PluginProbe
Patchstack – WordPress & Plugins Security / 2.3.5
Patchstack – WordPress & Plugins Security v2.3.5
2.3.7 trunk 2.1.0 2.1.1 2.1.10 2.1.11 2.1.12 2.1.13 2.1.14 2.1.15 2.1.16 2.1.17 2.1.18 2.1.19 2.1.2 2.1.20 2.1.21 2.1.22 2.1.23 2.1.24 2.1.25 2.1.3 2.1.4 2.1.5 2.1.6 All 49 releases
← All changes | includes/core.php +3 -69 trunk2.3.5 View file →
@@ -116,14 +116,8 @@
116 116
117 117 // Get the setting of the current site.
118 118 $secondary = get_option( $name, $default );
119 119
120 - // On single-site installs there is no network option to reconcile, so
121 - // avoid the extra get_site_option() lookup on every read.
122 - if ( ! is_multisite() ) {
123 - return $secondary;
124 - }
125 -
126 120 // Get the setting of the network and in case there's a difference,
127 121 // return the value of site.
128 122 $main = get_site_option( $name, $default );
129 123 return $main != $secondary ? $secondary : $main;
@@ -173,9 +167,9 @@
173 167 return true;
174 168 }
175 169
176 170 $expiry = get_option( 'patchstack_license_expiry', '' );
177 - if ( $expiry != '' && ( strtotime( $expiry ) > ( time() - ( 3600 * 24 ) ) ) ) {
171 + if ( $expiry != '' && ( strtotime( $expiry ) < ( time() + ( 3600 * 24 ) ) ) ) {
178 172 return true;
179 173 }
180 174
181 175 return false;
@@ -187,9 +181,9 @@
187 181 * @return boolean
188 182 */
189 183 public function is_connected() {
190 184 // Determine if the API client id is set.
191 - if ( $this->plugin->client_id == 'PATCHSTACK_CLIENT_ID' && ! get_option( 'patchstack_clientid' ) ) {
185 + if ( $this->plugin->client_id == 'PATCHSTACK_CLIENT_ID' && get_option( 'patchstack_clientid', false ) === false ) {
192 186 return false;
193 187 }
194 188
195 189 // Determine if we have an API token.
@@ -211,63 +205,12 @@
211 205 *
212 206 * @return boolean
213 207 */
214 208 public function is_protected() {
215 - return (int) get_option( 'patchstack_license_free', 0 ) == 0;
209 + return get_option( 'patchstack_license_free', false) == 0;
216 210 }
217 211
218 212 /**
219 - * Format a UNIX timestamp as a short relative-time string for the connection card.
220 - * Returns "Never" for empty/zero, otherwise "Just now" / "Xm ago" / "Xh ago" / "Xd ago".
221 - *
222 - * The returned string is the raw translated value — escape it at the call site.
223 - *
224 - * @param int $timestamp UNIX timestamp.
225 - * @return string Translated relative-time label (not escaped).
226 - */
227 - public function format_relative_time( $timestamp ) {
228 - $timestamp = (int) $timestamp;
229 - if ( $timestamp <= 0 ) {
230 - return __( 'Never', 'patchstack' );
231 - }
232 -
233 - $diff = time() - $timestamp;
234 - if ( $diff < 60 ) {
235 - return __( 'Just now', 'patchstack' );
236 - }
237 - if ( $diff < 3600 ) {
238 - /* translators: %d: number of minutes since the last sync. */
239 - return sprintf( __( '%dm ago', 'patchstack' ), (int) floor( $diff / 60 ) );
240 - }
241 - if ( $diff < 86400 ) {
242 - /* translators: %d: number of hours since the last sync. */
243 - return sprintf( __( '%dh ago', 'patchstack' ), (int) floor( $diff / 3600 ) );
244 - }
245 - /* translators: %d: number of days since the last sync. */
246 - return sprintf( __( '%dd ago', 'patchstack' ), (int) floor( $diff / 86400 ) );
247 - }
248 -
249 - /**
250 - * Get the timestamp of the last successful API sync.
251 - *
252 - * Prefers patchstack_last_sync, which is stamped on every successful (200 OK)
253 - * API request (log/software uploads, rule pulls, license verify, ping, etc.),
254 - * so it reflects real sync activity rather than only license verification.
255 - * Falls back to patchstack_last_license_check for sites that have not synced
256 - * yet since this option was introduced.
257 - *
258 - * @return int UNIX timestamp, or 0 if never synced.
259 - */
260 - public function get_last_sync_time() {
261 - $last_sync = (int) get_option( 'patchstack_last_sync', 0 );
262 - if ( $last_sync > 0 ) {
263 - return $last_sync;
264 - }
265 -
266 - return (int) get_option( 'patchstack_last_license_check', 0 );
267 - }
268 -
269 - /**
270 213 * Grab the IP address of the user. Give the override IP header priority.
271 214 * If this does not exist, we should always default to REMOTE_ADDR.
272 215 *
273 216 * @return string
@@ -378,14 +321,8 @@
378 321 ];
379 322 }
380 323
381 324 // Use the Sodium polyfill library part of WordPress core.
382 - if ( ! file_exists( ABSPATH . WPINC . '/sodium_compat/autoload.php' ) ) {
383 - return [
384 - 'cipher' => $message,
385 - 'nonce' => ''
386 - ];
387 - }
388 325 require_once ABSPATH . WPINC . '/sodium_compat/autoload.php';
389 326 $key = \Sodium\crypto_generichash( AUTH_KEY );
390 327
391 328 return [
@@ -420,11 +357,8 @@
420 357 if ( $enc_type == 'native' ) {
421 358 $key = sodium_crypto_generichash( AUTH_KEY );
422 359 $dec = sodium_crypto_secretbox_open( sodium_hex2bin( $cipher ), sodium_hex2bin( $nonce ), $key );
423 360 } else {
424 - if ( ! file_exists( ABSPATH . WPINC . '/sodium_compat/autoload.php' ) ) {
425 - return $cipher;
426 - }
427 361 require_once ABSPATH . WPINC . '/sodium_compat/autoload.php';
428 362 $key = \Sodium\crypto_generichash( AUTH_KEY );
429 363 $dec = \Sodium\crypto_secretbox_open( sodium_hex2bin( $cipher ), sodium_hex2bin( $nonce ), $key );
430 364 }