← All changes | includes/class-file-integrity.php +1199 -60 2.11.6 → 3.0.0 View file →

		@@ -165,13 +165,16 @@
165	165	*/
166	166	const REDACTED_MARKER = '[redacted by Vigilant]';
167	167
168	168	/**
169		- * Constant names whose value never reaches the database.
	169	+ * Constant names whose value is checked even where the file does not name them
170	170	*
171		- * The eight WordPress keys and salts and the database credentials, plus
172		- * anything whose name reads like a credential, since a real wp-config.php
173		- * collects SMTP passwords, S3 keys and API tokens over the years.
	171	+ * The eight WordPress keys and salts and the database credentials. Until
	172	+ * 2.11.7 this list, plus names that read like a credential, was what got
	173	+ * redacted, and a real wp-config.php collects secrets under any name:
	174	+ * FTP_PASS, SMTP passwords, cloud keys inside serialize( array( ... ) ),
	175	+ * any const. Since 2.11.8 every value is redacted and this list only feeds
	176	+ * the output check of baseline_content().
174	177	*
175	178	* @since 2.11.2
176	179	*
177	180	* @var string[]
		@@ -182,8 +185,36 @@
182	185	'AUTH_SALT', 'SECURE_AUTH_SALT', 'LOGGED_IN_SALT', 'NONCE_SALT',
183	186	);
184	187
185	188	/**
	189	+ * Core constants whose value stays readable in the baseline copy
	190	+ *
	191	+ * Where the site lives, where its folders are, how much memory it gets:
	192	+ * none of it is a secret and all of it is what a diff of wp-config.php is
	193	+ * read for. Every other value is redacted. A list of what is secret can
	194	+ * never be complete, which is how 2.11.2 to 2.11.7 missed FTP_PASS; a list
	195	+ * of what is not can be short and still be right.
	196	+ *
	197	+ * @since 2.11.8
	198	+ *
	199	+ * @var string[]
	200	+ */
	201	+ private static $readable_constants = array(
	202	+ 'ABSPATH', 'WPINC', 'WP_HOME', 'WP_SITEURL', 'WP_CONTENT_DIR', 'WP_CONTENT_URL',
	203	+ 'WP_PLUGIN_DIR', 'WP_PLUGIN_URL', 'WPMU_PLUGIN_DIR', 'WPMU_PLUGIN_URL', 'UPLOADS',
	204	+ 'WP_LANG_DIR', 'WP_TEMP_DIR', 'WP_DEBUG_LOG', 'WP_MEMORY_LIMIT', 'WP_MAX_MEMORY_LIMIT',
	205	+ 'WP_ENVIRONMENT_TYPE', 'WP_DEVELOPMENT_MODE', 'WP_AUTO_UPDATE_CORE', 'FS_METHOD',
	206	+ 'DB_CHARSET', 'DB_COLLATE', 'DOMAIN_CURRENT_SITE', 'PATH_CURRENT_SITE', 'NOBLOGREDIRECT',
	207	+ 'COOKIE_DOMAIN', 'COOKIEPATH', 'SITECOOKIEPATH', 'ADMIN_COOKIE_PATH', 'PLUGINS_COOKIE_PATH',
	208	+ 'WP_DEFAULT_THEME', 'WPLANG',
	209	+ // Numeric core settings. Since 2.11.10 a number in the value of a
	210	+ // define() is redacted like any other value, so the ones that are known
	211	+ // not to be credentials are listed here to keep the diff useful.
	212	+ 'AUTOSAVE_INTERVAL', 'WP_POST_REVISIONS', 'EMPTY_TRASH_DAYS', 'WP_CRON_LOCK_TIMEOUT',
	213	+ 'FS_CHMOD_DIR', 'FS_CHMOD_FILE', 'SITE_ID_CURRENT_SITE', 'BLOG_ID_CURRENT_SITE',
	214	+ );
	215	+
	216	+ /**
186	217	* Read the critical files baseline, from where it belongs
187	218	*
188	219	* Both watched files, wp-config.php and the root .htaccess, belong to the
189	220	* whole network: there is one of each per installation, not one per site.
		@@ -350,35 +381,61 @@
350	381	* @param string $normalized Normalized content.
351	382	* @return string Content safe to store, or '' when it cannot be made safe.
352	383	*/
353	384	private function baseline_content( $filename, $normalized ) {
	385	+ if ( '.htaccess' === $filename ) {
	386	+ return $this->redact_server_secrets( $normalized );
	387	+ }
	388	+
354	389	if ( 'wp-config.php' !== $filename ) {
355	390	return $normalized;
356	391	}
357	392
358		- $redacted = $this->redact_secrets( $normalized );
	393	+ // Calculados una sola vez: los usa la redaccion (para no conservar un
	394	+ // numero que ademas este en vigor) y el control de salida de abajo.
	395	+ $live_values = $this->values_in_force( $normalized );
	396	+ $redacted = $this->redact_secrets( $normalized, $live_values );
359	397
360	398	/*
361		- * Belt and braces, and this is the part that matters: the regular
362		- * expression above is the thing most likely to miss a shape nobody
363		- * thought of, and the cost of missing one is a secret in the database.
364		- * So the result is checked against the values actually in force, and
365		- * if any of them survived, nothing is stored at all. The scan then
366		- * reports the change without a line diff, which the interface already
367		- * handles, instead of leaking.
	399	+ * Belt and braces, and this is the part that matters: the redaction
	400	+ * above is the thing most likely to miss a shape nobody thought of,
	401	+ * and the cost of missing one is a secret in the database. So the
	402	+ * result is checked against the values actually in force, and if any
	403	+ * of them survived, nothing is stored at all. The scan then reports the
	404	+ * change without a line diff, which the interface already handles,
	405	+ * instead of leaking.
368	406	*
	407	+ * Until 2.11.7 the check covered the twelve constants of WordPress and
	408	+ * nothing else, so a value the regular expression missed went straight
	409	+ * through it. It now covers every constant the file names and every
	410	+ * environment variable it reads.
	411	+ *
	412	+ * It runs against the copy that is actually stored. A value in force
	413	+ * that sits inside the value of a readable constant, such as a Redis
	414	+ * prefix equal to the domain inside WP_HOME, is not a secret left
	415	+ * behind, so that one alone is not looked for; without that, every such
	416	+ * site would lose its diff. The first version of this checked a
	417	+ * stricter copy instead, and a secret inside a kept include path went
	418	+ * straight past it (cross review of 2.11.8).
	419	+ *
369	420	* Only values of eight characters or more are checked: DB_NAME is
370	421	* often something like "local" or "wp", and looking for that inside a
371	422	* PHP file matches by accident every time.
372	423	*/
373		- foreach ( self::$secret_constants as $name ) {
374		- if ( ! defined( $name ) ) {
375		- continue;
	424	+ if ( '' === $redacted ) {
	425	+ return '';
	426	+ }
	427	+
	428	+ $shown = $this->readable_values_in_force();
	429	+
	430	+ foreach ( $live_values as $value ) {
	431	+ foreach ( $shown as $readable ) {
	432	+ if ( false !== strpos( $readable, $value ) ) {
	433	+ continue 2;
	434	+ }
376	435	}
377	436
378		- $value = (string) constant( $name );
379		-
380		- if ( strlen( $value ) >= 8 && false !== strpos( $redacted, $value ) ) {
	437	+ if ( false !== strpos( $redacted, $value ) ) {
381	438	return '';
382	439	}
383	440	}
384	441
		@@ -385,40 +442,523 @@
385	442	return $redacted;
386	443	}
387	444
388	445	/**
389		- * Replace the value of every credential-looking define with a marker
	446	+ * Replace every value in wp-config.php with a marker
390	447	*
391		- * Keeps the line and the constant name, so the diff still shows that a
392		- * credential line was touched, and drops only the value.
	448	+ * Reads the file as PHP tokens and replaces every string in it: quoted,
	449	+ * with variables inside, heredoc and nowdoc. What stays is what names a
	450	+ * thing rather than holding it: the name passed to define(), defined(),
	451	+ * constant() and getenv(), the name in putenv( 'NAME=value' ), array keys,
	452	+ * an index such as $_ENV['NAME'], and strings of a single character that
	453	+ * are not the value of a define(). Also the value of the constants in
	454	+ * $readable_constants, the table prefix and a path passed to require or
	455	+ * include, which are not secrets and are what a diff of this file is read
	456	+ * for. A path is kept only while it looks like one, and only up to where
	457	+ * its expression ends.
393	458	*
	459	+ * Until 2.11.7 this was a regular expression over define() with a list of
	460	+ * names, and it missed FTP_PASS, SMTP passwords, cloud keys inside
	461	+ * serialize( array( ... ) ), every const and every value read with a
	462	+ * fallback. Measured while preparing 2.11.8: 10 of 15 real shapes stored
	463	+ * their secret.
	464	+ *
	465	+ * The marker always goes in single quotes, whatever the original used, so
	466	+ * a copy redacted by an earlier version and the same file redacted today
	467	+ * read the same line for line.
	468	+ *
394	469	* @since 2.11.2
	470	+ * @since 2.11.8 Reads tokens and redacts every value.
395	471	*
396	472	* @param string $content Normalized wp-config.php content.
	473	+ * @return string Redacted content, or '' when it cannot be read as tokens.
	474	+ */
	475	+ private function redact_secrets( $content, $live_values = array() ) {
	476	+ if ( ! function_exists( 'token_get_all' ) ) {
	477	+ return '';
	478	+ }
	479	+
	480	+ $marker = "'" . self::REDACTED_MARKER . "'";
	481	+ $tokens = self::merged_tokens( token_get_all( (string) $content ) );
	482	+ $count = count( $tokens );
	483	+ $names = defined( 'T_NAME_FULLY_QUALIFIED' ) ? array( T_STRING, T_NAME_FULLY_QUALIFIED ) : array( T_STRING );
	484	+ $includes = array( T_INCLUDE, T_INCLUDE_ONCE, T_REQUIRE, T_REQUIRE_ONCE );
	485	+ $out = '';
	486	+ $depth = 0;
	487	+ $keep_until = -1;
	488	+ $define_at = -1;
	489	+ $in_include = false;
	490	+ $include_depth = 0;
	491	+ $include_ends = array( T_CLOSE_TAG, T_BOOLEAN_OR, T_BOOLEAN_AND, T_LOGICAL_OR, T_LOGICAL_AND, T_COALESCE );
	492	+
	493	+ for ( $i = 0; $i < $count; $i++ ) {
	494	+ list( $type, $text, $plain ) = $tokens[ $i ];
	495	+
	496	+ if ( '(' === $type ) {
	497	+ $depth++;
	498	+ } elseif ( ')' === $type ) {
	499	+ // The closing parenthesis of a readable define(), or of any define().
	500	+ if ( $depth === $keep_until ) {
	501	+ $keep_until = -1;
	502	+ }
	503	+ if ( $depth === $define_at ) {
	504	+ $define_at = -1;
	505	+ }
	506	+ $depth--;
	507	+
	508	+ // A parenthesis that closes around the include ends its path.
	509	+ if ( $in_include && $depth < $include_depth ) {
	510	+ $in_include = false;
	511	+ }
	512	+ } elseif ( in_array( $type, $includes, true ) ) {
	513	+ $in_include = true;
	514	+ $include_depth = $depth;
	515	+ } elseif ( $in_include && ( in_array( $type, array( ';', '{', '}', '?', ':', ',' ), true ) || in_array( $type, $include_ends, true ) ) ) {
	516	+ /*
	517	+ * The path of an include ends where its expression does. The
	518	+ * first version of this only ended it at ';', so the value in
	519	+ * `( include 'db.php' ) || define( 'FTP_PASS', '...' )`, in a
	520	+ * ternary after require, or after a closing tag, was kept.
	521	+ * Found by the cross review of 2.11.8.
	522	+ */
	523	+ $in_include = false;
	524	+ }
	525	+
	526	+ if ( T_COMMENT === $type || T_DOC_COMMENT === $type ) {
	527	+ $out .= $this->redact_comment( $text );
	528	+ continue;
	529	+ }
	530	+
	531	+ if ( T_INLINE_HTML === $type ) {
	532	+ $out .= ( '' === trim( $text ) ) ? $text : $marker;
	533	+ continue;
	534	+ }
	535	+
	536	+ /*
	537	+ * A value that is not a quoted string is still a value. Until
	538	+ * 2.11.10 only string tokens were looked at, so
	539	+ * define( 'SERVICE_TOKEN', 12345678 ) put the live token in the copy
	540	+ * kept in the database. Reported by the wp.org automated review of
	541	+ * 2.11.9.
	542	+ *
	543	+ * The first fix here redacted a number only in the value position of
	544	+ * a define(), which is the shape that was reported and not the shape
	545	+ * of the problem. The second cross review of 2.11.10 measured nine
	546	+ * more: a negative number, one in parentheses, one inside
	547	+ * array( ... ), one in a ternary, a const, and four that are not
	548	+ * constants at all and so the output check cannot catch either, the
	549	+ * worst of them the documented way of configuring Redis,
	550	+ * $redis_server = array( 'auth' => 12345678 ). So a number is now
	551	+ * treated like a string: redacted unless the place it sits in is one
	552	+ * of the few that cannot hold a credential, which is how the rest of
	553	+ * this function has been written since 2.11.8 (a list of what may be
	554	+ * shown, never a list of what is secret).
	555	+ *
	556	+ * Losing a number from the diff costs little and buys the same trade
	557	+ * as everywhere else: the hash still covers the whole file, so a
	558	+ * change is detected even where the diff can no longer show it. The
	559	+ * numeric core settings are in $readable_constants so the diff of a
	560	+ * normal wp-config.php keeps saying what it used to.
	561	+ */
	562	+ if ( T_LNUMBER === $type || T_DNUMBER === $type ) {
	563	+ $nprev = self::significant_token( $tokens, $i, -1 );
	564	+ $nnext = self::significant_token( $tokens, $i, 1 );
	565	+ $nptype = ( null === $nprev ) ? null : $tokens[ $nprev ][0];
	566	+ $nntype = ( null === $nnext ) ? null : $tokens[ $nnext ][0];
	567	+ $nbefore = ( '[' === $nptype ) ? self::significant_token( $tokens, $nprev, -1 ) : null;
	568	+ $nbtoken = ( null === $nbefore ) ? array( null, null ) : $tokens[ $nbefore ];
	569	+ $nvalue = ( -1 !== $define_at && $depth === $define_at && ',' === $nptype );
	570	+
	571	+ $nkeep = $keep_until >= 0
	572	+ || T_DOUBLE_ARROW === $nntype
	573	+ || ( '[' === $nptype && ']' === $nntype && in_array( $nbtoken[0], array( T_VARIABLE, T_STRING, ']', ')', '}' ), true ) )
	574	+ || ( strlen( $text ) <= 1 && ! $nvalue );
	575	+
	576	+ /*
	577	+ * Except when that same number is a value actually in force. The
	578	+ * positions kept above are kept because a credential does not live
	579	+ * in them, which is true, but it says nothing about the number
	580	+ * itself: with
	581	+ * define( 'SERVICE_TOKEN', 12345678 );
	582	+ * $a = $config[12345678];
	583	+ * the value was redacted in the define and kept in the index, so it
	584	+ * survived, and the output check below did what it is there for and
	585	+ * threw the whole copy away. No leak, but the diff of that
	586	+ * wp-config.php was lost for good, which is the regression 2.11.8
	587	+ * fixed, coming back through the numbers added in 2.11.10. Found by
	588	+ * the third cross review.
	589	+ *
	590	+ * Strings are deliberately NOT treated this way: there, a value in
	591	+ * force sitting in a kept position (an include path, an array key)
	592	+ * can BE the secret, and losing the diff is the right answer. It is
	593	+ * what poc/wpconfig-baseline-secretos.sh checks and it stays.
	594	+ */
	595	+ if ( $nkeep && in_array( $text, $live_values, true ) ) {
	596	+ $nkeep = false;
	597	+ }
	598	+
	599	+ $out .= $nkeep ? $text : $marker;
	600	+ continue;
	601	+ }
	602	+
	603	+ if ( 'string' !== $type ) {
	604	+ $out .= $text;
	605	+ continue;
	606	+ }
	607	+
	608	+ $prev = self::significant_token( $tokens, $i, -1 );
	609	+ $next = self::significant_token( $tokens, $i, 1 );
	610	+ $ptype = ( null === $prev ) ? null : $tokens[ $prev ][0];
	611	+ $ntype = ( null === $next ) ? null : $tokens[ $next ][0];
	612	+ $call = ( '(' === $ptype ) ? self::significant_token( $tokens, $prev, -1 ) : null;
	613	+ $inner = $plain ? substr( $text, 1, -1 ) : null;
	614	+
	615	+ if ( $plain && null !== $call && in_array( $tokens[ $call ][0], $names, true ) ) {
	616	+ $function = strtolower( ltrim( $tokens[ $call ][1], '\\' ) );
	617	+
	618	+ if ( in_array( $function, array( 'define', 'defined', 'constant', 'getenv' ), true ) ) {
	619	+ if ( 'define' === $function ) {
	620	+ $define_at = $depth;
	621	+
	622	+ if ( in_array( $inner, self::$readable_constants, true ) ) {
	623	+ $keep_until = $depth;
	624	+ }
	625	+ }
	626	+ $out .= $text;
	627	+ continue;
	628	+ }
	629	+
	630	+ if ( 'putenv' === $function && false !== strpos( $inner, '=' ) ) {
	631	+ $out .= "'" . substr( $inner, 0, strpos( $inner, '=' ) + 1 ) . self::REDACTED_MARKER . "'";
	632	+ continue;
	633	+ }
	634	+ }
	635	+
	636	+ // The token before an opening bracket or an assignment, when there is one.
	637	+ $before = ( '[' === $ptype || '=' === $ptype ) ? self::significant_token( $tokens, $prev, -1 ) : null;
	638	+ $btoken = ( null === $before ) ? array( null, null ) : $tokens[ $before ];
	639	+
	640	+ /*
	641	+ * The value of a define() is redacted whatever its length, as it was
	642	+ * up to 2.11.7, so an empty password reads the same in a copy stored
	643	+ * then as in today's; the first version of this kept strings of one
	644	+ * character there and a file awaiting review showed credential lines
	645	+ * nobody had touched (cross review of 2.11.8).
	646	+ */
	647	+ $is_define_value = ( -1 !== $define_at && $depth === $define_at && ',' === $ptype );
	648	+ $is_path = $in_include && $plain
	649	+ && preg_match( '#^[A-Za-z0-9_./\-]+$#', (string) $inner )
	650	+ && ( false !== strpos( (string) $inner, '/' ) || '.php' === substr( (string) $inner, -4 ) );
	651	+
	652	+ $keep = ( $plain && strlen( $inner ) <= 1 && ! $is_define_value )
	653	+ || T_DOUBLE_ARROW === $ntype
	654	+ || ( '[' === $ptype && ']' === $ntype && in_array( $btoken[0], array( T_VARIABLE, T_STRING, ']', ')', '}' ), true ) )
	655	+ || $keep_until >= 0
	656	+ || $is_path
	657	+ || ( '=' === $ptype && ';' === $ntype && T_VARIABLE === $btoken[0] && '$table_prefix' === $btoken[1] );
	658	+
	659	+ $out .= $keep ? $text : $marker;
	660	+ }
	661	+
	662	+ return $out;
	663	+ }
	664	+
	665	+ /**
	666	+ * PHP tokens with every string folded into a single token
	667	+ *
	668	+ * The tokenizer splits a string with variables inside, a heredoc and a
	669	+ * backtick command into several tokens. For the redaction each of them is
	670	+ * one value, so they come back as a single token of type 'string'. The
	671	+ * third field says whether it is a plain quoted literal.
	672	+ *
	673	+ * @since 2.11.8
	674	+ *
	675	+ * @param array $raw Output of token_get_all().
	676	+ * @return array List of array( type, text, plain ).
	677	+ */
	678	+ private static function merged_tokens( $raw ) {
	679	+ $tokens = array();
	680	+ $count = count( $raw );
	681	+
	682	+ for ( $i = 0; $i < $count; $i++ ) {
	683	+ $token = $raw[ $i ];
	684	+
	685	+ if ( '"' === $token || '`' === $token ) {
	686	+ $text = $token;
	687	+ for ( $i++; $i < $count; $i++ ) {
	688	+ $text .= is_array( $raw[ $i ] ) ? $raw[ $i ][1] : $raw[ $i ];
	689	+ if ( $raw[ $i ] === $token ) {
	690	+ break;
	691	+ }
	692	+ }
	693	+ $tokens[] = array( 'string', $text, false );
	694	+ continue;
	695	+ }
	696	+
	697	+ if ( is_array( $token ) && T_START_HEREDOC === $token[0] ) {
	698	+ $text = $token[1];
	699	+ for ( $i++; $i < $count; $i++ ) {
	700	+ $text .= is_array( $raw[ $i ] ) ? $raw[ $i ][1] : $raw[ $i ];
	701	+ if ( is_array( $raw[ $i ] ) && T_END_HEREDOC === $raw[ $i ][0] ) {
	702	+ break;
	703	+ }
	704	+ }
	705	+ $tokens[] = array( 'string', $text, false );
	706	+ continue;
	707	+ }
	708	+
	709	+ // An unterminated string comes back as T_ENCAPSED_AND_WHITESPACE
	710	+ // on its own, and it is a value like any other.
	711	+ if ( is_array( $token ) && ( T_CONSTANT_ENCAPSED_STRING === $token[0] || T_ENCAPSED_AND_WHITESPACE === $token[0] ) ) {
	712	+ $tokens[] = array( 'string', $token[1], T_CONSTANT_ENCAPSED_STRING === $token[0] );
	713	+ continue;
	714	+ }
	715	+
	716	+ $tokens[] = is_array( $token ) ? array( $token[0], $token[1], false ) : array( $token, $token, false );
	717	+ }
	718	+
	719	+ return $tokens;
	720	+ }
	721	+
	722	+ /**
	723	+ * Index of the nearest token that is not whitespace or a comment
	724	+ *
	725	+ * @since 2.11.8
	726	+ *
	727	+ * @param array $tokens Output of merged_tokens().
	728	+ * @param int $from Index to start from, not included.
	729	+ * @param int $step -1 to look back, 1 to look ahead.
	730	+ * @return int|null
	731	+ */
	732	+ private static function significant_token( $tokens, $from, $step ) {
	733	+ $count = count( $tokens );
	734	+
	735	+ for ( $i = $from + $step; $i >= 0 && $i < $count; $i += $step ) {
	736	+ if ( ! in_array( $tokens[ $i ][0], array( T_WHITESPACE, T_COMMENT, T_DOC_COMMENT ), true ) ) {
	737	+ return $i;
	738	+ }
	739	+ }
	740	+
	741	+ return null;
	742	+ }
	743	+
	744	+ /**
	745	+ * Redact a comment, keeping its plain words
	746	+ *
	747	+ * To the tokenizer a comment is text, and wp-config.php files keep old
	748	+ * credentials in them, commented out or in a note. The first version of
	749	+ * this, in the same release, redacted what was between quotes: an
	750	+ * apostrophe in prose ("Don't use 'the-old-password'") paired with the
	751	+ * opening quote of the secret and left it out, and a secret without quotes
	752	+ * was never touched. Found by the cross review of 2.11.8.
	753	+ *
	754	+ * So it works the other way round. A comment keeps its plain words
	755	+ * (lowercase, capitalised or uppercase letters, or two capitalised parts
	756	+ * such as WordPress, and docblock tags), constant names, and anything
	757	+ * shorter than eight characters; every other run of characters, a URL, a
	758	+ * key, a password with a digit in it, becomes the marker. The value of a
	759	+ * commented-out define() goes in single quotes whatever its length, as in
	760	+ * code and as 2.11.2 to 2.11.7 wrote it, so a copy stored by those
	761	+ * versions reads the same line for line. What this cannot tell from prose
	762	+ * is a password made only of plain letters; the output check still
	763	+ * catches it when it is a value in force.
	764	+ *
	765	+ * @since 2.11.8
	766	+ *
	767	+ * @param string $comment Comment token text.
397	768	* @return string
398	769	*/
399		- private function redact_secrets( $content ) {
400		- $names = implode( '|', array_map( 'preg_quote', self::$secret_constants ) );
	770	+ private function redact_comment( $comment ) {
	771	+ $marker = self::REDACTED_MARKER;
	772	+ $readable = self::$readable_constants;
401	773
	774	+ // Only the text between the delimiters is redacted: "/**#@-*/" in
	775	+ // wp-config-sample.php is a single run of eight characters, and
	776	+ // replacing it whole took the comment markers with it.
	777	+ if ( ! preg_match( '#\A(/\*\*?|//|\#)(.*?)(\*/)?\z#s', $comment, $parts ) ) {
	778	+ $parts = array( $comment, '', $comment );
	779	+ }
	780	+
	781	+ $open = $parts[1];
	782	+ $close = isset( $parts[3] ) ? $parts[3] : '';
	783	+ $comment = preg_replace_callback(
	784	+ '/(\bdefine\s*\(\s*([\'"])((?:\\\\.|(?!\2).)*)\2\s*,\s*)([\'"])((?:\\\\.|(?!\4).)*)\4/i',
	785	+ function ( $match ) use ( $marker, $readable ) {
	786	+ return in_array( $match[3], $readable, true ) ? $match[0] : $match[1] . "'" . $marker . "'";
	787	+ },
	788	+ $parts[2]
	789	+ );
	790	+
	791	+ if ( null === $comment ) {
	792	+ return '';
	793	+ }
	794	+
	795	+ $redacted = preg_replace_callback(
	796	+ '/[^\s\'"`(),;\[\]{}<>=]+/u',
	797	+ function ( $match ) use ( $marker ) {
	798	+ $word = $match[0];
	799	+ $core = rtrim( $word, '.:!?' );
	800	+
	801	+ // Plain words only, without hyphens: a passphrase written as
	802	+ // lowercase words joined by hyphens reads as prose otherwise, and
	803	+ // the PoC of this very fix caught one surviving.
	804	+ if ( strlen( $core ) < 8
	805	+ || preg_match( '/^@?(?:\p{Lu}?\p{Ll}+|\p{Lu}+)$/u', $core )
	806	+ || preg_match( '/^\p{Lu}\p{Ll}+\p{Lu}\p{Ll}+$/u', $core )
	807	+ || preg_match( '/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/', $core )
	808	+ ) {
	809	+ return $word;
	810	+ }
	811	+
	812	+ return $marker . substr( $word, strlen( $core ) );
	813	+ },
	814	+ $comment
	815	+ );
	816	+
	817	+ // A failed replacement, on invalid UTF-8 for one, drops the comment
	818	+ // rather than keep it whole.
	819	+ return ( null === $redacted ) ? '' : $open . $redacted . $close;
	820	+ }
	821	+
	822	+ /**
	823	+ * Values in force of what a wp-config.php names
	824	+ *
	825	+ * Every user constant whose name appears in the file, the twelve of
	826	+ * WordPress wherever they were defined, and the environment variables the
	827	+ * file reads or sets. Arrays are walked to their leaves, since define()
	828	+ * takes arrays. Strings and numbers both: the first version of this counted
	829	+ * numbers and wiped the diff of any file with a large number in force (cross
	830	+ * review of 2.11.8), so they were dropped, and 2.11.10 had to bring them
	831	+ * back because a credential written as a number, which the wp.org review of
	832	+ * 2.11.9 reported, is exactly what this check has to be able to see. The
	833	+ * eight character floor is what keeps the old problem away. The readable
	834	+ * constants are left out, and so is anything shorter than that.
	835	+ *
	836	+ * @since 2.11.8
	837	+ *
	838	+ * @param string $content Normalized wp-config.php content.
	839	+ * @return string[]
	840	+ */
	841	+ private function values_in_force( $content ) {
	842	+ $defined = get_defined_constants( true );
	843	+ $user = isset( $defined['user'] ) ? $defined['user'] : array();
	844	+ $names = self::$secret_constants;
	845	+ $values = array();
	846	+
	847	+ if ( preg_match_all( '/[A-Za-z_][A-Za-z0-9_]*/', (string) $content, $words ) ) {
	848	+ $names = array_merge( $names, $words[0] );
	849	+ }
	850	+
	851	+ foreach ( array_unique( $names ) as $name ) {
	852	+ if ( array_key_exists( $name, $user ) && ! in_array( $name, self::$readable_constants, true ) ) {
	853	+ $values = array_merge( $values, self::string_leaves( $user[ $name ] ) );
	854	+ }
	855	+ }
	856	+
	857	+ if ( preg_match_all( '/\b(?:getenv|putenv)\s*\(\s*[\'"]([A-Za-z_][A-Za-z0-9_]*)|\$_ENV\s*\[\s*[\'"]([A-Za-z_][A-Za-z0-9_]*)/', (string) $content, $env ) ) {
	858	+ foreach ( array_filter( array_merge( $env[1], $env[2] ) ) as $name ) {
	859	+ $value = getenv( $name );
	860	+
	861	+ if ( is_string( $value ) ) {
	862	+ $values[] = $value;
	863	+ }
	864	+ }
	865	+ }
	866	+
	867	+ $long = array();
	868	+
	869	+ foreach ( $values as $value ) {
	870	+ if ( strlen( $value ) >= 8 ) {
	871	+ $long[ $value ] = $value;
	872	+ }
	873	+ }
	874	+
	875	+ return array_values( $long );
	876	+ }
	877	+
	878	+ /**
	879	+ * Every string inside a constant value
	880	+ *
	881	+ * @since 2.11.8
	882	+ *
	883	+ * @param mixed $value Constant value.
	884	+ * @return string[]
	885	+ */
	886	+ private static function string_leaves( $value ) {
	887	+ if ( is_array( $value ) ) {
	888	+ $leaves = array();
	889	+
	890	+ foreach ( $value as $item ) {
	891	+ $leaves = array_merge( $leaves, self::string_leaves( $item ) );
	892	+ }
	893	+
	894	+ return $leaves;
	895	+ }
	896	+
	897	+ if ( is_string( $value ) ) {
	898	+ return array( $value );
	899	+ }
	900	+
402	901	/*
403		- * define( 'NAME', 'value' ), matching the quoted literal itself rather
404		- * than reading up to the closing parenthesis.
405		- *
406		- * The first version of this stopped at the first ';', which looked
407		- * reasonable and failed on the very first real file it saw: the salts
408		- * WordPress generates are full of punctuation and a ';' inside one cut
409		- * the match short, so nothing was redacted. Backreference 3 is the
410		- * opening quote and the value runs to its unescaped twin. No /s
411		- * modifier on purpose, so a file with an unterminated string breaks
412		- * one line instead of swallowing the rest of the file.
	902	+ * A number is a value too. Until 2.11.10 this returned nothing for one,
	903	+ * so the output check had no way to see a credential written as
	904	+ * define( 'SERVICE_TOKEN', 12345678 ) and the redaction was left without
	905	+ * its safety net there. Booleans and null stay out on purpose: as text
	906	+ * they are '1' and '', which would match half the file.
413	907	*/
414		- $pattern = '/(define\s*\(\s*([\'"])(?:' . $names . '|[A-Z0-9_]*(?:KEY|SALT|SECRET|PASSWORD|PASSWD|TOKEN|API)[A-Z0-9_]*)\2\s*,\s*)([\'"])(?:\\\\.|(?!\3).)*\3/i';
	908	+ return ( is_int( $value ) || is_float( $value ) ) ? array( (string) $value ) : array();
	909	+ }
415	910
416		- $redacted = preg_replace( $pattern, '${1}\'' . self::REDACTED_MARKER . '\'', $content );
	911	+ /**
	912	+ * Values in force of the readable constants, the ones kept in the copy
	913	+ *
	914	+ * @since 2.11.8
	915	+ *
	916	+ * @return string[]
	917	+ */
	918	+ private function readable_values_in_force() {
	919	+ $values = array();
417	920
418		- // A failed preg_replace returns null, and storing null would wipe the
419		- // baseline copy silently. Falling back to the original is not an
420		- // option either, so the caller's guard turns this into "no content".
	921	+ foreach ( self::$readable_constants as $name ) {
	922	+ if ( defined( $name ) ) {
	923	+ $values = array_merge( $values, self::string_leaves( constant( $name ) ) );
	924	+ }
	925	+ }
	926	+
	927	+ return $values;
	928	+ }
	929	+
	930	+ /**
	931	+ * Replace the values a root .htaccess can carry as credentials
	932	+ *
	933	+ * The .htaccess is not a secrets file, but it can hold a few: an
	934	+ * environment variable handed to PHP with SetEnv, an Authorization header
	935	+ * set for a backend, or a php_value with a password, a key, a licence or a
	936	+ * session store address with its auth in it. The directive and its name
	937	+ * stay, the value goes. Line based, which is how Apache reads it too. Since
	938	+ * the cross review of 2.11.8 also any request or response header whose name
	939	+ * reads like a credential (X-Api-Key, a cookie, a signature) and a
	940	+ * RewriteCond that compares against key=, token= or the like, the way a
	941	+ * staging site is opened with a secret in the query string. What it cannot
	942	+ * see is a credential written in any other shape.
	943	+ *
	944	+ * @since 2.11.8
	945	+ *
	946	+ * @param string $content Normalized .htaccess content.
	947	+ * @return string
	948	+ */
	949	+ private function redact_server_secrets( $content ) {
	950	+ $redacted = preg_replace(
	951	+ array(
	952	+ '/^([ \t]*SetEnv[ \t]+\S+[ \t]+)\S.*$/mi',
	953	+ '/^([ \t]*(?:RequestHeader|Header)[ \t]+(?:always[ \t]+)?\S+[ \t]+[\w-]*(?:auth|key|token|secret|pass|cookie|sig)[\w-]*[ \t]+)\S.*$/mi',
	954	+ '/^([ \t]*php_(?:admin_)?value[ \t]+\S*(?:pass|pw|secret|key|token|licen|auth|save_path)\S*[ \t]+)\S.*$/mi',
	955	+ '/^([ \t]*RewriteCond[ \t]+\S+[ \t]+)\S*(?:key|token|secret|pass|auth|sig)[\w-]*=\S*/mi',
	956	+ ),
	957	+ '${1}' . self::REDACTED_MARKER,
	958	+ (string) $content
	959	+ );
	960	+
421	961	return ( null === $redacted ) ? '' : $redacted;
422	962	}
423	963
424	964	/**
		@@ -617,8 +1157,150 @@
617	1157	}
618	1158	}
619	1159
620	1160	/**
	1161	+ * Network option recording the version whose results cleanup walked the network
	1162	+ *
	1163	+ * @since 2.11.8
	1164	+ */
	1165	+ const RESULTS_SWEEP_OPTION = 'vigilante_results_sweep';
	1166	+
	1167	+ /**
	1168	+ * Clean the stored scan results of every site of the network, once per version
	1169	+ *
	1170	+ * redact_stored_results() runs per site from admin_init and from the scan,
	1171	+ * so a subsite with the module off whose dashboard nobody opens kept the
	1172	+ * lines of wp-config.php its last scan stored, with whatever that version
	1173	+ * failed to redact. Same gap 2.11.3 and 2.11.4 closed for the baseline copy;
	1174	+ * found for the results by the cross review of 2.11.8. It runs from the
	1175	+ * network sweep, for a network administrator on the main site, and has its
	1176	+ * own marker because the baseline sweep is already done on every network
	1177	+ * that updated through 2.11.4.
	1178	+ *
	1179	+ * @since 2.11.8
	1180	+ */
	1181	+ private function maybe_sweep_network_results() {
	1182	+ if ( VIGILANTE_VERSION === get_site_option( self::RESULTS_SWEEP_OPTION ) ) {
	1183	+ return;
	1184	+ }
	1185	+
	1186	+ update_site_option( self::RESULTS_SWEEP_OPTION, VIGILANTE_VERSION );
	1187	+
	1188	+ $site_ids = get_sites(
	1189	+ array(
	1190	+ 'fields' => 'ids',
	1191	+ 'number' => 0,
	1192	+ 'network_id' => get_current_network_id(),
	1193	+ 'update_site_meta_cache' => false,
	1194	+ )
	1195	+ );
	1196	+
	1197	+ foreach ( $site_ids as $site_id ) {
	1198	+ switch_to_blog( $site_id );
	1199	+ $this->redact_stored_results();
	1200	+ restore_current_blog();
	1201	+ }
	1202	+ }
	1203	+
	1204	+ /**
	1205	+ * The diff of a shared file as a site that does not own it gets it
	1206	+ *
	1207	+ * No lines, and a flag the screens read to say where the lines are.
	1208	+ *
	1209	+ * @since 2.11.8
	1210	+ *
	1211	+ * @return array
	1212	+ */
	1213	+ public static function network_only_diff() {
	1214	+ return array(
	1215	+ 'added' => array(),
	1216	+ 'removed' => array(),
	1217	+ 'unavailable' => true,
	1218	+ 'network' => true,
	1219	+ );
	1220	+ }
	1221	+
	1222	+ /**
	1223	+ * Take out of the last stored scan what the baseline copy no longer keeps
	1224	+ *
	1225	+ * The results of the last scan are an option of each site, and the diff of
	1226	+ * a critical file travels inside them line by line, redacted the way the
	1227	+ * version that ran the scan redacted. Until 2.11.7 that let FTP_PASS and
	1228	+ * friends through, and on a network every subsite with the module on kept
	1229	+ * its own copy of the lines. This runs once per version with the rest of
	1230	+ * the cleanup:
	1231	+ *
	1232	+ * - Where the shared files do not belong to this site, no line is kept.
	1233	+ * - Lines of wp-config.php are dropped. A single line cannot be read as
	1234	+ * PHP reliably (half a heredoc is just words), and the next scan rebuilds
	1235	+ * them from the whole file.
	1236	+ * - Lines of .htaccess are directives, one per line, and are redacted in
	1237	+ * place.
	1238	+ *
	1239	+ * @since 2.11.8
	1240	+ */
	1241	+ private function redact_stored_results() {
	1242	+ $results = get_option( 'vigilante_last_integrity_results' );
	1243	+
	1244	+ if ( ! is_array( $results ) || empty( $results['modified'] ) || ! is_array( $results['modified'] ) ) {
	1245	+ return;
	1246	+ }
	1247	+
	1248	+ $owns = Vigilante_Settings::owns_shared_files();
	1249	+ $changed = false;
	1250	+
	1251	+ foreach ( $results['modified'] as $index => $item ) {
	1252	+ if ( ! is_array( $item ) || 'critical_config' !== ( $item['type'] ?? '' ) || ! isset( $item['diff'] ) || ! is_array( $item['diff'] ) ) {
	1253	+ continue;
	1254	+ }
	1255	+
	1256	+ if ( ! $owns ) {
	1257	+ if ( empty( $item['diff']['network'] ) ) {
	1258	+ $results['modified'][ $index ]['diff'] = self::network_only_diff();
	1259	+ $changed = true;
	1260	+ }
	1261	+ continue;
	1262	+ }
	1263	+
	1264	+ if ( 'wp-config.php' === ( $item['file'] ?? '' ) ) {
	1265	+ if ( ! empty( $item['diff']['added'] ) || ! empty( $item['diff']['removed'] ) ) {
	1266	+ $results['modified'][ $index ]['diff'] = array(
	1267	+ 'added' => array(),
	1268	+ 'removed' => array(),
	1269	+ 'unavailable' => true,
	1270	+ 'rescan' => true,
	1271	+ );
	1272	+ $changed = true;
	1273	+ }
	1274	+ continue;
	1275	+ }
	1276	+
	1277	+ foreach ( array( 'added', 'removed' ) as $side ) {
	1278	+ if ( empty( $item['diff'][ $side ] ) || ! is_array( $item['diff'][ $side ] ) ) {
	1279	+ continue;
	1280	+ }
	1281	+
	1282	+ foreach ( $item['diff'][ $side ] as $line_index => $line ) {
	1283	+ if ( ! is_array( $line ) || ! isset( $line['content'] ) || ! is_string( $line['content'] ) ) {
	1284	+ continue;
	1285	+ }
	1286	+
	1287	+ $safe = $this->redact_server_secrets( $line['content'] );
	1288	+
	1289	+ if ( $safe !== $line['content'] ) {
	1290	+ $results['modified'][ $index ]['diff'][ $side ][ $line_index ]['content'] = $safe;
	1291	+ $changed = true;
	1292	+ }
	1293	+ }
	1294	+ }
	1295	+ }
	1296	+
	1297	+ if ( $changed ) {
	1298	+ update_option( 'vigilante_last_integrity_results', $results );
	1299	+ }
	1300	+ }
	1301	+
	1302	+ /**
621	1303	* Clean up what earlier versions stored, wherever they stored it
622	1304	*
623	1305	* Two jobs, and the second one only exists on a network.
624	1306	*
		@@ -695,8 +1377,10 @@
695	1377	$this->write_baseline( $baseline );
696	1378	}
697	1379	}
698	1380
	1381	+ $this->redact_stored_results();
	1382	+
699	1383	/*
700	1384	* The gate does not close while a per-site copy is still waiting to be
701	1385	* promoted. Closing it would end the retries for a whole version: the
702	1386	* copy would sit there unread, the file it records would be missing
		@@ -750,8 +1434,10 @@
750	1434	if ( ! current_user_can( 'manage_network_options' ) ) {
751	1435	return;
752	1436	}
753	1437
	1438	+ $this->maybe_sweep_network_results();
	1439	+
754	1440	$marker = get_site_option( self::BASELINE_SWEEP_OPTION );
755	1441
756	1442	/*
757	1443	* Two markers, because there are two different things to remember and
		@@ -1012,9 +1698,9 @@
1012	1698	*/
1013	1699	public function init_cleanup_hooks() {
1014	1700	add_action( 'admin_init', array( $this, 'maybe_redact_stored_baseline' ) );
1015	1701	add_action( 'admin_init', array( $this, 'maybe_sweep_network_baselines' ) );
1016		- add_action( 'admin_init', array( $this, 'maybe_claim_owned_blocks' ) );
	1702	+ add_action( 'admin_init', array( $this, 'maybe_claim_owned_blocks_on_admin' ) );
1017	1703	}
1018	1704
1019	1705	/**
1020	1706	* Check if scan time limit has been exceeded
		@@ -1085,8 +1771,16 @@
1085	1771	$files = array( $hook_extra['plugin'] );
1086	1772	}
1087	1773	foreach ( $files as $file ) {
1088	1774	$slug = dirname( (string) $file );
	1775	+ // Vigilant itself is verified immediately (not after 90 s) by
	1776	+ // Vigilante_Self_Integrity::handle_upgrader() when the
	1777	+ // self-check is on; do not also open a grace window for it.
	1778	+ // Compared with the folder it really lives in, not the literal
	1779	+ // slug, so a renamed folder is skipped the same way.
	1780	+ if ( dirname( VIGILANTE_PLUGIN_BASENAME ) === $slug && Vigilante_Self_Integrity::is_on() ) {
	1781	+ continue;
	1782	+ }
1089	1783	if ( '.' !== $slug && '' !== $slug ) {
1090	1784	$targets['plugin'][] = $slug;
1091	1785	}
1092	1786	}
		@@ -1155,8 +1849,17 @@
1155	1849	*/
1156	1850	private function verify_updated_slug( $type, $slug ) {
1157	1851	$grace_key = 'vigilante_fi_grace_' . $type . '_' . md5( $slug );
1158	1852
	1853	+ // Defensive skip for the first 2.11.x -> 3.0.x update: the OLD code in
	1854	+ // memory scheduled this event including Vigilant's own slug, and by the
	1855	+ // time it fires the NEW code (this one) is running with the self-check
	1856	+ // handling Vigilant on its own.
	1857	+ if ( 'plugin' === $type && dirname( VIGILANTE_PLUGIN_BASENAME ) === $slug && Vigilante_Self_Integrity::is_on() ) {
	1858	+ delete_transient( $grace_key );
	1859	+ return;
	1860	+ }
	1861	+
1159	1862	if ( 'plugin' === $type ) {
1160	1863	if ( ! function_exists( 'get_plugins' ) ) {
1161	1864	require_once ABSPATH . 'wp-admin/includes/plugin.php';
1162	1865	}
		@@ -1307,8 +2010,41 @@
1307	2010
1308	2011	// Use settings from options page
1309	2012	$options = is_array( $this->options ) ? $this->options : array();
1310	2013
	2014	+ // Vigilant self-check runs FIRST and exempt from the time budget:
	2015	+ // ~60 small-file hashes cost < 50 ms and the guardian must never be
	2016	+ // dropped by the budget on plugin-heavy sites. User exclusions do not
	2017	+ // apply to it (see Vigilante_Self_Integrity::run_check()).
	2018	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	2019	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	2020	+ }
	2021	+ if ( Vigilante_Self_Integrity::is_on() ) {
	2022	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	2023	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	2024	+ }
	2025	+ $self = new Vigilante_Self_Integrity( $this->settings, $this->activity_log );
	2026	+ $self_result = $self->run_check( 'scan' );
	2027	+ // run_check() above updates this site's own state (status line and
	2028	+ // the analyzer check keep working everywhere). The plugin files are
	2029	+ // shared by the whole installation, so the self findings are folded
	2030	+ // Self-protection has its own alert, and it does not travel in the
	2031	+ // scan digest any more. That digest is governed by a notification
	2032	+ // setting that can be switched off, and switching off "tell me about
	2033	+ // changed files" was also switching off the alarm of the plugin
	2034	+ // itself. So the findings stay out of the scan results (they have
	2035	+ // their own block in File Integrity, with what each one means and how
	2036	+ // to repair it) and a critical one sends its own email from here,
	2037	+ // wherever the scan runs. maybe_send_self_alert() keeps it to the
	2038	+ // site that owns the shared files and dedupes by set of findings.
	2039	+ foreach ( (array) $self_result['findings'] as $self_finding ) {
	2040	+ if ( 'critical' === ( $self_finding['severity'] ?? '' ) ) {
	2041	+ $self->maybe_send_self_alert( $self_result['findings'], 'scan' );
	2042	+ break;
	2043	+ }
	2044	+ }
	2045	+ }
	2046	+
1311	2047	// Scan uploads for suspicious files FIRST (highest security priority)
1312	2048	// PHP files in uploads are almost always malware
1313	2049	if ( ! empty( $options['scan_uploads'] ) && ! $this->is_time_exceeded() ) {
1314	2050	$upload_results = $this->scan_uploads();
		@@ -1713,8 +2449,51 @@
1713	2449	* silently — there is nothing to compare against.
1714	2450	*
1715	2451	* @return array Array of modified file entries (same format as core modified).
1716	2452	*/
	2453	+ /**
	2454	+ * Where a critical root file actually lives
	2455	+ *
	2456	+ * WordPress supports wp-config.php one directory above ABSPATH, guarded by
	2457	+ * wp-settings.php not being there: that is literally what the installed core
	2458	+ * does in wp-load.php, and it is a common hardening layout. Until 2.11.10
	2459	+ * this module only looked inside ABSPATH, so on those installations
	2460	+ * wp-config.php was never added to the baseline, never compared and never
	2461	+ * mentioned: the module reported the site clean without having opened the
	2462	+ * one file it most needs to watch. A zero is justified, never assumed. The
	2463	+ * plugin already resolved both locations elsewhere
	2464	+ * (Vigilante_Database_Prefix::find_wpconfig_path()), just not here. Found by
	2465	+ * the file-by-file review of 2.11.10.
	2466	+ *
	2467	+ * @since 2.11.10
	2468	+ *
	2469	+ * @param string $filename Name of the file, such as wp-config.php.
	2470	+ * @return string|false Absolute path, or false when it cannot be found.
	2471	+ */
	2472	+ private function critical_file_path( $filename ) {
	2473	+ $root = untrailingslashit( ABSPATH );
	2474	+ $path = $root . '/' . $filename;
	2475	+
	2476	+ if ( file_exists( $path ) ) {
	2477	+ return $path;
	2478	+ }
	2479	+
	2480	+ if ( 'wp-config.php' === $filename ) {
	2481	+ $above = dirname( $root ) . '/wp-config.php';
	2482	+
	2483	+ // Suppressed like the core does in wp-load.php: the directory above
	2484	+ // the install is often outside open_basedir on shared hosting, and
	2485	+ // without the @ every scan emits a warning that can land in front of
	2486	+ // the JSON of an AJAX scan.
	2487	+ // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- The same @ the core uses for this same check in wp-load.php:52, where a wp-config.php one directory up is looked for: open_basedir makes file_exists() warn on a path outside it, and this must not print.
	2488	+ if ( @file_exists( $above ) && ! @file_exists( dirname( $root ) . '/wp-settings.php' ) ) {
	2489	+ return $above;
	2490	+ }
	2491	+ }
	2492	+
	2493	+ return false;
	2494	+ }
	2495	+
1717	2496	private function scan_critical_root_files() {
1718	2497	// Before reading anything: the scan is the only thing that reaches
1719	2498	// every site of a network on its own, through wp-cron and front-end
1720	2499	// traffic. Hooking the cleanup to admin_init alone left every subsite
		@@ -1728,14 +2507,13 @@
1728	2507
1729	2508	$modified = array();
1730	2509	$baseline = $this->get_critical_files_baseline();
1731	2510	$baseline_changed = false;
1732		- $root_path = untrailingslashit( ABSPATH );
1733	2511
1734	2512	foreach ( $this->critical_root_files as $filename ) {
1735		- $full_path = $root_path . '/' . $filename;
	2513	+ $full_path = $this->critical_file_path( $filename );
1736	2514
1737		- if ( ! file_exists( $full_path ) ) {
	2515	+ if ( false === $full_path ) {
1738	2516	continue;
1739	2517	}
1740	2518
1741	2519	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -1797,14 +2575,34 @@
1797	2575	*
1798	2576	* Both sides go through the same redaction, or every credential
1799	2577	* line would read as a change nobody made.
1800	2578	*/
1801		- $baseline_content = $baseline[ $filename ]['content'] ?? '';
1802		- $current_content = $this->baseline_content( $filename, $normalized );
1803		- $diff = ( '' !== $baseline_content && '' !== $current_content )
1804		- ? $this->compute_simple_diff( $baseline_content, $current_content )
1805		- : array( 'added' => array(), 'removed' => array(), 'unavailable' => true );
	2579	+ /*
	2580	+ * Where the shared files do not belong to this site, the lines are
	2581	+ * not computed at all. The diff is shown to whoever can open this
	2582	+ * site's screen, the administrator of a subsite included, and it
	2583	+ * was stored in the options of every subsite with the module on.
	2584	+ * Found by the audit of the admin surface for 2.11.8. The change is
	2585	+ * still reported, with both sizes, and the lines are read on the
	2586	+ * main site, where the change is approved.
	2587	+ */
	2588	+ if ( ! Vigilante_Settings::owns_shared_files() ) {
	2589	+ $diff = self::network_only_diff();
	2590	+ } else {
	2591	+ $baseline_content = $baseline[ $filename ]['content'] ?? '';
	2592	+ $current_content = $this->baseline_content( $filename, $normalized );
	2593	+ $diff = ( '' !== $baseline_content && '' !== $current_content )
	2594	+ ? $this->compute_simple_diff( $baseline_content, $current_content )
	2595	+ : array( 'added' => array(), 'removed' => array(), 'unavailable' => true );
1806	2596
	2597	+ // Say why there are no lines when today's copy could not be
	2598	+ // made safe, which approving does not change: the generic
	2599	+ // message talks about an old baseline. Cross review of 2.11.8.
	2600	+ if ( '' === $current_content && 'wp-config.php' === $filename ) {
	2601	+ $diff['redaction'] = true;
	2602	+ }
	2603	+ }
	2604	+
1807	2605	$modified[] = array(
1808	2606	'file' => $filename,
1809	2607	'type' => 'critical_config',
1810	2608	'expected_hash' => $baseline[ $filename ]['hash'],
		@@ -1992,8 +2790,222 @@
1992	2790	*
1993	2791	* @param string $line One line of wp-config.php.
1994	2792	* @return bool
1995	2793	*/
	2794	+ /**
	2795	+ * Whether every marked line of a file can run nothing at all
	2796	+ *
	2797	+ * The question the re-base has to answer before adopting a file is whether
	2798	+ * the lines that carry the marker are only comments. Asking a stricter one
	2799	+ * was wrong in both directions: the first version of the guard used
	2800	+ * is_vigilant_original_line(), which also requires the commented define to
	2801	+ * match a known harmless shape, so it refused to re-base a perfectly inert
	2802	+ * line carrying an unusual define, which is exactly the case the re-base
	2803	+ * exists for, leaving the function unable to act at all. Found by the cross
	2804	+ * review of 2.11.10.
	2805	+ *
	2806	+ * The second version read one line at a time and reasoned that the marker
	2807	+ * begins with //, so a line with nothing but whitespace before it is wholly
	2808	+ * a comment. That is true only where PHP is already reading code, and the
	2809	+ * second cross review of 2.11.10 built three files where it is not, all of
	2810	+ * them valid PHP, all of them passing that test and all of them running or
	2811	+ * printing something:
	2812	+ *
	2813	+ * - the marked line placed BEFORE the opening <?php, so it is inline HTML
	2814	+ * that the server prints verbatim to the browser;
	2815	+ * - the same after a ?> that the file already had;
	2816	+ * - the marked line ending a block comment opened on an earlier line and
	2817	+ * opening another one at its end, with a statement in between, which
	2818	+ * runs like any other statement.
	2819	+ *
	2820	+ * So the file is read the way PHP reads it, not the way the line looks. A
	2821	+ * marked line is inert when every token touching it is a comment or
	2822	+ * whitespace, which answers the three at once: inline HTML is not a comment,
	2823	+ * and neither is a statement. The shape the guard was written for, code
	2824	+ * BEFORE the marker, is the same question from the other side.
	2825	+ *
	2826	+ * The three shapes are in the harness as cells X2, X3 and X4 of
	2827	+ * matriz-escondite-marcadores.sh, written out in full there. They are not
	2828	+ * written out here on purpose: a literal payload in a shipped file is
	2829	+ * signature surface for the scanners this plugin is read by, and a comment
	2830	+ * is a bad place to pay for it.
	2831	+ *
	2832	+ * @since 2.11.10
	2833	+ *
	2834	+ * @param string $content Whole file content.
	2835	+ * @return bool True when no marked line can run or print anything.
	2836	+ */
	2837	+ /**
	2838	+ * The lines of a file that carry the original-value marker
	2839	+ *
	2840	+ * @since 2.11.10
	2841	+ *
	2842	+ * @param string $content Whole file content, newlines already normalised.
	2843	+ * @return string[]
	2844	+ */
	2845	+ private function marked_lines_of( $content ) {
	2846	+ $out = array();
	2847	+
	2848	+ foreach ( explode( "\n", $content ) as $text ) {
	2849	+ if ( false !== strpos( $text, $this->wpconfig_original_marker ) ) {
	2850	+ $out[] = $text;
	2851	+ }
	2852	+ }
	2853	+
	2854	+ return $out;
	2855	+ }
	2856	+
	2857	+ /**
	2858	+ * Whether what a marked line carries would still be harmless uncommented
	2859	+ *
	2860	+ * Only the part after the marker matters: what comes before it is answered by
	2861	+ * the token pass, which refuses anything that is not comment or whitespace.
	2862	+ * Here the question is what comes BACK when uncomment_original_constants()
	2863	+ * removes the marker, so the body has to be a single define() and nothing
	2864	+ * else, with at most a trailing line comment. Deliberately says nothing about
	2865	+ * WHICH constant it is: asking that was the first version of this guard, and
	2866	+ * it refused every define it did not recognise, which is exactly the case the
	2867	+ * re-base exists for.
	2868	+ *
	2869	+ * @since 2.11.10
	2870	+ *
	2871	+ * @param string $line One line carrying the marker.
	2872	+ * @return bool
	2873	+ */
	2874	+ private function marked_line_body_is_harmless( $line ) {
	2875	+ $at = strpos( $line, $this->wpconfig_original_marker );
	2876	+
	2877	+ if ( false === $at ) {
	2878	+ return true;
	2879	+ }
	2880	+
	2881	+ $body = trim( substr( $line, $at + strlen( $this->wpconfig_original_marker ) ) );
	2882	+
	2883	+ if ( '' === $body ) {
	2884	+ return true;
	2885	+ }
	2886	+
	2887	+ // Tokenised as PHP so the trailing comment, the strings and the nesting
	2888	+ // are read the way PHP reads them and not with a regular expression.
	2889	+ $tokens = @token_get_all( '<?php ' . $body ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- A marked line can carry anything; a warning here must not be printed, and an unreadable body is refused below.
	2890	+
	2891	+ if ( empty( $tokens ) ) {
	2892	+ return false;
	2893	+ }
	2894	+
	2895	+ $statements = 0;
	2896	+ $depth = 0;
	2897	+
	2898	+ foreach ( $tokens as $token ) {
	2899	+ $type = is_array( $token ) ? $token[0] : $token;
	2900	+
	2901	+ if ( in_array( $type, array( T_OPEN_TAG, T_WHITESPACE, T_COMMENT, T_DOC_COMMENT ), true ) ) {
	2902	+ continue;
	2903	+ }
	2904	+
	2905	+ if ( '(' === $type ) {
	2906	+ $depth++;
	2907	+ continue;
	2908	+ }
	2909	+
	2910	+ if ( ')' === $type ) {
	2911	+ $depth--;
	2912	+ continue;
	2913	+ }
	2914	+
	2915	+ // A semicolon at the top level closes a statement. More than one, or
	2916	+ // anything after the first, means the line carries something else.
	2917	+ if ( ';' === $type && 0 === $depth ) {
	2918	+ $statements++;
	2919	+ continue;
	2920	+ }
	2921	+
	2922	+ if ( $statements > 0 ) {
	2923	+ return false;
	2924	+ }
	2925	+ }
	2926	+
	2927	+ return ( $statements <= 1 );
	2928	+ }
	2929	+
	2930	+ private function marked_lines_are_inert( $content ) {
	2931	+ $content = str_replace( "\r\n", "\n", (string) $content );
	2932	+ $marker = $this->wpconfig_original_marker;
	2933	+
	2934	+ if ( '' === $content || false === strpos( $content, $marker ) ) {
	2935	+ return true;
	2936	+ }
	2937	+
	2938	+ $marked = array();
	2939	+
	2940	+ foreach ( explode( "\n", $content ) as $index => $text ) {
	2941	+ if ( false !== strpos( $text, $marker ) ) {
	2942	+ $marked[ $index + 1 ] = true;
	2943	+ }
	2944	+ }
	2945	+
	2946	+ // Lenient on purpose (no TOKEN_PARSE): a tampered file still has to be
	2947	+ // read, and a file that cannot be tokenised is never adopted.
	2948	+ // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- The file read here may have been tampered with, which is the whole point, and PHP 8 emits a warning when it cannot tokenise: printing it would put a parse error on whatever page ran the scan. An unreadable file is refused four lines below.
	2949	+ $tokens = @token_get_all( $content );
	2950	+
	2951	+ if ( empty( $tokens ) ) {
	2952	+ return false;
	2953	+ }
	2954	+
	2955	+ /*
	2956	+ * And the other half of the question, which the first token version left
	2957	+ * out: a marked line is a COMMENTED OUT value, and uncommenting it is what
	2958	+ * the feature exists for, so "runs nothing today" is not enough. Anything
	2959	+ * sharing the line after the define comes back with it. The shape is real
	2960	+ * and needs no attacker: comment_existing_constants() takes a define and
	2961	+ * everything on its line, so
	2962	+ * define( 'WP_DEBUG', false ); @ini_set( 'display_errors', 0 );
	2963	+ * is commented whole, and re-basing it would adopt as approved something
	2964	+ * that runs the moment the value is restored. The old rule refused this
	2965	+ * too, but along with every define whose NAME it did not recognise, which
	2966	+ * is what left the function unable to act at all. Found by the third cross
	2967	+ * review of 2.11.10.
	2968	+ */
	2969	+ foreach ( $this->marked_lines_of( $content ) as $text ) {
	2970	+ if ( ! $this->marked_line_body_is_harmless( $text ) ) {
	2971	+ return false;
	2972	+ }
	2973	+ }
	2974	+
	2975	+ $inocuos = array( T_COMMENT, T_DOC_COMMENT, T_WHITESPACE );
	2976	+ $linea = 1;
	2977	+
	2978	+ foreach ( $tokens as $token ) {
	2979	+ $texto = is_array( $token ) ? $token[1] : $token;
	2980	+ $tipo = is_array( $token ) ? $token[0] : null;
	2981	+ $saltos = substr_count( $texto, "\n" );
	2982	+ $desde = $linea;
	2983	+ $hasta = $linea + $saltos;
	2984	+
	2985	+ /*
	2986	+ * A token whose text ends in a newline puts nothing on the line that
	2987	+ * newline opens. Counting it would make the "<?php\n" of every file
	2988	+ * touch line 2 and refuse the legitimate case, which is what the
	2989	+ * first version of this did.
	2990	+ */
	2991	+ $ultima = ( $saltos > 0 && "\n" === substr( $texto, -1 ) ) ? $hasta - 1 : $hasta;
	2992	+ $linea = $hasta;
	2993	+
	2994	+ if ( null !== $tipo && in_array( $tipo, $inocuos, true ) ) {
	2995	+ continue;
	2996	+ }
	2997	+
	2998	+ for ( $l = $desde; $l <= $ultima; $l++ ) {
	2999	+ if ( isset( $marked[ $l ] ) ) {
	3000	+ return false;
	3001	+ }
	3002	+ }
	3003	+ }
	3004	+
	3005	+ return true;
	3006	+ }
	3007	+
1996	3008	private function is_vigilant_original_line( $line ) {
1997	3009	if ( false !== strpos( $line, '<?' ) || false !== strpos( $line, '?>' ) ) {
1998	3010	return false;
1999	3011	}
		@@ -2104,8 +3116,36 @@
2104	3116	* it has run, normalize_critical_file() keeps the old rule on every site.
2105	3117	*
2106	3118	* @since 2.11.5
2107	3119	*/
	3120	+ /**
	3121	+ * The admin_init entry point of the claim, which does ask for an administrator
	3122	+ *
	3123	+ * admin-ajax.php fires admin_init before it decides who is asking
	3124	+ * (wp-admin/admin-ajax.php:45), so without this an anonymous request chose
	3125	+ * the moment the claim runs. Unlike its two neighbours in
	3126	+ * init_cleanup_hooks(), which only drop the plugin's own copy out of the
	3127	+ * database, the claim writes two network options, changes for the whole
	3128	+ * network the rule normalize_critical_file() applies, and re-bases the
	3129	+ * approved baseline.
	3130	+ *
	3131	+ * The gate lives here and not inside maybe_claim_owned_blocks() because the
	3132	+ * scan calls that one directly and the scan runs from wp-cron, with no user:
	3133	+ * putting the capability check inside left the claim unable to complete on
	3134	+ * any site whose dashboard nobody opens, and until it completes the older,
	3135	+ * permissive rule is the one in force, which is the hiding place 2.11.5 was
	3136	+ * written to close. Found by the cross review of 2.11.10.
	3137	+ *
	3138	+ * @since 2.11.10
	3139	+ */
	3140	+ public function maybe_claim_owned_blocks_on_admin() {
	3141	+ if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
	3142	+ return;
	3143	+ }
	3144	+
	3145	+ $this->maybe_claim_owned_blocks();
	3146	+ }
	3147	+
2108	3148	public function maybe_claim_owned_blocks() {
2109	3149	if ( $this->owned_blocks_claimed() || ! Vigilante_Settings::owns_shared_files() ) {
2110	3150	return;
2111	3151	}
		@@ -2116,16 +3156,15 @@
2116	3156	if ( $sync_due && ! get_option( 'vigilante_server_files_retry_after' ) ) {
2117	3157	return;
2118	3158	}
2119	3159
2120		- $root_path = untrailingslashit( ABSPATH );
2121	3160	$expected = null;
2122	3161	$unclaimed = array();
2123	3162
2124	3163	foreach ( $this->critical_root_files as $filename ) {
2125		- $full_path = $root_path . '/' . $filename;
	3164	+ $full_path = $this->critical_file_path( $filename );
2126	3165
2127		- if ( ! file_exists( $full_path ) ) {
	3166	+ if ( false === $full_path ) {
2128	3167	continue;
2129	3168	}
2130	3169
2131	3170	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -2216,15 +3255,14 @@
2216	3255	* @since 2.11.5
2217	3256	*/
2218	3257	private function rebase_original_line_shift() {
2219	3258	$baseline = $this->get_critical_files_baseline();
2220		- $root = untrailingslashit( ABSPATH );
2221	3259	$changed = false;
2222	3260
2223	3261	foreach ( $this->critical_root_files as $filename ) {
2224		- $full_path = $root . '/' . $filename;
	3262	+ $full_path = $this->critical_file_path( $filename );
2225	3263
2226		- if ( ! file_exists( $full_path ) || empty( $baseline[ $filename ]['hash'] ) ) {
	3264	+ if ( false === $full_path || empty( $baseline[ $filename ]['hash'] ) ) {
2227	3265	continue;
2228	3266	}
2229	3267
2230	3268	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -2232,8 +3270,33 @@
2232	3270	if ( false === $content ) {
2233	3271	continue;
2234	3272	}
2235	3273
	3274	+ /*
	3275	+ * Never re-base a file that carries a marked line which is not
	3276	+ * wholly a comment. The test below only establishes that the
	3277	+ * difference lies in lines carrying the marker, and the old rule
	3278	+ * dropped the WHOLE line, so a line with a statement in front of the
	3279	+ * marker satisfies it (cell X1 of matriz-escondite-marcadores.sh,
	3280	+ * where the shape is written out): re-basing would write that line
	3281	+ * into the approved baseline and rewrite the stored content, so the
	3282	+ * diff would stop showing it. Adopting as approved what the previous rule
	3283	+ * hid is the one thing an integrity scanner must never do, and the
	3284	+ * log entry of maybe_claim_owned_blocks() already promises the
	3285	+ * opposite ("the scan reports it as a change for you to review").
	3286	+ * Those files are left to be reported. Found by the file-by-file
	3287	+ * review of 2.11.10.
	3288	+ *
	3289	+ * What counts as "wholly a comment" is decided by reading the file
	3290	+ * as PHP reads it, not by the shape of the line: see
	3291	+ * marked_lines_are_inert(). A line that is not recognised is not the
	3292	+ * same thing as a line that can run something, and the first
	3293	+ * wording of this guard confused the two.
	3294	+ */
	3295	+ if ( ! $this->marked_lines_are_inert( $content ) ) {
	3296	+ continue;
	3297	+ }
	3298	+
2236	3299	$current = md5( $this->normalize_critical_file( $filename, $content ) );
2237	3300
2238	3301	// Already in step, or a real change to something other than the
2239	3302	// original lines: nothing to re-base here.
		@@ -2324,11 +3387,11 @@
2324	3387	* @param string $filename File name relative to ABSPATH (e.g. 'wp-config.php').
2325	3388	* @return bool True on success.
2326	3389	*/
2327	3390	public function update_critical_file_baseline( $filename ) {
2328		- $full_path = untrailingslashit( ABSPATH ) . '/' . $filename;
	3391	+ $full_path = $this->critical_file_path( $filename );
2329	3392
2330		- if ( ! file_exists( $full_path ) ) {
	3393	+ if ( false === $full_path ) {
2331	3394	return false;
2332	3395	}
2333	3396
2334	3397	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -2385,14 +3448,13 @@
2385	3448	* @return array Updated baseline data.
2386	3449	*/
2387	3450	public function regenerate_all_baselines() {
2388	3451	$baseline = array();
2389		- $root_path = untrailingslashit( ABSPATH );
2390	3452
2391	3453	foreach ( $this->critical_root_files as $filename ) {
2392		- $full_path = $root_path . '/' . $filename;
	3454	+ $full_path = $this->critical_file_path( $filename );
2393	3455
2394		- if ( ! file_exists( $full_path ) ) {
	3456	+ if ( false === $full_path ) {
2395	3457	continue;
2396	3458	}
2397	3459
2398	3460	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -2502,8 +3564,17 @@
2502	3564	if ( '.' === $plugin_slug ) {
2503	3565	continue;
2504	3566	}
2505	3567
	3568	+ // With the self-check on, Vigilant itself is verified by the
	3569	+ // sha256 triple-anchor block at the start of run_scan(): scanning
	3570	+ // it here again would duplicate findings and the md5 fetch. With
	3571	+ // the check off by filter, Vigilant is a regular plugin (legacy
	3572	+ // behaviour).
	3573	+ if ( dirname( VIGILANTE_PLUGIN_BASENAME ) === $plugin_slug && Vigilante_Self_Integrity::is_on() ) {
	3574	+ continue;
	3575	+ }
	3576	+
2506	3577	// Skip slugs in their post-update grace window: wp.org may still be
2507	3578	// publishing the new version's checksums, so a scheduled scan here
2508	3579	// would raise benign "modified/extra" noise. The dedicated post-update
2509	3580	// verifier (vigilante_fi_postupdate_verify) handles these instead.
		@@ -3737,8 +4808,39 @@
3737	4808	return array_values(
3738	4809	array_filter(
3739	4810	$items,
3740	4811	function ( $item ) {
	4812	+ /*
	4813	+ * On a network, wp-config.php and the root .htaccess are not a
	4814	+ * site's to silence: a change to them is closed by approving it,
	4815	+ * and approving takes a network administrator since 2.11.3. The
	4816	+ * ignore list is an option of each site, so until 2.11.8 the
	4817	+ * administrator of the main site without network rights hid a
	4818	+ * pending change from the network administrator's own screen by
	4819	+ * posting the file name to the ignore handler.
	4820	+ */
	4821	+ if ( is_multisite() && is_array( $item ) && 'critical_config' === ( $item['type'] ?? '' ) ) {
	4822	+ return true;
	4823	+ }
	4824	+
	4825	+ // Findings about the manifest and the version of Vigilant
	4826	+ // itself are not about one file, so no entry of the list may
	4827	+ // hide them, on a single site either: ignoring the row of
	4828	+ // MANIFEST.sha256 took a replaced manifest out of the email.
	4829	+ // Vigilante_Self_Integrity::filter_ignored_findings() keeps
	4830	+ // them the same way.
	4831	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) && in_array( $item['self_finding'] ?? '', array( 'manifest_replaced', 'manifest_unverified', 'manifest_missing', 'manifest_invalid', 'self_downgraded' ), true ) ) {
	4832	+ return true;
	4833	+ }
	4834	+ // Nor the findings of the walk of Vigilant's folder (a folder
	4835	+ // that cannot be listed, the folder that could not be walked):
	4836	+ // their path ends in a slash, and ignoring that row left the
	4837	+ // scan with no row and no email while the self-protection
	4838	+ // status stayed critical.
	4839	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) && '/' === substr( (string) ( $item['file'] ?? '' ), -1 ) ) {
	4840	+ return true;
	4841	+ }
	4842	+
3741	4843	$file = is_array( $item ) && isset( $item['file'] ) ? $item['file'] : '';
3742	4844	return ! in_array( $file, $this->ignored_files, true );
3743	4845	}
3744	4846	)
		@@ -3775,9 +4877,17 @@
3775	4877	// a security-critical finding, same tier as a suspicious file.
3776	4878	$closed_plugins = $this->collect_closed_plugins_for_email();
3777	4879	$has_closed = ! empty( $closed_plugins );
3778	4880
	4881	+ /*
	4882	+ * Self-protection is not part of this decision any more. Its alert is
	4883	+ * its own and no setting switches it off, so this email is again about
	4884	+ * the files of the site: core, plugins, themes, uploads and the two
	4885	+ * shared configuration files.
	4886	+ */
3779	4887	$has_suspicious = ! empty( $results['suspicious'] ) || ! empty( $results['extra'] ) || $has_critical_config || $has_closed;
	4888	+ // Missing files of core, plugins or themes still do not send the email on
	4889	+ // their own: it has no section to list them in, so it would arrive empty.
3780	4890	$has_modified = ! empty( $results['modified'] );
3781	4891
3782	4892	// Instant alert: send for suspicious, extra, critical_config, modified
3783	4893	// files, or closed plugins.
		@@ -3896,8 +5006,37 @@
3896	5006	$regular_modified[] = $item;
3897	5007	}
3898	5008	}
3899	5009
	5010	+ /*
	5011	+ * Self-protection does not travel in this email any more: it has its own
	5012	+ * alert, which no setting switches off (Vigilante_Self_Integrity::
	5013	+ * maybe_send_self_alert()). Older stored results can still carry its
	5014	+ * rows, so they are dropped here instead of being listed as ordinary
	5015	+ * files.
	5016	+ */
	5017	+ foreach ( array( 'suspicious', 'extra', 'missing' ) as $self_bucket ) {
	5018	+ if ( empty( $results[ $self_bucket ] ) || ! is_array( $results[ $self_bucket ] ) ) {
	5019	+ continue;
	5020	+ }
	5021	+ $results[ $self_bucket ] = array_values(
	5022	+ array_filter(
	5023	+ $results[ $self_bucket ],
	5024	+ function ( $item ) {
	5025	+ return ! ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) );
	5026	+ }
	5027	+ )
	5028	+ );
	5029	+ }
	5030	+ $regular_modified = array_values(
	5031	+ array_filter(
	5032	+ $regular_modified,
	5033	+ function ( $item ) {
	5034	+ return ! ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) );
	5035	+ }
	5036	+ )
	5037	+ );
	5038	+
3900	5039	$suspicious_count = count( $results['suspicious'] ?? array() );
3901	5040	$extra_count = count( $results['extra'] ?? array() );
3902	5041	$critical_config_count = count( $critical_config );
3903	5042	$modified_count = count( $regular_modified );
		@@ -3902,10 +5041,10 @@
3902	5041	$critical_config_count = count( $critical_config );
3903	5042	$modified_count = count( $regular_modified );
3904	5043	$closed_count = count( $closed_plugins );
3905	5044
3906		- // Use more urgent subject when suspicious files, critical config changes
3907		- // or closed plugins are found (all three are security-critical).
	5045	+ // Use more urgent subject when suspicious files, critical config changes,
	5046	+ // closed plugins or self-integrity findings are found (all security-critical).
3908	5047	if ( $suspicious_count > 0 || $critical_config_count > 0 || $closed_count > 0 ) {
3909	5048	$subject = sprintf(
3910	5049	/* translators: %s: Site name */
3911	5050	__( '[%s] SECURITY ALERT: File integrity issues detected', 'vigilante' ),