gotmls')=>"htaccess",__("TimThumb Exploits",'gotmls')=>"timthumb",__("Known Threats",'gotmls')=>"known",__("Core File Changes",'gotmls')=>"wp_core",__("Potential Threats",'gotmls')=>"potential"), "apache" => array(), "skip_ext"=>array("png", "jpg", "jpeg", "gif", "bmp", "tif", "tiff", "psd", "svg", "doc", "docx", "ttf", "fla", "flv", "mov", "mp3", "pdf", "css", "pot", "po", "mo", "so", "exe", "zip", "7z", "gz", "rar"), "execution_time" => 60, "default" => array("msg_position" => array("80px", "40px", "400px", "600px")), "Definition" => array("Default" => "CCIGG"), "definitions_array" => array( "potential"=>array( $bad[0]=>array("CCIGG", "/[^a-z_\\/'\"]".$bad[0]."\\(.+\\)+\\s*;/i"), $bad[1]." /e"=>array("CCIGG", "/".$bad[1]."[\\s*\\(]+(['\"])([\\!\\/\\#\\|\\@\\%\\^\\*\\~]).+?\\2[imsx]*e[imsx]*\\1\\s*,[^,]+,[^\\)]+[\\);\\s]+/i"), $bad[2]=>array("CCIGG", "/\\\$".$bad[2]."\\s*=.+;/i"), "function add_action wp_enqueue_script json2"=>array("CCIGG", "/json2\\.min\\.js/i"), "Tagged Code"=>array("CCIGG", "/\\#(\\w+)\\#.+?\\#\\/\\1\\#/is"), "protected by copyright"=>array("CCIGG", "/\\/\\* This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited. \\*\\//i")), ) ) ); if (isset($_SERVER["HTTP_HOST"])) $SERVER_HTTP = 'HOST://'.$_SERVER["HTTP_HOST"]; elseif (isset($_SERVER["SERVER_NAME"])) $SERVER_HTTP = 'NAME://'.$_SERVER["SERVER_NAME"]; elseif (isset($_SERVER["SERVER_ADDR"])) $SERVER_HTTP = 'ADDR://'.$_SERVER["SERVER_ADDR"]; else $SERVER_HTTP = "NULL://not.anything.com"; if (isset($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"]) $SERVER_HTTP .= ":".$_SERVER["SERVER_PORT"]; $SERVER_parts = explode(":", $SERVER_HTTP.":"); if ((isset($_SERVER["HTTPS"]) && ($_SERVER["HTTPS"] == "on" || $_SERVER["HTTPS"] == 1)) || (count($SERVER_parts) > 2 && $SERVER_parts[2] == "443")) $GLOBALS["GOTMLS"]["tmp"]["protocol"] = "https:"; else $GLOBALS["GOTMLS"]["tmp"]["protocol"] = "http:"; GOTMLS_define("GOTMLS_script_URI", preg_replace('/\&(last_)?mt=[0-9\.]+/i', '', str_replace('&', '&', GOTMLS_htmlspecialchars($_SERVER["REQUEST_URI"], ENT_QUOTES))).'&mt='.$GLOBALS["GOTMLS"]["tmp"]["mt"]); GOTMLS_define("GOTMLS_plugin_home", $GLOBALS["GOTMLS"]["tmp"]["protocol"]."//gotmls.net/"); if (!function_exists("GOTMLS_encode")) { function GOTMLS_encode($unencoded_string) { if (function_exists("base64_encode")) $encoded_string = base64_encode($unencoded_string); elseif (function_exists("mb_convert_encoding")) $encoded_string = mb_convert_encoding($unencoded_string, "BASE64", "UTF-8"); else $encoded_string = "Cannot encode: $unencoded_string function_exists: "; $encoded_array = explode("=", $encoded_string."="); return strtr($encoded_array[0], "+/0", "-_=").(count($encoded_array)-1); }} if (!function_exists("GOTMLS_decode")) { function GOTMLS_decode($encoded_string) { $tail = 0; if (strlen($encoded_string) > 1 && is_numeric(substr($encoded_string, -1)) && substr($encoded_string, -1) > 0) $tail = substr($encoded_string, -1) - 1; else $encoded_string .= "$tail"; $encoded_string = strtr(substr($encoded_string, 0, -1), "-_=", "+/0").str_repeat("=", $tail); if (function_exists("base64_decode")) return base64_decode($encoded_string); elseif (function_exists("mb_convert_encoding")) return mb_convert_encoding($encoded_string, "UTF-8", "BASE64"); else return "Cannot decode: $encoded_string"; }} GOTMLS_define("GOTMLS_Failed_to_list_LANGUAGE", __("Failed to list files in directory!",'gotmls')); GOTMLS_define("GOTMLS_Run_Quick_Scan_LANGUAGE", __("Quick Scan",'gotmls')); GOTMLS_define("GOTMLS_View_Quarantine_LANGUAGE", __("View Quarantine",'gotmls')); GOTMLS_define("GOTMLS_View_Scan_Log_LANGUAGE", __("View Scan Log",'gotmls')); GOTMLS_define("GOTMLS_require_version_LANGUAGE", sprintf(__("This Plugin requires WordPress version %s or higher",'gotmls'), GOTMLS_require_version)); GOTMLS_define("GOTMLS_Scan_Settings_LANGUAGE", __("Scan Settings",'gotmls')); GOTMLS_define("GOTMLS_Loading_LANGUAGE", __("Loading, Please Wait ...",'gotmls')); GOTMLS_define("GOTMLS_Automatically_Fix_LANGUAGE", __("Automatically Fix SELECTED Files Now",'gotmls')); if (!defined("ABSPATH")) { define("ABSPATH", dirname(dirname(__FILE__)).'/safe-load/'); $root_path = dirname(ABSPATH); while (strlen($root_path) > 1 && !is_file($root_path."/wp-config.php")) $root_path = dirname($root_path); if (is_file($root_path."/wp-config.php")) include_once($root_path."/wp-config.php"); else die("No wp-config!"); } function GOTMLS_update_option($index, $value = array()) { return update_option('GOTMLS_'.$index.'_blob', GOTMLS_encode(serialize($value))); } function GOTMLS_get_option($index, $value = array()) { if (is_array($tmp = get_option('GOTMLS_'.$index.'_array', array())) && count($tmp)) { GOTMLS_update_option($index, $tmp); delete_option('GOTMLS_'.$index.'_array'); } else $tmp = $value; return unserialize(GOTMLS_decode(get_option('GOTMLS_'.$index.'_blob', GOTMLS_encode(serialize($tmp))))); } $GOTMLS_chmod_file = (0644); $GOTMLS_chmod_dir = (0755); $GLOBALS["GOTMLS"]["tmp"]["nonce"] = get_option('GOTMLS_nonce_array', array()); $GLOBALS["GOTMLS"]["tmp"]["settings_array"] = get_option('GOTMLS_settings_array', array()); $GLOBALS["GOTMLS"]["tmp"]["definitions_array"] = GOTMLS_get_option('definitions', $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]); GOTMLS_define("GOTMLS_siteurl", get_option("siteurl", $GLOBALS["GOTMLS"]["tmp"]["protocol"].$SERVER_parts[1].((count($SERVER_parts) > 2 && ($SERVER_parts[2] == '80' || $SERVER_parts[2] == '443'))?"":":".$SERVER_parts[2])."/")); $GLOBALS["GOTMLS"]["log"] = get_option('GOTMLS_scan_log/'.(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:"0.0.0.0").'/'.$GLOBALS["GOTMLS"]["tmp"]["mt"], array()); if (!(isset($GLOBALS["GOTMLS"]["log"]["settings"]) && is_array($GLOBALS["GOTMLS"]["log"]["settings"]))) $GLOBALS["GOTMLS"]["log"]["settings"] = $GLOBALS["GOTMLS"]["tmp"]["settings_array"]; GOTMLS_define("GOTMLS_installation_key", md5(GOTMLS_siteurl)); GOTMLS_define("GOTMLS_update_home", "//updates.gotmls.net/".GOTMLS_installation_key."/"); if (!function_exists("GOTMLS_Invalid_Nonce")) { function GOTMLS_Invalid_Nonce($pre = "//Error: ") { return $pre.__("Invalid or expired Nonce Token!",'gotmls').(isset($_REQUEST["GOTMLS_mt"])?(GOTMLS_htmlspecialchars($_REQUEST["GOTMLS_mt"]).((strlen($_REQUEST["GOTMLS_mt"]) == 32)?(isset($GLOBALS["GOTMLS"]["tmp"]["nonce"][$_REQUEST["GOTMLS_mt"]])?$GLOBALS["GOTMLS"]["tmp"]["nonce"][$_REQUEST["GOTMLS_mt"]]:" !found"):" !len(".strlen($_REQUEST["GOTMLS_mt"]).")")):" GOTMLS_mt !set"); }} if (!function_exists("GOTMLS_set_nonce")) { function GOTMLS_set_nonce($context = "NULL") { $hour = round(($GLOBALS["GOTMLS"]["tmp"]["mt"]/60)/60); $transient_name = md5(GOTMLS_installation_key.GOTMLS_plugin_path.$hour); foreach ($GLOBALS["GOTMLS"]["tmp"]["nonce"] as $nonce_key => $nonce_value) if (($nonce_value > $hour) || (($nonce_value + 24) < $hour)) unset($GLOBALS["GOTMLS"]["tmp"]["nonce"][$nonce_key]); if (!isset($GLOBALS["GOTMLS"]["tmp"]["nonce"][$transient_name])) { $GLOBALS["GOTMLS"]["tmp"]["nonce"][$transient_name] = $hour; if (!update_option('GOTMLS_nonce_array', $GLOBALS["GOTMLS"]["tmp"]["nonce"])) return ("$context=DB-err:".preg_replace('/[\r\n]+/', " ", GOTMLS_htmlspecialchars(print_r($GLOBALS["GOTMLS"]["tmp"]["nonce"],1).$wpdb->last_error))); } return 'GOTMLS_mt='.$transient_name; }} if (!function_exists("GOTMLS_get_nonce")) { function GOTMLS_get_nonce() { if (isset($_REQUEST["GOTMLS_mt"])) { if (is_array($_REQUEST["GOTMLS_mt"])) { foreach ($_REQUEST["GOTMLS_mt"] as $_REQUEST_GOTMLS_mt) if (strlen($_REQUEST_GOTMLS_mt) == 32 && isset($GLOBALS["GOTMLS"]["tmp"]["nonce"][$_REQUEST_GOTMLS_mt])) return $GLOBALS["GOTMLS"]["tmp"]["nonce"][$_REQUEST_GOTMLS_mt]; return 0; } elseif (strlen($_REQUEST["GOTMLS_mt"]) == 32 && isset($GLOBALS["GOTMLS"]["tmp"]["nonce"][$_REQUEST["GOTMLS_mt"]])) return $GLOBALS["GOTMLS"]["tmp"]["nonce"][$_REQUEST["GOTMLS_mt"]]; else return ""; } else return false; }} function GOTMLS_fileperms($file) { if ($prm = @fileperms($file)) { if (($prm & 0xC000) == 0xC000) $ret = "s"; elseif (($prm & 0xA000) == 0xA000) $ret = "l"; elseif (($prm & 0x8000) == 0x8000) $ret = "-"; elseif (($prm & 0x6000) == 0x6000) $ret = "b"; elseif (($prm & 0x4000) == 0x4000) $ret = "d"; elseif (($prm & 0x2000) == 0x2000) $ret = "c"; elseif (($prm & 0x1000) == 0x1000) $ret = "p"; else $ret = "u"; $ret .= (($prm & 0x0100)?"r":"-").(($prm & 0x0080)?"w":"-"); $ret .= (($prm & 0x0040)?(($prm & 0x0800)?"s":"x" ):(($prm & 0x0800)?"S":"-")); $ret .= (($prm & 0x0020)?"r":"-").(($prm & 0x0010)?"w":"-"); $ret .= (($prm & 0x0008)?(($prm & 0x0400)?"s":"x" ):(($prm & 0x0400)?"S":"-")); $ret .= (($prm & 0x0004)?"r":"-").(($prm & 0x0002)?"w":"-"); $ret .= (($prm & 0x0001)?(($prm & 0x0200)?"t":"x" ):(($prm & 0x0200)?"T":"-")); return $ret; } else return "stat failed!"; } function GOTMLS_file_details($file) { return ''; } if (isset($_GET["SESSION"]) && is_numeric($_GET["SESSION"]) && preg_match('|(.*?/gotmls\.js\?SESSION=)|', GOTMLS_script_URI, $match)) { header("Content-type: text/javascript"); if (is_file(GOTMLS_plugin_path."safe-load/session.php")) require_once(GOTMLS_plugin_path."safe-load/session.php"); if (isset($_SESSION["GOTMLS_SESSION_TEST"])) die("/* GOTMLS SESSION PASS */\nif('undefined' != typeof stopCheckingSession && stopCheckingSession)\n\tclearTimeout(stopCheckingSession);\nshowhide('GOTMLS_patch_searching', true);\nif (autoUpdateDownloadGIF = document.getElementById('autoUpdateDownload'))\n\tdonationAmount = autoUpdateDownloadGIF.src.replace(/^.+\?/,'');\nif ((autoUpdateDownloadGIF.src == donationAmount) || donationAmount=='0') {\n\tif (patch_searching_div = document.getElementById('GOTMLS_patch_searching')) {\n\t\tif (autoUpdateDownloadGIF.src == donationAmount)\n\t\t\tpatch_searching_div.innerHTML = '".__("You must register and donate to use this feature!",'gotmls')."';\n\t\telse\n\t\t\tpatch_searching_div.innerHTML = '".__("This feature is available to those who have donated!",'gotmls')."';\n\t}\n} else {\n\tshowhide('GOTMLS_patch_searching');\n\tshowhide('GOTMLS_patch_button', true);\n}\n"); else { $_SESSION["GOTMLS_SESSION_TEST"] = $_GET["SESSION"] + 1; if ($_GET["SESSION"] > 0) die("/* GOTMLS SESSION FAIL */\nif('undefined' != typeof stopCheckingSession && stopCheckingSession)\n\tclearTimeout(stopCheckingSession);\ndocument.getElementById('GOTMLS_patch_searching').innerHTML = '
".__("Your Server could not start a Session!",'gotmls')."
';"); else die("/* GOTMLS SESSION TEST */\nif('undefined' != typeof stopCheckingSession && stopCheckingSession)\n\tclearTimeout(stopCheckingSession);\nstopCheckingSession = checkupdateserver('".$match[0].$_SESSION["GOTMLS_SESSION_TEST"]."', 'GOTMLS_patch_searching');"); } } elseif ((isset($_SERVER["DOCUMENT_ROOT"]) && ($SCRIPT_FILE = str_replace($_SERVER["DOCUMENT_ROOT"], "", isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:isset($_SERVER["SCRIPT_NAME"])?$_SERVER["SCRIPT_NAME"]:"")) && strlen($SCRIPT_FILE) > strlen("/".basename(__FILE__)) && substr(__FILE__, -1 * strlen($SCRIPT_FILE)) == substr($SCRIPT_FILE, -1 * strlen(__FILE__)))) { if (isset($_GET["page"]) && $_GET["page"] == "GOTMLS-View-Quarantine" && isset($_REQUEST["GOTMLS_mt"]) && strlen($_REQUEST["GOTMLS_mt"]) == 32 && isset($GLOBALS["GOTMLS"]["tmp"]["nonce"][$_REQUEST["GOTMLS_mt"]])) { $return = (print_r( array("nonce"=>$GLOBALS["GOTMLS"]["tmp"]["nonce"][$_REQUEST["GOTMLS_mt"]],"mt"=>($_REQUEST["GOTMLS_mt"])),1)); try { $Q_Paged = '
';//
Page:
'; $Q_Page = ' '; if (isset($_REQUEST["id"]) && is_numeric($_REQUEST["id"])) { $my_query = $wpdb->get_results("SELECT * FROM `{$table_prefix}posts` WHERE `post_type` = 'GOTMLS_quarantine' AND `post_status` = 'private' AND `ID` = ".$_REQUEST["id"], ARRAY_A); if (is_array($my_query) && count($my_query) && ($Q_post = $my_query[0]) && isset($Q_post["post_type"]) && $Q_post["post_type"] == "GOTMLS_quarantine" && isset($Q_post["post_status"]) && $Q_post["post_status"] == "private") { $clean_file = $Q_post["post_title"]; $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = GOTMLS_decode($Q_post["post_content"]); $fa = ""; if (isset($Q_post["post_excerpt"]) && strlen($Q_post["post_excerpt"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["threats_found"] = @unserialize(GOTMLS_decode($Q_post["post_excerpt"])))) { $f = 1; foreach ($GLOBALS["GOTMLS"]["tmp"]["threats_found"] as $threats_found => $threats_name) { list($start, $end, $junk) = explode("-", "$threats_found--", 3); if (strlen($end) > 0 && is_numeric($start) && is_numeric($end)) { if ($start < $end) $fa .= ' ['.$f++.']'; else $fa .= ' ['.$f++.']'; } else { if (is_numeric($threats_found)) { $threats_found = $threats_name; $threats_name = $f; } $fpos = 0; $flen = 0; $potential_threat = str_replace("\r", "", $threats_found); while (($fpos = strpos(str_replace("\r", "", $GLOBALS["GOTMLS"]["tmp"]["file_contents"]), ($potential_threat), $flen + $fpos)) !== false) { $flen = strlen($potential_threat); $fa .= ' ['.$f++.']'; } } } } die("\n".'
'.__("File Details:",'gotmls').' ('.$fa.' )
'); } else die('

Item NOT Found in Quarantine

'); } else { $my_query = $wpdb->get_results("SELECT * FROM `{$table_prefix}posts` WHERE `post_type` = 'GOTMLS_quarantine' AND `post_status` = 'private' ORDER BY `post_date_gmt` DESC", ARRAY_A); if (is_array($my_query) && count($my_query)) { $Q_Page .= '

The following items have been found to contain malicious code, they have been cleaned, and the original infected file contents have been saved here in the Quarantine. The code is safe here and you do not need to do anything further with these files.

"; for ($p = 1; $p <= 0; $p++) { $Q_Paged .= ''; } } else $Q_Page .= '

'.__("No Items in Quarantine",'gotmls').'

'; $return = "$Q_Paged\n
\n$Q_Page\n\n$Q_Paged\n
\n"; die("$return"); } } catch (Exception $e) { die('Caught exception: '. $e->getMessage(). "\n"); } } else { header("Content-type: image/gif"); $img_src = GOTMLS_local_images_path.'GOTMLS-16x16.gif'; if (!(file_exists($img_src) && $img_bin = @file_get_contents($img_src))) $img_bin = GOTMLS_decode('R=lGODlhEAAQAIABAAAAAP___yH5BAEAAAEALAAAAAAQABAAAAIshB=Qm-eo2HuJNWdrjlFm3S2hKB7kViKaxZmr98YgSo_jzH6tiU=974MADwUAOw2'); die($img_bin); } } elseif (isset($_GET["no_error_reporting"])) @error_reporting(0); if (function_exists("plugins_url")) GOTMLS_define("GOTMLS_images_path", plugins_url('/', __FILE__)); elseif (function_exists("plugin_dir_url")) GOTMLS_define("GOTMLS_images_path", plugin_dir_url(__FILE__)); elseif (isset($_SERVER["DOCUMENT_ROOT"]) && ($_SERVER["DOCUMENT_ROOT"]) && strlen($_SERVER["DOCUMENT_ROOT"]) < __FILE__ && substr(__FILE__, 0, strlen($_SERVER["DOCUMENT_ROOT"])) == $_SERVER["DOCUMENT_ROOT"]) GOTMLS_define("GOTMLS_images_path", substr(dirname(__FILE__), strlen($_SERVER["DOCUMENT_ROOT"]))); elseif (isset($_SERVER["SCRIPT_FILENAME"]) && isset($_SERVER["DOCUMENT_ROOT"]) && ($_SERVER["DOCUMENT_ROOT"]) && strlen($_SERVER["DOCUMENT_ROOT"]) < strlen($_SERVER["SCRIPT_FILENAME"]) && substr($_SERVER["SCRIPT_FILENAME"], 0, strlen($_SERVER["DOCUMENT_ROOT"])) == $_SERVER["DOCUMENT_ROOT"]) GOTMLS_define("GOTMLS_images_path", substr(dirname($_SERVER["SCRIPT_FILENAME"]), strlen($_SERVER["DOCUMENT_ROOT"]))); else GOTMLS_define("GOTMLS_images_path", "/wp-content/plugins/update/images/"); $GOTMLS_image_alt = array("wait"=>"...", "checked"=>"✔", "blocked"=>"X", "question"=>"?", "threat"=>"!"); $GOTMLS_dir_at_depth = array(); $GOTMLS_dirs_at_depth = array(); $GLOBAL_STRING = array("REQUEST" => "&","SERVER" => "&","FILES" => "&"); if (isset($_REQUEST) && is_array($_REQUEST)) foreach ($_REQUEST as $req => $val) $GLOBAL_STRING["REQUEST"] .= "$req=".(is_array($val)?print_r($val,1):$val)."&"; if (isset($_SERVER) && is_array($_SERVER)) foreach ($_SERVER as $req => $val) $GLOBAL_STRING["SERVER"] .= "$req=".(is_array($val)?print_r($val,1):$val)."&"; if (isset($_FILES) && is_array($_FILES)) foreach ($_FILES as $req => $fila) foreach (array("tmp_name","name") as $val) if (isset($fila["$val"])) $GLOBAL_STRING["FILES"] .= "$req.$val=".(is_array($fila["$val"])?print_r($fila["$val"],1):$fila["$val"])."&"; if (!(isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"]) && array($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"]))) $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"] = array( "RevSlider"=>array("CCIGG", "Revolution Slider Exploit Protection", "This protection is automatically activated because of the widespread attacks on WordPress that have affected so many sites. It is still recommended that you make sure to upgrade any older versions of the Revolution Slider plugin, especially those included in themes that will not update automatically. Even if you don't think you have Revolution Slider on your site it doen't hurt to have this protection enabled.", "SERVER", '/\/admin-ajax\.php/i', "REQUEST", '/\&img=[^\&]*(?array("CCIGG", "Directory Traversal Protection", "This protection is automatically activated because this type of attack is quite common. This protection can prevent hackers from accessing secure files in parent directories (or user's folders outside the site_root).", "REQUEST", '/=[\s\/]*\.\.\//'), "UploadPHP"=>array("CCIGG", "Upload PHP File Protection", "This protection is automatically activated because this type of attack is extremely dangerous. This protection can prevent hackers from uploading malicious code via web scripts.", "FILES", '/name=[^\&]*\.php\&/')); foreach ($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"] as $TP => $VA) { $V = 3; if (is_array($VA) && count($VA) > $V && is_array($VA[$V])) { foreach ($VA[$V] as $reg => $arr) { $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"]["$TP"][$V++] = $arr; $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"]["$TP"][$V++] = $reg; } } if (!(isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["firewall"]["$TP"]) && $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["firewall"]["$TP"])) { $GLOBALS["GOTMLS"]["detected_attacks"] = "&attack[]=FW_$TP"; for ($V = 4; isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"]["$TP"][$V]); $V+=2) if (!isset($GLOBAL_STRING[$GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"]["$TP"][$V-1]])) die($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"]["$TP"][$V-1]." [$V] not in 
".GOTMLS_htmlspecialchars(print_r($GLOBAL_STRING,1))."
"); elseif (!preg_match($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"]["$TP"][$V], $GLOBAL_STRING[$GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["firewall"]["$TP"][$V-1]], $matches)) $GLOBALS["GOTMLS"]["detected_attacks"] = ""; if ($GLOBALS["GOTMLS"]["detected_attacks"]) include(dirname(dirname(__FILE__))."/safe-load/index.php"); } } $GLOBALS["GOTMLS"]["detected_attacks"] = ""; if (!(isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"]) && count($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"]) == 4)) $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"] = $GLOBALS["GOTMLS"]["tmp"]["default"]["msg_position"]; if (!isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_what"])) $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_what"] = 2; if (!isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_depth"])) $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_depth"] = -1; if (!(isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"]))) $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"] = $GLOBALS["GOTMLS"]["tmp"]["skip_ext"]; if (!isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check_custom"])) $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check_custom"] = ""; if (!(isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_dir"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_dir"]))) $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_dir"] = array(); $GOTMLS_total_percent = 0; function GOTMLS_admin_notices() { if (!is_admin()) return; elseif ($GLOBALS["GOTMLS"]["tmp"]["HeadersError"]) echo $GLOBALS["GOTMLS"]["tmp"]["HeadersError"]; } function GOTMLS_array_recurse($array1, $array2) { foreach ($array2 as $key => $value) { if (!isset($array1[$key]) || (isset($array1[$key]) && !is_array($array1[$key]))) $array1[$key] = array(); if (is_array($value)) $value = GOTMLS_array_recurse($array1[$key], $value); $array1[$key] = $value; } return $array1; } function GOTMLS_array_replace($array1, $array2) { foreach ($array2 as $key => $value) $array1[$key] = $value; return $array1; } function GOTMLS_array_replace_recursive($array1 = array()) { $args = func_get_args(); $array1 = $args[0]; if (!is_array($array1)) $array1 = array(); for ($i = 1; $i < count($args); $i++) if (is_array($args[$i])) $array1 = GOTMLS_array_recurse($array1, $args[$i]); return $array1; } function GOTMLS_update_scan_log($scan_log) { if (is_array($scan_log)) { $GLOBALS["GOTMLS"]["log"] = GOTMLS_array_replace_recursive($GLOBALS["GOTMLS"]["log"], $scan_log); if (isset($GLOBALS["GOTMLS"]["log"]["scan"]["percent"]) && is_numeric($GLOBALS["GOTMLS"]["log"]["scan"]["percent"]) && ($GLOBALS["GOTMLS"]["log"]["scan"]["percent"] >= 100)) $GLOBALS["GOTMLS"]["log"]["scan"]["finish"] = time(); if (isset($GLOBALS["GOTMLS"]["log"]["scan"])) update_option("GOTMLS_scan_log/".(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:"0.0.0.0")."/".$GLOBALS["GOTMLS"]["tmp"]["mt"], $GLOBALS["GOTMLS"]["log"]); } } function GOTMLS_loaded() { if (headers_sent($filename, $linenum)) { if (!$filename) $filename = __("an unknown file",'gotmls'); if (!is_numeric($linenum)) $linenum = __("unknown",'gotmls'); $GLOBALS["GOTMLS"]["tmp"]["HeadersError"] = '
'.sprintf(__('Headers already sent in %1$s on line %2$s.
This is not a good sign, it may just be a poorly written plugin but Headers should not have been sent at this point.
Check the code in the above mentioned file to fix this problem.','gotmls'), $filename, $linenum).'
'; } elseif (isset($_GET["SESSION"]) && !session_id()) { @session_start(); if (session_id() && $_GET["SESSION"] == "GOTMLS_debug" && !isset($_SESSION["GOTMLS_debug"])) $_SESSION["GOTMLS_debug"]=array(); } } if (!function_exists("add_action")) { GOTMLS_loaded(); // GOTMLS_admin_notices(); } function GOTMLS_get_ext($filename) { $nameparts = explode(".", ".$filename"); return strtolower($nameparts[(count($nameparts)-1)]); } function GOTMLS_preg_match_all($threat_definition, $threat_name) { if (@preg_match_all($threat_definition, $GLOBALS["GOTMLS"]["tmp"]["file_contents"], $threats_found)) { $start = -1; if (!@preg_match_all($threat_definition, $GLOBALS["GOTMLS"]["tmp"]["new_contents"], $threat_found)) { $new_contents = $GLOBALS["GOTMLS"]["tmp"]["new_contents"]; $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = $GLOBALS["GOTMLS"]["tmp"]["file_contents"]; } else $new_contents = false; foreach ($threats_found[0] as $find) { $potential_threat = str_replace("\r", "", $find); $flen = strlen($potential_threat); while (($start = strpos(str_replace("\r", "", $GLOBALS["GOTMLS"]["tmp"]["file_contents"]), $potential_threat, $start+1)) !== false) $GLOBALS["GOTMLS"]["tmp"]["threats_found"]["$start-".($flen+$start)] = "$threat_name"; $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = str_replace($find, "", $GLOBALS["GOTMLS"]["tmp"]["new_contents"]); } if ($new_contents && strlen($new_contents) < strlen($GLOBALS["GOTMLS"]["tmp"]["new_contents"])) $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = $new_contents; return count($GLOBALS["GOTMLS"]["tmp"]["threats_found"]); } else return false; } function GOTMLS_check_threat($check_threats, $file='UNKNOWN') { $GLOBALS["GOTMLS"]["tmp"]["threats_found"] = array(); $GLOBALS["GOTMLS"]["log"]["scan"]["last_threat"] = microtime(true); if (is_array($check_threats)) { $path = str_replace("//", "/", "/".str_replace("\\", "/", substr($file, strlen(ABSPATH)))); if (substr($file, 0, strlen(ABSPATH)) == ABSPATH && isset($check_threats[GOTMLS_wp_version]["$path"])) { if (($check_threats[GOTMLS_wp_version]["$path"] != md5($GLOBALS["GOTMLS"]["tmp"]["file_contents"])."O".strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"])) && ($source = GOTMLS_get_URL("http://core.svn.wordpress.org/tags/".GOTMLS_wp_version."$path")) && ($check_threats[GOTMLS_wp_version]["$path"] == md5($source)."O".strlen($source))) { $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = $source; $len = strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]); if (strlen($source) < $len) $len = strlen($source); for ($start = 0, $end = 0; ($start == 0 || $end == 0) && $len > 0; $len--){ if ($start == 0 && substr($source, 0, $len) == substr($GLOBALS["GOTMLS"]["tmp"]["file_contents"], 0, $len)) $start = $len; if ($end == 0 && substr($source, -1 * $len) == substr($GLOBALS["GOTMLS"]["tmp"]["file_contents"], -1 * $len)) $end = $len; } $GLOBALS["GOTMLS"]["tmp"]["threats_found"]["$start-".(strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"])-$end)] = "Core File Modified"; } } else { foreach ($check_threats as $threat_name=>$threat_definitions) { $GLOBALS["GOTMLS"]["log"]["scan"]["last_threat"] = microtime(true); if (is_array($threat_definitions) && count($threat_definitions) > 1 && strlen(array_shift($threat_definitions)) == 5 && (!(isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["dont_check"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["dont_check"]) && in_array($threat_name, $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["dont_check"])))) while ($threat_definition = array_shift($threat_definitions)) GOTMLS_preg_match_all($threat_definition, $threat_name); if (isset($_SESSION["GOTMLS_debug"])) { $_SESSION["GOTMLS_debug"]["threat_name"] = $threat_name; $file_time = round(microtime(true) - $GLOBALS["GOTMLS"]["log"]["scan"]["last_threat"], 5); if (isset($_GET["GOTMLS_debug"]) && is_numeric($_GET["GOTMLS_debug"]) && $file_time > $_GET["GOTMLS_debug"]) echo "\n//GOTMLS_debug $file_time $threat_name $file\n"; if (isset($_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["total"])) $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["total"] += $file_time; else $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["total"] = $file_time; if (isset($_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["count"])) $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["count"] ++; else $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["count"] = 1; if (!isset($_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["least"]) || $file_time < $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["least"]) $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["least"] = $file_time; if (!isset($_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["most"]) || $file_time > $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["most"]) $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_name"]]["most"] = $file_time; } } } } elseif (strlen($check_threats) && isset($_GET['eli']) && substr($check_threats, 0, 1) == '/') GOTMLS_preg_match_all($check_threats, $check_threats); if (isset($_SESSION["GOTMLS_debug"])) { $file_time = round(microtime(true) - $GLOBALS["GOTMLS"]["log"]["scan"]["last_threat"], 5); if (isset($_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["total"])) $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["total"] += $file_time; else $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["total"] = $file_time; if (isset($_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["count"])) $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["count"] ++; else $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["count"] = 1; if (!isset($_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["least"]) || $file_time < $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["least"]) $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["least"] = $file_time; if (!isset($_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["most"]) || $file_time > $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["most"]) $_SESSION["GOTMLS_debug"][$_SESSION["GOTMLS_debug"]["threat_level"]]["most"] = $file_time; } return count($GLOBALS["GOTMLS"]["tmp"]["threats_found"]); } function GOTMLS_scanfile($file) { global $wpdb, $GOTMLS_chmod_file, $GOTMLS_chmod_dir; $GLOBALS["GOTMLS"]["tmp"]["debug_fix"]="Scanning..."; $GLOBALS["GOTMLS"]["tmp"]["threats_found"] = array(); $gt = ">"; $lt = "<"; $found = false; $threat_link = ""; $className = "scanned"; $real_file = realpath($file); $clean_file = GOTMLS_encode($real_file); if (is_file($real_file) && ($filesize = filesize($real_file)) && ($GLOBALS["GOTMLS"]["tmp"]["file_contents"] = @file_get_contents($real_file))) { if (isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"][GOTMLS_wp_version]) && is_array($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"][GOTMLS_wp_version])) $whitelist = array_flip($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"][GOTMLS_wp_version]); else $whitelist = array(); if (isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["whitelist"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["whitelist"])) { foreach ($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["whitelist"] as $whitelist_file=>$non_threats) { if (is_array($non_threats) && count($non_threats) > 1) { if (isset($non_threats[0])) unset($non_threats[0]); $whitelist = array_merge($whitelist, $non_threats); } } } if (isset($whitelist[md5($GLOBALS["GOTMLS"]["tmp"]["file_contents"]).'O'.$filesize])) return GOTMLS_return_threat($className, "checked.gif?$className", $file, $threat_link); $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = $GLOBALS["GOTMLS"]["tmp"]["file_contents"]; if (isset($GLOBALS["GOTMLS"]["log"]["settings"]["check_custom"]) && strlen($GLOBALS["GOTMLS"]["log"]["settings"]["check_custom"]) && isset($_GET['eli']) && substr($GLOBALS["GOTMLS"]["log"]["settings"]["check_custom"], 0, 1) == '/' && ($found = GOTMLS_check_threat($GLOBALS["GOTMLS"]["log"]["settings"]["check_custom"]))) $className = "known"; else { $path = str_replace("//", "/", "/".str_replace("\\", "/", substr($file, strlen(ABSPATH)))); if (isset($_SESSION["GOTMLS_debug"])) { $_SESSION["GOTMLS_debug"]["file"] = $file; $_SESSION["GOTMLS_debug"]["last"]["total"] = microtime(true); } if (isset($GLOBALS["GOTMLS"]["tmp"]["threat_levels"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["threat_levels"])) { foreach ($GLOBALS["GOTMLS"]["tmp"]["threat_levels"] as $threat_level) { if ("db_scan" != $threat_level) { if (isset($_SESSION["GOTMLS_debug"])) { $_SESSION["GOTMLS_debug"]["threat_level"] = $threat_level; $_SESSION["GOTMLS_debug"]["last"]["threat_level"] = microtime(true); } if (in_array($threat_level, $GLOBALS["GOTMLS"]["log"]["settings"]["check"]) && !$found && isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"][$threat_level]) && ($threat_level != "wp_core" || (substr($file, 0, strlen(ABSPATH)) == ABSPATH && isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"][GOTMLS_wp_version]["$path"]))) && (!array_key_exists($threat_level, $GLOBALS["GOTMLS"]["tmp"]["threat_files"]) || (substr($file."e", (-1 * strlen($GLOBALS["GOTMLS"]["tmp"]["threat_files"][$threat_level]."e"))) == $GLOBALS["GOTMLS"]["tmp"]["threat_files"][$threat_level]."e")) && ($found = GOTMLS_check_threat($GLOBALS["GOTMLS"]["tmp"]["definitions_array"][$threat_level],$file))) $className = $threat_level; } } } if (isset($_SESSION["GOTMLS_debug"])) { $file_time = round(microtime(true) - $_SESSION["GOTMLS_debug"]["last"]["total"], 5); if (isset($_SESSION["GOTMLS_debug"]["total"]["total"])) $_SESSION["GOTMLS_debug"]["total"]["total"] += $file_time; else $_SESSION["GOTMLS_debug"]["total"]["total"] = $file_time; if (isset($_SESSION["GOTMLS_debug"]["total"]["count"])) $_SESSION["GOTMLS_debug"]["total"]["count"] ++; else $_SESSION["GOTMLS_debug"]["total"]["count"] = 1; if (!isset($_SESSION["GOTMLS_debug"]["total"]["least"]) || $file_time < $_SESSION["GOTMLS_debug"]["total"]["least"]) $_SESSION["GOTMLS_debug"]["total"]["least"] = $file_time; if (!isset($_SESSION["GOTMLS_debug"]["total"]["most"]) || $file_time > $_SESSION["GOTMLS_debug"]["total"]["most"]) $_SESSION["GOTMLS_debug"]["total"]["most"] = $file_time; } } } else { $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = (is_file($real_file)?(is_readable($real_file)?(filesize($real_file)?__("Failed to read file contents!",'gotmls'):__("Empty file!",'gotmls')):(isset($_GET["eli"])?(@chmod($real_file, $GOTMLS_chmod_file)?__("Fixed file permissions! (try again)",'gotmls'):__("File permissions read-only!",'gotmls')):__("File not readable!",'gotmls'))):__("File does not exist!",'gotmls')); // $threat_link = GOTMLS_error_link($GLOBALS["GOTMLS"]["tmp"]["file_contents"], $real_file); $className = "errors"; } if (count($GLOBALS["GOTMLS"]["tmp"]["threats_found"])) { $threat_link = $lt.'a target="GOTMLS_iFrame" href="'.admin_url('admin-ajax.php?action=GOTMLS_scan&'.GOTMLS_set_nonce(__FUNCTION__."687").'&mt='.$GLOBALS["GOTMLS"]["tmp"]["mt"].'&GOTMLS_scan='.$clean_file.preg_replace('/\&(GOTMLS_scan|mt|GOTMLS_mt|action)=/', '&last_\1=', isset($_SERVER["QUERY_STRING"])&&strlen($_SERVER["QUERY_STRING"])?"&".$_SERVER["QUERY_STRING"]:"")).'" id="list_'.$clean_file.'" onclick="loadIframe(\''.str_replace("\"", """, $lt.'div style="float: left; white-space: nowrap;"'.$gt.__("Examine File",'gotmls').' ... '.$lt.'/div'.$gt.$lt.'div style="overflow: hidden; position: relative; height: 20px;"'.$gt.$lt.'div style="position: absolute; right: 0px; text-align: right; width: 9000px;"'.$gt.GOTMLS_htmlspecialchars(GOTMLS_strip4java($file), ENT_NOQUOTES)).$lt.'/div'.$gt.$lt.'/div'.$gt.'\');" class="GOTMLS_plugin"'.$gt; if ($className == "errors") { $GLOBALS["GOTMLS"]["tmp"]["debug_fix"]="errors"; $threat_link = GOTMLS_error_link($GLOBALS["GOTMLS"]["tmp"]["file_contents"], $file); $imageFile = "/blocked"; } elseif ($className != "potential") { if (isset($_POST["GOTMLS_fix"]) && is_array($_POST["GOTMLS_fix"]) && in_array($clean_file, $_POST["GOTMLS_fix"])) { $GLOBALS["GOTMLS"]["tmp"]["debug_fix"]="GOTMLS_fix"; if (GOTMLS_get_nonce()) { if ($className == "timthumb") { if (($source = GOTMLS_get_URL("http://$className.googlecode.com/svn/trunk/$className.php")) && strlen($source) > 500) $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = $source; else $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = ""; } elseif ($className == 'wp_core') { $path = str_replace("//", "/", "/".str_replace("\\", "/", substr($file, strlen(ABSPATH)))); if (substr($file, 0, strlen(ABSPATH)) == ABSPATH && isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"][GOTMLS_wp_version]["$path"]) && ($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"][GOTMLS_wp_version]["$path"] != md5($GLOBALS["GOTMLS"]["tmp"]["file_contents"])."O".strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"])) && ($source = GOTMLS_get_URL("http://core.svn.wordpress.org/tags/".GOTMLS_wp_version."$path")) && ($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"][GOTMLS_wp_version]["$path"] == md5($source)."O".strlen($source))) $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = $source; else $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = ""; } else { $GOTMLS_no_contents = trim(preg_replace('/\/\*.*?\*\/\s*/s', "", $GLOBALS["GOTMLS"]["tmp"]["new_contents"])); $GOTMLS_no_contents = trim(preg_replace('/\n\s*\/\/.*/', "", $GOTMLS_no_contents)); $GOTMLS_no_contents = trim(preg_replace('/'.$lt.'\?(php)?\s*(\?'.$gt.'|$)/is', "", $GOTMLS_no_contents)); if (strlen($GOTMLS_no_contents)) $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = trim(preg_replace('/'.$lt.'\?(php)?\s*(\?'.$gt.'|$)/is', "", $GLOBALS["GOTMLS"]["tmp"]["new_contents"])); else $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = ""; } if (strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) > 0 && (($Q_post = GOTMLS_write_quarantine($file, $className)) !== false) && ((strlen($GLOBALS["GOTMLS"]["tmp"]["new_contents"])==0 && isset($_GET["eli"]) && ($_GET["eli"] == "delete") && @unlink($file)) || (($Write_File = GOTMLS_file_put_contents($file, $GLOBALS["GOTMLS"]["tmp"]["new_contents"])) !== false))) { echo __("Success!",'gotmls'); return "/*--{$gt}*"."/\nfixedFile('$clean_file');\n/*{$lt}!--*"."/"; } else { echo __("Failed:",'gotmls').' '.(strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"])?((is_writable(dirname($file)) && is_writable($file))?(($Q_post===false)?__("failed to quarantine!",'gotmls')." (".$wpdb->last_error.")":((isset($Write_File)&&$Write_File)?"Q=$Q_post: ".__("reason unknown!",'gotmls'):"Q=$Q_post: ".__("failed to write!",'gotmls'))):__("file not writable!",'gotmls')):__("no file contents!",'gotmls')); if (isset($_GET["eli"])) echo 'uid='.getmyuid().'('.get_current_user().'),gid='.getmygid().($lt.'br'.$gt.$lt.'pre'.$gt.'file_stat'.print_r(stat($file), true)); return "/*--{$gt}*"."/\nfailedFile('$clean_file');\n/*{$lt}!--*"."/"; } } else { echo GOTMLS_Invalid_Nonce(__("Failed: ",'gotmls')); return "/*--{$gt}*"."/\nfailedFile('$clean_file');\n/*{$lt}!--*"."/"; } } $GLOBALS["GOTMLS"]["tmp"]["debug_fix"]=isset($_POST["GOTMLS_fix"])?"GOTMLS_fix=".GOTMLS_htmlspecialchars(print_r($_POST["GOTMLS_fix"],1)):"!potential"; $threat_link = $lt.'input type="checkbox" name="GOTMLS_fix[]" value="'.$clean_file.'" id="check_'.$clean_file.(($className != "wp_core||ifitis")?'" checked="'.$className:'').'" /'.$gt.$threat_link; $imageFile = "threat"; } elseif (isset($_POST["GOTMLS_fix"]) && is_array($_POST["GOTMLS_fix"]) && in_array($clean_file, $_POST["GOTMLS_fix"])) { echo __("Already Fixed!",'gotmls'); return "/*-->*"."/\nfixedFile('$clean_file');\n/**"."/\nDeletedFile('$id');\n/**"."/\nfailedFile('$id');\n/**"."/\nfixedFile('$id');\n/**"."/\nfailedFile('$id');\n/**"."/"; if ($className != "scanned") $li_js .= "\n$className++;\ndivx=document.getElementById('found_$className');\nif (divx) {\n\tvar newli = document.createElement('li');\n\tnewli.innerHTML='\"".$GOTMLS_image_alt[$imageFile]."\"".GOTMLS_strip4java($link, true).$fileNameJS.($link?"';\n\tdivx.display='block":"")."';\n\tdivx.appendChild(newli);\n}"; if ($className == "errors") $li_js .= "\ndivx=document.getElementById('wait_$fileName64');\nif (divx) {\n\tdivx.src='".GOTMLS_images_path."blocked.gif';\n\tdirerrors++;\n}"; elseif (is_file($fileName)) $li_js .= "\nscanned++;\n"; if ($className == "dir") $li_js .= "\ndivx=document.getElementById('wait_$fileName64');\nif (divx)\n\tdivx.src='".GOTMLS_images_path."checked.gif';"; return $li_js."\n/**"."/\nupdate_status('".GOTMLS_strip4java($status)."', $microtime, $percent);\n/*\*\//s', "", "$output/*-->*"."/"); echo "$output\n//flushed(".strlen(trim($output)).")\n"; if ($tag) echo "\n\n"; if (@ob_get_length()) @ob_flush(); if ($tag) echo "<$tag>\n/**"."/\ndocument.getElementById('status_text').innerHTML='Checking ".GOTMLS_strip4java($file)." ($filesize bytes)';\n/**"."/\ndocument.getElementById('status_text').innerHTML='Checked ".GOTMLS_strip4java($file)."';\n/**"."/\nscanNextDir(-1);\n/**"."/\nscanfilesArKeys.push('".GOTMLS_encode($dir)."&GOTMLS_only_file=".GOTMLS_encode($file)."');\nscanfilesArNames.push('Re-Checking ".GOTMLS_strip4java($path)."');\n/**"."/\n//skipped $path;\n/*