← All changes | includes/class-file-integrity.php +5473 -306 2.11.1 → 3.0.3 View file →

		@@ -68,15 +68,50 @@
68	68	*/
69	69	private $scan_start_time = 0;
70	70
71	71	/**
	72	+ * Seconds a scan runs for at most
	73	+ *
	74	+ * A scan is one request, and it starts from the beginning every time. On
	75	+ * a site too large for this, what comes last is left unchecked on every
	76	+ * scan, so the results say what was not reached (see not_checked_lines()).
	77	+ */
	78	+ const MAX_SCAN_SECONDS = 60;
	79	+
	80	+ /**
72	81	* Maximum scan time in seconds (default 60s for thorough scanning)
73	82	*
74	83	* @var int
75	84	*/
76		- private $max_scan_time = 60;
	85	+ private $max_scan_time = self::MAX_SCAN_SECONDS;
77	86
78	87	/**
	88	+ * Largest file the search for hidden code reads, in bytes
	89	+ *
	90	+ * It used to be 512,000, and a larger file was not opened at all: in a
	91	+ * plugin with no official copy that left it out of the results as if it
	92	+ * were clean. There is still a cap because the file is read whole, but
	93	+ * what is above it is reported as not searched instead of being passed
	94	+ * over (see search_file()).
	95	+ */
	96	+ const MAX_SEARCHED_BYTES = 8388608;
	97	+
	98	+ /**
	99	+ * Seconds a scan gives to the folders of wp-content that belong to nothing
	100	+ *
	101	+ * @var int
	102	+ */
	103	+ private $content_folders_time = 10;
	104	+
	105	+ /**
	106	+ * Whether an expression of the search for hidden code gave up on the file
	107	+ * being searched (see found())
	108	+ *
	109	+ * @var bool
	110	+ */
	111	+ private $search_failed = false;
	112	+
	113	+ /**
79	114	* Option name for critical files baseline hashes.
80	115	*
81	116	* @var string
82	117	*/
		@@ -82,8 +117,1439 @@
82	117	*/
83	118	const BASELINE_OPTION = 'vigilante_critical_files_baseline';
84	119
85	120	/**
	121	+ * Option that records which version last redacted the stored baseline.
	122	+ *
	123	+ * @since 2.11.2
	124	+ */
	125	+ const BASELINE_REDACTION_OPTION = 'vigilante_baseline_redaction';
	126	+
	127	+ /**
	128	+ * Network option recording that the one-off sweep of per-site baselines ran.
	129	+ *
	130	+ * @since 2.11.3
	131	+ */
	132	+ const BASELINE_SWEEP_OPTION = 'vigilante_baseline_sweep';
	133	+
	134	+ /**
	135	+ * The migration the sweep marker stands for.
	136	+ *
	137	+ * A literal, not VIGILANTE_VERSION, and the difference is the whole point.
	138	+ * 2.11.3 stored the running version, so every release after it rearmed the
	139	+ * sweep: the first dashboard load on the main site walked the network with
	140	+ * switch_to_blog() to find nothing, because there was nothing left to find,
	141	+ * for ever, at the price of the one walk the marker exists to avoid.
	142	+ *
	143	+ * A plain boolean would fix that too, and would also leave no way to fire a
	144	+ * second network sweep the day another migration needs one. A literal costs
	145	+ * nothing today and keeps that door open. The redaction marker keeps the
	146	+ * running version on purpose: there the point IS to run again when the list
	147	+ * of what has to be redacted grows, and the cost of reopening it is one
	148	+ * option read rather than a walk of the network.
	149	+ *
	150	+ * And it must be a value NO version ever wrote into this option. The first
	151	+ * draft used '2.11.3', which is precisely what 2.11.3 wrote there, as its
	152	+ * own VIGILANTE_VERSION and BEFORE starting the walk: out in the wild that
	153	+ * value means "started, maybe unfinished". Reading it as "finished" left
	154	+ * every network whose 2.11.3 walk was cut short unswept for good, subsites
	155	+ * still holding the database password and the eight keys. Reproduced on the
	156	+ * Multisite install by a third cross review. The price of the new value is
	157	+ * that networks that did finish in 2.11.3 walk once more and find nothing.
	158	+ *
	159	+ * @since 2.11.4
	160	+ */
	161	+ const BASELINE_SWEEP_MIGRATION = 'network-sweep-done';
	162	+
	163	+ /**
	164	+ * Network option with the fingerprint of every block Vigilant itself wrote
	165	+ * into wp-config.php or the root .htaccess.
	166	+ *
	167	+ * The integrity scan leaves Vigilant's own blocks out of the hash, so that
	168	+ * rewriting them is not reported as somebody else's change. Until 2.11.5 it
	169	+ * left out whatever sat between the markers, without looking. From 2.11.5 a
	170	+ * block is left out only if its content is exactly what Vigilant wrote, as
	171	+ * recorded here at write time.
	172	+ *
	173	+ * @since 2.11.5
	174	+ */
	175	+ const OWNED_BLOCKS_OPTION = 'vigilante_owned_blocks';
	176	+
	177	+ /**
	178	+ * Network option marking that the blocks already on disk have been claimed.
	179	+ *
	180	+ * @since 2.11.5
	181	+ */
	182	+ const OWNED_BLOCKS_CLAIM_OPTION = 'vigilante_owned_blocks_claim';
	183	+
	184	+ /**
	185	+ * Value stored when the claim is done. Deliberately not a version number:
	186	+ * that is the lesson of BASELINE_SWEEP_MIGRATION above.
	187	+ *
	188	+ * @since 2.11.5
	189	+ */
	190	+ const OWNED_BLOCKS_CLAIMED = 'claimed';
	191	+
	192	+ /**
	193	+ * What replaces a secret value kept in the baseline.
	194	+ *
	195	+ * Fixed forever: if this string ever changes, every stored baseline
	196	+ * suddenly differs from the freshly redacted file and every site reports a
	197	+ * change to wp-config.php that never happened.
	198	+ *
	199	+ * @since 2.11.2
	200	+ */
	201	+ const REDACTED_MARKER = '[redacted by Vigilant]';
	202	+
	203	+ /**
	204	+ * Constant names whose value is checked even where the file does not name them
	205	+ *
	206	+ * The eight WordPress keys and salts and the database credentials. Until
	207	+ * 2.11.7 this list, plus names that read like a credential, was what got
	208	+ * redacted, and a real wp-config.php collects secrets under any name:
	209	+ * FTP_PASS, SMTP passwords, cloud keys inside serialize( array( ... ) ),
	210	+ * any const. Since 2.11.8 every value is redacted and this list only feeds
	211	+ * the output check of baseline_content().
	212	+ *
	213	+ * @since 2.11.2
	214	+ *
	215	+ * @var string[]
	216	+ */
	217	+ private static $secret_constants = array(
	218	+ 'DB_NAME', 'DB_USER', 'DB_PASSWORD', 'DB_HOST',
	219	+ 'AUTH_KEY', 'SECURE_AUTH_KEY', 'LOGGED_IN_KEY', 'NONCE_KEY',
	220	+ 'AUTH_SALT', 'SECURE_AUTH_SALT', 'LOGGED_IN_SALT', 'NONCE_SALT',
	221	+ );
	222	+
	223	+ /**
	224	+ * Core constants whose value stays readable in the baseline copy
	225	+ *
	226	+ * Where the site lives, where its folders are, how much memory it gets:
	227	+ * none of it is a secret and all of it is what a diff of wp-config.php is
	228	+ * read for. Every other value is redacted. A list of what is secret can
	229	+ * never be complete, which is how 2.11.2 to 2.11.7 missed FTP_PASS; a list
	230	+ * of what is not can be short and still be right.
	231	+ *
	232	+ * @since 2.11.8
	233	+ *
	234	+ * @var string[]
	235	+ */
	236	+ private static $readable_constants = array(
	237	+ 'ABSPATH', 'WPINC', 'WP_HOME', 'WP_SITEURL', 'WP_CONTENT_DIR', 'WP_CONTENT_URL',
	238	+ 'WP_PLUGIN_DIR', 'WP_PLUGIN_URL', 'WPMU_PLUGIN_DIR', 'WPMU_PLUGIN_URL', 'UPLOADS',
	239	+ 'WP_LANG_DIR', 'WP_TEMP_DIR', 'WP_DEBUG_LOG', 'WP_MEMORY_LIMIT', 'WP_MAX_MEMORY_LIMIT',
	240	+ 'WP_ENVIRONMENT_TYPE', 'WP_DEVELOPMENT_MODE', 'WP_AUTO_UPDATE_CORE', 'FS_METHOD',
	241	+ 'DB_CHARSET', 'DB_COLLATE', 'DOMAIN_CURRENT_SITE', 'PATH_CURRENT_SITE', 'NOBLOGREDIRECT',
	242	+ 'COOKIE_DOMAIN', 'COOKIEPATH', 'SITECOOKIEPATH', 'ADMIN_COOKIE_PATH', 'PLUGINS_COOKIE_PATH',
	243	+ 'WP_DEFAULT_THEME', 'WPLANG',
	244	+ // Numeric core settings. Since 2.11.10 a number in the value of a
	245	+ // define() is redacted like any other value, so the ones that are known
	246	+ // not to be credentials are listed here to keep the diff useful.
	247	+ 'AUTOSAVE_INTERVAL', 'WP_POST_REVISIONS', 'EMPTY_TRASH_DAYS', 'WP_CRON_LOCK_TIMEOUT',
	248	+ 'FS_CHMOD_DIR', 'FS_CHMOD_FILE', 'SITE_ID_CURRENT_SITE', 'BLOG_ID_CURRENT_SITE',
	249	+ );
	250	+
	251	+ /**
	252	+ * Read the critical files baseline, from where it belongs
	253	+ *
	254	+ * Both watched files, wp-config.php and the root .htaccess, belong to the
	255	+ * whole network: there is one of each per installation, not one per site.
	256	+ * Keeping the baseline in a per-site option meant every site of a network
	257	+ * stored its own copy of the same wp-config.php, so a network of fifty
	258	+ * sites held fifty copies of the same credentials, and a cleanup that ran
	259	+ * on one site left the other forty nine untouched. Reported by @calzbert on
	260	+ * 10 sep 2026 and reproduced on the Multisite install. Since 2.11.3 there
	261	+ * is one baseline per network.
	262	+ *
	263	+ * No is_multisite() branch on purpose, and this is worth reading before
	264	+ * anyone adds one back: the core functions already make the distinction.
	265	+ * Verified in the installed core, wp-includes/option.php, where
	266	+ * get_network_option() falls back to get_option() on a single site and
	267	+ * update_network_option() falls back to update_option( $option, $value,
	268	+ * false ), autoload already off, which is exactly what this needs. Two
	269	+ * branches doing the same thing are two branches that can drift apart,
	270	+ * and one of them did during this very change.
	271	+ *
	272	+ * @since 2.11.3
	273	+ *
	274	+ * @return array
	275	+ */
	276	+ private function read_baseline() {
	277	+ $baseline = get_site_option( self::BASELINE_OPTION, array() );
	278	+
	279	+ return is_array( $baseline ) ? $baseline : array();
	280	+ }
	281	+
	282	+ /**
	283	+ * Store the critical files baseline where read_baseline() looks for it
	284	+ *
	285	+ * @since 2.11.3
	286	+ *
	287	+ * @param array $baseline Baseline to store.
	288	+ * @return bool
	289	+ */
	290	+ private function write_baseline( $baseline ) {
	291	+ return update_site_option( self::BASELINE_OPTION, $baseline );
	292	+ }
	293	+
	294	+ /**
	295	+ * Fingerprint of a block exactly as the integrity scan reads it back
	296	+ *
	297	+ * @since 2.11.5
	298	+ *
	299	+ * @param string $block Block from start marker to end marker, inclusive.
	300	+ * @return string
	301	+ */
	302	+ private static function block_fingerprint( $block ) {
	303	+ return md5( str_replace( array( "\r\n", "\r" ), "\n", (string) $block ) );
	304	+ }
	305	+
	306	+ /**
	307	+ * Record a block Vigilant has just written
	308	+ *
	309	+ * Called by the writers right after a verified write, so the scan can tell
	310	+ * Vigilant's block from anything else carrying the same markers. By default
	311	+ * it replaces the earlier record for that marker: after a write, only the
	312	+ * block just written is Vigilant's.
	313	+ *
	314	+ * @since 2.11.5
	315	+ *
	316	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	317	+ * @param string $marker_start Start marker of the block.
	318	+ * @param string $block Block from start marker to end marker, inclusive.
	319	+ * @param bool $replace Drop earlier records for the same marker first.
	320	+ * @return bool
	321	+ */
	322	+ public static function remember_owned_block( $filename, $marker_start, $block, $replace = true ) {
	323	+ $owned = get_site_option( self::OWNED_BLOCKS_OPTION, array() );
	324	+ $owned = is_array( $owned ) ? $owned : array();
	325	+ $file = ( isset( $owned[ $filename ] ) && is_array( $owned[ $filename ] ) ) ? $owned[ $filename ] : array();
	326	+
	327	+ if ( $replace ) {
	328	+ foreach ( $file as $fingerprint => $marker ) {
	329	+ if ( $marker === $marker_start ) {
	330	+ unset( $file[ $fingerprint ] );
	331	+ }
	332	+ }
	333	+ }
	334	+
	335	+ $file[ self::block_fingerprint( $block ) ] = $marker_start;
	336	+ $owned[ $filename ] = $file;
	337	+
	338	+ return update_site_option( self::OWNED_BLOCKS_OPTION, $owned );
	339	+ }
	340	+
	341	+ /**
	342	+ * Forget the blocks recorded for a marker, once Vigilant has removed them
	343	+ *
	344	+ * @since 2.11.5
	345	+ *
	346	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	347	+ * @param string $marker_start Start marker of the block.
	348	+ * @return bool
	349	+ */
	350	+ public static function forget_owned_blocks( $filename, $marker_start ) {
	351	+ $owned = get_site_option( self::OWNED_BLOCKS_OPTION, array() );
	352	+
	353	+ if ( ! is_array( $owned ) || empty( $owned[ $filename ] ) || ! is_array( $owned[ $filename ] ) ) {
	354	+ return true;
	355	+ }
	356	+
	357	+ $changed = false;
	358	+
	359	+ foreach ( $owned[ $filename ] as $fingerprint => $marker ) {
	360	+ if ( $marker === $marker_start ) {
	361	+ unset( $owned[ $filename ][ $fingerprint ] );
	362	+ $changed = true;
	363	+ }
	364	+ }
	365	+
	366	+ return $changed ? update_site_option( self::OWNED_BLOCKS_OPTION, $owned ) : true;
	367	+ }
	368	+
	369	+ /**
	370	+ * Whether a block is one Vigilant wrote
	371	+ *
	372	+ * @since 2.11.5
	373	+ *
	374	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	375	+ * @param string $block Block from start marker to end marker, inclusive.
	376	+ * @return bool
	377	+ */
	378	+ private static function is_owned_block( $filename, $block ) {
	379	+ $owned = get_site_option( self::OWNED_BLOCKS_OPTION, array() );
	380	+
	381	+ return is_array( $owned )
	382	+ && isset( $owned[ $filename ] )
	383	+ && is_array( $owned[ $filename ] )
	384	+ && isset( $owned[ $filename ][ self::block_fingerprint( $block ) ] );
	385	+ }
	386	+
	387	+ /**
	388	+ * Whether the blocks already on disk have been claimed
	389	+ *
	390	+ * @since 2.11.5
	391	+ *
	392	+ * @return bool
	393	+ */
	394	+ private function owned_blocks_claimed() {
	395	+ return self::OWNED_BLOCKS_CLAIMED === get_site_option( self::OWNED_BLOCKS_CLAIM_OPTION );
	396	+ }
	397	+
	398	+ /**
	399	+ * The baseline copy of a critical file, with no secret in it
	400	+ *
	401	+ * The integrity scan keeps a copy of wp-config.php so it can show which
	402	+ * lines changed. Until 2.11.1 that copy was the file itself minus the
	403	+ * plugin's own blocks, so the options table held the database password and
	404	+ * the eight authentication keys and salts, and anybody who later read the
	405	+ * database or a backup of it got them without ever touching the
	406	+ * filesystem. Reported by the automated security review of wp.org on 9 sep
	407	+ * 2026 and fixed in 2.11.2.
	408	+ *
	409	+ * The hash is still taken over the whole file, so a change to a secret is
	410	+ * still detected; what changes is that the diff cannot show it, which is
	411	+ * the right trade.
	412	+ *
	413	+ * @since 2.11.2
	414	+ *
	415	+ * @param string $filename Critical file name.
	416	+ * @param string $normalized Normalized content.
	417	+ * @return string Content safe to store, or '' when it cannot be made safe.
	418	+ */
	419	+ private function baseline_content( $filename, $normalized ) {
	420	+ if ( '.htaccess' === $filename ) {
	421	+ return $this->redact_server_secrets( $normalized );
	422	+ }
	423	+
	424	+ if ( 'wp-config.php' !== $filename ) {
	425	+ return $normalized;
	426	+ }
	427	+
	428	+ // Calculados una sola vez: los usa la redaccion (para no conservar un
	429	+ // numero que ademas este en vigor) y el control de salida de abajo.
	430	+ $live_values = $this->values_in_force( $normalized );
	431	+ $redacted = $this->redact_secrets( $normalized, $live_values );
	432	+
	433	+ /*
	434	+ * Belt and braces, and this is the part that matters: the redaction
	435	+ * above is the thing most likely to miss a shape nobody thought of,
	436	+ * and the cost of missing one is a secret in the database. So the
	437	+ * result is checked against the values actually in force, and if any
	438	+ * of them survived, nothing is stored at all. The scan then reports the
	439	+ * change without a line diff, which the interface already handles,
	440	+ * instead of leaking.
	441	+ *
	442	+ * Until 2.11.7 the check covered the twelve constants of WordPress and
	443	+ * nothing else, so a value the regular expression missed went straight
	444	+ * through it. It now covers every constant the file names and every
	445	+ * environment variable it reads.
	446	+ *
	447	+ * It runs against the copy that is actually stored. A value in force
	448	+ * that sits inside the value of a readable constant, such as a Redis
	449	+ * prefix equal to the domain inside WP_HOME, is not a secret left
	450	+ * behind, so that one alone is not looked for; without that, every such
	451	+ * site would lose its diff. The first version of this checked a
	452	+ * stricter copy instead, and a secret inside a kept include path went
	453	+ * straight past it (cross review of 2.11.8).
	454	+ *
	455	+ * Only values of eight characters or more are checked: DB_NAME is
	456	+ * often something like "local" or "wp", and looking for that inside a
	457	+ * PHP file matches by accident every time.
	458	+ */
	459	+ if ( '' === $redacted ) {
	460	+ return '';
	461	+ }
	462	+
	463	+ $shown = $this->readable_values_in_force();
	464	+
	465	+ foreach ( $live_values as $value ) {
	466	+ foreach ( $shown as $readable ) {
	467	+ if ( false !== strpos( $readable, $value ) ) {
	468	+ continue 2;
	469	+ }
	470	+ }
	471	+
	472	+ if ( false !== strpos( $redacted, $value ) ) {
	473	+ return '';
	474	+ }
	475	+ }
	476	+
	477	+ return $redacted;
	478	+ }
	479	+
	480	+ /**
	481	+ * Replace every value in wp-config.php with a marker
	482	+ *
	483	+ * Reads the file as PHP tokens and replaces every string in it: quoted,
	484	+ * with variables inside, heredoc and nowdoc. What stays is what names a
	485	+ * thing rather than holding it: the name passed to define(), defined(),
	486	+ * constant() and getenv(), the name in putenv( 'NAME=value' ), array keys,
	487	+ * an index such as $_ENV['NAME'], and strings of a single character that
	488	+ * are not the value of a define(). Also the value of the constants in
	489	+ * $readable_constants, the table prefix and a path passed to require or
	490	+ * include, which are not secrets and are what a diff of this file is read
	491	+ * for. A path is kept only while it looks like one, and only up to where
	492	+ * its expression ends.
	493	+ *
	494	+ * Until 2.11.7 this was a regular expression over define() with a list of
	495	+ * names, and it missed FTP_PASS, SMTP passwords, cloud keys inside
	496	+ * serialize( array( ... ) ), every const and every value read with a
	497	+ * fallback. Measured while preparing 2.11.8: 10 of 15 real shapes stored
	498	+ * their secret.
	499	+ *
	500	+ * The marker always goes in single quotes, whatever the original used, so
	501	+ * a copy redacted by an earlier version and the same file redacted today
	502	+ * read the same line for line.
	503	+ *
	504	+ * @since 2.11.2
	505	+ * @since 2.11.8 Reads tokens and redacts every value.
	506	+ *
	507	+ * @param string $content Normalized wp-config.php content.
	508	+ * @return string Redacted content, or '' when it cannot be read as tokens.
	509	+ */
	510	+ private function redact_secrets( $content, $live_values = array() ) {
	511	+ if ( ! function_exists( 'token_get_all' ) ) {
	512	+ return '';
	513	+ }
	514	+
	515	+ $marker = "'" . self::REDACTED_MARKER . "'";
	516	+ $tokens = self::merged_tokens( token_get_all( (string) $content ) );
	517	+ $count = count( $tokens );
	518	+ $names = defined( 'T_NAME_FULLY_QUALIFIED' ) ? array( T_STRING, T_NAME_FULLY_QUALIFIED ) : array( T_STRING );
	519	+ $includes = array( T_INCLUDE, T_INCLUDE_ONCE, T_REQUIRE, T_REQUIRE_ONCE );
	520	+ $out = '';
	521	+ $depth = 0;
	522	+ $keep_until = -1;
	523	+ $define_at = -1;
	524	+ $in_include = false;
	525	+ $include_depth = 0;
	526	+ $include_ends = array( T_CLOSE_TAG, T_BOOLEAN_OR, T_BOOLEAN_AND, T_LOGICAL_OR, T_LOGICAL_AND, T_COALESCE );
	527	+
	528	+ for ( $i = 0; $i < $count; $i++ ) {
	529	+ list( $type, $text, $plain ) = $tokens[ $i ];
	530	+
	531	+ if ( '(' === $type ) {
	532	+ $depth++;
	533	+ } elseif ( ')' === $type ) {
	534	+ // The closing parenthesis of a readable define(), or of any define().
	535	+ if ( $depth === $keep_until ) {
	536	+ $keep_until = -1;
	537	+ }
	538	+ if ( $depth === $define_at ) {
	539	+ $define_at = -1;
	540	+ }
	541	+ $depth--;
	542	+
	543	+ // A parenthesis that closes around the include ends its path.
	544	+ if ( $in_include && $depth < $include_depth ) {
	545	+ $in_include = false;
	546	+ }
	547	+ } elseif ( in_array( $type, $includes, true ) ) {
	548	+ $in_include = true;
	549	+ $include_depth = $depth;
	550	+ } elseif ( $in_include && ( in_array( $type, array( ';', '{', '}', '?', ':', ',' ), true ) || in_array( $type, $include_ends, true ) ) ) {
	551	+ /*
	552	+ * The path of an include ends where its expression does. The
	553	+ * first version of this only ended it at ';', so the value in
	554	+ * `( include 'db.php' ) || define( 'FTP_PASS', '...' )`, in a
	555	+ * ternary after require, or after a closing tag, was kept.
	556	+ * Found by the cross review of 2.11.8.
	557	+ */
	558	+ $in_include = false;
	559	+ }
	560	+
	561	+ if ( T_COMMENT === $type || T_DOC_COMMENT === $type ) {
	562	+ $out .= $this->redact_comment( $text );
	563	+ continue;
	564	+ }
	565	+
	566	+ if ( T_INLINE_HTML === $type ) {
	567	+ $out .= ( '' === trim( $text ) ) ? $text : $marker;
	568	+ continue;
	569	+ }
	570	+
	571	+ /*
	572	+ * A value that is not a quoted string is still a value. Until
	573	+ * 2.11.10 only string tokens were looked at, so
	574	+ * define( 'SERVICE_TOKEN', 12345678 ) put the live token in the copy
	575	+ * kept in the database. Reported by the wp.org automated review of
	576	+ * 2.11.9.
	577	+ *
	578	+ * The first fix here redacted a number only in the value position of
	579	+ * a define(), which is the shape that was reported and not the shape
	580	+ * of the problem. The second cross review of 2.11.10 measured nine
	581	+ * more: a negative number, one in parentheses, one inside
	582	+ * array( ... ), one in a ternary, a const, and four that are not
	583	+ * constants at all and so the output check cannot catch either, the
	584	+ * worst of them the documented way of configuring Redis,
	585	+ * $redis_server = array( 'auth' => 12345678 ). So a number is now
	586	+ * treated like a string: redacted unless the place it sits in is one
	587	+ * of the few that cannot hold a credential, which is how the rest of
	588	+ * this function has been written since 2.11.8 (a list of what may be
	589	+ * shown, never a list of what is secret).
	590	+ *
	591	+ * Losing a number from the diff costs little and buys the same trade
	592	+ * as everywhere else: the hash still covers the whole file, so a
	593	+ * change is detected even where the diff can no longer show it. The
	594	+ * numeric core settings are in $readable_constants so the diff of a
	595	+ * normal wp-config.php keeps saying what it used to.
	596	+ */
	597	+ if ( T_LNUMBER === $type || T_DNUMBER === $type ) {
	598	+ $nprev = self::significant_token( $tokens, $i, -1 );
	599	+ $nnext = self::significant_token( $tokens, $i, 1 );
	600	+ $nptype = ( null === $nprev ) ? null : $tokens[ $nprev ][0];
	601	+ $nntype = ( null === $nnext ) ? null : $tokens[ $nnext ][0];
	602	+ $nbefore = ( '[' === $nptype ) ? self::significant_token( $tokens, $nprev, -1 ) : null;
	603	+ $nbtoken = ( null === $nbefore ) ? array( null, null ) : $tokens[ $nbefore ];
	604	+ $nvalue = ( -1 !== $define_at && $depth === $define_at && ',' === $nptype );
	605	+
	606	+ $nkeep = $keep_until >= 0
	607	+ || T_DOUBLE_ARROW === $nntype
	608	+ || ( '[' === $nptype && ']' === $nntype && in_array( $nbtoken[0], array( T_VARIABLE, T_STRING, ']', ')', '}' ), true ) )
	609	+ || ( strlen( $text ) <= 1 && ! $nvalue );
	610	+
	611	+ /*
	612	+ * Except when that same number is a value actually in force. The
	613	+ * positions kept above are kept because a credential does not live
	614	+ * in them, which is true, but it says nothing about the number
	615	+ * itself: with
	616	+ * define( 'SERVICE_TOKEN', 12345678 );
	617	+ * $a = $config[12345678];
	618	+ * the value was redacted in the define and kept in the index, so it
	619	+ * survived, and the output check below did what it is there for and
	620	+ * threw the whole copy away. No leak, but the diff of that
	621	+ * wp-config.php was lost for good, which is the regression 2.11.8
	622	+ * fixed, coming back through the numbers added in 2.11.10. Found by
	623	+ * the third cross review.
	624	+ *
	625	+ * Strings are deliberately NOT treated this way: there, a value in
	626	+ * force sitting in a kept position (an include path, an array key)
	627	+ * can BE the secret, and losing the diff is the right answer. It is
	628	+ * what poc/wpconfig-baseline-secretos.sh checks and it stays.
	629	+ */
	630	+ if ( $nkeep && in_array( $text, $live_values, true ) ) {
	631	+ $nkeep = false;
	632	+ }
	633	+
	634	+ $out .= $nkeep ? $text : $marker;
	635	+ continue;
	636	+ }
	637	+
	638	+ if ( 'string' !== $type ) {
	639	+ $out .= $text;
	640	+ continue;
	641	+ }
	642	+
	643	+ $prev = self::significant_token( $tokens, $i, -1 );
	644	+ $next = self::significant_token( $tokens, $i, 1 );
	645	+ $ptype = ( null === $prev ) ? null : $tokens[ $prev ][0];
	646	+ $ntype = ( null === $next ) ? null : $tokens[ $next ][0];
	647	+ $call = ( '(' === $ptype ) ? self::significant_token( $tokens, $prev, -1 ) : null;
	648	+ $inner = $plain ? substr( $text, 1, -1 ) : null;
	649	+
	650	+ if ( $plain && null !== $call && in_array( $tokens[ $call ][0], $names, true ) ) {
	651	+ $function = strtolower( ltrim( $tokens[ $call ][1], '\\' ) );
	652	+
	653	+ if ( in_array( $function, array( 'define', 'defined', 'constant', 'getenv' ), true ) ) {
	654	+ if ( 'define' === $function ) {
	655	+ $define_at = $depth;
	656	+
	657	+ if ( in_array( $inner, self::$readable_constants, true ) ) {
	658	+ $keep_until = $depth;
	659	+ }
	660	+ }
	661	+ $out .= $text;
	662	+ continue;
	663	+ }
	664	+
	665	+ if ( 'putenv' === $function && false !== strpos( $inner, '=' ) ) {
	666	+ $out .= "'" . substr( $inner, 0, strpos( $inner, '=' ) + 1 ) . self::REDACTED_MARKER . "'";
	667	+ continue;
	668	+ }
	669	+ }
	670	+
	671	+ // The token before an opening bracket or an assignment, when there is one.
	672	+ $before = ( '[' === $ptype || '=' === $ptype ) ? self::significant_token( $tokens, $prev, -1 ) : null;
	673	+ $btoken = ( null === $before ) ? array( null, null ) : $tokens[ $before ];
	674	+
	675	+ /*
	676	+ * The value of a define() is redacted whatever its length, as it was
	677	+ * up to 2.11.7, so an empty password reads the same in a copy stored
	678	+ * then as in today's; the first version of this kept strings of one
	679	+ * character there and a file awaiting review showed credential lines
	680	+ * nobody had touched (cross review of 2.11.8).
	681	+ */
	682	+ $is_define_value = ( -1 !== $define_at && $depth === $define_at && ',' === $ptype );
	683	+ $is_path = $in_include && $plain
	684	+ && preg_match( '#^[A-Za-z0-9_./\-]+$#', (string) $inner )
	685	+ && ( false !== strpos( (string) $inner, '/' ) || '.php' === substr( (string) $inner, -4 ) );
	686	+
	687	+ $keep = ( $plain && strlen( $inner ) <= 1 && ! $is_define_value )
	688	+ || T_DOUBLE_ARROW === $ntype
	689	+ || ( '[' === $ptype && ']' === $ntype && in_array( $btoken[0], array( T_VARIABLE, T_STRING, ']', ')', '}' ), true ) )
	690	+ || $keep_until >= 0
	691	+ || $is_path
	692	+ || ( '=' === $ptype && ';' === $ntype && T_VARIABLE === $btoken[0] && '$table_prefix' === $btoken[1] );
	693	+
	694	+ $out .= $keep ? $text : $marker;
	695	+ }
	696	+
	697	+ return $out;
	698	+ }
	699	+
	700	+ /**
	701	+ * PHP tokens with every string folded into a single token
	702	+ *
	703	+ * The tokenizer splits a string with variables inside, a heredoc and a
	704	+ * backtick command into several tokens. For the redaction each of them is
	705	+ * one value, so they come back as a single token of type 'string'. The
	706	+ * third field says whether it is a plain quoted literal.
	707	+ *
	708	+ * @since 2.11.8
	709	+ *
	710	+ * @param array $raw Output of token_get_all().
	711	+ * @return array List of array( type, text, plain ).
	712	+ */
	713	+ private static function merged_tokens( $raw ) {
	714	+ $tokens = array();
	715	+ $count = count( $raw );
	716	+
	717	+ for ( $i = 0; $i < $count; $i++ ) {
	718	+ $token = $raw[ $i ];
	719	+
	720	+ if ( '"' === $token || '`' === $token ) {
	721	+ $text = $token;
	722	+ for ( $i++; $i < $count; $i++ ) {
	723	+ $text .= is_array( $raw[ $i ] ) ? $raw[ $i ][1] : $raw[ $i ];
	724	+ if ( $raw[ $i ] === $token ) {
	725	+ break;
	726	+ }
	727	+ }
	728	+ $tokens[] = array( 'string', $text, false );
	729	+ continue;
	730	+ }
	731	+
	732	+ if ( is_array( $token ) && T_START_HEREDOC === $token[0] ) {
	733	+ $text = $token[1];
	734	+ for ( $i++; $i < $count; $i++ ) {
	735	+ $text .= is_array( $raw[ $i ] ) ? $raw[ $i ][1] : $raw[ $i ];
	736	+ if ( is_array( $raw[ $i ] ) && T_END_HEREDOC === $raw[ $i ][0] ) {
	737	+ break;
	738	+ }
	739	+ }
	740	+ $tokens[] = array( 'string', $text, false );
	741	+ continue;
	742	+ }
	743	+
	744	+ // An unterminated string comes back as T_ENCAPSED_AND_WHITESPACE
	745	+ // on its own, and it is a value like any other.
	746	+ if ( is_array( $token ) && ( T_CONSTANT_ENCAPSED_STRING === $token[0] || T_ENCAPSED_AND_WHITESPACE === $token[0] ) ) {
	747	+ $tokens[] = array( 'string', $token[1], T_CONSTANT_ENCAPSED_STRING === $token[0] );
	748	+ continue;
	749	+ }
	750	+
	751	+ $tokens[] = is_array( $token ) ? array( $token[0], $token[1], false ) : array( $token, $token, false );
	752	+ }
	753	+
	754	+ return $tokens;
	755	+ }
	756	+
	757	+ /**
	758	+ * Index of the nearest token that is not whitespace or a comment
	759	+ *
	760	+ * @since 2.11.8
	761	+ *
	762	+ * @param array $tokens Output of merged_tokens().
	763	+ * @param int $from Index to start from, not included.
	764	+ * @param int $step -1 to look back, 1 to look ahead.
	765	+ * @return int|null
	766	+ */
	767	+ private static function significant_token( $tokens, $from, $step ) {
	768	+ $count = count( $tokens );
	769	+
	770	+ for ( $i = $from + $step; $i >= 0 && $i < $count; $i += $step ) {
	771	+ if ( ! in_array( $tokens[ $i ][0], array( T_WHITESPACE, T_COMMENT, T_DOC_COMMENT ), true ) ) {
	772	+ return $i;
	773	+ }
	774	+ }
	775	+
	776	+ return null;
	777	+ }
	778	+
	779	+ /**
	780	+ * Redact a comment, keeping its plain words
	781	+ *
	782	+ * To the tokenizer a comment is text, and wp-config.php files keep old
	783	+ * credentials in them, commented out or in a note. The first version of
	784	+ * this, in the same release, redacted what was between quotes: an
	785	+ * apostrophe in prose ("Don't use 'the-old-password'") paired with the
	786	+ * opening quote of the secret and left it out, and a secret without quotes
	787	+ * was never touched. Found by the cross review of 2.11.8.
	788	+ *
	789	+ * So it works the other way round. A comment keeps its plain words
	790	+ * (lowercase, capitalised or uppercase letters, or two capitalised parts
	791	+ * such as WordPress, and docblock tags), constant names, and anything
	792	+ * shorter than eight characters; every other run of characters, a URL, a
	793	+ * key, a password with a digit in it, becomes the marker. The value of a
	794	+ * commented-out define() goes in single quotes whatever its length, as in
	795	+ * code and as 2.11.2 to 2.11.7 wrote it, so a copy stored by those
	796	+ * versions reads the same line for line. What this cannot tell from prose
	797	+ * is a password made only of plain letters; the output check still
	798	+ * catches it when it is a value in force.
	799	+ *
	800	+ * @since 2.11.8
	801	+ *
	802	+ * @param string $comment Comment token text.
	803	+ * @return string
	804	+ */
	805	+ private function redact_comment( $comment ) {
	806	+ $marker = self::REDACTED_MARKER;
	807	+ $readable = self::$readable_constants;
	808	+
	809	+ // Only the text between the delimiters is redacted: "/**#@-*/" in
	810	+ // wp-config-sample.php is a single run of eight characters, and
	811	+ // replacing it whole took the comment markers with it.
	812	+ if ( ! preg_match( '#\A(/\*\*?|//|\#)(.*?)(\*/)?\z#s', $comment, $parts ) ) {
	813	+ $parts = array( $comment, '', $comment );
	814	+ }
	815	+
	816	+ $open = $parts[1];
	817	+ $close = isset( $parts[3] ) ? $parts[3] : '';
	818	+ $comment = preg_replace_callback(
	819	+ '/(\bdefine\s*\(\s*([\'"])((?:\\\\.|(?!\2).)*)\2\s*,\s*)([\'"])((?:\\\\.|(?!\4).)*)\4/i',
	820	+ function ( $match ) use ( $marker, $readable ) {
	821	+ return in_array( $match[3], $readable, true ) ? $match[0] : $match[1] . "'" . $marker . "'";
	822	+ },
	823	+ $parts[2]
	824	+ );
	825	+
	826	+ if ( null === $comment ) {
	827	+ return '';
	828	+ }
	829	+
	830	+ $redacted = preg_replace_callback(
	831	+ '/[^\s\'"`(),;\[\]{}<>=]+/u',
	832	+ function ( $match ) use ( $marker ) {
	833	+ $word = $match[0];
	834	+ $core = rtrim( $word, '.:!?' );
	835	+
	836	+ // Plain words only, without hyphens: a passphrase written as
	837	+ // lowercase words joined by hyphens reads as prose otherwise, and
	838	+ // the PoC of this very fix caught one surviving.
	839	+ if ( strlen( $core ) < 8
	840	+ || preg_match( '/^@?(?:\p{Lu}?\p{Ll}+|\p{Lu}+)$/u', $core )
	841	+ || preg_match( '/^\p{Lu}\p{Ll}+\p{Lu}\p{Ll}+$/u', $core )
	842	+ || preg_match( '/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/', $core )
	843	+ ) {
	844	+ return $word;
	845	+ }
	846	+
	847	+ return $marker . substr( $word, strlen( $core ) );
	848	+ },
	849	+ $comment
	850	+ );
	851	+
	852	+ // A failed replacement, on invalid UTF-8 for one, drops the comment
	853	+ // rather than keep it whole.
	854	+ return ( null === $redacted ) ? '' : $open . $redacted . $close;
	855	+ }
	856	+
	857	+ /**
	858	+ * Values in force of what a wp-config.php names
	859	+ *
	860	+ * Every user constant whose name appears in the file, the twelve of
	861	+ * WordPress wherever they were defined, and the environment variables the
	862	+ * file reads or sets. Arrays are walked to their leaves, since define()
	863	+ * takes arrays. Strings and numbers both: the first version of this counted
	864	+ * numbers and wiped the diff of any file with a large number in force (cross
	865	+ * review of 2.11.8), so they were dropped, and 2.11.10 had to bring them
	866	+ * back because a credential written as a number, which the wp.org review of
	867	+ * 2.11.9 reported, is exactly what this check has to be able to see. The
	868	+ * eight character floor is what keeps the old problem away. The readable
	869	+ * constants are left out, and so is anything shorter than that.
	870	+ *
	871	+ * @since 2.11.8
	872	+ *
	873	+ * @param string $content Normalized wp-config.php content.
	874	+ * @return string[]
	875	+ */
	876	+ private function values_in_force( $content ) {
	877	+ $defined = get_defined_constants( true );
	878	+ $user = isset( $defined['user'] ) ? $defined['user'] : array();
	879	+ $names = self::$secret_constants;
	880	+ $values = array();
	881	+
	882	+ if ( preg_match_all( '/[A-Za-z_][A-Za-z0-9_]*/', (string) $content, $words ) ) {
	883	+ $names = array_merge( $names, $words[0] );
	884	+ }
	885	+
	886	+ foreach ( array_unique( $names ) as $name ) {
	887	+ if ( array_key_exists( $name, $user ) && ! in_array( $name, self::$readable_constants, true ) ) {
	888	+ $values = array_merge( $values, self::string_leaves( $user[ $name ] ) );
	889	+ }
	890	+ }
	891	+
	892	+ if ( preg_match_all( '/\b(?:getenv|putenv)\s*\(\s*[\'"]([A-Za-z_][A-Za-z0-9_]*)|\$_ENV\s*\[\s*[\'"]([A-Za-z_][A-Za-z0-9_]*)/', (string) $content, $env ) ) {
	893	+ foreach ( array_filter( array_merge( $env[1], $env[2] ) ) as $name ) {
	894	+ $value = getenv( $name );
	895	+
	896	+ if ( is_string( $value ) ) {
	897	+ $values[] = $value;
	898	+ }
	899	+ }
	900	+ }
	901	+
	902	+ $long = array();
	903	+
	904	+ foreach ( $values as $value ) {
	905	+ if ( strlen( $value ) >= 8 ) {
	906	+ $long[ $value ] = $value;
	907	+ }
	908	+ }
	909	+
	910	+ return array_values( $long );
	911	+ }
	912	+
	913	+ /**
	914	+ * Every string inside a constant value
	915	+ *
	916	+ * @since 2.11.8
	917	+ *
	918	+ * @param mixed $value Constant value.
	919	+ * @return string[]
	920	+ */
	921	+ private static function string_leaves( $value ) {
	922	+ if ( is_array( $value ) ) {
	923	+ $leaves = array();
	924	+
	925	+ foreach ( $value as $item ) {
	926	+ $leaves = array_merge( $leaves, self::string_leaves( $item ) );
	927	+ }
	928	+
	929	+ return $leaves;
	930	+ }
	931	+
	932	+ if ( is_string( $value ) ) {
	933	+ return array( $value );
	934	+ }
	935	+
	936	+ /*
	937	+ * A number is a value too. Until 2.11.10 this returned nothing for one,
	938	+ * so the output check had no way to see a credential written as
	939	+ * define( 'SERVICE_TOKEN', 12345678 ) and the redaction was left without
	940	+ * its safety net there. Booleans and null stay out on purpose: as text
	941	+ * they are '1' and '', which would match half the file.
	942	+ */
	943	+ return ( is_int( $value ) || is_float( $value ) ) ? array( (string) $value ) : array();
	944	+ }
	945	+
	946	+ /**
	947	+ * Values in force of the readable constants, the ones kept in the copy
	948	+ *
	949	+ * @since 2.11.8
	950	+ *
	951	+ * @return string[]
	952	+ */
	953	+ private function readable_values_in_force() {
	954	+ $values = array();
	955	+
	956	+ foreach ( self::$readable_constants as $name ) {
	957	+ if ( defined( $name ) ) {
	958	+ $values = array_merge( $values, self::string_leaves( constant( $name ) ) );
	959	+ }
	960	+ }
	961	+
	962	+ return $values;
	963	+ }
	964	+
	965	+ /**
	966	+ * Replace the values a root .htaccess can carry as credentials
	967	+ *
	968	+ * The .htaccess is not a secrets file, but it can hold a few: an
	969	+ * environment variable handed to PHP with SetEnv, an Authorization header
	970	+ * set for a backend, or a php_value with a password, a key, a licence or a
	971	+ * session store address with its auth in it. The directive and its name
	972	+ * stay, the value goes. Line based, which is how Apache reads it too. Since
	973	+ * the cross review of 2.11.8 also any request or response header whose name
	974	+ * reads like a credential (X-Api-Key, a cookie, a signature) and a
	975	+ * RewriteCond that compares against key=, token= or the like, the way a
	976	+ * staging site is opened with a secret in the query string. What it cannot
	977	+ * see is a credential written in any other shape.
	978	+ *
	979	+ * @since 2.11.8
	980	+ *
	981	+ * @param string $content Normalized .htaccess content.
	982	+ * @return string
	983	+ */
	984	+ private function redact_server_secrets( $content ) {
	985	+ $redacted = preg_replace(
	986	+ array(
	987	+ '/^([ \t]*SetEnv[ \t]+\S+[ \t]+)\S.*$/mi',
	988	+ '/^([ \t]*(?:RequestHeader|Header)[ \t]+(?:always[ \t]+)?\S+[ \t]+[\w-]*(?:auth|key|token|secret|pass|cookie|sig)[\w-]*[ \t]+)\S.*$/mi',
	989	+ '/^([ \t]*php_(?:admin_)?value[ \t]+\S*(?:pass|pw|secret|key|token|licen|auth|save_path)\S*[ \t]+)\S.*$/mi',
	990	+ '/^([ \t]*RewriteCond[ \t]+\S+[ \t]+)\S*(?:key|token|secret|pass|auth|sig)[\w-]*=\S*/mi',
	991	+ ),
	992	+ '${1}' . self::REDACTED_MARKER,
	993	+ (string) $content
	994	+ );
	995	+
	996	+ return ( null === $redacted ) ? '' : $redacted;
	997	+ }
	998	+
	999	+ /**
	1000	+ * Promote a per-site baseline to the network record before dropping it
	1001	+ *
	1002	+ * Up to 2.11.2 the baseline was a per-site option, so on a network every
	1003	+ * site kept its own copy of the same two files. Those copies go, but what a
	1004	+ * copy records is which version of the file the owner approved, and that
	1005	+ * has to survive: rebuilding the baseline from disk would take whatever is
	1006	+ * there right now as approved, so a wp-config.php modified and still
	1007	+ * awaiting review would be blessed in silence.
	1008	+ *
	1009	+ * WHICH copy becomes the network record is not a detail, and 2.11.3 got it
	1010	+ * wrong. This runs from the scan, under wp-cron, on whichever site gets
	1011	+ * traffic first, and the sweep from the main site can be hours away because
	1012	+ * it waits for a network administrator to open a dashboard. So on a network
	1013	+ * with traffic spread around, the record of the whole installation was
	1014	+ * whatever the first subsite to scan happened to hold.
	1015	+ *
	1016	+ * That is harmless while every copy agrees, which is the ordinary case. The
	1017	+ * reason they can disagree is the very thing 2.11.3 fixed: until then,
	1018	+ * approving a change to wp-config.php took manage_options, which on a
	1019	+ * network the administrator of every subsite holds. If a change was
	1020	+ * approved on some subsite while the main site still had it pending review,
	1021	+ * promoting that subsite's copy retires a warning nobody decided to retire.
	1022	+ *
	1023	+ * Hence the order, file by file: what the network record already holds
	1024	+ * wins, then the main site, then the site this runs on. Between the copies,
	1025	+ * the main site beats a subsite, which is @calzbert's point, reported after
	1026	+ * reading the 2.11.3 diff.
	1027	+ *
	1028	+ * What this does NOT protect, said plainly because an earlier wording
	1029	+ * claimed more: if the network record already holds a file, that entry
	1030	+ * wins, even when it was written from disk by the .htaccess writer on
	1031	+ * init:20 while a third-party edit was pending review. What survives is a
	1032	+ * file the network record does not hold yet, which is the wp-config.php
	1033	+ * case that 2.11.3 lost. The .htaccess case is pre-existing and needs the
	1034	+ * writers to pass their before-hash, see update_critical_file_baseline().
	1035	+ *
	1036	+ * @since 2.11.4
	1037	+ *
	1038	+ * @param array|null $per_site Baseline stored for the site this runs on.
	1039	+ * @return bool True when the network record covers everything the per-site
	1040	+ * copy had, which is the only case where dropping it is safe.
	1041	+ */
	1042	+ private function promote_per_site_baseline( $per_site ) {
	1043	+ $network = get_site_option( self::BASELINE_OPTION, array() );
	1044	+
	1045	+ if ( ! is_array( $network ) ) {
	1046	+ $network = array();
	1047	+ }
	1048	+
	1049	+ /*
	1050	+ * Three sources, filled in one from another, file by file. It used to
	1051	+ * be all or nothing: if the network record existed at all, this
	1052	+ * returned at once and the caller dropped the per-site copy anyway.
	1053	+ *
	1054	+ * That looked safe and was not, because the network record can be born
	1055	+ * holding ONE of the two files. maybe_sync_server_files() runs on init
	1056	+ * and rewrites the root .htaccess by itself, and the writer calls
	1057	+ * update_critical_file_baseline( '.htaccess' ), which creates the
	1058	+ * network option with that single entry. init runs before admin_init,
	1059	+ * so on a network on Apache this is the ordinary order of an update,
	1060	+ * not a race: the cleanup then found the option "already there", kept
	1061	+ * nothing, and deleted the per-site copies that held the approved
	1062	+ * record of wp-config.php. The next scan met a file it had never seen
	1063	+ * and stored whatever was on disk as approved, which is the silent
	1064	+ * blessing this whole function exists to prevent. Reproduced on the
	1065	+ * Multisite install on 10 sep 2026, found by a cross review.
	1066	+ *
	1067	+ * Order of authority: what the network already says wins, then the main
	1068	+ * site, then the site this runs on. Nothing is ever overwritten and
	1069	+ * nothing is dropped for being late.
	1070	+ */
	1071	+ $sources = array( $network );
	1072	+
	1073	+ if ( ! is_main_site() ) {
	1074	+ $from_main = get_blog_option( get_main_site_id(), self::BASELINE_OPTION, null );
	1075	+
	1076	+ if ( is_array( $from_main ) ) {
	1077	+ $sources[] = $from_main;
	1078	+ }
	1079	+ }
	1080	+
	1081	+ if ( is_array( $per_site ) ) {
	1082	+ $sources[] = $per_site;
	1083	+ }
	1084	+
	1085	+ $merged = array();
	1086	+
	1087	+ foreach ( $sources as $source ) {
	1088	+ foreach ( $source as $filename => $data ) {
	1089	+ if ( isset( $merged[ $filename ] ) || ! is_array( $data ) || ! isset( $data['hash'] ) ) {
	1090	+ continue;
	1091	+ }
	1092	+
	1093	+ // Only the content carries secrets; the hash and the size,
	1094	+ // which are what say "this is the version that was approved",
	1095	+ // go over untouched.
	1096	+ if ( isset( $data['content'] ) && is_string( $data['content'] ) ) {
	1097	+ $data['content'] = $this->baseline_content( $filename, $data['content'] );
	1098	+ }
	1099	+
	1100	+ $merged[ $filename ] = $data;
	1101	+ }
	1102	+ }
	1103	+
	1104	+ if ( array_diff_key( $merged, $network ) ) {
	1105	+ $this->write_baseline( $merged );
	1106	+ }
	1107	+
	1108	+ if ( ! is_array( $per_site ) ) {
	1109	+ return true;
	1110	+ }
	1111	+
	1112	+ /*
	1113	+ * Is every file this copy had a record of now on the network record?
	1114	+ * Only then may the caller drop it. And the question is asked of what
	1115	+ * is STORED, not of $merged, which is only what this request MEANT to
	1116	+ * store. Asking $merged makes the answer true by construction, because
	1117	+ * the copy is one of the sources above, so the guard could never fire
	1118	+ * and redact_in_place() in the caller was unreachable code.
	1119	+ *
	1120	+ * The write does not always land, and the case that matters is not a
	1121	+ * broken database, it is the same race as the bug this function fixes.
	1122	+ * On a network updating from 2.11.2 the network option does not exist
	1123	+ * yet, so update_network_option() takes the $old_value === false branch
	1124	+ * and delegates to add_network_option() (wp-includes/option.php:2434).
	1125	+ * If another request created the option in between, that call either
	1126	+ * returns false without writing (option.php:2201) or, when this process
	1127	+ * still holds "does not exist" in its own notoptions cache, skips the
	1128	+ * check and INSERTs a second row: wp_sitemeta has no unique index on
	1129	+ * meta_key, so the record ends up duplicated and get_network_option()
	1130	+ * hands back whichever row comes first. Reproduced on the Multisite
	1131	+ * install on 10 sep 2026, with the .htaccess writer of init:20 racing a
	1132	+ * promotion: two rows, the approved hash of wp-config.php out of reach,
	1133	+ * and the per-site copy deleted all the same. Found by a cross review.
	1134	+ *
	1135	+ * Both cache keys go before rereading, and that is not belt and braces.
	1136	+ * add_network_option() caches the value it believes it wrote
	1137	+ * (option.php:2221), so a plain read hands back the very array that did
	1138	+ * not survive; and a stale notoptions would answer "no such option"
	1139	+ * without touching the database, which reads as "nothing is covered".
	1140	+ * Measured: without dropping the cache this guard still returns true.
	1141	+ */
	1142	+ $network_id = get_current_network_id();
	1143	+ wp_cache_delete( $network_id . ':' . self::BASELINE_OPTION, 'site-options' );
	1144	+ wp_cache_delete( $network_id . ':notoptions', 'site-options' );
	1145	+
	1146	+ $stored = get_site_option( self::BASELINE_OPTION, array() );
	1147	+
	1148	+ if ( ! is_array( $stored ) ) {
	1149	+ return false;
	1150	+ }
	1151	+
	1152	+ foreach ( $per_site as $filename => $data ) {
	1153	+ if ( is_array( $data ) && isset( $data['hash'] ) && ! isset( $stored[ $filename ] ) ) {
	1154	+ return false;
	1155	+ }
	1156	+ }
	1157	+
	1158	+ return true;
	1159	+ }
	1160	+
	1161	+ /**
	1162	+ * Strip the secrets from a per-site copy that cannot be dropped yet
	1163	+ *
	1164	+ * The copy stays because it holds the only record of an approved file, but
	1165	+ * what it must not keep for one more minute is the database password and
	1166	+ * the eight keys and salts. The two things are separable and this is where
	1167	+ * they get separated.
	1168	+ *
	1169	+ * @since 2.11.4
	1170	+ *
	1171	+ * @param array $per_site Baseline stored for the current site.
	1172	+ * @return void
	1173	+ */
	1174	+ private function redact_in_place( $per_site ) {
	1175	+ $changed = false;
	1176	+
	1177	+ foreach ( $per_site as $filename => $data ) {
	1178	+ if ( ! is_array( $data ) || ! isset( $data['content'] ) || ! is_string( $data['content'] ) ) {
	1179	+ continue;
	1180	+ }
	1181	+
	1182	+ $safe = $this->baseline_content( $filename, $data['content'] );
	1183	+
	1184	+ if ( $safe !== $data['content'] ) {
	1185	+ $per_site[ $filename ]['content'] = $safe;
	1186	+ $changed = true;
	1187	+ }
	1188	+ }
	1189	+
	1190	+ if ( $changed ) {
	1191	+ update_option( self::BASELINE_OPTION, $per_site );
	1192	+ }
	1193	+ }
	1194	+
	1195	+ /**
	1196	+ * Network option recording the version whose results cleanup walked the network
	1197	+ *
	1198	+ * @since 2.11.8
	1199	+ */
	1200	+ const RESULTS_SWEEP_OPTION = 'vigilante_results_sweep';
	1201	+
	1202	+ /**
	1203	+ * Clean the stored scan results of every site of the network, once per version
	1204	+ *
	1205	+ * redact_stored_results() runs per site from admin_init and from the scan,
	1206	+ * so a subsite with the module off whose dashboard nobody opens kept the
	1207	+ * lines of wp-config.php its last scan stored, with whatever that version
	1208	+ * failed to redact. Same gap 2.11.3 and 2.11.4 closed for the baseline copy;
	1209	+ * found for the results by the cross review of 2.11.8. It runs from the
	1210	+ * network sweep, for a network administrator on the main site, and has its
	1211	+ * own marker because the baseline sweep is already done on every network
	1212	+ * that updated through 2.11.4.
	1213	+ *
	1214	+ * @since 2.11.8
	1215	+ */
	1216	+ private function maybe_sweep_network_results() {
	1217	+ if ( VIGILANTE_VERSION === get_site_option( self::RESULTS_SWEEP_OPTION ) ) {
	1218	+ return;
	1219	+ }
	1220	+
	1221	+ update_site_option( self::RESULTS_SWEEP_OPTION, VIGILANTE_VERSION );
	1222	+
	1223	+ $site_ids = get_sites(
	1224	+ array(
	1225	+ 'fields' => 'ids',
	1226	+ 'number' => 0,
	1227	+ 'network_id' => get_current_network_id(),
	1228	+ 'update_site_meta_cache' => false,
	1229	+ )
	1230	+ );
	1231	+
	1232	+ foreach ( $site_ids as $site_id ) {
	1233	+ switch_to_blog( $site_id );
	1234	+ $this->redact_stored_results();
	1235	+ restore_current_blog();
	1236	+ }
	1237	+ }
	1238	+
	1239	+ /**
	1240	+ * The diff of a shared file as a site that does not own it gets it
	1241	+ *
	1242	+ * No lines, and a flag the screens read to say where the lines are.
	1243	+ *
	1244	+ * @since 2.11.8
	1245	+ *
	1246	+ * @return array
	1247	+ */
	1248	+ public static function network_only_diff() {
	1249	+ return array(
	1250	+ 'added' => array(),
	1251	+ 'removed' => array(),
	1252	+ 'unavailable' => true,
	1253	+ 'network' => true,
	1254	+ );
	1255	+ }
	1256	+
	1257	+ /**
	1258	+ * Take out of the last stored scan what the baseline copy no longer keeps
	1259	+ *
	1260	+ * The results of the last scan are an option of each site, and the diff of
	1261	+ * a critical file travels inside them line by line, redacted the way the
	1262	+ * version that ran the scan redacted. Until 2.11.7 that let FTP_PASS and
	1263	+ * friends through, and on a network every subsite with the module on kept
	1264	+ * its own copy of the lines. This runs once per version with the rest of
	1265	+ * the cleanup:
	1266	+ *
	1267	+ * - Where the shared files do not belong to this site, no line is kept.
	1268	+ * - Lines of wp-config.php are dropped. A single line cannot be read as
	1269	+ * PHP reliably (half a heredoc is just words), and the next scan rebuilds
	1270	+ * them from the whole file.
	1271	+ * - Lines of .htaccess are directives, one per line, and are redacted in
	1272	+ * place.
	1273	+ *
	1274	+ * @since 2.11.8
	1275	+ */
	1276	+ private function redact_stored_results() {
	1277	+ $results = get_option( 'vigilante_last_integrity_results' );
	1278	+
	1279	+ if ( ! is_array( $results ) || empty( $results['modified'] ) || ! is_array( $results['modified'] ) ) {
	1280	+ return;
	1281	+ }
	1282	+
	1283	+ $owns = Vigilante_Settings::owns_shared_files();
	1284	+ $changed = false;
	1285	+
	1286	+ foreach ( $results['modified'] as $index => $item ) {
	1287	+ if ( ! is_array( $item ) || 'critical_config' !== ( $item['type'] ?? '' ) || ! isset( $item['diff'] ) || ! is_array( $item['diff'] ) ) {
	1288	+ continue;
	1289	+ }
	1290	+
	1291	+ if ( ! $owns ) {
	1292	+ if ( empty( $item['diff']['network'] ) ) {
	1293	+ $results['modified'][ $index ]['diff'] = self::network_only_diff();
	1294	+ $changed = true;
	1295	+ }
	1296	+ continue;
	1297	+ }
	1298	+
	1299	+ if ( 'wp-config.php' === ( $item['file'] ?? '' ) ) {
	1300	+ if ( ! empty( $item['diff']['added'] ) || ! empty( $item['diff']['removed'] ) ) {
	1301	+ $results['modified'][ $index ]['diff'] = array(
	1302	+ 'added' => array(),
	1303	+ 'removed' => array(),
	1304	+ 'unavailable' => true,
	1305	+ 'rescan' => true,
	1306	+ );
	1307	+ $changed = true;
	1308	+ }
	1309	+ continue;
	1310	+ }
	1311	+
	1312	+ foreach ( array( 'added', 'removed' ) as $side ) {
	1313	+ if ( empty( $item['diff'][ $side ] ) || ! is_array( $item['diff'][ $side ] ) ) {
	1314	+ continue;
	1315	+ }
	1316	+
	1317	+ foreach ( $item['diff'][ $side ] as $line_index => $line ) {
	1318	+ if ( ! is_array( $line ) || ! isset( $line['content'] ) || ! is_string( $line['content'] ) ) {
	1319	+ continue;
	1320	+ }
	1321	+
	1322	+ $safe = $this->redact_server_secrets( $line['content'] );
	1323	+
	1324	+ if ( $safe !== $line['content'] ) {
	1325	+ $results['modified'][ $index ]['diff'][ $side ][ $line_index ]['content'] = $safe;
	1326	+ $changed = true;
	1327	+ }
	1328	+ }
	1329	+ }
	1330	+ }
	1331	+
	1332	+ if ( $changed ) {
	1333	+ update_option( 'vigilante_last_integrity_results', $results );
	1334	+ }
	1335	+ }
	1336	+
	1337	+ /**
	1338	+ * Clean up what earlier versions stored, wherever they stored it
	1339	+ *
	1340	+ * Two jobs, and the second one only exists on a network.
	1341	+ *
	1342	+ * The first: versions up to 2.11.1 kept the contents of wp-config.php in
	1343	+ * the baseline, credentials included, so what is already on disk is
	1344	+ * redacted in place.
	1345	+ *
	1346	+ * The second: up to 2.11.2 that baseline was a per-site option, so on a
	1347	+ * network every site had its own copy of the same file. This runs per site
	1348	+ * and removes that copy, because the baseline now lives in a single
	1349	+ * network option. Doing it here is what makes the cleanup reach a site
	1350	+ * whose dashboard nobody ever opens: this method is called from the scan
	1351	+ * as well as from admin_init, and the scan runs on every site through
	1352	+ * wp-cron with front-end traffic alone.
	1353	+ *
	1354	+ * The gate option stays per site on purpose. It records that THIS site has
	1355	+ * been cleaned, which is exactly the per-site fact being tracked.
	1356	+ *
	1357	+ * @since 2.11.2
	1358	+ */
	1359	+ public function maybe_redact_stored_baseline() {
	1360	+ if ( VIGILANTE_VERSION === get_option( self::BASELINE_REDACTION_OPTION ) ) {
	1361	+ return;
	1362	+ }
	1363	+
	1364	+ /*
	1365	+ * The per-site copy left behind by 2.11.2 and earlier. On a network it
	1366	+ * holds the database password and the eight keys and salts, so it goes,
	1367	+ * but never before what it records has been carried over:
	1368	+ * promote_per_site_baseline() explains why the record has to outlive
	1369	+ * the copy, and which copy wins when they disagree. Measured on the
	1370	+ * Multisite install while writing 2.11.3: without that, the first scan
	1371	+ * after the migration reported zero modified files where it had to
	1372	+ * report one.
	1373	+ */
	1374	+ $pending = false;
	1375	+
	1376	+ if ( is_multisite() ) {
	1377	+ $per_site = get_option( self::BASELINE_OPTION, null );
	1378	+
	1379	+ if ( null !== $per_site ) {
	1380	+ if ( $this->promote_per_site_baseline( $per_site ) ) {
	1381	+ delete_option( self::BASELINE_OPTION );
	1382	+ } elseif ( is_array( $per_site ) ) {
	1383	+ // Something this copy recorded is not on the network record
	1384	+ // yet, so it does not go: it is the only evidence of what
	1385	+ // was approved. The secrets do go, right now, because that
	1386	+ // part cannot wait for the next pass.
	1387	+ $this->redact_in_place( $per_site );
	1388	+ $pending = true;
	1389	+ }
	1390	+ }
	1391	+ }
	1392	+
	1393	+ $baseline = $this->read_baseline();
	1394	+
	1395	+ if ( is_array( $baseline ) ) {
	1396	+ $changed = false;
	1397	+
	1398	+ foreach ( $baseline as $filename => $data ) {
	1399	+ if ( ! is_array( $data ) || ! isset( $data['content'] ) || ! is_string( $data['content'] ) ) {
	1400	+ continue;
	1401	+ }
	1402	+
	1403	+ $safe = $this->baseline_content( $filename, $data['content'] );
	1404	+
	1405	+ if ( $safe !== $data['content'] ) {
	1406	+ $baseline[ $filename ]['content'] = $safe;
	1407	+ $changed = true;
	1408	+ }
	1409	+ }
	1410	+
	1411	+ if ( $changed ) {
	1412	+ $this->write_baseline( $baseline );
	1413	+ }
	1414	+ }
	1415	+
	1416	+ $this->redact_stored_results();
	1417	+
	1418	+ /*
	1419	+ * The gate does not close while a per-site copy is still waiting to be
	1420	+ * promoted. Closing it would end the retries for a whole version: the
	1421	+ * copy would sit there unread, the file it records would be missing
	1422	+ * from the network record, and the next scan would take whatever is on
	1423	+ * disk as approved. Not closing it is not free, though, and the first
	1424	+ * wording here said "one option read": measured cold on the Multisite
	1425	+ * install, it is 6 SQL queries per admin request against 0 with the gate
	1426	+ * closed, admin-ajax.php and the heartbeat included, two of them from the
	1427	+ * cache invalidation in promote_per_site_baseline(). Acceptable only
	1428	+ * because it converges: the stuck case this guards against resolves on
	1429	+ * the next pass that gets its write through.
	1430	+ */
	1431	+ if ( ! $pending ) {
	1432	+ update_option( self::BASELINE_REDACTION_OPTION, VIGILANTE_VERSION, false );
	1433	+ }
	1434	+ }
	1435	+
	1436	+ /**
	1437	+ * Sweep the whole network once, so it does not wait for each site's cron
	1438	+ *
	1439	+ * The per-site cleanup above reaches a site when that site runs a scan or
	1440	+ * someone opens its dashboard, which on a quiet subsite can take a while.
	1441	+ * This walks every site once and gets it over with, and its marker is a
	1442	+ * network option so it does not repeat per site.
	1443	+ *
	1444	+ * Runs only on the main site of the network, where a network administrator
	1445	+ * works, and only there does it cost anything.
	1446	+ *
	1447	+ * @since 2.11.3
	1448	+ */
	1449	+ public function maybe_sweep_network_baselines() {
	1450	+ if ( ! is_multisite() || ! is_main_site() ) {
	1451	+ return;
	1452	+ }
	1453	+
	1454	+ /*
	1455	+ * A network administrator, and nobody else. admin_init fires for any
	1456	+ * logged-in visitor, a subscriber opening their own profile included,
	1457	+ * and this walks every site of the network writing to each one. What it
	1458	+ * removes is stale data that rebuilds itself, so the harm is small, but
	1459	+ * an action over the whole network belongs to whoever administers the
	1460	+ * network. The surface inventory cannot see this: it reads wp_ajax_*,
	1461	+ * admin_post_* and REST routes, and a hook on admin_init is outside its
	1462	+ * coverage by construction, which is exactly the blind spot written
	1463	+ * down as rule 23.
	1464	+ *
	1465	+ * The per-site cleanup is deliberately not gated the same way: it also
	1466	+ * runs from the scan, under wp-cron with no user at all, and it only
	1467	+ * touches the site it runs on.
	1468	+ */
	1469	+ if ( ! current_user_can( 'manage_network_options' ) ) {
	1470	+ return;
	1471	+ }
	1472	+
	1473	+ $this->maybe_sweep_network_results();
	1474	+
	1475	+ $marker = get_site_option( self::BASELINE_SWEEP_OPTION );
	1476	+
	1477	+ /*
	1478	+ * Two markers, because there are two different things to remember and
	1479	+ * 2.11.3 only remembered one of them.
	1480	+ *
	1481	+ * The walk is marked BEFORE it starts, on purpose: on a very large
	1482	+ * network it may not finish inside one request, and repeating it on
	1483	+ * every admin page load would be worse than leaving the rest to each
	1484	+ * site's own scan. But 2.11.3 wrote VIGILANTE_VERSION there, so an
	1485	+ * interrupted walk was retried by the next release, which was the only
	1486	+ * thing that ever finished it. Writing a fixed literal instead, as the
	1487	+ * first draft of 2.11.4 did, stopped the pointless rearming and took
	1488	+ * that retry away with it: a walk cut short would never be resumed by
	1489	+ * any version. And "each site's own scan cleans the rest" only holds
	1490	+ * where the module is on; with it off, the cleanup is registered under
	1491	+ * is_admin() alone, so a subsite nobody opens is exactly what the sweep
	1492	+ * exists for. Found by a cross review on 10 sep 2026.
	1493	+ *
	1494	+ * So: the running version means "started here and did not finish", and
	1495	+ * the migration literal means "finished, never again".
	1496	+ */
	1497	+ if ( self::BASELINE_SWEEP_MIGRATION === $marker ) {
	1498	+ return;
	1499	+ }
	1500	+
	1501	+ if ( VIGILANTE_VERSION === $marker ) {
	1502	+ return;
	1503	+ }
	1504	+
	1505	+ update_site_option( self::BASELINE_SWEEP_OPTION, VIGILANTE_VERSION );
	1506	+
	1507	+ // Only this network. WP_Site_Query filters by network solely when
	1508	+ // network_id is given, so on a multi-network install the walk would
	1509	+ // otherwise reach the sites of other networks and promote their copies
	1510	+ // into this network's record (get_current_network_id() below does not
	1511	+ // change with switch_to_blog()).
	1512	+ $site_ids = get_sites(
	1513	+ array(
	1514	+ 'fields' => 'ids',
	1515	+ 'number' => 0,
	1516	+ 'network_id' => get_current_network_id(),
	1517	+ 'update_site_meta_cache' => false,
	1518	+ )
	1519	+ );
	1520	+
	1521	+ $pending = 0;
	1522	+
	1523	+ foreach ( $site_ids as $site_id ) {
	1524	+ switch_to_blog( $site_id );
	1525	+
	1526	+ $per_site = get_option( self::BASELINE_OPTION, null );
	1527	+
	1528	+ if ( null !== $per_site ) {
	1529	+ // Same care as the per-site cleanup, and the same helper, so
	1530	+ // the two paths cannot drift apart the way they nearly did.
	1531	+ if ( $this->promote_per_site_baseline( $per_site ) ) {
	1532	+ delete_option( self::BASELINE_OPTION );
	1533	+ } elseif ( is_array( $per_site ) ) {
	1534	+ $this->redact_in_place( $per_site );
	1535	+ $pending++;
	1536	+ }
	1537	+ }
	1538	+
	1539	+ restore_current_blog();
	1540	+ }
	1541	+
	1542	+ // Finished, and with nothing left behind, so it never has to run again
	1543	+ // in any version. A site whose copy could not be promoted keeps the
	1544	+ // marker on the running version instead, which is what gets the walk
	1545	+ // retried by the next release.
	1546	+ if ( ! $pending ) {
	1547	+ update_site_option( self::BASELINE_SWEEP_OPTION, self::BASELINE_SWEEP_MIGRATION );
	1548	+ }
	1549	+ }
	1550	+
	1551	+ /**
86	1552	* Critical root files to monitor against a stored baseline.
87	1553	* These files have no official WordPress.org checksum because their
88	1554	* content is unique per installation.
89	1555	*
		@@ -121,16 +1587,25 @@
121	1587	array( '# BEGIN Vigilante Security Headers', '# END Vigilante Security Headers' ),
122	1588	);
123	1589
124	1590	/**
	1591	+ * Whether the core is being compared with the English checksums because
	1592	+ * WordPress.org has none for the language of the site. Set by
	1593	+ * get_core_checksums().
	1594	+ *
	1595	+ * @var bool
	1596	+ */
	1597	+ private $core_checksums_are_english = false;
	1598	+
	1599	+ /**
125	1600	* Core files known to produce false positives in checksum comparison.
126		- * These are skipped during core scanning (e.g. version.php is rewritten
127		- * during auto-updates and localized installs, readme files vary by locale).
	1601	+ * These are skipped during core scanning: the readme and the license vary
	1602	+ * by locale and are not code. version.php used to be here too, and is now
	1603	+ * compared (see matches_core_of_other_locale()).
128	1604	*
129	1605	* @var array
130	1606	*/
131	1607	private $core_known_false_positives = array(
132		- 'wp-includes/version.php',
133	1608	'readme.html',
134	1609	'license.txt',
135	1610	'licencia.txt',
136	1611	);
		@@ -212,9 +1687,24 @@
212	1687	$this->activity_log = $activity_log;
213	1688	$this->options = $settings ? $settings->get_section( 'file_integrity' ) : array();
214	1689	$this->wp_version = get_bloginfo( 'version' );
215	1690	$this->ignored_files = get_option( 'vigilante_ignored_files', array() );
	1691	+ }
216	1692
	1693	+ /**
	1694	+ * Register the hooks of the scanner itself
	1695	+ *
	1696	+ * Until 2.11.4 all of this lived in the constructor, and the constructor is
	1697	+ * called from a dozen places: the module gate, the activator, the hook that
	1698	+ * runs after Vigilant writes a watched file, and the admin handlers that
	1699	+ * only want the class as a tool. Every
	1700	+ * one of them registered these hooks again, and one runs during admin_init
	1701	+ * itself. Registering apart from constructing means a `new` is only a
	1702	+ * `new`, and it is what lets the cleanup below stand on its own.
	1703	+ *
	1704	+ * @since 2.11.4
	1705	+ */
	1706	+ public function init_hooks() {
217	1707	// Schedule automated scans only if options available
218	1708	if ( ! empty( $this->options['auto_scan'] ) ) {
219	1709	add_action( 'vigilante_file_integrity_scan', array( $this, 'run_scheduled_scan' ) );
220	1710	$this->schedule_scan();
		@@ -229,8 +1719,35 @@
229	1719	add_action( 'vigilante_fi_postupdate_verify', array( $this, 'run_postupdate_verify' ) );
230	1720	}
231	1721
232	1722	/**
	1723	+ * Register the cleanup of what earlier versions stored, module on or off
	1724	+ *
	1725	+ * These two are not integrity monitoring. They take out of the database
	1726	+ * something the plugin stored and should not have, which is the copy of
	1727	+ * wp-config.php carrying the database password and the eight keys and
	1728	+ * salts. Whoever switched the module off did not decide to keep that, and
	1729	+ * for that person the cleanup matters more, not less: they are not going
	1730	+ * to pass through the scanner again.
	1731	+ *
	1732	+ * Until 2.11.4 these were registered in the constructor, so they only ran
	1733	+ * where the module was on. A site with the module off kept the credentials
	1734	+ * with 2.11.3 installed, and a network whose main site had it off lost the
	1735	+ * sweep too, which was the one path that reached the sites nobody visits.
	1736	+ * Reported by @calzbert after reading the 2.11.3 diff.
	1737	+ *
	1738	+ * On admin_init because that is where the baseline is looked at, and it
	1739	+ * does one option read per admin request until it has run once.
	1740	+ *
	1741	+ * @since 2.11.4
	1742	+ */
	1743	+ public function init_cleanup_hooks() {
	1744	+ add_action( 'admin_init', array( $this, 'maybe_redact_stored_baseline' ) );
	1745	+ add_action( 'admin_init', array( $this, 'maybe_sweep_network_baselines' ) );
	1746	+ add_action( 'admin_init', array( $this, 'maybe_claim_owned_blocks_on_admin' ) );
	1747	+ }
	1748	+
	1749	+ /**
233	1750	* Check if scan time limit has been exceeded
234	1751	*
235	1752	* @return bool True if time exceeded.
236	1753	*/
		@@ -298,8 +1815,16 @@
298	1815	$files = array( $hook_extra['plugin'] );
299	1816	}
300	1817	foreach ( $files as $file ) {
301	1818	$slug = dirname( (string) $file );
	1819	+ // Vigilant itself is verified immediately (not after 90 s) by
	1820	+ // Vigilante_Self_Integrity::handle_upgrader() when the
	1821	+ // self-check is on; do not also open a grace window for it.
	1822	+ // Compared with the folder it really lives in, not the literal
	1823	+ // slug, so a renamed folder is skipped the same way.
	1824	+ if ( dirname( VIGILANTE_PLUGIN_BASENAME ) === $slug && Vigilante_Self_Integrity::is_on() ) {
	1825	+ continue;
	1826	+ }
302	1827	if ( '.' !== $slug && '' !== $slug ) {
303	1828	$targets['plugin'][] = $slug;
304	1829	}
305	1830	}
		@@ -368,8 +1893,17 @@
368	1893	*/
369	1894	private function verify_updated_slug( $type, $slug ) {
370	1895	$grace_key = 'vigilante_fi_grace_' . $type . '_' . md5( $slug );
371	1896
	1897	+ // Defensive skip for the first 2.11.x -> 3.0.x update: the OLD code in
	1898	+ // memory scheduled this event including Vigilant's own slug, and by the
	1899	+ // time it fires the NEW code (this one) is running with the self-check
	1900	+ // handling Vigilant on its own.
	1901	+ if ( 'plugin' === $type && dirname( VIGILANTE_PLUGIN_BASENAME ) === $slug && Vigilante_Self_Integrity::is_on() ) {
	1902	+ delete_transient( $grace_key );
	1903	+ return;
	1904	+ }
	1905	+
372	1906	if ( 'plugin' === $type ) {
373	1907	if ( ! function_exists( 'get_plugins' ) ) {
374	1908	require_once ABSPATH . 'wp-admin/includes/plugin.php';
375	1909	}
		@@ -520,8 +2054,56 @@
520	2054
521	2055	// Use settings from options page
522	2056	$options = is_array( $this->options ) ? $this->options : array();
523	2057
	2058	+ // Vigilant self-check runs FIRST and exempt from the time budget:
	2059	+ // ~60 small-file hashes cost < 50 ms and the guardian must never be
	2060	+ // dropped by the budget on plugin-heavy sites. User exclusions do not
	2061	+ // apply to it (see Vigilante_Self_Integrity::run_check()).
	2062	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	2063	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	2064	+ }
	2065	+ if ( Vigilante_Self_Integrity::is_on() ) {
	2066	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	2067	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	2068	+ }
	2069	+ $self = new Vigilante_Self_Integrity( $this->settings, $this->activity_log );
	2070	+ $self_result = $self->run_check( 'scan' );
	2071	+ // run_check() above updates this site's own state (status line and
	2072	+ // the analyzer check keep working everywhere). The plugin files are
	2073	+ // shared by the whole installation, so the self findings are folded
	2074	+ // Self-protection has its own alert, and it does not travel in the
	2075	+ // scan digest any more. That digest is governed by a notification
	2076	+ // setting that can be switched off, and switching off "tell me about
	2077	+ // changed files" was also switching off the alarm of the plugin
	2078	+ // itself. So the findings stay out of the scan results (they have
	2079	+ // their own block in File Integrity, with what each one means and how
	2080	+ // to repair it) and a critical one sends its own email from here,
	2081	+ // wherever the scan runs. maybe_send_self_alert() keeps it to the
	2082	+ // site that owns the shared files and dedupes by set of findings.
	2083	+ foreach ( (array) $self_result['findings'] as $self_finding ) {
	2084	+ if ( 'critical' === ( $self_finding['severity'] ?? '' ) ) {
	2085	+ $self->maybe_send_self_alert( $self_result['findings'], 'scan' );
	2086	+ break;
	2087	+ }
	2088	+ }
	2089	+ }
	2090	+
	2091	+ // What the time does not reach. A scan that runs out of time used to
	2092	+ // say only that it was partial, and it starts from the beginning
	2093	+ // every time, so on a large site the same plugins and themes were
	2094	+ // left out on every scan with nobody told which. They are named.
	2095	+ $not_checked = array(
	2096	+ 'areas' => array(),
	2097	+ 'plugins' => array(),
	2098	+ 'themes' => array(),
	2099	+ );
	2100	+
	2101	+ // And the folders of the plugins and themes it did check, which is
	2102	+ // what the tab offers to exclude so that a scan by hand reaches the
	2103	+ // rest (see folders_to_exclude()).
	2104	+ $checked_folders = array();
	2105	+
524	2106	// Scan uploads for suspicious files FIRST (highest security priority)
525	2107	// PHP files in uploads are almost always malware
526	2108	if ( ! empty( $options['scan_uploads'] ) && ! $this->is_time_exceeded() ) {
527	2109	$upload_results = $this->scan_uploads();
		@@ -526,8 +2108,11 @@
526	2108	if ( ! empty( $options['scan_uploads'] ) && ! $this->is_time_exceeded() ) {
527	2109	$upload_results = $this->scan_uploads();
528	2110	$results['suspicious'] = array_merge( $results['suspicious'], $upload_results['suspicious'] );
529	2111	$results['extra'] = array_merge( $results['extra'], $upload_results['extra'] );
	2112	+ $results['errors'] = array_merge( $results['errors'], $upload_results['errors'] ?? array() );
	2113	+ } elseif ( ! empty( $options['scan_uploads'] ) ) {
	2114	+ $not_checked['areas'][] = 'uploads';
530	2115	}
531	2116
532	2117	// Scan core files
533	2118	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
		@@ -532,8 +2117,10 @@
532	2117	// Scan core files
533	2118	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
534	2119	$core_results = $this->scan_core_files();
535	2120	$results = $this->merge_results( $results, $core_results );
	2121	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2122	+ $not_checked['areas'][] = 'core';
536	2123	}
537	2124
538	2125	// Scan root directory for non-core files (PHP = suspicious, others = additional)
539	2126	// Runs after core scan so checksums are already cached
		@@ -540,20 +2127,61 @@
540	2127	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
541	2128	$root_results = $this->scan_root_files();
542	2129	$results['suspicious'] = array_merge( $results['suspicious'], $root_results['suspicious'] );
543	2130	$results['extra'] = array_merge( $results['extra'], $root_results['extra'] );
	2131	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2132	+ $not_checked['areas'][] = 'core';
544	2133	}
545	2134
	2135	+ // Files added to wp-admin or wp-includes, which the comparison with
	2136	+ // the checksums never visits because the checksums do not name them.
	2137	+ if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
	2138	+ $folder_results = $this->scan_core_folders();
	2139	+ $results['suspicious'] = array_merge( $results['suspicious'], $folder_results['suspicious'] );
	2140	+ $results['extra'] = array_merge( $results['extra'], $folder_results['extra'] );
	2141	+ $results['errors'] = array_merge( $results['errors'], $folder_results['errors'] );
	2142	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2143	+ $not_checked['areas'][] = 'core';
	2144	+ }
	2145	+
546	2146	// Scan critical config files (wp-config.php, .htaccess) against stored baseline
547	2147	if ( ! empty( $options['scan_critical_config'] ) && ! $this->is_time_exceeded() ) {
548	2148	$critical_results = $this->scan_critical_root_files();
549	2149	$results['modified'] = array_merge( $results['modified'], $critical_results );
	2150	+ } elseif ( ! empty( $options['scan_critical_config'] ) ) {
	2151	+ $not_checked['areas'][] = 'config';
550	2152	}
551	2153
	2154	+ // The other folders of wp-content (cache, languages, upgrade and
	2155	+ // whatever else is there), which belong to no plugin and no theme and
	2156	+ // had no turn. Before the plugins and the themes, which on a large
	2157	+ // site can use up the whole scan, and with a share of the time of
	2158	+ // their own, so a cache of a hundred thousand files cannot do the
	2159	+ // same to them.
	2160	+ $content_results = null;
	2161	+ if ( ! empty( $options['scan_plugins'] ) && ! $this->is_time_exceeded() ) {
	2162	+ $content_results = $this->scan_content_folders();
	2163	+ $results['suspicious'] = array_merge( $results['suspicious'], $content_results['suspicious'] );
	2164	+ $results['extra'] = array_merge( $results['extra'], $content_results['extra'] );
	2165	+ $results['errors'] = array_merge( $results['errors'], $content_results['errors'] );
	2166	+ } elseif ( ! empty( $options['scan_plugins'] ) ) {
	2167	+ $not_checked['areas'][] = 'content';
	2168	+ }
	2169	+
552	2170	// Scan plugins
553	2171	if ( ! empty( $options['scan_plugins'] ) && ! $this->is_time_exceeded() ) {
554	2172	$plugin_results = $this->scan_plugins();
555	2173	$results = $this->merge_results( $results, $plugin_results );
	2174	+
	2175	+ $not_checked['plugins'] = $plugin_results['not_checked'] ?? array();
	2176	+ $checked_folders = $plugin_results['checked'] ?? array();
	2177	+
	2178	+ if ( empty( $plugin_results['unlisted_checked'] ) ) {
	2179	+ $not_checked['areas'][] = 'unlisted';
	2180	+ }
	2181	+ } elseif ( ! empty( $options['scan_plugins'] ) ) {
	2182	+ $not_checked['areas'][] = 'plugins';
	2183	+ $not_checked['areas'][] = 'unlisted';
556	2184	}
557	2185
558	2186	// Scan themes
559	2187	if ( ! empty( $options['scan_themes'] ) && ! $this->is_time_exceeded() ) {
		@@ -558,10 +2186,21 @@
558	2186	// Scan themes
559	2187	if ( ! empty( $options['scan_themes'] ) && ! $this->is_time_exceeded() ) {
560	2188	$theme_results = $this->scan_themes();
561	2189	$results = $this->merge_results( $results, $theme_results );
	2190	+
	2191	+ $not_checked['themes'] = $theme_results['not_checked'] ?? array();
	2192	+ $checked_folders = array_merge( $checked_folders, $theme_results['checked'] ?? array() );
	2193	+ } elseif ( ! empty( $options['scan_themes'] ) ) {
	2194	+ $not_checked['areas'][] = 'themes';
562	2195	}
563	2196
	2197	+ // What could only be searched for hidden code: plugins and themes
	2198	+ // first, as they are found, and the folders of wp-content after them.
	2199	+ if ( null !== $content_results ) {
	2200	+ $results['unverified'] = array_values( array_unique( array_merge( $results['unverified'] ?? array(), $content_results['unverified'] ) ) );
	2201	+ }
	2202	+
564	2203	// Mark as incomplete if time was exceeded
565	2204	if ( $this->is_time_exceeded() ) {
566	2205	$results['incomplete'] = true;
567	2206	$results['errors'][] = __( 'Scan was incomplete due to time limit. Results may be partial.', 'vigilante' );
		@@ -566,8 +2205,19 @@
566	2205	$results['incomplete'] = true;
567	2206	$results['errors'][] = __( 'Scan was incomplete due to time limit. Results may be partial.', 'vigilante' );
568	2207	}
569	2208
	2209	+ // Stored after the last merge: merge_results() keeps only the keys it
	2210	+ // knows.
	2211	+ $not_checked['areas'] = array_values( array_unique( $not_checked['areas'] ) );
	2212	+ $results['not_checked'] = $not_checked;
	2213	+
	2214	+ // Only with plugins or themes left out: a scan that reached them all
	2215	+ // has nothing to make room for.
	2216	+ if ( ! empty( $not_checked['plugins'] ) || ! empty( $not_checked['themes'] ) || array_intersect( array( 'plugins', 'themes' ), $not_checked['areas'] ) ) {
	2217	+ $results['checked_folders'] = array_values( array_unique( $checked_folders ) );
	2218	+ }
	2219	+
570	2220	// Filter out ignored files from all result categories
571	2221	$results['modified'] = $this->filter_ignored( $results['modified'] );
572	2222	$results['suspicious'] = $this->filter_ignored( $results['suspicious'] );
573	2223	$results['extra'] = $this->filter_ignored( $results['extra'] );
		@@ -578,14 +2228,21 @@
578	2228	if ( $this->activity_log ) {
579	2229	$has_issues = ! empty( $results['modified'] ) || ! empty( $results['suspicious'] ) || ! empty( $results['extra'] );
580	2230	$severity = $has_issues ? 'warning' : 'info';
581	2231
	2232	+ /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
	2233	+ $log_text = __( 'File integrity scan completed: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' );
	2234	+
	2235	+ if ( $results['incomplete'] ) {
	2236	+ /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
	2237	+ $log_text = __( 'File integrity scan ran out of time, so its result is partial: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' );
	2238	+ }
	2239	+
582	2240	$this->activity_log->log(
583	2241	'file',
584	2242	'integrity_scan',
585	2243	sprintf(
586		- /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
587		- __( 'File integrity scan completed: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' ),
	2244	+ $log_text,
588	2245	$results['scanned'],
589	2246	count( $results['modified'] ),
590	2247	count( $results['suspicious'] ),
591	2248	count( $results['extra'] )
		@@ -640,9 +2297,10 @@
640	2297	'errors' => array(),
641	2298	);
642	2299
643	2300	// Get official checksums from WordPress.org
644		- $checksums = $this->get_core_checksums();
	2301	+ $this->core_checksums_are_english = false;
	2302	+ $checksums = $this->get_core_checksums();
645	2303
646	2304	if ( is_wp_error( $checksums ) ) {
647	2305	$results['errors'][] = $checksums->get_error_message();
648	2306	return $results;
		@@ -647,8 +2305,37 @@
647	2305	$results['errors'][] = $checksums->get_error_message();
648	2306	return $results;
649	2307	}
650	2308
	2309	+ // The plugins and themes that get a turn of their own in this scan.
	2310	+ $own_turn = array(
	2311	+ 'plugins' => array(),
	2312	+ 'themes' => array(),
	2313	+ );
	2314	+
	2315	+ if ( ! empty( $this->options['scan_plugins'] ) ) {
	2316	+ if ( ! function_exists( 'get_plugins' ) ) {
	2317	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	2318	+ }
	2319	+
	2320	+ foreach ( array_keys( get_plugins() ) as $plugin_file ) {
	2321	+ $slash = strpos( $plugin_file, '/' );
	2322	+
	2323	+ if ( false !== $slash ) {
	2324	+ $own_turn['plugins'][ substr( $plugin_file, 0, $slash ) ] = true;
	2325	+ }
	2326	+ }
	2327	+ }
	2328	+
	2329	+ if ( ! empty( $this->options['scan_themes'] ) ) {
	2330	+ foreach ( array_keys( wp_get_themes() ) as $stylesheet ) {
	2331	+ $stylesheet = (string) $stylesheet;
	2332	+ $slash = strpos( $stylesheet, '/' );
	2333	+
	2334	+ $own_turn['themes'][ false === $slash ? $stylesheet : substr( $stylesheet, 0, $slash ) ] = true;
	2335	+ }
	2336	+ }
	2337	+
651	2338	foreach ( $checksums as $file => $expected_hash ) {
652	2339	// Check time limit
653	2340	if ( $this->is_time_exceeded() ) {
654	2341	break;
		@@ -665,9 +2352,9 @@
665	2352	if ( $this->is_extension_excluded( $file_path ) ) {
666	2353	continue;
667	2354	}
668	2355
669		- // Skip known false positives (e.g. version.php, readme.html)
	2356	+ // Skip known false positives (e.g. readme.html, license.txt)
670	2357	if ( in_array( $file, $this->core_known_false_positives, true ) ) {
671	2358	continue;
672	2359	}
673	2360
		@@ -682,8 +2369,30 @@
682	2369	|| 0 === strpos( $file, 'wp-content/languages/themes/' ) ) {
683	2370	continue;
684	2371	}
685	2372
	2373	+ // The bundled themes and plugins have their own turn. Akismet and
	2374	+ // the default themes are in this list at the version WordPress
	2375	+ // shipped, and they update on their own cycle: every one of those
	2376	+ // updates showed as a modified core file, and deleting one that is
	2377	+ // not in use as missing core files. The plugin and theme scans
	2378	+ // compare them with their own published copy, so they are left to
	2379	+ // those whenever those are on and have them in their list.
	2380	+ if ( preg_match( '#^wp-content/(plugins|themes)/([^/]+)/#', $file, $bundled ) ) {
	2381	+ // Deleted on purpose: nothing to compare and nothing missing.
	2382	+ if ( ! is_dir( ABSPATH . 'wp-content/' . $bundled[1] . '/' . $bundled[2] ) ) {
	2383	+ continue;
	2384	+ }
	2385	+
	2386	+ // Its own scan compares it, but only what WordPress lists as a
	2387	+ // plugin or as a theme gets that turn. A folder that is there
	2388	+ // and is not listed (a plugin without its header, a theme
	2389	+ // without its style.css) stays with the core.
	2390	+ if ( isset( $own_turn[ $bundled[1] ][ $bundled[2] ] ) ) {
	2391	+ continue;
	2392	+ }
	2393	+ }
	2394	+
686	2395	$results['scanned']++;
687	2396
688	2397	if ( ! file_exists( $file_path ) ) {
689	2398	$results['missing'][] = array(
		@@ -694,9 +2403,22 @@
694	2403	}
695	2404
696	2405	$actual_hash = md5_file( $file_path );
697	2406
698		- if ( $actual_hash !== $expected_hash ) {
	2407	+ if ( $actual_hash !== $expected_hash && ! $this->matches_core_of_other_locale( $file, $actual_hash ) ) {
	2408	+ // The two files a translated package changes cannot be told
	2409	+ // from a modified one while only the English list exists. Said
	2410	+ // as what it is, a file that could not be verified, instead of
	2411	+ // as a modified core file.
	2412	+ if ( $this->core_checksums_are_english && in_array( $file, array( 'wp-includes/version.php', 'wp-config-sample.php' ), true ) ) {
	2413	+ $results['errors'][] = sprintf(
	2414	+ /* translators: %s: File name */
	2415	+ __( '%s differs from the English package of WordPress, and WordPress.org has not published the checksums for the language of this site yet, so it could not be verified.', 'vigilante' ),
	2416	+ $file
	2417	+ );
	2418	+ continue;
	2419	+ }
	2420	+
699	2421	$results['modified'][] = array(
700	2422	'file' => $file,
701	2423	'type' => 'core',
702	2424	'expected_hash' => $expected_hash,
		@@ -810,9 +2532,9 @@
810	2532
811	2533	// Also add wp-config.php which is not in checksums but is core
812	2534	$core_root_files[] = 'wp-config.php';
813	2535
814		- $php_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar', 'phps' );
	2536	+ $php_extensions = self::php_extensions();
815	2537
816	2538	// Scan only direct children of ABSPATH (not recursive)
817	2539	$root_path = untrailingslashit( ABSPATH );
818	2540	$handle = opendir( $root_path );
		@@ -830,9 +2552,22 @@
830	2552	if ( '.' === $entry || '..' === $entry ) {
831	2553	continue;
832	2554	}
833	2555
834		- // Skip dotfiles (.htaccess, .user.ini, .env, etc.) — handled by firewall protection
	2556	+ // PHP reads .user.ini and php.ini from the folder of the script, and
	2557	+ // either can make it load a file before every request: the same
	2558	+ // door as .htaccess, for servers that run PHP outside Apache.
	2559	+ if ( in_array( strtolower( $entry ), array( '.user.ini', 'php.ini' ), true ) ) {
	2560	+ $config = $this->is_path_excluded( $root_path . '/' . $entry ) ? null : self::server_config_finding( $root_path . '/' . $entry, $entry );
	2561	+
	2562	+ if ( $config ) {
	2563	+ $config['item']['type'] = 'php_config_in_root';
	2564	+ $found['extra'][] = $config['item'];
	2565	+ }
	2566	+ continue;
	2567	+ }
	2568	+
	2569	+ // Skip dotfiles (.htaccess, .env, etc.): handled by firewall protection
835	2570	if ( 0 === strpos( $entry, '.' ) ) {
836	2571	continue;
837	2572	}
838	2573
		@@ -857,8 +2592,13 @@
857	2592	if ( in_array( strtolower( $entry ), $this->known_safe_root_files, true ) ) {
858	2593	continue;
859	2594	}
860	2595
	2596	+ // Site verification files and sitemaps that are what their name says.
	2597	+ if ( self::is_harmless_root_file( $entry, $full_path ) ) {
	2598	+ continue;
	2599	+ }
	2600	+
861	2601	$extension = strtolower( pathinfo( $entry, PATHINFO_EXTENSION ) );
862	2602
863	2603	if ( in_array( $extension, $php_extensions, true ) ) {
864	2604	// Check if this is a legacy WordPress core file (removed from newer versions)
		@@ -880,15 +2620,12 @@
880	2620	// PHP file not in core = suspicious
881	2621	$reason = __( 'Non-core PHP file in WordPress root directory', 'vigilante' );
882	2622
883	2623	// Scan content for specific patterns
884		- if ( filesize( $full_path ) < 512000 ) {
885		- $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
886		- $pattern = $this->detect_suspicious_pattern( $content );
887		- if ( $pattern ) {
888		- /* translators: %s: Suspicious pattern found */
889		- $reason = sprintf( __( 'Non-core PHP in root with suspicious code: %s', 'vigilante' ), $pattern );
890		- }
	2624	+ $pattern = $this->search_file( $full_path );
	2625	+ if ( $pattern ) {
	2626	+ /* translators: %s: Suspicious pattern found */
	2627	+ $reason = sprintf( __( 'Non-core PHP in root with suspicious code: %s', 'vigilante' ), $pattern );
891	2628	}
892	2629
893	2630	$found['suspicious'][] = array(
894	2631	'file' => $entry,
		@@ -895,8 +2632,20 @@
895	2632	'type' => 'php_in_root',
896	2633	'reason' => $reason,
897	2634	);
898	2635	} else {
	2636	+ // A copy of the configuration, a database dump or an archive
	2637	+ // is not one more loose file: whoever guesses its name can
	2638	+ // download it.
	2639	+ if ( false !== stripos( $entry, 'wp-config' ) || preg_match( '/\.(?:sql|bak|old|orig|save|swp|dump|zip|gz|tgz|tar|7z|rar)$/i', $entry ) ) {
	2640	+ $found['extra'][] = array(
	2641	+ 'file' => $entry,
	2642	+ 'type' => 'backup_in_root',
	2643	+ 'reason' => __( 'Backup or copy of a sensitive file in the site root, where it can be downloaded', 'vigilante' ),
	2644	+ );
	2645	+ continue;
	2646	+ }
	2647	+
899	2648	// Non-PHP, non-known-safe file = additional (informational)
900	2649	$found['extra'][] = array(
901	2650	'file' => $entry,
902	2651	'type' => 'extra_root',
		@@ -909,8 +2658,864 @@
909	2658
910	2659	return $found;
911	2660	}
912	2661
	2662	+ /**
	2663	+ * The line of a .user.ini or php.ini that makes PHP load a file by itself
	2664	+ *
	2665	+ * @param string $path Absolute path of the file.
	2666	+ * @return string|null The line, an empty string when there is none, or
	2667	+ * null when the file is too large to be read, which
	2668	+ * the caller reports instead of taking for clean.
	2669	+ */
	2670	+ private static function php_ini_loads( $path ) {
	2671	+ // PHP runs as the same user: what it cannot read here it cannot apply.
	2672	+ if ( ! is_readable( $path ) ) {
	2673	+ return '';
	2674	+ }
	2675	+
	2676	+ if ( filesize( $path ) > MB_IN_BYTES ) {
	2677	+ return null;
	2678	+ }
	2679	+
	2680	+ $content = file_get_contents( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look at its directives; nothing is written.
	2681	+
	2682	+ foreach ( preg_split( '/\r\n|\r|\n/', (string) $content ) as $line ) {
	2683	+ $line = trim( $line );
	2684	+
	2685	+ if ( '' === $line || ';' === $line[0] || '#' === $line[0] ) {
	2686	+ continue;
	2687	+ }
	2688	+
	2689	+ if ( preg_match( '/^(auto_prepend_file|auto_append_file)\s*=\s*(.*)$/i', $line, $parts ) ) {
	2690	+ $value = trim( $parts[2], " \t\"'" );
	2691	+
	2692	+ if ( '' !== $value && 'none' !== strtolower( $value ) ) {
	2693	+ return strtolower( $parts[1] ) . ' = ' . substr( $value, 0, 200 );
	2694	+ }
	2695	+ }
	2696	+ }
	2697	+
	2698	+ return '';
	2699	+ }
	2700	+
	2701	+ /**
	2702	+ * What a .htaccess, .user.ini or php.ini outside uploads makes the server do
	2703	+ *
	2704	+ * Inside a plugin, a theme, wp-content or a WordPress folder, one of these
	2705	+ * files is a finding only when it makes the server run code or load a file.
	2706	+ * One that denies access, or does nothing of the kind, is left alone.
	2707	+ *
	2708	+ * @param string $file_path Absolute path.
	2709	+ * @param string $relative Path for display.
	2710	+ * @return array|null Array with 'category' and 'item', or null.
	2711	+ */
	2712	+ private static function server_config_finding( $file_path, $relative ) {
	2713	+ $item = array(
	2714	+ 'file' => $relative,
	2715	+ 'type' => 'server_config',
	2716	+ );
	2717	+
	2718	+ if ( '.htaccess' === strtolower( basename( $file_path ) ) ) {
	2719	+ if ( ! is_readable( $file_path ) ) {
	2720	+ return null;
	2721	+ }
	2722	+
	2723	+ if ( filesize( $file_path ) >= 65536 ) {
	2724	+ $item['reason'] = __( '.htaccess file that is too large to be read', 'vigilante' );
	2725	+
	2726	+ return array(
	2727	+ 'category' => 'extra',
	2728	+ 'item' => $item,
	2729	+ );
	2730	+ }
	2731	+
	2732	+ $facts = self::read_htaccess_rules( file_get_contents( $file_path ) ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look at its directives; nothing is written.
	2733	+
	2734	+ if ( empty( $facts['runs'] ) ) {
	2735	+ return null;
	2736	+ }
	2737	+
	2738	+ $item['reason'] = self::htaccess_run_reason( $facts );
	2739	+
	2740	+ return array(
	2741	+ 'category' => 'suspicious',
	2742	+ 'item' => $item,
	2743	+ );
	2744	+ }
	2745	+
	2746	+ $loads = self::php_ini_loads( $file_path );
	2747	+
	2748	+ if ( '' === $loads ) {
	2749	+ return null;
	2750	+ }
	2751	+
	2752	+ $item['reason'] = null === $loads
	2753	+ ? __( 'PHP configuration file that is too large to be read', 'vigilante' )
	2754	+ /* translators: %s: The line of the file that does it */
	2755	+ : sprintf( __( 'PHP configuration file that loads a file on every request: %s', 'vigilante' ), $loads );
	2756	+
	2757	+ return array(
	2758	+ 'category' => 'extra',
	2759	+ 'item' => $item,
	2760	+ );
	2761	+ }
	2762	+
	2763	+ /**
	2764	+ * Whether a loose file in the site root is a verification file or a sitemap
	2765	+ *
	2766	+ * By what it contains or by its kind, never by its name alone: a Google
	2767	+ * verification file is one line that repeats its own name, and a sitemap
	2768	+ * is XML, which no server runs.
	2769	+ *
	2770	+ * @param string $entry File name.
	2771	+ * @param string $full_path Absolute path.
	2772	+ * @return bool
	2773	+ */
	2774	+ private static function is_harmless_root_file( $entry, $full_path ) {
	2775	+ if ( preg_match( '/^[a-z0-9_-]*sitemap[a-z0-9_-]*\.xml(?:\.gz)?$/i', $entry ) ) {
	2776	+ return true;
	2777	+ }
	2778	+
	2779	+ if ( preg_match( '/^google[0-9a-f]{16}\.html$/', $entry ) && is_readable( $full_path ) && filesize( $full_path ) < 200 ) {
	2780	+ $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to compare it with its own name; nothing is written.
	2781	+
	2782	+ return 'google-site-verification: ' . $entry === trim( (string) $content );
	2783	+ }
	2784	+
	2785	+ return false;
	2786	+ }
	2787	+
	2788	+ /**
	2789	+ * Walk a folder and everything under it without stopping at what cannot be read
	2790	+ *
	2791	+ * A folder PHP cannot open used to end the whole walk in silence, which is
	2792	+ * all it took to blind a scan: one unreadable folder early in the order,
	2793	+ * and nothing after it was looked at. Now the walk goes past it, and the
	2794	+ * caller reports it (see unreadable_folder_error()).
	2795	+ *
	2796	+ * @param string $directory Folder to walk.
	2797	+ * @param callable|null $skip Given the path of a folder, whether to leave
	2798	+ * it and everything under it out of the walk.
	2799	+ * @return RecursiveIteratorIterator Folders included: the caller skips them.
	2800	+ */
	2801	+ private static function walk_folder( $directory, $skip = null ) {
	2802	+ $folder = new RecursiveDirectoryIterator( $directory, RecursiveDirectoryIterator::SKIP_DOTS );
	2803	+
	2804	+ if ( null !== $skip ) {
	2805	+ $folder = new RecursiveCallbackFilterIterator(
	2806	+ $folder,
	2807	+ static function ( $current ) use ( $skip ) {
	2808	+ return ! ( $current->isDir() && call_user_func( $skip, $current->getPathname() ) );
	2809	+ }
	2810	+ );
	2811	+ }
	2812	+
	2813	+ return new RecursiveIteratorIterator(
	2814	+ $folder,
	2815	+ RecursiveIteratorIterator::SELF_FIRST,
	2816	+ RecursiveIteratorIterator::CATCH_GET_CHILD
	2817	+ );
	2818	+ }
	2819	+
	2820	+ /**
	2821	+ * What the scan says about a folder it could not read
	2822	+ *
	2823	+ * @param string $path Absolute path of the folder.
	2824	+ * @return string
	2825	+ */
	2826	+ private static function unreadable_folder_error( $path ) {
	2827	+ return sprintf(
	2828	+ /* translators: %s: Folder path */
	2829	+ __( 'The folder %s could not be read, so what is inside it was not checked.', 'vigilante' ),
	2830	+ str_replace( ABSPATH, '', $path )
	2831	+ );
	2832	+ }
	2833	+
	2834	+ /**
	2835	+ * Extensions a server may be set up to run as PHP
	2836	+ *
	2837	+ * One list for uploads, the site root, the core folders and the plugin and
	2838	+ * theme folders. Each had its own until now, and none had them all.
	2839	+ *
	2840	+ * @return array
	2841	+ */
	2842	+ private static function php_extensions() {
	2843	+ return array( 'php', 'php2', 'php3', 'php4', 'php5', 'php6', 'php7', 'php8', 'phtml', 'pht', 'phar', 'phps', 'inc' );
	2844	+ }
	2845	+
	2846	+ /**
	2847	+ * Look in wp-admin and wp-includes for files WordPress does not ship
	2848	+ *
	2849	+ * The comparison with the official checksums only visits the files the
	2850	+ * checksums name, so a file added to either folder was never looked at. A
	2851	+ * PHP file there that is not part of the installed version is reported as
	2852	+ * suspicious. A file that changes how the server runs code (.htaccess,
	2853	+ * .user.ini, php.ini) is reported as extra, or as suspicious when it
	2854	+ * makes the server run code. Anything else that is not code, such as an
	2855	+ * error log the host writes there, is left alone.
	2856	+ *
	2857	+ * @return array Array with 'suspicious', 'extra' and 'errors' sub-arrays.
	2858	+ */
	2859	+ private function scan_core_folders() {
	2860	+ $found = array(
	2861	+ 'suspicious' => array(),
	2862	+ 'extra' => array(),
	2863	+ 'errors' => array(),
	2864	+ );
	2865	+
	2866	+ $checksums = $this->get_core_checksums();
	2867	+ if ( is_wp_error( $checksums ) ) {
	2868	+ return $found;
	2869	+ }
	2870	+
	2871	+ $php_extensions = self::php_extensions();
	2872	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	2873	+
	2874	+ foreach ( array( 'wp-admin', 'wp-includes' ) as $folder ) {
	2875	+ $directory = ABSPATH . $folder;
	2876	+
	2877	+ if ( ! is_dir( $directory ) ) {
	2878	+ continue;
	2879	+ }
	2880	+
	2881	+ try {
	2882	+ foreach ( self::walk_folder( $directory ) as $file ) {
	2883	+ if ( $this->is_time_exceeded() ) {
	2884	+ break 2;
	2885	+ }
	2886	+
	2887	+ $file_path = $file->getPathname();
	2888	+
	2889	+ if ( $file->isDir() ) {
	2890	+ if ( ! $file->isReadable() ) {
	2891	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	2892	+ }
	2893	+ continue;
	2894	+ }
	2895	+
	2896	+ $relative = $this->normalize_rel_path( str_replace( '\\', '/', str_replace( ABSPATH, '', $file_path ) ) );
	2897	+
	2898	+ if ( isset( $checksums[ $relative ] ) || $this->is_path_excluded( $file_path ) ) {
	2899	+ continue;
	2900	+ }
	2901	+
	2902	+ $extension = strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) );
	2903	+
	2904	+ if ( in_array( $extension, $php_extensions, true ) ) {
	2905	+ // The placeholder some hosts and tools drop in every folder.
	2906	+ if ( $this->is_silence_golden_file( $file_path ) ) {
	2907	+ continue;
	2908	+ }
	2909	+
	2910	+ // Translation files, on the installations old enough
	2911	+ // to keep them in wp-includes/languages: text and
	2912	+ // nothing else, which is checked and not assumed.
	2913	+ if ( self::is_inside_languages( $file_path ) && true === $this->is_literal_data( $file_path ) ) {
	2914	+ continue;
	2915	+ }
	2916	+
	2917	+ /* translators: %s: Folder name, wp-admin or wp-includes */
	2918	+ $reason = sprintf( __( 'File in %s that is not part of the installed WordPress version', 'vigilante' ), $folder );
	2919	+
	2920	+ $pattern = $this->search_file( $file_path );
	2921	+ if ( $pattern ) {
	2922	+ /* translators: 1: Folder name, wp-admin or wp-includes, 2: Suspicious pattern found */
	2923	+ $reason = sprintf( __( 'File in %1$s that is not part of WordPress, with suspicious code: %2$s', 'vigilante' ), $folder, $pattern );
	2924	+ }
	2925	+
	2926	+ $found['suspicious'][] = array(
	2927	+ 'file' => $relative,
	2928	+ 'type' => 'php_in_core',
	2929	+ 'reason' => $reason,
	2930	+ );
	2931	+ } elseif ( in_array( strtolower( basename( $file_path ) ), $config_files, true ) ) {
	2932	+ $config = self::server_config_finding( $file_path, $relative );
	2933	+
	2934	+ if ( $config && 'suspicious' === $config['category'] ) {
	2935	+ $found['suspicious'][] = $config['item'];
	2936	+ continue;
	2937	+ }
	2938	+
	2939	+ $found['extra'][] = array(
	2940	+ 'file' => $relative,
	2941	+ 'type' => 'config_in_core',
	2942	+ /* translators: %s: Folder name, wp-admin or wp-includes */
	2943	+ 'reason' => $config ? $config['item']['reason'] : sprintf( __( 'Server configuration file in %s', 'vigilante' ), $folder ),
	2944	+ );
	2945	+ }
	2946	+ }
	2947	+ } catch ( Exception $e ) {
	2948	+ $found['errors'][] = self::unreadable_folder_error( $directory );
	2949	+ }
	2950	+ }
	2951	+
	2952	+ return $found;
	2953	+ }
	2954	+
	2955	+ /**
	2956	+ * Look for code where there is no official copy to compare with
	2957	+ *
	2958	+ * Must-use plugins, drop-ins, the loose PHP files of wp-content, of the
	2959	+ * plugins folder and of the themes folder, and the folders in those two
	2960	+ * that WordPress does not list as a plugin or as a theme, were not opened
	2961	+ * by any part of the scan, although WordPress loads some of them on every
	2962	+ * request and the rest can be reached by their address. They are searched
	2963	+ * the way a plugin from outside WordPress.org is, for code written the way
	2964	+ * malware hides itself. A loose PHP file or a folder with PHP that is
	2965	+ * neither a plugin, a theme nor a drop-in is listed as extra, and so is a
	2966	+ * .htaccess, .user.ini or php.ini there that makes the server run code or
	2967	+ * load a file.
	2968	+ *
	2969	+ * @return array Array with 'suspicious', 'extra', 'unverified' and 'errors' sub-arrays.
	2970	+ */
	2971	+ private function scan_unlisted_code() {
	2972	+ $found = array(
	2973	+ 'suspicious' => array(),
	2974	+ 'extra' => array(),
	2975	+ 'unverified' => array(),
	2976	+ 'errors' => array(),
	2977	+ );
	2978	+
	2979	+ // Must-use plugins: the whole folder.
	2980	+ if ( defined( 'WPMU_PLUGIN_DIR' ) && is_dir( WPMU_PLUGIN_DIR ) ) {
	2981	+ $mu = $this->detect_extra_files( WPMU_PLUGIN_DIR, array(), 'plugin', __( 'Must-use plugins', 'vigilante' ), true );
	2982	+
	2983	+ $found['suspicious'] = array_merge( $found['suspicious'], $mu['suspicious'] );
	2984	+ $found['extra'] = array_merge( $found['extra'], $mu['extra'] );
	2985	+ $found['errors'] = array_merge( $found['errors'], $mu['errors'] );
	2986	+
	2987	+ if ( $mu['php_files'] > 0 ) {
	2988	+ $found['unverified'][] = __( 'Must-use plugins', 'vigilante' );
	2989	+ }
	2990	+ }
	2991	+
	2992	+ if ( ! function_exists( '_get_dropins' ) || ! function_exists( 'get_plugins' ) ) {
	2993	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	2994	+ }
	2995	+
	2996	+ $php_extensions = self::php_extensions();
	2997	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	2998	+ $dropins = array_keys( _get_dropins() );
	2999	+
	3000	+ // What WordPress lists as a plugin or as a theme, by the file or the
	3001	+ // folder it lives in.
	3002	+ $single_plugins = array();
	3003	+ $plugin_folders = array();
	3004	+ foreach ( get_plugins() as $plugin_file => $plugin_data ) {
	3005	+ if ( false === strpos( $plugin_file, '/' ) ) {
	3006	+ $single_plugins[ $plugin_file ] = $plugin_data['Name'] ?? $plugin_file;
	3007	+ } else {
	3008	+ $plugin_folders[ substr( $plugin_file, 0, strpos( $plugin_file, '/' ) ) ] = true;
	3009	+ }
	3010	+ }
	3011	+
	3012	+ // The themes by where they really are, because there can be more
	3013	+ // than one folder of themes and the same name in two of them.
	3014	+ $theme_folders = array();
	3015	+ foreach ( wp_get_themes() as $stylesheet => $theme ) {
	3016	+ $stylesheet = (string) $stylesheet;
	3017	+ $slash = strpos( $stylesheet, '/' );
	3018	+ $real = realpath( untrailingslashit( $theme->get_theme_root() ) . '/' . ( false === $slash ? $stylesheet : substr( $stylesheet, 0, $slash ) ) );
	3019	+
	3020	+ if ( false !== $real ) {
	3021	+ $theme_folders[ wp_normalize_path( $real ) ] = true;
	3022	+ }
	3023	+ }
	3024	+
	3025	+ $roots = array(
	3026	+ array( 'content', WP_CONTENT_DIR ),
	3027	+ array( 'plugins', WP_PLUGIN_DIR ),
	3028	+ );
	3029	+
	3030	+ // Every folder themes are registered in, not only the usual one. One
	3031	+ // that is inside a plugin belongs to that plugin, and has its turn
	3032	+ // with it.
	3033	+ global $wp_theme_directories;
	3034	+
	3035	+ $plugin_roots = array();
	3036	+ foreach ( array( WP_PLUGIN_DIR, defined( 'WPMU_PLUGIN_DIR' ) ? WPMU_PLUGIN_DIR : '' ) as $plugin_root ) {
	3037	+ $real = '' === (string) $plugin_root ? false : realpath( $plugin_root );
	3038	+
	3039	+ if ( false !== $real ) {
	3040	+ $plugin_roots[ wp_normalize_path( $real ) ] = true;
	3041	+ }
	3042	+ }
	3043	+
	3044	+ $theme_roots = array();
	3045	+ foreach ( array_merge( array( get_theme_root() ), is_array( $wp_theme_directories ) ? $wp_theme_directories : array() ) as $theme_root ) {
	3046	+ $real = '' === (string) $theme_root ? false : realpath( $theme_root );
	3047	+ $real = false === $real ? '' : wp_normalize_path( $real );
	3048	+
	3049	+ if ( '' === $real || isset( $theme_roots[ $real ] ) || self::is_inside_any( $real, $plugin_roots ) ) {
	3050	+ continue;
	3051	+ }
	3052	+
	3053	+ $theme_roots[ $real ] = true;
	3054	+ $roots[] = array( 'themes', untrailingslashit( $theme_root ) );
	3055	+ }
	3056	+
	3057	+ foreach ( $roots as $root ) {
	3058	+ list( $kind, $directory ) = $root;
	3059	+
	3060	+ $entries = is_dir( $directory ) ? scandir( $directory ) : false;
	3061	+
	3062	+ if ( ! is_array( $entries ) ) {
	3063	+ continue;
	3064	+ }
	3065	+
	3066	+ foreach ( $entries as $entry ) {
	3067	+ if ( '.' === $entry || '..' === $entry ) {
	3068	+ continue;
	3069	+ }
	3070	+
	3071	+ if ( $this->is_time_exceeded() ) {
	3072	+ break 2;
	3073	+ }
	3074	+
	3075	+ $path = $directory . '/' . $entry;
	3076	+
	3077	+ if ( $this->is_path_excluded( $path ) ) {
	3078	+ continue;
	3079	+ }
	3080	+
	3081	+ $relative = str_replace( ABSPATH, '', $path );
	3082	+
	3083	+ // A folder among the plugins or the themes that WordPress does
	3084	+ // not list as one: no scan had a turn for it.
	3085	+ if ( is_dir( $path ) ) {
	3086	+ $real = realpath( $path );
	3087	+ $listed = 'plugins' === $kind ? isset( $plugin_folders[ $entry ] ) : ( 'themes' === $kind ? ( false !== $real && isset( $theme_folders[ wp_normalize_path( $real ) ] ) ) : true );
	3088	+
	3089	+ // A link is followed like any other folder, because what
	3090	+ // is behind it is reached by its address just the same,
	3091	+ // unless it leads back to wp-content or above it, which
	3092	+ // would be walking the site a second time.
	3093	+ if ( $listed || ( is_link( $path ) && self::leads_back( $path ) ) ) {
	3094	+ continue;
	3095	+ }
	3096	+
	3097	+ $inside = $this->detect_extra_files( $path, array(), 'themes' === $kind ? 'theme' : 'plugin', $entry, true );
	3098	+
	3099	+ $found['suspicious'] = array_merge( $found['suspicious'], $inside['suspicious'] );
	3100	+ $found['extra'] = array_merge( $found['extra'], $inside['extra'] );
	3101	+ $found['errors'] = array_merge( $found['errors'], $inside['errors'] );
	3102	+
	3103	+ if ( $inside['php_files'] > 0 ) {
	3104	+ $found['extra'][] = array(
	3105	+ 'file' => $relative,
	3106	+ 'type' => 'php_in_content',
	3107	+ 'reason' => 'themes' === $kind
	3108	+ ? __( 'Folder with PHP files that WordPress does not list as a theme', 'vigilante' )
	3109	+ : __( 'Folder with PHP files that WordPress does not list as a plugin', 'vigilante' ),
	3110	+ );
	3111	+ }
	3112	+ continue;
	3113	+ }
	3114	+
	3115	+ if ( in_array( strtolower( $entry ), $config_files, true ) ) {
	3116	+ $config = self::server_config_finding( $path, $relative );
	3117	+
	3118	+ if ( $config ) {
	3119	+ $found[ $config['category'] ][] = $config['item'];
	3120	+ }
	3121	+ continue;
	3122	+ }
	3123	+
	3124	+ $extension = strtolower( pathinfo( $entry, PATHINFO_EXTENSION ) );
	3125	+
	3126	+ if ( ! in_array( $extension, $php_extensions, true ) || $this->is_silence_golden_file( $path ) ) {
	3127	+ continue;
	3128	+ }
	3129	+
	3130	+ // hello.php comes with WordPress and is compared with it.
	3131	+ if ( 'plugins' === $kind && 'hello.php' === $entry ) {
	3132	+ continue;
	3133	+ }
	3134	+
	3135	+ $pattern = $this->search_file( $path, true );
	3136	+
	3137	+ $known = ( 'plugins' === $kind && isset( $single_plugins[ $entry ] ) ) || ( 'content' === $kind && in_array( $entry, $dropins, true ) );
	3138	+
	3139	+ if ( $known ) {
	3140	+ $found['unverified'][] = 'plugins' === $kind ? $single_plugins[ $entry ] : __( 'Drop-ins', 'vigilante' );
	3141	+ }
	3142	+
	3143	+ if ( $pattern ) {
	3144	+ $found['suspicious'][] = array(
	3145	+ 'file' => $relative,
	3146	+ 'type' => 'suspicious_plugin',
	3147	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	3148	+ 'reason' => sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), dirname( $relative ), $pattern ),
	3149	+ );
	3150	+ } elseif ( ! $known ) {
	3151	+ $found['extra'][] = array(
	3152	+ 'file' => $relative,
	3153	+ 'type' => 'php_in_content',
	3154	+ 'reason' => __( 'PHP file that is not a plugin, a theme or a WordPress drop-in', 'vigilante' ),
	3155	+ );
	3156	+ } elseif ( null === $pattern ) {
	3157	+ $found['extra'][] = $this->not_searched_item( $path, $relative );
	3158	+ }
	3159	+ }
	3160	+ }
	3161	+
	3162	+ $found['unverified'] = array_values( array_unique( $found['unverified'] ) );
	3163	+
	3164	+ return $found;
	3165	+ }
	3166	+
	3167	+ /**
	3168	+ * Look in the folders of wp-content that belong to no plugin and no theme
	3169	+ *
	3170	+ * cache, languages, upgrade and whatever else is there were not opened by
	3171	+ * any part of the scan, and a PHP file in any of them can be reached by
	3172	+ * its address like one anywhere else. Every PHP file in them is searched
	3173	+ * for hidden code, the way a plugin from outside WordPress.org is, and a
	3174	+ * .htaccess, .user.ini or php.ini is reported when it makes the server run
	3175	+ * code or load a file. A folder with PHP files that could only be
	3176	+ * searched is named among what has no official copy.
	3177	+ *
	3178	+ * Translation files are the exception, because what they must hold is
	3179	+ * known: text. WordPress loads the .l10n.php files of the site language
	3180	+ * with include on every request
	3181	+ * (wp-includes/l10n/class-wp-translation-file-php.php:24), so one that
	3182	+ * holds anything else is reported whatever the code looks like, and any
	3183	+ * other PHP file among the translations is listed. A PHP file that holds
	3184	+ * literal data and nothing else cannot run anything, and is left alone
	3185	+ * wherever it is (see is_literal_data()).
	3186	+ *
	3187	+ * Plugins, themes, must-use plugins and uploads have their own scans and
	3188	+ * are skipped here. The folders whose name says cache go last, and the
	3189	+ * whole walk has a share of the scan time of its own, so a cache with a
	3190	+ * hundred thousand files costs that share and no more.
	3191	+ *
	3192	+ * @return array Array with 'suspicious', 'extra', 'unverified' and 'errors' sub-arrays.
	3193	+ */
	3194	+ private function scan_content_folders() {
	3195	+ $found = array(
	3196	+ 'suspicious' => array(),
	3197	+ 'extra' => array(),
	3198	+ 'unverified' => array(),
	3199	+ 'errors' => array(),
	3200	+ );
	3201	+
	3202	+ $entries = is_dir( WP_CONTENT_DIR ) ? scandir( WP_CONTENT_DIR ) : false;
	3203	+
	3204	+ if ( ! is_array( $entries ) ) {
	3205	+ return $found;
	3206	+ }
	3207	+
	3208	+ // The folders with a scan of their own, by where they really are.
	3209	+ global $wp_theme_directories;
	3210	+
	3211	+ $uploads = wp_get_upload_dir();
	3212	+ $uploads_real = empty( $uploads['basedir'] ) ? false : realpath( $uploads['basedir'] );
	3213	+ $uploads_real = false === $uploads_real ? '' : wp_normalize_path( $uploads_real );
	3214	+ $own = array();
	3215	+ $roots = array_merge(
	3216	+ array( WP_PLUGIN_DIR, defined( 'WPMU_PLUGIN_DIR' ) ? WPMU_PLUGIN_DIR : '', get_theme_root() ),
	3217	+ is_array( $wp_theme_directories ) ? $wp_theme_directories : array()
	3218	+ );
	3219	+
	3220	+ foreach ( $roots as $root ) {
	3221	+ $real = '' === (string) $root ? false : realpath( $root );
	3222	+
	3223	+ if ( false !== $real ) {
	3224	+ $own[ wp_normalize_path( $real ) ] = true;
	3225	+ }
	3226	+ }
	3227	+
	3228	+ if ( '' !== $uploads_real ) {
	3229	+ $own[ $uploads_real ] = true;
	3230	+ }
	3231	+
	3232	+ // On a site of a network that is not the main one, the uploads of the
	3233	+ // site live inside the uploads of the network, which are the main
	3234	+ // site's turn.
	3235	+ $network_uploads = is_multisite() && ! is_main_site() ? $uploads_real : '';
	3236	+
	3237	+ $folders = array();
	3238	+
	3239	+ foreach ( $entries as $entry ) {
	3240	+ $path = WP_CONTENT_DIR . '/' . $entry;
	3241	+
	3242	+ if ( '.' === $entry || '..' === $entry || ! is_dir( $path ) ) {
	3243	+ continue;
	3244	+ }
	3245	+
	3246	+ $real = realpath( $path );
	3247	+ $real = false === $real ? '' : wp_normalize_path( $real );
	3248	+
	3249	+ // A folder with a scan of its own, or a link into one. A link to
	3250	+ // anywhere else is walked like the folder it stands for: deploy
	3251	+ // tools keep languages or a cache behind one, and what is there
	3252	+ // is reached by its address all the same.
	3253	+ if ( '' === $real || self::is_inside_any( $real, $own ) || ( is_link( $path ) && self::leads_back( $path ) ) ) {
	3254	+ continue;
	3255	+ }
	3256	+
	3257	+ if ( '' !== $network_uploads && 0 === strpos( $network_uploads, $real . '/' ) ) {
	3258	+ continue;
	3259	+ }
	3260	+
	3261	+ if ( $this->is_path_excluded( $path . '/.' ) ) {
	3262	+ continue;
	3263	+ }
	3264	+
	3265	+ $folders[] = $entry;
	3266	+ }
	3267	+
	3268	+ usort(
	3269	+ $folders,
	3270	+ static function ( $a, $b ) {
	3271	+ $a_cache = false !== stripos( $a, 'cache' );
	3272	+ $b_cache = false !== stripos( $b, 'cache' );
	3273	+
	3274	+ return $a_cache === $b_cache ? strcmp( $a, $b ) : ( $a_cache ? 1 : -1 );
	3275	+ }
	3276	+ );
	3277	+
	3278	+ $php_extensions = self::php_extensions();
	3279	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	3280	+ $deadline = microtime( true ) + $this->content_folders_time;
	3281	+
	3282	+ // A folder with a scan of its own nested further down, or one the
	3283	+ // user left out, is not walked at all.
	3284	+ $skip = function ( $folder ) use ( $own ) {
	3285	+ $real = realpath( $folder );
	3286	+
	3287	+ return ( false !== $real && isset( $own[ wp_normalize_path( $real ) ] ) ) || $this->is_path_excluded( $folder . '/.' );
	3288	+ };
	3289	+
	3290	+ foreach ( $folders as $entry ) {
	3291	+ $path = WP_CONTENT_DIR . '/' . $entry;
	3292	+ $php_files = 0;
	3293	+
	3294	+ try {
	3295	+ foreach ( self::walk_folder( $path, $skip ) as $file ) {
	3296	+ if ( $this->is_time_exceeded() ) {
	3297	+ break 2;
	3298	+ }
	3299	+
	3300	+ if ( microtime( true ) > $deadline ) {
	3301	+ $found['errors'][] = sprintf(
	3302	+ /* translators: %s: Folder path */
	3303	+ __( 'The folders of wp-content outside plugins, themes and uploads were not checked completely: the time for them ran out in %s. If that folder only holds files that change all the time, such as a cache, add it to Excluded Paths.', 'vigilante' ),
	3304	+ str_replace( ABSPATH, '', $path )
	3305	+ );
	3306	+ break 2;
	3307	+ }
	3308	+
	3309	+ $file_path = $file->getPathname();
	3310	+
	3311	+ if ( $file->isDir() ) {
	3312	+ if ( ! $file->isReadable() ) {
	3313	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	3314	+ }
	3315	+ continue;
	3316	+ }
	3317	+
	3318	+ $basename = strtolower( basename( $file_path ) );
	3319	+
	3320	+ if ( in_array( $basename, $config_files, true ) ) {
	3321	+ $config = $this->is_path_excluded( $file_path ) ? null : self::server_config_finding( $file_path, str_replace( ABSPATH, '', $file_path ) );
	3322	+
	3323	+ if ( $config ) {
	3324	+ $found[ $config['category'] ][] = $config['item'];
	3325	+ }
	3326	+ continue;
	3327	+ }
	3328	+
	3329	+ if ( ! in_array( strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) ), $php_extensions, true ) ) {
	3330	+ continue;
	3331	+ }
	3332	+
	3333	+ if ( $this->is_path_excluded( $file_path ) || $this->is_silence_golden_file( $file_path ) ) {
	3334	+ continue;
	3335	+ }
	3336	+
	3337	+ $literal = $this->is_literal_data( $file_path );
	3338	+
	3339	+ if ( true === $literal ) {
	3340	+ continue;
	3341	+ }
	3342	+
	3343	+ $relative = str_replace( ABSPATH, '', $file_path );
	3344	+
	3345	+ if ( false === $literal && '.l10n.php' === substr( $basename, -9 ) ) {
	3346	+ // Reported whatever the search finds, like a PHP file
	3347	+ // in uploads: WordPress loads it on every request, and
	3348	+ // no tool writes anything but the table of texts in
	3349	+ // it. What the search finds is said next to it.
	3350	+ $pattern = $this->search_file( $file_path, true );
	3351	+ $reason = __( 'Translation file that holds something other than translations', 'vigilante' );
	3352	+
	3353	+ if ( $pattern ) {
	3354	+ /* translators: %s: Suspicious pattern found */
	3355	+ $reason = sprintf( __( 'Translation file with suspicious code: %s', 'vigilante' ), $pattern );
	3356	+ }
	3357	+
	3358	+ $found['suspicious'][] = array(
	3359	+ 'file' => $relative,
	3360	+ 'type' => 'translation_with_code',
	3361	+ 'reason' => $reason,
	3362	+ );
	3363	+ continue;
	3364	+ }
	3365	+
	3366	+ $pattern = $this->search_file( $file_path, true );
	3367	+
	3368	+ if ( $pattern ) {
	3369	+ $found['suspicious'][] = array(
	3370	+ 'file' => $relative,
	3371	+ 'type' => 'suspicious_content',
	3372	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	3373	+ 'reason' => sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), str_replace( ABSPATH, '', $path ), $pattern ),
	3374	+ );
	3375	+ } elseif ( null === $pattern ) {
	3376	+ $found['extra'][] = $this->not_searched_item( $file_path, $relative );
	3377	+ } elseif ( self::is_inside_languages( $file_path ) ) {
	3378	+ $found['extra'][] = array(
	3379	+ 'file' => $relative,
	3380	+ 'type' => 'php_in_content',
	3381	+ 'reason' => __( 'PHP file among the translations that is not a translation file', 'vigilante' ),
	3382	+ );
	3383	+ } else {
	3384	+ $php_files++;
	3385	+ }
	3386	+ }
	3387	+ } catch ( Exception $e ) {
	3388	+ $found['errors'][] = self::unreadable_folder_error( $path );
	3389	+ }
	3390	+
	3391	+ if ( $php_files > 0 ) {
	3392	+ $found['unverified'][] = str_replace( ABSPATH, '', $path );
	3393	+ }
	3394	+ }
	3395	+
	3396	+ return $found;
	3397	+ }
	3398	+
	3399	+ /**
	3400	+ * Whether a real path is one of a set of folders or lies inside one of them
	3401	+ *
	3402	+ * @param string $real Real path, with forward slashes.
	3403	+ * @param array $folders Real paths with forward slashes, as keys.
	3404	+ * @return bool
	3405	+ */
	3406	+ private static function is_inside_any( $real, $folders ) {
	3407	+ foreach ( array_keys( $folders ) as $folder ) {
	3408	+ if ( $real === $folder || 0 === strpos( $real, $folder . '/' ) ) {
	3409	+ return true;
	3410	+ }
	3411	+ }
	3412	+
	3413	+ return false;
	3414	+ }
	3415	+
	3416	+ /**
	3417	+ * Whether a link leads to wp-content itself or to a folder above it
	3418	+ *
	3419	+ * @param string $path Path of the link.
	3420	+ * @return bool True also when where it leads cannot be worked out.
	3421	+ */
	3422	+ private static function leads_back( $path ) {
	3423	+ $real = realpath( $path );
	3424	+ $content = realpath( WP_CONTENT_DIR );
	3425	+
	3426	+ if ( false === $real || false === $content ) {
	3427	+ return true;
	3428	+ }
	3429	+
	3430	+ return 0 === strpos( wp_normalize_path( $content ) . '/', wp_normalize_path( $real ) . '/' );
	3431	+ }
	3432	+
	3433	+ /**
	3434	+ * Whether a path is inside the folder WordPress keeps its translations in
	3435	+ *
	3436	+ * @param string $path Absolute path.
	3437	+ * @return bool
	3438	+ */
	3439	+ private static function is_inside_languages( $path ) {
	3440	+ if ( ! defined( 'WP_LANG_DIR' ) ) {
	3441	+ return false;
	3442	+ }
	3443	+
	3444	+ return 0 === strpos( wp_normalize_path( $path ), untrailingslashit( wp_normalize_path( WP_LANG_DIR ) ) . '/' );
	3445	+ }
	3446	+
	3447	+ /**
	3448	+ * Whether a PHP file holds literal data and nothing else
	3449	+ *
	3450	+ * A file such as "<?php return [ 'a' => 'b' ];" cannot run anything. It is
	3451	+ * how WordPress, GlotPress, WP-CLI and Loco Translate write translation
	3452	+ * files, and how plugins keep small tables. The file is read one piece at
	3453	+ * a time, and every piece has to be a quoted string with nothing
	3454	+ * interpolated in it, a number, true, false, null, return, an array
	3455	+ * bracket, a comma, "=>", a dot or a semicolon. A parenthesis is
	3456	+ * accepted only as part of "array(" and to close it, so
	3457	+ * nothing can be called, and with those pieces there is no way to name a
	3458	+ * variable, a function, a class or a file.
	3459	+ *
	3460	+ * Anything else, a comment included, and the answer is no. Saying no to a
	3461	+ * harmless file only means it is searched like any other; saying yes to
	3462	+ * a file with code would hide it. So this reads less than PHP does, on
	3463	+ * purpose. Each piece is also one PHP would cut the same way: a minus
	3464	+ * sign only in front of a number and a dot never in front of "=", or
	3465	+ * "-=>" and ".=>" would be read here as an arrow and by PHP as an
	3466	+ * assignment. What it accepts is checked against PHP's own reading of
	3467	+ * the same file, at random, in the release checks.
	3468	+ *
	3469	+ * @param string $file_path Absolute path.
	3470	+ * @return bool|null True when it holds only data, false when it holds
	3471	+ * anything else, null when it could not be read whole.
	3472	+ */
	3473	+ private function is_literal_data( $file_path ) {
	3474	+ if ( ! is_file( $file_path ) || ! is_readable( $file_path ) ) {
	3475	+ return null;
	3476	+ }
	3477	+
	3478	+ // With another source encoding set (zend.multibyte), a string does
	3479	+ // not end for PHP where it ends byte by byte: nothing is vouched for.
	3480	+ if ( ini_get( 'zend.multibyte' ) ) {
	3481	+ return null;
	3482	+ }
	3483	+
	3484	+ $size = filesize( $file_path );
	3485	+
	3486	+ if ( false === $size || $size > self::MAX_SEARCHED_BYTES ) {
	3487	+ return null;
	3488	+ }
	3489	+
	3490	+ $content = file_get_contents( $file_path, false, null, 0, self::MAX_SEARCHED_BYTES + 1 ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to see whether it holds anything but data; nothing is written.
	3491	+
	3492	+ if ( false === $content || strlen( $content ) > self::MAX_SEARCHED_BYTES ) {
	3493	+ return null;
	3494	+ }
	3495	+
	3496	+ if ( 1 !== preg_match( '/\A<\?php[ \t\r\n]/', $content ) ) {
	3497	+ return false;
	3498	+ }
	3499	+
	3500	+ $piece = '/\G(?:[ \t\r\n]++|\'[^\'\\\\]*+(?:\\\\.[^\'\\\\]*+)*+\'|"[^"\\\\$]*+(?:\\\\.[^"\\\\$]*+)*+"|-?+\d++(?:\.\d++)?+(?:e[+-]?+\d++)?+|=>|\.(?!=)|[\[\],;)]|(?:true|false|null|return)(?![a-z0-9_\x80-\xff])|array[ \t\r\n]*+\()/is';
	3501	+ $length = strlen( $content );
	3502	+ $offset = 6;
	3503	+
	3504	+ while ( $offset < $length ) {
	3505	+ $match = array();
	3506	+ $result = preg_match( $piece, $content, $match, 0, $offset );
	3507	+
	3508	+ if ( 1 !== $result ) {
	3509	+ return false === $result ? null : false;
	3510	+ }
	3511	+
	3512	+ $offset += strlen( $match[0] );
	3513	+ }
	3514	+
	3515	+ return true;
	3516	+ }
	3517	+
913	3518	// =========================================================================
914	3519	// Critical config file baseline monitoring (wp-config.php, .htaccess)
915	3520	// =========================================================================
916	3521
		@@ -926,18 +3531,71 @@
926	3531	* silently — there is nothing to compare against.
927	3532	*
928	3533	* @return array Array of modified file entries (same format as core modified).
929	3534	*/
	3535	+ /**
	3536	+ * Where a critical root file actually lives
	3537	+ *
	3538	+ * WordPress supports wp-config.php one directory above ABSPATH, guarded by
	3539	+ * wp-settings.php not being there: that is literally what the installed core
	3540	+ * does in wp-load.php, and it is a common hardening layout. Until 2.11.10
	3541	+ * this module only looked inside ABSPATH, so on those installations
	3542	+ * wp-config.php was never added to the baseline, never compared and never
	3543	+ * mentioned: the module reported the site clean without having opened the
	3544	+ * one file it most needs to watch. A zero is justified, never assumed. The
	3545	+ * plugin already resolved both locations elsewhere
	3546	+ * (Vigilante_Database_Prefix::find_wpconfig_path()), just not here. Found by
	3547	+ * the file-by-file review of 2.11.10.
	3548	+ *
	3549	+ * @since 2.11.10
	3550	+ *
	3551	+ * @param string $filename Name of the file, such as wp-config.php.
	3552	+ * @return string|false Absolute path, or false when it cannot be found.
	3553	+ */
	3554	+ private function critical_file_path( $filename ) {
	3555	+ $root = untrailingslashit( ABSPATH );
	3556	+ $path = $root . '/' . $filename;
	3557	+
	3558	+ if ( file_exists( $path ) ) {
	3559	+ return $path;
	3560	+ }
	3561	+
	3562	+ if ( 'wp-config.php' === $filename ) {
	3563	+ $above = dirname( $root ) . '/wp-config.php';
	3564	+
	3565	+ // Suppressed like the core does in wp-load.php: the directory above
	3566	+ // the install is often outside open_basedir on shared hosting, and
	3567	+ // without the @ every scan emits a warning that can land in front of
	3568	+ // the JSON of an AJAX scan.
	3569	+ // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- The same @ the core uses for this same check in wp-load.php:52, where a wp-config.php one directory up is looked for: open_basedir makes file_exists() warn on a path outside it, and this must not print.
	3570	+ if ( @file_exists( $above ) && ! @file_exists( dirname( $root ) . '/wp-settings.php' ) ) {
	3571	+ return $above;
	3572	+ }
	3573	+ }
	3574	+
	3575	+ return false;
	3576	+ }
	3577	+
930	3578	private function scan_critical_root_files() {
	3579	+ // Before reading anything: the scan is the only thing that reaches
	3580	+ // every site of a network on its own, through wp-cron and front-end
	3581	+ // traffic. Hooking the cleanup to admin_init alone left every subsite
	3582	+ // whose dashboard nobody opens with its old copy of wp-config.php,
	3583	+ // credentials included, for as long as nobody visited it.
	3584	+ $this->maybe_redact_stored_baseline();
	3585	+
	3586	+ // And claim the blocks already on disk before anything is compared,
	3587	+ // so the first scan after updating uses the rule that will stay.
	3588	+ $this->maybe_claim_owned_blocks();
	3589	+
931	3590	$modified = array();
932	3591	$baseline = $this->get_critical_files_baseline();
933	3592	$baseline_changed = false;
934		- $root_path = untrailingslashit( ABSPATH );
935	3593
936	3594	foreach ( $this->critical_root_files as $filename ) {
937		- $full_path = $root_path . '/' . $filename;
	3595	+ $full_path = $this->critical_file_path( $filename );
938	3596
939		- if ( ! file_exists( $full_path ) ) {
	3597	+ if ( false === $full_path ) {
940	3598	continue;
941	3599	}
942	3600
943	3601	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -952,9 +3610,9 @@
952	3610	// First time seeing this file — store baseline silently
953	3611	$baseline[ $filename ] = array(
954	3612	'hash' => $current_hash,
955	3613	'size' => strlen( $content ),
956		- 'content' => $normalized,
	3614	+ 'content' => $this->baseline_content( $filename, $normalized ),
957	3615	'updated' => time(),
958	3616	);
959	3617	$baseline_changed = true;
960	3618	continue;
		@@ -961,34 +3619,85 @@
961	3619	}
962	3620
963	3621	// Upgrade legacy baseline entries that lack content (pre-diff format)
964	3622	if ( ! isset( $baseline[ $filename ]['content'] ) && $baseline[ $filename ]['hash'] === $current_hash ) {
965		- $baseline[ $filename ]['content'] = $normalized;
	3623	+ $baseline[ $filename ]['content'] = $this->baseline_content( $filename, $normalized );
966	3624	$baseline_changed = true;
967	3625	continue;
968	3626	}
969	3627
970		- // Compare against stored baseline
971		- if ( $baseline[ $filename ]['hash'] !== $current_hash ) {
	3628	+ /*
	3629	+ * The file has not changed, but the copy on record is not the copy
	3630	+ * that would be stored today: an entry written before 2.11.2 with
	3631	+ * the credentials in it, or one written before the redaction list
	3632	+ * grew. Rewrite it.
	3633	+ *
	3634	+ * Only when the hash matches, and that condition is the whole
	3635	+ * point: if the file HAD changed, this entry is the evidence of
	3636	+ * the change that the administrator still has to review, and
	3637	+ * rewriting it here would quietly destroy that evidence.
	3638	+ */
	3639	+ if ( $baseline[ $filename ]['hash'] === $current_hash ) {
	3640	+ $expected = $this->baseline_content( $filename, $normalized );
	3641	+
	3642	+ if ( $expected !== $baseline[ $filename ]['content'] ) {
	3643	+ $baseline[ $filename ]['content'] = $expected;
	3644	+ $baseline_changed = true;
	3645	+ }
	3646	+
	3647	+ continue;
	3648	+ }
	3649	+
	3650	+ /*
	3651	+ * Everything from here down is the changed file, and only that: the
	3652	+ * branch above returns on every matching hash, so there is no third
	3653	+ * case and no condition left to test. It used to be wrapped in an
	3654	+ * `if` repeating the opposite comparison, which read as if some
	3655	+ * other path could reach this point. It could not. Flagged by
	3656	+ * @calzbert, and worth the two lines it costs to say so.
	3657	+ *
	3658	+ * Both sides go through the same redaction, or every credential
	3659	+ * line would read as a change nobody made.
	3660	+ */
	3661	+ /*
	3662	+ * Where the shared files do not belong to this site, the lines are
	3663	+ * not computed at all. The diff is shown to whoever can open this
	3664	+ * site's screen, the administrator of a subsite included, and it
	3665	+ * was stored in the options of every subsite with the module on.
	3666	+ * Found by the audit of the admin surface for 2.11.8. The change is
	3667	+ * still reported, with both sizes, and the lines are read on the
	3668	+ * main site, where the change is approved.
	3669	+ */
	3670	+ if ( ! Vigilante_Settings::owns_shared_files() ) {
	3671	+ $diff = self::network_only_diff();
	3672	+ } else {
972	3673	$baseline_content = $baseline[ $filename ]['content'] ?? '';
973		- $diff = '' !== $baseline_content
974		- ? $this->compute_simple_diff( $baseline_content, $normalized )
	3674	+ $current_content = $this->baseline_content( $filename, $normalized );
	3675	+ $diff = ( '' !== $baseline_content && '' !== $current_content )
	3676	+ ? $this->compute_simple_diff( $baseline_content, $current_content )
975	3677	: array( 'added' => array(), 'removed' => array(), 'unavailable' => true );
976	3678
977		- $modified[] = array(
978		- 'file' => $filename,
979		- 'type' => 'critical_config',
980		- 'expected_hash' => $baseline[ $filename ]['hash'],
981		- 'actual_hash' => $current_hash,
982		- 'baseline_size' => $baseline[ $filename ]['size'],
983		- 'current_size' => strlen( $content ),
984		- 'diff' => $diff,
985		- );
	3679	+ // Say why there are no lines when today's copy could not be
	3680	+ // made safe, which approving does not change: the generic
	3681	+ // message talks about an old baseline. Cross review of 2.11.8.
	3682	+ if ( '' === $current_content && 'wp-config.php' === $filename ) {
	3683	+ $diff['redaction'] = true;
	3684	+ }
986	3685	}
	3686	+
	3687	+ $modified[] = array(
	3688	+ 'file' => $filename,
	3689	+ 'type' => 'critical_config',
	3690	+ 'expected_hash' => $baseline[ $filename ]['hash'],
	3691	+ 'actual_hash' => $current_hash,
	3692	+ 'baseline_size' => $baseline[ $filename ]['size'],
	3693	+ 'current_size' => strlen( $content ),
	3694	+ 'diff' => $diff,
	3695	+ );
987	3696	}
988	3697
989	3698	if ( $baseline_changed ) {
990		- update_option( self::BASELINE_OPTION, $baseline, false );
	3699	+ $this->write_baseline( $baseline );
991	3700	}
992	3701
993	3702	return $modified;
994	3703	}
		@@ -1060,30 +3769,49 @@
1060	3769	* @param string $filename File name (e.g. 'wp-config.php').
1061	3770	* @param string $content Raw file content.
1062	3771	* @return string Normalized content for hashing.
1063	3772	*/
1064		- private function normalize_critical_file( $filename, $content ) {
	3773	+ private function normalize_critical_file( $filename, $content, $drop_all_original = false ) {
1065	3774	// Normalize line endings first (CRLF and CR to LF)
1066	3775	$content = str_replace( array( "\r\n", "\r" ), "\n", $content );
1067	3776
	3777	+ /*
	3778	+ * Vigilant's own blocks are left out of the hash, so rewriting them is
	3779	+ * not reported as somebody else's change. Until 2.11.5 that covered
	3780	+ * everything between the markers, and every line carrying the
	3781	+ * [VIGILANTE_ORIGINAL] marker, whatever they contained. From 2.11.5 a
	3782	+ * block is left out only if it is exactly a block Vigilant wrote (see
	3783	+ * remember_owned_block()), and a marked line only while uncommenting it
	3784	+ * would still give a harmless define() (see is_vigilant_original_line()).
	3785	+ *
	3786	+ * Until the blocks already on disk have been claimed, the old rule
	3787	+ * applies unchanged. That is what keeps an update from changing the
	3788	+ * hash of a file nobody touched.
	3789	+ */
	3790	+ $claimed = $this->owned_blocks_claimed();
	3791	+
1068	3792	if ( 'wp-config.php' === $filename ) {
1069		- // Remove Vigilante constants blocks (current and legacy)
	3793	+ // Vigilante constants blocks (current and legacy)
1070	3794	foreach ( $this->wpconfig_markers as $markers ) {
1071		- $pattern = '/' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . '\s*/s';
1072		- $content = preg_replace( $pattern, '', $content );
	3795	+ $content = $this->strip_vigilant_blocks( $filename, $content, $markers, $claimed );
1073	3796	}
1074	3797
1075		- // Remove lines commented out by Vigilante (original constants)
1076		- $content = preg_replace(
	3798	+ // Lines commented out by Vigilante (original constants)
	3799	+ $content = preg_replace_callback(
1077	3800	'/^.*' . preg_quote( $this->wpconfig_original_marker, '/' ) . '.*$/m',
1078		- '',
	3801	+ function ( $line ) use ( $claimed, $drop_all_original ) {
	3802	+ // $drop_all_original reproduce la regla anterior a la 2.11.5 (quitar
	3803	+ // toda linea marcada) sobre los bloques de la regla nueva. Solo lo usa
	3804	+ // el re-base de la transicion, para decidir si la unica diferencia con
	3805	+ // el registro aprobado son estas lineas. Ver rebase_original_line_shift().
	3806	+ return ( ! $claimed || $drop_all_original || $this->is_vigilant_original_line( $line[0] ) ) ? '' : $line[0];
	3807	+ },
1079	3808	$content
1080	3809	);
1081	3810	} elseif ( '.htaccess' === $filename ) {
1082		- // Remove Vigilante htaccess blocks (firewall + security headers)
	3811	+ // Vigilante htaccess blocks (firewall + security headers)
1083	3812	foreach ( $this->htaccess_markers as $markers ) {
1084		- $pattern = '/' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . '\s*/s';
1085		- $content = preg_replace( $pattern, '', $content );
	3813	+ $content = $this->strip_vigilant_blocks( $filename, $content, $markers, $claimed );
1086	3814	}
1087	3815	}
1088	3816
1089	3817	// Collapse multiple blank lines into one (blocks removal leaves gaps)
		@@ -1092,15 +3820,645 @@
1092	3820	return trim( $content );
1093	3821	}
1094	3822
1095	3823	/**
	3824	+ * Leave Vigilant's blocks for one pair of markers out of the content
	3825	+ *
	3826	+ * Before the claim, every block, as it always was. After it, only the blocks
	3827	+ * whose fingerprint was recorded when Vigilant wrote them. A block that does
	3828	+ * not match, edited or planted, stays in the content: it counts in the hash
	3829	+ * and shows up in the diff.
	3830	+ *
	3831	+ * The match runs from marker to marker and the removal also takes the
	3832	+ * whitespace after the block, exactly as before, so a file whose blocks are
	3833	+ * all Vigilant's normalizes to the same text under both rules.
	3834	+ *
	3835	+ * @since 2.11.5
	3836	+ *
	3837	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	3838	+ * @param string $content Content with normalized line endings.
	3839	+ * @param array $markers Start and end marker.
	3840	+ * @param bool $claimed Whether the claim has run.
	3841	+ * @return string
	3842	+ */
	3843	+ private function strip_vigilant_blocks( $filename, $content, $markers, $claimed ) {
	3844	+ $pattern = '/(' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . ')\s*/s';
	3845	+
	3846	+ if ( ! $claimed ) {
	3847	+ return preg_replace( $pattern, '', $content );
	3848	+ }
	3849	+
	3850	+ return preg_replace_callback(
	3851	+ $pattern,
	3852	+ function ( $match ) use ( $filename ) {
	3853	+ return self::is_owned_block( $filename, $match[1] ) ? '' : $match[0];
	3854	+ },
	3855	+ $content
	3856	+ );
	3857	+ }
	3858	+
	3859	+ /**
	3860	+ * Whether a line carrying the original-constant marker is one Vigilant wrote
	3861	+ *
	3862	+ * comment_existing_constants() puts the marker in front of a define() of a
	3863	+ * constant it manages, and uncomment_original_constants() takes it away
	3864	+ * again whenever the constants are applied or removed, so whatever follows
	3865	+ * the marker gets to run some day. The line is left out of the hash only
	3866	+ * when there is nothing but indentation before the marker, nothing after it
	3867	+ * but a harmless define() and at most a line comment, and no PHP tag
	3868	+ * anywhere on it. That keeps it a comment today and harmless once
	3869	+ * uncommented. Anything else counts, and shows up in the diff.
	3870	+ *
	3871	+ * @since 2.11.5
	3872	+ *
	3873	+ * @param string $line One line of wp-config.php.
	3874	+ * @return bool
	3875	+ */
	3876	+ /**
	3877	+ * Whether every marked line of a file can run nothing at all
	3878	+ *
	3879	+ * The question the re-base has to answer before adopting a file is whether
	3880	+ * the lines that carry the marker are only comments. Asking a stricter one
	3881	+ * was wrong in both directions: the first version of the guard used
	3882	+ * is_vigilant_original_line(), which also requires the commented define to
	3883	+ * match a known harmless shape, so it refused to re-base a perfectly inert
	3884	+ * line carrying an unusual define, which is exactly the case the re-base
	3885	+ * exists for, leaving the function unable to act at all. Found by the cross
	3886	+ * review of 2.11.10.
	3887	+ *
	3888	+ * The second version read one line at a time and reasoned that the marker
	3889	+ * begins with //, so a line with nothing but whitespace before it is wholly
	3890	+ * a comment. That is true only where PHP is already reading code, and the
	3891	+ * second cross review of 2.11.10 built three files where it is not, all of
	3892	+ * them valid PHP, all of them passing that test and all of them running or
	3893	+ * printing something:
	3894	+ *
	3895	+ * - the marked line placed BEFORE the opening <?php, so it is inline HTML
	3896	+ * that the server prints verbatim to the browser;
	3897	+ * - the same after a ?> that the file already had;
	3898	+ * - the marked line ending a block comment opened on an earlier line and
	3899	+ * opening another one at its end, with a statement in between, which
	3900	+ * runs like any other statement.
	3901	+ *
	3902	+ * So the file is read the way PHP reads it, not the way the line looks. A
	3903	+ * marked line is inert when every token touching it is a comment or
	3904	+ * whitespace, which answers the three at once: inline HTML is not a comment,
	3905	+ * and neither is a statement. The shape the guard was written for, code
	3906	+ * BEFORE the marker, is the same question from the other side.
	3907	+ *
	3908	+ * The three shapes are in the harness as cells X2, X3 and X4 of
	3909	+ * matriz-escondite-marcadores.sh, written out in full there. They are not
	3910	+ * written out here on purpose: a literal payload in a shipped file is
	3911	+ * signature surface for the scanners this plugin is read by, and a comment
	3912	+ * is a bad place to pay for it.
	3913	+ *
	3914	+ * @since 2.11.10
	3915	+ *
	3916	+ * @param string $content Whole file content.
	3917	+ * @return bool True when no marked line can run or print anything.
	3918	+ */
	3919	+ /**
	3920	+ * The lines of a file that carry the original-value marker
	3921	+ *
	3922	+ * @since 2.11.10
	3923	+ *
	3924	+ * @param string $content Whole file content, newlines already normalised.
	3925	+ * @return string[]
	3926	+ */
	3927	+ private function marked_lines_of( $content ) {
	3928	+ $out = array();
	3929	+
	3930	+ foreach ( explode( "\n", $content ) as $text ) {
	3931	+ if ( false !== strpos( $text, $this->wpconfig_original_marker ) ) {
	3932	+ $out[] = $text;
	3933	+ }
	3934	+ }
	3935	+
	3936	+ return $out;
	3937	+ }
	3938	+
	3939	+ /**
	3940	+ * Whether what a marked line carries would still be harmless uncommented
	3941	+ *
	3942	+ * Only the part after the marker matters: what comes before it is answered by
	3943	+ * the token pass, which refuses anything that is not comment or whitespace.
	3944	+ * Here the question is what comes BACK when uncomment_original_constants()
	3945	+ * removes the marker, so the body has to be a single define() and nothing
	3946	+ * else, with at most a trailing line comment. Deliberately says nothing about
	3947	+ * WHICH constant it is: asking that was the first version of this guard, and
	3948	+ * it refused every define it did not recognise, which is exactly the case the
	3949	+ * re-base exists for.
	3950	+ *
	3951	+ * @since 2.11.10
	3952	+ *
	3953	+ * @param string $line One line carrying the marker.
	3954	+ * @return bool
	3955	+ */
	3956	+ private function marked_line_body_is_harmless( $line ) {
	3957	+ $at = strpos( $line, $this->wpconfig_original_marker );
	3958	+
	3959	+ if ( false === $at ) {
	3960	+ return true;
	3961	+ }
	3962	+
	3963	+ $body = trim( substr( $line, $at + strlen( $this->wpconfig_original_marker ) ) );
	3964	+
	3965	+ if ( '' === $body ) {
	3966	+ return true;
	3967	+ }
	3968	+
	3969	+ // Tokenised as PHP so the trailing comment, the strings and the nesting
	3970	+ // are read the way PHP reads them and not with a regular expression.
	3971	+ $tokens = @token_get_all( '<?php ' . $body ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- A marked line can carry anything; a warning here must not be printed, and an unreadable body is refused below.
	3972	+
	3973	+ if ( empty( $tokens ) ) {
	3974	+ return false;
	3975	+ }
	3976	+
	3977	+ $statements = 0;
	3978	+ $depth = 0;
	3979	+
	3980	+ foreach ( $tokens as $token ) {
	3981	+ $type = is_array( $token ) ? $token[0] : $token;
	3982	+
	3983	+ if ( in_array( $type, array( T_OPEN_TAG, T_WHITESPACE, T_COMMENT, T_DOC_COMMENT ), true ) ) {
	3984	+ continue;
	3985	+ }
	3986	+
	3987	+ if ( '(' === $type ) {
	3988	+ $depth++;
	3989	+ continue;
	3990	+ }
	3991	+
	3992	+ if ( ')' === $type ) {
	3993	+ $depth--;
	3994	+ continue;
	3995	+ }
	3996	+
	3997	+ // A semicolon at the top level closes a statement. More than one, or
	3998	+ // anything after the first, means the line carries something else.
	3999	+ if ( ';' === $type && 0 === $depth ) {
	4000	+ $statements++;
	4001	+ continue;
	4002	+ }
	4003	+
	4004	+ if ( $statements > 0 ) {
	4005	+ return false;
	4006	+ }
	4007	+ }
	4008	+
	4009	+ return ( $statements <= 1 );
	4010	+ }
	4011	+
	4012	+ private function marked_lines_are_inert( $content ) {
	4013	+ $content = str_replace( "\r\n", "\n", (string) $content );
	4014	+ $marker = $this->wpconfig_original_marker;
	4015	+
	4016	+ if ( '' === $content || false === strpos( $content, $marker ) ) {
	4017	+ return true;
	4018	+ }
	4019	+
	4020	+ $marked = array();
	4021	+
	4022	+ foreach ( explode( "\n", $content ) as $index => $text ) {
	4023	+ if ( false !== strpos( $text, $marker ) ) {
	4024	+ $marked[ $index + 1 ] = true;
	4025	+ }
	4026	+ }
	4027	+
	4028	+ // Lenient on purpose (no TOKEN_PARSE): a tampered file still has to be
	4029	+ // read, and a file that cannot be tokenised is never adopted.
	4030	+ // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- The file read here may have been tampered with, which is the whole point, and PHP 8 emits a warning when it cannot tokenise: printing it would put a parse error on whatever page ran the scan. An unreadable file is refused four lines below.
	4031	+ $tokens = @token_get_all( $content );
	4032	+
	4033	+ if ( empty( $tokens ) ) {
	4034	+ return false;
	4035	+ }
	4036	+
	4037	+ /*
	4038	+ * And the other half of the question, which the first token version left
	4039	+ * out: a marked line is a COMMENTED OUT value, and uncommenting it is what
	4040	+ * the feature exists for, so "runs nothing today" is not enough. Anything
	4041	+ * sharing the line after the define comes back with it. The shape is real
	4042	+ * and needs no attacker: comment_existing_constants() takes a define and
	4043	+ * everything on its line, so
	4044	+ * define( 'WP_DEBUG', false ); @ini_set( 'display_errors', 0 );
	4045	+ * is commented whole, and re-basing it would adopt as approved something
	4046	+ * that runs the moment the value is restored. The old rule refused this
	4047	+ * too, but along with every define whose NAME it did not recognise, which
	4048	+ * is what left the function unable to act at all. Found by the third cross
	4049	+ * review of 2.11.10.
	4050	+ */
	4051	+ foreach ( $this->marked_lines_of( $content ) as $text ) {
	4052	+ if ( ! $this->marked_line_body_is_harmless( $text ) ) {
	4053	+ return false;
	4054	+ }
	4055	+ }
	4056	+
	4057	+ $inocuos = array( T_COMMENT, T_DOC_COMMENT, T_WHITESPACE );
	4058	+ $linea = 1;
	4059	+
	4060	+ foreach ( $tokens as $token ) {
	4061	+ $texto = is_array( $token ) ? $token[1] : $token;
	4062	+ $tipo = is_array( $token ) ? $token[0] : null;
	4063	+ $saltos = substr_count( $texto, "\n" );
	4064	+ $desde = $linea;
	4065	+ $hasta = $linea + $saltos;
	4066	+
	4067	+ /*
	4068	+ * A token whose text ends in a newline puts nothing on the line that
	4069	+ * newline opens. Counting it would make the "<?php\n" of every file
	4070	+ * touch line 2 and refuse the legitimate case, which is what the
	4071	+ * first version of this did.
	4072	+ */
	4073	+ $ultima = ( $saltos > 0 && "\n" === substr( $texto, -1 ) ) ? $hasta - 1 : $hasta;
	4074	+ $linea = $hasta;
	4075	+
	4076	+ if ( null !== $tipo && in_array( $tipo, $inocuos, true ) ) {
	4077	+ continue;
	4078	+ }
	4079	+
	4080	+ for ( $l = $desde; $l <= $ultima; $l++ ) {
	4081	+ if ( isset( $marked[ $l ] ) ) {
	4082	+ return false;
	4083	+ }
	4084	+ }
	4085	+ }
	4086	+
	4087	+ return true;
	4088	+ }
	4089	+
	4090	+ private function is_vigilant_original_line( $line ) {
	4091	+ if ( false !== strpos( $line, '<?' ) || false !== strpos( $line, '?>' ) ) {
	4092	+ return false;
	4093	+ }
	4094	+
	4095	+ return 1 === preg_match(
	4096	+ '/^[ \t]*' . preg_quote( $this->wpconfig_original_marker, '/' ) . self::harmless_define_pattern() . '[ \t]*(?:(?:\/\/|#(?!\[)).*)?$/',
	4097	+ $line
	4098	+ );
	4099	+ }
	4100	+
	4101	+ /**
	4102	+ * A define() that runs nothing but itself, as a regular expression fragment
	4103	+ *
	4104	+ * The name is one of the constants Vigilant has managed in any version. The
	4105	+ * value is made only of literals (true, false, null, a number, a quoted
	4106	+ * string with nothing to interpolate) and of ABSPATH, WP_CONTENT_DIR and
	4107	+ * __DIR__, which is what a debug log path is usually built from, joined
	4108	+ * with dots. No call, no variable, no backtick, no include.
	4109	+ *
	4110	+ * @since 2.11.5
	4111	+ *
	4112	+ * @return string Pattern without delimiters.
	4113	+ */
	4114	+ private static function harmless_define_pattern() {
	4115	+ $names = 'DISALLOW_FILE_EDIT|DISALLOW_FILE_MODS|FORCE_SSL_ADMIN|FORCE_SSL_LOGIN|WP_DEBUG|WP_DEBUG_LOG|WP_DEBUG_DISPLAY|SCRIPT_DEBUG|DISABLE_WP_CRON'
	4116	+ . '|WP_POST_REVISIONS|AUTOSAVE_INTERVAL|EMPTY_TRASH_DAYS|WP_MEMORY_LIMIT|WP_MAX_MEMORY_LIMIT|WP_AUTO_UPDATE_CORE|CONCATENATE_SCRIPTS';
	4117	+
	4118	+ $value = '(?:(?i:true|false|null)|-?\d+|\'(?:[^\'\\\\]|\\\\.)*\'|"[^"\\\\$]*"|ABSPATH|WP_CONTENT_DIR|__DIR__)';
	4119	+
	4120	+ return 'define\s*\(\s*[\'"](?:' . $names . ')[\'"]\s*,\s*' . $value . '(?:\s*\.\s*' . $value . ')*\s*\)\s*;';
	4121	+ }
	4122	+
	4123	+ /**
	4124	+ * Whether a wp-config.php constants block can only be one Vigilant wrote
	4125	+ *
	4126	+ * Every version of generate_constants() has written the start marker on its
	4127	+ * own line, then comments, blank lines and define() calls, bare or wrapped
	4128	+ * in if ( ! defined() ), then the end marker on its own line. A block made
	4129	+ * only of those lines runs nothing but the defines, whatever version wrote
	4130	+ * it and whatever settings it was written with. One line of anything else,
	4131	+ * or a PHP tag on any line, and the block is not taken.
	4132	+ *
	4133	+ * @since 2.11.5
	4134	+ *
	4135	+ * @param string $block Block from start marker to end marker, inclusive.
	4136	+ * @param array $markers Start and end marker.
	4137	+ * @return bool
	4138	+ */
	4139	+ private static function is_harmless_constants_block( $block, $markers ) {
	4140	+ $lines = explode( "\n", str_replace( array( "\r\n", "\r" ), "\n", (string) $block ) );
	4141	+
	4142	+ if ( count( $lines ) < 2
	4143	+ || rtrim( array_shift( $lines ), " \t" ) !== $markers[0]
	4144	+ || ltrim( array_pop( $lines ), " \t" ) !== $markers[1]
	4145	+ ) {
	4146	+ return false;
	4147	+ }
	4148	+
	4149	+ $define = self::harmless_define_pattern();
	4150	+ $guarded = '/^if\s*\(\s*!\s*defined\s*\(\s*[\'"][A-Z_]+[\'"]\s*\)\s*\)\s*\{\s*' . $define . '\s*\}$/';
	4151	+
	4152	+ foreach ( $lines as $line ) {
	4153	+ $line = trim( $line, " \t" );
	4154	+
	4155	+ if ( false !== strpos( $line, '<?' ) || false !== strpos( $line, '?>' ) ) {
	4156	+ return false;
	4157	+ }
	4158	+
	4159	+ if ( '' === $line
	4160	+ || 0 === strpos( $line, '//' )
	4161	+ || preg_match( '/^' . $define . '$/', $line )
	4162	+ || preg_match( $guarded, $line )
	4163	+ ) {
	4164	+ continue;
	4165	+ }
	4166	+
	4167	+ return false;
	4168	+ }
	4169	+
	4170	+ return true;
	4171	+ }
	4172	+
	4173	+ /**
	4174	+ * Take ownership of the blocks already on disk, once
	4175	+ *
	4176	+ * Fingerprints are recorded when Vigilant writes a block, which leaves every
	4177	+ * block written before 2.11.5 without one. This records the blocks that can
	4178	+ * be recognised as Vigilant's without having seen them written:
	4179	+ *
	4180	+ * - A .htaccess block, when it is exactly what Vigilant would write today
	4181	+ * with the settings it has, the timestamp and the version apart. After an
	4182	+ * update, maybe_sync_server_files() rewrites those blocks on the next
	4183	+ * request, so the claim waits for it. Unless it has already failed: a
	4184	+ * block Vigilant cannot rewrite is not going to start matching, and
	4185	+ * waiting for it would keep the old rule for good.
	4186	+ * - A wp-config.php constants block, when every line in it is a comment, a
	4187	+ * blank line or a harmless define(). Nothing rewrites that block on an
	4188	+ * update and its format has changed five times, so comparing it with
	4189	+ * today's output would report every site that has not saved those
	4190	+ * settings since. A line that could run anything is never accepted.
	4191	+ *
	4192	+ * A block that is not recognised stays in the hash and is reported as a
	4193	+ * change, so the owner gets to look at it, and the activity log says why.
	4194	+ * Nothing in the stored baseline is rewritten.
	4195	+ *
	4196	+ * Only where the shared files belong, a single site or the main site of a
	4197	+ * network, because the expected blocks come from that site's settings. Until
	4198	+ * it has run, normalize_critical_file() keeps the old rule on every site.
	4199	+ *
	4200	+ * @since 2.11.5
	4201	+ */
	4202	+ /**
	4203	+ * The admin_init entry point of the claim, which does ask for an administrator
	4204	+ *
	4205	+ * admin-ajax.php fires admin_init before it decides who is asking
	4206	+ * (wp-admin/admin-ajax.php:45), so without this an anonymous request chose
	4207	+ * the moment the claim runs. Unlike its two neighbours in
	4208	+ * init_cleanup_hooks(), which only drop the plugin's own copy out of the
	4209	+ * database, the claim writes two network options, changes for the whole
	4210	+ * network the rule normalize_critical_file() applies, and re-bases the
	4211	+ * approved baseline.
	4212	+ *
	4213	+ * The gate lives here and not inside maybe_claim_owned_blocks() because the
	4214	+ * scan calls that one directly and the scan runs from wp-cron, with no user:
	4215	+ * putting the capability check inside left the claim unable to complete on
	4216	+ * any site whose dashboard nobody opens, and until it completes the older,
	4217	+ * permissive rule is the one in force, which is the hiding place 2.11.5 was
	4218	+ * written to close. Found by the cross review of 2.11.10.
	4219	+ *
	4220	+ * @since 2.11.10
	4221	+ */
	4222	+ public function maybe_claim_owned_blocks_on_admin() {
	4223	+ if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
	4224	+ return;
	4225	+ }
	4226	+
	4227	+ $this->maybe_claim_owned_blocks();
	4228	+ }
	4229	+
	4230	+ public function maybe_claim_owned_blocks() {
	4231	+ if ( $this->owned_blocks_claimed() || ! Vigilante_Settings::owns_shared_files() ) {
	4232	+ return;
	4233	+ }
	4234	+
	4235	+ $sync_due = get_option( 'vigilante_server_files_pending' )
	4236	+ || VIGILANTE_VERSION !== get_option( 'vigilante_server_files_version' );
	4237	+
	4238	+ if ( $sync_due && ! get_option( 'vigilante_server_files_retry_after' ) ) {
	4239	+ return;
	4240	+ }
	4241	+
	4242	+ $expected = null;
	4243	+ $unclaimed = array();
	4244	+
	4245	+ foreach ( $this->critical_root_files as $filename ) {
	4246	+ $full_path = $this->critical_file_path( $filename );
	4247	+
	4248	+ if ( false === $full_path ) {
	4249	+ continue;
	4250	+ }
	4251	+
	4252	+ $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
	4253	+
	4254	+ if ( false === $content ) {
	4255	+ // Unreadable right now: leave the claim open and try again later.
	4256	+ return;
	4257	+ }
	4258	+
	4259	+ $content = str_replace( array( "\r\n", "\r" ), "\n", $content );
	4260	+ $is_config = 'wp-config.php' === $filename;
	4261	+
	4262	+ foreach ( ( $is_config ? $this->wpconfig_markers : $this->htaccess_markers ) as $markers ) {
	4263	+ $pattern = '/' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . '/s';
	4264	+
	4265	+ if ( ! preg_match_all( $pattern, $content, $found ) ) {
	4266	+ continue;
	4267	+ }
	4268	+
	4269	+ foreach ( $found[0] as $block ) {
	4270	+ if ( $is_config ) {
	4271	+ $ours = self::is_harmless_constants_block( $block, $markers );
	4272	+ } else {
	4273	+ $expected = null === $expected ? $this->expected_htaccess_blocks() : $expected;
	4274	+ $ours = isset( $expected[ $markers[0] ] )
	4275	+ && self::comparable_block( $block ) === self::comparable_block( $expected[ $markers[0] ] );
	4276	+ }
	4277	+
	4278	+ if ( $ours ) {
	4279	+ self::remember_owned_block( $filename, $markers[0], $block, false );
	4280	+ } else {
	4281	+ $unclaimed[ $filename ] = $filename;
	4282	+ }
	4283	+ }
	4284	+ }
	4285	+
	4286	+ // The commented-out originals are judged line by line at scan time.
	4287	+ // Looking at them here only keeps the log entry below complete.
	4288	+ if ( $is_config && preg_match_all( '/^.*' . preg_quote( $this->wpconfig_original_marker, '/' ) . '.*$/m', $content, $marked ) ) {
	4289	+ foreach ( $marked[0] as $line ) {
	4290	+ if ( ! $this->is_vigilant_original_line( $line ) ) {
	4291	+ $unclaimed[ $filename ] = $filename;
	4292	+ }
	4293	+ }
	4294	+ }
	4295	+ }
	4296	+
	4297	+ update_site_option( self::OWNED_BLOCKS_CLAIM_OPTION, self::OWNED_BLOCKS_CLAIMED );
	4298	+
	4299	+ // With the claim in place normalize uses the new rule, so a file nobody
	4300	+ // touched whose only difference is an original line the old rule dropped
	4301	+ // would read as changed. Re-base those, and only those, once.
	4302	+ $this->rebase_original_line_shift();
	4303	+
	4304	+ if ( $unclaimed && $this->activity_log ) {
	4305	+ $this->activity_log->log(
	4306	+ 'file',
	4307	+ 'critical_file_unrecognized_block',
	4308	+ sprintf(
	4309	+ /* translators: %s: comma-separated file names, such as wp-config.php or .htaccess. */
	4310	+ __( 'Content marked as written by Vigilant in %s does not match what Vigilant writes. From now on it is checked like the rest of the file, so the file integrity scan reports it as a change for you to review.', 'vigilante' ),
	4311	+ implode( ', ', $unclaimed )
	4312	+ ),
	4313	+ array( 'files' => array_values( $unclaimed ) ),
	4314	+ 'warning'
	4315	+ );
	4316	+ }
	4317	+ }
	4318	+
	4319	+ /**
	4320	+ * Re-base the critical files whose only change is a newly kept original line
	4321	+ *
	4322	+ * Until 2.11.5 the hash left out every [VIGILANTE_ORIGINAL] line; from 2.11.5
	4323	+ * it keeps the ones whose value is not a plain constant define, which is the
	4324	+ * right thing for the hash but moves it on a file nobody edited: the stored
	4325	+ * baseline was taken under the old rule, and nothing re-bases wp-config.php on
	4326	+ * an update (maybe_sync_server_files() only rewrites the .htaccess). So the
	4327	+ * first scan after updating would report wp-config.php as changed.
	4328	+ *
	4329	+ * This runs once, in the same pass that claims the blocks. For each file it
	4330	+ * re-bases to the new hash only when the baseline still matches the file with
	4331	+ * every original line dropped, which means the blocks are exactly the approved
	4332	+ * ones and the sole difference is those lines, the user's own commented-out
	4333	+ * defines. A block that was edited or planted does not match with the lines
	4334	+ * dropped, so it is left to be reported: this closes the false positive
	4335	+ * without adopting anything that was hidden before.
	4336	+ *
	4337	+ * @since 2.11.5
	4338	+ */
	4339	+ private function rebase_original_line_shift() {
	4340	+ $baseline = $this->get_critical_files_baseline();
	4341	+ $changed = false;
	4342	+
	4343	+ foreach ( $this->critical_root_files as $filename ) {
	4344	+ $full_path = $this->critical_file_path( $filename );
	4345	+
	4346	+ if ( false === $full_path || empty( $baseline[ $filename ]['hash'] ) ) {
	4347	+ continue;
	4348	+ }
	4349	+
	4350	+ $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
	4351	+
	4352	+ if ( false === $content ) {
	4353	+ continue;
	4354	+ }
	4355	+
	4356	+ /*
	4357	+ * Never re-base a file that carries a marked line which is not
	4358	+ * wholly a comment. The test below only establishes that the
	4359	+ * difference lies in lines carrying the marker, and the old rule
	4360	+ * dropped the WHOLE line, so a line with a statement in front of the
	4361	+ * marker satisfies it (cell X1 of matriz-escondite-marcadores.sh,
	4362	+ * where the shape is written out): re-basing would write that line
	4363	+ * into the approved baseline and rewrite the stored content, so the
	4364	+ * diff would stop showing it. Adopting as approved what the previous rule
	4365	+ * hid is the one thing an integrity scanner must never do, and the
	4366	+ * log entry of maybe_claim_owned_blocks() already promises the
	4367	+ * opposite ("the scan reports it as a change for you to review").
	4368	+ * Those files are left to be reported. Found by the file-by-file
	4369	+ * review of 2.11.10.
	4370	+ *
	4371	+ * What counts as "wholly a comment" is decided by reading the file
	4372	+ * as PHP reads it, not by the shape of the line: see
	4373	+ * marked_lines_are_inert(). A line that is not recognised is not the
	4374	+ * same thing as a line that can run something, and the first
	4375	+ * wording of this guard confused the two.
	4376	+ */
	4377	+ if ( ! $this->marked_lines_are_inert( $content ) ) {
	4378	+ continue;
	4379	+ }
	4380	+
	4381	+ $current = md5( $this->normalize_critical_file( $filename, $content ) );
	4382	+
	4383	+ // Already in step, or a real change to something other than the
	4384	+ // original lines: nothing to re-base here.
	4385	+ if ( $baseline[ $filename ]['hash'] === $current
	4386	+ || $baseline[ $filename ]['hash'] !== md5( $this->normalize_critical_file( $filename, $content, true ) )
	4387	+ ) {
	4388	+ continue;
	4389	+ }
	4390	+
	4391	+ $normalized = $this->normalize_critical_file( $filename, $content );
	4392	+ $baseline[ $filename ]['hash'] = $current;
	4393	+ $baseline[ $filename ]['size'] = strlen( $content );
	4394	+ $baseline[ $filename ]['content'] = $this->baseline_content( $filename, $normalized );
	4395	+ $baseline[ $filename ]['updated'] = time();
	4396	+ $changed = true;
	4397	+ }
	4398	+
	4399	+ if ( $changed ) {
	4400	+ $this->write_baseline( $baseline );
	4401	+ }
	4402	+ }
	4403	+
	4404	+ /**
	4405	+ * The .htaccess blocks Vigilant would write today, keyed by start marker
	4406	+ *
	4407	+ * @since 2.11.5
	4408	+ *
	4409	+ * @return array
	4410	+ */
	4411	+ private function expected_htaccess_blocks() {
	4412	+ $settings = $this->settings ? $this->settings : new Vigilante_Settings();
	4413	+
	4414	+ $classes = array(
	4415	+ 'Vigilante_Htaccess_Protection' => 'class-htaccess-protection.php',
	4416	+ 'Vigilante_Security_Headers' => 'class-security-headers.php',
	4417	+ );
	4418	+
	4419	+ foreach ( $classes as $class => $file ) {
	4420	+ if ( ! class_exists( $class ) ) {
	4421	+ require_once VIGILANTE_INCLUDES_DIR . $file;
	4422	+ }
	4423	+ }
	4424	+
	4425	+ $headers = new Vigilante_Security_Headers( $settings );
	4426	+
	4427	+ return array(
	4428	+ Vigilante_Htaccess_Protection::MARKER_START => ( new Vigilante_Htaccess_Protection( $settings ) )->generate_rules(),
	4429	+ Vigilante_Security_Headers::MARKER_START => Vigilante_Security_Headers::MARKER_START . "\n" . $headers->generate_rules_content() . "\n" . Vigilante_Security_Headers::MARKER_END,
	4430	+ );
	4431	+ }
	4432	+
	4433	+ /**
	4434	+ * A .htaccess block with the parts that change on every write evened out
	4435	+ *
	4436	+ * Two blocks Vigilant wrote with the same settings differ only in the time
	4437	+ * they were generated and, across an update, in the version the firewall
	4438	+ * block names. Everything else has to be identical for the claim to take
	4439	+ * the block.
	4440	+ *
	4441	+ * @since 2.11.5
	4442	+ *
	4443	+ * @param string $block Block from start marker to end marker, inclusive.
	4444	+ * @return string
	4445	+ */
	4446	+ private static function comparable_block( $block ) {
	4447	+ $block = str_replace( array( "\r\n", "\r" ), "\n", (string) $block );
	4448	+ $block = preg_replace( '/^# Generated: \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} UTC$/m', '# Generated:', $block );
	4449	+ $block = preg_replace( '/^# Vigilante for WordPress - Firewall v[0-9][0-9A-Za-z.\-]*$/m', '# Vigilante for WordPress - Firewall v', $block );
	4450	+
	4451	+ return rtrim( $block, "\n" );
	4452	+ }
	4453	+
	4454	+ /**
1096	4455	* Get stored baseline hashes for critical files
1097	4456	*
1098	4457	* @return array Associative array keyed by filename.
1099	4458	*/
1100	4459	public function get_critical_files_baseline() {
1101		- $baseline = get_option( self::BASELINE_OPTION, array() );
1102		- return is_array( $baseline ) ? $baseline : array();
	4460	+ return $this->read_baseline();
1103	4461	}
1104	4462
1105	4463	/**
1106	4464	* Update baseline hash for a single critical file
		@@ -1111,11 +4469,11 @@
1111	4469	* @param string $filename File name relative to ABSPATH (e.g. 'wp-config.php').
1112	4470	* @return bool True on success.
1113	4471	*/
1114	4472	public function update_critical_file_baseline( $filename ) {
1115		- $full_path = untrailingslashit( ABSPATH ) . '/' . $filename;
	4473	+ $full_path = $this->critical_file_path( $filename );
1116	4474
1117		- if ( ! file_exists( $full_path ) ) {
	4475	+ if ( false === $full_path ) {
1118	4476	return false;
1119	4477	}
1120	4478
1121	4479	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -1125,16 +4483,44 @@
1125	4483
1126	4484	$normalized = $this->normalize_critical_file( $filename, $content );
1127	4485
1128	4486	$baseline = $this->get_critical_files_baseline();
	4487	+
	4488	+ /*
	4489	+ * No guard here, and there was one for a few hours during 2.11.4 that
	4490	+ * had to come out. It refused to rewrite the record when the stored hash
	4491	+ * no longer matched the file, meant to stop a write of ours from
	4492	+ * approving somebody else's pending edit. Two things were wrong with it,
	4493	+ * both measured on 10 sep 2026 by a third cross review:
	4494	+ *
	4495	+ * - This is also the Approve button (Vigilante_Admin_Ajax::
	4496	+ * ajax_approve_critical_file). A moved hash is exactly the state in
	4497	+ * which Approve is pressed, so the guard made Approve fail every time
	4498	+ * and the warning could never be closed.
	4499	+ * - Its premise, "our own write cannot move the normalized hash", holds
	4500	+ * for the block and not for the rest of what the writers do.
	4501	+ * comment_existing_constants() turns a define() into a
	4502	+ * [VIGILANTE_ORIGINAL] line that normalize_critical_file() leaves as
	4503	+ * an empty line, and remove_old_rules() deletes legacy .htaccess blocks
	4504	+ * that normalize_critical_file() does not know. Both move the hash, so
	4505	+ * the guard would have raised a false "file modified" after Vigilant's
	4506	+ * own work, on sites that updated.
	4507	+ *
	4508	+ * The real fix is to know what the hash was before WE touched the file:
	4509	+ * the writers capture it and pass it along vigilante_critical_file_
	4510	+ * written, and this compares against that instead of against the
	4511	+ * record. Until then this behaves as it always has, which does mean a
	4512	+ * write of ours can adopt a third-party edit that was pending review.
	4513	+ * That is pre-existing, and written down in the roadmap.
	4514	+ */
1129	4515	$baseline[ $filename ] = array(
1130	4516	'hash' => md5( $normalized ),
1131	4517	'size' => strlen( $content ),
1132		- 'content' => $normalized,
	4518	+ 'content' => $this->baseline_content( $filename, $normalized ),
1133	4519	'updated' => time(),
1134	4520	);
1135	4521
1136		- return update_option( self::BASELINE_OPTION, $baseline, false );
	4522	+ return $this->write_baseline( $baseline );
1137	4523	}
1138	4524
1139	4525	/**
1140	4526	* Regenerate baseline for all critical files
		@@ -1144,14 +4530,13 @@
1144	4530	* @return array Updated baseline data.
1145	4531	*/
1146	4532	public function regenerate_all_baselines() {
1147	4533	$baseline = array();
1148		- $root_path = untrailingslashit( ABSPATH );
1149	4534
1150	4535	foreach ( $this->critical_root_files as $filename ) {
1151		- $full_path = $root_path . '/' . $filename;
	4536	+ $full_path = $this->critical_file_path( $filename );
1152	4537
1153		- if ( ! file_exists( $full_path ) ) {
	4538	+ if ( false === $full_path ) {
1154	4539	continue;
1155	4540	}
1156	4541
1157	4542	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -1162,14 +4547,14 @@
1162	4547	$normalized = $this->normalize_critical_file( $filename, $content );
1163	4548	$baseline[ $filename ] = array(
1164	4549	'hash' => md5( $normalized ),
1165	4550	'size' => strlen( $content ),
1166		- 'content' => $normalized,
	4551	+ 'content' => $this->baseline_content( $filename, $normalized ),
1167	4552	'updated' => time(),
1168	4553	);
1169	4554	}
1170	4555
1171		- update_option( self::BASELINE_OPTION, $baseline, false );
	4556	+ $this->write_baseline( $baseline );
1172	4557
1173	4558	return $baseline;
1174	4559	}
1175	4560
		@@ -1178,10 +4563,10 @@
1178	4563	*
1179	4564	* @param bool $force_refresh Skip the cached copy and ask wp.org again.
1180	4565	* @return array|WP_Error Checksums or error.
1181	4566	*/
1182		- private function get_core_checksums( $force_refresh = false ) {
1183		- $locale = get_locale();
	4567	+ private function get_core_checksums( $force_refresh = false, $locale = null, $english_fallback = true ) {
	4568	+ $locale = null === $locale ? get_locale() : $locale;
1184	4569	$version = $this->wp_version;
1185	4570
1186	4571	// Check cache first
1187	4572	$cache_key = 'vigilante_core_checksums_' . md5( $version . $locale );
		@@ -1210,8 +4595,26 @@
1210	4595
1211	4596	$body = json_decode( wp_remote_retrieve_body( $response ), true );
1212	4597
1213	4598	if ( empty( $body['checksums'] ) ) {
	4599	+ /*
	4600	+ * WordPress.org has no list for this version in this language. That
	4601	+ * is the normal state of every site that is not in English for the
	4602	+ * hours or days after a release, until the package of its language
	4603	+ * is built, and of the languages that never get one. Until now the
	4604	+ * core was then not compared at all. Those sites run the English
	4605	+ * files, so the English list is the one to compare with. It is not
	4606	+ * kept under this language, so the next scan asks again.
	4607	+ */
	4608	+ if ( 'en_US' !== $locale && $english_fallback ) {
	4609	+ $english = $this->get_core_checksums( $force_refresh, 'en_US' );
	4610	+
	4611	+ if ( is_array( $english ) ) {
	4612	+ $this->core_checksums_are_english = true;
	4613	+ return $english;
	4614	+ }
	4615	+ }
	4616	+
1214	4617	return new WP_Error( 'no_checksums', __( 'Could not retrieve WordPress core checksums', 'vigilante' ) );
1215	4618	}
1216	4619
1217	4620	$checksums = $body['checksums'];
		@@ -1227,8 +4630,52 @@
1227	4630	return $checksums;
1228	4631	}
1229	4632
1230	4633	/**
	4634	+ * Whether a core file is the official copy of another language
	4635	+ *
	4636	+ * The checksums are asked for in the language of the site, and a site does
	4637	+ * not always run the package of its language: one installed in English and
	4638	+ * switched to Spanish afterwards keeps the English files, so its
	4639	+ * version.php and its wp-config-sample.php do not match the Spanish list.
	4640	+ * That is why version.php used to be left out of the comparison altogether,
	4641	+ * which left a file WordPress loads on every request unchecked. A file that
	4642	+ * matches the official copy of the same version in English, or in the
	4643	+ * language its own package declares, is an official file. The language
	4644	+ * only chooses which official list to look at: a file that was tampered
	4645	+ * with matches none of them.
	4646	+ *
	4647	+ * @param string $file Path relative to the WordPress root.
	4648	+ * @param string $actual_hash md5 of the file on disk.
	4649	+ * @return bool
	4650	+ */
	4651	+ private function matches_core_of_other_locale( $file, $actual_hash ) {
	4652	+ $current = get_locale();
	4653	+ $others = array( 'en_US' );
	4654	+
	4655	+ if ( ! empty( $GLOBALS['wp_local_package'] ) && is_string( $GLOBALS['wp_local_package'] ) ) {
	4656	+ $others[] = $GLOBALS['wp_local_package'];
	4657	+ }
	4658	+
	4659	+ foreach ( array_unique( $others ) as $locale ) {
	4660	+ if ( $locale === $current || ! preg_match( '/^[A-Za-z0-9_]{2,24}$/', $locale ) ) {
	4661	+ continue;
	4662	+ }
	4663	+
	4664	+ // Without the English list in its place: asking about another
	4665	+ // language must not leave the scan believing that the list of the
	4666	+ // site itself was missing.
	4667	+ $checksums = $this->get_core_checksums( false, $locale, false );
	4668	+
	4669	+ if ( is_array( $checksums ) && isset( $checksums[ $file ] ) && $checksums[ $file ] === $actual_hash ) {
	4670	+ return true;
	4671	+ }
	4672	+ }
	4673	+
	4674	+ return false;
	4675	+ }
	4676	+
	4677	+ /**
1231	4678	* Scan plugins for modifications
1232	4679	*
1233	4680	* @return array Scan results.
1234	4681	*/
		@@ -1246,9 +4693,10 @@
1246	4693	if ( ! function_exists( 'get_plugins' ) ) {
1247	4694	require_once ABSPATH . 'wp-admin/includes/plugin.php';
1248	4695	}
1249	4696
1250		- $plugins = get_plugins();
	4697	+ $plugins = get_plugins();
	4698	+ $finished = array();
1251	4699
1252	4700	foreach ( $plugins as $plugin_file => $plugin_data ) {
1253	4701	// Check time limit
1254	4702	if ( $this->is_time_exceeded() ) {
		@@ -1256,21 +4704,12 @@
1256	4704	}
1257	4705
1258	4706	$plugin_slug = dirname( $plugin_file );
1259	4707
1260		- // Skip single-file plugins
1261		- if ( '.' === $plugin_slug ) {
	4708	+ if ( ! $this->plugin_has_turn( $plugin_slug ) ) {
1262	4709	continue;
1263	4710	}
1264	4711
1265		- // Skip slugs in their post-update grace window: wp.org may still be
1266		- // publishing the new version's checksums, so a scheduled scan here
1267		- // would raise benign "modified/extra" noise. The dedicated post-update
1268		- // verifier (vigilante_fi_postupdate_verify) handles these instead.
1269		- if ( $this->in_post_update_grace( 'plugin', $plugin_slug ) ) {
1270		- continue;
1271		- }
1272		-
1273	4712	// Get checksums from WordPress.org
1274	4713	$version = $plugin_data['Version'] ?? '';
1275	4714	$checksums = $this->get_plugin_checksums( $plugin_slug, $version );
1276	4715
		@@ -1275,8 +4714,22 @@
1275	4714	$checksums = $this->get_plugin_checksums( $plugin_slug, $version );
1276	4715
1277	4716	$has_checksums = ! is_wp_error( $checksums ) && 'not_found' !== $checksums;
1278	4717
	4718	+ // Say which plugins could not be compared, and why. A plugin that
	4719	+ // is not on WordPress.org is named as such; a failed request is an
	4720	+ // error of this scan, not a plugin without an official copy.
	4721	+ if ( is_wp_error( $checksums ) ) {
	4722	+ $results['errors'][] = sprintf(
	4723	+ /* translators: 1: Plugin name, 2: What went wrong */
	4724	+ __( 'The plugin %1$s could not be compared with its copy on WordPress.org: %2$s', 'vigilante' ),
	4725	+ $plugin_data['Name'] ?? $plugin_slug,
	4726	+ $checksums->get_error_message()
	4727	+ );
	4728	+ } elseif ( ! $has_checksums ) {
	4729	+ $results['unverified'][] = $plugin_data['Name'] ?? $plugin_slug;
	4730	+ }
	4731	+
1279	4732	$plugin_dir = WP_PLUGIN_DIR . '/' . $plugin_slug;
1280	4733
1281	4734	// Check known files against checksums (only if available)
1282	4735	if ( $has_checksums ) {
		@@ -1305,9 +4758,17 @@
1305	4758
1306	4759	$results['scanned']++;
1307	4760
1308	4761	if ( ! file_exists( $file_path ) ) {
1309		- continue; // Some files might not be installed
	4762	+ // Reported, and not just skipped: a file that is in the
	4763	+ // published copy and not on the server is part of what
	4764	+ // the scan found.
	4765	+ $results['missing'][] = array(
	4766	+ 'file' => 'plugins/' . $plugin_slug . '/' . $file,
	4767	+ 'type' => 'plugin',
	4768	+ 'plugin' => $plugin_data['Name'] ?? $plugin_slug,
	4769	+ );
	4770	+ continue;
1310	4771	}
1311	4772
1312	4773	if ( ! $this->hash_matches_published( $file_path, $expected_hash ) ) {
1313	4774	$results['modified'][] = array(
		@@ -1331,15 +4792,84 @@
1331	4792	$suspicious_only = ! $has_checksums; // Without checksums, only report files with suspicious code
1332	4793	$extra_results = $this->detect_extra_files( $plugin_dir, $known_files, 'plugin', $plugin_data['Name'], $suspicious_only );
1333	4794	$results['extra'] = array_merge( $results['extra'] ?? array(), $extra_results['extra'] );
1334	4795	$results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $extra_results['suspicious'] );
	4796	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $extra_results['errors'] ?? array() );
1335	4797	}
	4798	+
	4799	+ // The plugin had its whole turn. The one the time runs out on
	4800	+ // does not get here with time left, and is named with the ones
	4801	+ // behind it.
	4802	+ if ( ! $this->is_time_exceeded() ) {
	4803	+ $finished[ $plugin_file ] = true;
	4804	+
	4805	+ // Its folder, as a line for Excluded Paths: what a partial
	4806	+ // scan offers so that the next one spends its time on the
	4807	+ // rest. One that is already excluded was not looked at.
	4808	+ if ( ! $this->is_path_excluded( $plugin_dir . '/.' ) ) {
	4809	+ $results['checked'][] = $this->relative_path( $plugin_dir );
	4810	+ }
	4811	+ }
1336	4812	}
1337	4813
	4814	+ // The plugins the time did not reach, by name.
	4815	+ $results['not_checked'] = array();
	4816	+
	4817	+ foreach ( $plugins as $plugin_file => $plugin_data ) {
	4818	+ if ( isset( $finished[ $plugin_file ] ) || ! $this->plugin_has_turn( dirname( $plugin_file ) ) ) {
	4819	+ continue;
	4820	+ }
	4821	+
	4822	+ $results['not_checked'][] = (string) ( $plugin_data['Name'] ?? dirname( $plugin_file ) );
	4823	+ }
	4824	+
	4825	+ // Must-use plugins, drop-ins and loose PHP files, which have no
	4826	+ // official copy and no entry in the list above.
	4827	+ $results['unlisted_checked'] = false;
	4828	+
	4829	+ if ( ! $this->is_time_exceeded() ) {
	4830	+ $unlisted = $this->scan_unlisted_code();
	4831	+
	4832	+ $results['extra'] = array_merge( $results['extra'] ?? array(), $unlisted['extra'] );
	4833	+ $results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $unlisted['suspicious'] );
	4834	+ $results['unverified'] = array_merge( $results['unverified'] ?? array(), $unlisted['unverified'] );
	4835	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $unlisted['errors'] );
	4836	+
	4837	+ $results['unlisted_checked'] = ! $this->is_time_exceeded();
	4838	+ }
	4839	+
1338	4840	return $results;
1339	4841	}
1340	4842
1341	4843	/**
	4844	+ * Whether a plugin gets a turn of its own in scan_plugins()
	4845	+ *
	4846	+ * @param string $plugin_slug Folder of the plugin, or "." for a single file.
	4847	+ * @return bool
	4848	+ */
	4849	+ private function plugin_has_turn( $plugin_slug ) {
	4850	+ // Single-file plugins are loose PHP files: scan_unlisted_code().
	4851	+ if ( '.' === $plugin_slug ) {
	4852	+ return false;
	4853	+ }
	4854	+
	4855	+ // With the self-check on, Vigilant itself is verified by the
	4856	+ // sha256 triple-anchor block at the start of run_scan(): scanning
	4857	+ // it here again would duplicate findings and the md5 fetch. With
	4858	+ // the check off by filter, Vigilant is a regular plugin (legacy
	4859	+ // behaviour).
	4860	+ if ( dirname( VIGILANTE_PLUGIN_BASENAME ) === $plugin_slug && Vigilante_Self_Integrity::is_on() ) {
	4861	+ return false;
	4862	+ }
	4863	+
	4864	+ // Skip slugs in their post-update grace window: wp.org may still be
	4865	+ // publishing the new version's checksums, so a scheduled scan here
	4866	+ // would raise benign "modified/extra" noise. The dedicated post-update
	4867	+ // verifier (vigilante_fi_postupdate_verify) handles these instead.
	4868	+ return ! $this->in_post_update_grace( 'plugin', $plugin_slug );
	4869	+ }
	4870	+
	4871	+ /**
1342	4872	* Whether a file on disk matches a hash WordPress.org publishes for it.
1343	4873	*
1344	4874	* The wp.org checksums JSON gives, per file, an md5 (and usually a sha256)
1345	4875	* that may be a single string OR an array of strings: a file whose content
		@@ -1469,9 +4999,9 @@
1469	4999	return $response;
1470	5000	}
1471	5001
1472	5002	$status = wp_remote_retrieve_response_code( $response );
1473		- if ( 200 !== $status ) {
	5003	+ if ( 404 === (int) $status ) {
1474	5004	// Cache "not found" to avoid repeated requests (never during grace).
1475	5005	if ( ! $grace ) {
1476	5006	set_transient( $cache_key, 'not_found', HOUR_IN_SECONDS );
1477	5007	}
		@@ -1477,8 +5007,19 @@
1477	5007	}
1478	5008	return 'not_found';
1479	5009	}
1480	5010
	5011	+ if ( 200 !== (int) $status ) {
	5012	+ // WordPress.org answered, but not with the checksums. An outage is
	5013	+ // not a plugin with no published copy, and until now it passed
	5014	+ // for one: the plugin was quietly left uncompared.
	5015	+ return new WP_Error(
	5016	+ 'http_error',
	5017	+ /* translators: %d: HTTP status code */
	5018	+ sprintf( __( 'WordPress.org answered with status %d', 'vigilante' ), (int) $status )
	5019	+ );
	5020	+ }
	5021	+
1481	5022	$body = json_decode( wp_remote_retrieve_body( $response ), true );
1482	5023
1483	5024	if ( empty( $body['files'] ) ) {
1484	5025	return new WP_Error( 'no_checksums', __( 'No checksums found', 'vigilante' ) );
		@@ -1517,9 +5058,10 @@
1517	5058	'extra' => array(),
1518	5059	'errors' => array(),
1519	5060	);
1520	5061
1521		- $themes = wp_get_themes();
	5062	+ $themes = wp_get_themes();
	5063	+ $finished = array();
1522	5064
1523	5065	foreach ( $themes as $theme_slug => $theme ) {
1524	5066	// Check time limit
1525	5067	if ( $this->is_time_exceeded() ) {
		@@ -1535,8 +5077,20 @@
1535	5077	$checksums = $this->get_theme_checksums( $theme_slug, $version );
1536	5078
1537	5079	$has_checksums = ! is_wp_error( $checksums ) && 'not_found' !== $checksums;
1538	5080
	5081	+ // Same as for plugins: name what could not be compared, and why.
	5082	+ if ( is_wp_error( $checksums ) && 'not_found' !== $checksums->get_error_code() ) {
	5083	+ $results['errors'][] = sprintf(
	5084	+ /* translators: 1: Theme name, 2: What went wrong */
	5085	+ __( 'The theme %1$s could not be compared with its copy on WordPress.org: %2$s', 'vigilante' ),
	5086	+ $theme->get( 'Name' ),
	5087	+ $checksums->get_error_message()
	5088	+ );
	5089	+ } elseif ( ! $has_checksums ) {
	5090	+ $results['unverified'][] = $theme->get( 'Name' );
	5091	+ }
	5092	+
1539	5093	$theme_dir = $theme->get_stylesheet_directory();
1540	5094
1541	5095	// Check known files against checksums (only if available)
1542	5096	if ( $has_checksums ) {
		@@ -1565,8 +5119,13 @@
1565	5119
1566	5120	$results['scanned']++;
1567	5121
1568	5122	if ( ! file_exists( $file_path ) ) {
	5123	+ $results['missing'][] = array(
	5124	+ 'file' => 'themes/' . $theme_slug . '/' . $file,
	5125	+ 'type' => 'theme',
	5126	+ 'theme' => $theme->get( 'Name' ),
	5127	+ );
1569	5128	continue;
1570	5129	}
1571	5130
1572	5131	if ( ! $this->hash_matches_published( $file_path, $expected_hash ) ) {
		@@ -1589,11 +5148,32 @@
1589	5148	$suspicious_only = ! $has_checksums;
1590	5149	$extra_results = $this->detect_extra_files( $theme_dir, $known_files, 'theme', $theme->get( 'Name' ), $suspicious_only );
1591	5150	$results['extra'] = array_merge( $results['extra'] ?? array(), $extra_results['extra'] );
1592	5151	$results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $extra_results['suspicious'] );
	5152	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $extra_results['errors'] ?? array() );
1593	5153	}
	5154	+
	5155	+ // Same as for plugins: a whole turn, with time left.
	5156	+ if ( ! $this->is_time_exceeded() ) {
	5157	+ $finished[ $theme_slug ] = true;
	5158	+
	5159	+ if ( ! $this->is_path_excluded( $theme_dir . '/.' ) ) {
	5160	+ $results['checked'][] = $this->relative_path( $theme_dir );
	5161	+ }
	5162	+ }
1594	5163	}
1595	5164
	5165	+ // The themes the time did not reach, by name.
	5166	+ $results['not_checked'] = array();
	5167	+
	5168	+ foreach ( $themes as $theme_slug => $theme ) {
	5169	+ if ( isset( $finished[ $theme_slug ] ) || $this->in_post_update_grace( 'theme', $theme_slug ) ) {
	5170	+ continue;
	5171	+ }
	5172	+
	5173	+ $results['not_checked'][] = (string) $theme->get( 'Name' );
	5174	+ }
	5175	+
1596	5176	return $results;
1597	5177	}
1598	5178
1599	5179	/**
		@@ -1603,9 +5183,9 @@
1603	5183	* @param string $version Theme version.
1604	5184	* @return array|WP_Error
1605	5185	*/
1606	5186	private function get_theme_checksums( $slug, $version ) {
1607		- $cache_key = 'vigilante_theme_checksums_' . md5( $slug . $version );
	5187	+ $cache_key = 'vigilante_theme_package_' . md5( $slug . $version );
1608	5188
1609	5189	// Bypass the cache during the post-update grace window (see plugin path).
1610	5190	$grace = $this->in_post_update_grace( 'theme', $slug );
1611	5191
		@@ -1615,48 +5195,103 @@
1615	5195	return $cached;
1616	5196	}
1617	5197	}
1618	5198
1619		- $url = sprintf(
1620		- 'https://downloads.wordpress.org/theme-checksums/%s/%s.json',
1621		- $slug,
1622		- $version
1623		- );
	5199	+ /*
	5200	+ * WordPress.org publishes checksums for plugins and for core, and none
	5201	+ * for themes: the address this method asked until now answers 404 for
	5202	+ * every theme, so no theme was ever compared with anything and they
	5203	+ * were all treated as themes from elsewhere. What WordPress.org does
	5204	+ * publish is the package of each version, so the checksums are taken
	5205	+ * from there: the package is downloaded once per version, each file in
	5206	+ * it is hashed straight from the archive, nothing is unpacked to disk,
	5207	+ * and the result is kept for a month.
	5208	+ */
	5209	+ if ( '' === (string) $version || ! preg_match( '/^[A-Za-z0-9._-]+$/', (string) $slug ) ) {
	5210	+ return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
	5211	+ }
1624	5212
1625		- $response = wp_remote_get( $url, array( 'timeout' => 10 ) );
	5213	+ if ( ! class_exists( 'ZipArchive' ) ) {
	5214	+ return new WP_Error( 'no_zip', __( 'the zip extension of PHP is missing on this server', 'vigilante' ) );
	5215	+ }
1626	5216
1627		- if ( is_wp_error( $response ) ) {
1628		- return $response;
	5217	+ if ( ! function_exists( 'download_url' ) ) {
	5218	+ require_once ABSPATH . 'wp-admin/includes/file.php';
1629	5219	}
1630	5220
1631		- $status = wp_remote_retrieve_response_code( $response );
1632		- if ( 200 !== $status ) {
1633		- // Cache "not found" to avoid repeated requests (never during grace).
1634		- if ( ! $grace ) {
1635		- set_transient( $cache_key, 'not_found', HOUR_IN_SECONDS );
	5221	+ $package = download_url(
	5222	+ sprintf( 'https://downloads.wordpress.org/theme/%s.%s.zip', rawurlencode( $slug ), rawurlencode( (string) $version ) ),
	5223	+ 30
	5224	+ );
	5225	+
	5226	+ if ( is_wp_error( $package ) ) {
	5227	+ $data = $package->get_error_data();
	5228	+
	5229	+ // WordPress.org has no such theme or no such version: a theme from
	5230	+ // somewhere else. Anything other than a 404 is a failed download,
	5231	+ // and is reported as that instead of passing for a theme with no
	5232	+ // official copy.
	5233	+ if ( is_array( $data ) && isset( $data['code'] ) && 404 === (int) $data['code'] ) {
	5234	+ if ( ! $grace ) {
	5235	+ set_transient( $cache_key, 'not_found', 12 * HOUR_IN_SECONDS );
	5236	+ }
	5237	+ return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
1636	5238	}
1637		- return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
	5239	+
	5240	+ return $package;
1638	5241	}
1639	5242
1640		- $body = json_decode( wp_remote_retrieve_body( $response ), true );
	5243	+ $checksums = array();
	5244	+ $archive = new ZipArchive();
1641	5245
1642		- if ( empty( $body['files'] ) ) {
1643		- return new WP_Error( 'no_checksums', __( 'No checksums found', 'vigilante' ) );
	5246	+ if ( true === $archive->open( $package ) ) {
	5247	+ $prefix = $slug . '/';
	5248	+ $max_entry = 16 * MB_IN_BYTES;
	5249	+
	5250	+ for ( $i = 0; $i < $archive->numFiles; $i++ ) {
	5251	+ $entry = $archive->statIndex( $i );
	5252	+ $name = is_array( $entry ) ? (string) $entry['name'] : '';
	5253	+
	5254	+ // Everything in the package lives under the folder of the theme.
	5255	+ // Folders, anything outside it and any path with a ".."
	5256	+ // segment are not files of the theme.
	5257	+ if ( '' === $name || '/' === substr( $name, -1 ) || 0 !== strpos( $name, $prefix ) || preg_match( '#(?:^|/)\.\.(?:/|$)#', $name ) ) {
	5258	+ continue;
	5259	+ }
	5260	+
	5261	+ // Read up to a limit: an entry larger than this is not code,
	5262	+ // and is left out of the comparison instead of being loaded
	5263	+ // whole into memory.
	5264	+ $content = $archive->getFromIndex( $i, $max_entry + 1 );
	5265	+
	5266	+ if ( false === $content ) {
	5267	+ $checksums = array();
	5268	+ break;
	5269	+ }
	5270	+
	5271	+ if ( strlen( $content ) > $max_entry ) {
	5272	+ continue;
	5273	+ }
	5274	+
	5275	+ $checksums[ substr( $name, strlen( $prefix ) ) ] = array(
	5276	+ 'md5' => md5( $content ),
	5277	+ 'sha256' => hash( 'sha256', $content ),
	5278	+ );
	5279	+ }
	5280	+
	5281	+ $archive->close();
1644	5282	}
1645	5283
1646		- // Store the full per-file record (md5 + sha256), either of which may be a
1647		- // string or an array; hash_matches_published() handles both shapes.
1648		- $checksums = array();
1649		- foreach ( $body['files'] as $file => $data ) {
1650		- $checksums[ $file ] = array(
1651		- 'md5' => isset( $data['md5'] ) ? $data['md5'] : null,
1652		- 'sha256' => isset( $data['sha256'] ) ? $data['sha256'] : null,
1653		- );
	5284	+ wp_delete_file( $package );
	5285	+
	5286	+ if ( empty( $checksums ) ) {
	5287	+ return new WP_Error( 'no_checksums', __( 'the package from WordPress.org could not be read', 'vigilante' ) );
1654	5288	}
1655	5289
1656		- // Cache for 24 hours (never during grace).
	5290	+ // The package of a published version does not change, so it is kept
	5291	+ // for a month (never during grace).
1657	5292	if ( ! $grace ) {
1658		- set_transient( $cache_key, $checksums, DAY_IN_SECONDS );
	5293	+ set_transient( $cache_key, $checksums, MONTH_IN_SECONDS );
1659	5294	}
1660	5295
1661	5296	return $checksums;
1662	5297	}
		@@ -1669,36 +5304,56 @@
1669	5304	private function scan_uploads() {
1670	5305	$found = array(
1671	5306	'suspicious' => array(),
1672	5307	'extra' => array(),
	5308	+ 'errors' => array(),
1673	5309	);
1674	5310	$upload_dir = wp_upload_dir();
1675	5311	$base_dir = $upload_dir['basedir'];
1676		- $max_files = 10000; // Increased limit for thorough scanning
1677	5312	$files_checked = 0;
1678	5313
	5314	+ // The walk used to stop after 10,000 files without saying so, and a
	5315	+ // media library passes that with a few thousand images. Now it goes on
	5316	+ // for as long as its share of the scan time lasts, and says so when it
	5317	+ // is cut short. The share keeps a huge library from leaving the core
	5318	+ // and the plugins without their turn.
	5319	+ $deadline = $this->scan_start_time > 0 ? $this->scan_start_time + ( 0.4 * $this->max_scan_time ) : 0;
	5320	+
1679	5321	// Executable extensions that should never be in uploads
1680		- $dangerous_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar', 'phps' );
	5322	+ $dangerous_extensions = self::php_extensions();
1681	5323
	5324	+ // Files that change how PHP runs in the folder they are in.
	5325	+ $php_config_files = array( '.user.ini', 'php.ini' );
	5326	+
	5327	+ // Scripts a server can be told to run through CGI.
	5328	+ $script_extensions = array( 'cgi', 'pl', 'py', 'sh', 'shtml' );
	5329	+
1682	5330	if ( ! is_dir( $base_dir ) ) {
1683	5331	return $found;
1684	5332	}
1685	5333
1686	5334	try {
1687		- $iterator = new RecursiveIteratorIterator(
1688		- new RecursiveDirectoryIterator( $base_dir, RecursiveDirectoryIterator::SKIP_DOTS ),
1689		- RecursiveIteratorIterator::LEAVES_ONLY
1690		- );
1691		-
1692		- foreach ( $iterator as $file ) {
	5335	+ foreach ( self::walk_folder( $base_dir ) as $file ) {
1693	5336	// Check global time limit
1694	5337	if ( $this->is_time_exceeded() ) {
1695	5338	break;
1696	5339	}
1697	5340
1698		- // Check file limit
	5341	+ if ( $file->isDir() ) {
	5342	+ if ( ! $file->isReadable() ) {
	5343	+ $found['errors'][] = self::unreadable_folder_error( $file->getPathname() );
	5344	+ }
	5345	+ continue;
	5346	+ }
	5347	+
	5348	+ // Check the share of the scan time (every 500 files)
1699	5349	$files_checked++;
1700		- if ( $files_checked > $max_files ) {
	5350	+ if ( $deadline > 0 && 0 === $files_checked % 500 && microtime( true ) > $deadline ) {
	5351	+ $found['errors'][] = sprintf(
	5352	+ /* translators: %s: Number of files */
	5353	+ __( 'The uploads folder was not checked completely: the time for it ran out after %s files.', 'vigilante' ),
	5354	+ number_format_i18n( $files_checked )
	5355	+ );
1701	5356	break;
1702	5357	}
1703	5358
1704	5359	$file_path = $file->getPathname();
		@@ -1723,15 +5378,12 @@
1723	5378
1724	5379	$reason = __( 'PHP file found in uploads directory', 'vigilante' );
1725	5380
1726	5381	// Scan content for specific suspicious patterns
1727		- if ( $file->getSize() < 512000 ) { // Only scan files < 500KB
1728		- $content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
1729		- $pattern = $this->detect_suspicious_pattern( $content );
1730		- if ( $pattern ) {
1731		- /* translators: %s: Suspicious pattern found */
1732		- $reason = sprintf( __( 'PHP in uploads with suspicious code: %s', 'vigilante' ), $pattern );
1733		- }
	5382	+ $pattern = $this->search_file( $file_path );
	5383	+ if ( $pattern ) {
	5384	+ /* translators: %s: Suspicious pattern found */
	5385	+ $reason = sprintf( __( 'PHP in uploads with suspicious code: %s', 'vigilante' ), $pattern );
1734	5386	}
1735	5387
1736	5388	$found['suspicious'][] = array(
1737	5389	'file' => $relative,
		@@ -1741,9 +5393,12 @@
1741	5393	continue;
1742	5394	}
1743	5395
1744	5396	// 2. Check for double extensions (image.php.jpg, file.phtml.png)
1745		- if ( preg_match( '/\.(' . implode( '|', $dangerous_extensions ) . ')\.[a-z]{2,4}$/i', $basename ) ) {
	5397	+ // The second extension can be anything: a script renamed by a
	5398	+ // malware cleaner (shell.php.suspected) or numbered (shell.php.1)
	5399	+ // is as much of a finding as one dressed up as an image.
	5400	+ if ( preg_match( '/\.(' . implode( '|', $dangerous_extensions ) . ')\.[a-z0-9_~-]{1,16}$/i', $basename ) ) {
1746	5401	$found['suspicious'][] = array(
1747	5402	'file' => $relative,
1748	5403	'type' => 'double_extension',
1749	5404	'reason' => __( 'Double extension detected (possible disguised executable)', 'vigilante' ),
		@@ -1750,17 +5405,41 @@
1750	5405	);
1751	5406	continue;
1752	5407	}
1753	5408
	5409	+ // 2b. Files that change how PHP runs in this folder
	5410	+ if ( in_array( strtolower( $basename ), $php_config_files, true ) ) {
	5411	+ $found['suspicious'][] = array(
	5412	+ 'file' => $relative,
	5413	+ 'type' => 'php_config_in_uploads',
	5414	+ 'reason' => __( 'PHP configuration file in uploads', 'vigilante' ),
	5415	+ );
	5416	+ continue;
	5417	+ }
	5418	+
	5419	+ // 2c. Scripts in other languages
	5420	+ if ( in_array( $extension, $script_extensions, true ) ) {
	5421	+ $found['extra'][] = array(
	5422	+ 'file' => $relative,
	5423	+ 'type' => 'script_in_uploads',
	5424	+ 'reason' => __( 'Script file in uploads', 'vigilante' ),
	5425	+ );
	5426	+ continue;
	5427	+ }
	5428	+
1754	5429	// 3. Check for .htaccess files in uploads
1755		- // Read content to classify: dangerous rules = suspicious, protective rules = extra
	5430	+ // Read content to classify (see classify_htaccess_in_uploads())
1756	5431	if ( '.htaccess' === $basename ) {
1757	5432	$htaccess_result = $this->classify_htaccess_in_uploads( $file_path, $relative );
1758		- $found[ $htaccess_result['category'] ][] = $htaccess_result['item'];
	5433	+
	5434	+ // One that only denies access, or does nothing, is not a finding.
	5435	+ if ( 'none' !== $htaccess_result['category'] ) {
	5436	+ $found[ $htaccess_result['category'] ][] = $htaccess_result['item'];
	5437	+ }
1759	5438	}
1760	5439	}
1761	5440	} catch ( Exception $e ) {
1762		- // Ignore iterator errors
	5441	+ $found['errors'][] = self::unreadable_folder_error( $base_dir );
1763	5442	}
1764	5443
1765	5444	return $found;
1766	5445	}
		@@ -1767,94 +5446,515 @@
1767	5446
1768	5447	/**
1769	5448	* Classify a .htaccess file found in uploads directory
1770	5449	*
1771		- * Reads the file content to determine if it contains dangerous rules
1772		- * (enabling PHP execution, rewriting to executables) or protective rules
1773		- * (deny access, disable indexes). Dangerous = suspicious, protective = extra.
	5450	+ * The file is read the way Apache reads it: continued lines are joined,
	5451	+ * comments are dropped and each directive is looked at on its own. That
	5452	+ * replaces a handful of expressions run over the whole text, which took a
	5453	+ * commented line for a live one and the rule that forbids PHP for one that
	5454	+ * runs it, and let through the directives that turn CGI on.
1774	5455	*
	5456	+ * - Something that makes the server run code: suspicious.
	5457	+ * - Only directives that deny or switch something off: not reported.
	5458	+ * - Rewrite rules of its own and nothing that denies PHP: extra, because in
	5459	+ * that folder they replace the rules of the site root, the one that
	5460	+ * blocks PHP in uploads included (measured on Apache, 3 Oct 2026).
	5461	+ * - Anything else: extra, with what it contains.
	5462	+ *
1775	5463	* @param string $file_path Absolute file path.
1776	5464	* @param string $relative Relative file path for display.
1777		- * @return array Array with 'category' ('suspicious' or 'extra') and 'item' data.
	5465	+ * @return array Array with 'category' ('suspicious', 'extra' or 'none') and 'item' data.
1778	5466	*/
1779	5467	private function classify_htaccess_in_uploads( $file_path, $relative ) {
1780		- $content = '';
	5468	+ $content = false;
1781	5469
1782	5470	if ( filesize( $file_path ) < 65536 ) { // Only read files < 64KB
1783	5471	$content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
1784	5472	}
1785	5473
1786		- // If we can't read it or it's empty, treat as suspicious (unknown)
1787		- if ( empty( trim( $content ) ) ) {
	5474	+ $item = array(
	5475	+ 'file' => $relative,
	5476	+ 'type' => 'htaccess_in_uploads',
	5477	+ );
	5478	+
	5479	+ // A file that cannot be read cannot be vouched for.
	5480	+ if ( false === $content ) {
	5481	+ $item['reason'] = __( '.htaccess file in uploads directory that could not be read', 'vigilante' );
	5482	+
1788	5483	return array(
1789	5484	'category' => 'suspicious',
1790		- 'item' => array(
1791		- 'file' => $relative,
1792		- 'type' => 'htaccess_in_uploads',
1793		- 'reason' => __( '.htaccess file in uploads directory (empty or unreadable)', 'vigilante' ),
1794		- ),
	5485	+ 'item' => $item,
1795	5486	);
1796	5487	}
1797	5488
1798		- // Dangerous patterns: rules that enable code execution or rewrite to executables
1799		- $dangerous_patterns = array(
1800		- '/AddHandler\s+.*(php|cgi|pl|py)/i' => 'AddHandler enabling script execution',
1801		- '/AddType\s+application\/x-httpd-php/i' => 'AddType enabling PHP execution',
1802		- '/SetHandler\s+.*(php|cgi)/i' => 'SetHandler enabling script execution',
1803		- '/php_flag\s+engine\s+on/i' => 'PHP engine enabled',
1804		- '/php_admin_flag\s+engine\s+on/i' => 'PHP admin engine enabled',
1805		- '/RewriteRule\s+.*\.(php|phtml|phar)/i' => 'Rewrite rule targeting PHP files',
1806		- '/auto_prepend_file/i' => 'auto_prepend_file directive',
1807		- '/auto_append_file/i' => 'auto_append_file directive',
	5489	+ $facts = self::read_htaccess_rules( $content );
	5490	+
	5491	+ if ( ! empty( $facts['runs'] ) ) {
	5492	+ $item['reason'] = self::htaccess_run_reason( $facts );
	5493	+
	5494	+ return array(
	5495	+ 'category' => 'suspicious',
	5496	+ 'item' => $item,
	5497	+ );
	5498	+ }
	5499	+
	5500	+ if ( $facts['rewrite'] && ! $facts['denies_php'] ) {
	5501	+ $item['reason'] = __( '.htaccess in uploads with rewrite rules of its own: in this folder they replace the ones of the site root, the rule that blocks PHP in uploads included', 'vigilante' );
	5502	+
	5503	+ return array(
	5504	+ 'category' => 'extra',
	5505	+ 'item' => $item,
	5506	+ );
	5507	+ }
	5508	+
	5509	+ // Empty, or nothing in it that does not deny or switch something off:
	5510	+ // it protects the folder, or does nothing, and is not a finding.
	5511	+ if ( empty( $facts['other'] ) ) {
	5512	+ return array(
	5513	+ 'category' => 'none',
	5514	+ 'item' => null,
	5515	+ );
	5516	+ }
	5517	+
	5518	+ $kinds = array(
	5519	+ 'access' => __( 'access rules', 'vigilante' ),
	5520	+ 'rewrite' => __( 'rewrite rules', 'vigilante' ),
	5521	+ 'headers' => __( 'cache or header rules', 'vigilante' ),
	5522	+ 'other' => __( 'other rules', 'vigilante' ),
1808	5523	);
1809	5524
1810		- foreach ( $dangerous_patterns as $pattern => $label ) {
1811		- if ( preg_match( $pattern, $content ) ) {
1812		- return array(
1813		- 'category' => 'suspicious',
1814		- 'item' => array(
1815		- 'file' => $relative,
1816		- 'type' => 'htaccess_in_uploads',
1817		- /* translators: %s: Dangerous rule description */
1818		- 'reason' => sprintf( __( '.htaccess with dangerous rule: %s', 'vigilante' ), $label ),
1819		- ),
1820		- );
	5525	+ /* translators: %s: Summary of rules found in the .htaccess file */
	5526	+ $item['reason'] = sprintf( __( '.htaccess in uploads (likely from plugin). Contains: %s', 'vigilante' ), implode( ', ', array_intersect_key( $kinds, $facts['other'] ) ) );
	5527	+
	5528	+ return array(
	5529	+ 'category' => 'extra',
	5530	+ 'item' => $item,
	5531	+ );
	5532	+ }
	5533	+
	5534	+ /**
	5535	+ * The reason shown for a .htaccess that makes the server run code
	5536	+ *
	5537	+ * @param array $facts What read_htaccess_rules() found.
	5538	+ * @return string
	5539	+ */
	5540	+ private static function htaccess_run_reason( $facts ) {
	5541	+ $labels = array(
	5542	+ 'run' => __( 'makes the server run files of this folder as code', 'vigilante' ),
	5543	+ 'load' => __( 'loads a file on every PHP request', 'vigilante' ),
	5544	+ 'rewrite' => __( 'sends requests to a PHP file', 'vigilante' ),
	5545	+ 'cgi' => __( 'turns on CGI or server-side includes', 'vigilante' ),
	5546	+ );
	5547	+
	5548	+ /* translators: %s: What the rule does */
	5549	+ return sprintf( __( '.htaccess with a rule that affects how code runs: %s', 'vigilante' ), implode( '; ', array_intersect_key( $labels, $facts['runs'] ) ) );
	5550	+ }
	5551	+
	5552	+ /**
	5553	+ * What a section of a .htaccess says about the directives inside it
	5554	+ *
	5555	+ * @param string $name Section name, in lower case.
	5556	+ * @param string $args What follows the name, as written.
	5557	+ * @return string '' when it changes nothing (<RequireAll>), 'rewrite' for
	5558	+ * <IfModule mod_rewrite.c>, 'maybe' for any other test of
	5559	+ * what the server has, 'files-php' for a <Files> or
	5560	+ * <FilesMatch> that names PHP files, 'files' for one that
	5561	+ * names other files, and 'condition' for the rest (<Limit>,
	5562	+ * <If>, <RequireAny>...), which apply to some requests only.
	5563	+ */
	5564	+ private static function htaccess_section_kind( $name, $args ) {
	5565	+ $args = trim( rtrim( trim( $args ), '>' ) );
	5566	+
	5567	+ if ( 'requireall' === $name ) {
	5568	+ return '';
	5569	+ }
	5570	+
	5571	+ if ( 'ifmodule' === $name ) {
	5572	+ return in_array( strtolower( trim( $args, '"\' ' ) ), array( 'mod_rewrite.c', 'rewrite_module' ), true ) ? 'rewrite' : 'maybe';
	5573	+ }
	5574	+
	5575	+ if ( in_array( $name, array( 'ifdefine', 'ifversion' ), true ) ) {
	5576	+ return 'maybe';
	5577	+ }
	5578	+
	5579	+ if ( 'files' === $name || 'filesmatch' === $name ) {
	5580	+ $regex = 'filesmatch' === $name;
	5581	+
	5582	+ if ( ! $regex && '~' === substr( $args, 0, 1 ) ) {
	5583	+ $regex = true;
	5584	+ $args = trim( substr( $args, 1 ) );
1821	5585	}
	5586	+
	5587	+ return true === self::extension_pattern_names_php( trim( $args, '"\'' ), $regex, false ) ? 'files-php' : 'files';
1822	5588	}
1823	5589
1824		- // Identify what protective/benign rules it contains for informational display
1825		- $found_rules = array();
	5590	+ return 'condition';
	5591	+ }
1826	5592
1827		- $benign_patterns = array(
1828		- '/Deny\s+from\s+all/i' => 'Deny from all',
1829		- '/Require\s+all\s+denied/i' => 'Require all denied',
1830		- '/Options\s+.*-Indexes/i' => 'Options -Indexes',
1831		- '/Header\s+set/i' => 'Header rules',
1832		- '/ExpiresActive/i' => 'Expires/cache rules',
1833		- '/RewriteEngine/i' => 'Rewrite rules',
1834		- '/FilesMatch/i' => 'FilesMatch rules',
1835		- '/ForceType\s+application\/octet/i' => 'ForceType (force download)',
	5593	+ /**
	5594	+ * Whether a pattern that goes only by the extension of a file names the PHP ones
	5595	+ *
	5596	+ * "Every PHP file" cannot be asked of a sample name. A sample is public,
	5597	+ * so a section can be written for it and nothing else, and an expression
	5598	+ * can name every file but one ("all but shell.php") in more ways than can
	5599	+ * be tried. So the pattern has to be of a kind that cannot tell one name
	5600	+ * from another: any name, a dot and a list of extensions, to the end. In
	5601	+ * that kind there is nothing to make an exception with, and whether .php
	5602	+ * is on the list is then a fair question for a sample. Anything else is
	5603	+ * not taken for a denial of PHP, which only means the .htaccess is listed.
	5604	+ *
	5605	+ * @param string $pattern Pattern, without its quotes.
	5606	+ * @param bool $regex Whether it is an expression (FilesMatch, "Files ~",
	5607	+ * RewriteRule) or a wildcard (Files).
	5608	+ * @param bool $nocase Whether it ignores case.
	5609	+ * @return bool|null True when it names every .php file, false when it goes
	5610	+ * by the extension and .php is not one of them, null
	5611	+ * when it is not of that kind.
	5612	+ */
	5613	+ private static function extension_pattern_names_php( $pattern, $regex, $nocase ) {
	5614	+ if ( ! $regex ) {
	5615	+ if ( 1 !== preg_match( '/^\*\.[a-z0-9*?]+$/i', $pattern ) ) {
	5616	+ return null;
	5617	+ }
	5618	+
	5619	+ return function_exists( 'fnmatch' ) ? fnmatch( $pattern, 'x.php' ) : '*.php' === $pattern;
	5620	+ }
	5621	+
	5622	+ $rest = $pattern;
	5623	+
	5624	+ if ( 0 === stripos( $rest, '(?i)' ) ) {
	5625	+ $rest = substr( $rest, 4 );
	5626	+ $nocase = true;
	5627	+ }
	5628	+
	5629	+ // "Any name" in front, written out or left out, and then a dot, the
	5630	+ // extensions and the end, written out or left out too. The extensions
	5631	+ // are letters, digits, groups, alternatives and classes of letters and
	5632	+ // digits: no dot, no "any character", nothing negated and nothing
	5633	+ // that looks around.
	5634	+ $rest = preg_replace( '/^\^?\.[*+]/', '', $rest, 1 );
	5635	+
	5636	+ if ( 1 !== preg_match( '/^\\\\\.(?:[a-z0-9|?*+)]|\\\\d|\[[a-z0-9-]+\]|\((?:\?i?:)?)+\$?$/i', (string) $rest ) ) {
	5637	+ return null;
	5638	+ }
	5639	+
	5640	+ // The dot has to be there: with "?" or "*" after it, what follows
	5641	+ // would be looked for anywhere in the name. And an alternative
	5642	+ // outside a group is a second pattern with no dot in front of it,
	5643	+ // which goes by the name again.
	5644	+ if ( 1 === preg_match( '/^\\\\\.[?*+]/', $rest ) ) {
	5645	+ return null;
	5646	+ }
	5647	+
	5648	+ $depth = 0;
	5649	+
	5650	+ for ( $i = 0, $length = strlen( $rest ); $i < $length; $i++ ) {
	5651	+ if ( '(' === $rest[ $i ] ) {
	5652	+ $depth++;
	5653	+ } elseif ( ')' === $rest[ $i ] ) {
	5654	+ $depth--;
	5655	+ }
	5656	+
	5657	+ if ( $depth < 0 || ( 0 === $depth && '|' === $rest[ $i ] ) ) {
	5658	+ return null;
	5659	+ }
	5660	+ }
	5661	+
	5662	+ if ( 0 !== $depth ) {
	5663	+ return null;
	5664	+ }
	5665	+
	5666	+ $expression = '~' . str_replace( '~', '\\~', $pattern ) . '~' . ( $nocase ? 'i' : '' );
	5667	+
	5668	+ foreach ( array( 'x.php', 'a/b/x.php' ) as $sample ) {
	5669	+ $matched = @preg_match( $expression, $sample ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- A pattern Apache would refuse names nothing.
	5670	+
	5671	+ if ( false === $matched ) {
	5672	+ return null;
	5673	+ }
	5674	+
	5675	+ if ( 0 === $matched ) {
	5676	+ return false;
	5677	+ }
	5678	+ }
	5679	+
	5680	+ return true;
	5681	+ }
	5682	+
	5683	+ /**
	5684	+ * Whether a RewriteRule that refuses requests refuses every PHP file
	5685	+ *
	5686	+ * A pattern with a "!" in front refuses what it does not match, so it
	5687	+ * refuses PHP when it goes by the extension and .php is not one of them
	5688	+ * ("!\.(jpe?g|png)$": everything but the images).
	5689	+ *
	5690	+ * @param string $pattern Pattern of the rule.
	5691	+ * @param string $flags Flags of the rule, in lower case.
	5692	+ * @return bool
	5693	+ */
	5694	+ private static function rewrite_rule_refuses_php( $pattern, $flags ) {
	5695	+ $pattern = trim( $pattern, '"\'' );
	5696	+ $negated = '' !== $pattern && '!' === $pattern[0];
	5697	+
	5698	+ if ( $negated ) {
	5699	+ $pattern = substr( $pattern, 1 );
	5700	+ }
	5701	+
	5702	+ if ( '' === $pattern ) {
	5703	+ return false;
	5704	+ }
	5705	+
	5706	+ $names = self::extension_pattern_names_php( $pattern, true, (bool) preg_match( '/[\[,]\s*(?:nc|nocase)\s*[,\]]/', $flags ) );
	5707	+
	5708	+ return $negated ? false === $names : true === $names;
	5709	+ }
	5710	+
	5711	+ /**
	5712	+ * What the directives of a .htaccess do, as far as running code goes
	5713	+ *
	5714	+ * @param string $content Content of the file.
	5715	+ * @return array {
	5716	+ * @type array $runs Ways it makes the server run code, as keys:
	5717	+ * 'run', 'load', 'rewrite', 'cgi'.
	5718	+ * @type array $other Kinds of directive that neither run code nor
	5719	+ * only deny, as keys: 'access', 'rewrite',
	5720	+ * 'headers', 'other'.
	5721	+ * @type bool $rewrite Whether it has rewrite directives of its own.
	5722	+ * @type bool $denies_php Whether it denies access to every PHP file
	5723	+ * itself, for every request and whatever the
	5724	+ * server has loaded.
	5725	+ * }
	5726	+ */
	5727	+ private static function read_htaccess_rules( $content ) {
	5728	+ $facts = array(
	5729	+ 'runs' => array(),
	5730	+ 'other' => array(),
	5731	+ 'rewrite' => false,
	5732	+ 'denies_php' => false,
1836	5733	);
1837	5734
1838		- foreach ( $benign_patterns as $pattern => $label ) {
1839		- if ( preg_match( $pattern, $content ) ) {
1840		- $found_rules[] = $label;
	5735	+ // A line that ends in a backslash goes on in the next one, and Apache
	5736	+ // joins the two before it looks at anything else, comments included.
	5737	+ $content = str_replace( array( "\r\n", "\r" ), "\n", (string) $content );
	5738	+ $content = preg_replace( '/(?<!\\\\)\\\\\n/', '', $content );
	5739	+
	5740	+ // "script" as a word of its own: cgi-script and php-script are
	5741	+ // handlers that run code, application/javascript is a kind of file.
	5742	+ $scripts = '/php|cgi|(?<![a-z])script|lsapi|server-parsed|proxy:|python-program/';
	5743	+ $php_target = '/\.(?:ph(?:p\d*|tml|t|ar|ps)|inc)(?![a-z0-9])/';
	5744	+ $containers = array();
	5745	+ $cgi_handler = false;
	5746	+ $execcgi_on = false;
	5747	+ $execcgi_off = false;
	5748	+
	5749	+ foreach ( explode( "\n", (string) $content ) as $line ) {
	5750	+ $line = trim( $line );
	5751	+
	5752	+ if ( '' === $line || '#' === $line[0] ) {
	5753	+ continue;
1841	5754	}
	5755	+
	5756	+ // Sections are remembered, to know what a directive inside them
	5757	+ // applies to (see htaccess_section_kind()).
	5758	+ if ( '<' === $line[0] ) {
	5759	+ if ( preg_match( '/^<\s*\//', $line ) ) {
	5760	+ array_pop( $containers );
	5761	+ } elseif ( preg_match( '/^<\s*([A-Za-z]+)\b(.*)$/', $line, $section ) ) {
	5762	+ $containers[] = self::htaccess_section_kind( strtolower( $section[1] ), $section[2] );
	5763	+ }
	5764	+ continue;
	5765	+ }
	5766	+
	5767	+ if ( ! preg_match( '/^([A-Za-z_]+)\s*(.*)$/', $line, $parts ) ) {
	5768	+ $facts['other']['other'] = true;
	5769	+ continue;
	5770	+ }
	5771	+
	5772	+ $name = strtolower( $parts[1] );
	5773	+ $args = trim( $parts[2] );
	5774	+ $low = strtolower( $args );
	5775	+ $words = preg_split( '/\s+/', $low, -1, PREG_SPLIT_NO_EMPTY );
	5776	+ $first = isset( $words[0] ) ? trim( $words[0], '"\'' ) : '';
	5777	+
	5778	+ // The sections around this line that put a condition on it.
	5779	+ $inside = array_values( array_diff( $containers, array( '' ) ) );
	5780	+
	5781	+ switch ( $name ) {
	5782	+ case 'sethandler':
	5783	+ case 'addhandler':
	5784	+ case 'addtype':
	5785	+ case 'forcetype':
	5786	+ if ( preg_match( $scripts, $first ) ) {
	5787	+ // "AddHandler cgi-script" next to "Options -ExecCGI" is
	5788	+ // the old recipe that hands every script to CGI and
	5789	+ // forbids CGI. Which of the two it is gets decided
	5790	+ // once the whole file has been read.
	5791	+ if ( 'addhandler' === $name && false !== strpos( $first, 'cgi' ) ) {
	5792	+ $cgi_handler = true;
	5793	+ } else {
	5794	+ $facts['runs']['run'] = true;
	5795	+ }
	5796	+ } elseif ( ! in_array( $first, array( 'none', 'default-handler', 'text/plain', 'application/octet-stream' ), true ) ) {
	5797	+ $facts['other']['other'] = true;
	5798	+ }
	5799	+ break;
	5800	+
	5801	+ case 'php_flag':
	5802	+ case 'php_admin_flag':
	5803	+ case 'php_value':
	5804	+ case 'php_admin_value':
	5805	+ $value = isset( $words[1] ) ? trim( $words[1], '"\'' ) : '';
	5806	+
	5807	+ if ( 'engine' === $first ) {
	5808	+ if ( ! in_array( $value, array( 'off', '0', 'false', 'no' ), true ) ) {
	5809	+ $facts['runs']['run'] = true;
	5810	+ }
	5811	+ } elseif ( in_array( $first, array( 'auto_prepend_file', 'auto_append_file' ), true ) ) {
	5812	+ if ( '' !== $value && 'none' !== $value ) {
	5813	+ $facts['runs']['load'] = true;
	5814	+ }
	5815	+ } else {
	5816	+ $facts['other']['other'] = true;
	5817	+ }
	5818	+ break;
	5819	+
	5820	+ case 'options':
	5821	+ foreach ( $words as $option ) {
	5822	+ // Only a ban on CGI that holds for everybody counts as one.
	5823	+ if ( '-execcgi' === $option && empty( $inside ) ) {
	5824	+ $execcgi_off = true;
	5825	+ }
	5826	+
	5827	+ if ( '-' === $option[0] || 'none' === $option ) {
	5828	+ continue;
	5829	+ }
	5830	+
	5831	+ $option = ltrim( $option, '+' );
	5832	+
	5833	+ if ( in_array( $option, array( 'execcgi', 'includes', 'all' ), true ) ) {
	5834	+ $facts['runs']['cgi'] = true;
	5835	+ $execcgi_on = true;
	5836	+ } else {
	5837	+ $facts['other']['other'] = true;
	5838	+ }
	5839	+ }
	5840	+ break;
	5841	+
	5842	+ case 'addoutputfilter':
	5843	+ case 'setoutputfilter':
	5844	+ case 'addoutputfilterbytype':
	5845	+ if ( false !== strpos( $low, 'includes' ) ) {
	5846	+ $facts['runs']['cgi'] = true;
	5847	+ } else {
	5848	+ $facts['other']['other'] = true;
	5849	+ }
	5850	+ break;
	5851	+
	5852	+ case 'action':
	5853	+ $facts['runs']['cgi'] = true;
	5854	+ break;
	5855	+
	5856	+ case 'xbithack':
	5857	+ // Server-side includes for every file with the execute bit.
	5858	+ if ( 'off' !== $first ) {
	5859	+ $facts['runs']['cgi'] = true;
	5860	+ }
	5861	+ break;
	5862	+
	5863	+ case 'deny':
	5864	+ case 'require':
	5865	+ $denies = 'deny' === $name ? ( 'from' === $first && isset( $words[1] ) && 'all' === $words[1] ) : ( 'all' === $first && isset( $words[1] ) && 'denied' === $words[1] );
	5866	+
	5867	+ if ( ! $denies || in_array( 'condition', $inside, true ) ) {
	5868	+ $facts['other']['access'] = true;
	5869	+ } elseif ( ! array_diff( $inside, array( 'rewrite', 'files-php' ) ) ) {
	5870	+ // For every request, on any server, and for every file
	5871	+ // or for the PHP ones. A denial that depends on a
	5872	+ // module being there, or that names other files, still
	5873	+ // protects, but it does not make up for rewrite rules
	5874	+ // that switch off the ones of the site root.
	5875	+ $facts['denies_php'] = true;
	5876	+ }
	5877	+ break;
	5878	+
	5879	+ case 'order':
	5880	+ case 'indexignore':
	5881	+ break;
	5882	+
	5883	+ case 'allow':
	5884	+ case 'satisfy':
	5885	+ case 'authtype':
	5886	+ case 'authname':
	5887	+ case 'authuserfile':
	5888	+ case 'authgroupfile':
	5889	+ $facts['other']['access'] = true;
	5890	+ break;
	5891	+
	5892	+ case 'rewriteengine':
	5893	+ case 'rewritebase':
	5894	+ case 'rewriteoptions':
	5895	+ $facts['rewrite'] = true;
	5896	+ break;
	5897	+
	5898	+ case 'rewritecond':
	5899	+ // A condition makes the rule after it apply to some
	5900	+ // requests and not to others, a denial included.
	5901	+ $facts['rewrite'] = true;
	5902	+ $facts['other']['rewrite'] = true;
	5903	+ break;
	5904	+
	5905	+ case 'rewriterule':
	5906	+ $facts['rewrite'] = true;
	5907	+
	5908	+ $rule = preg_split( '/\s+/', $args, 3 );
	5909	+ $pattern = isset( $rule[0] ) ? $rule[0] : '';
	5910	+ $target = isset( $rule[1] ) ? strtolower( trim( $rule[1], '"\'' ) ) : '';
	5911	+ $flags = isset( $rule[2] ) ? strtolower( $rule[2] ) : '';
	5912	+
	5913	+ if ( preg_match( '/[\[,]\s*h=/', $flags ) || preg_match( '/[\[,]\s*t=[^,\]]*(?:php|cgi|(?<![a-z])script)/', $flags ) ) {
	5914	+ // A handler or a type forced from the rule itself.
	5915	+ $facts['runs']['run'] = true;
	5916	+ } elseif ( '-' === $target && preg_match( '/[\[,]\s*(?:f|forbidden|g|gone)\s*[,\]]/', $flags ) ) {
	5917	+ // Rewrites nothing and refuses the request. It stands
	5918	+ // for the rule of the site root only when it refuses
	5919	+ // every PHP file, for every request.
	5920	+ if ( ! array_diff( $inside, array( 'rewrite' ) ) && self::rewrite_rule_refuses_php( $pattern, $flags ) ) {
	5921	+ $facts['denies_php'] = true;
	5922	+ } else {
	5923	+ $facts['other']['rewrite'] = true;
	5924	+ }
	5925	+ } elseif ( '-' === $target ) {
	5926	+ // Rewrites nothing and lets the request through, which
	5927	+ // can be the way to keep one file out of the denial
	5928	+ // that follows: it is not part of a file that only
	5929	+ // protects.
	5930	+ $facts['other']['rewrite'] = true;
	5931	+ } elseif ( preg_match( $php_target, $target ) && '/index.php' !== $target ) {
	5932	+ $facts['runs']['rewrite'] = true;
	5933	+ } else {
	5934	+ $facts['other']['rewrite'] = true;
	5935	+ }
	5936	+ break;
	5937	+
	5938	+ case 'header':
	5939	+ case 'requestheader':
	5940	+ case 'expiresactive':
	5941	+ case 'expiresbytype':
	5942	+ case 'expiresdefault':
	5943	+ case 'fileetag':
	5944	+ $facts['other']['headers'] = true;
	5945	+ break;
	5946	+
	5947	+ default:
	5948	+ $facts['other']['other'] = true;
	5949	+ }
1842	5950	}
1843	5951
1844		- $rules_summary = ! empty( $found_rules )
1845		- ? implode( ', ', $found_rules )
1846		- : __( 'Custom rules', 'vigilante' );
	5952	+ if ( $cgi_handler && ( $execcgi_on || ! $execcgi_off ) ) {
	5953	+ $facts['runs']['cgi'] = true;
	5954	+ }
1847	5955
1848		- return array(
1849		- 'category' => 'extra',
1850		- 'item' => array(
1851		- 'file' => $relative,
1852		- 'type' => 'htaccess_in_uploads',
1853		- /* translators: %s: Summary of rules found in the .htaccess file */
1854		- 'reason' => sprintf( __( '.htaccess in uploads (likely from plugin). Contains: %s', 'vigilante' ), $rules_summary ),
1855		- ),
1856		- );
	5956	+ return $facts;
1857	5957	}
1858	5958
1859	5959	/**
1860	5960	* Check content for suspicious patterns
		@@ -1898,25 +5998,45 @@
1898	5998	foreach ( $patterns_data['standard_patterns'] as $encoded_needle => $label ) {
1899	5999	// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- Decoding pattern definitions, not user input.
1900	6000	$needle = base64_decode( $encoded_needle );
1901	6001	if ( $this->needle_present( $content, $needle ) ) {
1902		- return $label;
	6002	+ // The labels live in the pattern file, in English: "$_GET access"
	6003	+ // becomes "$_GET", which needs no translation.
	6004	+ return preg_replace( '/ access$/', '', (string) $label );
1903	6005	}
1904	6006	}
1905	6007
1906		- // Check for preg_replace with /e modifier (code execution)
1907		- if ( preg_match( '/preg_replace\s*\(\s*[\'"].*\/e[\'"]/i', $content ) ) {
1908		- return 'preg_replace /e modifier';
	6008	+ return $this->detect_common_pattern( $content );
	6009	+ }
	6010	+
	6011	+ /**
	6012	+ * The three checks both levels of the search share
	6013	+ *
	6014	+ * @param string $content File content.
	6015	+ * @return string|false The pattern found, or false.
	6016	+ */
	6017	+ private function detect_common_pattern( $content ) {
	6018	+ // preg_replace with the /e modifier (arbitrary code execution,
	6019	+ // deprecated). The modifier is looked for on the same line and within
	6020	+ // 300 characters of the opening quote. With ".*" every preg_replace of
	6021	+ // a long line cost a pass over the whole line: 88 seconds for a file
	6022	+ // of 500 KB made for it, measured without the PCRE compiler.
	6023	+ if ( $this->found( '/preg_replace\s*+\(\s*+[\'"][^\n]{0,300}?\/e[\'"]/i', $content ) ) {
	6024	+ return __( 'preg_replace with the /e modifier, which runs code', 'vigilante' );
1909	6025	}
1910	6026
1911		- // Check for long hex-encoded strings (obfuscated payloads)
1912		- if ( preg_match( '/\\\\x[0-9a-f]{2}(\\\\x[0-9a-f]{2}){10,}/i', $content ) ) {
1913		- return 'hex-encoded string';
	6027	+ // Long hex-encoded strings (obfuscated payloads). Eleven escapes in a
	6028	+ // row and not "ten or more after the first": asked to take them all,
	6029	+ // PCRE gave up on a run of some 12,000, and a search that gave up
	6030	+ // read as "nothing found". The longer the payload, the less it was
	6031	+ // found.
	6032	+ if ( $this->found( '/(?:\\\\x[0-9a-f]{2}){11}/i', $content ) ) {
	6033	+ return __( 'a long string written in hexadecimal', 'vigilante' );
1914	6034	}
1915	6035
1916		- // Check for heavily concatenated chr() calls (char-by-char obfuscation)
1917		- if ( preg_match( '/chr\s*\(\s*\d+\s*\)\s*\.\s*chr\s*\(\s*\d+\s*\)\s*\.\s*chr/i', $content ) ) {
1918		- return 'chr() concatenation obfuscation';
	6036	+ // Heavily concatenated chr() calls (char-by-char obfuscation)
	6037	+ if ( $this->found( '/chr\s*+\(\s*+\d++\s*+\)\s*+\.\s*+chr\s*+\(\s*+\d++\s*+\)\s*+\.\s*+chr/i', $content ) ) {
	6038	+ return __( 'text built character by character with chr()', 'vigilante' );
1919	6039	}
1920	6040
1921	6041	return false;
1922	6042	}
		@@ -1953,29 +6073,94 @@
1953	6073	$as = $fragments['as'] ?? '';
1954	6074	$ss = $fragments['ss'] ?? '';
1955	6075	$cf = $fragments['cf'] ?? '';
1956	6076
1957		- // Obfuscation combos: dangerous function wrapping decoded content
	6077	+ // Obfuscation combos: dangerous function wrapping decoded content.
	6078	+ // The labels name the two functions side by side and not one inside
	6079	+ // the other. Written the way the code is written, a label was itself
	6080	+ // a match: the results of a scan, kept in a cache that stores options
	6081	+ // as PHP files under wp-content, would have been the next finding.
	6082	+ // The possessive quantifiers ("*+") change nothing in what matches,
	6083	+ // because what follows each run of spaces is never a space. They keep
	6084	+ // PCRE from walking a long run back one space at a time, which is
	6085	+ // where it gives up when it runs without its compiler.
1958	6086	$obfuscation_combos = array(
1959		- '/' . $ev . '\s*\(\s*' . $b6 . '\s*\(/i' => $ev . '(' . $b6 . '())',
1960		- '/' . $ev . '\s*\(\s*' . $gz . '\s*\(/i' => $ev . '(' . $gz . '())',
1961		- '/' . $ev . '\s*\(\s*' . $gu . '\s*\(/i' => $ev . '(' . $gu . '())',
1962		- '/' . $ev . '\s*\(\s*' . $sr . '\s*\(/i' => $ev . '(' . $sr . '())',
1963		- '/' . $ev . '\s*\(\s*' . $hb . '\s*\(/i' => $ev . '(' . $hb . '())',
1964		- '/' . $as . '\s*\(\s*' . $b6 . '\s*\(/i' => $as . '(' . $b6 . '())',
1965		- '/' . $ev . '\s*\(\s*\$[a-z_]+\s*\(/i' => $ev . '($variable())',
1966		- '/' . $ev . '\s*\(\s*' . $ss . '\s*\(/i' => $ev . '(' . $ss . '())',
	6087	+ '/' . $ev . '\s*+\(\s*+' . $b6 . '\s*+\(/i' => $ev . '() + ' . $b6 . '()',
	6088	+ '/' . $ev . '\s*+\(\s*+' . $gz . '\s*+\(/i' => $ev . '() + ' . $gz . '()',
	6089	+ '/' . $ev . '\s*+\(\s*+' . $gu . '\s*+\(/i' => $ev . '() + ' . $gu . '()',
	6090	+ '/' . $ev . '\s*+\(\s*+' . $sr . '\s*+\(/i' => $ev . '() + ' . $sr . '()',
	6091	+ '/' . $ev . '\s*+\(\s*+' . $hb . '\s*+\(/i' => $ev . '() + ' . $hb . '()',
	6092	+ '/' . $as . '\s*+\(\s*+' . $b6 . '\s*+\(/i' => $as . '() + ' . $b6 . '()',
	6093	+ '/' . $ev . '\s*+\(\s*+\$[a-z_]++\s*+\(/i' => $ev . '() + $variable()',
	6094	+ '/' . $ev . '\s*+\(\s*+' . $ss . '\s*+\(/i' => $ev . '() + ' . $ss . '()',
1967	6095	);
1968	6096
1969	6097	foreach ( $obfuscation_combos as $regex => $label ) {
1970		- if ( preg_match( $regex, $content ) ) {
	6098	+ if ( $this->found( $regex, $content ) ) {
1971	6099	return $label;
1972	6100	}
1973	6101	}
1974	6102
	6103	+ // The plain backdoor, with nothing to hide: data from the request
	6104	+ // handed straight to code or to the system, a function the request
	6105	+ // chooses, or a file included from another server. The names come
	6106	+ // from the list the concatenation check below uses, minus the decoders,
	6107	+ // so they are not written here either. That list is decoded once, for both.
	6108	+ $dangerous_names = array();
	6109	+ if ( ! empty( $patterns_data['dangerous_names'] ) ) {
	6110	+ foreach ( $patterns_data['dangerous_names'] as $encoded_name ) {
	6111	+ // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
	6112	+ $dangerous_names[] = base64_decode( $encoded_name );
	6113	+ }
	6114	+ }
	6115	+
	6116	+ $runners = array_merge( array_filter( array( $ev, $as ) ), array_diff( $dangerous_names, array( $b6, $gz, $gu, $sr, $hb ) ) );
	6117	+
	6118	+ // These three read as code what PHP reads as code, so they are
	6119	+ // searched with the comments of the file turned into blank space
	6120	+ // (blank_comments()). A comment that quotes one of them ("never do
	6121	+ // this: ...") is then not a finding, and a comment slipped between a
	6122	+ // name and its parenthesis hides nothing. The first two cannot match
	6123	+ // without a superglobal of the request, so only the files that name
	6124	+ // one are prepared that way, about one in twenty. The third is looked
	6125	+ // for in the file as it is and checked again that way when it matches.
	6126	+ $code = null;
	6127	+
	6128	+ if ( $this->found( '/\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b/', $content ) ) {
	6129	+ $code = $this->blank_comments( $content );
	6130	+
	6131	+ // When PHP cannot be asked what is a comment, the file is
	6132	+ // searched as it is: a comment may then be reported, and nothing
	6133	+ // that runs is left out.
	6134	+ $subject = false === $code ? $content : $code;
	6135	+
	6136	+ if ( ! empty( $runners ) ) {
	6137	+ $names = implode( '|', array_map( 'preg_quote', $runners ) );
	6138	+ // What the visitor sends, when it is not just being asked about
	6139	+ // with isset() or empty(). The path of an uploaded file is not in
	6140	+ // the list: handing it to a command is how images get processed.
	6141	+ $from_request = '(?<!isset\()(?<!isset\( )(?<!empty\()(?<!empty\( )(?:\$_(?:GET|POST|REQUEST|COOKIE)\b|\$_SERVER\s*\[\s*[\'"]HTTP_)';
	6142	+
	6143	+ // The possessive quantifiers keep a file made of spaces from
	6144	+ // costing a try per space.
	6145	+ if ( $this->found( '/(?<![a-z0-9_>:$])(?:' . $names . ')\s*+\(\s*+[^;\n]{0,80}?' . $from_request . '/i', $subject ) ) {
	6146	+ return __( 'data from the request is run as code or as a command', 'vigilante' );
	6147	+ }
	6148	+ }
	6149	+
	6150	+ if ( $this->found( '/\$_(?:GET|POST|REQUEST|COOKIE)\s*+\[[^\]\n]{1,60}\]\s*+\(/', $subject ) ) {
	6151	+ return __( 'a function chosen by the request is called', 'vigilante' );
	6152	+ }
	6153	+ }
	6154	+
	6155	+ if ( $this->found_in_code( '/(?<![a-z0-9_>$])(?:include|require)(?:_once)?\s*+(?:\(\s*+)?[\'"]https?:\/\//i', $content, $code ) ) {
	6156	+ return __( 'a file from another server is included', 'vigilante' );
	6157	+ }
	6158	+
1975	6159	// Deprecated dynamic function constructor, nearly always malicious in modern code
1976	6160	if ( ! empty( $cf ) && $this->needle_present( $content, $cf ) ) {
1977		- return $cf . ')';
	6161	+ // The name alone, for the same reason as the labels above.
	6162	+ return rtrim( $cf, '(' );
1978	6163	}
1979	6164
1980	6165	// Remote fetch piped into unserialize: a PHP object-injection / supply-chain
1981	6166	// vector seen in trojanized or nulled plugins (download a payload from a
		@@ -1985,11 +6170,21 @@
1985	6170	// checked that both strings appeared somewhere in the file, which
1986	6171	// false-positived on legitimate code using both in unrelated methods
1987	6172	// (e.g. a theme reading a transient with maybe_unserialize() while
1988	6173	// fetching its public IP with wp_remote_get()).
1989		- $us = $fragments['us'] ?? '';
1990		- if ( '' !== $us ) {
1991		- $us_regex = '/(?<![a-z0-9_])' . preg_quote( $us, '/' ) . '\s*\(/i';
	6174	+ //
	6175	+ // The search runs on a copy of the file in lower case, with
	6176	+ // expressions that tell the case apart, and only when the file names
	6177	+ // the function at all. PCRE without its compiler looks ahead for the
	6178	+ // first letter of an expression in both cases before each try, and
	6179	+ // when one of the two is not in the file that look runs to the end of
	6180	+ // it. pattern_near() asks once per match, so a file with thousands of
	6181	+ // them cost thousands of passes (26 seconds for 8 MB, measured). With
	6182	+ // one case to look for, each look stops at the next candidate.
	6183	+ $us = self::lower_ascii( $fragments['us'] ?? '' );
	6184	+ if ( '' !== $us && false !== stripos( $content, $us ) ) {
	6185	+ $lower = self::lower_ascii( $content );
	6186	+ $us_regex = '/(?<![a-z0-9_])' . preg_quote( $us, '/' ) . '\s*+\(/';
1992	6187	$remote_fetchers = array(
1993	6188	$fragments['wr'] ?? '', // wp_remote_get
1994	6189	$fragments['rb'] ?? '', // wp_remote_retrieve_body
1995	6190	$fragments['ce'] ?? '', // curl_exec
		@@ -1997,11 +6192,12 @@
1997	6192	foreach ( $remote_fetchers as $rf ) {
1998	6193	if ( '' === $rf ) {
1999	6194	continue;
2000	6195	}
2001		- $rf_regex = '/(?<![a-z0-9_])' . preg_quote( $rf, '/' ) . '\s*\(/i';
2002		- if ( $this->pattern_near( $content, $us_regex, $rf_regex, 600 ) ) {
2003		- return $rf . '() + ' . $us . '() remote deserialization';
	6196	+ $rf_regex = '/(?<![a-z0-9_])' . preg_quote( self::lower_ascii( $rf ), '/' ) . '\s*+\(/';
	6197	+ if ( $this->pattern_near( $lower, $us_regex, $rf_regex, 600 ) ) {
	6198	+ /* translators: 1: Function that downloads, 2: Function that unserializes */
	6199	+ return sprintf( __( 'data downloaded from another server is unserialized (%1$s and %2$s)', 'vigilante' ), $rf, $us );
2004	6200	}
2005	6201	}
2006	6202
2007	6203	// file_get_contents() is treated separately from the fetchers
		@@ -2014,51 +6210,106 @@
2014	6210	// argument is a URL, so the combo additionally requires a
2015	6211	// remote-scheme literal near the call before it fires.
2016	6212	$fg = $fragments['fg'] ?? '';
2017	6213	if ( '' !== $fg ) {
2018		- $fg_regex = '/(?<![a-z0-9_])' . preg_quote( $fg, '/' ) . '\s*\(/i';
2019		- $scheme_regex = '/(?:https?|ftps?):\/\/|php:\/\/input/i';
	6214	+ $fg_regex = '/(?<![a-z0-9_])' . preg_quote( self::lower_ascii( $fg ), '/' ) . '\s*+\(/';
	6215	+ $scheme_regex = '/(?:https?|ftps?):\/\/|php:\/\/input/';
2020	6216
2021		- if ( $this->pattern_near( $content, $us_regex, $fg_regex, 600 )
2022		- && $this->pattern_near( $content, $fg_regex, $scheme_regex, 600 ) ) {
2023		- return $fg . '() + ' . $us . '() remote deserialization';
	6217	+ if ( $this->pattern_near( $lower, $us_regex, $fg_regex, 600 )
	6218	+ && $this->pattern_near( $lower, $fg_regex, $scheme_regex, 600 ) ) {
	6219	+ /* translators: 1: Function that downloads, 2: Function that unserializes */
	6220	+ return sprintf( __( 'data downloaded from another server is unserialized (%1$s and %2$s)', 'vigilante' ), $fg, $us );
2024	6221	}
2025	6222	}
2026	6223	}
2027	6224
2028		- // preg_replace with /e modifier (arbitrary code execution, deprecated)
2029		- if ( preg_match( '/preg_replace\s*\(\s*[\'"].*\/e[\'"]/i', $content ) ) {
2030		- return 'preg_replace /e modifier';
	6225	+ $common = $this->detect_common_pattern( $content );
	6226	+ if ( $common ) {
	6227	+ return $common;
2031	6228	}
2032	6229
2033		- // Long hex-encoded strings (obfuscated payloads)
2034		- if ( preg_match( '/\\\\x[0-9a-f]{2}(\\\\x[0-9a-f]{2}){10,}/i', $content ) ) {
2035		- return 'hex-encoded string';
	6230	+ // Dangerous function names built from string concatenation: a variable
	6231	+ // given a name in pieces and then called. The assignments are taken
	6232	+ // one at a time and the calls are looked up in one pass. Collecting
	6233	+ // every assignment of the file first, and then searching the whole
	6234	+ // file again for each one, took memory and time that grew with the
	6235	+ // square of the file.
	6236	+ $split = array();
	6237	+ $capped = false;
	6238	+ $offset = 0;
	6239	+
	6240	+ while ( true ) {
	6241	+ // A variable, "=" and a quoted piece followed by a dot: where a
	6242	+ // string put together from pieces starts.
	6243	+ $start = $this->next_match( '/\$([a-z_]\w*)\s*+=\s*+(?=["\'][a-z0-9_]*+["\']\s*+\.)/i', $content, $offset );
	6244	+
	6245	+ if ( null === $start ) {
	6246	+ break;
	6247	+ }
	6248	+
	6249	+ // The pieces are taken one by one, however many there are: a name
	6250	+ // can be padded with as many empty ones as its author likes, and
	6251	+ // asking PCRE for the whole chain at once is what made it give up.
	6252	+ $position = $start[0][1] + strlen( $start[0][0] );
	6253	+ $combined = '';
	6254	+ $closed = false;
	6255	+
	6256	+ while ( true ) {
	6257	+ $piece = $this->next_match( '/\G["\']([a-z0-9_]*+)["\']\s*+(\.\s*+|;)?+/i', $content, $position );
	6258	+
	6259	+ if ( null === $piece ) {
	6260	+ break;
	6261	+ }
	6262	+
	6263	+ // No name on the list is this long: past it, the letters are
	6264	+ // not kept, and the chain is still walked to its end.
	6265	+ if ( strlen( $combined ) <= 64 ) {
	6266	+ $combined .= self::lower_ascii( $piece[1][0] );
	6267	+ }
	6268	+
	6269	+ $position = $piece[0][1] + strlen( $piece[0][0] );
	6270	+ $after = isset( $piece[2] ) && $piece[2][1] >= 0 ? $piece[2][0] : '';
	6271	+
	6272	+ if ( '' === $after || ';' === $after ) {
	6273	+ $closed = ';' === $after;
	6274	+ break;
	6275	+ }
	6276	+ }
	6277	+
	6278	+ $offset = max( $position, $start[0][1] + 1 );
	6279	+
	6280	+ if ( $closed && in_array( $combined, $dangerous_names, true ) && ! isset( $split[ $start[1][0] ] ) ) {
	6281	+ $split[ $start[1][0] ] = $combined;
	6282	+
	6283	+ if ( count( $split ) >= 500 ) {
	6284	+ $capped = true;
	6285	+ break;
	6286	+ }
	6287	+ }
2036	6288	}
2037	6289
2038		- // Heavily concatenated chr() calls (char-by-char obfuscation)
2039		- if ( preg_match( '/chr\s*\(\s*\d+\s*\)\s*\.\s*chr\s*\(\s*\d+\s*\)\s*\.\s*chr/i', $content ) ) {
2040		- return 'chr() concatenation obfuscation';
2041		- }
	6290	+ if ( ! empty( $split ) ) {
	6291	+ $offset = 0;
2042	6292
2043		- // Detect dangerous function names built from string concatenation
2044		- if ( preg_match_all( '/\$([a-z_]\w*)\s*=\s*((?:["\'][a-z0-9_]*["\']\s*\.\s*)+["\'][a-z0-9_]*["\'])\s*;/i', $content, $matches, PREG_SET_ORDER ) ) {
2045		- $dangerous_names = array();
2046		- if ( ! empty( $patterns_data['dangerous_names'] ) ) {
2047		- foreach ( $patterns_data['dangerous_names'] as $encoded_name ) {
2048		- // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
2049		- $dangerous_names[] = base64_decode( $encoded_name );
	6293	+ while ( true ) {
	6294	+ $call = $this->next_match( '/\$([a-z_]\w*)\s*+\(/i', $content, $offset );
	6295	+
	6296	+ if ( null === $call ) {
	6297	+ break;
2050	6298	}
	6299	+
	6300	+ if ( isset( $split[ $call[1][0] ] ) ) {
	6301	+ /* translators: %s: Function name */
	6302	+ return sprintf( __( 'call to %s() with its name split in pieces', 'vigilante' ), $split[ $call[1][0] ] );
	6303	+ }
	6304	+
	6305	+ $offset = $call[0][1] + strlen( $call[0][0] );
2051	6306	}
2052	6307
2053		- foreach ( $matches as $match ) {
2054		- $combined = strtolower( preg_replace( '/["\'\s\.]/', '', $match[2] ) );
2055		- if ( in_array( $combined, $dangerous_names, true ) ) {
2056		- $var_pattern = '/\$' . preg_quote( $match[1], '/' ) . '\s*\(/';
2057		- if ( preg_match( $var_pattern, $content ) ) {
2058		- return 'obfuscated ' . $combined . '() call';
2059		- }
2060		- }
	6308	+ // More names in pieces than a file has any reason to hold, and
	6309	+ // not every one was followed: not searched, rather than clean.
	6310	+ if ( $capped ) {
	6311	+ $this->search_failed = true;
2061	6312	}
2062	6313	}
2063	6314
2064	6315	return false;
		@@ -2084,9 +6335,9 @@
2084	6335	return false;
2085	6336	}
2086	6337	if ( preg_match( '/^[a-z_][a-z0-9_]*\($/i', $needle ) ) {
2087	6338	$fn = rtrim( $needle, '(' );
2088		- return (bool) preg_match( '/(?<![a-z0-9_])' . preg_quote( $fn, '/' ) . '\s*\(/i', $content );
	6339	+ return $this->found( '/(?<![a-z0-9_])' . preg_quote( $fn, '/' ) . '\s*+\(/i', $content );
2089	6340	}
2090	6341	return stripos( $content, $needle ) !== false;
2091	6342	}
2092	6343
		@@ -2104,25 +6355,266 @@
2104	6355	* @param int $window Maximum byte distance between a match of each.
2105	6356	* @return bool
2106	6357	*/
2107	6358	private function pattern_near( $content, $regex_a, $regex_b, $window ) {
2108		- if ( ! preg_match_all( $regex_a, $content, $m_a, PREG_OFFSET_CAPTURE ) ) {
	6359	+ // Both lists come in order, so they are walked together: the match
	6360	+ // that is behind moves on, and no pair is compared twice. Every match
	6361	+ // of one used to be compared with every match of the other.
	6362	+ $a = $this->next_match( $regex_a, $content, 0 );
	6363	+ $b = $this->next_match( $regex_b, $content, 0 );
	6364	+
	6365	+ while ( null !== $a && null !== $b ) {
	6366	+ if ( abs( $a[0][1] - $b[0][1] ) <= $window ) {
	6367	+ return true;
	6368	+ }
	6369	+
	6370	+ if ( $a[0][1] < $b[0][1] ) {
	6371	+ $a = $this->next_match( $regex_a, $content, $a[0][1] + 1 );
	6372	+ } else {
	6373	+ $b = $this->next_match( $regex_b, $content, $b[0][1] + 1 );
	6374	+ }
	6375	+ }
	6376	+
	6377	+ return false;
	6378	+ }
	6379	+
	6380	+ /**
	6381	+ * A text with its capital letters from A to Z in lower case, and nothing else
	6382	+ *
	6383	+ * strtolower() follows the language of the server until PHP 8.2, and in
	6384	+ * Turkish a capital I does not become an i: a function name written in
	6385	+ * capitals would not be found there.
	6386	+ *
	6387	+ * @param string $text Text.
	6388	+ * @return string
	6389	+ */
	6390	+ private static function lower_ascii( $text ) {
	6391	+ return strtr( (string) $text, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz' );
	6392	+ }
	6393	+
	6394	+ /**
	6395	+ * Whether an expression matches, without taking a search that gave up for a "no"
	6396	+ *
	6397	+ * preg_match() answers false, and not 0, when PCRE stops before the end
	6398	+ * because a long run used up the stack of its compiler or its
	6399	+ * backtracking limit. Read as "nothing found", that is a file that passes
	6400	+ * as clean without having been searched. Measured on what was published
	6401	+ * until now: a hexadecimal string of some 12,000 characters made the
	6402	+ * expression that looks for hexadecimal strings give up. Every expression
	6403	+ * of the search goes through here or through next_match(), and a file on
	6404	+ * which one of them gave up is reported as not searched (search_file()).
	6405	+ *
	6406	+ * @param string $regex Expression, with delimiters and flags.
	6407	+ * @param string $content Text to search.
	6408	+ * @return bool
	6409	+ */
	6410	+ private function found( $regex, $content ) {
	6411	+ $result = preg_match( $regex, $content );
	6412	+
	6413	+ if ( false === $result ) {
	6414	+ $this->search_failed = true;
	6415	+ }
	6416	+
	6417	+ return 1 === $result;
	6418	+ }
	6419	+
	6420	+ /**
	6421	+ * The next match of an expression from a position on
	6422	+ *
	6423	+ * For the checks that walk every match. Asked for one at a time they take
	6424	+ * no memory to speak of, where preg_match_all() held every match of the
	6425	+ * file at once.
	6426	+ *
	6427	+ * @param string $regex Expression, with delimiters and flags.
	6428	+ * @param string $content Text to search.
	6429	+ * @param int $offset Where to start.
	6430	+ * @return array|null The match as PREG_OFFSET_CAPTURE gives it, or null.
	6431	+ */
	6432	+ private function next_match( $regex, $content, $offset ) {
	6433	+ $match = array();
	6434	+ $result = preg_match( $regex, $content, $match, PREG_OFFSET_CAPTURE, $offset );
	6435	+
	6436	+ if ( false === $result ) {
	6437	+ $this->search_failed = true;
	6438	+ }
	6439	+
	6440	+ return 1 === $result ? $match : null;
	6441	+ }
	6442	+
	6443	+ /**
	6444	+ * Whether an expression matches in the code of a file and not only in its comments
	6445	+ *
	6446	+ * @param string $regex Expression, with delimiters and flags.
	6447	+ * @param string $content File content.
	6448	+ * @param string|false|null $code The content with its comments blanked. Worked
	6449	+ * out here the first time it is needed and kept
	6450	+ * by the caller; false when it cannot be.
	6451	+ * @return bool
	6452	+ */
	6453	+ private function found_in_code( $regex, $content, &$code ) {
	6454	+ if ( ! $this->found( $regex, $content ) ) {
2109	6455	return false;
2110	6456	}
2111		- if ( ! preg_match_all( $regex_b, $content, $m_b, PREG_OFFSET_CAPTURE ) ) {
	6457	+
	6458	+ if ( null === $code ) {
	6459	+ $code = $this->blank_comments( $content );
	6460	+ }
	6461	+
	6462	+ // When PHP cannot be asked what is a comment, the match stands.
	6463	+ return false === $code || $this->found( $regex, $code );
	6464	+ }
	6465	+
	6466	+ /**
	6467	+ * The content of a PHP file with its comments turned into blank space
	6468	+ *
	6469	+ * PHP itself says what is a comment (token_get_all()), so nothing that
	6470	+ * runs can be taken for one: a "//" comment ends at "?>", a string that
	6471	+ * holds "/*" opens nothing, and so on, without a second reader of the
	6472	+ * language here to get any of it wrong. Each comment is replaced by as
	6473	+ * many spaces as it had characters, line breaks kept, so the result is as
	6474	+ * long as the original and what was on one line stays on one line.
	6475	+ *
	6476	+ * Three cases are left as they are, and then the match stands:
	6477	+ *
	6478	+ * - A file with a "<?" that is not "<?php" or "<?=". Whether PHP reads
	6479	+ * that as an opening tag depends on short_open_tag, which may not be
	6480	+ * set the same for the PHP that runs this scan as for the one that
	6481	+ * serves the site, and with it changes where the code starts and so
	6482	+ * what is a comment.
	6483	+ * - A comment that starts with "#[". PHP 8 reads that as an attribute and
	6484	+ * runs what follows it on the line; PHP 7 reads the whole line as a
	6485	+ * comment.
	6486	+ * - A file whose tokens would not fit in the memory that is left, or
	6487	+ * would take more than 64 MB. PHP returns one array per token, up to
	6488	+ * 450 bytes each, and a file can be written so that every byte is one:
	6489	+ * 400 KB of that took 180 MB with PHP 7.4 (measured). How many tokens
	6490	+ * there can be is counted first, without making them.
	6491	+ * - Any file, when PHP is set to read its source in another encoding
	6492	+ * (zend.multibyte). In Shift JIS, Big5 or GBK the second byte of a
	6493	+ * character can be a backslash, so where a string ends is not where
	6494	+ * it ends for a reader that goes byte by byte.
	6495	+ *
	6496	+ * @param string $content File content.
	6497	+ * @return string|false The content without its comments, or false when it
	6498	+ * cannot be told what is a comment.
	6499	+ */
	6500	+ private function blank_comments( $content ) {
	6501	+ if ( ! function_exists( 'token_get_all' ) || ini_get( 'zend.multibyte' ) || preg_match( '/<\?(?!php[ \t\r\n]|=)/i', $content ) ) {
2112	6502	return false;
2113	6503	}
2114		- foreach ( $m_a[0] as $a ) {
2115		- foreach ( $m_b[0] as $b ) {
2116		- if ( abs( $a[1] - $b[1] ) <= $window ) {
2117		- return true;
2118		- }
	6504	+
	6505	+ // No more tokens than this: each character that is not part of a
	6506	+ // word can be one, and so can each run of digits and each word.
	6507	+ $words = 0;
	6508	+ $others = preg_replace( '/[a-z_\x80-\xff][a-z0-9_\x80-\xff]*+|[0-9]++/i', '', $content, -1, $words );
	6509	+
	6510	+ if ( null === $others ) {
	6511	+ return false;
	6512	+ }
	6513	+
	6514	+ $needed = 450 * ( strlen( $others ) + $words + 2 ) + strlen( $content );
	6515	+ $limit = wp_convert_hr_to_bytes( ini_get( 'memory_limit' ) );
	6516	+ unset( $others );
	6517	+
	6518	+ if ( $needed > 64 * MB_IN_BYTES || ( $limit > 0 && ( $limit - memory_get_usage() ) < $needed ) ) {
	6519	+ return false;
	6520	+ }
	6521	+
	6522	+ $tokens = @token_get_all( $content ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- PHP 7 warns about what it cannot read in the file being scanned, such as a comment left open; the warning says nothing about this code.
	6523	+ $code = '';
	6524	+ $length = 0;
	6525	+
	6526	+ foreach ( $tokens as $token ) {
	6527	+ $text = is_array( $token ) ? $token[1] : $token;
	6528	+ $length += strlen( $text );
	6529	+
	6530	+ if ( is_array( $token ) && ( T_COMMENT === $token[0] || T_DOC_COMMENT === $token[0] ) && 0 !== strpos( $text, '#[' ) ) {
	6531	+ $text = preg_replace( '/[^\n]/', ' ', $text );
2119	6532	}
	6533	+
	6534	+ $code .= $text;
2120	6535	}
2121		- return false;
	6536	+
	6537	+ // The pieces have to add up to the file. If they do not, the
	6538	+ // positions cannot be trusted and neither can the result.
	6539	+ if ( strlen( $content ) !== $length || strlen( $code ) !== $length ) {
	6540	+ return false;
	6541	+ }
	6542	+
	6543	+ return $code;
2122	6544	}
2123	6545
2124	6546	/**
	6547	+ * Search one file for hidden code
	6548	+ *
	6549	+ * The one place where a file is read for that. Each scan used to read it
	6550	+ * by itself, and only when it was under 512,000 bytes: a larger file was
	6551	+ * not opened, and where the file was not going to be listed anyway (a
	6552	+ * plugin or a theme with no official copy) that was the same as calling
	6553	+ * it clean. Padding a file was enough to keep it out of the results.
	6554	+ *
	6555	+ * @param string $file_path Absolute path.
	6556	+ * @param bool $strict Use strict mode (see detect_suspicious_pattern()).
	6557	+ * @return string|false|null The pattern found, false when the file was
	6558	+ * searched and has none, or null when it could
	6559	+ * not be searched: it is larger than
	6560	+ * MAX_SEARCHED_BYTES, it cannot be read, or an
	6561	+ * expression gave up on it. The caller reports
	6562	+ * that instead of taking it for clean.
	6563	+ */
	6564	+ private function search_file( $file_path, $strict = false ) {
	6565	+ if ( ! is_file( $file_path ) || ! is_readable( $file_path ) ) {
	6566	+ return null;
	6567	+ }
	6568	+
	6569	+ $size = filesize( $file_path );
	6570	+
	6571	+ if ( false === $size || $size > self::MAX_SEARCHED_BYTES ) {
	6572	+ return null;
	6573	+ }
	6574	+
	6575	+ // One byte past the cap and no more, whatever the size said: a file
	6576	+ // that grew since it was measured is not read whole.
	6577	+ $content = file_get_contents( $file_path, false, null, 0, self::MAX_SEARCHED_BYTES + 1 ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look for hidden code; nothing is written.
	6578	+
	6579	+ if ( false === $content || strlen( $content ) > self::MAX_SEARCHED_BYTES ) {
	6580	+ return null;
	6581	+ }
	6582	+
	6583	+ $this->search_failed = false;
	6584	+ $pattern = $this->detect_suspicious_pattern( $content, $strict );
	6585	+
	6586	+ if ( $pattern ) {
	6587	+ return $pattern;
	6588	+ }
	6589	+
	6590	+ return $this->search_failed ? null : false;
	6591	+ }
	6592	+
	6593	+ /**
	6594	+ * The finding for a PHP file with no official copy that could not be searched
	6595	+ *
	6596	+ * @param string $file_path Absolute path.
	6597	+ * @param string $relative Path for display.
	6598	+ * @return array
	6599	+ */
	6600	+ private function not_searched_item( $file_path, $relative ) {
	6601	+ $size = is_file( $file_path ) ? filesize( $file_path ) : false;
	6602	+ $reason = __( 'PHP file that could not be searched for hidden code', 'vigilante' );
	6603	+
	6604	+ if ( false !== $size && $size > self::MAX_SEARCHED_BYTES ) {
	6605	+ /* translators: %s: File size, such as 12 MB */
	6606	+ $reason = sprintf( __( 'PHP file of %s, too large to be searched for hidden code', 'vigilante' ), size_format( $size ) );
	6607	+ }
	6608	+
	6609	+ return array(
	6610	+ 'file' => $relative,
	6611	+ 'type' => 'not_searched',
	6612	+ 'reason' => $reason,
	6613	+ );
	6614	+ }
	6615	+
	6616	+ /**
2125	6617	* Whether a file is a text file worth normalizing before the fallback hash
2126	6618	* comparison in hash_matches_published().
2127	6619	*
2128	6620	* @param string $file_path Absolute path.
		@@ -2206,14 +6698,22 @@
2206	6698	private function detect_extra_files( $directory, $checksums, $type, $name, $suspicious_only = false ) {
2207	6699	$found = array(
2208	6700	'suspicious' => array(),
2209	6701	'extra' => array(),
	6702	+ 'errors' => array(),
	6703	+ 'php_files' => 0,
2210	6704	);
2211		- $max_extra = 50; // Limit to prevent timeout on large plugins
2212		- $count = 0;
	6705	+ // Every PHP file is examined. Until now the walk stopped after 50, which
	6706	+ // in a plugin or theme with no official copy meant the first 50 files
	6707	+ // of the folder and nothing else. Only the list of plain extra files is
	6708	+ // bounded, so a folder full of generated PHP cannot fill the results;
	6709	+ // hidden code is reported wherever it is.
	6710	+ $max_listed = 500;
	6711	+ $listed = 0;
	6712	+ $truncated = false;
2213	6713
2214	6714	// Only check PHP files for performance
2215		- $php_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar' );
	6715	+ $php_extensions = self::php_extensions();
2216	6716
2217	6717	// Pre-normalize the checksum keys once so path-shape differences
2218	6718	// (Windows backslashes, a leading "./", doubled slashes) don't make a
2219	6719	// known file look "extra" and get scanned or flagged. Case is preserved.
		@@ -2222,21 +6722,39 @@
2222	6722	$known_normalized[ $this->normalize_rel_path( $known_file ) ] = true;
2223	6723	}
2224	6724
2225	6725	try {
2226		- $iterator = new RecursiveIteratorIterator(
2227		- new RecursiveDirectoryIterator( $directory, RecursiveDirectoryIterator::SKIP_DOTS ),
2228		- RecursiveIteratorIterator::LEAVES_ONLY
2229		- );
2230		-
2231		- foreach ( $iterator as $file ) {
2232		- if ( $this->is_time_exceeded() || $count >= $max_extra ) {
	6726	+ foreach ( self::walk_folder( $directory ) as $file ) {
	6727	+ if ( $this->is_time_exceeded() ) {
2233	6728	break;
2234	6729	}
2235	6730
2236	6731	$file_path = $file->getPathname();
	6732	+
	6733	+ if ( $file->isDir() ) {
	6734	+ if ( ! $file->isReadable() ) {
	6735	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	6736	+ }
	6737	+ continue;
	6738	+ }
	6739	+
2237	6740	$extension = strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) );
2238	6741
	6742	+ // A .htaccess, .user.ini or php.ini that is not part of the
	6743	+ // published copy is looked at for what it makes the server do.
	6744	+ if ( in_array( strtolower( basename( $file_path ) ), array( '.htaccess', '.user.ini', 'php.ini' ), true ) ) {
	6745	+ $config_path = $this->normalize_rel_path( str_replace( str_replace( '\\', '/', $directory ) . '/', '', str_replace( '\\', '/', $file_path ) ) );
	6746	+
	6747	+ if ( ! isset( $known_normalized[ $config_path ] ) && ! $this->is_path_excluded( $file_path ) ) {
	6748	+ $config = self::server_config_finding( $file_path, str_replace( ABSPATH, '', $file_path ) );
	6749	+
	6750	+ if ( $config ) {
	6751	+ $found[ $config['category'] ][] = $config['item'];
	6752	+ }
	6753	+ }
	6754	+ continue;
	6755	+ }
	6756	+
2239	6757	// Only check PHP files
2240	6758	if ( ! in_array( $extension, $php_extensions, true ) ) {
2241	6759	continue;
2242	6760	}
		@@ -2264,18 +6782,15 @@
2264	6782	if ( $this->is_silence_golden_file( $file_path ) ) {
2265	6783	continue;
2266	6784	}
2267	6785
2268		- $count++;
	6786	+ $found['php_files']++;
	6787	+
2269	6788	$relative = str_replace( ABSPATH, '', $file_path );
2270		- $pattern = false;
2271	6789
2272	6790	// Check for suspicious content in extra files
2273	6791	// Use strict mode for plugins without checksums to avoid false positives
2274		- if ( $file->getSize() < 512000 ) { // Only scan files < 500KB
2275		- $content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
2276		- $pattern = $this->detect_suspicious_pattern( $content, $suspicious_only );
2277		- }
	6792	+ $pattern = $this->search_file( $file_path, $suspicious_only );
2278	6793
2279	6794	$item = array(
2280	6795	'file' => $relative,
2281	6796	$type => $name,
		@@ -2283,21 +6798,49 @@
2283	6798
2284	6799	if ( $pattern ) {
2285	6800	// Suspicious content: promote to suspicious category
2286	6801	$item['type'] = 'suspicious_' . $type;
2287		- /* translators: 1: Plugin or theme name, 2: Suspicious pattern found */
2288		- $item['reason'] = sprintf( __( 'Injected file in %1$s with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6802	+
	6803	+ // With an official copy to compare with, the file is known
	6804	+ // not to belong to it. Without one it may well be the
	6805	+ // plugin's own, so it is not called injected.
	6806	+ if ( $suspicious_only ) {
	6807	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	6808	+ $item['reason'] = sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6809	+ } else {
	6810	+ /* translators: 1: Plugin or theme name, 2: Suspicious pattern found */
	6811	+ $item['reason'] = sprintf( __( 'File that is not part of %1$s, with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6812	+ }
	6813	+
2289	6814	$found['suspicious'][] = $item;
2290	6815	} elseif ( ! $suspicious_only ) {
2291	6816	// No suspicious patterns and checksums available: report as extra
2292	6817	// Skipped in suspicious_only mode (no checksums) to avoid noise
	6818	+ if ( $listed >= $max_listed ) {
	6819	+ if ( ! $truncated ) {
	6820	+ $truncated = true;
	6821	+ $found['errors'][] = sprintf(
	6822	+ /* translators: 1: Plugin or theme name, 2: Number of files */
	6823	+ __( '%1$s has more extra files than can be listed: only the first %2$d are shown.', 'vigilante' ),
	6824	+ $name,
	6825	+ $max_listed
	6826	+ );
	6827	+ }
	6828	+ continue;
	6829	+ }
	6830	+
	6831	+ $listed++;
2293	6832	$item['type'] = 'extra_' . $type;
2294	6833	$item['reason'] = __( 'PHP file not present in original distribution', 'vigilante' );
2295	6834	$found['extra'][] = $item;
	6835	+ } elseif ( null === $pattern ) {
	6836	+ // No official copy to compare with, and the search could
	6837	+ // not look inside either: said, not passed over.
	6838	+ $found['extra'][] = $this->not_searched_item( $file_path, $relative );
2296	6839	}
2297	6840	}
2298	6841	} catch ( Exception $e ) {
2299		- // Ignore iterator errors
	6842	+ $found['errors'][] = self::unreadable_folder_error( $directory );
2300	6843	}
2301	6844
2302	6845	return $found;
2303	6846	}
		@@ -2330,9 +6873,14 @@
2330	6873	if ( false === $content ) {
2331	6874	return false;
2332	6875	}
2333	6876
2334		- $normalized = strtolower( trim( str_replace( array( "\r\n", "\r" ), "\n", $content ) ) );
	6877	+ // Every run of whitespace counts as one space, so the placeholder
	6878	+ // WordPress itself ships (the opening tag, a line break and the comment)
	6879	+ // matches the same entries as the one-line form. The comparison is
	6880	+ // still against the whole file: nothing can follow these few words, and
	6881	+ // no arrangement of them on several lines is code that runs.
	6882	+ $normalized = strtolower( trim( preg_replace( '/\s+/', ' ', $content ) ) );
2335	6883
2336	6884	$known = array(
2337	6885	'',
2338	6886	'<?php',
		@@ -2345,8 +6893,391 @@
2345	6893	return in_array( $normalized, $known, true );
2346	6894	}
2347	6895
2348	6896	/**
	6897	+ * Folders of the installation that hold plugins or themes
	6898	+ *
	6899	+ * @return array Relative path => true, for the plugins folder and every
	6900	+ * theme root that lies inside the WordPress directory.
	6901	+ */
	6902	+ private function code_roots() {
	6903	+ global $wp_theme_directories;
	6904	+
	6905	+ $roots = array();
	6906	+
	6907	+ foreach ( array_merge( array( WP_PLUGIN_DIR, get_theme_root() ), is_array( $wp_theme_directories ) ? $wp_theme_directories : array() ) as $root ) {
	6908	+ $root = untrailingslashit( str_replace( '\\', '/', (string) $root ) );
	6909	+
	6910	+ if ( '' !== $root && 0 === strpos( $root . '/', str_replace( '\\', '/', ABSPATH ) ) ) {
	6911	+ $roots[ $this->relative_path( $root ) ] = true;
	6912	+ }
	6913	+ }
	6914	+
	6915	+ return $roots;
	6916	+ }
	6917	+
	6918	+ /**
	6919	+ * What a partial scan offers to exclude, so that the next one reaches the rest
	6920	+ *
	6921	+ * The folders of the plugins and themes the scan did check, as lines for
	6922	+ * Excluded Paths, less the ones that are excluded by now. A scan starts
	6923	+ * from the beginning every time, so with these out of the way a scan
	6924	+ * run by hand spends its time on what the last one never got to. They
	6925	+ * have to come out of the list afterwards, and the tab says so for as
	6926	+ * long as they are there (see excluded_code_folders()).
	6927	+ *
	6928	+ * The list comes from stored results, and whoever reads it is told to
	6929	+ * paste it into the exclusions, so only what can be the folder of a
	6930	+ * plugin or of a theme is let through: one line with anything else in it
	6931	+ * would exclude far more than it says.
	6932	+ *
	6933	+ * @param mixed $results Scan results, as run_scan() returns them.
	6934	+ * @return array Relative paths, one per folder.
	6935	+ */
	6936	+ public function folders_to_exclude( $results ) {
	6937	+ $stored = is_array( $results ) && isset( $results['checked_folders'] ) && is_array( $results['checked_folders'] ) ? $results['checked_folders'] : array();
	6938	+ $roots = $this->code_roots();
	6939	+ $lines = array();
	6940	+
	6941	+ foreach ( $stored as $folder ) {
	6942	+ if ( ! is_string( $folder ) || 1 === preg_match( '/[\\x00-\\x1f\\x7f]/', $folder ) ) {
	6943	+ continue;
	6944	+ }
	6945	+
	6946	+ $folder = trim( str_replace( '\\', '/', $folder ), '/' );
	6947	+ $name = basename( $folder );
	6948	+
	6949	+ if ( '' === $name || '.' === $name || '..' === $name || ! isset( $roots[ dirname( $folder ) ] ) ) {
	6950	+ continue;
	6951	+ }
	6952	+
	6953	+ if ( ! is_dir( ABSPATH . $folder ) || $this->is_path_excluded( ABSPATH . $folder . '/.' ) ) {
	6954	+ continue;
	6955	+ }
	6956	+
	6957	+ $lines[ $folder ] = true;
	6958	+ }
	6959	+
	6960	+ return array_keys( $lines );
	6961	+ }
	6962	+
	6963	+ /**
	6964	+ * Whole folders of code, or the uploads folder, that Excluded Paths keeps out of every scan
	6965	+ *
	6966	+ * A subfolder of uploads or of a plugin is an ordinary exclusion (a cache
	6967	+ * of compiled templates, say). A whole plugin, a whole theme, the
	6968	+ * must-use plugins or all of uploads is something else: the scan comes
	6969	+ * out complete and clean without having looked there. The tab and
	6970	+ * Security Check go by this list, so that nobody is left thinking those
	6971	+ * folders are being watched.
	6972	+ *
	6973	+ * @return array Relative paths. A folder that holds others (the plugins
	6974	+ * folder, a theme root) stands for all of them.
	6975	+ */
	6976	+ public function excluded_code_folders() {
	6977	+ if ( empty( $this->options['excluded_paths'] ) || ! is_array( $this->options['excluded_paths'] ) ) {
	6978	+ return array();
	6979	+ }
	6980	+
	6981	+ if ( ! function_exists( 'get_plugins' ) ) {
	6982	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	6983	+ }
	6984	+
	6985	+ $found = array();
	6986	+ $roots = array_keys( $this->code_roots() );
	6987	+
	6988	+ foreach ( $roots as $root ) {
	6989	+ if ( $this->is_path_excluded( ABSPATH . $root . '/.' ) ) {
	6990	+ $found[ $root ] = true;
	6991	+ }
	6992	+ }
	6993	+
	6994	+ $plugins_root = $this->relative_path( WP_PLUGIN_DIR );
	6995	+
	6996	+ if ( ! isset( $found[ $plugins_root ] ) ) {
	6997	+ foreach ( array_keys( get_plugins() ) as $plugin_file ) {
	6998	+ $slug = dirname( $plugin_file );
	6999	+
	7000	+ if ( '.' !== $slug && $this->is_path_excluded( WP_PLUGIN_DIR . '/' . $slug . '/.' ) ) {
	7001	+ $found[ $this->relative_path( WP_PLUGIN_DIR . '/' . $slug ) ] = true;
	7002	+ }
	7003	+ }
	7004	+ }
	7005	+
	7006	+ foreach ( wp_get_themes() as $theme ) {
	7007	+ $dir = $theme->get_stylesheet_directory();
	7008	+
	7009	+ if ( ! isset( $found[ $this->relative_path( dirname( $dir ) ) ] ) && $this->is_path_excluded( $dir . '/.' ) ) {
	7010	+ $found[ $this->relative_path( $dir ) ] = true;
	7011	+ }
	7012	+ }
	7013	+
	7014	+ if ( defined( 'WPMU_PLUGIN_DIR' ) && is_dir( WPMU_PLUGIN_DIR ) && $this->is_path_excluded( WPMU_PLUGIN_DIR . '/.' ) ) {
	7015	+ $found[ $this->relative_path( WPMU_PLUGIN_DIR ) ] = true;
	7016	+ }
	7017	+
	7018	+ $uploads = wp_get_upload_dir();
	7019	+
	7020	+ if ( ! empty( $uploads['basedir'] ) && $this->is_path_excluded( $uploads['basedir'] . '/.' ) ) {
	7021	+ $found[ $this->relative_path( $uploads['basedir'] ) ] = true;
	7022	+ }
	7023	+
	7024	+ return array_keys( $found );
	7025	+ }
	7026	+
	7027	+ /**
	7028	+ * Whether a scan checked less than it was asked to
	7029	+ *
	7030	+ * Either it ran out of time, or something could not be read or compared
	7031	+ * (a folder, a plugin whose copy on WordPress.org could not be fetched).
	7032	+ * The tab, the scan email and Security Check go by this, so none of them
	7033	+ * calls clean a result that covers only part of the site.
	7034	+ *
	7035	+ * @param mixed $results Scan results, as run_scan() returns them.
	7036	+ * @return bool
	7037	+ */
	7038	+ public static function is_partial( $results ) {
	7039	+ return is_array( $results ) && ( ! empty( $results['incomplete'] ) || ! empty( $results['errors'] ) );
	7040	+ }
	7041	+
	7042	+ /**
	7043	+ * What a scan did not get to, one line per thing
	7044	+ *
	7045	+ * The one source of that text, for the tab, the scan email and anything
	7046	+ * else that shows the result of a scan. In the order of the scan.
	7047	+ *
	7048	+ * @param mixed $results Scan results, as run_scan() returns them.
	7049	+ * @return array Lines ready to show, not escaped. Empty when nothing was
	7050	+ * left out.
	7051	+ */
	7052	+ public static function not_checked_lines( $results ) {
	7053	+ $left = is_array( $results ) && isset( $results['not_checked'] ) && is_array( $results['not_checked'] ) ? $results['not_checked'] : array();
	7054	+
	7055	+ $areas = isset( $left['areas'] ) && is_array( $left['areas'] ) ? $left['areas'] : array();
	7056	+ $plugins = isset( $left['plugins'] ) && is_array( $left['plugins'] ) ? array_filter( array_map( 'strval', $left['plugins'] ), 'strlen' ) : array();
	7057	+ $themes = isset( $left['themes'] ) && is_array( $left['themes'] ) ? array_filter( array_map( 'strval', $left['themes'] ), 'strlen' ) : array();
	7058	+ $lines = array();
	7059	+
	7060	+ if ( in_array( 'uploads', $areas, true ) ) {
	7061	+ $lines[] = __( 'The uploads folder was not checked.', 'vigilante' );
	7062	+ }
	7063	+
	7064	+ if ( in_array( 'core', $areas, true ) ) {
	7065	+ $lines[] = __( 'The WordPress files were not checked completely.', 'vigilante' );
	7066	+ }
	7067	+
	7068	+ if ( in_array( 'config', $areas, true ) ) {
	7069	+ $lines[] = __( 'wp-config.php and .htaccess were not compared.', 'vigilante' );
	7070	+ }
	7071	+
	7072	+ if ( in_array( 'content', $areas, true ) ) {
	7073	+ $lines[] = __( 'The other folders of wp-content were not checked.', 'vigilante' );
	7074	+ }
	7075	+
	7076	+ if ( in_array( 'plugins', $areas, true ) ) {
	7077	+ $lines[] = __( 'No plugin was checked.', 'vigilante' );
	7078	+ } elseif ( ! empty( $plugins ) ) {
	7079	+ /* translators: %s: Comma separated list of plugin names */
	7080	+ $lines[] = sprintf( __( 'Plugins not checked: %s.', 'vigilante' ), implode( ', ', $plugins ) );
	7081	+ }
	7082	+
	7083	+ if ( in_array( 'unlisted', $areas, true ) ) {
	7084	+ $lines[] = __( 'Must-use plugins, drop-ins and loose PHP files were not checked.', 'vigilante' );
	7085	+ }
	7086	+
	7087	+ if ( in_array( 'themes', $areas, true ) ) {
	7088	+ $lines[] = __( 'No theme was checked.', 'vigilante' );
	7089	+ } elseif ( ! empty( $themes ) ) {
	7090	+ /* translators: %s: Comma separated list of theme names */
	7091	+ $lines[] = sprintf( __( 'Themes not checked: %s.', 'vigilante' ), implode( ', ', $themes ) );
	7092	+ }
	7093	+
	7094	+ return $lines;
	7095	+ }
	7096	+
	7097	+ /**
	7098	+ * Whether the scheduled scan has not finished for longer than it should
	7099	+ *
	7100	+ * A scan that PHP or the server stops halfway stores nothing, so the date
	7101	+ * of the last one that finished is the only sign left. Twice the interval
	7102	+ * and one day more, because WP-Cron only runs when the site has a visit.
	7103	+ *
	7104	+ * @param int $last_scan Time of the last stored scan, 0 for none.
	7105	+ * @param string $frequency 'daily' or 'weekly'.
	7106	+ * @return bool
	7107	+ */
	7108	+ public static function is_scan_overdue( $last_scan, $frequency ) {
	7109	+ $last_scan = (int) $last_scan;
	7110	+
	7111	+ if ( $last_scan <= 0 ) {
	7112	+ return false;
	7113	+ }
	7114	+
	7115	+ $every = 'weekly' === $frequency ? WEEK_IN_SECONDS : DAY_IN_SECONDS;
	7116	+
	7117	+ return ( time() - $last_scan ) > ( 2 * $every + DAY_IN_SECONDS );
	7118	+ }
	7119	+
	7120	+ /**
	7121	+ * What a kind of finding usually is, and what to do about it
	7122	+ *
	7123	+ * The one source of the text shown next to the findings of a scan, so the
	7124	+ * File Integrity tab and anything else that explains them say the same.
	7125	+ * Vigilant's own files have their own source,
	7126	+ * Vigilante_Self_Integrity_Guidance.
	7127	+ *
	7128	+ * @param string $type Finding type as stored in the scan results.
	7129	+ * @return array {
	7130	+ * @type string $label Name of the kind of finding, for a table cell.
	7131	+ * @type string $advice What it usually is and what to do. Empty for a
	7132	+ * type this method does not know.
	7133	+ * }
	7134	+ */
	7135	+ public static function finding_guidance( $type ) {
	7136	+ switch ( $type ) {
	7137	+ case 'php_in_uploads':
	7138	+ return array(
	7139	+ 'label' => __( 'PHP in uploads', 'vigilante' ),
	7140	+ 'advice' => __( 'Uploads is meant for media, not for code. It is normal only when a plugin you use writes PHP there, such as compiled templates or cache files: ignore the file, or add its folder to Excluded Paths if new ones keep appearing. If nothing you use explains it, treat it as malware.', 'vigilante' ),
	7141	+ );
	7142	+
	7143	+ case 'double_extension':
	7144	+ return array(
	7145	+ 'label' => __( 'Double extension', 'vigilante' ),
	7146	+ 'advice' => __( 'A name such as photo.php.jpg is a common way to pass a script off as an image. Delete it unless you know who or what uploaded it.', 'vigilante' ),
	7147	+ );
	7148	+
	7149	+ case 'htaccess_in_uploads':
	7150	+ return array(
	7151	+ 'label' => __( '.htaccess in uploads', 'vigilante' ),
	7152	+ 'advice' => __( 'A .htaccess here changes how the server treats this folder. One that only denies access is not listed. If it makes files run as code (AddHandler, SetHandler, php_value, Options ExecCGI) and you did not put it there, it is a sign of infection. If it only has rewrite rules, it usually belongs to an image or cache plugin, and it switches off for this folder the rule that blocks PHP in uploads.', 'vigilante' ),
	7153	+ );
	7154	+
	7155	+ case 'php_in_root':
	7156	+ return array(
	7157	+ 'label' => __( 'PHP in the site root', 'vigilante' ),
	7158	+ 'advice' => __( 'A PHP file next to wp-config.php that WordPress does not ship. Hosting tools, firewalls and verification scripts put files here, and so do attackers. Ignore it if you know where it comes from; if you do not, look at what it contains before anything else.', 'vigilante' ),
	7159	+ );
	7160	+
	7161	+ case 'extra_root':
	7162	+ return array(
	7163	+ 'label' => __( 'Extra file in the site root', 'vigilante' ),
	7164	+ 'advice' => __( 'WordPress does not ship this file. Verification files and the like are harmless. A copy of wp-config.php, a database dump or a backup archive here can be downloaded by anyone who guesses its name: move it out of the web root.', 'vigilante' ),
	7165	+ );
	7166	+
	7167	+ case 'legacy_core':
	7168	+ return array(
	7169	+ 'label' => __( 'Old core file', 'vigilante' ),
	7170	+ 'advice' => __( 'Left behind by an earlier version of WordPress. Nothing uses it any more and it can be deleted.', 'vigilante' ),
	7171	+ );
	7172	+
	7173	+ case 'suspicious_plugin':
	7174	+ case 'suspicious_theme':
	7175	+ return array(
	7176	+ 'label' => 'suspicious_theme' === $type ? __( 'Hidden code in a theme', 'vigilante' ) : __( 'Hidden code in a plugin', 'vigilante' ),
	7177	+ 'advice' => __( 'The file contains code written the way malware hides itself, and it is not part of the published copy, or there is no published copy to compare with. Some commercial plugins and themes obfuscate their own code and end up here. If you cannot tell, replace the plugin or theme with a clean copy from its author.', 'vigilante' ),
	7178	+ );
	7179	+
	7180	+ case 'extra_plugin':
	7181	+ case 'extra_theme':
	7182	+ return array(
	7183	+ 'label' => 'extra_theme' === $type ? __( 'Extra file in a theme', 'vigilante' ) : __( 'Extra file in a plugin', 'vigilante' ),
	7184	+ 'advice' => __( 'A PHP file that is not in the copy WordPress.org publishes for the installed version. Some plugins and themes create files after they are installed, and a manual fix adds them too. If you cannot explain it, reinstall the plugin or theme: that removes everything that does not belong to it.', 'vigilante' ),
	7185	+ );
	7186	+
	7187	+ case 'php_in_core':
	7188	+ return array(
	7189	+ 'label' => __( 'PHP in a WordPress folder', 'vigilante' ),
	7190	+ 'advice' => __( 'A PHP file in wp-admin or wp-includes that the installed version of WordPress does not ship. It is either left over from an older version or put there by someone: compare it with a clean copy of WordPress and delete it if it is not in it.', 'vigilante' ),
	7191	+ );
	7192	+
	7193	+ case 'config_in_core':
	7194	+ return array(
	7195	+ 'label' => __( 'Configuration file in a WordPress folder', 'vigilante' ),
	7196	+ 'advice' => __( 'A .htaccess, .user.ini or php.ini in wp-admin or wp-includes. A .htaccess that asks for a password in wp-admin is a common protection, and some hosts leave a php.ini there. A line with auto_prepend_file or auto_append_file loads a file on every request: make sure you know which one.', 'vigilante' ),
	7197	+ );
	7198	+
	7199	+ case 'php_config_in_uploads':
	7200	+ return array(
	7201	+ 'label' => __( 'PHP configuration in uploads', 'vigilante' ),
	7202	+ 'advice' => __( 'A .user.ini or php.ini here changes how PHP runs for this folder, and can make it load another file on every request. Nothing in uploads needs one: delete it unless you put it there.', 'vigilante' ),
	7203	+ );
	7204	+
	7205	+ case 'script_in_uploads':
	7206	+ return array(
	7207	+ 'label' => __( 'Script in uploads', 'vigilante' ),
	7208	+ 'advice' => __( 'A script in another language (shell, Perl, Python, CGI). It only runs if the server is told to run it, which a .htaccess in the same folder can do. Delete it unless you know why it is there.', 'vigilante' ),
	7209	+ );
	7210	+
	7211	+ case 'php_config_in_root':
	7212	+ return array(
	7213	+ 'label' => __( 'PHP configuration in the site root', 'vigilante' ),
	7214	+ 'advice' => __( 'This file makes PHP load another file before every request. Firewalls such as Wordfence set it up for themselves, and so do some hosts: check that the file it names is theirs. If nothing you installed needs it, that file runs before WordPress on every visit: treat it as a backdoor.', 'vigilante' ),
	7215	+ );
	7216	+
	7217	+ case 'backup_in_root':
	7218	+ return array(
	7219	+ 'label' => __( 'Backup in the site root', 'vigilante' ),
	7220	+ 'advice' => __( 'A copy of wp-config.php, a database dump or an archive next to WordPress can be downloaded by anyone who guesses its name, and it holds passwords or the whole site. Move it out of the web root or delete it.', 'vigilante' ),
	7221	+ );
	7222	+
	7223	+ case 'php_in_content':
	7224	+ return array(
	7225	+ 'label' => __( 'Loose PHP in wp-content', 'vigilante' ),
	7226	+ 'advice' => __( 'A PHP file, or a folder with PHP files, in wp-content or among the plugins or the themes, that WordPress does not list as a plugin, a theme or a drop-in. It does not show on the Plugins screen, and it can still be reached by its address. Some plugins keep a settings file there, WP Super Cache for one. If nothing you use explains it, look at what it contains.', 'vigilante' ),
	7227	+ );
	7228	+
	7229	+ case 'suspicious_content':
	7230	+ return array(
	7231	+ 'label' => __( 'Hidden code in wp-content', 'vigilante' ),
	7232	+ 'advice' => __( 'The file contains code written the way malware hides itself, in a folder of wp-content that belongs to no plugin and no theme. Cache, backup and security plugins keep files in folders like these, and what they store can look like this. Find out which one the folder belongs to. If nothing you use explains the file, treat it as malware.', 'vigilante' ),
	7233	+ );
	7234	+
	7235	+ case 'translation_with_code':
	7236	+ return array(
	7237	+ 'label' => __( 'Translation file with code', 'vigilante' ),
	7238	+ 'advice' => __( 'WordPress loads the translation files of the site language on every request, and a translation file holds text and nothing else. This one holds something more. Delete it and get the translations again from Dashboard > Updates. If it comes back, something on the site is writing it.', 'vigilante' ),
	7239	+ );
	7240	+
	7241	+ case 'not_searched':
	7242	+ return array(
	7243	+ 'label' => __( 'File not searched', 'vigilante' ),
	7244	+ 'advice' => __( 'The search for hidden code could not look inside this file, nearly always because it is very large, and there is no official copy to compare it with. A PHP file of that size is unusual. Check that it belongs to the plugin, the theme or the folder it is in, and ignore it if it does.', 'vigilante' ),
	7245	+ );
	7246	+
	7247	+ case 'server_config':
	7248	+ return array(
	7249	+ 'label' => __( 'Server configuration file', 'vigilante' ),
	7250	+ 'advice' => __( 'A .htaccess, .user.ini or php.ini outside uploads that makes the server run files as code or load a file on every request. Plugins rarely need one. If you cannot tell which one put it there, treat it as a sign of infection.', 'vigilante' ),
	7251	+ );
	7252	+
	7253	+ case 'core':
	7254	+ return array(
	7255	+ 'label' => __( 'WordPress core', 'vigilante' ),
	7256	+ 'advice' => __( 'Does not match the copy WordPress.org publishes for your version and language. For a file in wp-admin, wp-includes or the site root, reinstall WordPress from Dashboard > Updates and scan again. A file of a bundled theme or of Akismet, under wp-content, appears here after that theme or plugin updates on its own, which is normal.', 'vigilante' ),
	7257	+ );
	7258	+
	7259	+ case 'plugin':
	7260	+ case 'theme':
	7261	+ return array(
	7262	+ 'label' => 'theme' === $type ? __( 'Theme', 'vigilante' ) : __( 'Plugin', 'vigilante' ),
	7263	+ 'advice' => __( 'Does not match the copy WordPress.org publishes for the installed version. The usual causes are an update that did not finish, a release replaced on WordPress.org without a new version number, or a manual edit. Reinstall it; if the file changes again by itself, investigate.', 'vigilante' ),
	7264	+ );
	7265	+
	7266	+ case 'critical_config':
	7267	+ return array(
	7268	+ 'label' => __( 'Configuration file', 'vigilante' ),
	7269	+ 'advice' => __( 'Changed since you last approved it. Cache, security and redirection plugins rewrite their own blocks in these files, often on every update, and that shows up here too. Review the changes and approve them if they belong to something you use. Lines you cannot explain, above all the ones that load a file or send requests to one, need a closer look.', 'vigilante' ),
	7270	+ );
	7271	+ }
	7272	+
	7273	+ return array(
	7274	+ 'label' => (string) $type,
	7275	+ 'advice' => '',
	7276	+ );
	7277	+ }
	7278	+
	7279	+ /**
2349	7280	* Check if a path is excluded from scanning
2350	7281	*
2351	7282	* @param string $path File path.
2352	7283	* @return bool
		@@ -2496,8 +7427,39 @@
2496	7427	return array_values(
2497	7428	array_filter(
2498	7429	$items,
2499	7430	function ( $item ) {
	7431	+ /*
	7432	+ * On a network, wp-config.php and the root .htaccess are not a
	7433	+ * site's to silence: a change to them is closed by approving it,
	7434	+ * and approving takes a network administrator since 2.11.3. The
	7435	+ * ignore list is an option of each site, so until 2.11.8 the
	7436	+ * administrator of the main site without network rights hid a
	7437	+ * pending change from the network administrator's own screen by
	7438	+ * posting the file name to the ignore handler.
	7439	+ */
	7440	+ if ( is_multisite() && is_array( $item ) && 'critical_config' === ( $item['type'] ?? '' ) ) {
	7441	+ return true;
	7442	+ }
	7443	+
	7444	+ // Findings about the manifest and the version of Vigilant
	7445	+ // itself are not about one file, so no entry of the list may
	7446	+ // hide them, on a single site either: ignoring the row of
	7447	+ // MANIFEST.sha256 took a replaced manifest out of the email.
	7448	+ // Vigilante_Self_Integrity::filter_ignored_findings() keeps
	7449	+ // them the same way.
	7450	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) && in_array( $item['self_finding'] ?? '', array( 'manifest_replaced', 'manifest_unverified', 'manifest_missing', 'manifest_invalid', 'self_downgraded' ), true ) ) {
	7451	+ return true;
	7452	+ }
	7453	+ // Nor the findings of the walk of Vigilant's folder (a folder
	7454	+ // that cannot be listed, the folder that could not be walked):
	7455	+ // their path ends in a slash, and ignoring that row left the
	7456	+ // scan with no row and no email while the self-protection
	7457	+ // status stayed critical.
	7458	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) && '/' === substr( (string) ( $item['file'] ?? '' ), -1 ) ) {
	7459	+ return true;
	7460	+ }
	7461	+
2500	7462	$file = is_array( $item ) && isset( $item['file'] ) ? $item['file'] : '';
2501	7463	return ! in_array( $file, $this->ignored_files, true );
2502	7464	}
2503	7465	)
		@@ -2518,32 +7480,25 @@
2518	7480	*/
2519	7481	private function maybe_send_notification( $results ) {
2520	7482	$options = is_array( $this->options ) ? $this->options : array();
2521	7483
2522		- // Count critical_config separately from regular modified so we can treat it
2523		- // as "serious" for notification level purposes (same tier as suspicious/extra).
2524		- $has_critical_config = false;
2525		- foreach ( $results['modified'] ?? array() as $item ) {
2526		- if ( is_array( $item ) && isset( $item['type'] ) && 'critical_config' === $item['type'] ) {
2527		- $has_critical_config = true;
2528		- break;
2529		- }
2530		- }
2531		-
2532		- // Collect closed/removed plugins (excluding ignored slugs). These count
2533		- // as "serious" for notification purposes: a closed plugin in wp.org is
2534		- // a security-critical finding, same tier as a suspicious file.
	7484	+ // Closed/removed plugins (excluding ignored slugs) travel in this
	7485	+ // email, in the same tier as a suspicious file.
2535	7486	$closed_plugins = $this->collect_closed_plugins_for_email();
2536		- $has_closed = ! empty( $closed_plugins );
2537	7487
2538		- $has_suspicious = ! empty( $results['suspicious'] ) || ! empty( $results['extra'] ) || $has_critical_config || $has_closed;
2539		- $has_modified = ! empty( $results['modified'] );
	7488	+ /*
	7489	+ * Self-protection is not part of this decision. Its alert is its own
	7490	+ * and no setting switches it off, so this email is about the files of
	7491	+ * the site: core, plugins, themes, uploads and the two shared
	7492	+ * configuration files. Missing files do not send it on their own: it
	7493	+ * has no section to list them in.
	7494	+ */
2540	7495
2541		- // Instant alert: send for suspicious, extra, critical_config, modified
2542		- // files, or closed plugins.
2543		- $instant_alert = ! empty( $options['instant_alert'] );
2544		- if ( $instant_alert && ( $has_suspicious || $has_modified ) ) {
2545		- $this->send_notification( $results, 'all', $closed_plugins );
	7496	+ // Instant alert: every finding travels, modified files included,
	7497	+ // whatever the level below says. A scan with nothing to report goes
	7498	+ // through as well, so that what was reported is forgotten.
	7499	+ if ( ! empty( $options['instant_alert'] ) ) {
	7500	+ $this->send_new_findings( $results, 'all', $closed_plugins );
2546	7501	return;
2547	7502	}
2548	7503
2549	7504	// Determine notify level with backward compatibility
		@@ -2558,22 +7513,142 @@
2558	7513	}
2559	7514	}
2560	7515
2561	7516	if ( 'disabled' === $notify_level ) {
	7517	+ // Nothing is sent, and nothing stays on record as reported:
	7518	+ // whoever switches the email back on is told about everything
	7519	+ // that is pending then.
	7520	+ delete_option( self::NOTIFIED_OPTION );
2562	7521	return;
2563	7522	}
2564	7523
2565	7524	// 'suspicious_only' treats suspicious/extra, critical_config AND closed
2566		- // plugins as serious.
2567		- if ( 'suspicious_only' === $notify_level && ! $has_suspicious ) {
	7525	+ // plugins as serious. A scan with nothing to send at this level still
	7526	+ // goes through send_new_findings(), which then forgets what it had
	7527	+ // reported, so a finding that goes away and comes back is new again.
	7528	+ $this->send_new_findings( $results, $notify_level, $closed_plugins );
	7529	+ }
	7530	+
	7531	+ /**
	7532	+ * What the scan email has already reported to the recipients
	7533	+ */
	7534	+ const NOTIFIED_OPTION = 'vigilante_integrity_notified';
	7535	+
	7536	+ /**
	7537	+ * Send the scan email only when the scan found something new
	7538	+ *
	7539	+ * Until now the email went out after every scan for as long as a finding
	7540	+ * was still listed, so a plugin that rewrote its block in .htaccess meant
	7541	+ * the same alert every day until somebody approved the change. Now every
	7542	+ * finding is reported once: the email goes out when a scan finds something
	7543	+ * the recipients have not been told about, and it lists everything that is
	7544	+ * pending, old and new.
	7545	+ *
	7546	+ * A finding is the file, its kind and its content (by its hash), so a
	7547	+ * file that changes again under the same name is new, also when the
	7548	+ * change keeps its size and its date. What goes away is forgotten, so it
	7549	+ * is new again if it comes back. Nothing is recorded when the email could
	7550	+ * not be sent, and the next scan tries again.
	7551	+ *
	7552	+ * @param array $results Scan results.
	7553	+ * @param string $notify_level 'all' or 'suspicious_only'.
	7554	+ * @param array $closed_plugins Closed plugins, keyed by slug.
	7555	+ */
	7556	+ private function send_new_findings( $results, $notify_level, $closed_plugins ) {
	7557	+ $keys = $this->notification_keys( $results, $closed_plugins, 'all' === $notify_level );
	7558	+ $told = get_option( self::NOTIFIED_OPTION, array() );
	7559	+ $told = is_array( $told ) ? $told : array();
	7560	+
	7561	+ // A partial scan cannot tell whether what it did not reach is still
	7562	+ // there, so it forgets nothing: with the findings of an unchecked
	7563	+ // plugin forgotten, the next scan that reached it would report them
	7564	+ // again as new, and on a site whose scans are always partial that
	7565	+ // is the same email over and over.
	7566	+ $known = self::is_partial( $results ) ? array_values( array_unique( array_merge( $keys, $told ) ) ) : $keys;
	7567	+
	7568	+ // The record is bounded, and the comparison is not: what does not fit
	7569	+ // in the record is reported again, never left out. The keys come in
	7570	+ // order of importance, so what does not fit is the least of it.
	7571	+ $record = array_slice( $known, 0, 5000 );
	7572	+
	7573	+ if ( empty( array_diff( $keys, $told ) ) ) {
	7574	+ if ( count( $record ) !== count( $told ) ) {
	7575	+ update_option( self::NOTIFIED_OPTION, $record, false );
	7576	+ }
2568	7577	return;
2569	7578	}
2570	7579
2571		- if ( ! $has_suspicious && ! $has_modified ) {
2572		- return;
	7580	+ if ( $this->send_notification( $results, $notify_level, $closed_plugins ) ) {
	7581	+ update_option( self::NOTIFIED_OPTION, $record, false );
2573	7582	}
	7583	+ }
2574	7584
2575		- $this->send_notification( $results, $notify_level, $closed_plugins );
	7585	+ /**
	7586	+ * One key per finding the scan email would carry at this level
	7587	+ *
	7588	+ * @param array $results Scan results.
	7589	+ * @param array $closed_plugins Closed plugins, keyed by slug.
	7590	+ * @param bool $with_modified Whether files that are only modified travel
	7591	+ * in the email at this level.
	7592	+ * @return array
	7593	+ */
	7594	+ private function notification_keys( $results, $closed_plugins, $with_modified ) {
	7595	+ $keys = array(
	7596	+ 'config' => array(),
	7597	+ 'closed' => array(),
	7598	+ 'suspicious' => array(),
	7599	+ 'modified' => array(),
	7600	+ 'extra' => array(),
	7601	+ );
	7602	+
	7603	+ foreach ( (array) ( $results['modified'] ?? array() ) as $item ) {
	7604	+ if ( ! is_array( $item ) ) {
	7605	+ continue;
	7606	+ }
	7607	+
	7608	+ $type = (string) ( $item['type'] ?? '' );
	7609	+ $config = 'critical_config' === $type;
	7610	+
	7611	+ // Vigilant's own files have their own alert.
	7612	+ if ( 'vigilante_self' === $type || ( ! $config && ! $with_modified ) ) {
	7613	+ continue;
	7614	+ }
	7615	+
	7616	+ $keys[ $config ? 'config' : 'modified' ][] = md5( 'modified|' . $type . '|' . (string) ( $item['file'] ?? '' ) . '|' . (string) ( $item['actual_hash'] ?? '' ) );
	7617	+ }
	7618	+
	7619	+ foreach ( (array) $closed_plugins as $slug => $info ) {
	7620	+ $keys['closed'][] = md5( 'closed|' . $slug . '|' . ( is_array( $info ) ? (string) ( $info['state'] ?? '' ) : '' ) );
	7621	+ }
	7622	+
	7623	+ foreach ( array( 'suspicious', 'extra' ) as $bucket ) {
	7624	+ foreach ( (array) ( $results[ $bucket ] ?? array() ) as $item ) {
	7625	+ $type = is_array( $item ) ? (string) ( $item['type'] ?? '' ) : '';
	7626	+
	7627	+ if ( 'vigilante_self' === $type ) {
	7628	+ continue;
	7629	+ }
	7630	+
	7631	+ $file = is_array( $item ) ? (string) ( $item['file'] ?? '' ) : (string) $item;
	7632	+ $state = '';
	7633	+ $path = ABSPATH . ltrim( $file, '/' );
	7634	+
	7635	+ // By content, so a file rewritten with the same size and the
	7636	+ // same date is still a different file. The ones too large to
	7637	+ // hash on every scan go by size, date and the time of their
	7638	+ // last change of any kind, which writing to a file moves and
	7639	+ // which cannot be set back the way the date can.
	7640	+ if ( '' !== $file && is_file( $path ) ) {
	7641	+ $state = filesize( $path ) <= MB_IN_BYTES ? (string) md5_file( $path ) : filesize( $path ) . ':' . filemtime( $path ) . ':' . filectime( $path );
	7642	+ }
	7643	+
	7644	+ $keys[ $bucket ][] = md5( $bucket . '|' . $type . '|' . $file . '|' . $state );
	7645	+ }
	7646	+ }
	7647	+
	7648	+ // In order of importance: only the first 5,000 are remembered, and
	7649	+ // what is not remembered is reported again.
	7650	+ return array_values( array_unique( array_merge( $keys['config'], $keys['closed'], $keys['suspicious'], $keys['modified'], $keys['extra'] ) ) );
2576	7651	}
2577	7652
2578	7653	/**
2579	7654	* Collect the closed/removed plugins (excluding ignored slugs) so they can
		@@ -2608,8 +7683,10 @@
2608	7683	'suspicious' => array_merge( $results1['suspicious'] ?? array(), $results2['suspicious'] ?? array() ),
2609	7684	'extra' => array_merge( $results1['extra'] ?? array(), $results2['extra'] ?? array() ),
2610	7685	'new' => $results1['new'] ?? array(),
2611	7686	'errors' => array_merge( $results1['errors'] ?? array(), $results2['errors'] ?? array() ),
	7687	+ // Plugins and themes with no official copy to compare with.
	7688	+ 'unverified' => array_merge( $results1['unverified'] ?? array(), $results2['unverified'] ?? array() ),
2612	7689	'scan_time' => $results1['scan_time'] ?? 0,
2613	7690	'incomplete' => $results1['incomplete'] ?? false,
2614	7691	);
2615	7692	}
		@@ -2655,8 +7732,37 @@
2655	7732	$regular_modified[] = $item;
2656	7733	}
2657	7734	}
2658	7735
	7736	+ /*
	7737	+ * Self-protection does not travel in this email any more: it has its own
	7738	+ * alert, which no setting switches off (Vigilante_Self_Integrity::
	7739	+ * maybe_send_self_alert()). Older stored results can still carry its
	7740	+ * rows, so they are dropped here instead of being listed as ordinary
	7741	+ * files.
	7742	+ */
	7743	+ foreach ( array( 'suspicious', 'extra', 'missing' ) as $self_bucket ) {
	7744	+ if ( empty( $results[ $self_bucket ] ) || ! is_array( $results[ $self_bucket ] ) ) {
	7745	+ continue;
	7746	+ }
	7747	+ $results[ $self_bucket ] = array_values(
	7748	+ array_filter(
	7749	+ $results[ $self_bucket ],
	7750	+ function ( $item ) {
	7751	+ return ! ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) );
	7752	+ }
	7753	+ )
	7754	+ );
	7755	+ }
	7756	+ $regular_modified = array_values(
	7757	+ array_filter(
	7758	+ $regular_modified,
	7759	+ function ( $item ) {
	7760	+ return ! ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) );
	7761	+ }
	7762	+ )
	7763	+ );
	7764	+
2659	7765	$suspicious_count = count( $results['suspicious'] ?? array() );
2660	7766	$extra_count = count( $results['extra'] ?? array() );
2661	7767	$critical_config_count = count( $critical_config );
2662	7768	$modified_count = count( $regular_modified );
		@@ -2661,16 +7767,31 @@
2661	7767	$critical_config_count = count( $critical_config );
2662	7768	$modified_count = count( $regular_modified );
2663	7769	$closed_count = count( $closed_plugins );
2664	7770
2665		- // Use more urgent subject when suspicious files, critical config changes
2666		- // or closed plugins are found (all three are security-critical).
2667		- if ( $suspicious_count > 0 || $critical_config_count > 0 || $closed_count > 0 ) {
	7771	+ // The subject says what was found. Suspicious files and closed plugins
	7772	+ // keep the alert wording. A change in wp-config.php or .htaccess with
	7773	+ // nothing else next to it names the files instead: most of the time it
	7774	+ // is a plugin rewriting its own block, and "SECURITY ALERT" on every
	7775	+ // one of those taught people to read the subject as "I was hacked".
	7776	+ if ( $suspicious_count > 0 || $closed_count > 0 ) {
2668	7777	$subject = sprintf(
2669	7778	/* translators: %s: Site name */
2670	7779	__( '[%s] SECURITY ALERT: File integrity issues detected', 'vigilante' ),
2671	7780	$site_name
2672	7781	);
	7782	+ } elseif ( $critical_config_count > 0 ) {
	7783	+ $changed = array();
	7784	+ foreach ( $critical_config as $item ) {
	7785	+ $changed[] = (string) ( $item['file'] ?? '' );
	7786	+ }
	7787	+
	7788	+ $subject = sprintf(
	7789	+ /* translators: 1: Site name, 2: The file that changed, or both of them, such as "wp-config.php, .htaccess" */
	7790	+ __( '[%1$s] %2$s changed: review needed', 'vigilante' ),
	7791	+ $site_name,
	7792	+ implode( ', ', array_unique( array_filter( $changed ) ) )
	7793	+ );
2673	7794	} else {
2674	7795	$subject = sprintf(
2675	7796	/* translators: %s: Site name */
2676	7797	__( '[%s] File integrity issues detected', 'vigilante' ),
		@@ -2705,9 +7826,9 @@
2705	7826	// Suspicious files section
2706	7827	if ( ! empty( $results['suspicious'] ) ) {
2707	7828	$inner .= $this->get_section_html(
2708	7829	__( 'Suspicious files', 'vigilante' ),
2709		- __( 'These files may contain malicious code. Review immediately.', 'vigilante' ),
	7830	+ __( 'Files that can run code where none is expected, or that contain code written the way malware hides itself. Some are harmless, such as cache files a plugin generates or a .htaccess that protects a folder: check the path and the reason before acting.', 'vigilante' ),
2710	7831	$results['suspicious'],
2711	7832	'#d63638',
2712	7833	'#fef1f1',
2713	7834	20,
		@@ -2718,9 +7839,9 @@
2718	7839	// Extra files section
2719	7840	if ( ! empty( $results['extra'] ) ) {
2720	7841	$inner .= $this->get_section_html(
2721	7842	__( 'Extra files', 'vigilante' ),
2722		- __( 'PHP files not in the original WordPress.org distribution.', 'vigilante' ),
	7843	+ __( 'Files that are not part of WordPress, or of the plugin or theme they sit in. Many are legitimate. A copy of wp-config.php or a database dump in the site root should be moved out of it.', 'vigilante' ),
2723	7844	$results['extra'],
2724	7845	'#b32d2e',
2725	7846	'#fdf6f4',
2726	7847	20,
		@@ -2731,9 +7852,9 @@
2731	7852	// Critical config files section (wp-config.php, .htaccess modified outside Vigilante)
2732	7853	if ( ! empty( $critical_config ) ) {
2733	7854	$inner .= $this->get_section_html(
2734	7855	__( 'Critical config files modified', 'vigilante' ),
2735		- __( 'These files are common targets for code injection. Review the changes and approve if they are legitimate.', 'vigilante' ),
	7856	+ __( 'Changed since you last approved them. Cache, security and redirection plugins rewrite their own blocks in these files, often on every update, and attackers write to them too. Review the changes and approve them if they belong to something you use.', 'vigilante' ),
2736	7857	$critical_config,
2737	7858	'#e36210',
2738	7859	'#fdf2e6',
2739	7860	10,
		@@ -2744,9 +7865,9 @@
2744	7865	// Modified files section (only if notify_level is 'all')
2745	7866	if ( 'all' === $notify_level && ! empty( $regular_modified ) ) {
2746	7867	$inner .= $this->get_section_html(
2747	7868	__( 'Modified files', 'vigilante' ),
2748		- __( 'Checksum mismatch with WordPress.org originals.', 'vigilante' ),
	7869	+ __( 'These files do not match the copy WordPress.org publishes for the installed version. Reinstalling the plugin, the theme or WordPress brings the original back.', 'vigilante' ),
2749	7870	$regular_modified,
2750	7871	'#dba617',
2751	7872	'#fdf8e8',
2752	7873	15,
		@@ -2761,8 +7882,31 @@
2761	7882	if ( $closed_count > 0 ) {
2762	7883	$inner .= $this->build_closed_plugins_email_section( $closed_plugins );
2763	7884	}
2764	7885
	7886	+ // A partial scan says so and names what it did not get to. With no
	7887	+ // finding in a plugin that was never looked at, silence here read as
	7888	+ // "that plugin is fine".
	7889	+ if ( self::is_partial( $results ) ) {
	7890	+ $partial_lines = array_merge(
	7891	+ array_slice( array_map( 'strval', (array) ( $results['errors'] ?? array() ) ), 0, 10 ),
	7892	+ self::not_checked_lines( $results )
	7893	+ );
	7894	+
	7895	+ $inner .= '<p style="margin:0 0 8px;font-size:13px;color:#1d2327;"><strong>' . esc_html__( 'The last scan could not check everything, so its result is partial.', 'vigilante' ) . '</strong></p>';
	7896	+ $inner .= '<ul style="margin:0 0 16px 18px;padding:0;font-size:13px;color:#50575e;">';
	7897	+
	7898	+ foreach ( $partial_lines as $partial_line ) {
	7899	+ $inner .= '<li>' . esc_html( $partial_line ) . '</li>';
	7900	+ }
	7901	+
	7902	+ $inner .= '</ul>';
	7903	+ }
	7904	+
	7905	+ // Where the explanation is. The email stays a list; what each kind of
	7906	+ // finding usually is and what to do about it lives next to the results.
	7907	+ $inner .= '<p style="margin:0 0 16px;font-size:12px;color:#50575e;">' . esc_html__( 'File Integrity explains what each kind of finding usually is and what to do about it. A finding stays listed until you approve it, ignore it or fix it.', 'vigilante' ) . '</p>';
	7908	+
2765	7909	// CTA button
2766	7910	$inner .= Vigilante_Email_Template::button(
2767	7911	admin_url( 'admin.php?page=vigilante&tab=file-integrity#vigilante-section-fi-last-scan' ),
2768	7912	__( 'Review in Vigilant', 'vigilante' )
		@@ -2768,13 +7912,20 @@
2768	7912	__( 'Review in Vigilant', 'vigilante' )
2769	7913	);
2770	7914
2771	7915	$is_alert = ( $suspicious_count > 0 || $critical_config_count > 0 || $closed_count > 0 );
2772		- $title = $is_alert
2773		- ? __( 'Security alert', 'vigilante' )
2774		- : __( 'File integrity report', 'vigilante' );
2775	7916
2776		- Vigilante_Email_Template::send( $to, $subject, $title, $inner, $is_alert );
	7917	+ // Same three cases as the subject.
	7918	+ if ( $suspicious_count > 0 || $closed_count > 0 ) {
	7919	+ $title = __( 'Security alert', 'vigilante' );
	7920	+ } elseif ( $critical_config_count > 0 ) {
	7921	+ $title = __( 'Configuration file changed', 'vigilante' );
	7922	+ } else {
	7923	+ $title = __( 'File integrity report', 'vigilante' );
	7924	+ }
	7925	+
	7926	+ // The caller records what was reported only when the email went out.
	7927	+ return (bool) Vigilante_Email_Template::send( $to, $subject, $title, $inner, $is_alert );
2777	7928	}
2778	7929
2779	7930	/**
2780	7931	* Build the closed + removed plugins block for the scan email.
		@@ -2899,16 +8050,32 @@
2899	8050
2900	8051	/**
2901	8052	* Add a file to the ignored list
2902	8053	*
	8054	+ * The path is stored exactly as it comes: the callers are the AJAX
	8055	+ * handlers, which have already read it and checked it against the shared
	8056	+ * files and Vigilant's own, and the scan compares the stored strings with
	8057	+ * the paths it finds one by one (in_array(), strict). This used to run
	8058	+ * sanitize_text_field() over it, which deletes every %XX octet and collapses
	8059	+ * repeated spaces, so the entry never matched the file it was made for
	8060	+ * (measured on 1 oct 2026 against 3.0.1). Anything that is not a plain
	8061	+ * string, is empty or carries tags is not a path and is refused. That guards
	8062	+ * a direct caller: the AJAX handlers read the path with wp_strip_all_tags()
	8063	+ * first, which shortens a name with a stray < instead of handing it over
	8064	+ * intact (see ajax_ignore_file()).
	8065	+ *
2903	8066	* @param string $file_path Relative file path to ignore.
2904	8067	* @return bool
2905	8068	*/
2906	8069	public function ignore_file( $file_path ) {
	8070	+ if ( ! is_string( $file_path ) || '' === $file_path || wp_strip_all_tags( $file_path ) !== $file_path ) {
	8071	+ return false;
	8072	+ }
	8073	+
2907	8074	$ignored = get_option( 'vigilante_ignored_files', array() );
2908	8075
2909	8076	if ( ! in_array( $file_path, $ignored, true ) ) {
2910		- $ignored[] = sanitize_text_field( $file_path );
	8077	+ $ignored[] = $file_path;
2911	8078	return update_option( 'vigilante_ignored_files', $ignored );
2912	8079	}
2913	8080
2914	8081	return true;