← All changes | includes/class-file-integrity.php +4250 -324 2.11.7 → 3.0.3 View file →

		@@ -68,15 +68,50 @@
68	68	*/
69	69	private $scan_start_time = 0;
70	70
71	71	/**
	72	+ * Seconds a scan runs for at most
	73	+ *
	74	+ * A scan is one request, and it starts from the beginning every time. On
	75	+ * a site too large for this, what comes last is left unchecked on every
	76	+ * scan, so the results say what was not reached (see not_checked_lines()).
	77	+ */
	78	+ const MAX_SCAN_SECONDS = 60;
	79	+
	80	+ /**
72	81	* Maximum scan time in seconds (default 60s for thorough scanning)
73	82	*
74	83	* @var int
75	84	*/
76		- private $max_scan_time = 60;
	85	+ private $max_scan_time = self::MAX_SCAN_SECONDS;
77	86
78	87	/**
	88	+ * Largest file the search for hidden code reads, in bytes
	89	+ *
	90	+ * It used to be 512,000, and a larger file was not opened at all: in a
	91	+ * plugin with no official copy that left it out of the results as if it
	92	+ * were clean. There is still a cap because the file is read whole, but
	93	+ * what is above it is reported as not searched instead of being passed
	94	+ * over (see search_file()).
	95	+ */
	96	+ const MAX_SEARCHED_BYTES = 8388608;
	97	+
	98	+ /**
	99	+ * Seconds a scan gives to the folders of wp-content that belong to nothing
	100	+ *
	101	+ * @var int
	102	+ */
	103	+ private $content_folders_time = 10;
	104	+
	105	+ /**
	106	+ * Whether an expression of the search for hidden code gave up on the file
	107	+ * being searched (see found())
	108	+ *
	109	+ * @var bool
	110	+ */
	111	+ private $search_failed = false;
	112	+
	113	+ /**
79	114	* Option name for critical files baseline hashes.
80	115	*
81	116	* @var string
82	117	*/
		@@ -165,13 +200,16 @@
165	200	*/
166	201	const REDACTED_MARKER = '[redacted by Vigilant]';
167	202
168	203	/**
169		- * Constant names whose value never reaches the database.
	204	+ * Constant names whose value is checked even where the file does not name them
170	205	*
171		- * The eight WordPress keys and salts and the database credentials, plus
172		- * anything whose name reads like a credential, since a real wp-config.php
173		- * collects SMTP passwords, S3 keys and API tokens over the years.
	206	+ * The eight WordPress keys and salts and the database credentials. Until
	207	+ * 2.11.7 this list, plus names that read like a credential, was what got
	208	+ * redacted, and a real wp-config.php collects secrets under any name:
	209	+ * FTP_PASS, SMTP passwords, cloud keys inside serialize( array( ... ) ),
	210	+ * any const. Since 2.11.8 every value is redacted and this list only feeds
	211	+ * the output check of baseline_content().
174	212	*
175	213	* @since 2.11.2
176	214	*
177	215	* @var string[]
		@@ -182,8 +220,36 @@
182	220	'AUTH_SALT', 'SECURE_AUTH_SALT', 'LOGGED_IN_SALT', 'NONCE_SALT',
183	221	);
184	222
185	223	/**
	224	+ * Core constants whose value stays readable in the baseline copy
	225	+ *
	226	+ * Where the site lives, where its folders are, how much memory it gets:
	227	+ * none of it is a secret and all of it is what a diff of wp-config.php is
	228	+ * read for. Every other value is redacted. A list of what is secret can
	229	+ * never be complete, which is how 2.11.2 to 2.11.7 missed FTP_PASS; a list
	230	+ * of what is not can be short and still be right.
	231	+ *
	232	+ * @since 2.11.8
	233	+ *
	234	+ * @var string[]
	235	+ */
	236	+ private static $readable_constants = array(
	237	+ 'ABSPATH', 'WPINC', 'WP_HOME', 'WP_SITEURL', 'WP_CONTENT_DIR', 'WP_CONTENT_URL',
	238	+ 'WP_PLUGIN_DIR', 'WP_PLUGIN_URL', 'WPMU_PLUGIN_DIR', 'WPMU_PLUGIN_URL', 'UPLOADS',
	239	+ 'WP_LANG_DIR', 'WP_TEMP_DIR', 'WP_DEBUG_LOG', 'WP_MEMORY_LIMIT', 'WP_MAX_MEMORY_LIMIT',
	240	+ 'WP_ENVIRONMENT_TYPE', 'WP_DEVELOPMENT_MODE', 'WP_AUTO_UPDATE_CORE', 'FS_METHOD',
	241	+ 'DB_CHARSET', 'DB_COLLATE', 'DOMAIN_CURRENT_SITE', 'PATH_CURRENT_SITE', 'NOBLOGREDIRECT',
	242	+ 'COOKIE_DOMAIN', 'COOKIEPATH', 'SITECOOKIEPATH', 'ADMIN_COOKIE_PATH', 'PLUGINS_COOKIE_PATH',
	243	+ 'WP_DEFAULT_THEME', 'WPLANG',
	244	+ // Numeric core settings. Since 2.11.10 a number in the value of a
	245	+ // define() is redacted like any other value, so the ones that are known
	246	+ // not to be credentials are listed here to keep the diff useful.
	247	+ 'AUTOSAVE_INTERVAL', 'WP_POST_REVISIONS', 'EMPTY_TRASH_DAYS', 'WP_CRON_LOCK_TIMEOUT',
	248	+ 'FS_CHMOD_DIR', 'FS_CHMOD_FILE', 'SITE_ID_CURRENT_SITE', 'BLOG_ID_CURRENT_SITE',
	249	+ );
	250	+
	251	+ /**
186	252	* Read the critical files baseline, from where it belongs
187	253	*
188	254	* Both watched files, wp-config.php and the root .htaccess, belong to the
189	255	* whole network: there is one of each per installation, not one per site.
		@@ -350,35 +416,61 @@
350	416	* @param string $normalized Normalized content.
351	417	* @return string Content safe to store, or '' when it cannot be made safe.
352	418	*/
353	419	private function baseline_content( $filename, $normalized ) {
	420	+ if ( '.htaccess' === $filename ) {
	421	+ return $this->redact_server_secrets( $normalized );
	422	+ }
	423	+
354	424	if ( 'wp-config.php' !== $filename ) {
355	425	return $normalized;
356	426	}
357	427
358		- $redacted = $this->redact_secrets( $normalized );
	428	+ // Calculados una sola vez: los usa la redaccion (para no conservar un
	429	+ // numero que ademas este en vigor) y el control de salida de abajo.
	430	+ $live_values = $this->values_in_force( $normalized );
	431	+ $redacted = $this->redact_secrets( $normalized, $live_values );
359	432
360	433	/*
361		- * Belt and braces, and this is the part that matters: the regular
362		- * expression above is the thing most likely to miss a shape nobody
363		- * thought of, and the cost of missing one is a secret in the database.
364		- * So the result is checked against the values actually in force, and
365		- * if any of them survived, nothing is stored at all. The scan then
366		- * reports the change without a line diff, which the interface already
367		- * handles, instead of leaking.
	434	+ * Belt and braces, and this is the part that matters: the redaction
	435	+ * above is the thing most likely to miss a shape nobody thought of,
	436	+ * and the cost of missing one is a secret in the database. So the
	437	+ * result is checked against the values actually in force, and if any
	438	+ * of them survived, nothing is stored at all. The scan then reports the
	439	+ * change without a line diff, which the interface already handles,
	440	+ * instead of leaking.
368	441	*
	442	+ * Until 2.11.7 the check covered the twelve constants of WordPress and
	443	+ * nothing else, so a value the regular expression missed went straight
	444	+ * through it. It now covers every constant the file names and every
	445	+ * environment variable it reads.
	446	+ *
	447	+ * It runs against the copy that is actually stored. A value in force
	448	+ * that sits inside the value of a readable constant, such as a Redis
	449	+ * prefix equal to the domain inside WP_HOME, is not a secret left
	450	+ * behind, so that one alone is not looked for; without that, every such
	451	+ * site would lose its diff. The first version of this checked a
	452	+ * stricter copy instead, and a secret inside a kept include path went
	453	+ * straight past it (cross review of 2.11.8).
	454	+ *
369	455	* Only values of eight characters or more are checked: DB_NAME is
370	456	* often something like "local" or "wp", and looking for that inside a
371	457	* PHP file matches by accident every time.
372	458	*/
373		- foreach ( self::$secret_constants as $name ) {
374		- if ( ! defined( $name ) ) {
375		- continue;
	459	+ if ( '' === $redacted ) {
	460	+ return '';
	461	+ }
	462	+
	463	+ $shown = $this->readable_values_in_force();
	464	+
	465	+ foreach ( $live_values as $value ) {
	466	+ foreach ( $shown as $readable ) {
	467	+ if ( false !== strpos( $readable, $value ) ) {
	468	+ continue 2;
	469	+ }
376	470	}
377	471
378		- $value = (string) constant( $name );
379		-
380		- if ( strlen( $value ) >= 8 && false !== strpos( $redacted, $value ) ) {
	472	+ if ( false !== strpos( $redacted, $value ) ) {
381	473	return '';
382	474	}
383	475	}
384	476
		@@ -385,40 +477,523 @@
385	477	return $redacted;
386	478	}
387	479
388	480	/**
389		- * Replace the value of every credential-looking define with a marker
	481	+ * Replace every value in wp-config.php with a marker
390	482	*
391		- * Keeps the line and the constant name, so the diff still shows that a
392		- * credential line was touched, and drops only the value.
	483	+ * Reads the file as PHP tokens and replaces every string in it: quoted,
	484	+ * with variables inside, heredoc and nowdoc. What stays is what names a
	485	+ * thing rather than holding it: the name passed to define(), defined(),
	486	+ * constant() and getenv(), the name in putenv( 'NAME=value' ), array keys,
	487	+ * an index such as $_ENV['NAME'], and strings of a single character that
	488	+ * are not the value of a define(). Also the value of the constants in
	489	+ * $readable_constants, the table prefix and a path passed to require or
	490	+ * include, which are not secrets and are what a diff of this file is read
	491	+ * for. A path is kept only while it looks like one, and only up to where
	492	+ * its expression ends.
393	493	*
	494	+ * Until 2.11.7 this was a regular expression over define() with a list of
	495	+ * names, and it missed FTP_PASS, SMTP passwords, cloud keys inside
	496	+ * serialize( array( ... ) ), every const and every value read with a
	497	+ * fallback. Measured while preparing 2.11.8: 10 of 15 real shapes stored
	498	+ * their secret.
	499	+ *
	500	+ * The marker always goes in single quotes, whatever the original used, so
	501	+ * a copy redacted by an earlier version and the same file redacted today
	502	+ * read the same line for line.
	503	+ *
394	504	* @since 2.11.2
	505	+ * @since 2.11.8 Reads tokens and redacts every value.
395	506	*
396	507	* @param string $content Normalized wp-config.php content.
	508	+ * @return string Redacted content, or '' when it cannot be read as tokens.
	509	+ */
	510	+ private function redact_secrets( $content, $live_values = array() ) {
	511	+ if ( ! function_exists( 'token_get_all' ) ) {
	512	+ return '';
	513	+ }
	514	+
	515	+ $marker = "'" . self::REDACTED_MARKER . "'";
	516	+ $tokens = self::merged_tokens( token_get_all( (string) $content ) );
	517	+ $count = count( $tokens );
	518	+ $names = defined( 'T_NAME_FULLY_QUALIFIED' ) ? array( T_STRING, T_NAME_FULLY_QUALIFIED ) : array( T_STRING );
	519	+ $includes = array( T_INCLUDE, T_INCLUDE_ONCE, T_REQUIRE, T_REQUIRE_ONCE );
	520	+ $out = '';
	521	+ $depth = 0;
	522	+ $keep_until = -1;
	523	+ $define_at = -1;
	524	+ $in_include = false;
	525	+ $include_depth = 0;
	526	+ $include_ends = array( T_CLOSE_TAG, T_BOOLEAN_OR, T_BOOLEAN_AND, T_LOGICAL_OR, T_LOGICAL_AND, T_COALESCE );
	527	+
	528	+ for ( $i = 0; $i < $count; $i++ ) {
	529	+ list( $type, $text, $plain ) = $tokens[ $i ];
	530	+
	531	+ if ( '(' === $type ) {
	532	+ $depth++;
	533	+ } elseif ( ')' === $type ) {
	534	+ // The closing parenthesis of a readable define(), or of any define().
	535	+ if ( $depth === $keep_until ) {
	536	+ $keep_until = -1;
	537	+ }
	538	+ if ( $depth === $define_at ) {
	539	+ $define_at = -1;
	540	+ }
	541	+ $depth--;
	542	+
	543	+ // A parenthesis that closes around the include ends its path.
	544	+ if ( $in_include && $depth < $include_depth ) {
	545	+ $in_include = false;
	546	+ }
	547	+ } elseif ( in_array( $type, $includes, true ) ) {
	548	+ $in_include = true;
	549	+ $include_depth = $depth;
	550	+ } elseif ( $in_include && ( in_array( $type, array( ';', '{', '}', '?', ':', ',' ), true ) || in_array( $type, $include_ends, true ) ) ) {
	551	+ /*
	552	+ * The path of an include ends where its expression does. The
	553	+ * first version of this only ended it at ';', so the value in
	554	+ * `( include 'db.php' ) || define( 'FTP_PASS', '...' )`, in a
	555	+ * ternary after require, or after a closing tag, was kept.
	556	+ * Found by the cross review of 2.11.8.
	557	+ */
	558	+ $in_include = false;
	559	+ }
	560	+
	561	+ if ( T_COMMENT === $type || T_DOC_COMMENT === $type ) {
	562	+ $out .= $this->redact_comment( $text );
	563	+ continue;
	564	+ }
	565	+
	566	+ if ( T_INLINE_HTML === $type ) {
	567	+ $out .= ( '' === trim( $text ) ) ? $text : $marker;
	568	+ continue;
	569	+ }
	570	+
	571	+ /*
	572	+ * A value that is not a quoted string is still a value. Until
	573	+ * 2.11.10 only string tokens were looked at, so
	574	+ * define( 'SERVICE_TOKEN', 12345678 ) put the live token in the copy
	575	+ * kept in the database. Reported by the wp.org automated review of
	576	+ * 2.11.9.
	577	+ *
	578	+ * The first fix here redacted a number only in the value position of
	579	+ * a define(), which is the shape that was reported and not the shape
	580	+ * of the problem. The second cross review of 2.11.10 measured nine
	581	+ * more: a negative number, one in parentheses, one inside
	582	+ * array( ... ), one in a ternary, a const, and four that are not
	583	+ * constants at all and so the output check cannot catch either, the
	584	+ * worst of them the documented way of configuring Redis,
	585	+ * $redis_server = array( 'auth' => 12345678 ). So a number is now
	586	+ * treated like a string: redacted unless the place it sits in is one
	587	+ * of the few that cannot hold a credential, which is how the rest of
	588	+ * this function has been written since 2.11.8 (a list of what may be
	589	+ * shown, never a list of what is secret).
	590	+ *
	591	+ * Losing a number from the diff costs little and buys the same trade
	592	+ * as everywhere else: the hash still covers the whole file, so a
	593	+ * change is detected even where the diff can no longer show it. The
	594	+ * numeric core settings are in $readable_constants so the diff of a
	595	+ * normal wp-config.php keeps saying what it used to.
	596	+ */
	597	+ if ( T_LNUMBER === $type || T_DNUMBER === $type ) {
	598	+ $nprev = self::significant_token( $tokens, $i, -1 );
	599	+ $nnext = self::significant_token( $tokens, $i, 1 );
	600	+ $nptype = ( null === $nprev ) ? null : $tokens[ $nprev ][0];
	601	+ $nntype = ( null === $nnext ) ? null : $tokens[ $nnext ][0];
	602	+ $nbefore = ( '[' === $nptype ) ? self::significant_token( $tokens, $nprev, -1 ) : null;
	603	+ $nbtoken = ( null === $nbefore ) ? array( null, null ) : $tokens[ $nbefore ];
	604	+ $nvalue = ( -1 !== $define_at && $depth === $define_at && ',' === $nptype );
	605	+
	606	+ $nkeep = $keep_until >= 0
	607	+ || T_DOUBLE_ARROW === $nntype
	608	+ || ( '[' === $nptype && ']' === $nntype && in_array( $nbtoken[0], array( T_VARIABLE, T_STRING, ']', ')', '}' ), true ) )
	609	+ || ( strlen( $text ) <= 1 && ! $nvalue );
	610	+
	611	+ /*
	612	+ * Except when that same number is a value actually in force. The
	613	+ * positions kept above are kept because a credential does not live
	614	+ * in them, which is true, but it says nothing about the number
	615	+ * itself: with
	616	+ * define( 'SERVICE_TOKEN', 12345678 );
	617	+ * $a = $config[12345678];
	618	+ * the value was redacted in the define and kept in the index, so it
	619	+ * survived, and the output check below did what it is there for and
	620	+ * threw the whole copy away. No leak, but the diff of that
	621	+ * wp-config.php was lost for good, which is the regression 2.11.8
	622	+ * fixed, coming back through the numbers added in 2.11.10. Found by
	623	+ * the third cross review.
	624	+ *
	625	+ * Strings are deliberately NOT treated this way: there, a value in
	626	+ * force sitting in a kept position (an include path, an array key)
	627	+ * can BE the secret, and losing the diff is the right answer. It is
	628	+ * what poc/wpconfig-baseline-secretos.sh checks and it stays.
	629	+ */
	630	+ if ( $nkeep && in_array( $text, $live_values, true ) ) {
	631	+ $nkeep = false;
	632	+ }
	633	+
	634	+ $out .= $nkeep ? $text : $marker;
	635	+ continue;
	636	+ }
	637	+
	638	+ if ( 'string' !== $type ) {
	639	+ $out .= $text;
	640	+ continue;
	641	+ }
	642	+
	643	+ $prev = self::significant_token( $tokens, $i, -1 );
	644	+ $next = self::significant_token( $tokens, $i, 1 );
	645	+ $ptype = ( null === $prev ) ? null : $tokens[ $prev ][0];
	646	+ $ntype = ( null === $next ) ? null : $tokens[ $next ][0];
	647	+ $call = ( '(' === $ptype ) ? self::significant_token( $tokens, $prev, -1 ) : null;
	648	+ $inner = $plain ? substr( $text, 1, -1 ) : null;
	649	+
	650	+ if ( $plain && null !== $call && in_array( $tokens[ $call ][0], $names, true ) ) {
	651	+ $function = strtolower( ltrim( $tokens[ $call ][1], '\\' ) );
	652	+
	653	+ if ( in_array( $function, array( 'define', 'defined', 'constant', 'getenv' ), true ) ) {
	654	+ if ( 'define' === $function ) {
	655	+ $define_at = $depth;
	656	+
	657	+ if ( in_array( $inner, self::$readable_constants, true ) ) {
	658	+ $keep_until = $depth;
	659	+ }
	660	+ }
	661	+ $out .= $text;
	662	+ continue;
	663	+ }
	664	+
	665	+ if ( 'putenv' === $function && false !== strpos( $inner, '=' ) ) {
	666	+ $out .= "'" . substr( $inner, 0, strpos( $inner, '=' ) + 1 ) . self::REDACTED_MARKER . "'";
	667	+ continue;
	668	+ }
	669	+ }
	670	+
	671	+ // The token before an opening bracket or an assignment, when there is one.
	672	+ $before = ( '[' === $ptype || '=' === $ptype ) ? self::significant_token( $tokens, $prev, -1 ) : null;
	673	+ $btoken = ( null === $before ) ? array( null, null ) : $tokens[ $before ];
	674	+
	675	+ /*
	676	+ * The value of a define() is redacted whatever its length, as it was
	677	+ * up to 2.11.7, so an empty password reads the same in a copy stored
	678	+ * then as in today's; the first version of this kept strings of one
	679	+ * character there and a file awaiting review showed credential lines
	680	+ * nobody had touched (cross review of 2.11.8).
	681	+ */
	682	+ $is_define_value = ( -1 !== $define_at && $depth === $define_at && ',' === $ptype );
	683	+ $is_path = $in_include && $plain
	684	+ && preg_match( '#^[A-Za-z0-9_./\-]+$#', (string) $inner )
	685	+ && ( false !== strpos( (string) $inner, '/' ) || '.php' === substr( (string) $inner, -4 ) );
	686	+
	687	+ $keep = ( $plain && strlen( $inner ) <= 1 && ! $is_define_value )
	688	+ || T_DOUBLE_ARROW === $ntype
	689	+ || ( '[' === $ptype && ']' === $ntype && in_array( $btoken[0], array( T_VARIABLE, T_STRING, ']', ')', '}' ), true ) )
	690	+ || $keep_until >= 0
	691	+ || $is_path
	692	+ || ( '=' === $ptype && ';' === $ntype && T_VARIABLE === $btoken[0] && '$table_prefix' === $btoken[1] );
	693	+
	694	+ $out .= $keep ? $text : $marker;
	695	+ }
	696	+
	697	+ return $out;
	698	+ }
	699	+
	700	+ /**
	701	+ * PHP tokens with every string folded into a single token
	702	+ *
	703	+ * The tokenizer splits a string with variables inside, a heredoc and a
	704	+ * backtick command into several tokens. For the redaction each of them is
	705	+ * one value, so they come back as a single token of type 'string'. The
	706	+ * third field says whether it is a plain quoted literal.
	707	+ *
	708	+ * @since 2.11.8
	709	+ *
	710	+ * @param array $raw Output of token_get_all().
	711	+ * @return array List of array( type, text, plain ).
	712	+ */
	713	+ private static function merged_tokens( $raw ) {
	714	+ $tokens = array();
	715	+ $count = count( $raw );
	716	+
	717	+ for ( $i = 0; $i < $count; $i++ ) {
	718	+ $token = $raw[ $i ];
	719	+
	720	+ if ( '"' === $token || '`' === $token ) {
	721	+ $text = $token;
	722	+ for ( $i++; $i < $count; $i++ ) {
	723	+ $text .= is_array( $raw[ $i ] ) ? $raw[ $i ][1] : $raw[ $i ];
	724	+ if ( $raw[ $i ] === $token ) {
	725	+ break;
	726	+ }
	727	+ }
	728	+ $tokens[] = array( 'string', $text, false );
	729	+ continue;
	730	+ }
	731	+
	732	+ if ( is_array( $token ) && T_START_HEREDOC === $token[0] ) {
	733	+ $text = $token[1];
	734	+ for ( $i++; $i < $count; $i++ ) {
	735	+ $text .= is_array( $raw[ $i ] ) ? $raw[ $i ][1] : $raw[ $i ];
	736	+ if ( is_array( $raw[ $i ] ) && T_END_HEREDOC === $raw[ $i ][0] ) {
	737	+ break;
	738	+ }
	739	+ }
	740	+ $tokens[] = array( 'string', $text, false );
	741	+ continue;
	742	+ }
	743	+
	744	+ // An unterminated string comes back as T_ENCAPSED_AND_WHITESPACE
	745	+ // on its own, and it is a value like any other.
	746	+ if ( is_array( $token ) && ( T_CONSTANT_ENCAPSED_STRING === $token[0] || T_ENCAPSED_AND_WHITESPACE === $token[0] ) ) {
	747	+ $tokens[] = array( 'string', $token[1], T_CONSTANT_ENCAPSED_STRING === $token[0] );
	748	+ continue;
	749	+ }
	750	+
	751	+ $tokens[] = is_array( $token ) ? array( $token[0], $token[1], false ) : array( $token, $token, false );
	752	+ }
	753	+
	754	+ return $tokens;
	755	+ }
	756	+
	757	+ /**
	758	+ * Index of the nearest token that is not whitespace or a comment
	759	+ *
	760	+ * @since 2.11.8
	761	+ *
	762	+ * @param array $tokens Output of merged_tokens().
	763	+ * @param int $from Index to start from, not included.
	764	+ * @param int $step -1 to look back, 1 to look ahead.
	765	+ * @return int|null
	766	+ */
	767	+ private static function significant_token( $tokens, $from, $step ) {
	768	+ $count = count( $tokens );
	769	+
	770	+ for ( $i = $from + $step; $i >= 0 && $i < $count; $i += $step ) {
	771	+ if ( ! in_array( $tokens[ $i ][0], array( T_WHITESPACE, T_COMMENT, T_DOC_COMMENT ), true ) ) {
	772	+ return $i;
	773	+ }
	774	+ }
	775	+
	776	+ return null;
	777	+ }
	778	+
	779	+ /**
	780	+ * Redact a comment, keeping its plain words
	781	+ *
	782	+ * To the tokenizer a comment is text, and wp-config.php files keep old
	783	+ * credentials in them, commented out or in a note. The first version of
	784	+ * this, in the same release, redacted what was between quotes: an
	785	+ * apostrophe in prose ("Don't use 'the-old-password'") paired with the
	786	+ * opening quote of the secret and left it out, and a secret without quotes
	787	+ * was never touched. Found by the cross review of 2.11.8.
	788	+ *
	789	+ * So it works the other way round. A comment keeps its plain words
	790	+ * (lowercase, capitalised or uppercase letters, or two capitalised parts
	791	+ * such as WordPress, and docblock tags), constant names, and anything
	792	+ * shorter than eight characters; every other run of characters, a URL, a
	793	+ * key, a password with a digit in it, becomes the marker. The value of a
	794	+ * commented-out define() goes in single quotes whatever its length, as in
	795	+ * code and as 2.11.2 to 2.11.7 wrote it, so a copy stored by those
	796	+ * versions reads the same line for line. What this cannot tell from prose
	797	+ * is a password made only of plain letters; the output check still
	798	+ * catches it when it is a value in force.
	799	+ *
	800	+ * @since 2.11.8
	801	+ *
	802	+ * @param string $comment Comment token text.
397	803	* @return string
398	804	*/
399		- private function redact_secrets( $content ) {
400		- $names = implode( '|', array_map( 'preg_quote', self::$secret_constants ) );
	805	+ private function redact_comment( $comment ) {
	806	+ $marker = self::REDACTED_MARKER;
	807	+ $readable = self::$readable_constants;
401	808
	809	+ // Only the text between the delimiters is redacted: "/**#@-*/" in
	810	+ // wp-config-sample.php is a single run of eight characters, and
	811	+ // replacing it whole took the comment markers with it.
	812	+ if ( ! preg_match( '#\A(/\*\*?|//|\#)(.*?)(\*/)?\z#s', $comment, $parts ) ) {
	813	+ $parts = array( $comment, '', $comment );
	814	+ }
	815	+
	816	+ $open = $parts[1];
	817	+ $close = isset( $parts[3] ) ? $parts[3] : '';
	818	+ $comment = preg_replace_callback(
	819	+ '/(\bdefine\s*\(\s*([\'"])((?:\\\\.|(?!\2).)*)\2\s*,\s*)([\'"])((?:\\\\.|(?!\4).)*)\4/i',
	820	+ function ( $match ) use ( $marker, $readable ) {
	821	+ return in_array( $match[3], $readable, true ) ? $match[0] : $match[1] . "'" . $marker . "'";
	822	+ },
	823	+ $parts[2]
	824	+ );
	825	+
	826	+ if ( null === $comment ) {
	827	+ return '';
	828	+ }
	829	+
	830	+ $redacted = preg_replace_callback(
	831	+ '/[^\s\'"`(),;\[\]{}<>=]+/u',
	832	+ function ( $match ) use ( $marker ) {
	833	+ $word = $match[0];
	834	+ $core = rtrim( $word, '.:!?' );
	835	+
	836	+ // Plain words only, without hyphens: a passphrase written as
	837	+ // lowercase words joined by hyphens reads as prose otherwise, and
	838	+ // the PoC of this very fix caught one surviving.
	839	+ if ( strlen( $core ) < 8
	840	+ || preg_match( '/^@?(?:\p{Lu}?\p{Ll}+|\p{Lu}+)$/u', $core )
	841	+ || preg_match( '/^\p{Lu}\p{Ll}+\p{Lu}\p{Ll}+$/u', $core )
	842	+ || preg_match( '/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/', $core )
	843	+ ) {
	844	+ return $word;
	845	+ }
	846	+
	847	+ return $marker . substr( $word, strlen( $core ) );
	848	+ },
	849	+ $comment
	850	+ );
	851	+
	852	+ // A failed replacement, on invalid UTF-8 for one, drops the comment
	853	+ // rather than keep it whole.
	854	+ return ( null === $redacted ) ? '' : $open . $redacted . $close;
	855	+ }
	856	+
	857	+ /**
	858	+ * Values in force of what a wp-config.php names
	859	+ *
	860	+ * Every user constant whose name appears in the file, the twelve of
	861	+ * WordPress wherever they were defined, and the environment variables the
	862	+ * file reads or sets. Arrays are walked to their leaves, since define()
	863	+ * takes arrays. Strings and numbers both: the first version of this counted
	864	+ * numbers and wiped the diff of any file with a large number in force (cross
	865	+ * review of 2.11.8), so they were dropped, and 2.11.10 had to bring them
	866	+ * back because a credential written as a number, which the wp.org review of
	867	+ * 2.11.9 reported, is exactly what this check has to be able to see. The
	868	+ * eight character floor is what keeps the old problem away. The readable
	869	+ * constants are left out, and so is anything shorter than that.
	870	+ *
	871	+ * @since 2.11.8
	872	+ *
	873	+ * @param string $content Normalized wp-config.php content.
	874	+ * @return string[]
	875	+ */
	876	+ private function values_in_force( $content ) {
	877	+ $defined = get_defined_constants( true );
	878	+ $user = isset( $defined['user'] ) ? $defined['user'] : array();
	879	+ $names = self::$secret_constants;
	880	+ $values = array();
	881	+
	882	+ if ( preg_match_all( '/[A-Za-z_][A-Za-z0-9_]*/', (string) $content, $words ) ) {
	883	+ $names = array_merge( $names, $words[0] );
	884	+ }
	885	+
	886	+ foreach ( array_unique( $names ) as $name ) {
	887	+ if ( array_key_exists( $name, $user ) && ! in_array( $name, self::$readable_constants, true ) ) {
	888	+ $values = array_merge( $values, self::string_leaves( $user[ $name ] ) );
	889	+ }
	890	+ }
	891	+
	892	+ if ( preg_match_all( '/\b(?:getenv|putenv)\s*\(\s*[\'"]([A-Za-z_][A-Za-z0-9_]*)|\$_ENV\s*\[\s*[\'"]([A-Za-z_][A-Za-z0-9_]*)/', (string) $content, $env ) ) {
	893	+ foreach ( array_filter( array_merge( $env[1], $env[2] ) ) as $name ) {
	894	+ $value = getenv( $name );
	895	+
	896	+ if ( is_string( $value ) ) {
	897	+ $values[] = $value;
	898	+ }
	899	+ }
	900	+ }
	901	+
	902	+ $long = array();
	903	+
	904	+ foreach ( $values as $value ) {
	905	+ if ( strlen( $value ) >= 8 ) {
	906	+ $long[ $value ] = $value;
	907	+ }
	908	+ }
	909	+
	910	+ return array_values( $long );
	911	+ }
	912	+
	913	+ /**
	914	+ * Every string inside a constant value
	915	+ *
	916	+ * @since 2.11.8
	917	+ *
	918	+ * @param mixed $value Constant value.
	919	+ * @return string[]
	920	+ */
	921	+ private static function string_leaves( $value ) {
	922	+ if ( is_array( $value ) ) {
	923	+ $leaves = array();
	924	+
	925	+ foreach ( $value as $item ) {
	926	+ $leaves = array_merge( $leaves, self::string_leaves( $item ) );
	927	+ }
	928	+
	929	+ return $leaves;
	930	+ }
	931	+
	932	+ if ( is_string( $value ) ) {
	933	+ return array( $value );
	934	+ }
	935	+
402	936	/*
403		- * define( 'NAME', 'value' ), matching the quoted literal itself rather
404		- * than reading up to the closing parenthesis.
405		- *
406		- * The first version of this stopped at the first ';', which looked
407		- * reasonable and failed on the very first real file it saw: the salts
408		- * WordPress generates are full of punctuation and a ';' inside one cut
409		- * the match short, so nothing was redacted. Backreference 3 is the
410		- * opening quote and the value runs to its unescaped twin. No /s
411		- * modifier on purpose, so a file with an unterminated string breaks
412		- * one line instead of swallowing the rest of the file.
	937	+ * A number is a value too. Until 2.11.10 this returned nothing for one,
	938	+ * so the output check had no way to see a credential written as
	939	+ * define( 'SERVICE_TOKEN', 12345678 ) and the redaction was left without
	940	+ * its safety net there. Booleans and null stay out on purpose: as text
	941	+ * they are '1' and '', which would match half the file.
413	942	*/
414		- $pattern = '/(define\s*\(\s*([\'"])(?:' . $names . '|[A-Z0-9_]*(?:KEY|SALT|SECRET|PASSWORD|PASSWD|TOKEN|API)[A-Z0-9_]*)\2\s*,\s*)([\'"])(?:\\\\.|(?!\3).)*\3/i';
	943	+ return ( is_int( $value ) || is_float( $value ) ) ? array( (string) $value ) : array();
	944	+ }
415	945
416		- $redacted = preg_replace( $pattern, '${1}\'' . self::REDACTED_MARKER . '\'', $content );
	946	+ /**
	947	+ * Values in force of the readable constants, the ones kept in the copy
	948	+ *
	949	+ * @since 2.11.8
	950	+ *
	951	+ * @return string[]
	952	+ */
	953	+ private function readable_values_in_force() {
	954	+ $values = array();
417	955
418		- // A failed preg_replace returns null, and storing null would wipe the
419		- // baseline copy silently. Falling back to the original is not an
420		- // option either, so the caller's guard turns this into "no content".
	956	+ foreach ( self::$readable_constants as $name ) {
	957	+ if ( defined( $name ) ) {
	958	+ $values = array_merge( $values, self::string_leaves( constant( $name ) ) );
	959	+ }
	960	+ }
	961	+
	962	+ return $values;
	963	+ }
	964	+
	965	+ /**
	966	+ * Replace the values a root .htaccess can carry as credentials
	967	+ *
	968	+ * The .htaccess is not a secrets file, but it can hold a few: an
	969	+ * environment variable handed to PHP with SetEnv, an Authorization header
	970	+ * set for a backend, or a php_value with a password, a key, a licence or a
	971	+ * session store address with its auth in it. The directive and its name
	972	+ * stay, the value goes. Line based, which is how Apache reads it too. Since
	973	+ * the cross review of 2.11.8 also any request or response header whose name
	974	+ * reads like a credential (X-Api-Key, a cookie, a signature) and a
	975	+ * RewriteCond that compares against key=, token= or the like, the way a
	976	+ * staging site is opened with a secret in the query string. What it cannot
	977	+ * see is a credential written in any other shape.
	978	+ *
	979	+ * @since 2.11.8
	980	+ *
	981	+ * @param string $content Normalized .htaccess content.
	982	+ * @return string
	983	+ */
	984	+ private function redact_server_secrets( $content ) {
	985	+ $redacted = preg_replace(
	986	+ array(
	987	+ '/^([ \t]*SetEnv[ \t]+\S+[ \t]+)\S.*$/mi',
	988	+ '/^([ \t]*(?:RequestHeader|Header)[ \t]+(?:always[ \t]+)?\S+[ \t]+[\w-]*(?:auth|key|token|secret|pass|cookie|sig)[\w-]*[ \t]+)\S.*$/mi',
	989	+ '/^([ \t]*php_(?:admin_)?value[ \t]+\S*(?:pass|pw|secret|key|token|licen|auth|save_path)\S*[ \t]+)\S.*$/mi',
	990	+ '/^([ \t]*RewriteCond[ \t]+\S+[ \t]+)\S*(?:key|token|secret|pass|auth|sig)[\w-]*=\S*/mi',
	991	+ ),
	992	+ '${1}' . self::REDACTED_MARKER,
	993	+ (string) $content
	994	+ );
	995	+
421	996	return ( null === $redacted ) ? '' : $redacted;
422	997	}
423	998
424	999	/**
		@@ -617,8 +1192,150 @@
617	1192	}
618	1193	}
619	1194
620	1195	/**
	1196	+ * Network option recording the version whose results cleanup walked the network
	1197	+ *
	1198	+ * @since 2.11.8
	1199	+ */
	1200	+ const RESULTS_SWEEP_OPTION = 'vigilante_results_sweep';
	1201	+
	1202	+ /**
	1203	+ * Clean the stored scan results of every site of the network, once per version
	1204	+ *
	1205	+ * redact_stored_results() runs per site from admin_init and from the scan,
	1206	+ * so a subsite with the module off whose dashboard nobody opens kept the
	1207	+ * lines of wp-config.php its last scan stored, with whatever that version
	1208	+ * failed to redact. Same gap 2.11.3 and 2.11.4 closed for the baseline copy;
	1209	+ * found for the results by the cross review of 2.11.8. It runs from the
	1210	+ * network sweep, for a network administrator on the main site, and has its
	1211	+ * own marker because the baseline sweep is already done on every network
	1212	+ * that updated through 2.11.4.
	1213	+ *
	1214	+ * @since 2.11.8
	1215	+ */
	1216	+ private function maybe_sweep_network_results() {
	1217	+ if ( VIGILANTE_VERSION === get_site_option( self::RESULTS_SWEEP_OPTION ) ) {
	1218	+ return;
	1219	+ }
	1220	+
	1221	+ update_site_option( self::RESULTS_SWEEP_OPTION, VIGILANTE_VERSION );
	1222	+
	1223	+ $site_ids = get_sites(
	1224	+ array(
	1225	+ 'fields' => 'ids',
	1226	+ 'number' => 0,
	1227	+ 'network_id' => get_current_network_id(),
	1228	+ 'update_site_meta_cache' => false,
	1229	+ )
	1230	+ );
	1231	+
	1232	+ foreach ( $site_ids as $site_id ) {
	1233	+ switch_to_blog( $site_id );
	1234	+ $this->redact_stored_results();
	1235	+ restore_current_blog();
	1236	+ }
	1237	+ }
	1238	+
	1239	+ /**
	1240	+ * The diff of a shared file as a site that does not own it gets it
	1241	+ *
	1242	+ * No lines, and a flag the screens read to say where the lines are.
	1243	+ *
	1244	+ * @since 2.11.8
	1245	+ *
	1246	+ * @return array
	1247	+ */
	1248	+ public static function network_only_diff() {
	1249	+ return array(
	1250	+ 'added' => array(),
	1251	+ 'removed' => array(),
	1252	+ 'unavailable' => true,
	1253	+ 'network' => true,
	1254	+ );
	1255	+ }
	1256	+
	1257	+ /**
	1258	+ * Take out of the last stored scan what the baseline copy no longer keeps
	1259	+ *
	1260	+ * The results of the last scan are an option of each site, and the diff of
	1261	+ * a critical file travels inside them line by line, redacted the way the
	1262	+ * version that ran the scan redacted. Until 2.11.7 that let FTP_PASS and
	1263	+ * friends through, and on a network every subsite with the module on kept
	1264	+ * its own copy of the lines. This runs once per version with the rest of
	1265	+ * the cleanup:
	1266	+ *
	1267	+ * - Where the shared files do not belong to this site, no line is kept.
	1268	+ * - Lines of wp-config.php are dropped. A single line cannot be read as
	1269	+ * PHP reliably (half a heredoc is just words), and the next scan rebuilds
	1270	+ * them from the whole file.
	1271	+ * - Lines of .htaccess are directives, one per line, and are redacted in
	1272	+ * place.
	1273	+ *
	1274	+ * @since 2.11.8
	1275	+ */
	1276	+ private function redact_stored_results() {
	1277	+ $results = get_option( 'vigilante_last_integrity_results' );
	1278	+
	1279	+ if ( ! is_array( $results ) || empty( $results['modified'] ) || ! is_array( $results['modified'] ) ) {
	1280	+ return;
	1281	+ }
	1282	+
	1283	+ $owns = Vigilante_Settings::owns_shared_files();
	1284	+ $changed = false;
	1285	+
	1286	+ foreach ( $results['modified'] as $index => $item ) {
	1287	+ if ( ! is_array( $item ) || 'critical_config' !== ( $item['type'] ?? '' ) || ! isset( $item['diff'] ) || ! is_array( $item['diff'] ) ) {
	1288	+ continue;
	1289	+ }
	1290	+
	1291	+ if ( ! $owns ) {
	1292	+ if ( empty( $item['diff']['network'] ) ) {
	1293	+ $results['modified'][ $index ]['diff'] = self::network_only_diff();
	1294	+ $changed = true;
	1295	+ }
	1296	+ continue;
	1297	+ }
	1298	+
	1299	+ if ( 'wp-config.php' === ( $item['file'] ?? '' ) ) {
	1300	+ if ( ! empty( $item['diff']['added'] ) || ! empty( $item['diff']['removed'] ) ) {
	1301	+ $results['modified'][ $index ]['diff'] = array(
	1302	+ 'added' => array(),
	1303	+ 'removed' => array(),
	1304	+ 'unavailable' => true,
	1305	+ 'rescan' => true,
	1306	+ );
	1307	+ $changed = true;
	1308	+ }
	1309	+ continue;
	1310	+ }
	1311	+
	1312	+ foreach ( array( 'added', 'removed' ) as $side ) {
	1313	+ if ( empty( $item['diff'][ $side ] ) || ! is_array( $item['diff'][ $side ] ) ) {
	1314	+ continue;
	1315	+ }
	1316	+
	1317	+ foreach ( $item['diff'][ $side ] as $line_index => $line ) {
	1318	+ if ( ! is_array( $line ) || ! isset( $line['content'] ) || ! is_string( $line['content'] ) ) {
	1319	+ continue;
	1320	+ }
	1321	+
	1322	+ $safe = $this->redact_server_secrets( $line['content'] );
	1323	+
	1324	+ if ( $safe !== $line['content'] ) {
	1325	+ $results['modified'][ $index ]['diff'][ $side ][ $line_index ]['content'] = $safe;
	1326	+ $changed = true;
	1327	+ }
	1328	+ }
	1329	+ }
	1330	+ }
	1331	+
	1332	+ if ( $changed ) {
	1333	+ update_option( 'vigilante_last_integrity_results', $results );
	1334	+ }
	1335	+ }
	1336	+
	1337	+ /**
621	1338	* Clean up what earlier versions stored, wherever they stored it
622	1339	*
623	1340	* Two jobs, and the second one only exists on a network.
624	1341	*
		@@ -695,8 +1412,10 @@
695	1412	$this->write_baseline( $baseline );
696	1413	}
697	1414	}
698	1415
	1416	+ $this->redact_stored_results();
	1417	+
699	1418	/*
700	1419	* The gate does not close while a per-site copy is still waiting to be
701	1420	* promoted. Closing it would end the retries for a whole version: the
702	1421	* copy would sit there unread, the file it records would be missing
		@@ -750,8 +1469,10 @@
750	1469	if ( ! current_user_can( 'manage_network_options' ) ) {
751	1470	return;
752	1471	}
753	1472
	1473	+ $this->maybe_sweep_network_results();
	1474	+
754	1475	$marker = get_site_option( self::BASELINE_SWEEP_OPTION );
755	1476
756	1477	/*
757	1478	* Two markers, because there are two different things to remember and
		@@ -866,16 +1587,25 @@
866	1587	array( '# BEGIN Vigilante Security Headers', '# END Vigilante Security Headers' ),
867	1588	);
868	1589
869	1590	/**
	1591	+ * Whether the core is being compared with the English checksums because
	1592	+ * WordPress.org has none for the language of the site. Set by
	1593	+ * get_core_checksums().
	1594	+ *
	1595	+ * @var bool
	1596	+ */
	1597	+ private $core_checksums_are_english = false;
	1598	+
	1599	+ /**
870	1600	* Core files known to produce false positives in checksum comparison.
871		- * These are skipped during core scanning (e.g. version.php is rewritten
872		- * during auto-updates and localized installs, readme files vary by locale).
	1601	+ * These are skipped during core scanning: the readme and the license vary
	1602	+ * by locale and are not code. version.php used to be here too, and is now
	1603	+ * compared (see matches_core_of_other_locale()).
873	1604	*
874	1605	* @var array
875	1606	*/
876	1607	private $core_known_false_positives = array(
877		- 'wp-includes/version.php',
878	1608	'readme.html',
879	1609	'license.txt',
880	1610	'licencia.txt',
881	1611	);
		@@ -1012,9 +1742,9 @@
1012	1742	*/
1013	1743	public function init_cleanup_hooks() {
1014	1744	add_action( 'admin_init', array( $this, 'maybe_redact_stored_baseline' ) );
1015	1745	add_action( 'admin_init', array( $this, 'maybe_sweep_network_baselines' ) );
1016		- add_action( 'admin_init', array( $this, 'maybe_claim_owned_blocks' ) );
	1746	+ add_action( 'admin_init', array( $this, 'maybe_claim_owned_blocks_on_admin' ) );
1017	1747	}
1018	1748
1019	1749	/**
1020	1750	* Check if scan time limit has been exceeded
		@@ -1085,8 +1815,16 @@
1085	1815	$files = array( $hook_extra['plugin'] );
1086	1816	}
1087	1817	foreach ( $files as $file ) {
1088	1818	$slug = dirname( (string) $file );
	1819	+ // Vigilant itself is verified immediately (not after 90 s) by
	1820	+ // Vigilante_Self_Integrity::handle_upgrader() when the
	1821	+ // self-check is on; do not also open a grace window for it.
	1822	+ // Compared with the folder it really lives in, not the literal
	1823	+ // slug, so a renamed folder is skipped the same way.
	1824	+ if ( dirname( VIGILANTE_PLUGIN_BASENAME ) === $slug && Vigilante_Self_Integrity::is_on() ) {
	1825	+ continue;
	1826	+ }
1089	1827	if ( '.' !== $slug && '' !== $slug ) {
1090	1828	$targets['plugin'][] = $slug;
1091	1829	}
1092	1830	}
		@@ -1155,8 +1893,17 @@
1155	1893	*/
1156	1894	private function verify_updated_slug( $type, $slug ) {
1157	1895	$grace_key = 'vigilante_fi_grace_' . $type . '_' . md5( $slug );
1158	1896
	1897	+ // Defensive skip for the first 2.11.x -> 3.0.x update: the OLD code in
	1898	+ // memory scheduled this event including Vigilant's own slug, and by the
	1899	+ // time it fires the NEW code (this one) is running with the self-check
	1900	+ // handling Vigilant on its own.
	1901	+ if ( 'plugin' === $type && dirname( VIGILANTE_PLUGIN_BASENAME ) === $slug && Vigilante_Self_Integrity::is_on() ) {
	1902	+ delete_transient( $grace_key );
	1903	+ return;
	1904	+ }
	1905	+
1159	1906	if ( 'plugin' === $type ) {
1160	1907	if ( ! function_exists( 'get_plugins' ) ) {
1161	1908	require_once ABSPATH . 'wp-admin/includes/plugin.php';
1162	1909	}
		@@ -1307,8 +2054,56 @@
1307	2054
1308	2055	// Use settings from options page
1309	2056	$options = is_array( $this->options ) ? $this->options : array();
1310	2057
	2058	+ // Vigilant self-check runs FIRST and exempt from the time budget:
	2059	+ // ~60 small-file hashes cost < 50 ms and the guardian must never be
	2060	+ // dropped by the budget on plugin-heavy sites. User exclusions do not
	2061	+ // apply to it (see Vigilante_Self_Integrity::run_check()).
	2062	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	2063	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	2064	+ }
	2065	+ if ( Vigilante_Self_Integrity::is_on() ) {
	2066	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	2067	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	2068	+ }
	2069	+ $self = new Vigilante_Self_Integrity( $this->settings, $this->activity_log );
	2070	+ $self_result = $self->run_check( 'scan' );
	2071	+ // run_check() above updates this site's own state (status line and
	2072	+ // the analyzer check keep working everywhere). The plugin files are
	2073	+ // shared by the whole installation, so the self findings are folded
	2074	+ // Self-protection has its own alert, and it does not travel in the
	2075	+ // scan digest any more. That digest is governed by a notification
	2076	+ // setting that can be switched off, and switching off "tell me about
	2077	+ // changed files" was also switching off the alarm of the plugin
	2078	+ // itself. So the findings stay out of the scan results (they have
	2079	+ // their own block in File Integrity, with what each one means and how
	2080	+ // to repair it) and a critical one sends its own email from here,
	2081	+ // wherever the scan runs. maybe_send_self_alert() keeps it to the
	2082	+ // site that owns the shared files and dedupes by set of findings.
	2083	+ foreach ( (array) $self_result['findings'] as $self_finding ) {
	2084	+ if ( 'critical' === ( $self_finding['severity'] ?? '' ) ) {
	2085	+ $self->maybe_send_self_alert( $self_result['findings'], 'scan' );
	2086	+ break;
	2087	+ }
	2088	+ }
	2089	+ }
	2090	+
	2091	+ // What the time does not reach. A scan that runs out of time used to
	2092	+ // say only that it was partial, and it starts from the beginning
	2093	+ // every time, so on a large site the same plugins and themes were
	2094	+ // left out on every scan with nobody told which. They are named.
	2095	+ $not_checked = array(
	2096	+ 'areas' => array(),
	2097	+ 'plugins' => array(),
	2098	+ 'themes' => array(),
	2099	+ );
	2100	+
	2101	+ // And the folders of the plugins and themes it did check, which is
	2102	+ // what the tab offers to exclude so that a scan by hand reaches the
	2103	+ // rest (see folders_to_exclude()).
	2104	+ $checked_folders = array();
	2105	+
1311	2106	// Scan uploads for suspicious files FIRST (highest security priority)
1312	2107	// PHP files in uploads are almost always malware
1313	2108	if ( ! empty( $options['scan_uploads'] ) && ! $this->is_time_exceeded() ) {
1314	2109	$upload_results = $this->scan_uploads();
		@@ -1313,8 +2108,11 @@
1313	2108	if ( ! empty( $options['scan_uploads'] ) && ! $this->is_time_exceeded() ) {
1314	2109	$upload_results = $this->scan_uploads();
1315	2110	$results['suspicious'] = array_merge( $results['suspicious'], $upload_results['suspicious'] );
1316	2111	$results['extra'] = array_merge( $results['extra'], $upload_results['extra'] );
	2112	+ $results['errors'] = array_merge( $results['errors'], $upload_results['errors'] ?? array() );
	2113	+ } elseif ( ! empty( $options['scan_uploads'] ) ) {
	2114	+ $not_checked['areas'][] = 'uploads';
1317	2115	}
1318	2116
1319	2117	// Scan core files
1320	2118	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
		@@ -1319,8 +2117,10 @@
1319	2117	// Scan core files
1320	2118	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
1321	2119	$core_results = $this->scan_core_files();
1322	2120	$results = $this->merge_results( $results, $core_results );
	2121	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2122	+ $not_checked['areas'][] = 'core';
1323	2123	}
1324	2124
1325	2125	// Scan root directory for non-core files (PHP = suspicious, others = additional)
1326	2126	// Runs after core scan so checksums are already cached
		@@ -1327,20 +2127,61 @@
1327	2127	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
1328	2128	$root_results = $this->scan_root_files();
1329	2129	$results['suspicious'] = array_merge( $results['suspicious'], $root_results['suspicious'] );
1330	2130	$results['extra'] = array_merge( $results['extra'], $root_results['extra'] );
	2131	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2132	+ $not_checked['areas'][] = 'core';
1331	2133	}
1332	2134
	2135	+ // Files added to wp-admin or wp-includes, which the comparison with
	2136	+ // the checksums never visits because the checksums do not name them.
	2137	+ if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
	2138	+ $folder_results = $this->scan_core_folders();
	2139	+ $results['suspicious'] = array_merge( $results['suspicious'], $folder_results['suspicious'] );
	2140	+ $results['extra'] = array_merge( $results['extra'], $folder_results['extra'] );
	2141	+ $results['errors'] = array_merge( $results['errors'], $folder_results['errors'] );
	2142	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2143	+ $not_checked['areas'][] = 'core';
	2144	+ }
	2145	+
1333	2146	// Scan critical config files (wp-config.php, .htaccess) against stored baseline
1334	2147	if ( ! empty( $options['scan_critical_config'] ) && ! $this->is_time_exceeded() ) {
1335	2148	$critical_results = $this->scan_critical_root_files();
1336	2149	$results['modified'] = array_merge( $results['modified'], $critical_results );
	2150	+ } elseif ( ! empty( $options['scan_critical_config'] ) ) {
	2151	+ $not_checked['areas'][] = 'config';
1337	2152	}
1338	2153
	2154	+ // The other folders of wp-content (cache, languages, upgrade and
	2155	+ // whatever else is there), which belong to no plugin and no theme and
	2156	+ // had no turn. Before the plugins and the themes, which on a large
	2157	+ // site can use up the whole scan, and with a share of the time of
	2158	+ // their own, so a cache of a hundred thousand files cannot do the
	2159	+ // same to them.
	2160	+ $content_results = null;
	2161	+ if ( ! empty( $options['scan_plugins'] ) && ! $this->is_time_exceeded() ) {
	2162	+ $content_results = $this->scan_content_folders();
	2163	+ $results['suspicious'] = array_merge( $results['suspicious'], $content_results['suspicious'] );
	2164	+ $results['extra'] = array_merge( $results['extra'], $content_results['extra'] );
	2165	+ $results['errors'] = array_merge( $results['errors'], $content_results['errors'] );
	2166	+ } elseif ( ! empty( $options['scan_plugins'] ) ) {
	2167	+ $not_checked['areas'][] = 'content';
	2168	+ }
	2169	+
1339	2170	// Scan plugins
1340	2171	if ( ! empty( $options['scan_plugins'] ) && ! $this->is_time_exceeded() ) {
1341	2172	$plugin_results = $this->scan_plugins();
1342	2173	$results = $this->merge_results( $results, $plugin_results );
	2174	+
	2175	+ $not_checked['plugins'] = $plugin_results['not_checked'] ?? array();
	2176	+ $checked_folders = $plugin_results['checked'] ?? array();
	2177	+
	2178	+ if ( empty( $plugin_results['unlisted_checked'] ) ) {
	2179	+ $not_checked['areas'][] = 'unlisted';
	2180	+ }
	2181	+ } elseif ( ! empty( $options['scan_plugins'] ) ) {
	2182	+ $not_checked['areas'][] = 'plugins';
	2183	+ $not_checked['areas'][] = 'unlisted';
1343	2184	}
1344	2185
1345	2186	// Scan themes
1346	2187	if ( ! empty( $options['scan_themes'] ) && ! $this->is_time_exceeded() ) {
		@@ -1345,10 +2186,21 @@
1345	2186	// Scan themes
1346	2187	if ( ! empty( $options['scan_themes'] ) && ! $this->is_time_exceeded() ) {
1347	2188	$theme_results = $this->scan_themes();
1348	2189	$results = $this->merge_results( $results, $theme_results );
	2190	+
	2191	+ $not_checked['themes'] = $theme_results['not_checked'] ?? array();
	2192	+ $checked_folders = array_merge( $checked_folders, $theme_results['checked'] ?? array() );
	2193	+ } elseif ( ! empty( $options['scan_themes'] ) ) {
	2194	+ $not_checked['areas'][] = 'themes';
1349	2195	}
1350	2196
	2197	+ // What could only be searched for hidden code: plugins and themes
	2198	+ // first, as they are found, and the folders of wp-content after them.
	2199	+ if ( null !== $content_results ) {
	2200	+ $results['unverified'] = array_values( array_unique( array_merge( $results['unverified'] ?? array(), $content_results['unverified'] ) ) );
	2201	+ }
	2202	+
1351	2203	// Mark as incomplete if time was exceeded
1352	2204	if ( $this->is_time_exceeded() ) {
1353	2205	$results['incomplete'] = true;
1354	2206	$results['errors'][] = __( 'Scan was incomplete due to time limit. Results may be partial.', 'vigilante' );
		@@ -1353,8 +2205,19 @@
1353	2205	$results['incomplete'] = true;
1354	2206	$results['errors'][] = __( 'Scan was incomplete due to time limit. Results may be partial.', 'vigilante' );
1355	2207	}
1356	2208
	2209	+ // Stored after the last merge: merge_results() keeps only the keys it
	2210	+ // knows.
	2211	+ $not_checked['areas'] = array_values( array_unique( $not_checked['areas'] ) );
	2212	+ $results['not_checked'] = $not_checked;
	2213	+
	2214	+ // Only with plugins or themes left out: a scan that reached them all
	2215	+ // has nothing to make room for.
	2216	+ if ( ! empty( $not_checked['plugins'] ) || ! empty( $not_checked['themes'] ) || array_intersect( array( 'plugins', 'themes' ), $not_checked['areas'] ) ) {
	2217	+ $results['checked_folders'] = array_values( array_unique( $checked_folders ) );
	2218	+ }
	2219	+
1357	2220	// Filter out ignored files from all result categories
1358	2221	$results['modified'] = $this->filter_ignored( $results['modified'] );
1359	2222	$results['suspicious'] = $this->filter_ignored( $results['suspicious'] );
1360	2223	$results['extra'] = $this->filter_ignored( $results['extra'] );
		@@ -1365,14 +2228,21 @@
1365	2228	if ( $this->activity_log ) {
1366	2229	$has_issues = ! empty( $results['modified'] ) || ! empty( $results['suspicious'] ) || ! empty( $results['extra'] );
1367	2230	$severity = $has_issues ? 'warning' : 'info';
1368	2231
	2232	+ /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
	2233	+ $log_text = __( 'File integrity scan completed: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' );
	2234	+
	2235	+ if ( $results['incomplete'] ) {
	2236	+ /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
	2237	+ $log_text = __( 'File integrity scan ran out of time, so its result is partial: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' );
	2238	+ }
	2239	+
1369	2240	$this->activity_log->log(
1370	2241	'file',
1371	2242	'integrity_scan',
1372	2243	sprintf(
1373		- /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
1374		- __( 'File integrity scan completed: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' ),
	2244	+ $log_text,
1375	2245	$results['scanned'],
1376	2246	count( $results['modified'] ),
1377	2247	count( $results['suspicious'] ),
1378	2248	count( $results['extra'] )
		@@ -1427,9 +2297,10 @@
1427	2297	'errors' => array(),
1428	2298	);
1429	2299
1430	2300	// Get official checksums from WordPress.org
1431		- $checksums = $this->get_core_checksums();
	2301	+ $this->core_checksums_are_english = false;
	2302	+ $checksums = $this->get_core_checksums();
1432	2303
1433	2304	if ( is_wp_error( $checksums ) ) {
1434	2305	$results['errors'][] = $checksums->get_error_message();
1435	2306	return $results;
		@@ -1434,8 +2305,37 @@
1434	2305	$results['errors'][] = $checksums->get_error_message();
1435	2306	return $results;
1436	2307	}
1437	2308
	2309	+ // The plugins and themes that get a turn of their own in this scan.
	2310	+ $own_turn = array(
	2311	+ 'plugins' => array(),
	2312	+ 'themes' => array(),
	2313	+ );
	2314	+
	2315	+ if ( ! empty( $this->options['scan_plugins'] ) ) {
	2316	+ if ( ! function_exists( 'get_plugins' ) ) {
	2317	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	2318	+ }
	2319	+
	2320	+ foreach ( array_keys( get_plugins() ) as $plugin_file ) {
	2321	+ $slash = strpos( $plugin_file, '/' );
	2322	+
	2323	+ if ( false !== $slash ) {
	2324	+ $own_turn['plugins'][ substr( $plugin_file, 0, $slash ) ] = true;
	2325	+ }
	2326	+ }
	2327	+ }
	2328	+
	2329	+ if ( ! empty( $this->options['scan_themes'] ) ) {
	2330	+ foreach ( array_keys( wp_get_themes() ) as $stylesheet ) {
	2331	+ $stylesheet = (string) $stylesheet;
	2332	+ $slash = strpos( $stylesheet, '/' );
	2333	+
	2334	+ $own_turn['themes'][ false === $slash ? $stylesheet : substr( $stylesheet, 0, $slash ) ] = true;
	2335	+ }
	2336	+ }
	2337	+
1438	2338	foreach ( $checksums as $file => $expected_hash ) {
1439	2339	// Check time limit
1440	2340	if ( $this->is_time_exceeded() ) {
1441	2341	break;
		@@ -1452,9 +2352,9 @@
1452	2352	if ( $this->is_extension_excluded( $file_path ) ) {
1453	2353	continue;
1454	2354	}
1455	2355
1456		- // Skip known false positives (e.g. version.php, readme.html)
	2356	+ // Skip known false positives (e.g. readme.html, license.txt)
1457	2357	if ( in_array( $file, $this->core_known_false_positives, true ) ) {
1458	2358	continue;
1459	2359	}
1460	2360
		@@ -1469,8 +2369,30 @@
1469	2369	|| 0 === strpos( $file, 'wp-content/languages/themes/' ) ) {
1470	2370	continue;
1471	2371	}
1472	2372
	2373	+ // The bundled themes and plugins have their own turn. Akismet and
	2374	+ // the default themes are in this list at the version WordPress
	2375	+ // shipped, and they update on their own cycle: every one of those
	2376	+ // updates showed as a modified core file, and deleting one that is
	2377	+ // not in use as missing core files. The plugin and theme scans
	2378	+ // compare them with their own published copy, so they are left to
	2379	+ // those whenever those are on and have them in their list.
	2380	+ if ( preg_match( '#^wp-content/(plugins|themes)/([^/]+)/#', $file, $bundled ) ) {
	2381	+ // Deleted on purpose: nothing to compare and nothing missing.
	2382	+ if ( ! is_dir( ABSPATH . 'wp-content/' . $bundled[1] . '/' . $bundled[2] ) ) {
	2383	+ continue;
	2384	+ }
	2385	+
	2386	+ // Its own scan compares it, but only what WordPress lists as a
	2387	+ // plugin or as a theme gets that turn. A folder that is there
	2388	+ // and is not listed (a plugin without its header, a theme
	2389	+ // without its style.css) stays with the core.
	2390	+ if ( isset( $own_turn[ $bundled[1] ][ $bundled[2] ] ) ) {
	2391	+ continue;
	2392	+ }
	2393	+ }
	2394	+
1473	2395	$results['scanned']++;
1474	2396
1475	2397	if ( ! file_exists( $file_path ) ) {
1476	2398	$results['missing'][] = array(
		@@ -1481,9 +2403,22 @@
1481	2403	}
1482	2404
1483	2405	$actual_hash = md5_file( $file_path );
1484	2406
1485		- if ( $actual_hash !== $expected_hash ) {
	2407	+ if ( $actual_hash !== $expected_hash && ! $this->matches_core_of_other_locale( $file, $actual_hash ) ) {
	2408	+ // The two files a translated package changes cannot be told
	2409	+ // from a modified one while only the English list exists. Said
	2410	+ // as what it is, a file that could not be verified, instead of
	2411	+ // as a modified core file.
	2412	+ if ( $this->core_checksums_are_english && in_array( $file, array( 'wp-includes/version.php', 'wp-config-sample.php' ), true ) ) {
	2413	+ $results['errors'][] = sprintf(
	2414	+ /* translators: %s: File name */
	2415	+ __( '%s differs from the English package of WordPress, and WordPress.org has not published the checksums for the language of this site yet, so it could not be verified.', 'vigilante' ),
	2416	+ $file
	2417	+ );
	2418	+ continue;
	2419	+ }
	2420	+
1486	2421	$results['modified'][] = array(
1487	2422	'file' => $file,
1488	2423	'type' => 'core',
1489	2424	'expected_hash' => $expected_hash,
		@@ -1597,9 +2532,9 @@
1597	2532
1598	2533	// Also add wp-config.php which is not in checksums but is core
1599	2534	$core_root_files[] = 'wp-config.php';
1600	2535
1601		- $php_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar', 'phps' );
	2536	+ $php_extensions = self::php_extensions();
1602	2537
1603	2538	// Scan only direct children of ABSPATH (not recursive)
1604	2539	$root_path = untrailingslashit( ABSPATH );
1605	2540	$handle = opendir( $root_path );
		@@ -1617,9 +2552,22 @@
1617	2552	if ( '.' === $entry || '..' === $entry ) {
1618	2553	continue;
1619	2554	}
1620	2555
1621		- // Skip dotfiles (.htaccess, .user.ini, .env, etc.) — handled by firewall protection
	2556	+ // PHP reads .user.ini and php.ini from the folder of the script, and
	2557	+ // either can make it load a file before every request: the same
	2558	+ // door as .htaccess, for servers that run PHP outside Apache.
	2559	+ if ( in_array( strtolower( $entry ), array( '.user.ini', 'php.ini' ), true ) ) {
	2560	+ $config = $this->is_path_excluded( $root_path . '/' . $entry ) ? null : self::server_config_finding( $root_path . '/' . $entry, $entry );
	2561	+
	2562	+ if ( $config ) {
	2563	+ $config['item']['type'] = 'php_config_in_root';
	2564	+ $found['extra'][] = $config['item'];
	2565	+ }
	2566	+ continue;
	2567	+ }
	2568	+
	2569	+ // Skip dotfiles (.htaccess, .env, etc.): handled by firewall protection
1622	2570	if ( 0 === strpos( $entry, '.' ) ) {
1623	2571	continue;
1624	2572	}
1625	2573
		@@ -1644,8 +2592,13 @@
1644	2592	if ( in_array( strtolower( $entry ), $this->known_safe_root_files, true ) ) {
1645	2593	continue;
1646	2594	}
1647	2595
	2596	+ // Site verification files and sitemaps that are what their name says.
	2597	+ if ( self::is_harmless_root_file( $entry, $full_path ) ) {
	2598	+ continue;
	2599	+ }
	2600	+
1648	2601	$extension = strtolower( pathinfo( $entry, PATHINFO_EXTENSION ) );
1649	2602
1650	2603	if ( in_array( $extension, $php_extensions, true ) ) {
1651	2604	// Check if this is a legacy WordPress core file (removed from newer versions)
		@@ -1667,15 +2620,12 @@
1667	2620	// PHP file not in core = suspicious
1668	2621	$reason = __( 'Non-core PHP file in WordPress root directory', 'vigilante' );
1669	2622
1670	2623	// Scan content for specific patterns
1671		- if ( filesize( $full_path ) < 512000 ) {
1672		- $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
1673		- $pattern = $this->detect_suspicious_pattern( $content );
1674		- if ( $pattern ) {
1675		- /* translators: %s: Suspicious pattern found */
1676		- $reason = sprintf( __( 'Non-core PHP in root with suspicious code: %s', 'vigilante' ), $pattern );
1677		- }
	2624	+ $pattern = $this->search_file( $full_path );
	2625	+ if ( $pattern ) {
	2626	+ /* translators: %s: Suspicious pattern found */
	2627	+ $reason = sprintf( __( 'Non-core PHP in root with suspicious code: %s', 'vigilante' ), $pattern );
1678	2628	}
1679	2629
1680	2630	$found['suspicious'][] = array(
1681	2631	'file' => $entry,
		@@ -1682,8 +2632,20 @@
1682	2632	'type' => 'php_in_root',
1683	2633	'reason' => $reason,
1684	2634	);
1685	2635	} else {
	2636	+ // A copy of the configuration, a database dump or an archive
	2637	+ // is not one more loose file: whoever guesses its name can
	2638	+ // download it.
	2639	+ if ( false !== stripos( $entry, 'wp-config' ) || preg_match( '/\.(?:sql|bak|old|orig|save|swp|dump|zip|gz|tgz|tar|7z|rar)$/i', $entry ) ) {
	2640	+ $found['extra'][] = array(
	2641	+ 'file' => $entry,
	2642	+ 'type' => 'backup_in_root',
	2643	+ 'reason' => __( 'Backup or copy of a sensitive file in the site root, where it can be downloaded', 'vigilante' ),
	2644	+ );
	2645	+ continue;
	2646	+ }
	2647	+
1686	2648	// Non-PHP, non-known-safe file = additional (informational)
1687	2649	$found['extra'][] = array(
1688	2650	'file' => $entry,
1689	2651	'type' => 'extra_root',
		@@ -1696,8 +2658,864 @@
1696	2658
1697	2659	return $found;
1698	2660	}
1699	2661
	2662	+ /**
	2663	+ * The line of a .user.ini or php.ini that makes PHP load a file by itself
	2664	+ *
	2665	+ * @param string $path Absolute path of the file.
	2666	+ * @return string|null The line, an empty string when there is none, or
	2667	+ * null when the file is too large to be read, which
	2668	+ * the caller reports instead of taking for clean.
	2669	+ */
	2670	+ private static function php_ini_loads( $path ) {
	2671	+ // PHP runs as the same user: what it cannot read here it cannot apply.
	2672	+ if ( ! is_readable( $path ) ) {
	2673	+ return '';
	2674	+ }
	2675	+
	2676	+ if ( filesize( $path ) > MB_IN_BYTES ) {
	2677	+ return null;
	2678	+ }
	2679	+
	2680	+ $content = file_get_contents( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look at its directives; nothing is written.
	2681	+
	2682	+ foreach ( preg_split( '/\r\n|\r|\n/', (string) $content ) as $line ) {
	2683	+ $line = trim( $line );
	2684	+
	2685	+ if ( '' === $line || ';' === $line[0] || '#' === $line[0] ) {
	2686	+ continue;
	2687	+ }
	2688	+
	2689	+ if ( preg_match( '/^(auto_prepend_file|auto_append_file)\s*=\s*(.*)$/i', $line, $parts ) ) {
	2690	+ $value = trim( $parts[2], " \t\"'" );
	2691	+
	2692	+ if ( '' !== $value && 'none' !== strtolower( $value ) ) {
	2693	+ return strtolower( $parts[1] ) . ' = ' . substr( $value, 0, 200 );
	2694	+ }
	2695	+ }
	2696	+ }
	2697	+
	2698	+ return '';
	2699	+ }
	2700	+
	2701	+ /**
	2702	+ * What a .htaccess, .user.ini or php.ini outside uploads makes the server do
	2703	+ *
	2704	+ * Inside a plugin, a theme, wp-content or a WordPress folder, one of these
	2705	+ * files is a finding only when it makes the server run code or load a file.
	2706	+ * One that denies access, or does nothing of the kind, is left alone.
	2707	+ *
	2708	+ * @param string $file_path Absolute path.
	2709	+ * @param string $relative Path for display.
	2710	+ * @return array|null Array with 'category' and 'item', or null.
	2711	+ */
	2712	+ private static function server_config_finding( $file_path, $relative ) {
	2713	+ $item = array(
	2714	+ 'file' => $relative,
	2715	+ 'type' => 'server_config',
	2716	+ );
	2717	+
	2718	+ if ( '.htaccess' === strtolower( basename( $file_path ) ) ) {
	2719	+ if ( ! is_readable( $file_path ) ) {
	2720	+ return null;
	2721	+ }
	2722	+
	2723	+ if ( filesize( $file_path ) >= 65536 ) {
	2724	+ $item['reason'] = __( '.htaccess file that is too large to be read', 'vigilante' );
	2725	+
	2726	+ return array(
	2727	+ 'category' => 'extra',
	2728	+ 'item' => $item,
	2729	+ );
	2730	+ }
	2731	+
	2732	+ $facts = self::read_htaccess_rules( file_get_contents( $file_path ) ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look at its directives; nothing is written.
	2733	+
	2734	+ if ( empty( $facts['runs'] ) ) {
	2735	+ return null;
	2736	+ }
	2737	+
	2738	+ $item['reason'] = self::htaccess_run_reason( $facts );
	2739	+
	2740	+ return array(
	2741	+ 'category' => 'suspicious',
	2742	+ 'item' => $item,
	2743	+ );
	2744	+ }
	2745	+
	2746	+ $loads = self::php_ini_loads( $file_path );
	2747	+
	2748	+ if ( '' === $loads ) {
	2749	+ return null;
	2750	+ }
	2751	+
	2752	+ $item['reason'] = null === $loads
	2753	+ ? __( 'PHP configuration file that is too large to be read', 'vigilante' )
	2754	+ /* translators: %s: The line of the file that does it */
	2755	+ : sprintf( __( 'PHP configuration file that loads a file on every request: %s', 'vigilante' ), $loads );
	2756	+
	2757	+ return array(
	2758	+ 'category' => 'extra',
	2759	+ 'item' => $item,
	2760	+ );
	2761	+ }
	2762	+
	2763	+ /**
	2764	+ * Whether a loose file in the site root is a verification file or a sitemap
	2765	+ *
	2766	+ * By what it contains or by its kind, never by its name alone: a Google
	2767	+ * verification file is one line that repeats its own name, and a sitemap
	2768	+ * is XML, which no server runs.
	2769	+ *
	2770	+ * @param string $entry File name.
	2771	+ * @param string $full_path Absolute path.
	2772	+ * @return bool
	2773	+ */
	2774	+ private static function is_harmless_root_file( $entry, $full_path ) {
	2775	+ if ( preg_match( '/^[a-z0-9_-]*sitemap[a-z0-9_-]*\.xml(?:\.gz)?$/i', $entry ) ) {
	2776	+ return true;
	2777	+ }
	2778	+
	2779	+ if ( preg_match( '/^google[0-9a-f]{16}\.html$/', $entry ) && is_readable( $full_path ) && filesize( $full_path ) < 200 ) {
	2780	+ $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to compare it with its own name; nothing is written.
	2781	+
	2782	+ return 'google-site-verification: ' . $entry === trim( (string) $content );
	2783	+ }
	2784	+
	2785	+ return false;
	2786	+ }
	2787	+
	2788	+ /**
	2789	+ * Walk a folder and everything under it without stopping at what cannot be read
	2790	+ *
	2791	+ * A folder PHP cannot open used to end the whole walk in silence, which is
	2792	+ * all it took to blind a scan: one unreadable folder early in the order,
	2793	+ * and nothing after it was looked at. Now the walk goes past it, and the
	2794	+ * caller reports it (see unreadable_folder_error()).
	2795	+ *
	2796	+ * @param string $directory Folder to walk.
	2797	+ * @param callable|null $skip Given the path of a folder, whether to leave
	2798	+ * it and everything under it out of the walk.
	2799	+ * @return RecursiveIteratorIterator Folders included: the caller skips them.
	2800	+ */
	2801	+ private static function walk_folder( $directory, $skip = null ) {
	2802	+ $folder = new RecursiveDirectoryIterator( $directory, RecursiveDirectoryIterator::SKIP_DOTS );
	2803	+
	2804	+ if ( null !== $skip ) {
	2805	+ $folder = new RecursiveCallbackFilterIterator(
	2806	+ $folder,
	2807	+ static function ( $current ) use ( $skip ) {
	2808	+ return ! ( $current->isDir() && call_user_func( $skip, $current->getPathname() ) );
	2809	+ }
	2810	+ );
	2811	+ }
	2812	+
	2813	+ return new RecursiveIteratorIterator(
	2814	+ $folder,
	2815	+ RecursiveIteratorIterator::SELF_FIRST,
	2816	+ RecursiveIteratorIterator::CATCH_GET_CHILD
	2817	+ );
	2818	+ }
	2819	+
	2820	+ /**
	2821	+ * What the scan says about a folder it could not read
	2822	+ *
	2823	+ * @param string $path Absolute path of the folder.
	2824	+ * @return string
	2825	+ */
	2826	+ private static function unreadable_folder_error( $path ) {
	2827	+ return sprintf(
	2828	+ /* translators: %s: Folder path */
	2829	+ __( 'The folder %s could not be read, so what is inside it was not checked.', 'vigilante' ),
	2830	+ str_replace( ABSPATH, '', $path )
	2831	+ );
	2832	+ }
	2833	+
	2834	+ /**
	2835	+ * Extensions a server may be set up to run as PHP
	2836	+ *
	2837	+ * One list for uploads, the site root, the core folders and the plugin and
	2838	+ * theme folders. Each had its own until now, and none had them all.
	2839	+ *
	2840	+ * @return array
	2841	+ */
	2842	+ private static function php_extensions() {
	2843	+ return array( 'php', 'php2', 'php3', 'php4', 'php5', 'php6', 'php7', 'php8', 'phtml', 'pht', 'phar', 'phps', 'inc' );
	2844	+ }
	2845	+
	2846	+ /**
	2847	+ * Look in wp-admin and wp-includes for files WordPress does not ship
	2848	+ *
	2849	+ * The comparison with the official checksums only visits the files the
	2850	+ * checksums name, so a file added to either folder was never looked at. A
	2851	+ * PHP file there that is not part of the installed version is reported as
	2852	+ * suspicious. A file that changes how the server runs code (.htaccess,
	2853	+ * .user.ini, php.ini) is reported as extra, or as suspicious when it
	2854	+ * makes the server run code. Anything else that is not code, such as an
	2855	+ * error log the host writes there, is left alone.
	2856	+ *
	2857	+ * @return array Array with 'suspicious', 'extra' and 'errors' sub-arrays.
	2858	+ */
	2859	+ private function scan_core_folders() {
	2860	+ $found = array(
	2861	+ 'suspicious' => array(),
	2862	+ 'extra' => array(),
	2863	+ 'errors' => array(),
	2864	+ );
	2865	+
	2866	+ $checksums = $this->get_core_checksums();
	2867	+ if ( is_wp_error( $checksums ) ) {
	2868	+ return $found;
	2869	+ }
	2870	+
	2871	+ $php_extensions = self::php_extensions();
	2872	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	2873	+
	2874	+ foreach ( array( 'wp-admin', 'wp-includes' ) as $folder ) {
	2875	+ $directory = ABSPATH . $folder;
	2876	+
	2877	+ if ( ! is_dir( $directory ) ) {
	2878	+ continue;
	2879	+ }
	2880	+
	2881	+ try {
	2882	+ foreach ( self::walk_folder( $directory ) as $file ) {
	2883	+ if ( $this->is_time_exceeded() ) {
	2884	+ break 2;
	2885	+ }
	2886	+
	2887	+ $file_path = $file->getPathname();
	2888	+
	2889	+ if ( $file->isDir() ) {
	2890	+ if ( ! $file->isReadable() ) {
	2891	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	2892	+ }
	2893	+ continue;
	2894	+ }
	2895	+
	2896	+ $relative = $this->normalize_rel_path( str_replace( '\\', '/', str_replace( ABSPATH, '', $file_path ) ) );
	2897	+
	2898	+ if ( isset( $checksums[ $relative ] ) || $this->is_path_excluded( $file_path ) ) {
	2899	+ continue;
	2900	+ }
	2901	+
	2902	+ $extension = strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) );
	2903	+
	2904	+ if ( in_array( $extension, $php_extensions, true ) ) {
	2905	+ // The placeholder some hosts and tools drop in every folder.
	2906	+ if ( $this->is_silence_golden_file( $file_path ) ) {
	2907	+ continue;
	2908	+ }
	2909	+
	2910	+ // Translation files, on the installations old enough
	2911	+ // to keep them in wp-includes/languages: text and
	2912	+ // nothing else, which is checked and not assumed.
	2913	+ if ( self::is_inside_languages( $file_path ) && true === $this->is_literal_data( $file_path ) ) {
	2914	+ continue;
	2915	+ }
	2916	+
	2917	+ /* translators: %s: Folder name, wp-admin or wp-includes */
	2918	+ $reason = sprintf( __( 'File in %s that is not part of the installed WordPress version', 'vigilante' ), $folder );
	2919	+
	2920	+ $pattern = $this->search_file( $file_path );
	2921	+ if ( $pattern ) {
	2922	+ /* translators: 1: Folder name, wp-admin or wp-includes, 2: Suspicious pattern found */
	2923	+ $reason = sprintf( __( 'File in %1$s that is not part of WordPress, with suspicious code: %2$s', 'vigilante' ), $folder, $pattern );
	2924	+ }
	2925	+
	2926	+ $found['suspicious'][] = array(
	2927	+ 'file' => $relative,
	2928	+ 'type' => 'php_in_core',
	2929	+ 'reason' => $reason,
	2930	+ );
	2931	+ } elseif ( in_array( strtolower( basename( $file_path ) ), $config_files, true ) ) {
	2932	+ $config = self::server_config_finding( $file_path, $relative );
	2933	+
	2934	+ if ( $config && 'suspicious' === $config['category'] ) {
	2935	+ $found['suspicious'][] = $config['item'];
	2936	+ continue;
	2937	+ }
	2938	+
	2939	+ $found['extra'][] = array(
	2940	+ 'file' => $relative,
	2941	+ 'type' => 'config_in_core',
	2942	+ /* translators: %s: Folder name, wp-admin or wp-includes */
	2943	+ 'reason' => $config ? $config['item']['reason'] : sprintf( __( 'Server configuration file in %s', 'vigilante' ), $folder ),
	2944	+ );
	2945	+ }
	2946	+ }
	2947	+ } catch ( Exception $e ) {
	2948	+ $found['errors'][] = self::unreadable_folder_error( $directory );
	2949	+ }
	2950	+ }
	2951	+
	2952	+ return $found;
	2953	+ }
	2954	+
	2955	+ /**
	2956	+ * Look for code where there is no official copy to compare with
	2957	+ *
	2958	+ * Must-use plugins, drop-ins, the loose PHP files of wp-content, of the
	2959	+ * plugins folder and of the themes folder, and the folders in those two
	2960	+ * that WordPress does not list as a plugin or as a theme, were not opened
	2961	+ * by any part of the scan, although WordPress loads some of them on every
	2962	+ * request and the rest can be reached by their address. They are searched
	2963	+ * the way a plugin from outside WordPress.org is, for code written the way
	2964	+ * malware hides itself. A loose PHP file or a folder with PHP that is
	2965	+ * neither a plugin, a theme nor a drop-in is listed as extra, and so is a
	2966	+ * .htaccess, .user.ini or php.ini there that makes the server run code or
	2967	+ * load a file.
	2968	+ *
	2969	+ * @return array Array with 'suspicious', 'extra', 'unverified' and 'errors' sub-arrays.
	2970	+ */
	2971	+ private function scan_unlisted_code() {
	2972	+ $found = array(
	2973	+ 'suspicious' => array(),
	2974	+ 'extra' => array(),
	2975	+ 'unverified' => array(),
	2976	+ 'errors' => array(),
	2977	+ );
	2978	+
	2979	+ // Must-use plugins: the whole folder.
	2980	+ if ( defined( 'WPMU_PLUGIN_DIR' ) && is_dir( WPMU_PLUGIN_DIR ) ) {
	2981	+ $mu = $this->detect_extra_files( WPMU_PLUGIN_DIR, array(), 'plugin', __( 'Must-use plugins', 'vigilante' ), true );
	2982	+
	2983	+ $found['suspicious'] = array_merge( $found['suspicious'], $mu['suspicious'] );
	2984	+ $found['extra'] = array_merge( $found['extra'], $mu['extra'] );
	2985	+ $found['errors'] = array_merge( $found['errors'], $mu['errors'] );
	2986	+
	2987	+ if ( $mu['php_files'] > 0 ) {
	2988	+ $found['unverified'][] = __( 'Must-use plugins', 'vigilante' );
	2989	+ }
	2990	+ }
	2991	+
	2992	+ if ( ! function_exists( '_get_dropins' ) || ! function_exists( 'get_plugins' ) ) {
	2993	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	2994	+ }
	2995	+
	2996	+ $php_extensions = self::php_extensions();
	2997	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	2998	+ $dropins = array_keys( _get_dropins() );
	2999	+
	3000	+ // What WordPress lists as a plugin or as a theme, by the file or the
	3001	+ // folder it lives in.
	3002	+ $single_plugins = array();
	3003	+ $plugin_folders = array();
	3004	+ foreach ( get_plugins() as $plugin_file => $plugin_data ) {
	3005	+ if ( false === strpos( $plugin_file, '/' ) ) {
	3006	+ $single_plugins[ $plugin_file ] = $plugin_data['Name'] ?? $plugin_file;
	3007	+ } else {
	3008	+ $plugin_folders[ substr( $plugin_file, 0, strpos( $plugin_file, '/' ) ) ] = true;
	3009	+ }
	3010	+ }
	3011	+
	3012	+ // The themes by where they really are, because there can be more
	3013	+ // than one folder of themes and the same name in two of them.
	3014	+ $theme_folders = array();
	3015	+ foreach ( wp_get_themes() as $stylesheet => $theme ) {
	3016	+ $stylesheet = (string) $stylesheet;
	3017	+ $slash = strpos( $stylesheet, '/' );
	3018	+ $real = realpath( untrailingslashit( $theme->get_theme_root() ) . '/' . ( false === $slash ? $stylesheet : substr( $stylesheet, 0, $slash ) ) );
	3019	+
	3020	+ if ( false !== $real ) {
	3021	+ $theme_folders[ wp_normalize_path( $real ) ] = true;
	3022	+ }
	3023	+ }
	3024	+
	3025	+ $roots = array(
	3026	+ array( 'content', WP_CONTENT_DIR ),
	3027	+ array( 'plugins', WP_PLUGIN_DIR ),
	3028	+ );
	3029	+
	3030	+ // Every folder themes are registered in, not only the usual one. One
	3031	+ // that is inside a plugin belongs to that plugin, and has its turn
	3032	+ // with it.
	3033	+ global $wp_theme_directories;
	3034	+
	3035	+ $plugin_roots = array();
	3036	+ foreach ( array( WP_PLUGIN_DIR, defined( 'WPMU_PLUGIN_DIR' ) ? WPMU_PLUGIN_DIR : '' ) as $plugin_root ) {
	3037	+ $real = '' === (string) $plugin_root ? false : realpath( $plugin_root );
	3038	+
	3039	+ if ( false !== $real ) {
	3040	+ $plugin_roots[ wp_normalize_path( $real ) ] = true;
	3041	+ }
	3042	+ }
	3043	+
	3044	+ $theme_roots = array();
	3045	+ foreach ( array_merge( array( get_theme_root() ), is_array( $wp_theme_directories ) ? $wp_theme_directories : array() ) as $theme_root ) {
	3046	+ $real = '' === (string) $theme_root ? false : realpath( $theme_root );
	3047	+ $real = false === $real ? '' : wp_normalize_path( $real );
	3048	+
	3049	+ if ( '' === $real || isset( $theme_roots[ $real ] ) || self::is_inside_any( $real, $plugin_roots ) ) {
	3050	+ continue;
	3051	+ }
	3052	+
	3053	+ $theme_roots[ $real ] = true;
	3054	+ $roots[] = array( 'themes', untrailingslashit( $theme_root ) );
	3055	+ }
	3056	+
	3057	+ foreach ( $roots as $root ) {
	3058	+ list( $kind, $directory ) = $root;
	3059	+
	3060	+ $entries = is_dir( $directory ) ? scandir( $directory ) : false;
	3061	+
	3062	+ if ( ! is_array( $entries ) ) {
	3063	+ continue;
	3064	+ }
	3065	+
	3066	+ foreach ( $entries as $entry ) {
	3067	+ if ( '.' === $entry || '..' === $entry ) {
	3068	+ continue;
	3069	+ }
	3070	+
	3071	+ if ( $this->is_time_exceeded() ) {
	3072	+ break 2;
	3073	+ }
	3074	+
	3075	+ $path = $directory . '/' . $entry;
	3076	+
	3077	+ if ( $this->is_path_excluded( $path ) ) {
	3078	+ continue;
	3079	+ }
	3080	+
	3081	+ $relative = str_replace( ABSPATH, '', $path );
	3082	+
	3083	+ // A folder among the plugins or the themes that WordPress does
	3084	+ // not list as one: no scan had a turn for it.
	3085	+ if ( is_dir( $path ) ) {
	3086	+ $real = realpath( $path );
	3087	+ $listed = 'plugins' === $kind ? isset( $plugin_folders[ $entry ] ) : ( 'themes' === $kind ? ( false !== $real && isset( $theme_folders[ wp_normalize_path( $real ) ] ) ) : true );
	3088	+
	3089	+ // A link is followed like any other folder, because what
	3090	+ // is behind it is reached by its address just the same,
	3091	+ // unless it leads back to wp-content or above it, which
	3092	+ // would be walking the site a second time.
	3093	+ if ( $listed || ( is_link( $path ) && self::leads_back( $path ) ) ) {
	3094	+ continue;
	3095	+ }
	3096	+
	3097	+ $inside = $this->detect_extra_files( $path, array(), 'themes' === $kind ? 'theme' : 'plugin', $entry, true );
	3098	+
	3099	+ $found['suspicious'] = array_merge( $found['suspicious'], $inside['suspicious'] );
	3100	+ $found['extra'] = array_merge( $found['extra'], $inside['extra'] );
	3101	+ $found['errors'] = array_merge( $found['errors'], $inside['errors'] );
	3102	+
	3103	+ if ( $inside['php_files'] > 0 ) {
	3104	+ $found['extra'][] = array(
	3105	+ 'file' => $relative,
	3106	+ 'type' => 'php_in_content',
	3107	+ 'reason' => 'themes' === $kind
	3108	+ ? __( 'Folder with PHP files that WordPress does not list as a theme', 'vigilante' )
	3109	+ : __( 'Folder with PHP files that WordPress does not list as a plugin', 'vigilante' ),
	3110	+ );
	3111	+ }
	3112	+ continue;
	3113	+ }
	3114	+
	3115	+ if ( in_array( strtolower( $entry ), $config_files, true ) ) {
	3116	+ $config = self::server_config_finding( $path, $relative );
	3117	+
	3118	+ if ( $config ) {
	3119	+ $found[ $config['category'] ][] = $config['item'];
	3120	+ }
	3121	+ continue;
	3122	+ }
	3123	+
	3124	+ $extension = strtolower( pathinfo( $entry, PATHINFO_EXTENSION ) );
	3125	+
	3126	+ if ( ! in_array( $extension, $php_extensions, true ) || $this->is_silence_golden_file( $path ) ) {
	3127	+ continue;
	3128	+ }
	3129	+
	3130	+ // hello.php comes with WordPress and is compared with it.
	3131	+ if ( 'plugins' === $kind && 'hello.php' === $entry ) {
	3132	+ continue;
	3133	+ }
	3134	+
	3135	+ $pattern = $this->search_file( $path, true );
	3136	+
	3137	+ $known = ( 'plugins' === $kind && isset( $single_plugins[ $entry ] ) ) || ( 'content' === $kind && in_array( $entry, $dropins, true ) );
	3138	+
	3139	+ if ( $known ) {
	3140	+ $found['unverified'][] = 'plugins' === $kind ? $single_plugins[ $entry ] : __( 'Drop-ins', 'vigilante' );
	3141	+ }
	3142	+
	3143	+ if ( $pattern ) {
	3144	+ $found['suspicious'][] = array(
	3145	+ 'file' => $relative,
	3146	+ 'type' => 'suspicious_plugin',
	3147	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	3148	+ 'reason' => sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), dirname( $relative ), $pattern ),
	3149	+ );
	3150	+ } elseif ( ! $known ) {
	3151	+ $found['extra'][] = array(
	3152	+ 'file' => $relative,
	3153	+ 'type' => 'php_in_content',
	3154	+ 'reason' => __( 'PHP file that is not a plugin, a theme or a WordPress drop-in', 'vigilante' ),
	3155	+ );
	3156	+ } elseif ( null === $pattern ) {
	3157	+ $found['extra'][] = $this->not_searched_item( $path, $relative );
	3158	+ }
	3159	+ }
	3160	+ }
	3161	+
	3162	+ $found['unverified'] = array_values( array_unique( $found['unverified'] ) );
	3163	+
	3164	+ return $found;
	3165	+ }
	3166	+
	3167	+ /**
	3168	+ * Look in the folders of wp-content that belong to no plugin and no theme
	3169	+ *
	3170	+ * cache, languages, upgrade and whatever else is there were not opened by
	3171	+ * any part of the scan, and a PHP file in any of them can be reached by
	3172	+ * its address like one anywhere else. Every PHP file in them is searched
	3173	+ * for hidden code, the way a plugin from outside WordPress.org is, and a
	3174	+ * .htaccess, .user.ini or php.ini is reported when it makes the server run
	3175	+ * code or load a file. A folder with PHP files that could only be
	3176	+ * searched is named among what has no official copy.
	3177	+ *
	3178	+ * Translation files are the exception, because what they must hold is
	3179	+ * known: text. WordPress loads the .l10n.php files of the site language
	3180	+ * with include on every request
	3181	+ * (wp-includes/l10n/class-wp-translation-file-php.php:24), so one that
	3182	+ * holds anything else is reported whatever the code looks like, and any
	3183	+ * other PHP file among the translations is listed. A PHP file that holds
	3184	+ * literal data and nothing else cannot run anything, and is left alone
	3185	+ * wherever it is (see is_literal_data()).
	3186	+ *
	3187	+ * Plugins, themes, must-use plugins and uploads have their own scans and
	3188	+ * are skipped here. The folders whose name says cache go last, and the
	3189	+ * whole walk has a share of the scan time of its own, so a cache with a
	3190	+ * hundred thousand files costs that share and no more.
	3191	+ *
	3192	+ * @return array Array with 'suspicious', 'extra', 'unverified' and 'errors' sub-arrays.
	3193	+ */
	3194	+ private function scan_content_folders() {
	3195	+ $found = array(
	3196	+ 'suspicious' => array(),
	3197	+ 'extra' => array(),
	3198	+ 'unverified' => array(),
	3199	+ 'errors' => array(),
	3200	+ );
	3201	+
	3202	+ $entries = is_dir( WP_CONTENT_DIR ) ? scandir( WP_CONTENT_DIR ) : false;
	3203	+
	3204	+ if ( ! is_array( $entries ) ) {
	3205	+ return $found;
	3206	+ }
	3207	+
	3208	+ // The folders with a scan of their own, by where they really are.
	3209	+ global $wp_theme_directories;
	3210	+
	3211	+ $uploads = wp_get_upload_dir();
	3212	+ $uploads_real = empty( $uploads['basedir'] ) ? false : realpath( $uploads['basedir'] );
	3213	+ $uploads_real = false === $uploads_real ? '' : wp_normalize_path( $uploads_real );
	3214	+ $own = array();
	3215	+ $roots = array_merge(
	3216	+ array( WP_PLUGIN_DIR, defined( 'WPMU_PLUGIN_DIR' ) ? WPMU_PLUGIN_DIR : '', get_theme_root() ),
	3217	+ is_array( $wp_theme_directories ) ? $wp_theme_directories : array()
	3218	+ );
	3219	+
	3220	+ foreach ( $roots as $root ) {
	3221	+ $real = '' === (string) $root ? false : realpath( $root );
	3222	+
	3223	+ if ( false !== $real ) {
	3224	+ $own[ wp_normalize_path( $real ) ] = true;
	3225	+ }
	3226	+ }
	3227	+
	3228	+ if ( '' !== $uploads_real ) {
	3229	+ $own[ $uploads_real ] = true;
	3230	+ }
	3231	+
	3232	+ // On a site of a network that is not the main one, the uploads of the
	3233	+ // site live inside the uploads of the network, which are the main
	3234	+ // site's turn.
	3235	+ $network_uploads = is_multisite() && ! is_main_site() ? $uploads_real : '';
	3236	+
	3237	+ $folders = array();
	3238	+
	3239	+ foreach ( $entries as $entry ) {
	3240	+ $path = WP_CONTENT_DIR . '/' . $entry;
	3241	+
	3242	+ if ( '.' === $entry || '..' === $entry || ! is_dir( $path ) ) {
	3243	+ continue;
	3244	+ }
	3245	+
	3246	+ $real = realpath( $path );
	3247	+ $real = false === $real ? '' : wp_normalize_path( $real );
	3248	+
	3249	+ // A folder with a scan of its own, or a link into one. A link to
	3250	+ // anywhere else is walked like the folder it stands for: deploy
	3251	+ // tools keep languages or a cache behind one, and what is there
	3252	+ // is reached by its address all the same.
	3253	+ if ( '' === $real || self::is_inside_any( $real, $own ) || ( is_link( $path ) && self::leads_back( $path ) ) ) {
	3254	+ continue;
	3255	+ }
	3256	+
	3257	+ if ( '' !== $network_uploads && 0 === strpos( $network_uploads, $real . '/' ) ) {
	3258	+ continue;
	3259	+ }
	3260	+
	3261	+ if ( $this->is_path_excluded( $path . '/.' ) ) {
	3262	+ continue;
	3263	+ }
	3264	+
	3265	+ $folders[] = $entry;
	3266	+ }
	3267	+
	3268	+ usort(
	3269	+ $folders,
	3270	+ static function ( $a, $b ) {
	3271	+ $a_cache = false !== stripos( $a, 'cache' );
	3272	+ $b_cache = false !== stripos( $b, 'cache' );
	3273	+
	3274	+ return $a_cache === $b_cache ? strcmp( $a, $b ) : ( $a_cache ? 1 : -1 );
	3275	+ }
	3276	+ );
	3277	+
	3278	+ $php_extensions = self::php_extensions();
	3279	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	3280	+ $deadline = microtime( true ) + $this->content_folders_time;
	3281	+
	3282	+ // A folder with a scan of its own nested further down, or one the
	3283	+ // user left out, is not walked at all.
	3284	+ $skip = function ( $folder ) use ( $own ) {
	3285	+ $real = realpath( $folder );
	3286	+
	3287	+ return ( false !== $real && isset( $own[ wp_normalize_path( $real ) ] ) ) || $this->is_path_excluded( $folder . '/.' );
	3288	+ };
	3289	+
	3290	+ foreach ( $folders as $entry ) {
	3291	+ $path = WP_CONTENT_DIR . '/' . $entry;
	3292	+ $php_files = 0;
	3293	+
	3294	+ try {
	3295	+ foreach ( self::walk_folder( $path, $skip ) as $file ) {
	3296	+ if ( $this->is_time_exceeded() ) {
	3297	+ break 2;
	3298	+ }
	3299	+
	3300	+ if ( microtime( true ) > $deadline ) {
	3301	+ $found['errors'][] = sprintf(
	3302	+ /* translators: %s: Folder path */
	3303	+ __( 'The folders of wp-content outside plugins, themes and uploads were not checked completely: the time for them ran out in %s. If that folder only holds files that change all the time, such as a cache, add it to Excluded Paths.', 'vigilante' ),
	3304	+ str_replace( ABSPATH, '', $path )
	3305	+ );
	3306	+ break 2;
	3307	+ }
	3308	+
	3309	+ $file_path = $file->getPathname();
	3310	+
	3311	+ if ( $file->isDir() ) {
	3312	+ if ( ! $file->isReadable() ) {
	3313	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	3314	+ }
	3315	+ continue;
	3316	+ }
	3317	+
	3318	+ $basename = strtolower( basename( $file_path ) );
	3319	+
	3320	+ if ( in_array( $basename, $config_files, true ) ) {
	3321	+ $config = $this->is_path_excluded( $file_path ) ? null : self::server_config_finding( $file_path, str_replace( ABSPATH, '', $file_path ) );
	3322	+
	3323	+ if ( $config ) {
	3324	+ $found[ $config['category'] ][] = $config['item'];
	3325	+ }
	3326	+ continue;
	3327	+ }
	3328	+
	3329	+ if ( ! in_array( strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) ), $php_extensions, true ) ) {
	3330	+ continue;
	3331	+ }
	3332	+
	3333	+ if ( $this->is_path_excluded( $file_path ) || $this->is_silence_golden_file( $file_path ) ) {
	3334	+ continue;
	3335	+ }
	3336	+
	3337	+ $literal = $this->is_literal_data( $file_path );
	3338	+
	3339	+ if ( true === $literal ) {
	3340	+ continue;
	3341	+ }
	3342	+
	3343	+ $relative = str_replace( ABSPATH, '', $file_path );
	3344	+
	3345	+ if ( false === $literal && '.l10n.php' === substr( $basename, -9 ) ) {
	3346	+ // Reported whatever the search finds, like a PHP file
	3347	+ // in uploads: WordPress loads it on every request, and
	3348	+ // no tool writes anything but the table of texts in
	3349	+ // it. What the search finds is said next to it.
	3350	+ $pattern = $this->search_file( $file_path, true );
	3351	+ $reason = __( 'Translation file that holds something other than translations', 'vigilante' );
	3352	+
	3353	+ if ( $pattern ) {
	3354	+ /* translators: %s: Suspicious pattern found */
	3355	+ $reason = sprintf( __( 'Translation file with suspicious code: %s', 'vigilante' ), $pattern );
	3356	+ }
	3357	+
	3358	+ $found['suspicious'][] = array(
	3359	+ 'file' => $relative,
	3360	+ 'type' => 'translation_with_code',
	3361	+ 'reason' => $reason,
	3362	+ );
	3363	+ continue;
	3364	+ }
	3365	+
	3366	+ $pattern = $this->search_file( $file_path, true );
	3367	+
	3368	+ if ( $pattern ) {
	3369	+ $found['suspicious'][] = array(
	3370	+ 'file' => $relative,
	3371	+ 'type' => 'suspicious_content',
	3372	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	3373	+ 'reason' => sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), str_replace( ABSPATH, '', $path ), $pattern ),
	3374	+ );
	3375	+ } elseif ( null === $pattern ) {
	3376	+ $found['extra'][] = $this->not_searched_item( $file_path, $relative );
	3377	+ } elseif ( self::is_inside_languages( $file_path ) ) {
	3378	+ $found['extra'][] = array(
	3379	+ 'file' => $relative,
	3380	+ 'type' => 'php_in_content',
	3381	+ 'reason' => __( 'PHP file among the translations that is not a translation file', 'vigilante' ),
	3382	+ );
	3383	+ } else {
	3384	+ $php_files++;
	3385	+ }
	3386	+ }
	3387	+ } catch ( Exception $e ) {
	3388	+ $found['errors'][] = self::unreadable_folder_error( $path );
	3389	+ }
	3390	+
	3391	+ if ( $php_files > 0 ) {
	3392	+ $found['unverified'][] = str_replace( ABSPATH, '', $path );
	3393	+ }
	3394	+ }
	3395	+
	3396	+ return $found;
	3397	+ }
	3398	+
	3399	+ /**
	3400	+ * Whether a real path is one of a set of folders or lies inside one of them
	3401	+ *
	3402	+ * @param string $real Real path, with forward slashes.
	3403	+ * @param array $folders Real paths with forward slashes, as keys.
	3404	+ * @return bool
	3405	+ */
	3406	+ private static function is_inside_any( $real, $folders ) {
	3407	+ foreach ( array_keys( $folders ) as $folder ) {
	3408	+ if ( $real === $folder || 0 === strpos( $real, $folder . '/' ) ) {
	3409	+ return true;
	3410	+ }
	3411	+ }
	3412	+
	3413	+ return false;
	3414	+ }
	3415	+
	3416	+ /**
	3417	+ * Whether a link leads to wp-content itself or to a folder above it
	3418	+ *
	3419	+ * @param string $path Path of the link.
	3420	+ * @return bool True also when where it leads cannot be worked out.
	3421	+ */
	3422	+ private static function leads_back( $path ) {
	3423	+ $real = realpath( $path );
	3424	+ $content = realpath( WP_CONTENT_DIR );
	3425	+
	3426	+ if ( false === $real || false === $content ) {
	3427	+ return true;
	3428	+ }
	3429	+
	3430	+ return 0 === strpos( wp_normalize_path( $content ) . '/', wp_normalize_path( $real ) . '/' );
	3431	+ }
	3432	+
	3433	+ /**
	3434	+ * Whether a path is inside the folder WordPress keeps its translations in
	3435	+ *
	3436	+ * @param string $path Absolute path.
	3437	+ * @return bool
	3438	+ */
	3439	+ private static function is_inside_languages( $path ) {
	3440	+ if ( ! defined( 'WP_LANG_DIR' ) ) {
	3441	+ return false;
	3442	+ }
	3443	+
	3444	+ return 0 === strpos( wp_normalize_path( $path ), untrailingslashit( wp_normalize_path( WP_LANG_DIR ) ) . '/' );
	3445	+ }
	3446	+
	3447	+ /**
	3448	+ * Whether a PHP file holds literal data and nothing else
	3449	+ *
	3450	+ * A file such as "<?php return [ 'a' => 'b' ];" cannot run anything. It is
	3451	+ * how WordPress, GlotPress, WP-CLI and Loco Translate write translation
	3452	+ * files, and how plugins keep small tables. The file is read one piece at
	3453	+ * a time, and every piece has to be a quoted string with nothing
	3454	+ * interpolated in it, a number, true, false, null, return, an array
	3455	+ * bracket, a comma, "=>", a dot or a semicolon. A parenthesis is
	3456	+ * accepted only as part of "array(" and to close it, so
	3457	+ * nothing can be called, and with those pieces there is no way to name a
	3458	+ * variable, a function, a class or a file.
	3459	+ *
	3460	+ * Anything else, a comment included, and the answer is no. Saying no to a
	3461	+ * harmless file only means it is searched like any other; saying yes to
	3462	+ * a file with code would hide it. So this reads less than PHP does, on
	3463	+ * purpose. Each piece is also one PHP would cut the same way: a minus
	3464	+ * sign only in front of a number and a dot never in front of "=", or
	3465	+ * "-=>" and ".=>" would be read here as an arrow and by PHP as an
	3466	+ * assignment. What it accepts is checked against PHP's own reading of
	3467	+ * the same file, at random, in the release checks.
	3468	+ *
	3469	+ * @param string $file_path Absolute path.
	3470	+ * @return bool|null True when it holds only data, false when it holds
	3471	+ * anything else, null when it could not be read whole.
	3472	+ */
	3473	+ private function is_literal_data( $file_path ) {
	3474	+ if ( ! is_file( $file_path ) || ! is_readable( $file_path ) ) {
	3475	+ return null;
	3476	+ }
	3477	+
	3478	+ // With another source encoding set (zend.multibyte), a string does
	3479	+ // not end for PHP where it ends byte by byte: nothing is vouched for.
	3480	+ if ( ini_get( 'zend.multibyte' ) ) {
	3481	+ return null;
	3482	+ }
	3483	+
	3484	+ $size = filesize( $file_path );
	3485	+
	3486	+ if ( false === $size || $size > self::MAX_SEARCHED_BYTES ) {
	3487	+ return null;
	3488	+ }
	3489	+
	3490	+ $content = file_get_contents( $file_path, false, null, 0, self::MAX_SEARCHED_BYTES + 1 ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to see whether it holds anything but data; nothing is written.
	3491	+
	3492	+ if ( false === $content || strlen( $content ) > self::MAX_SEARCHED_BYTES ) {
	3493	+ return null;
	3494	+ }
	3495	+
	3496	+ if ( 1 !== preg_match( '/\A<\?php[ \t\r\n]/', $content ) ) {
	3497	+ return false;
	3498	+ }
	3499	+
	3500	+ $piece = '/\G(?:[ \t\r\n]++|\'[^\'\\\\]*+(?:\\\\.[^\'\\\\]*+)*+\'|"[^"\\\\$]*+(?:\\\\.[^"\\\\$]*+)*+"|-?+\d++(?:\.\d++)?+(?:e[+-]?+\d++)?+|=>|\.(?!=)|[\[\],;)]|(?:true|false|null|return)(?![a-z0-9_\x80-\xff])|array[ \t\r\n]*+\()/is';
	3501	+ $length = strlen( $content );
	3502	+ $offset = 6;
	3503	+
	3504	+ while ( $offset < $length ) {
	3505	+ $match = array();
	3506	+ $result = preg_match( $piece, $content, $match, 0, $offset );
	3507	+
	3508	+ if ( 1 !== $result ) {
	3509	+ return false === $result ? null : false;
	3510	+ }
	3511	+
	3512	+ $offset += strlen( $match[0] );
	3513	+ }
	3514	+
	3515	+ return true;
	3516	+ }
	3517	+
1700	3518	// =========================================================================
1701	3519	// Critical config file baseline monitoring (wp-config.php, .htaccess)
1702	3520	// =========================================================================
1703	3521
		@@ -1713,8 +3531,51 @@
1713	3531	* silently — there is nothing to compare against.
1714	3532	*
1715	3533	* @return array Array of modified file entries (same format as core modified).
1716	3534	*/
	3535	+ /**
	3536	+ * Where a critical root file actually lives
	3537	+ *
	3538	+ * WordPress supports wp-config.php one directory above ABSPATH, guarded by
	3539	+ * wp-settings.php not being there: that is literally what the installed core
	3540	+ * does in wp-load.php, and it is a common hardening layout. Until 2.11.10
	3541	+ * this module only looked inside ABSPATH, so on those installations
	3542	+ * wp-config.php was never added to the baseline, never compared and never
	3543	+ * mentioned: the module reported the site clean without having opened the
	3544	+ * one file it most needs to watch. A zero is justified, never assumed. The
	3545	+ * plugin already resolved both locations elsewhere
	3546	+ * (Vigilante_Database_Prefix::find_wpconfig_path()), just not here. Found by
	3547	+ * the file-by-file review of 2.11.10.
	3548	+ *
	3549	+ * @since 2.11.10
	3550	+ *
	3551	+ * @param string $filename Name of the file, such as wp-config.php.
	3552	+ * @return string|false Absolute path, or false when it cannot be found.
	3553	+ */
	3554	+ private function critical_file_path( $filename ) {
	3555	+ $root = untrailingslashit( ABSPATH );
	3556	+ $path = $root . '/' . $filename;
	3557	+
	3558	+ if ( file_exists( $path ) ) {
	3559	+ return $path;
	3560	+ }
	3561	+
	3562	+ if ( 'wp-config.php' === $filename ) {
	3563	+ $above = dirname( $root ) . '/wp-config.php';
	3564	+
	3565	+ // Suppressed like the core does in wp-load.php: the directory above
	3566	+ // the install is often outside open_basedir on shared hosting, and
	3567	+ // without the @ every scan emits a warning that can land in front of
	3568	+ // the JSON of an AJAX scan.
	3569	+ // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- The same @ the core uses for this same check in wp-load.php:52, where a wp-config.php one directory up is looked for: open_basedir makes file_exists() warn on a path outside it, and this must not print.
	3570	+ if ( @file_exists( $above ) && ! @file_exists( dirname( $root ) . '/wp-settings.php' ) ) {
	3571	+ return $above;
	3572	+ }
	3573	+ }
	3574	+
	3575	+ return false;
	3576	+ }
	3577	+
1717	3578	private function scan_critical_root_files() {
1718	3579	// Before reading anything: the scan is the only thing that reaches
1719	3580	// every site of a network on its own, through wp-cron and front-end
1720	3581	// traffic. Hooking the cleanup to admin_init alone left every subsite
		@@ -1728,14 +3589,13 @@
1728	3589
1729	3590	$modified = array();
1730	3591	$baseline = $this->get_critical_files_baseline();
1731	3592	$baseline_changed = false;
1732		- $root_path = untrailingslashit( ABSPATH );
1733	3593
1734	3594	foreach ( $this->critical_root_files as $filename ) {
1735		- $full_path = $root_path . '/' . $filename;
	3595	+ $full_path = $this->critical_file_path( $filename );
1736	3596
1737		- if ( ! file_exists( $full_path ) ) {
	3597	+ if ( false === $full_path ) {
1738	3598	continue;
1739	3599	}
1740	3600
1741	3601	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -1797,14 +3657,34 @@
1797	3657	*
1798	3658	* Both sides go through the same redaction, or every credential
1799	3659	* line would read as a change nobody made.
1800	3660	*/
1801		- $baseline_content = $baseline[ $filename ]['content'] ?? '';
1802		- $current_content = $this->baseline_content( $filename, $normalized );
1803		- $diff = ( '' !== $baseline_content && '' !== $current_content )
1804		- ? $this->compute_simple_diff( $baseline_content, $current_content )
1805		- : array( 'added' => array(), 'removed' => array(), 'unavailable' => true );
	3661	+ /*
	3662	+ * Where the shared files do not belong to this site, the lines are
	3663	+ * not computed at all. The diff is shown to whoever can open this
	3664	+ * site's screen, the administrator of a subsite included, and it
	3665	+ * was stored in the options of every subsite with the module on.
	3666	+ * Found by the audit of the admin surface for 2.11.8. The change is
	3667	+ * still reported, with both sizes, and the lines are read on the
	3668	+ * main site, where the change is approved.
	3669	+ */
	3670	+ if ( ! Vigilante_Settings::owns_shared_files() ) {
	3671	+ $diff = self::network_only_diff();
	3672	+ } else {
	3673	+ $baseline_content = $baseline[ $filename ]['content'] ?? '';
	3674	+ $current_content = $this->baseline_content( $filename, $normalized );
	3675	+ $diff = ( '' !== $baseline_content && '' !== $current_content )
	3676	+ ? $this->compute_simple_diff( $baseline_content, $current_content )
	3677	+ : array( 'added' => array(), 'removed' => array(), 'unavailable' => true );
1806	3678
	3679	+ // Say why there are no lines when today's copy could not be
	3680	+ // made safe, which approving does not change: the generic
	3681	+ // message talks about an old baseline. Cross review of 2.11.8.
	3682	+ if ( '' === $current_content && 'wp-config.php' === $filename ) {
	3683	+ $diff['redaction'] = true;
	3684	+ }
	3685	+ }
	3686	+
1807	3687	$modified[] = array(
1808	3688	'file' => $filename,
1809	3689	'type' => 'critical_config',
1810	3690	'expected_hash' => $baseline[ $filename ]['hash'],
		@@ -1992,8 +3872,222 @@
1992	3872	*
1993	3873	* @param string $line One line of wp-config.php.
1994	3874	* @return bool
1995	3875	*/
	3876	+ /**
	3877	+ * Whether every marked line of a file can run nothing at all
	3878	+ *
	3879	+ * The question the re-base has to answer before adopting a file is whether
	3880	+ * the lines that carry the marker are only comments. Asking a stricter one
	3881	+ * was wrong in both directions: the first version of the guard used
	3882	+ * is_vigilant_original_line(), which also requires the commented define to
	3883	+ * match a known harmless shape, so it refused to re-base a perfectly inert
	3884	+ * line carrying an unusual define, which is exactly the case the re-base
	3885	+ * exists for, leaving the function unable to act at all. Found by the cross
	3886	+ * review of 2.11.10.
	3887	+ *
	3888	+ * The second version read one line at a time and reasoned that the marker
	3889	+ * begins with //, so a line with nothing but whitespace before it is wholly
	3890	+ * a comment. That is true only where PHP is already reading code, and the
	3891	+ * second cross review of 2.11.10 built three files where it is not, all of
	3892	+ * them valid PHP, all of them passing that test and all of them running or
	3893	+ * printing something:
	3894	+ *
	3895	+ * - the marked line placed BEFORE the opening <?php, so it is inline HTML
	3896	+ * that the server prints verbatim to the browser;
	3897	+ * - the same after a ?> that the file already had;
	3898	+ * - the marked line ending a block comment opened on an earlier line and
	3899	+ * opening another one at its end, with a statement in between, which
	3900	+ * runs like any other statement.
	3901	+ *
	3902	+ * So the file is read the way PHP reads it, not the way the line looks. A
	3903	+ * marked line is inert when every token touching it is a comment or
	3904	+ * whitespace, which answers the three at once: inline HTML is not a comment,
	3905	+ * and neither is a statement. The shape the guard was written for, code
	3906	+ * BEFORE the marker, is the same question from the other side.
	3907	+ *
	3908	+ * The three shapes are in the harness as cells X2, X3 and X4 of
	3909	+ * matriz-escondite-marcadores.sh, written out in full there. They are not
	3910	+ * written out here on purpose: a literal payload in a shipped file is
	3911	+ * signature surface for the scanners this plugin is read by, and a comment
	3912	+ * is a bad place to pay for it.
	3913	+ *
	3914	+ * @since 2.11.10
	3915	+ *
	3916	+ * @param string $content Whole file content.
	3917	+ * @return bool True when no marked line can run or print anything.
	3918	+ */
	3919	+ /**
	3920	+ * The lines of a file that carry the original-value marker
	3921	+ *
	3922	+ * @since 2.11.10
	3923	+ *
	3924	+ * @param string $content Whole file content, newlines already normalised.
	3925	+ * @return string[]
	3926	+ */
	3927	+ private function marked_lines_of( $content ) {
	3928	+ $out = array();
	3929	+
	3930	+ foreach ( explode( "\n", $content ) as $text ) {
	3931	+ if ( false !== strpos( $text, $this->wpconfig_original_marker ) ) {
	3932	+ $out[] = $text;
	3933	+ }
	3934	+ }
	3935	+
	3936	+ return $out;
	3937	+ }
	3938	+
	3939	+ /**
	3940	+ * Whether what a marked line carries would still be harmless uncommented
	3941	+ *
	3942	+ * Only the part after the marker matters: what comes before it is answered by
	3943	+ * the token pass, which refuses anything that is not comment or whitespace.
	3944	+ * Here the question is what comes BACK when uncomment_original_constants()
	3945	+ * removes the marker, so the body has to be a single define() and nothing
	3946	+ * else, with at most a trailing line comment. Deliberately says nothing about
	3947	+ * WHICH constant it is: asking that was the first version of this guard, and
	3948	+ * it refused every define it did not recognise, which is exactly the case the
	3949	+ * re-base exists for.
	3950	+ *
	3951	+ * @since 2.11.10
	3952	+ *
	3953	+ * @param string $line One line carrying the marker.
	3954	+ * @return bool
	3955	+ */
	3956	+ private function marked_line_body_is_harmless( $line ) {
	3957	+ $at = strpos( $line, $this->wpconfig_original_marker );
	3958	+
	3959	+ if ( false === $at ) {
	3960	+ return true;
	3961	+ }
	3962	+
	3963	+ $body = trim( substr( $line, $at + strlen( $this->wpconfig_original_marker ) ) );
	3964	+
	3965	+ if ( '' === $body ) {
	3966	+ return true;
	3967	+ }
	3968	+
	3969	+ // Tokenised as PHP so the trailing comment, the strings and the nesting
	3970	+ // are read the way PHP reads them and not with a regular expression.
	3971	+ $tokens = @token_get_all( '<?php ' . $body ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- A marked line can carry anything; a warning here must not be printed, and an unreadable body is refused below.
	3972	+
	3973	+ if ( empty( $tokens ) ) {
	3974	+ return false;
	3975	+ }
	3976	+
	3977	+ $statements = 0;
	3978	+ $depth = 0;
	3979	+
	3980	+ foreach ( $tokens as $token ) {
	3981	+ $type = is_array( $token ) ? $token[0] : $token;
	3982	+
	3983	+ if ( in_array( $type, array( T_OPEN_TAG, T_WHITESPACE, T_COMMENT, T_DOC_COMMENT ), true ) ) {
	3984	+ continue;
	3985	+ }
	3986	+
	3987	+ if ( '(' === $type ) {
	3988	+ $depth++;
	3989	+ continue;
	3990	+ }
	3991	+
	3992	+ if ( ')' === $type ) {
	3993	+ $depth--;
	3994	+ continue;
	3995	+ }
	3996	+
	3997	+ // A semicolon at the top level closes a statement. More than one, or
	3998	+ // anything after the first, means the line carries something else.
	3999	+ if ( ';' === $type && 0 === $depth ) {
	4000	+ $statements++;
	4001	+ continue;
	4002	+ }
	4003	+
	4004	+ if ( $statements > 0 ) {
	4005	+ return false;
	4006	+ }
	4007	+ }
	4008	+
	4009	+ return ( $statements <= 1 );
	4010	+ }
	4011	+
	4012	+ private function marked_lines_are_inert( $content ) {
	4013	+ $content = str_replace( "\r\n", "\n", (string) $content );
	4014	+ $marker = $this->wpconfig_original_marker;
	4015	+
	4016	+ if ( '' === $content || false === strpos( $content, $marker ) ) {
	4017	+ return true;
	4018	+ }
	4019	+
	4020	+ $marked = array();
	4021	+
	4022	+ foreach ( explode( "\n", $content ) as $index => $text ) {
	4023	+ if ( false !== strpos( $text, $marker ) ) {
	4024	+ $marked[ $index + 1 ] = true;
	4025	+ }
	4026	+ }
	4027	+
	4028	+ // Lenient on purpose (no TOKEN_PARSE): a tampered file still has to be
	4029	+ // read, and a file that cannot be tokenised is never adopted.
	4030	+ // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- The file read here may have been tampered with, which is the whole point, and PHP 8 emits a warning when it cannot tokenise: printing it would put a parse error on whatever page ran the scan. An unreadable file is refused four lines below.
	4031	+ $tokens = @token_get_all( $content );
	4032	+
	4033	+ if ( empty( $tokens ) ) {
	4034	+ return false;
	4035	+ }
	4036	+
	4037	+ /*
	4038	+ * And the other half of the question, which the first token version left
	4039	+ * out: a marked line is a COMMENTED OUT value, and uncommenting it is what
	4040	+ * the feature exists for, so "runs nothing today" is not enough. Anything
	4041	+ * sharing the line after the define comes back with it. The shape is real
	4042	+ * and needs no attacker: comment_existing_constants() takes a define and
	4043	+ * everything on its line, so
	4044	+ * define( 'WP_DEBUG', false ); @ini_set( 'display_errors', 0 );
	4045	+ * is commented whole, and re-basing it would adopt as approved something
	4046	+ * that runs the moment the value is restored. The old rule refused this
	4047	+ * too, but along with every define whose NAME it did not recognise, which
	4048	+ * is what left the function unable to act at all. Found by the third cross
	4049	+ * review of 2.11.10.
	4050	+ */
	4051	+ foreach ( $this->marked_lines_of( $content ) as $text ) {
	4052	+ if ( ! $this->marked_line_body_is_harmless( $text ) ) {
	4053	+ return false;
	4054	+ }
	4055	+ }
	4056	+
	4057	+ $inocuos = array( T_COMMENT, T_DOC_COMMENT, T_WHITESPACE );
	4058	+ $linea = 1;
	4059	+
	4060	+ foreach ( $tokens as $token ) {
	4061	+ $texto = is_array( $token ) ? $token[1] : $token;
	4062	+ $tipo = is_array( $token ) ? $token[0] : null;
	4063	+ $saltos = substr_count( $texto, "\n" );
	4064	+ $desde = $linea;
	4065	+ $hasta = $linea + $saltos;
	4066	+
	4067	+ /*
	4068	+ * A token whose text ends in a newline puts nothing on the line that
	4069	+ * newline opens. Counting it would make the "<?php\n" of every file
	4070	+ * touch line 2 and refuse the legitimate case, which is what the
	4071	+ * first version of this did.
	4072	+ */
	4073	+ $ultima = ( $saltos > 0 && "\n" === substr( $texto, -1 ) ) ? $hasta - 1 : $hasta;
	4074	+ $linea = $hasta;
	4075	+
	4076	+ if ( null !== $tipo && in_array( $tipo, $inocuos, true ) ) {
	4077	+ continue;
	4078	+ }
	4079	+
	4080	+ for ( $l = $desde; $l <= $ultima; $l++ ) {
	4081	+ if ( isset( $marked[ $l ] ) ) {
	4082	+ return false;
	4083	+ }
	4084	+ }
	4085	+ }
	4086	+
	4087	+ return true;
	4088	+ }
	4089	+
1996	4090	private function is_vigilant_original_line( $line ) {
1997	4091	if ( false !== strpos( $line, '<?' ) || false !== strpos( $line, '?>' ) ) {
1998	4092	return false;
1999	4093	}
		@@ -2104,8 +4198,36 @@
2104	4198	* it has run, normalize_critical_file() keeps the old rule on every site.
2105	4199	*
2106	4200	* @since 2.11.5
2107	4201	*/
	4202	+ /**
	4203	+ * The admin_init entry point of the claim, which does ask for an administrator
	4204	+ *
	4205	+ * admin-ajax.php fires admin_init before it decides who is asking
	4206	+ * (wp-admin/admin-ajax.php:45), so without this an anonymous request chose
	4207	+ * the moment the claim runs. Unlike its two neighbours in
	4208	+ * init_cleanup_hooks(), which only drop the plugin's own copy out of the
	4209	+ * database, the claim writes two network options, changes for the whole
	4210	+ * network the rule normalize_critical_file() applies, and re-bases the
	4211	+ * approved baseline.
	4212	+ *
	4213	+ * The gate lives here and not inside maybe_claim_owned_blocks() because the
	4214	+ * scan calls that one directly and the scan runs from wp-cron, with no user:
	4215	+ * putting the capability check inside left the claim unable to complete on
	4216	+ * any site whose dashboard nobody opens, and until it completes the older,
	4217	+ * permissive rule is the one in force, which is the hiding place 2.11.5 was
	4218	+ * written to close. Found by the cross review of 2.11.10.
	4219	+ *
	4220	+ * @since 2.11.10
	4221	+ */
	4222	+ public function maybe_claim_owned_blocks_on_admin() {
	4223	+ if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
	4224	+ return;
	4225	+ }
	4226	+
	4227	+ $this->maybe_claim_owned_blocks();
	4228	+ }
	4229	+
2108	4230	public function maybe_claim_owned_blocks() {
2109	4231	if ( $this->owned_blocks_claimed() || ! Vigilante_Settings::owns_shared_files() ) {
2110	4232	return;
2111	4233	}
		@@ -2116,16 +4238,15 @@
2116	4238	if ( $sync_due && ! get_option( 'vigilante_server_files_retry_after' ) ) {
2117	4239	return;
2118	4240	}
2119	4241
2120		- $root_path = untrailingslashit( ABSPATH );
2121	4242	$expected = null;
2122	4243	$unclaimed = array();
2123	4244
2124	4245	foreach ( $this->critical_root_files as $filename ) {
2125		- $full_path = $root_path . '/' . $filename;
	4246	+ $full_path = $this->critical_file_path( $filename );
2126	4247
2127		- if ( ! file_exists( $full_path ) ) {
	4248	+ if ( false === $full_path ) {
2128	4249	continue;
2129	4250	}
2130	4251
2131	4252	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -2216,15 +4337,14 @@
2216	4337	* @since 2.11.5
2217	4338	*/
2218	4339	private function rebase_original_line_shift() {
2219	4340	$baseline = $this->get_critical_files_baseline();
2220		- $root = untrailingslashit( ABSPATH );
2221	4341	$changed = false;
2222	4342
2223	4343	foreach ( $this->critical_root_files as $filename ) {
2224		- $full_path = $root . '/' . $filename;
	4344	+ $full_path = $this->critical_file_path( $filename );
2225	4345
2226		- if ( ! file_exists( $full_path ) || empty( $baseline[ $filename ]['hash'] ) ) {
	4346	+ if ( false === $full_path || empty( $baseline[ $filename ]['hash'] ) ) {
2227	4347	continue;
2228	4348	}
2229	4349
2230	4350	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -2232,8 +4352,33 @@
2232	4352	if ( false === $content ) {
2233	4353	continue;
2234	4354	}
2235	4355
	4356	+ /*
	4357	+ * Never re-base a file that carries a marked line which is not
	4358	+ * wholly a comment. The test below only establishes that the
	4359	+ * difference lies in lines carrying the marker, and the old rule
	4360	+ * dropped the WHOLE line, so a line with a statement in front of the
	4361	+ * marker satisfies it (cell X1 of matriz-escondite-marcadores.sh,
	4362	+ * where the shape is written out): re-basing would write that line
	4363	+ * into the approved baseline and rewrite the stored content, so the
	4364	+ * diff would stop showing it. Adopting as approved what the previous rule
	4365	+ * hid is the one thing an integrity scanner must never do, and the
	4366	+ * log entry of maybe_claim_owned_blocks() already promises the
	4367	+ * opposite ("the scan reports it as a change for you to review").
	4368	+ * Those files are left to be reported. Found by the file-by-file
	4369	+ * review of 2.11.10.
	4370	+ *
	4371	+ * What counts as "wholly a comment" is decided by reading the file
	4372	+ * as PHP reads it, not by the shape of the line: see
	4373	+ * marked_lines_are_inert(). A line that is not recognised is not the
	4374	+ * same thing as a line that can run something, and the first
	4375	+ * wording of this guard confused the two.
	4376	+ */
	4377	+ if ( ! $this->marked_lines_are_inert( $content ) ) {
	4378	+ continue;
	4379	+ }
	4380	+
2236	4381	$current = md5( $this->normalize_critical_file( $filename, $content ) );
2237	4382
2238	4383	// Already in step, or a real change to something other than the
2239	4384	// original lines: nothing to re-base here.
		@@ -2324,11 +4469,11 @@
2324	4469	* @param string $filename File name relative to ABSPATH (e.g. 'wp-config.php').
2325	4470	* @return bool True on success.
2326	4471	*/
2327	4472	public function update_critical_file_baseline( $filename ) {
2328		- $full_path = untrailingslashit( ABSPATH ) . '/' . $filename;
	4473	+ $full_path = $this->critical_file_path( $filename );
2329	4474
2330		- if ( ! file_exists( $full_path ) ) {
	4475	+ if ( false === $full_path ) {
2331	4476	return false;
2332	4477	}
2333	4478
2334	4479	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -2385,14 +4530,13 @@
2385	4530	* @return array Updated baseline data.
2386	4531	*/
2387	4532	public function regenerate_all_baselines() {
2388	4533	$baseline = array();
2389		- $root_path = untrailingslashit( ABSPATH );
2390	4534
2391	4535	foreach ( $this->critical_root_files as $filename ) {
2392		- $full_path = $root_path . '/' . $filename;
	4536	+ $full_path = $this->critical_file_path( $filename );
2393	4537
2394		- if ( ! file_exists( $full_path ) ) {
	4538	+ if ( false === $full_path ) {
2395	4539	continue;
2396	4540	}
2397	4541
2398	4542	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -2419,10 +4563,10 @@
2419	4563	*
2420	4564	* @param bool $force_refresh Skip the cached copy and ask wp.org again.
2421	4565	* @return array|WP_Error Checksums or error.
2422	4566	*/
2423		- private function get_core_checksums( $force_refresh = false ) {
2424		- $locale = get_locale();
	4567	+ private function get_core_checksums( $force_refresh = false, $locale = null, $english_fallback = true ) {
	4568	+ $locale = null === $locale ? get_locale() : $locale;
2425	4569	$version = $this->wp_version;
2426	4570
2427	4571	// Check cache first
2428	4572	$cache_key = 'vigilante_core_checksums_' . md5( $version . $locale );
		@@ -2451,8 +4595,26 @@
2451	4595
2452	4596	$body = json_decode( wp_remote_retrieve_body( $response ), true );
2453	4597
2454	4598	if ( empty( $body['checksums'] ) ) {
	4599	+ /*
	4600	+ * WordPress.org has no list for this version in this language. That
	4601	+ * is the normal state of every site that is not in English for the
	4602	+ * hours or days after a release, until the package of its language
	4603	+ * is built, and of the languages that never get one. Until now the
	4604	+ * core was then not compared at all. Those sites run the English
	4605	+ * files, so the English list is the one to compare with. It is not
	4606	+ * kept under this language, so the next scan asks again.
	4607	+ */
	4608	+ if ( 'en_US' !== $locale && $english_fallback ) {
	4609	+ $english = $this->get_core_checksums( $force_refresh, 'en_US' );
	4610	+
	4611	+ if ( is_array( $english ) ) {
	4612	+ $this->core_checksums_are_english = true;
	4613	+ return $english;
	4614	+ }
	4615	+ }
	4616	+
2455	4617	return new WP_Error( 'no_checksums', __( 'Could not retrieve WordPress core checksums', 'vigilante' ) );
2456	4618	}
2457	4619
2458	4620	$checksums = $body['checksums'];
		@@ -2468,8 +4630,52 @@
2468	4630	return $checksums;
2469	4631	}
2470	4632
2471	4633	/**
	4634	+ * Whether a core file is the official copy of another language
	4635	+ *
	4636	+ * The checksums are asked for in the language of the site, and a site does
	4637	+ * not always run the package of its language: one installed in English and
	4638	+ * switched to Spanish afterwards keeps the English files, so its
	4639	+ * version.php and its wp-config-sample.php do not match the Spanish list.
	4640	+ * That is why version.php used to be left out of the comparison altogether,
	4641	+ * which left a file WordPress loads on every request unchecked. A file that
	4642	+ * matches the official copy of the same version in English, or in the
	4643	+ * language its own package declares, is an official file. The language
	4644	+ * only chooses which official list to look at: a file that was tampered
	4645	+ * with matches none of them.
	4646	+ *
	4647	+ * @param string $file Path relative to the WordPress root.
	4648	+ * @param string $actual_hash md5 of the file on disk.
	4649	+ * @return bool
	4650	+ */
	4651	+ private function matches_core_of_other_locale( $file, $actual_hash ) {
	4652	+ $current = get_locale();
	4653	+ $others = array( 'en_US' );
	4654	+
	4655	+ if ( ! empty( $GLOBALS['wp_local_package'] ) && is_string( $GLOBALS['wp_local_package'] ) ) {
	4656	+ $others[] = $GLOBALS['wp_local_package'];
	4657	+ }
	4658	+
	4659	+ foreach ( array_unique( $others ) as $locale ) {
	4660	+ if ( $locale === $current || ! preg_match( '/^[A-Za-z0-9_]{2,24}$/', $locale ) ) {
	4661	+ continue;
	4662	+ }
	4663	+
	4664	+ // Without the English list in its place: asking about another
	4665	+ // language must not leave the scan believing that the list of the
	4666	+ // site itself was missing.
	4667	+ $checksums = $this->get_core_checksums( false, $locale, false );
	4668	+
	4669	+ if ( is_array( $checksums ) && isset( $checksums[ $file ] ) && $checksums[ $file ] === $actual_hash ) {
	4670	+ return true;
	4671	+ }
	4672	+ }
	4673	+
	4674	+ return false;
	4675	+ }
	4676	+
	4677	+ /**
2472	4678	* Scan plugins for modifications
2473	4679	*
2474	4680	* @return array Scan results.
2475	4681	*/
		@@ -2487,9 +4693,10 @@
2487	4693	if ( ! function_exists( 'get_plugins' ) ) {
2488	4694	require_once ABSPATH . 'wp-admin/includes/plugin.php';
2489	4695	}
2490	4696
2491		- $plugins = get_plugins();
	4697	+ $plugins = get_plugins();
	4698	+ $finished = array();
2492	4699
2493	4700	foreach ( $plugins as $plugin_file => $plugin_data ) {
2494	4701	// Check time limit
2495	4702	if ( $this->is_time_exceeded() ) {
		@@ -2497,21 +4704,12 @@
2497	4704	}
2498	4705
2499	4706	$plugin_slug = dirname( $plugin_file );
2500	4707
2501		- // Skip single-file plugins
2502		- if ( '.' === $plugin_slug ) {
	4708	+ if ( ! $this->plugin_has_turn( $plugin_slug ) ) {
2503	4709	continue;
2504	4710	}
2505	4711
2506		- // Skip slugs in their post-update grace window: wp.org may still be
2507		- // publishing the new version's checksums, so a scheduled scan here
2508		- // would raise benign "modified/extra" noise. The dedicated post-update
2509		- // verifier (vigilante_fi_postupdate_verify) handles these instead.
2510		- if ( $this->in_post_update_grace( 'plugin', $plugin_slug ) ) {
2511		- continue;
2512		- }
2513		-
2514	4712	// Get checksums from WordPress.org
2515	4713	$version = $plugin_data['Version'] ?? '';
2516	4714	$checksums = $this->get_plugin_checksums( $plugin_slug, $version );
2517	4715
		@@ -2516,8 +4714,22 @@
2516	4714	$checksums = $this->get_plugin_checksums( $plugin_slug, $version );
2517	4715
2518	4716	$has_checksums = ! is_wp_error( $checksums ) && 'not_found' !== $checksums;
2519	4717
	4718	+ // Say which plugins could not be compared, and why. A plugin that
	4719	+ // is not on WordPress.org is named as such; a failed request is an
	4720	+ // error of this scan, not a plugin without an official copy.
	4721	+ if ( is_wp_error( $checksums ) ) {
	4722	+ $results['errors'][] = sprintf(
	4723	+ /* translators: 1: Plugin name, 2: What went wrong */
	4724	+ __( 'The plugin %1$s could not be compared with its copy on WordPress.org: %2$s', 'vigilante' ),
	4725	+ $plugin_data['Name'] ?? $plugin_slug,
	4726	+ $checksums->get_error_message()
	4727	+ );
	4728	+ } elseif ( ! $has_checksums ) {
	4729	+ $results['unverified'][] = $plugin_data['Name'] ?? $plugin_slug;
	4730	+ }
	4731	+
2520	4732	$plugin_dir = WP_PLUGIN_DIR . '/' . $plugin_slug;
2521	4733
2522	4734	// Check known files against checksums (only if available)
2523	4735	if ( $has_checksums ) {
		@@ -2546,9 +4758,17 @@
2546	4758
2547	4759	$results['scanned']++;
2548	4760
2549	4761	if ( ! file_exists( $file_path ) ) {
2550		- continue; // Some files might not be installed
	4762	+ // Reported, and not just skipped: a file that is in the
	4763	+ // published copy and not on the server is part of what
	4764	+ // the scan found.
	4765	+ $results['missing'][] = array(
	4766	+ 'file' => 'plugins/' . $plugin_slug . '/' . $file,
	4767	+ 'type' => 'plugin',
	4768	+ 'plugin' => $plugin_data['Name'] ?? $plugin_slug,
	4769	+ );
	4770	+ continue;
2551	4771	}
2552	4772
2553	4773	if ( ! $this->hash_matches_published( $file_path, $expected_hash ) ) {
2554	4774	$results['modified'][] = array(
		@@ -2572,15 +4792,84 @@
2572	4792	$suspicious_only = ! $has_checksums; // Without checksums, only report files with suspicious code
2573	4793	$extra_results = $this->detect_extra_files( $plugin_dir, $known_files, 'plugin', $plugin_data['Name'], $suspicious_only );
2574	4794	$results['extra'] = array_merge( $results['extra'] ?? array(), $extra_results['extra'] );
2575	4795	$results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $extra_results['suspicious'] );
	4796	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $extra_results['errors'] ?? array() );
2576	4797	}
	4798	+
	4799	+ // The plugin had its whole turn. The one the time runs out on
	4800	+ // does not get here with time left, and is named with the ones
	4801	+ // behind it.
	4802	+ if ( ! $this->is_time_exceeded() ) {
	4803	+ $finished[ $plugin_file ] = true;
	4804	+
	4805	+ // Its folder, as a line for Excluded Paths: what a partial
	4806	+ // scan offers so that the next one spends its time on the
	4807	+ // rest. One that is already excluded was not looked at.
	4808	+ if ( ! $this->is_path_excluded( $plugin_dir . '/.' ) ) {
	4809	+ $results['checked'][] = $this->relative_path( $plugin_dir );
	4810	+ }
	4811	+ }
2577	4812	}
2578	4813
	4814	+ // The plugins the time did not reach, by name.
	4815	+ $results['not_checked'] = array();
	4816	+
	4817	+ foreach ( $plugins as $plugin_file => $plugin_data ) {
	4818	+ if ( isset( $finished[ $plugin_file ] ) || ! $this->plugin_has_turn( dirname( $plugin_file ) ) ) {
	4819	+ continue;
	4820	+ }
	4821	+
	4822	+ $results['not_checked'][] = (string) ( $plugin_data['Name'] ?? dirname( $plugin_file ) );
	4823	+ }
	4824	+
	4825	+ // Must-use plugins, drop-ins and loose PHP files, which have no
	4826	+ // official copy and no entry in the list above.
	4827	+ $results['unlisted_checked'] = false;
	4828	+
	4829	+ if ( ! $this->is_time_exceeded() ) {
	4830	+ $unlisted = $this->scan_unlisted_code();
	4831	+
	4832	+ $results['extra'] = array_merge( $results['extra'] ?? array(), $unlisted['extra'] );
	4833	+ $results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $unlisted['suspicious'] );
	4834	+ $results['unverified'] = array_merge( $results['unverified'] ?? array(), $unlisted['unverified'] );
	4835	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $unlisted['errors'] );
	4836	+
	4837	+ $results['unlisted_checked'] = ! $this->is_time_exceeded();
	4838	+ }
	4839	+
2579	4840	return $results;
2580	4841	}
2581	4842
2582	4843	/**
	4844	+ * Whether a plugin gets a turn of its own in scan_plugins()
	4845	+ *
	4846	+ * @param string $plugin_slug Folder of the plugin, or "." for a single file.
	4847	+ * @return bool
	4848	+ */
	4849	+ private function plugin_has_turn( $plugin_slug ) {
	4850	+ // Single-file plugins are loose PHP files: scan_unlisted_code().
	4851	+ if ( '.' === $plugin_slug ) {
	4852	+ return false;
	4853	+ }
	4854	+
	4855	+ // With the self-check on, Vigilant itself is verified by the
	4856	+ // sha256 triple-anchor block at the start of run_scan(): scanning
	4857	+ // it here again would duplicate findings and the md5 fetch. With
	4858	+ // the check off by filter, Vigilant is a regular plugin (legacy
	4859	+ // behaviour).
	4860	+ if ( dirname( VIGILANTE_PLUGIN_BASENAME ) === $plugin_slug && Vigilante_Self_Integrity::is_on() ) {
	4861	+ return false;
	4862	+ }
	4863	+
	4864	+ // Skip slugs in their post-update grace window: wp.org may still be
	4865	+ // publishing the new version's checksums, so a scheduled scan here
	4866	+ // would raise benign "modified/extra" noise. The dedicated post-update
	4867	+ // verifier (vigilante_fi_postupdate_verify) handles these instead.
	4868	+ return ! $this->in_post_update_grace( 'plugin', $plugin_slug );
	4869	+ }
	4870	+
	4871	+ /**
2583	4872	* Whether a file on disk matches a hash WordPress.org publishes for it.
2584	4873	*
2585	4874	* The wp.org checksums JSON gives, per file, an md5 (and usually a sha256)
2586	4875	* that may be a single string OR an array of strings: a file whose content
		@@ -2710,9 +4999,9 @@
2710	4999	return $response;
2711	5000	}
2712	5001
2713	5002	$status = wp_remote_retrieve_response_code( $response );
2714		- if ( 200 !== $status ) {
	5003	+ if ( 404 === (int) $status ) {
2715	5004	// Cache "not found" to avoid repeated requests (never during grace).
2716	5005	if ( ! $grace ) {
2717	5006	set_transient( $cache_key, 'not_found', HOUR_IN_SECONDS );
2718	5007	}
		@@ -2718,8 +5007,19 @@
2718	5007	}
2719	5008	return 'not_found';
2720	5009	}
2721	5010
	5011	+ if ( 200 !== (int) $status ) {
	5012	+ // WordPress.org answered, but not with the checksums. An outage is
	5013	+ // not a plugin with no published copy, and until now it passed
	5014	+ // for one: the plugin was quietly left uncompared.
	5015	+ return new WP_Error(
	5016	+ 'http_error',
	5017	+ /* translators: %d: HTTP status code */
	5018	+ sprintf( __( 'WordPress.org answered with status %d', 'vigilante' ), (int) $status )
	5019	+ );
	5020	+ }
	5021	+
2722	5022	$body = json_decode( wp_remote_retrieve_body( $response ), true );
2723	5023
2724	5024	if ( empty( $body['files'] ) ) {
2725	5025	return new WP_Error( 'no_checksums', __( 'No checksums found', 'vigilante' ) );
		@@ -2758,9 +5058,10 @@
2758	5058	'extra' => array(),
2759	5059	'errors' => array(),
2760	5060	);
2761	5061
2762		- $themes = wp_get_themes();
	5062	+ $themes = wp_get_themes();
	5063	+ $finished = array();
2763	5064
2764	5065	foreach ( $themes as $theme_slug => $theme ) {
2765	5066	// Check time limit
2766	5067	if ( $this->is_time_exceeded() ) {
		@@ -2776,8 +5077,20 @@
2776	5077	$checksums = $this->get_theme_checksums( $theme_slug, $version );
2777	5078
2778	5079	$has_checksums = ! is_wp_error( $checksums ) && 'not_found' !== $checksums;
2779	5080
	5081	+ // Same as for plugins: name what could not be compared, and why.
	5082	+ if ( is_wp_error( $checksums ) && 'not_found' !== $checksums->get_error_code() ) {
	5083	+ $results['errors'][] = sprintf(
	5084	+ /* translators: 1: Theme name, 2: What went wrong */
	5085	+ __( 'The theme %1$s could not be compared with its copy on WordPress.org: %2$s', 'vigilante' ),
	5086	+ $theme->get( 'Name' ),
	5087	+ $checksums->get_error_message()
	5088	+ );
	5089	+ } elseif ( ! $has_checksums ) {
	5090	+ $results['unverified'][] = $theme->get( 'Name' );
	5091	+ }
	5092	+
2780	5093	$theme_dir = $theme->get_stylesheet_directory();
2781	5094
2782	5095	// Check known files against checksums (only if available)
2783	5096	if ( $has_checksums ) {
		@@ -2806,8 +5119,13 @@
2806	5119
2807	5120	$results['scanned']++;
2808	5121
2809	5122	if ( ! file_exists( $file_path ) ) {
	5123	+ $results['missing'][] = array(
	5124	+ 'file' => 'themes/' . $theme_slug . '/' . $file,
	5125	+ 'type' => 'theme',
	5126	+ 'theme' => $theme->get( 'Name' ),
	5127	+ );
2810	5128	continue;
2811	5129	}
2812	5130
2813	5131	if ( ! $this->hash_matches_published( $file_path, $expected_hash ) ) {
		@@ -2830,11 +5148,32 @@
2830	5148	$suspicious_only = ! $has_checksums;
2831	5149	$extra_results = $this->detect_extra_files( $theme_dir, $known_files, 'theme', $theme->get( 'Name' ), $suspicious_only );
2832	5150	$results['extra'] = array_merge( $results['extra'] ?? array(), $extra_results['extra'] );
2833	5151	$results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $extra_results['suspicious'] );
	5152	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $extra_results['errors'] ?? array() );
2834	5153	}
	5154	+
	5155	+ // Same as for plugins: a whole turn, with time left.
	5156	+ if ( ! $this->is_time_exceeded() ) {
	5157	+ $finished[ $theme_slug ] = true;
	5158	+
	5159	+ if ( ! $this->is_path_excluded( $theme_dir . '/.' ) ) {
	5160	+ $results['checked'][] = $this->relative_path( $theme_dir );
	5161	+ }
	5162	+ }
2835	5163	}
2836	5164
	5165	+ // The themes the time did not reach, by name.
	5166	+ $results['not_checked'] = array();
	5167	+
	5168	+ foreach ( $themes as $theme_slug => $theme ) {
	5169	+ if ( isset( $finished[ $theme_slug ] ) || $this->in_post_update_grace( 'theme', $theme_slug ) ) {
	5170	+ continue;
	5171	+ }
	5172	+
	5173	+ $results['not_checked'][] = (string) $theme->get( 'Name' );
	5174	+ }
	5175	+
2837	5176	return $results;
2838	5177	}
2839	5178
2840	5179	/**
		@@ -2844,9 +5183,9 @@
2844	5183	* @param string $version Theme version.
2845	5184	* @return array|WP_Error
2846	5185	*/
2847	5186	private function get_theme_checksums( $slug, $version ) {
2848		- $cache_key = 'vigilante_theme_checksums_' . md5( $slug . $version );
	5187	+ $cache_key = 'vigilante_theme_package_' . md5( $slug . $version );
2849	5188
2850	5189	// Bypass the cache during the post-update grace window (see plugin path).
2851	5190	$grace = $this->in_post_update_grace( 'theme', $slug );
2852	5191
		@@ -2856,48 +5195,103 @@
2856	5195	return $cached;
2857	5196	}
2858	5197	}
2859	5198
2860		- $url = sprintf(
2861		- 'https://downloads.wordpress.org/theme-checksums/%s/%s.json',
2862		- $slug,
2863		- $version
2864		- );
	5199	+ /*
	5200	+ * WordPress.org publishes checksums for plugins and for core, and none
	5201	+ * for themes: the address this method asked until now answers 404 for
	5202	+ * every theme, so no theme was ever compared with anything and they
	5203	+ * were all treated as themes from elsewhere. What WordPress.org does
	5204	+ * publish is the package of each version, so the checksums are taken
	5205	+ * from there: the package is downloaded once per version, each file in
	5206	+ * it is hashed straight from the archive, nothing is unpacked to disk,
	5207	+ * and the result is kept for a month.
	5208	+ */
	5209	+ if ( '' === (string) $version || ! preg_match( '/^[A-Za-z0-9._-]+$/', (string) $slug ) ) {
	5210	+ return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
	5211	+ }
2865	5212
2866		- $response = wp_remote_get( $url, array( 'timeout' => 10 ) );
	5213	+ if ( ! class_exists( 'ZipArchive' ) ) {
	5214	+ return new WP_Error( 'no_zip', __( 'the zip extension of PHP is missing on this server', 'vigilante' ) );
	5215	+ }
2867	5216
2868		- if ( is_wp_error( $response ) ) {
2869		- return $response;
	5217	+ if ( ! function_exists( 'download_url' ) ) {
	5218	+ require_once ABSPATH . 'wp-admin/includes/file.php';
2870	5219	}
2871	5220
2872		- $status = wp_remote_retrieve_response_code( $response );
2873		- if ( 200 !== $status ) {
2874		- // Cache "not found" to avoid repeated requests (never during grace).
2875		- if ( ! $grace ) {
2876		- set_transient( $cache_key, 'not_found', HOUR_IN_SECONDS );
	5221	+ $package = download_url(
	5222	+ sprintf( 'https://downloads.wordpress.org/theme/%s.%s.zip', rawurlencode( $slug ), rawurlencode( (string) $version ) ),
	5223	+ 30
	5224	+ );
	5225	+
	5226	+ if ( is_wp_error( $package ) ) {
	5227	+ $data = $package->get_error_data();
	5228	+
	5229	+ // WordPress.org has no such theme or no such version: a theme from
	5230	+ // somewhere else. Anything other than a 404 is a failed download,
	5231	+ // and is reported as that instead of passing for a theme with no
	5232	+ // official copy.
	5233	+ if ( is_array( $data ) && isset( $data['code'] ) && 404 === (int) $data['code'] ) {
	5234	+ if ( ! $grace ) {
	5235	+ set_transient( $cache_key, 'not_found', 12 * HOUR_IN_SECONDS );
	5236	+ }
	5237	+ return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
2877	5238	}
2878		- return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
	5239	+
	5240	+ return $package;
2879	5241	}
2880	5242
2881		- $body = json_decode( wp_remote_retrieve_body( $response ), true );
	5243	+ $checksums = array();
	5244	+ $archive = new ZipArchive();
2882	5245
2883		- if ( empty( $body['files'] ) ) {
2884		- return new WP_Error( 'no_checksums', __( 'No checksums found', 'vigilante' ) );
	5246	+ if ( true === $archive->open( $package ) ) {
	5247	+ $prefix = $slug . '/';
	5248	+ $max_entry = 16 * MB_IN_BYTES;
	5249	+
	5250	+ for ( $i = 0; $i < $archive->numFiles; $i++ ) {
	5251	+ $entry = $archive->statIndex( $i );
	5252	+ $name = is_array( $entry ) ? (string) $entry['name'] : '';
	5253	+
	5254	+ // Everything in the package lives under the folder of the theme.
	5255	+ // Folders, anything outside it and any path with a ".."
	5256	+ // segment are not files of the theme.
	5257	+ if ( '' === $name || '/' === substr( $name, -1 ) || 0 !== strpos( $name, $prefix ) || preg_match( '#(?:^|/)\.\.(?:/|$)#', $name ) ) {
	5258	+ continue;
	5259	+ }
	5260	+
	5261	+ // Read up to a limit: an entry larger than this is not code,
	5262	+ // and is left out of the comparison instead of being loaded
	5263	+ // whole into memory.
	5264	+ $content = $archive->getFromIndex( $i, $max_entry + 1 );
	5265	+
	5266	+ if ( false === $content ) {
	5267	+ $checksums = array();
	5268	+ break;
	5269	+ }
	5270	+
	5271	+ if ( strlen( $content ) > $max_entry ) {
	5272	+ continue;
	5273	+ }
	5274	+
	5275	+ $checksums[ substr( $name, strlen( $prefix ) ) ] = array(
	5276	+ 'md5' => md5( $content ),
	5277	+ 'sha256' => hash( 'sha256', $content ),
	5278	+ );
	5279	+ }
	5280	+
	5281	+ $archive->close();
2885	5282	}
2886	5283
2887		- // Store the full per-file record (md5 + sha256), either of which may be a
2888		- // string or an array; hash_matches_published() handles both shapes.
2889		- $checksums = array();
2890		- foreach ( $body['files'] as $file => $data ) {
2891		- $checksums[ $file ] = array(
2892		- 'md5' => isset( $data['md5'] ) ? $data['md5'] : null,
2893		- 'sha256' => isset( $data['sha256'] ) ? $data['sha256'] : null,
2894		- );
	5284	+ wp_delete_file( $package );
	5285	+
	5286	+ if ( empty( $checksums ) ) {
	5287	+ return new WP_Error( 'no_checksums', __( 'the package from WordPress.org could not be read', 'vigilante' ) );
2895	5288	}
2896	5289
2897		- // Cache for 24 hours (never during grace).
	5290	+ // The package of a published version does not change, so it is kept
	5291	+ // for a month (never during grace).
2898	5292	if ( ! $grace ) {
2899		- set_transient( $cache_key, $checksums, DAY_IN_SECONDS );
	5293	+ set_transient( $cache_key, $checksums, MONTH_IN_SECONDS );
2900	5294	}
2901	5295
2902	5296	return $checksums;
2903	5297	}
		@@ -2910,36 +5304,56 @@
2910	5304	private function scan_uploads() {
2911	5305	$found = array(
2912	5306	'suspicious' => array(),
2913	5307	'extra' => array(),
	5308	+ 'errors' => array(),
2914	5309	);
2915	5310	$upload_dir = wp_upload_dir();
2916	5311	$base_dir = $upload_dir['basedir'];
2917		- $max_files = 10000; // Increased limit for thorough scanning
2918	5312	$files_checked = 0;
2919	5313
	5314	+ // The walk used to stop after 10,000 files without saying so, and a
	5315	+ // media library passes that with a few thousand images. Now it goes on
	5316	+ // for as long as its share of the scan time lasts, and says so when it
	5317	+ // is cut short. The share keeps a huge library from leaving the core
	5318	+ // and the plugins without their turn.
	5319	+ $deadline = $this->scan_start_time > 0 ? $this->scan_start_time + ( 0.4 * $this->max_scan_time ) : 0;
	5320	+
2920	5321	// Executable extensions that should never be in uploads
2921		- $dangerous_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar', 'phps' );
	5322	+ $dangerous_extensions = self::php_extensions();
2922	5323
	5324	+ // Files that change how PHP runs in the folder they are in.
	5325	+ $php_config_files = array( '.user.ini', 'php.ini' );
	5326	+
	5327	+ // Scripts a server can be told to run through CGI.
	5328	+ $script_extensions = array( 'cgi', 'pl', 'py', 'sh', 'shtml' );
	5329	+
2923	5330	if ( ! is_dir( $base_dir ) ) {
2924	5331	return $found;
2925	5332	}
2926	5333
2927	5334	try {
2928		- $iterator = new RecursiveIteratorIterator(
2929		- new RecursiveDirectoryIterator( $base_dir, RecursiveDirectoryIterator::SKIP_DOTS ),
2930		- RecursiveIteratorIterator::LEAVES_ONLY
2931		- );
2932		-
2933		- foreach ( $iterator as $file ) {
	5335	+ foreach ( self::walk_folder( $base_dir ) as $file ) {
2934	5336	// Check global time limit
2935	5337	if ( $this->is_time_exceeded() ) {
2936	5338	break;
2937	5339	}
2938	5340
2939		- // Check file limit
	5341	+ if ( $file->isDir() ) {
	5342	+ if ( ! $file->isReadable() ) {
	5343	+ $found['errors'][] = self::unreadable_folder_error( $file->getPathname() );
	5344	+ }
	5345	+ continue;
	5346	+ }
	5347	+
	5348	+ // Check the share of the scan time (every 500 files)
2940	5349	$files_checked++;
2941		- if ( $files_checked > $max_files ) {
	5350	+ if ( $deadline > 0 && 0 === $files_checked % 500 && microtime( true ) > $deadline ) {
	5351	+ $found['errors'][] = sprintf(
	5352	+ /* translators: %s: Number of files */
	5353	+ __( 'The uploads folder was not checked completely: the time for it ran out after %s files.', 'vigilante' ),
	5354	+ number_format_i18n( $files_checked )
	5355	+ );
2942	5356	break;
2943	5357	}
2944	5358
2945	5359	$file_path = $file->getPathname();
		@@ -2964,15 +5378,12 @@
2964	5378
2965	5379	$reason = __( 'PHP file found in uploads directory', 'vigilante' );
2966	5380
2967	5381	// Scan content for specific suspicious patterns
2968		- if ( $file->getSize() < 512000 ) { // Only scan files < 500KB
2969		- $content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
2970		- $pattern = $this->detect_suspicious_pattern( $content );
2971		- if ( $pattern ) {
2972		- /* translators: %s: Suspicious pattern found */
2973		- $reason = sprintf( __( 'PHP in uploads with suspicious code: %s', 'vigilante' ), $pattern );
2974		- }
	5382	+ $pattern = $this->search_file( $file_path );
	5383	+ if ( $pattern ) {
	5384	+ /* translators: %s: Suspicious pattern found */
	5385	+ $reason = sprintf( __( 'PHP in uploads with suspicious code: %s', 'vigilante' ), $pattern );
2975	5386	}
2976	5387
2977	5388	$found['suspicious'][] = array(
2978	5389	'file' => $relative,
		@@ -2982,9 +5393,12 @@
2982	5393	continue;
2983	5394	}
2984	5395
2985	5396	// 2. Check for double extensions (image.php.jpg, file.phtml.png)
2986		- if ( preg_match( '/\.(' . implode( '|', $dangerous_extensions ) . ')\.[a-z]{2,4}$/i', $basename ) ) {
	5397	+ // The second extension can be anything: a script renamed by a
	5398	+ // malware cleaner (shell.php.suspected) or numbered (shell.php.1)
	5399	+ // is as much of a finding as one dressed up as an image.
	5400	+ if ( preg_match( '/\.(' . implode( '|', $dangerous_extensions ) . ')\.[a-z0-9_~-]{1,16}$/i', $basename ) ) {
2987	5401	$found['suspicious'][] = array(
2988	5402	'file' => $relative,
2989	5403	'type' => 'double_extension',
2990	5404	'reason' => __( 'Double extension detected (possible disguised executable)', 'vigilante' ),
		@@ -2991,17 +5405,41 @@
2991	5405	);
2992	5406	continue;
2993	5407	}
2994	5408
	5409	+ // 2b. Files that change how PHP runs in this folder
	5410	+ if ( in_array( strtolower( $basename ), $php_config_files, true ) ) {
	5411	+ $found['suspicious'][] = array(
	5412	+ 'file' => $relative,
	5413	+ 'type' => 'php_config_in_uploads',
	5414	+ 'reason' => __( 'PHP configuration file in uploads', 'vigilante' ),
	5415	+ );
	5416	+ continue;
	5417	+ }
	5418	+
	5419	+ // 2c. Scripts in other languages
	5420	+ if ( in_array( $extension, $script_extensions, true ) ) {
	5421	+ $found['extra'][] = array(
	5422	+ 'file' => $relative,
	5423	+ 'type' => 'script_in_uploads',
	5424	+ 'reason' => __( 'Script file in uploads', 'vigilante' ),
	5425	+ );
	5426	+ continue;
	5427	+ }
	5428	+
2995	5429	// 3. Check for .htaccess files in uploads
2996		- // Read content to classify: dangerous rules = suspicious, protective rules = extra
	5430	+ // Read content to classify (see classify_htaccess_in_uploads())
2997	5431	if ( '.htaccess' === $basename ) {
2998	5432	$htaccess_result = $this->classify_htaccess_in_uploads( $file_path, $relative );
2999		- $found[ $htaccess_result['category'] ][] = $htaccess_result['item'];
	5433	+
	5434	+ // One that only denies access, or does nothing, is not a finding.
	5435	+ if ( 'none' !== $htaccess_result['category'] ) {
	5436	+ $found[ $htaccess_result['category'] ][] = $htaccess_result['item'];
	5437	+ }
3000	5438	}
3001	5439	}
3002	5440	} catch ( Exception $e ) {
3003		- // Ignore iterator errors
	5441	+ $found['errors'][] = self::unreadable_folder_error( $base_dir );
3004	5442	}
3005	5443
3006	5444	return $found;
3007	5445	}
		@@ -3008,94 +5446,515 @@
3008	5446
3009	5447	/**
3010	5448	* Classify a .htaccess file found in uploads directory
3011	5449	*
3012		- * Reads the file content to determine if it contains dangerous rules
3013		- * (enabling PHP execution, rewriting to executables) or protective rules
3014		- * (deny access, disable indexes). Dangerous = suspicious, protective = extra.
	5450	+ * The file is read the way Apache reads it: continued lines are joined,
	5451	+ * comments are dropped and each directive is looked at on its own. That
	5452	+ * replaces a handful of expressions run over the whole text, which took a
	5453	+ * commented line for a live one and the rule that forbids PHP for one that
	5454	+ * runs it, and let through the directives that turn CGI on.
3015	5455	*
	5456	+ * - Something that makes the server run code: suspicious.
	5457	+ * - Only directives that deny or switch something off: not reported.
	5458	+ * - Rewrite rules of its own and nothing that denies PHP: extra, because in
	5459	+ * that folder they replace the rules of the site root, the one that
	5460	+ * blocks PHP in uploads included (measured on Apache, 3 Oct 2026).
	5461	+ * - Anything else: extra, with what it contains.
	5462	+ *
3016	5463	* @param string $file_path Absolute file path.
3017	5464	* @param string $relative Relative file path for display.
3018		- * @return array Array with 'category' ('suspicious' or 'extra') and 'item' data.
	5465	+ * @return array Array with 'category' ('suspicious', 'extra' or 'none') and 'item' data.
3019	5466	*/
3020	5467	private function classify_htaccess_in_uploads( $file_path, $relative ) {
3021		- $content = '';
	5468	+ $content = false;
3022	5469
3023	5470	if ( filesize( $file_path ) < 65536 ) { // Only read files < 64KB
3024	5471	$content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
3025	5472	}
3026	5473
3027		- // If we can't read it or it's empty, treat as suspicious (unknown)
3028		- if ( empty( trim( $content ) ) ) {
	5474	+ $item = array(
	5475	+ 'file' => $relative,
	5476	+ 'type' => 'htaccess_in_uploads',
	5477	+ );
	5478	+
	5479	+ // A file that cannot be read cannot be vouched for.
	5480	+ if ( false === $content ) {
	5481	+ $item['reason'] = __( '.htaccess file in uploads directory that could not be read', 'vigilante' );
	5482	+
3029	5483	return array(
3030	5484	'category' => 'suspicious',
3031		- 'item' => array(
3032		- 'file' => $relative,
3033		- 'type' => 'htaccess_in_uploads',
3034		- 'reason' => __( '.htaccess file in uploads directory (empty or unreadable)', 'vigilante' ),
3035		- ),
	5485	+ 'item' => $item,
3036	5486	);
3037	5487	}
3038	5488
3039		- // Dangerous patterns: rules that enable code execution or rewrite to executables
3040		- $dangerous_patterns = array(
3041		- '/AddHandler\s+.*(php|cgi|pl|py)/i' => 'AddHandler enabling script execution',
3042		- '/AddType\s+application\/x-httpd-php/i' => 'AddType enabling PHP execution',
3043		- '/SetHandler\s+.*(php|cgi)/i' => 'SetHandler enabling script execution',
3044		- '/php_flag\s+engine\s+on/i' => 'PHP engine enabled',
3045		- '/php_admin_flag\s+engine\s+on/i' => 'PHP admin engine enabled',
3046		- '/RewriteRule\s+.*\.(php|phtml|phar)/i' => 'Rewrite rule targeting PHP files',
3047		- '/auto_prepend_file/i' => 'auto_prepend_file directive',
3048		- '/auto_append_file/i' => 'auto_append_file directive',
	5489	+ $facts = self::read_htaccess_rules( $content );
	5490	+
	5491	+ if ( ! empty( $facts['runs'] ) ) {
	5492	+ $item['reason'] = self::htaccess_run_reason( $facts );
	5493	+
	5494	+ return array(
	5495	+ 'category' => 'suspicious',
	5496	+ 'item' => $item,
	5497	+ );
	5498	+ }
	5499	+
	5500	+ if ( $facts['rewrite'] && ! $facts['denies_php'] ) {
	5501	+ $item['reason'] = __( '.htaccess in uploads with rewrite rules of its own: in this folder they replace the ones of the site root, the rule that blocks PHP in uploads included', 'vigilante' );
	5502	+
	5503	+ return array(
	5504	+ 'category' => 'extra',
	5505	+ 'item' => $item,
	5506	+ );
	5507	+ }
	5508	+
	5509	+ // Empty, or nothing in it that does not deny or switch something off:
	5510	+ // it protects the folder, or does nothing, and is not a finding.
	5511	+ if ( empty( $facts['other'] ) ) {
	5512	+ return array(
	5513	+ 'category' => 'none',
	5514	+ 'item' => null,
	5515	+ );
	5516	+ }
	5517	+
	5518	+ $kinds = array(
	5519	+ 'access' => __( 'access rules', 'vigilante' ),
	5520	+ 'rewrite' => __( 'rewrite rules', 'vigilante' ),
	5521	+ 'headers' => __( 'cache or header rules', 'vigilante' ),
	5522	+ 'other' => __( 'other rules', 'vigilante' ),
3049	5523	);
3050	5524
3051		- foreach ( $dangerous_patterns as $pattern => $label ) {
3052		- if ( preg_match( $pattern, $content ) ) {
3053		- return array(
3054		- 'category' => 'suspicious',
3055		- 'item' => array(
3056		- 'file' => $relative,
3057		- 'type' => 'htaccess_in_uploads',
3058		- /* translators: %s: Dangerous rule description */
3059		- 'reason' => sprintf( __( '.htaccess with dangerous rule: %s', 'vigilante' ), $label ),
3060		- ),
3061		- );
	5525	+ /* translators: %s: Summary of rules found in the .htaccess file */
	5526	+ $item['reason'] = sprintf( __( '.htaccess in uploads (likely from plugin). Contains: %s', 'vigilante' ), implode( ', ', array_intersect_key( $kinds, $facts['other'] ) ) );
	5527	+
	5528	+ return array(
	5529	+ 'category' => 'extra',
	5530	+ 'item' => $item,
	5531	+ );
	5532	+ }
	5533	+
	5534	+ /**
	5535	+ * The reason shown for a .htaccess that makes the server run code
	5536	+ *
	5537	+ * @param array $facts What read_htaccess_rules() found.
	5538	+ * @return string
	5539	+ */
	5540	+ private static function htaccess_run_reason( $facts ) {
	5541	+ $labels = array(
	5542	+ 'run' => __( 'makes the server run files of this folder as code', 'vigilante' ),
	5543	+ 'load' => __( 'loads a file on every PHP request', 'vigilante' ),
	5544	+ 'rewrite' => __( 'sends requests to a PHP file', 'vigilante' ),
	5545	+ 'cgi' => __( 'turns on CGI or server-side includes', 'vigilante' ),
	5546	+ );
	5547	+
	5548	+ /* translators: %s: What the rule does */
	5549	+ return sprintf( __( '.htaccess with a rule that affects how code runs: %s', 'vigilante' ), implode( '; ', array_intersect_key( $labels, $facts['runs'] ) ) );
	5550	+ }
	5551	+
	5552	+ /**
	5553	+ * What a section of a .htaccess says about the directives inside it
	5554	+ *
	5555	+ * @param string $name Section name, in lower case.
	5556	+ * @param string $args What follows the name, as written.
	5557	+ * @return string '' when it changes nothing (<RequireAll>), 'rewrite' for
	5558	+ * <IfModule mod_rewrite.c>, 'maybe' for any other test of
	5559	+ * what the server has, 'files-php' for a <Files> or
	5560	+ * <FilesMatch> that names PHP files, 'files' for one that
	5561	+ * names other files, and 'condition' for the rest (<Limit>,
	5562	+ * <If>, <RequireAny>...), which apply to some requests only.
	5563	+ */
	5564	+ private static function htaccess_section_kind( $name, $args ) {
	5565	+ $args = trim( rtrim( trim( $args ), '>' ) );
	5566	+
	5567	+ if ( 'requireall' === $name ) {
	5568	+ return '';
	5569	+ }
	5570	+
	5571	+ if ( 'ifmodule' === $name ) {
	5572	+ return in_array( strtolower( trim( $args, '"\' ' ) ), array( 'mod_rewrite.c', 'rewrite_module' ), true ) ? 'rewrite' : 'maybe';
	5573	+ }
	5574	+
	5575	+ if ( in_array( $name, array( 'ifdefine', 'ifversion' ), true ) ) {
	5576	+ return 'maybe';
	5577	+ }
	5578	+
	5579	+ if ( 'files' === $name || 'filesmatch' === $name ) {
	5580	+ $regex = 'filesmatch' === $name;
	5581	+
	5582	+ if ( ! $regex && '~' === substr( $args, 0, 1 ) ) {
	5583	+ $regex = true;
	5584	+ $args = trim( substr( $args, 1 ) );
3062	5585	}
	5586	+
	5587	+ return true === self::extension_pattern_names_php( trim( $args, '"\'' ), $regex, false ) ? 'files-php' : 'files';
3063	5588	}
3064	5589
3065		- // Identify what protective/benign rules it contains for informational display
3066		- $found_rules = array();
	5590	+ return 'condition';
	5591	+ }
3067	5592
3068		- $benign_patterns = array(
3069		- '/Deny\s+from\s+all/i' => 'Deny from all',
3070		- '/Require\s+all\s+denied/i' => 'Require all denied',
3071		- '/Options\s+.*-Indexes/i' => 'Options -Indexes',
3072		- '/Header\s+set/i' => 'Header rules',
3073		- '/ExpiresActive/i' => 'Expires/cache rules',
3074		- '/RewriteEngine/i' => 'Rewrite rules',
3075		- '/FilesMatch/i' => 'FilesMatch rules',
3076		- '/ForceType\s+application\/octet/i' => 'ForceType (force download)',
	5593	+ /**
	5594	+ * Whether a pattern that goes only by the extension of a file names the PHP ones
	5595	+ *
	5596	+ * "Every PHP file" cannot be asked of a sample name. A sample is public,
	5597	+ * so a section can be written for it and nothing else, and an expression
	5598	+ * can name every file but one ("all but shell.php") in more ways than can
	5599	+ * be tried. So the pattern has to be of a kind that cannot tell one name
	5600	+ * from another: any name, a dot and a list of extensions, to the end. In
	5601	+ * that kind there is nothing to make an exception with, and whether .php
	5602	+ * is on the list is then a fair question for a sample. Anything else is
	5603	+ * not taken for a denial of PHP, which only means the .htaccess is listed.
	5604	+ *
	5605	+ * @param string $pattern Pattern, without its quotes.
	5606	+ * @param bool $regex Whether it is an expression (FilesMatch, "Files ~",
	5607	+ * RewriteRule) or a wildcard (Files).
	5608	+ * @param bool $nocase Whether it ignores case.
	5609	+ * @return bool|null True when it names every .php file, false when it goes
	5610	+ * by the extension and .php is not one of them, null
	5611	+ * when it is not of that kind.
	5612	+ */
	5613	+ private static function extension_pattern_names_php( $pattern, $regex, $nocase ) {
	5614	+ if ( ! $regex ) {
	5615	+ if ( 1 !== preg_match( '/^\*\.[a-z0-9*?]+$/i', $pattern ) ) {
	5616	+ return null;
	5617	+ }
	5618	+
	5619	+ return function_exists( 'fnmatch' ) ? fnmatch( $pattern, 'x.php' ) : '*.php' === $pattern;
	5620	+ }
	5621	+
	5622	+ $rest = $pattern;
	5623	+
	5624	+ if ( 0 === stripos( $rest, '(?i)' ) ) {
	5625	+ $rest = substr( $rest, 4 );
	5626	+ $nocase = true;
	5627	+ }
	5628	+
	5629	+ // "Any name" in front, written out or left out, and then a dot, the
	5630	+ // extensions and the end, written out or left out too. The extensions
	5631	+ // are letters, digits, groups, alternatives and classes of letters and
	5632	+ // digits: no dot, no "any character", nothing negated and nothing
	5633	+ // that looks around.
	5634	+ $rest = preg_replace( '/^\^?\.[*+]/', '', $rest, 1 );
	5635	+
	5636	+ if ( 1 !== preg_match( '/^\\\\\.(?:[a-z0-9|?*+)]|\\\\d|\[[a-z0-9-]+\]|\((?:\?i?:)?)+\$?$/i', (string) $rest ) ) {
	5637	+ return null;
	5638	+ }
	5639	+
	5640	+ // The dot has to be there: with "?" or "*" after it, what follows
	5641	+ // would be looked for anywhere in the name. And an alternative
	5642	+ // outside a group is a second pattern with no dot in front of it,
	5643	+ // which goes by the name again.
	5644	+ if ( 1 === preg_match( '/^\\\\\.[?*+]/', $rest ) ) {
	5645	+ return null;
	5646	+ }
	5647	+
	5648	+ $depth = 0;
	5649	+
	5650	+ for ( $i = 0, $length = strlen( $rest ); $i < $length; $i++ ) {
	5651	+ if ( '(' === $rest[ $i ] ) {
	5652	+ $depth++;
	5653	+ } elseif ( ')' === $rest[ $i ] ) {
	5654	+ $depth--;
	5655	+ }
	5656	+
	5657	+ if ( $depth < 0 || ( 0 === $depth && '|' === $rest[ $i ] ) ) {
	5658	+ return null;
	5659	+ }
	5660	+ }
	5661	+
	5662	+ if ( 0 !== $depth ) {
	5663	+ return null;
	5664	+ }
	5665	+
	5666	+ $expression = '~' . str_replace( '~', '\\~', $pattern ) . '~' . ( $nocase ? 'i' : '' );
	5667	+
	5668	+ foreach ( array( 'x.php', 'a/b/x.php' ) as $sample ) {
	5669	+ $matched = @preg_match( $expression, $sample ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- A pattern Apache would refuse names nothing.
	5670	+
	5671	+ if ( false === $matched ) {
	5672	+ return null;
	5673	+ }
	5674	+
	5675	+ if ( 0 === $matched ) {
	5676	+ return false;
	5677	+ }
	5678	+ }
	5679	+
	5680	+ return true;
	5681	+ }
	5682	+
	5683	+ /**
	5684	+ * Whether a RewriteRule that refuses requests refuses every PHP file
	5685	+ *
	5686	+ * A pattern with a "!" in front refuses what it does not match, so it
	5687	+ * refuses PHP when it goes by the extension and .php is not one of them
	5688	+ * ("!\.(jpe?g|png)$": everything but the images).
	5689	+ *
	5690	+ * @param string $pattern Pattern of the rule.
	5691	+ * @param string $flags Flags of the rule, in lower case.
	5692	+ * @return bool
	5693	+ */
	5694	+ private static function rewrite_rule_refuses_php( $pattern, $flags ) {
	5695	+ $pattern = trim( $pattern, '"\'' );
	5696	+ $negated = '' !== $pattern && '!' === $pattern[0];
	5697	+
	5698	+ if ( $negated ) {
	5699	+ $pattern = substr( $pattern, 1 );
	5700	+ }
	5701	+
	5702	+ if ( '' === $pattern ) {
	5703	+ return false;
	5704	+ }
	5705	+
	5706	+ $names = self::extension_pattern_names_php( $pattern, true, (bool) preg_match( '/[\[,]\s*(?:nc|nocase)\s*[,\]]/', $flags ) );
	5707	+
	5708	+ return $negated ? false === $names : true === $names;
	5709	+ }
	5710	+
	5711	+ /**
	5712	+ * What the directives of a .htaccess do, as far as running code goes
	5713	+ *
	5714	+ * @param string $content Content of the file.
	5715	+ * @return array {
	5716	+ * @type array $runs Ways it makes the server run code, as keys:
	5717	+ * 'run', 'load', 'rewrite', 'cgi'.
	5718	+ * @type array $other Kinds of directive that neither run code nor
	5719	+ * only deny, as keys: 'access', 'rewrite',
	5720	+ * 'headers', 'other'.
	5721	+ * @type bool $rewrite Whether it has rewrite directives of its own.
	5722	+ * @type bool $denies_php Whether it denies access to every PHP file
	5723	+ * itself, for every request and whatever the
	5724	+ * server has loaded.
	5725	+ * }
	5726	+ */
	5727	+ private static function read_htaccess_rules( $content ) {
	5728	+ $facts = array(
	5729	+ 'runs' => array(),
	5730	+ 'other' => array(),
	5731	+ 'rewrite' => false,
	5732	+ 'denies_php' => false,
3077	5733	);
3078	5734
3079		- foreach ( $benign_patterns as $pattern => $label ) {
3080		- if ( preg_match( $pattern, $content ) ) {
3081		- $found_rules[] = $label;
	5735	+ // A line that ends in a backslash goes on in the next one, and Apache
	5736	+ // joins the two before it looks at anything else, comments included.
	5737	+ $content = str_replace( array( "\r\n", "\r" ), "\n", (string) $content );
	5738	+ $content = preg_replace( '/(?<!\\\\)\\\\\n/', '', $content );
	5739	+
	5740	+ // "script" as a word of its own: cgi-script and php-script are
	5741	+ // handlers that run code, application/javascript is a kind of file.
	5742	+ $scripts = '/php|cgi|(?<![a-z])script|lsapi|server-parsed|proxy:|python-program/';
	5743	+ $php_target = '/\.(?:ph(?:p\d*|tml|t|ar|ps)|inc)(?![a-z0-9])/';
	5744	+ $containers = array();
	5745	+ $cgi_handler = false;
	5746	+ $execcgi_on = false;
	5747	+ $execcgi_off = false;
	5748	+
	5749	+ foreach ( explode( "\n", (string) $content ) as $line ) {
	5750	+ $line = trim( $line );
	5751	+
	5752	+ if ( '' === $line || '#' === $line[0] ) {
	5753	+ continue;
3082	5754	}
	5755	+
	5756	+ // Sections are remembered, to know what a directive inside them
	5757	+ // applies to (see htaccess_section_kind()).
	5758	+ if ( '<' === $line[0] ) {
	5759	+ if ( preg_match( '/^<\s*\//', $line ) ) {
	5760	+ array_pop( $containers );
	5761	+ } elseif ( preg_match( '/^<\s*([A-Za-z]+)\b(.*)$/', $line, $section ) ) {
	5762	+ $containers[] = self::htaccess_section_kind( strtolower( $section[1] ), $section[2] );
	5763	+ }
	5764	+ continue;
	5765	+ }
	5766	+
	5767	+ if ( ! preg_match( '/^([A-Za-z_]+)\s*(.*)$/', $line, $parts ) ) {
	5768	+ $facts['other']['other'] = true;
	5769	+ continue;
	5770	+ }
	5771	+
	5772	+ $name = strtolower( $parts[1] );
	5773	+ $args = trim( $parts[2] );
	5774	+ $low = strtolower( $args );
	5775	+ $words = preg_split( '/\s+/', $low, -1, PREG_SPLIT_NO_EMPTY );
	5776	+ $first = isset( $words[0] ) ? trim( $words[0], '"\'' ) : '';
	5777	+
	5778	+ // The sections around this line that put a condition on it.
	5779	+ $inside = array_values( array_diff( $containers, array( '' ) ) );
	5780	+
	5781	+ switch ( $name ) {
	5782	+ case 'sethandler':
	5783	+ case 'addhandler':
	5784	+ case 'addtype':
	5785	+ case 'forcetype':
	5786	+ if ( preg_match( $scripts, $first ) ) {
	5787	+ // "AddHandler cgi-script" next to "Options -ExecCGI" is
	5788	+ // the old recipe that hands every script to CGI and
	5789	+ // forbids CGI. Which of the two it is gets decided
	5790	+ // once the whole file has been read.
	5791	+ if ( 'addhandler' === $name && false !== strpos( $first, 'cgi' ) ) {
	5792	+ $cgi_handler = true;
	5793	+ } else {
	5794	+ $facts['runs']['run'] = true;
	5795	+ }
	5796	+ } elseif ( ! in_array( $first, array( 'none', 'default-handler', 'text/plain', 'application/octet-stream' ), true ) ) {
	5797	+ $facts['other']['other'] = true;
	5798	+ }
	5799	+ break;
	5800	+
	5801	+ case 'php_flag':
	5802	+ case 'php_admin_flag':
	5803	+ case 'php_value':
	5804	+ case 'php_admin_value':
	5805	+ $value = isset( $words[1] ) ? trim( $words[1], '"\'' ) : '';
	5806	+
	5807	+ if ( 'engine' === $first ) {
	5808	+ if ( ! in_array( $value, array( 'off', '0', 'false', 'no' ), true ) ) {
	5809	+ $facts['runs']['run'] = true;
	5810	+ }
	5811	+ } elseif ( in_array( $first, array( 'auto_prepend_file', 'auto_append_file' ), true ) ) {
	5812	+ if ( '' !== $value && 'none' !== $value ) {
	5813	+ $facts['runs']['load'] = true;
	5814	+ }
	5815	+ } else {
	5816	+ $facts['other']['other'] = true;
	5817	+ }
	5818	+ break;
	5819	+
	5820	+ case 'options':
	5821	+ foreach ( $words as $option ) {
	5822	+ // Only a ban on CGI that holds for everybody counts as one.
	5823	+ if ( '-execcgi' === $option && empty( $inside ) ) {
	5824	+ $execcgi_off = true;
	5825	+ }
	5826	+
	5827	+ if ( '-' === $option[0] || 'none' === $option ) {
	5828	+ continue;
	5829	+ }
	5830	+
	5831	+ $option = ltrim( $option, '+' );
	5832	+
	5833	+ if ( in_array( $option, array( 'execcgi', 'includes', 'all' ), true ) ) {
	5834	+ $facts['runs']['cgi'] = true;
	5835	+ $execcgi_on = true;
	5836	+ } else {
	5837	+ $facts['other']['other'] = true;
	5838	+ }
	5839	+ }
	5840	+ break;
	5841	+
	5842	+ case 'addoutputfilter':
	5843	+ case 'setoutputfilter':
	5844	+ case 'addoutputfilterbytype':
	5845	+ if ( false !== strpos( $low, 'includes' ) ) {
	5846	+ $facts['runs']['cgi'] = true;
	5847	+ } else {
	5848	+ $facts['other']['other'] = true;
	5849	+ }
	5850	+ break;
	5851	+
	5852	+ case 'action':
	5853	+ $facts['runs']['cgi'] = true;
	5854	+ break;
	5855	+
	5856	+ case 'xbithack':
	5857	+ // Server-side includes for every file with the execute bit.
	5858	+ if ( 'off' !== $first ) {
	5859	+ $facts['runs']['cgi'] = true;
	5860	+ }
	5861	+ break;
	5862	+
	5863	+ case 'deny':
	5864	+ case 'require':
	5865	+ $denies = 'deny' === $name ? ( 'from' === $first && isset( $words[1] ) && 'all' === $words[1] ) : ( 'all' === $first && isset( $words[1] ) && 'denied' === $words[1] );
	5866	+
	5867	+ if ( ! $denies || in_array( 'condition', $inside, true ) ) {
	5868	+ $facts['other']['access'] = true;
	5869	+ } elseif ( ! array_diff( $inside, array( 'rewrite', 'files-php' ) ) ) {
	5870	+ // For every request, on any server, and for every file
	5871	+ // or for the PHP ones. A denial that depends on a
	5872	+ // module being there, or that names other files, still
	5873	+ // protects, but it does not make up for rewrite rules
	5874	+ // that switch off the ones of the site root.
	5875	+ $facts['denies_php'] = true;
	5876	+ }
	5877	+ break;
	5878	+
	5879	+ case 'order':
	5880	+ case 'indexignore':
	5881	+ break;
	5882	+
	5883	+ case 'allow':
	5884	+ case 'satisfy':
	5885	+ case 'authtype':
	5886	+ case 'authname':
	5887	+ case 'authuserfile':
	5888	+ case 'authgroupfile':
	5889	+ $facts['other']['access'] = true;
	5890	+ break;
	5891	+
	5892	+ case 'rewriteengine':
	5893	+ case 'rewritebase':
	5894	+ case 'rewriteoptions':
	5895	+ $facts['rewrite'] = true;
	5896	+ break;
	5897	+
	5898	+ case 'rewritecond':
	5899	+ // A condition makes the rule after it apply to some
	5900	+ // requests and not to others, a denial included.
	5901	+ $facts['rewrite'] = true;
	5902	+ $facts['other']['rewrite'] = true;
	5903	+ break;
	5904	+
	5905	+ case 'rewriterule':
	5906	+ $facts['rewrite'] = true;
	5907	+
	5908	+ $rule = preg_split( '/\s+/', $args, 3 );
	5909	+ $pattern = isset( $rule[0] ) ? $rule[0] : '';
	5910	+ $target = isset( $rule[1] ) ? strtolower( trim( $rule[1], '"\'' ) ) : '';
	5911	+ $flags = isset( $rule[2] ) ? strtolower( $rule[2] ) : '';
	5912	+
	5913	+ if ( preg_match( '/[\[,]\s*h=/', $flags ) || preg_match( '/[\[,]\s*t=[^,\]]*(?:php|cgi|(?<![a-z])script)/', $flags ) ) {
	5914	+ // A handler or a type forced from the rule itself.
	5915	+ $facts['runs']['run'] = true;
	5916	+ } elseif ( '-' === $target && preg_match( '/[\[,]\s*(?:f|forbidden|g|gone)\s*[,\]]/', $flags ) ) {
	5917	+ // Rewrites nothing and refuses the request. It stands
	5918	+ // for the rule of the site root only when it refuses
	5919	+ // every PHP file, for every request.
	5920	+ if ( ! array_diff( $inside, array( 'rewrite' ) ) && self::rewrite_rule_refuses_php( $pattern, $flags ) ) {
	5921	+ $facts['denies_php'] = true;
	5922	+ } else {
	5923	+ $facts['other']['rewrite'] = true;
	5924	+ }
	5925	+ } elseif ( '-' === $target ) {
	5926	+ // Rewrites nothing and lets the request through, which
	5927	+ // can be the way to keep one file out of the denial
	5928	+ // that follows: it is not part of a file that only
	5929	+ // protects.
	5930	+ $facts['other']['rewrite'] = true;
	5931	+ } elseif ( preg_match( $php_target, $target ) && '/index.php' !== $target ) {
	5932	+ $facts['runs']['rewrite'] = true;
	5933	+ } else {
	5934	+ $facts['other']['rewrite'] = true;
	5935	+ }
	5936	+ break;
	5937	+
	5938	+ case 'header':
	5939	+ case 'requestheader':
	5940	+ case 'expiresactive':
	5941	+ case 'expiresbytype':
	5942	+ case 'expiresdefault':
	5943	+ case 'fileetag':
	5944	+ $facts['other']['headers'] = true;
	5945	+ break;
	5946	+
	5947	+ default:
	5948	+ $facts['other']['other'] = true;
	5949	+ }
3083	5950	}
3084	5951
3085		- $rules_summary = ! empty( $found_rules )
3086		- ? implode( ', ', $found_rules )
3087		- : __( 'Custom rules', 'vigilante' );
	5952	+ if ( $cgi_handler && ( $execcgi_on || ! $execcgi_off ) ) {
	5953	+ $facts['runs']['cgi'] = true;
	5954	+ }
3088	5955
3089		- return array(
3090		- 'category' => 'extra',
3091		- 'item' => array(
3092		- 'file' => $relative,
3093		- 'type' => 'htaccess_in_uploads',
3094		- /* translators: %s: Summary of rules found in the .htaccess file */
3095		- 'reason' => sprintf( __( '.htaccess in uploads (likely from plugin). Contains: %s', 'vigilante' ), $rules_summary ),
3096		- ),
3097		- );
	5956	+ return $facts;
3098	5957	}
3099	5958
3100	5959	/**
3101	5960	* Check content for suspicious patterns
		@@ -3139,25 +5998,45 @@
3139	5998	foreach ( $patterns_data['standard_patterns'] as $encoded_needle => $label ) {
3140	5999	// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- Decoding pattern definitions, not user input.
3141	6000	$needle = base64_decode( $encoded_needle );
3142	6001	if ( $this->needle_present( $content, $needle ) ) {
3143		- return $label;
	6002	+ // The labels live in the pattern file, in English: "$_GET access"
	6003	+ // becomes "$_GET", which needs no translation.
	6004	+ return preg_replace( '/ access$/', '', (string) $label );
3144	6005	}
3145	6006	}
3146	6007
3147		- // Check for preg_replace with /e modifier (code execution)
3148		- if ( preg_match( '/preg_replace\s*\(\s*[\'"].*\/e[\'"]/i', $content ) ) {
3149		- return 'preg_replace /e modifier';
	6008	+ return $this->detect_common_pattern( $content );
	6009	+ }
	6010	+
	6011	+ /**
	6012	+ * The three checks both levels of the search share
	6013	+ *
	6014	+ * @param string $content File content.
	6015	+ * @return string|false The pattern found, or false.
	6016	+ */
	6017	+ private function detect_common_pattern( $content ) {
	6018	+ // preg_replace with the /e modifier (arbitrary code execution,
	6019	+ // deprecated). The modifier is looked for on the same line and within
	6020	+ // 300 characters of the opening quote. With ".*" every preg_replace of
	6021	+ // a long line cost a pass over the whole line: 88 seconds for a file
	6022	+ // of 500 KB made for it, measured without the PCRE compiler.
	6023	+ if ( $this->found( '/preg_replace\s*+\(\s*+[\'"][^\n]{0,300}?\/e[\'"]/i', $content ) ) {
	6024	+ return __( 'preg_replace with the /e modifier, which runs code', 'vigilante' );
3150	6025	}
3151	6026
3152		- // Check for long hex-encoded strings (obfuscated payloads)
3153		- if ( preg_match( '/\\\\x[0-9a-f]{2}(\\\\x[0-9a-f]{2}){10,}/i', $content ) ) {
3154		- return 'hex-encoded string';
	6027	+ // Long hex-encoded strings (obfuscated payloads). Eleven escapes in a
	6028	+ // row and not "ten or more after the first": asked to take them all,
	6029	+ // PCRE gave up on a run of some 12,000, and a search that gave up
	6030	+ // read as "nothing found". The longer the payload, the less it was
	6031	+ // found.
	6032	+ if ( $this->found( '/(?:\\\\x[0-9a-f]{2}){11}/i', $content ) ) {
	6033	+ return __( 'a long string written in hexadecimal', 'vigilante' );
3155	6034	}
3156	6035
3157		- // Check for heavily concatenated chr() calls (char-by-char obfuscation)
3158		- if ( preg_match( '/chr\s*\(\s*\d+\s*\)\s*\.\s*chr\s*\(\s*\d+\s*\)\s*\.\s*chr/i', $content ) ) {
3159		- return 'chr() concatenation obfuscation';
	6036	+ // Heavily concatenated chr() calls (char-by-char obfuscation)
	6037	+ if ( $this->found( '/chr\s*+\(\s*+\d++\s*+\)\s*+\.\s*+chr\s*+\(\s*+\d++\s*+\)\s*+\.\s*+chr/i', $content ) ) {
	6038	+ return __( 'text built character by character with chr()', 'vigilante' );
3160	6039	}
3161	6040
3162	6041	return false;
3163	6042	}
		@@ -3194,29 +6073,94 @@
3194	6073	$as = $fragments['as'] ?? '';
3195	6074	$ss = $fragments['ss'] ?? '';
3196	6075	$cf = $fragments['cf'] ?? '';
3197	6076
3198		- // Obfuscation combos: dangerous function wrapping decoded content
	6077	+ // Obfuscation combos: dangerous function wrapping decoded content.
	6078	+ // The labels name the two functions side by side and not one inside
	6079	+ // the other. Written the way the code is written, a label was itself
	6080	+ // a match: the results of a scan, kept in a cache that stores options
	6081	+ // as PHP files under wp-content, would have been the next finding.
	6082	+ // The possessive quantifiers ("*+") change nothing in what matches,
	6083	+ // because what follows each run of spaces is never a space. They keep
	6084	+ // PCRE from walking a long run back one space at a time, which is
	6085	+ // where it gives up when it runs without its compiler.
3199	6086	$obfuscation_combos = array(
3200		- '/' . $ev . '\s*\(\s*' . $b6 . '\s*\(/i' => $ev . '(' . $b6 . '())',
3201		- '/' . $ev . '\s*\(\s*' . $gz . '\s*\(/i' => $ev . '(' . $gz . '())',
3202		- '/' . $ev . '\s*\(\s*' . $gu . '\s*\(/i' => $ev . '(' . $gu . '())',
3203		- '/' . $ev . '\s*\(\s*' . $sr . '\s*\(/i' => $ev . '(' . $sr . '())',
3204		- '/' . $ev . '\s*\(\s*' . $hb . '\s*\(/i' => $ev . '(' . $hb . '())',
3205		- '/' . $as . '\s*\(\s*' . $b6 . '\s*\(/i' => $as . '(' . $b6 . '())',
3206		- '/' . $ev . '\s*\(\s*\$[a-z_]+\s*\(/i' => $ev . '($variable())',
3207		- '/' . $ev . '\s*\(\s*' . $ss . '\s*\(/i' => $ev . '(' . $ss . '())',
	6087	+ '/' . $ev . '\s*+\(\s*+' . $b6 . '\s*+\(/i' => $ev . '() + ' . $b6 . '()',
	6088	+ '/' . $ev . '\s*+\(\s*+' . $gz . '\s*+\(/i' => $ev . '() + ' . $gz . '()',
	6089	+ '/' . $ev . '\s*+\(\s*+' . $gu . '\s*+\(/i' => $ev . '() + ' . $gu . '()',
	6090	+ '/' . $ev . '\s*+\(\s*+' . $sr . '\s*+\(/i' => $ev . '() + ' . $sr . '()',
	6091	+ '/' . $ev . '\s*+\(\s*+' . $hb . '\s*+\(/i' => $ev . '() + ' . $hb . '()',
	6092	+ '/' . $as . '\s*+\(\s*+' . $b6 . '\s*+\(/i' => $as . '() + ' . $b6 . '()',
	6093	+ '/' . $ev . '\s*+\(\s*+\$[a-z_]++\s*+\(/i' => $ev . '() + $variable()',
	6094	+ '/' . $ev . '\s*+\(\s*+' . $ss . '\s*+\(/i' => $ev . '() + ' . $ss . '()',
3208	6095	);
3209	6096
3210	6097	foreach ( $obfuscation_combos as $regex => $label ) {
3211		- if ( preg_match( $regex, $content ) ) {
	6098	+ if ( $this->found( $regex, $content ) ) {
3212	6099	return $label;
3213	6100	}
3214	6101	}
3215	6102
	6103	+ // The plain backdoor, with nothing to hide: data from the request
	6104	+ // handed straight to code or to the system, a function the request
	6105	+ // chooses, or a file included from another server. The names come
	6106	+ // from the list the concatenation check below uses, minus the decoders,
	6107	+ // so they are not written here either. That list is decoded once, for both.
	6108	+ $dangerous_names = array();
	6109	+ if ( ! empty( $patterns_data['dangerous_names'] ) ) {
	6110	+ foreach ( $patterns_data['dangerous_names'] as $encoded_name ) {
	6111	+ // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
	6112	+ $dangerous_names[] = base64_decode( $encoded_name );
	6113	+ }
	6114	+ }
	6115	+
	6116	+ $runners = array_merge( array_filter( array( $ev, $as ) ), array_diff( $dangerous_names, array( $b6, $gz, $gu, $sr, $hb ) ) );
	6117	+
	6118	+ // These three read as code what PHP reads as code, so they are
	6119	+ // searched with the comments of the file turned into blank space
	6120	+ // (blank_comments()). A comment that quotes one of them ("never do
	6121	+ // this: ...") is then not a finding, and a comment slipped between a
	6122	+ // name and its parenthesis hides nothing. The first two cannot match
	6123	+ // without a superglobal of the request, so only the files that name
	6124	+ // one are prepared that way, about one in twenty. The third is looked
	6125	+ // for in the file as it is and checked again that way when it matches.
	6126	+ $code = null;
	6127	+
	6128	+ if ( $this->found( '/\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b/', $content ) ) {
	6129	+ $code = $this->blank_comments( $content );
	6130	+
	6131	+ // When PHP cannot be asked what is a comment, the file is
	6132	+ // searched as it is: a comment may then be reported, and nothing
	6133	+ // that runs is left out.
	6134	+ $subject = false === $code ? $content : $code;
	6135	+
	6136	+ if ( ! empty( $runners ) ) {
	6137	+ $names = implode( '|', array_map( 'preg_quote', $runners ) );
	6138	+ // What the visitor sends, when it is not just being asked about
	6139	+ // with isset() or empty(). The path of an uploaded file is not in
	6140	+ // the list: handing it to a command is how images get processed.
	6141	+ $from_request = '(?<!isset\()(?<!isset\( )(?<!empty\()(?<!empty\( )(?:\$_(?:GET|POST|REQUEST|COOKIE)\b|\$_SERVER\s*\[\s*[\'"]HTTP_)';
	6142	+
	6143	+ // The possessive quantifiers keep a file made of spaces from
	6144	+ // costing a try per space.
	6145	+ if ( $this->found( '/(?<![a-z0-9_>:$])(?:' . $names . ')\s*+\(\s*+[^;\n]{0,80}?' . $from_request . '/i', $subject ) ) {
	6146	+ return __( 'data from the request is run as code or as a command', 'vigilante' );
	6147	+ }
	6148	+ }
	6149	+
	6150	+ if ( $this->found( '/\$_(?:GET|POST|REQUEST|COOKIE)\s*+\[[^\]\n]{1,60}\]\s*+\(/', $subject ) ) {
	6151	+ return __( 'a function chosen by the request is called', 'vigilante' );
	6152	+ }
	6153	+ }
	6154	+
	6155	+ if ( $this->found_in_code( '/(?<![a-z0-9_>$])(?:include|require)(?:_once)?\s*+(?:\(\s*+)?[\'"]https?:\/\//i', $content, $code ) ) {
	6156	+ return __( 'a file from another server is included', 'vigilante' );
	6157	+ }
	6158	+
3216	6159	// Deprecated dynamic function constructor, nearly always malicious in modern code
3217	6160	if ( ! empty( $cf ) && $this->needle_present( $content, $cf ) ) {
3218		- return $cf . ')';
	6161	+ // The name alone, for the same reason as the labels above.
	6162	+ return rtrim( $cf, '(' );
3219	6163	}
3220	6164
3221	6165	// Remote fetch piped into unserialize: a PHP object-injection / supply-chain
3222	6166	// vector seen in trojanized or nulled plugins (download a payload from a
		@@ -3226,11 +6170,21 @@
3226	6170	// checked that both strings appeared somewhere in the file, which
3227	6171	// false-positived on legitimate code using both in unrelated methods
3228	6172	// (e.g. a theme reading a transient with maybe_unserialize() while
3229	6173	// fetching its public IP with wp_remote_get()).
3230		- $us = $fragments['us'] ?? '';
3231		- if ( '' !== $us ) {
3232		- $us_regex = '/(?<![a-z0-9_])' . preg_quote( $us, '/' ) . '\s*\(/i';
	6174	+ //
	6175	+ // The search runs on a copy of the file in lower case, with
	6176	+ // expressions that tell the case apart, and only when the file names
	6177	+ // the function at all. PCRE without its compiler looks ahead for the
	6178	+ // first letter of an expression in both cases before each try, and
	6179	+ // when one of the two is not in the file that look runs to the end of
	6180	+ // it. pattern_near() asks once per match, so a file with thousands of
	6181	+ // them cost thousands of passes (26 seconds for 8 MB, measured). With
	6182	+ // one case to look for, each look stops at the next candidate.
	6183	+ $us = self::lower_ascii( $fragments['us'] ?? '' );
	6184	+ if ( '' !== $us && false !== stripos( $content, $us ) ) {
	6185	+ $lower = self::lower_ascii( $content );
	6186	+ $us_regex = '/(?<![a-z0-9_])' . preg_quote( $us, '/' ) . '\s*+\(/';
3233	6187	$remote_fetchers = array(
3234	6188	$fragments['wr'] ?? '', // wp_remote_get
3235	6189	$fragments['rb'] ?? '', // wp_remote_retrieve_body
3236	6190	$fragments['ce'] ?? '', // curl_exec
		@@ -3238,11 +6192,12 @@
3238	6192	foreach ( $remote_fetchers as $rf ) {
3239	6193	if ( '' === $rf ) {
3240	6194	continue;
3241	6195	}
3242		- $rf_regex = '/(?<![a-z0-9_])' . preg_quote( $rf, '/' ) . '\s*\(/i';
3243		- if ( $this->pattern_near( $content, $us_regex, $rf_regex, 600 ) ) {
3244		- return $rf . '() + ' . $us . '() remote deserialization';
	6196	+ $rf_regex = '/(?<![a-z0-9_])' . preg_quote( self::lower_ascii( $rf ), '/' ) . '\s*+\(/';
	6197	+ if ( $this->pattern_near( $lower, $us_regex, $rf_regex, 600 ) ) {
	6198	+ /* translators: 1: Function that downloads, 2: Function that unserializes */
	6199	+ return sprintf( __( 'data downloaded from another server is unserialized (%1$s and %2$s)', 'vigilante' ), $rf, $us );
3245	6200	}
3246	6201	}
3247	6202
3248	6203	// file_get_contents() is treated separately from the fetchers
		@@ -3255,51 +6210,106 @@
3255	6210	// argument is a URL, so the combo additionally requires a
3256	6211	// remote-scheme literal near the call before it fires.
3257	6212	$fg = $fragments['fg'] ?? '';
3258	6213	if ( '' !== $fg ) {
3259		- $fg_regex = '/(?<![a-z0-9_])' . preg_quote( $fg, '/' ) . '\s*\(/i';
3260		- $scheme_regex = '/(?:https?|ftps?):\/\/|php:\/\/input/i';
	6214	+ $fg_regex = '/(?<![a-z0-9_])' . preg_quote( self::lower_ascii( $fg ), '/' ) . '\s*+\(/';
	6215	+ $scheme_regex = '/(?:https?|ftps?):\/\/|php:\/\/input/';
3261	6216
3262		- if ( $this->pattern_near( $content, $us_regex, $fg_regex, 600 )
3263		- && $this->pattern_near( $content, $fg_regex, $scheme_regex, 600 ) ) {
3264		- return $fg . '() + ' . $us . '() remote deserialization';
	6217	+ if ( $this->pattern_near( $lower, $us_regex, $fg_regex, 600 )
	6218	+ && $this->pattern_near( $lower, $fg_regex, $scheme_regex, 600 ) ) {
	6219	+ /* translators: 1: Function that downloads, 2: Function that unserializes */
	6220	+ return sprintf( __( 'data downloaded from another server is unserialized (%1$s and %2$s)', 'vigilante' ), $fg, $us );
3265	6221	}
3266	6222	}
3267	6223	}
3268	6224
3269		- // preg_replace with /e modifier (arbitrary code execution, deprecated)
3270		- if ( preg_match( '/preg_replace\s*\(\s*[\'"].*\/e[\'"]/i', $content ) ) {
3271		- return 'preg_replace /e modifier';
	6225	+ $common = $this->detect_common_pattern( $content );
	6226	+ if ( $common ) {
	6227	+ return $common;
3272	6228	}
3273	6229
3274		- // Long hex-encoded strings (obfuscated payloads)
3275		- if ( preg_match( '/\\\\x[0-9a-f]{2}(\\\\x[0-9a-f]{2}){10,}/i', $content ) ) {
3276		- return 'hex-encoded string';
	6230	+ // Dangerous function names built from string concatenation: a variable
	6231	+ // given a name in pieces and then called. The assignments are taken
	6232	+ // one at a time and the calls are looked up in one pass. Collecting
	6233	+ // every assignment of the file first, and then searching the whole
	6234	+ // file again for each one, took memory and time that grew with the
	6235	+ // square of the file.
	6236	+ $split = array();
	6237	+ $capped = false;
	6238	+ $offset = 0;
	6239	+
	6240	+ while ( true ) {
	6241	+ // A variable, "=" and a quoted piece followed by a dot: where a
	6242	+ // string put together from pieces starts.
	6243	+ $start = $this->next_match( '/\$([a-z_]\w*)\s*+=\s*+(?=["\'][a-z0-9_]*+["\']\s*+\.)/i', $content, $offset );
	6244	+
	6245	+ if ( null === $start ) {
	6246	+ break;
	6247	+ }
	6248	+
	6249	+ // The pieces are taken one by one, however many there are: a name
	6250	+ // can be padded with as many empty ones as its author likes, and
	6251	+ // asking PCRE for the whole chain at once is what made it give up.
	6252	+ $position = $start[0][1] + strlen( $start[0][0] );
	6253	+ $combined = '';
	6254	+ $closed = false;
	6255	+
	6256	+ while ( true ) {
	6257	+ $piece = $this->next_match( '/\G["\']([a-z0-9_]*+)["\']\s*+(\.\s*+|;)?+/i', $content, $position );
	6258	+
	6259	+ if ( null === $piece ) {
	6260	+ break;
	6261	+ }
	6262	+
	6263	+ // No name on the list is this long: past it, the letters are
	6264	+ // not kept, and the chain is still walked to its end.
	6265	+ if ( strlen( $combined ) <= 64 ) {
	6266	+ $combined .= self::lower_ascii( $piece[1][0] );
	6267	+ }
	6268	+
	6269	+ $position = $piece[0][1] + strlen( $piece[0][0] );
	6270	+ $after = isset( $piece[2] ) && $piece[2][1] >= 0 ? $piece[2][0] : '';
	6271	+
	6272	+ if ( '' === $after || ';' === $after ) {
	6273	+ $closed = ';' === $after;
	6274	+ break;
	6275	+ }
	6276	+ }
	6277	+
	6278	+ $offset = max( $position, $start[0][1] + 1 );
	6279	+
	6280	+ if ( $closed && in_array( $combined, $dangerous_names, true ) && ! isset( $split[ $start[1][0] ] ) ) {
	6281	+ $split[ $start[1][0] ] = $combined;
	6282	+
	6283	+ if ( count( $split ) >= 500 ) {
	6284	+ $capped = true;
	6285	+ break;
	6286	+ }
	6287	+ }
3277	6288	}
3278	6289
3279		- // Heavily concatenated chr() calls (char-by-char obfuscation)
3280		- if ( preg_match( '/chr\s*\(\s*\d+\s*\)\s*\.\s*chr\s*\(\s*\d+\s*\)\s*\.\s*chr/i', $content ) ) {
3281		- return 'chr() concatenation obfuscation';
3282		- }
	6290	+ if ( ! empty( $split ) ) {
	6291	+ $offset = 0;
3283	6292
3284		- // Detect dangerous function names built from string concatenation
3285		- if ( preg_match_all( '/\$([a-z_]\w*)\s*=\s*((?:["\'][a-z0-9_]*["\']\s*\.\s*)+["\'][a-z0-9_]*["\'])\s*;/i', $content, $matches, PREG_SET_ORDER ) ) {
3286		- $dangerous_names = array();
3287		- if ( ! empty( $patterns_data['dangerous_names'] ) ) {
3288		- foreach ( $patterns_data['dangerous_names'] as $encoded_name ) {
3289		- // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
3290		- $dangerous_names[] = base64_decode( $encoded_name );
	6293	+ while ( true ) {
	6294	+ $call = $this->next_match( '/\$([a-z_]\w*)\s*+\(/i', $content, $offset );
	6295	+
	6296	+ if ( null === $call ) {
	6297	+ break;
3291	6298	}
	6299	+
	6300	+ if ( isset( $split[ $call[1][0] ] ) ) {
	6301	+ /* translators: %s: Function name */
	6302	+ return sprintf( __( 'call to %s() with its name split in pieces', 'vigilante' ), $split[ $call[1][0] ] );
	6303	+ }
	6304	+
	6305	+ $offset = $call[0][1] + strlen( $call[0][0] );
3292	6306	}
3293	6307
3294		- foreach ( $matches as $match ) {
3295		- $combined = strtolower( preg_replace( '/["\'\s\.]/', '', $match[2] ) );
3296		- if ( in_array( $combined, $dangerous_names, true ) ) {
3297		- $var_pattern = '/\$' . preg_quote( $match[1], '/' ) . '\s*\(/';
3298		- if ( preg_match( $var_pattern, $content ) ) {
3299		- return 'obfuscated ' . $combined . '() call';
3300		- }
3301		- }
	6308	+ // More names in pieces than a file has any reason to hold, and
	6309	+ // not every one was followed: not searched, rather than clean.
	6310	+ if ( $capped ) {
	6311	+ $this->search_failed = true;
3302	6312	}
3303	6313	}
3304	6314
3305	6315	return false;
		@@ -3325,9 +6335,9 @@
3325	6335	return false;
3326	6336	}
3327	6337	if ( preg_match( '/^[a-z_][a-z0-9_]*\($/i', $needle ) ) {
3328	6338	$fn = rtrim( $needle, '(' );
3329		- return (bool) preg_match( '/(?<![a-z0-9_])' . preg_quote( $fn, '/' ) . '\s*\(/i', $content );
	6339	+ return $this->found( '/(?<![a-z0-9_])' . preg_quote( $fn, '/' ) . '\s*+\(/i', $content );
3330	6340	}
3331	6341	return stripos( $content, $needle ) !== false;
3332	6342	}
3333	6343
		@@ -3345,25 +6355,266 @@
3345	6355	* @param int $window Maximum byte distance between a match of each.
3346	6356	* @return bool
3347	6357	*/
3348	6358	private function pattern_near( $content, $regex_a, $regex_b, $window ) {
3349		- if ( ! preg_match_all( $regex_a, $content, $m_a, PREG_OFFSET_CAPTURE ) ) {
	6359	+ // Both lists come in order, so they are walked together: the match
	6360	+ // that is behind moves on, and no pair is compared twice. Every match
	6361	+ // of one used to be compared with every match of the other.
	6362	+ $a = $this->next_match( $regex_a, $content, 0 );
	6363	+ $b = $this->next_match( $regex_b, $content, 0 );
	6364	+
	6365	+ while ( null !== $a && null !== $b ) {
	6366	+ if ( abs( $a[0][1] - $b[0][1] ) <= $window ) {
	6367	+ return true;
	6368	+ }
	6369	+
	6370	+ if ( $a[0][1] < $b[0][1] ) {
	6371	+ $a = $this->next_match( $regex_a, $content, $a[0][1] + 1 );
	6372	+ } else {
	6373	+ $b = $this->next_match( $regex_b, $content, $b[0][1] + 1 );
	6374	+ }
	6375	+ }
	6376	+
	6377	+ return false;
	6378	+ }
	6379	+
	6380	+ /**
	6381	+ * A text with its capital letters from A to Z in lower case, and nothing else
	6382	+ *
	6383	+ * strtolower() follows the language of the server until PHP 8.2, and in
	6384	+ * Turkish a capital I does not become an i: a function name written in
	6385	+ * capitals would not be found there.
	6386	+ *
	6387	+ * @param string $text Text.
	6388	+ * @return string
	6389	+ */
	6390	+ private static function lower_ascii( $text ) {
	6391	+ return strtr( (string) $text, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz' );
	6392	+ }
	6393	+
	6394	+ /**
	6395	+ * Whether an expression matches, without taking a search that gave up for a "no"
	6396	+ *
	6397	+ * preg_match() answers false, and not 0, when PCRE stops before the end
	6398	+ * because a long run used up the stack of its compiler or its
	6399	+ * backtracking limit. Read as "nothing found", that is a file that passes
	6400	+ * as clean without having been searched. Measured on what was published
	6401	+ * until now: a hexadecimal string of some 12,000 characters made the
	6402	+ * expression that looks for hexadecimal strings give up. Every expression
	6403	+ * of the search goes through here or through next_match(), and a file on
	6404	+ * which one of them gave up is reported as not searched (search_file()).
	6405	+ *
	6406	+ * @param string $regex Expression, with delimiters and flags.
	6407	+ * @param string $content Text to search.
	6408	+ * @return bool
	6409	+ */
	6410	+ private function found( $regex, $content ) {
	6411	+ $result = preg_match( $regex, $content );
	6412	+
	6413	+ if ( false === $result ) {
	6414	+ $this->search_failed = true;
	6415	+ }
	6416	+
	6417	+ return 1 === $result;
	6418	+ }
	6419	+
	6420	+ /**
	6421	+ * The next match of an expression from a position on
	6422	+ *
	6423	+ * For the checks that walk every match. Asked for one at a time they take
	6424	+ * no memory to speak of, where preg_match_all() held every match of the
	6425	+ * file at once.
	6426	+ *
	6427	+ * @param string $regex Expression, with delimiters and flags.
	6428	+ * @param string $content Text to search.
	6429	+ * @param int $offset Where to start.
	6430	+ * @return array|null The match as PREG_OFFSET_CAPTURE gives it, or null.
	6431	+ */
	6432	+ private function next_match( $regex, $content, $offset ) {
	6433	+ $match = array();
	6434	+ $result = preg_match( $regex, $content, $match, PREG_OFFSET_CAPTURE, $offset );
	6435	+
	6436	+ if ( false === $result ) {
	6437	+ $this->search_failed = true;
	6438	+ }
	6439	+
	6440	+ return 1 === $result ? $match : null;
	6441	+ }
	6442	+
	6443	+ /**
	6444	+ * Whether an expression matches in the code of a file and not only in its comments
	6445	+ *
	6446	+ * @param string $regex Expression, with delimiters and flags.
	6447	+ * @param string $content File content.
	6448	+ * @param string|false|null $code The content with its comments blanked. Worked
	6449	+ * out here the first time it is needed and kept
	6450	+ * by the caller; false when it cannot be.
	6451	+ * @return bool
	6452	+ */
	6453	+ private function found_in_code( $regex, $content, &$code ) {
	6454	+ if ( ! $this->found( $regex, $content ) ) {
3350	6455	return false;
3351	6456	}
3352		- if ( ! preg_match_all( $regex_b, $content, $m_b, PREG_OFFSET_CAPTURE ) ) {
	6457	+
	6458	+ if ( null === $code ) {
	6459	+ $code = $this->blank_comments( $content );
	6460	+ }
	6461	+
	6462	+ // When PHP cannot be asked what is a comment, the match stands.
	6463	+ return false === $code || $this->found( $regex, $code );
	6464	+ }
	6465	+
	6466	+ /**
	6467	+ * The content of a PHP file with its comments turned into blank space
	6468	+ *
	6469	+ * PHP itself says what is a comment (token_get_all()), so nothing that
	6470	+ * runs can be taken for one: a "//" comment ends at "?>", a string that
	6471	+ * holds "/*" opens nothing, and so on, without a second reader of the
	6472	+ * language here to get any of it wrong. Each comment is replaced by as
	6473	+ * many spaces as it had characters, line breaks kept, so the result is as
	6474	+ * long as the original and what was on one line stays on one line.
	6475	+ *
	6476	+ * Three cases are left as they are, and then the match stands:
	6477	+ *
	6478	+ * - A file with a "<?" that is not "<?php" or "<?=". Whether PHP reads
	6479	+ * that as an opening tag depends on short_open_tag, which may not be
	6480	+ * set the same for the PHP that runs this scan as for the one that
	6481	+ * serves the site, and with it changes where the code starts and so
	6482	+ * what is a comment.
	6483	+ * - A comment that starts with "#[". PHP 8 reads that as an attribute and
	6484	+ * runs what follows it on the line; PHP 7 reads the whole line as a
	6485	+ * comment.
	6486	+ * - A file whose tokens would not fit in the memory that is left, or
	6487	+ * would take more than 64 MB. PHP returns one array per token, up to
	6488	+ * 450 bytes each, and a file can be written so that every byte is one:
	6489	+ * 400 KB of that took 180 MB with PHP 7.4 (measured). How many tokens
	6490	+ * there can be is counted first, without making them.
	6491	+ * - Any file, when PHP is set to read its source in another encoding
	6492	+ * (zend.multibyte). In Shift JIS, Big5 or GBK the second byte of a
	6493	+ * character can be a backslash, so where a string ends is not where
	6494	+ * it ends for a reader that goes byte by byte.
	6495	+ *
	6496	+ * @param string $content File content.
	6497	+ * @return string|false The content without its comments, or false when it
	6498	+ * cannot be told what is a comment.
	6499	+ */
	6500	+ private function blank_comments( $content ) {
	6501	+ if ( ! function_exists( 'token_get_all' ) || ini_get( 'zend.multibyte' ) || preg_match( '/<\?(?!php[ \t\r\n]|=)/i', $content ) ) {
3353	6502	return false;
3354	6503	}
3355		- foreach ( $m_a[0] as $a ) {
3356		- foreach ( $m_b[0] as $b ) {
3357		- if ( abs( $a[1] - $b[1] ) <= $window ) {
3358		- return true;
3359		- }
	6504	+
	6505	+ // No more tokens than this: each character that is not part of a
	6506	+ // word can be one, and so can each run of digits and each word.
	6507	+ $words = 0;
	6508	+ $others = preg_replace( '/[a-z_\x80-\xff][a-z0-9_\x80-\xff]*+|[0-9]++/i', '', $content, -1, $words );
	6509	+
	6510	+ if ( null === $others ) {
	6511	+ return false;
	6512	+ }
	6513	+
	6514	+ $needed = 450 * ( strlen( $others ) + $words + 2 ) + strlen( $content );
	6515	+ $limit = wp_convert_hr_to_bytes( ini_get( 'memory_limit' ) );
	6516	+ unset( $others );
	6517	+
	6518	+ if ( $needed > 64 * MB_IN_BYTES || ( $limit > 0 && ( $limit - memory_get_usage() ) < $needed ) ) {
	6519	+ return false;
	6520	+ }
	6521	+
	6522	+ $tokens = @token_get_all( $content ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- PHP 7 warns about what it cannot read in the file being scanned, such as a comment left open; the warning says nothing about this code.
	6523	+ $code = '';
	6524	+ $length = 0;
	6525	+
	6526	+ foreach ( $tokens as $token ) {
	6527	+ $text = is_array( $token ) ? $token[1] : $token;
	6528	+ $length += strlen( $text );
	6529	+
	6530	+ if ( is_array( $token ) && ( T_COMMENT === $token[0] || T_DOC_COMMENT === $token[0] ) && 0 !== strpos( $text, '#[' ) ) {
	6531	+ $text = preg_replace( '/[^\n]/', ' ', $text );
3360	6532	}
	6533	+
	6534	+ $code .= $text;
3361	6535	}
3362		- return false;
	6536	+
	6537	+ // The pieces have to add up to the file. If they do not, the
	6538	+ // positions cannot be trusted and neither can the result.
	6539	+ if ( strlen( $content ) !== $length || strlen( $code ) !== $length ) {
	6540	+ return false;
	6541	+ }
	6542	+
	6543	+ return $code;
3363	6544	}
3364	6545
3365	6546	/**
	6547	+ * Search one file for hidden code
	6548	+ *
	6549	+ * The one place where a file is read for that. Each scan used to read it
	6550	+ * by itself, and only when it was under 512,000 bytes: a larger file was
	6551	+ * not opened, and where the file was not going to be listed anyway (a
	6552	+ * plugin or a theme with no official copy) that was the same as calling
	6553	+ * it clean. Padding a file was enough to keep it out of the results.
	6554	+ *
	6555	+ * @param string $file_path Absolute path.
	6556	+ * @param bool $strict Use strict mode (see detect_suspicious_pattern()).
	6557	+ * @return string|false|null The pattern found, false when the file was
	6558	+ * searched and has none, or null when it could
	6559	+ * not be searched: it is larger than
	6560	+ * MAX_SEARCHED_BYTES, it cannot be read, or an
	6561	+ * expression gave up on it. The caller reports
	6562	+ * that instead of taking it for clean.
	6563	+ */
	6564	+ private function search_file( $file_path, $strict = false ) {
	6565	+ if ( ! is_file( $file_path ) || ! is_readable( $file_path ) ) {
	6566	+ return null;
	6567	+ }
	6568	+
	6569	+ $size = filesize( $file_path );
	6570	+
	6571	+ if ( false === $size || $size > self::MAX_SEARCHED_BYTES ) {
	6572	+ return null;
	6573	+ }
	6574	+
	6575	+ // One byte past the cap and no more, whatever the size said: a file
	6576	+ // that grew since it was measured is not read whole.
	6577	+ $content = file_get_contents( $file_path, false, null, 0, self::MAX_SEARCHED_BYTES + 1 ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look for hidden code; nothing is written.
	6578	+
	6579	+ if ( false === $content || strlen( $content ) > self::MAX_SEARCHED_BYTES ) {
	6580	+ return null;
	6581	+ }
	6582	+
	6583	+ $this->search_failed = false;
	6584	+ $pattern = $this->detect_suspicious_pattern( $content, $strict );
	6585	+
	6586	+ if ( $pattern ) {
	6587	+ return $pattern;
	6588	+ }
	6589	+
	6590	+ return $this->search_failed ? null : false;
	6591	+ }
	6592	+
	6593	+ /**
	6594	+ * The finding for a PHP file with no official copy that could not be searched
	6595	+ *
	6596	+ * @param string $file_path Absolute path.
	6597	+ * @param string $relative Path for display.
	6598	+ * @return array
	6599	+ */
	6600	+ private function not_searched_item( $file_path, $relative ) {
	6601	+ $size = is_file( $file_path ) ? filesize( $file_path ) : false;
	6602	+ $reason = __( 'PHP file that could not be searched for hidden code', 'vigilante' );
	6603	+
	6604	+ if ( false !== $size && $size > self::MAX_SEARCHED_BYTES ) {
	6605	+ /* translators: %s: File size, such as 12 MB */
	6606	+ $reason = sprintf( __( 'PHP file of %s, too large to be searched for hidden code', 'vigilante' ), size_format( $size ) );
	6607	+ }
	6608	+
	6609	+ return array(
	6610	+ 'file' => $relative,
	6611	+ 'type' => 'not_searched',
	6612	+ 'reason' => $reason,
	6613	+ );
	6614	+ }
	6615	+
	6616	+ /**
3366	6617	* Whether a file is a text file worth normalizing before the fallback hash
3367	6618	* comparison in hash_matches_published().
3368	6619	*
3369	6620	* @param string $file_path Absolute path.
		@@ -3447,14 +6698,22 @@
3447	6698	private function detect_extra_files( $directory, $checksums, $type, $name, $suspicious_only = false ) {
3448	6699	$found = array(
3449	6700	'suspicious' => array(),
3450	6701	'extra' => array(),
	6702	+ 'errors' => array(),
	6703	+ 'php_files' => 0,
3451	6704	);
3452		- $max_extra = 50; // Limit to prevent timeout on large plugins
3453		- $count = 0;
	6705	+ // Every PHP file is examined. Until now the walk stopped after 50, which
	6706	+ // in a plugin or theme with no official copy meant the first 50 files
	6707	+ // of the folder and nothing else. Only the list of plain extra files is
	6708	+ // bounded, so a folder full of generated PHP cannot fill the results;
	6709	+ // hidden code is reported wherever it is.
	6710	+ $max_listed = 500;
	6711	+ $listed = 0;
	6712	+ $truncated = false;
3454	6713
3455	6714	// Only check PHP files for performance
3456		- $php_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar' );
	6715	+ $php_extensions = self::php_extensions();
3457	6716
3458	6717	// Pre-normalize the checksum keys once so path-shape differences
3459	6718	// (Windows backslashes, a leading "./", doubled slashes) don't make a
3460	6719	// known file look "extra" and get scanned or flagged. Case is preserved.
		@@ -3463,21 +6722,39 @@
3463	6722	$known_normalized[ $this->normalize_rel_path( $known_file ) ] = true;
3464	6723	}
3465	6724
3466	6725	try {
3467		- $iterator = new RecursiveIteratorIterator(
3468		- new RecursiveDirectoryIterator( $directory, RecursiveDirectoryIterator::SKIP_DOTS ),
3469		- RecursiveIteratorIterator::LEAVES_ONLY
3470		- );
3471		-
3472		- foreach ( $iterator as $file ) {
3473		- if ( $this->is_time_exceeded() || $count >= $max_extra ) {
	6726	+ foreach ( self::walk_folder( $directory ) as $file ) {
	6727	+ if ( $this->is_time_exceeded() ) {
3474	6728	break;
3475	6729	}
3476	6730
3477	6731	$file_path = $file->getPathname();
	6732	+
	6733	+ if ( $file->isDir() ) {
	6734	+ if ( ! $file->isReadable() ) {
	6735	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	6736	+ }
	6737	+ continue;
	6738	+ }
	6739	+
3478	6740	$extension = strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) );
3479	6741
	6742	+ // A .htaccess, .user.ini or php.ini that is not part of the
	6743	+ // published copy is looked at for what it makes the server do.
	6744	+ if ( in_array( strtolower( basename( $file_path ) ), array( '.htaccess', '.user.ini', 'php.ini' ), true ) ) {
	6745	+ $config_path = $this->normalize_rel_path( str_replace( str_replace( '\\', '/', $directory ) . '/', '', str_replace( '\\', '/', $file_path ) ) );
	6746	+
	6747	+ if ( ! isset( $known_normalized[ $config_path ] ) && ! $this->is_path_excluded( $file_path ) ) {
	6748	+ $config = self::server_config_finding( $file_path, str_replace( ABSPATH, '', $file_path ) );
	6749	+
	6750	+ if ( $config ) {
	6751	+ $found[ $config['category'] ][] = $config['item'];
	6752	+ }
	6753	+ }
	6754	+ continue;
	6755	+ }
	6756	+
3480	6757	// Only check PHP files
3481	6758	if ( ! in_array( $extension, $php_extensions, true ) ) {
3482	6759	continue;
3483	6760	}
		@@ -3505,18 +6782,15 @@
3505	6782	if ( $this->is_silence_golden_file( $file_path ) ) {
3506	6783	continue;
3507	6784	}
3508	6785
3509		- $count++;
	6786	+ $found['php_files']++;
	6787	+
3510	6788	$relative = str_replace( ABSPATH, '', $file_path );
3511		- $pattern = false;
3512	6789
3513	6790	// Check for suspicious content in extra files
3514	6791	// Use strict mode for plugins without checksums to avoid false positives
3515		- if ( $file->getSize() < 512000 ) { // Only scan files < 500KB
3516		- $content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
3517		- $pattern = $this->detect_suspicious_pattern( $content, $suspicious_only );
3518		- }
	6792	+ $pattern = $this->search_file( $file_path, $suspicious_only );
3519	6793
3520	6794	$item = array(
3521	6795	'file' => $relative,
3522	6796	$type => $name,
		@@ -3524,21 +6798,49 @@
3524	6798
3525	6799	if ( $pattern ) {
3526	6800	// Suspicious content: promote to suspicious category
3527	6801	$item['type'] = 'suspicious_' . $type;
3528		- /* translators: 1: Plugin or theme name, 2: Suspicious pattern found */
3529		- $item['reason'] = sprintf( __( 'Injected file in %1$s with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6802	+
	6803	+ // With an official copy to compare with, the file is known
	6804	+ // not to belong to it. Without one it may well be the
	6805	+ // plugin's own, so it is not called injected.
	6806	+ if ( $suspicious_only ) {
	6807	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	6808	+ $item['reason'] = sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6809	+ } else {
	6810	+ /* translators: 1: Plugin or theme name, 2: Suspicious pattern found */
	6811	+ $item['reason'] = sprintf( __( 'File that is not part of %1$s, with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6812	+ }
	6813	+
3530	6814	$found['suspicious'][] = $item;
3531	6815	} elseif ( ! $suspicious_only ) {
3532	6816	// No suspicious patterns and checksums available: report as extra
3533	6817	// Skipped in suspicious_only mode (no checksums) to avoid noise
	6818	+ if ( $listed >= $max_listed ) {
	6819	+ if ( ! $truncated ) {
	6820	+ $truncated = true;
	6821	+ $found['errors'][] = sprintf(
	6822	+ /* translators: 1: Plugin or theme name, 2: Number of files */
	6823	+ __( '%1$s has more extra files than can be listed: only the first %2$d are shown.', 'vigilante' ),
	6824	+ $name,
	6825	+ $max_listed
	6826	+ );
	6827	+ }
	6828	+ continue;
	6829	+ }
	6830	+
	6831	+ $listed++;
3534	6832	$item['type'] = 'extra_' . $type;
3535	6833	$item['reason'] = __( 'PHP file not present in original distribution', 'vigilante' );
3536	6834	$found['extra'][] = $item;
	6835	+ } elseif ( null === $pattern ) {
	6836	+ // No official copy to compare with, and the search could
	6837	+ // not look inside either: said, not passed over.
	6838	+ $found['extra'][] = $this->not_searched_item( $file_path, $relative );
3537	6839	}
3538	6840	}
3539	6841	} catch ( Exception $e ) {
3540		- // Ignore iterator errors
	6842	+ $found['errors'][] = self::unreadable_folder_error( $directory );
3541	6843	}
3542	6844
3543	6845	return $found;
3544	6846	}
		@@ -3571,9 +6873,14 @@
3571	6873	if ( false === $content ) {
3572	6874	return false;
3573	6875	}
3574	6876
3575		- $normalized = strtolower( trim( str_replace( array( "\r\n", "\r" ), "\n", $content ) ) );
	6877	+ // Every run of whitespace counts as one space, so the placeholder
	6878	+ // WordPress itself ships (the opening tag, a line break and the comment)
	6879	+ // matches the same entries as the one-line form. The comparison is
	6880	+ // still against the whole file: nothing can follow these few words, and
	6881	+ // no arrangement of them on several lines is code that runs.
	6882	+ $normalized = strtolower( trim( preg_replace( '/\s+/', ' ', $content ) ) );
3576	6883
3577	6884	$known = array(
3578	6885	'',
3579	6886	'<?php',
		@@ -3586,8 +6893,391 @@
3586	6893	return in_array( $normalized, $known, true );
3587	6894	}
3588	6895
3589	6896	/**
	6897	+ * Folders of the installation that hold plugins or themes
	6898	+ *
	6899	+ * @return array Relative path => true, for the plugins folder and every
	6900	+ * theme root that lies inside the WordPress directory.
	6901	+ */
	6902	+ private function code_roots() {
	6903	+ global $wp_theme_directories;
	6904	+
	6905	+ $roots = array();
	6906	+
	6907	+ foreach ( array_merge( array( WP_PLUGIN_DIR, get_theme_root() ), is_array( $wp_theme_directories ) ? $wp_theme_directories : array() ) as $root ) {
	6908	+ $root = untrailingslashit( str_replace( '\\', '/', (string) $root ) );
	6909	+
	6910	+ if ( '' !== $root && 0 === strpos( $root . '/', str_replace( '\\', '/', ABSPATH ) ) ) {
	6911	+ $roots[ $this->relative_path( $root ) ] = true;
	6912	+ }
	6913	+ }
	6914	+
	6915	+ return $roots;
	6916	+ }
	6917	+
	6918	+ /**
	6919	+ * What a partial scan offers to exclude, so that the next one reaches the rest
	6920	+ *
	6921	+ * The folders of the plugins and themes the scan did check, as lines for
	6922	+ * Excluded Paths, less the ones that are excluded by now. A scan starts
	6923	+ * from the beginning every time, so with these out of the way a scan
	6924	+ * run by hand spends its time on what the last one never got to. They
	6925	+ * have to come out of the list afterwards, and the tab says so for as
	6926	+ * long as they are there (see excluded_code_folders()).
	6927	+ *
	6928	+ * The list comes from stored results, and whoever reads it is told to
	6929	+ * paste it into the exclusions, so only what can be the folder of a
	6930	+ * plugin or of a theme is let through: one line with anything else in it
	6931	+ * would exclude far more than it says.
	6932	+ *
	6933	+ * @param mixed $results Scan results, as run_scan() returns them.
	6934	+ * @return array Relative paths, one per folder.
	6935	+ */
	6936	+ public function folders_to_exclude( $results ) {
	6937	+ $stored = is_array( $results ) && isset( $results['checked_folders'] ) && is_array( $results['checked_folders'] ) ? $results['checked_folders'] : array();
	6938	+ $roots = $this->code_roots();
	6939	+ $lines = array();
	6940	+
	6941	+ foreach ( $stored as $folder ) {
	6942	+ if ( ! is_string( $folder ) || 1 === preg_match( '/[\\x00-\\x1f\\x7f]/', $folder ) ) {
	6943	+ continue;
	6944	+ }
	6945	+
	6946	+ $folder = trim( str_replace( '\\', '/', $folder ), '/' );
	6947	+ $name = basename( $folder );
	6948	+
	6949	+ if ( '' === $name || '.' === $name || '..' === $name || ! isset( $roots[ dirname( $folder ) ] ) ) {
	6950	+ continue;
	6951	+ }
	6952	+
	6953	+ if ( ! is_dir( ABSPATH . $folder ) || $this->is_path_excluded( ABSPATH . $folder . '/.' ) ) {
	6954	+ continue;
	6955	+ }
	6956	+
	6957	+ $lines[ $folder ] = true;
	6958	+ }
	6959	+
	6960	+ return array_keys( $lines );
	6961	+ }
	6962	+
	6963	+ /**
	6964	+ * Whole folders of code, or the uploads folder, that Excluded Paths keeps out of every scan
	6965	+ *
	6966	+ * A subfolder of uploads or of a plugin is an ordinary exclusion (a cache
	6967	+ * of compiled templates, say). A whole plugin, a whole theme, the
	6968	+ * must-use plugins or all of uploads is something else: the scan comes
	6969	+ * out complete and clean without having looked there. The tab and
	6970	+ * Security Check go by this list, so that nobody is left thinking those
	6971	+ * folders are being watched.
	6972	+ *
	6973	+ * @return array Relative paths. A folder that holds others (the plugins
	6974	+ * folder, a theme root) stands for all of them.
	6975	+ */
	6976	+ public function excluded_code_folders() {
	6977	+ if ( empty( $this->options['excluded_paths'] ) || ! is_array( $this->options['excluded_paths'] ) ) {
	6978	+ return array();
	6979	+ }
	6980	+
	6981	+ if ( ! function_exists( 'get_plugins' ) ) {
	6982	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	6983	+ }
	6984	+
	6985	+ $found = array();
	6986	+ $roots = array_keys( $this->code_roots() );
	6987	+
	6988	+ foreach ( $roots as $root ) {
	6989	+ if ( $this->is_path_excluded( ABSPATH . $root . '/.' ) ) {
	6990	+ $found[ $root ] = true;
	6991	+ }
	6992	+ }
	6993	+
	6994	+ $plugins_root = $this->relative_path( WP_PLUGIN_DIR );
	6995	+
	6996	+ if ( ! isset( $found[ $plugins_root ] ) ) {
	6997	+ foreach ( array_keys( get_plugins() ) as $plugin_file ) {
	6998	+ $slug = dirname( $plugin_file );
	6999	+
	7000	+ if ( '.' !== $slug && $this->is_path_excluded( WP_PLUGIN_DIR . '/' . $slug . '/.' ) ) {
	7001	+ $found[ $this->relative_path( WP_PLUGIN_DIR . '/' . $slug ) ] = true;
	7002	+ }
	7003	+ }
	7004	+ }
	7005	+
	7006	+ foreach ( wp_get_themes() as $theme ) {
	7007	+ $dir = $theme->get_stylesheet_directory();
	7008	+
	7009	+ if ( ! isset( $found[ $this->relative_path( dirname( $dir ) ) ] ) && $this->is_path_excluded( $dir . '/.' ) ) {
	7010	+ $found[ $this->relative_path( $dir ) ] = true;
	7011	+ }
	7012	+ }
	7013	+
	7014	+ if ( defined( 'WPMU_PLUGIN_DIR' ) && is_dir( WPMU_PLUGIN_DIR ) && $this->is_path_excluded( WPMU_PLUGIN_DIR . '/.' ) ) {
	7015	+ $found[ $this->relative_path( WPMU_PLUGIN_DIR ) ] = true;
	7016	+ }
	7017	+
	7018	+ $uploads = wp_get_upload_dir();
	7019	+
	7020	+ if ( ! empty( $uploads['basedir'] ) && $this->is_path_excluded( $uploads['basedir'] . '/.' ) ) {
	7021	+ $found[ $this->relative_path( $uploads['basedir'] ) ] = true;
	7022	+ }
	7023	+
	7024	+ return array_keys( $found );
	7025	+ }
	7026	+
	7027	+ /**
	7028	+ * Whether a scan checked less than it was asked to
	7029	+ *
	7030	+ * Either it ran out of time, or something could not be read or compared
	7031	+ * (a folder, a plugin whose copy on WordPress.org could not be fetched).
	7032	+ * The tab, the scan email and Security Check go by this, so none of them
	7033	+ * calls clean a result that covers only part of the site.
	7034	+ *
	7035	+ * @param mixed $results Scan results, as run_scan() returns them.
	7036	+ * @return bool
	7037	+ */
	7038	+ public static function is_partial( $results ) {
	7039	+ return is_array( $results ) && ( ! empty( $results['incomplete'] ) || ! empty( $results['errors'] ) );
	7040	+ }
	7041	+
	7042	+ /**
	7043	+ * What a scan did not get to, one line per thing
	7044	+ *
	7045	+ * The one source of that text, for the tab, the scan email and anything
	7046	+ * else that shows the result of a scan. In the order of the scan.
	7047	+ *
	7048	+ * @param mixed $results Scan results, as run_scan() returns them.
	7049	+ * @return array Lines ready to show, not escaped. Empty when nothing was
	7050	+ * left out.
	7051	+ */
	7052	+ public static function not_checked_lines( $results ) {
	7053	+ $left = is_array( $results ) && isset( $results['not_checked'] ) && is_array( $results['not_checked'] ) ? $results['not_checked'] : array();
	7054	+
	7055	+ $areas = isset( $left['areas'] ) && is_array( $left['areas'] ) ? $left['areas'] : array();
	7056	+ $plugins = isset( $left['plugins'] ) && is_array( $left['plugins'] ) ? array_filter( array_map( 'strval', $left['plugins'] ), 'strlen' ) : array();
	7057	+ $themes = isset( $left['themes'] ) && is_array( $left['themes'] ) ? array_filter( array_map( 'strval', $left['themes'] ), 'strlen' ) : array();
	7058	+ $lines = array();
	7059	+
	7060	+ if ( in_array( 'uploads', $areas, true ) ) {
	7061	+ $lines[] = __( 'The uploads folder was not checked.', 'vigilante' );
	7062	+ }
	7063	+
	7064	+ if ( in_array( 'core', $areas, true ) ) {
	7065	+ $lines[] = __( 'The WordPress files were not checked completely.', 'vigilante' );
	7066	+ }
	7067	+
	7068	+ if ( in_array( 'config', $areas, true ) ) {
	7069	+ $lines[] = __( 'wp-config.php and .htaccess were not compared.', 'vigilante' );
	7070	+ }
	7071	+
	7072	+ if ( in_array( 'content', $areas, true ) ) {
	7073	+ $lines[] = __( 'The other folders of wp-content were not checked.', 'vigilante' );
	7074	+ }
	7075	+
	7076	+ if ( in_array( 'plugins', $areas, true ) ) {
	7077	+ $lines[] = __( 'No plugin was checked.', 'vigilante' );
	7078	+ } elseif ( ! empty( $plugins ) ) {
	7079	+ /* translators: %s: Comma separated list of plugin names */
	7080	+ $lines[] = sprintf( __( 'Plugins not checked: %s.', 'vigilante' ), implode( ', ', $plugins ) );
	7081	+ }
	7082	+
	7083	+ if ( in_array( 'unlisted', $areas, true ) ) {
	7084	+ $lines[] = __( 'Must-use plugins, drop-ins and loose PHP files were not checked.', 'vigilante' );
	7085	+ }
	7086	+
	7087	+ if ( in_array( 'themes', $areas, true ) ) {
	7088	+ $lines[] = __( 'No theme was checked.', 'vigilante' );
	7089	+ } elseif ( ! empty( $themes ) ) {
	7090	+ /* translators: %s: Comma separated list of theme names */
	7091	+ $lines[] = sprintf( __( 'Themes not checked: %s.', 'vigilante' ), implode( ', ', $themes ) );
	7092	+ }
	7093	+
	7094	+ return $lines;
	7095	+ }
	7096	+
	7097	+ /**
	7098	+ * Whether the scheduled scan has not finished for longer than it should
	7099	+ *
	7100	+ * A scan that PHP or the server stops halfway stores nothing, so the date
	7101	+ * of the last one that finished is the only sign left. Twice the interval
	7102	+ * and one day more, because WP-Cron only runs when the site has a visit.
	7103	+ *
	7104	+ * @param int $last_scan Time of the last stored scan, 0 for none.
	7105	+ * @param string $frequency 'daily' or 'weekly'.
	7106	+ * @return bool
	7107	+ */
	7108	+ public static function is_scan_overdue( $last_scan, $frequency ) {
	7109	+ $last_scan = (int) $last_scan;
	7110	+
	7111	+ if ( $last_scan <= 0 ) {
	7112	+ return false;
	7113	+ }
	7114	+
	7115	+ $every = 'weekly' === $frequency ? WEEK_IN_SECONDS : DAY_IN_SECONDS;
	7116	+
	7117	+ return ( time() - $last_scan ) > ( 2 * $every + DAY_IN_SECONDS );
	7118	+ }
	7119	+
	7120	+ /**
	7121	+ * What a kind of finding usually is, and what to do about it
	7122	+ *
	7123	+ * The one source of the text shown next to the findings of a scan, so the
	7124	+ * File Integrity tab and anything else that explains them say the same.
	7125	+ * Vigilant's own files have their own source,
	7126	+ * Vigilante_Self_Integrity_Guidance.
	7127	+ *
	7128	+ * @param string $type Finding type as stored in the scan results.
	7129	+ * @return array {
	7130	+ * @type string $label Name of the kind of finding, for a table cell.
	7131	+ * @type string $advice What it usually is and what to do. Empty for a
	7132	+ * type this method does not know.
	7133	+ * }
	7134	+ */
	7135	+ public static function finding_guidance( $type ) {
	7136	+ switch ( $type ) {
	7137	+ case 'php_in_uploads':
	7138	+ return array(
	7139	+ 'label' => __( 'PHP in uploads', 'vigilante' ),
	7140	+ 'advice' => __( 'Uploads is meant for media, not for code. It is normal only when a plugin you use writes PHP there, such as compiled templates or cache files: ignore the file, or add its folder to Excluded Paths if new ones keep appearing. If nothing you use explains it, treat it as malware.', 'vigilante' ),
	7141	+ );
	7142	+
	7143	+ case 'double_extension':
	7144	+ return array(
	7145	+ 'label' => __( 'Double extension', 'vigilante' ),
	7146	+ 'advice' => __( 'A name such as photo.php.jpg is a common way to pass a script off as an image. Delete it unless you know who or what uploaded it.', 'vigilante' ),
	7147	+ );
	7148	+
	7149	+ case 'htaccess_in_uploads':
	7150	+ return array(
	7151	+ 'label' => __( '.htaccess in uploads', 'vigilante' ),
	7152	+ 'advice' => __( 'A .htaccess here changes how the server treats this folder. One that only denies access is not listed. If it makes files run as code (AddHandler, SetHandler, php_value, Options ExecCGI) and you did not put it there, it is a sign of infection. If it only has rewrite rules, it usually belongs to an image or cache plugin, and it switches off for this folder the rule that blocks PHP in uploads.', 'vigilante' ),
	7153	+ );
	7154	+
	7155	+ case 'php_in_root':
	7156	+ return array(
	7157	+ 'label' => __( 'PHP in the site root', 'vigilante' ),
	7158	+ 'advice' => __( 'A PHP file next to wp-config.php that WordPress does not ship. Hosting tools, firewalls and verification scripts put files here, and so do attackers. Ignore it if you know where it comes from; if you do not, look at what it contains before anything else.', 'vigilante' ),
	7159	+ );
	7160	+
	7161	+ case 'extra_root':
	7162	+ return array(
	7163	+ 'label' => __( 'Extra file in the site root', 'vigilante' ),
	7164	+ 'advice' => __( 'WordPress does not ship this file. Verification files and the like are harmless. A copy of wp-config.php, a database dump or a backup archive here can be downloaded by anyone who guesses its name: move it out of the web root.', 'vigilante' ),
	7165	+ );
	7166	+
	7167	+ case 'legacy_core':
	7168	+ return array(
	7169	+ 'label' => __( 'Old core file', 'vigilante' ),
	7170	+ 'advice' => __( 'Left behind by an earlier version of WordPress. Nothing uses it any more and it can be deleted.', 'vigilante' ),
	7171	+ );
	7172	+
	7173	+ case 'suspicious_plugin':
	7174	+ case 'suspicious_theme':
	7175	+ return array(
	7176	+ 'label' => 'suspicious_theme' === $type ? __( 'Hidden code in a theme', 'vigilante' ) : __( 'Hidden code in a plugin', 'vigilante' ),
	7177	+ 'advice' => __( 'The file contains code written the way malware hides itself, and it is not part of the published copy, or there is no published copy to compare with. Some commercial plugins and themes obfuscate their own code and end up here. If you cannot tell, replace the plugin or theme with a clean copy from its author.', 'vigilante' ),
	7178	+ );
	7179	+
	7180	+ case 'extra_plugin':
	7181	+ case 'extra_theme':
	7182	+ return array(
	7183	+ 'label' => 'extra_theme' === $type ? __( 'Extra file in a theme', 'vigilante' ) : __( 'Extra file in a plugin', 'vigilante' ),
	7184	+ 'advice' => __( 'A PHP file that is not in the copy WordPress.org publishes for the installed version. Some plugins and themes create files after they are installed, and a manual fix adds them too. If you cannot explain it, reinstall the plugin or theme: that removes everything that does not belong to it.', 'vigilante' ),
	7185	+ );
	7186	+
	7187	+ case 'php_in_core':
	7188	+ return array(
	7189	+ 'label' => __( 'PHP in a WordPress folder', 'vigilante' ),
	7190	+ 'advice' => __( 'A PHP file in wp-admin or wp-includes that the installed version of WordPress does not ship. It is either left over from an older version or put there by someone: compare it with a clean copy of WordPress and delete it if it is not in it.', 'vigilante' ),
	7191	+ );
	7192	+
	7193	+ case 'config_in_core':
	7194	+ return array(
	7195	+ 'label' => __( 'Configuration file in a WordPress folder', 'vigilante' ),
	7196	+ 'advice' => __( 'A .htaccess, .user.ini or php.ini in wp-admin or wp-includes. A .htaccess that asks for a password in wp-admin is a common protection, and some hosts leave a php.ini there. A line with auto_prepend_file or auto_append_file loads a file on every request: make sure you know which one.', 'vigilante' ),
	7197	+ );
	7198	+
	7199	+ case 'php_config_in_uploads':
	7200	+ return array(
	7201	+ 'label' => __( 'PHP configuration in uploads', 'vigilante' ),
	7202	+ 'advice' => __( 'A .user.ini or php.ini here changes how PHP runs for this folder, and can make it load another file on every request. Nothing in uploads needs one: delete it unless you put it there.', 'vigilante' ),
	7203	+ );
	7204	+
	7205	+ case 'script_in_uploads':
	7206	+ return array(
	7207	+ 'label' => __( 'Script in uploads', 'vigilante' ),
	7208	+ 'advice' => __( 'A script in another language (shell, Perl, Python, CGI). It only runs if the server is told to run it, which a .htaccess in the same folder can do. Delete it unless you know why it is there.', 'vigilante' ),
	7209	+ );
	7210	+
	7211	+ case 'php_config_in_root':
	7212	+ return array(
	7213	+ 'label' => __( 'PHP configuration in the site root', 'vigilante' ),
	7214	+ 'advice' => __( 'This file makes PHP load another file before every request. Firewalls such as Wordfence set it up for themselves, and so do some hosts: check that the file it names is theirs. If nothing you installed needs it, that file runs before WordPress on every visit: treat it as a backdoor.', 'vigilante' ),
	7215	+ );
	7216	+
	7217	+ case 'backup_in_root':
	7218	+ return array(
	7219	+ 'label' => __( 'Backup in the site root', 'vigilante' ),
	7220	+ 'advice' => __( 'A copy of wp-config.php, a database dump or an archive next to WordPress can be downloaded by anyone who guesses its name, and it holds passwords or the whole site. Move it out of the web root or delete it.', 'vigilante' ),
	7221	+ );
	7222	+
	7223	+ case 'php_in_content':
	7224	+ return array(
	7225	+ 'label' => __( 'Loose PHP in wp-content', 'vigilante' ),
	7226	+ 'advice' => __( 'A PHP file, or a folder with PHP files, in wp-content or among the plugins or the themes, that WordPress does not list as a plugin, a theme or a drop-in. It does not show on the Plugins screen, and it can still be reached by its address. Some plugins keep a settings file there, WP Super Cache for one. If nothing you use explains it, look at what it contains.', 'vigilante' ),
	7227	+ );
	7228	+
	7229	+ case 'suspicious_content':
	7230	+ return array(
	7231	+ 'label' => __( 'Hidden code in wp-content', 'vigilante' ),
	7232	+ 'advice' => __( 'The file contains code written the way malware hides itself, in a folder of wp-content that belongs to no plugin and no theme. Cache, backup and security plugins keep files in folders like these, and what they store can look like this. Find out which one the folder belongs to. If nothing you use explains the file, treat it as malware.', 'vigilante' ),
	7233	+ );
	7234	+
	7235	+ case 'translation_with_code':
	7236	+ return array(
	7237	+ 'label' => __( 'Translation file with code', 'vigilante' ),
	7238	+ 'advice' => __( 'WordPress loads the translation files of the site language on every request, and a translation file holds text and nothing else. This one holds something more. Delete it and get the translations again from Dashboard > Updates. If it comes back, something on the site is writing it.', 'vigilante' ),
	7239	+ );
	7240	+
	7241	+ case 'not_searched':
	7242	+ return array(
	7243	+ 'label' => __( 'File not searched', 'vigilante' ),
	7244	+ 'advice' => __( 'The search for hidden code could not look inside this file, nearly always because it is very large, and there is no official copy to compare it with. A PHP file of that size is unusual. Check that it belongs to the plugin, the theme or the folder it is in, and ignore it if it does.', 'vigilante' ),
	7245	+ );
	7246	+
	7247	+ case 'server_config':
	7248	+ return array(
	7249	+ 'label' => __( 'Server configuration file', 'vigilante' ),
	7250	+ 'advice' => __( 'A .htaccess, .user.ini or php.ini outside uploads that makes the server run files as code or load a file on every request. Plugins rarely need one. If you cannot tell which one put it there, treat it as a sign of infection.', 'vigilante' ),
	7251	+ );
	7252	+
	7253	+ case 'core':
	7254	+ return array(
	7255	+ 'label' => __( 'WordPress core', 'vigilante' ),
	7256	+ 'advice' => __( 'Does not match the copy WordPress.org publishes for your version and language. For a file in wp-admin, wp-includes or the site root, reinstall WordPress from Dashboard > Updates and scan again. A file of a bundled theme or of Akismet, under wp-content, appears here after that theme or plugin updates on its own, which is normal.', 'vigilante' ),
	7257	+ );
	7258	+
	7259	+ case 'plugin':
	7260	+ case 'theme':
	7261	+ return array(
	7262	+ 'label' => 'theme' === $type ? __( 'Theme', 'vigilante' ) : __( 'Plugin', 'vigilante' ),
	7263	+ 'advice' => __( 'Does not match the copy WordPress.org publishes for the installed version. The usual causes are an update that did not finish, a release replaced on WordPress.org without a new version number, or a manual edit. Reinstall it; if the file changes again by itself, investigate.', 'vigilante' ),
	7264	+ );
	7265	+
	7266	+ case 'critical_config':
	7267	+ return array(
	7268	+ 'label' => __( 'Configuration file', 'vigilante' ),
	7269	+ 'advice' => __( 'Changed since you last approved it. Cache, security and redirection plugins rewrite their own blocks in these files, often on every update, and that shows up here too. Review the changes and approve them if they belong to something you use. Lines you cannot explain, above all the ones that load a file or send requests to one, need a closer look.', 'vigilante' ),
	7270	+ );
	7271	+ }
	7272	+
	7273	+ return array(
	7274	+ 'label' => (string) $type,
	7275	+ 'advice' => '',
	7276	+ );
	7277	+ }
	7278	+
	7279	+ /**
3590	7280	* Check if a path is excluded from scanning
3591	7281	*
3592	7282	* @param string $path File path.
3593	7283	* @return bool
		@@ -3737,8 +7427,39 @@
3737	7427	return array_values(
3738	7428	array_filter(
3739	7429	$items,
3740	7430	function ( $item ) {
	7431	+ /*
	7432	+ * On a network, wp-config.php and the root .htaccess are not a
	7433	+ * site's to silence: a change to them is closed by approving it,
	7434	+ * and approving takes a network administrator since 2.11.3. The
	7435	+ * ignore list is an option of each site, so until 2.11.8 the
	7436	+ * administrator of the main site without network rights hid a
	7437	+ * pending change from the network administrator's own screen by
	7438	+ * posting the file name to the ignore handler.
	7439	+ */
	7440	+ if ( is_multisite() && is_array( $item ) && 'critical_config' === ( $item['type'] ?? '' ) ) {
	7441	+ return true;
	7442	+ }
	7443	+
	7444	+ // Findings about the manifest and the version of Vigilant
	7445	+ // itself are not about one file, so no entry of the list may
	7446	+ // hide them, on a single site either: ignoring the row of
	7447	+ // MANIFEST.sha256 took a replaced manifest out of the email.
	7448	+ // Vigilante_Self_Integrity::filter_ignored_findings() keeps
	7449	+ // them the same way.
	7450	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) && in_array( $item['self_finding'] ?? '', array( 'manifest_replaced', 'manifest_unverified', 'manifest_missing', 'manifest_invalid', 'self_downgraded' ), true ) ) {
	7451	+ return true;
	7452	+ }
	7453	+ // Nor the findings of the walk of Vigilant's folder (a folder
	7454	+ // that cannot be listed, the folder that could not be walked):
	7455	+ // their path ends in a slash, and ignoring that row left the
	7456	+ // scan with no row and no email while the self-protection
	7457	+ // status stayed critical.
	7458	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) && '/' === substr( (string) ( $item['file'] ?? '' ), -1 ) ) {
	7459	+ return true;
	7460	+ }
	7461	+
3741	7462	$file = is_array( $item ) && isset( $item['file'] ) ? $item['file'] : '';
3742	7463	return ! in_array( $file, $this->ignored_files, true );
3743	7464	}
3744	7465	)
		@@ -3759,32 +7480,25 @@
3759	7480	*/
3760	7481	private function maybe_send_notification( $results ) {
3761	7482	$options = is_array( $this->options ) ? $this->options : array();
3762	7483
3763		- // Count critical_config separately from regular modified so we can treat it
3764		- // as "serious" for notification level purposes (same tier as suspicious/extra).
3765		- $has_critical_config = false;
3766		- foreach ( $results['modified'] ?? array() as $item ) {
3767		- if ( is_array( $item ) && isset( $item['type'] ) && 'critical_config' === $item['type'] ) {
3768		- $has_critical_config = true;
3769		- break;
3770		- }
3771		- }
3772		-
3773		- // Collect closed/removed plugins (excluding ignored slugs). These count
3774		- // as "serious" for notification purposes: a closed plugin in wp.org is
3775		- // a security-critical finding, same tier as a suspicious file.
	7484	+ // Closed/removed plugins (excluding ignored slugs) travel in this
	7485	+ // email, in the same tier as a suspicious file.
3776	7486	$closed_plugins = $this->collect_closed_plugins_for_email();
3777		- $has_closed = ! empty( $closed_plugins );
3778	7487
3779		- $has_suspicious = ! empty( $results['suspicious'] ) || ! empty( $results['extra'] ) || $has_critical_config || $has_closed;
3780		- $has_modified = ! empty( $results['modified'] );
	7488	+ /*
	7489	+ * Self-protection is not part of this decision. Its alert is its own
	7490	+ * and no setting switches it off, so this email is about the files of
	7491	+ * the site: core, plugins, themes, uploads and the two shared
	7492	+ * configuration files. Missing files do not send it on their own: it
	7493	+ * has no section to list them in.
	7494	+ */
3781	7495
3782		- // Instant alert: send for suspicious, extra, critical_config, modified
3783		- // files, or closed plugins.
3784		- $instant_alert = ! empty( $options['instant_alert'] );
3785		- if ( $instant_alert && ( $has_suspicious || $has_modified ) ) {
3786		- $this->send_notification( $results, 'all', $closed_plugins );
	7496	+ // Instant alert: every finding travels, modified files included,
	7497	+ // whatever the level below says. A scan with nothing to report goes
	7498	+ // through as well, so that what was reported is forgotten.
	7499	+ if ( ! empty( $options['instant_alert'] ) ) {
	7500	+ $this->send_new_findings( $results, 'all', $closed_plugins );
3787	7501	return;
3788	7502	}
3789	7503
3790	7504	// Determine notify level with backward compatibility
		@@ -3799,22 +7513,142 @@
3799	7513	}
3800	7514	}
3801	7515
3802	7516	if ( 'disabled' === $notify_level ) {
	7517	+ // Nothing is sent, and nothing stays on record as reported:
	7518	+ // whoever switches the email back on is told about everything
	7519	+ // that is pending then.
	7520	+ delete_option( self::NOTIFIED_OPTION );
3803	7521	return;
3804	7522	}
3805	7523
3806	7524	// 'suspicious_only' treats suspicious/extra, critical_config AND closed
3807		- // plugins as serious.
3808		- if ( 'suspicious_only' === $notify_level && ! $has_suspicious ) {
	7525	+ // plugins as serious. A scan with nothing to send at this level still
	7526	+ // goes through send_new_findings(), which then forgets what it had
	7527	+ // reported, so a finding that goes away and comes back is new again.
	7528	+ $this->send_new_findings( $results, $notify_level, $closed_plugins );
	7529	+ }
	7530	+
	7531	+ /**
	7532	+ * What the scan email has already reported to the recipients
	7533	+ */
	7534	+ const NOTIFIED_OPTION = 'vigilante_integrity_notified';
	7535	+
	7536	+ /**
	7537	+ * Send the scan email only when the scan found something new
	7538	+ *
	7539	+ * Until now the email went out after every scan for as long as a finding
	7540	+ * was still listed, so a plugin that rewrote its block in .htaccess meant
	7541	+ * the same alert every day until somebody approved the change. Now every
	7542	+ * finding is reported once: the email goes out when a scan finds something
	7543	+ * the recipients have not been told about, and it lists everything that is
	7544	+ * pending, old and new.
	7545	+ *
	7546	+ * A finding is the file, its kind and its content (by its hash), so a
	7547	+ * file that changes again under the same name is new, also when the
	7548	+ * change keeps its size and its date. What goes away is forgotten, so it
	7549	+ * is new again if it comes back. Nothing is recorded when the email could
	7550	+ * not be sent, and the next scan tries again.
	7551	+ *
	7552	+ * @param array $results Scan results.
	7553	+ * @param string $notify_level 'all' or 'suspicious_only'.
	7554	+ * @param array $closed_plugins Closed plugins, keyed by slug.
	7555	+ */
	7556	+ private function send_new_findings( $results, $notify_level, $closed_plugins ) {
	7557	+ $keys = $this->notification_keys( $results, $closed_plugins, 'all' === $notify_level );
	7558	+ $told = get_option( self::NOTIFIED_OPTION, array() );
	7559	+ $told = is_array( $told ) ? $told : array();
	7560	+
	7561	+ // A partial scan cannot tell whether what it did not reach is still
	7562	+ // there, so it forgets nothing: with the findings of an unchecked
	7563	+ // plugin forgotten, the next scan that reached it would report them
	7564	+ // again as new, and on a site whose scans are always partial that
	7565	+ // is the same email over and over.
	7566	+ $known = self::is_partial( $results ) ? array_values( array_unique( array_merge( $keys, $told ) ) ) : $keys;
	7567	+
	7568	+ // The record is bounded, and the comparison is not: what does not fit
	7569	+ // in the record is reported again, never left out. The keys come in
	7570	+ // order of importance, so what does not fit is the least of it.
	7571	+ $record = array_slice( $known, 0, 5000 );
	7572	+
	7573	+ if ( empty( array_diff( $keys, $told ) ) ) {
	7574	+ if ( count( $record ) !== count( $told ) ) {
	7575	+ update_option( self::NOTIFIED_OPTION, $record, false );
	7576	+ }
3809	7577	return;
3810	7578	}
3811	7579
3812		- if ( ! $has_suspicious && ! $has_modified ) {
3813		- return;
	7580	+ if ( $this->send_notification( $results, $notify_level, $closed_plugins ) ) {
	7581	+ update_option( self::NOTIFIED_OPTION, $record, false );
3814	7582	}
	7583	+ }
3815	7584
3816		- $this->send_notification( $results, $notify_level, $closed_plugins );
	7585	+ /**
	7586	+ * One key per finding the scan email would carry at this level
	7587	+ *
	7588	+ * @param array $results Scan results.
	7589	+ * @param array $closed_plugins Closed plugins, keyed by slug.
	7590	+ * @param bool $with_modified Whether files that are only modified travel
	7591	+ * in the email at this level.
	7592	+ * @return array
	7593	+ */
	7594	+ private function notification_keys( $results, $closed_plugins, $with_modified ) {
	7595	+ $keys = array(
	7596	+ 'config' => array(),
	7597	+ 'closed' => array(),
	7598	+ 'suspicious' => array(),
	7599	+ 'modified' => array(),
	7600	+ 'extra' => array(),
	7601	+ );
	7602	+
	7603	+ foreach ( (array) ( $results['modified'] ?? array() ) as $item ) {
	7604	+ if ( ! is_array( $item ) ) {
	7605	+ continue;
	7606	+ }
	7607	+
	7608	+ $type = (string) ( $item['type'] ?? '' );
	7609	+ $config = 'critical_config' === $type;
	7610	+
	7611	+ // Vigilant's own files have their own alert.
	7612	+ if ( 'vigilante_self' === $type || ( ! $config && ! $with_modified ) ) {
	7613	+ continue;
	7614	+ }
	7615	+
	7616	+ $keys[ $config ? 'config' : 'modified' ][] = md5( 'modified|' . $type . '|' . (string) ( $item['file'] ?? '' ) . '|' . (string) ( $item['actual_hash'] ?? '' ) );
	7617	+ }
	7618	+
	7619	+ foreach ( (array) $closed_plugins as $slug => $info ) {
	7620	+ $keys['closed'][] = md5( 'closed|' . $slug . '|' . ( is_array( $info ) ? (string) ( $info['state'] ?? '' ) : '' ) );
	7621	+ }
	7622	+
	7623	+ foreach ( array( 'suspicious', 'extra' ) as $bucket ) {
	7624	+ foreach ( (array) ( $results[ $bucket ] ?? array() ) as $item ) {
	7625	+ $type = is_array( $item ) ? (string) ( $item['type'] ?? '' ) : '';
	7626	+
	7627	+ if ( 'vigilante_self' === $type ) {
	7628	+ continue;
	7629	+ }
	7630	+
	7631	+ $file = is_array( $item ) ? (string) ( $item['file'] ?? '' ) : (string) $item;
	7632	+ $state = '';
	7633	+ $path = ABSPATH . ltrim( $file, '/' );
	7634	+
	7635	+ // By content, so a file rewritten with the same size and the
	7636	+ // same date is still a different file. The ones too large to
	7637	+ // hash on every scan go by size, date and the time of their
	7638	+ // last change of any kind, which writing to a file moves and
	7639	+ // which cannot be set back the way the date can.
	7640	+ if ( '' !== $file && is_file( $path ) ) {
	7641	+ $state = filesize( $path ) <= MB_IN_BYTES ? (string) md5_file( $path ) : filesize( $path ) . ':' . filemtime( $path ) . ':' . filectime( $path );
	7642	+ }
	7643	+
	7644	+ $keys[ $bucket ][] = md5( $bucket . '|' . $type . '|' . $file . '|' . $state );
	7645	+ }
	7646	+ }
	7647	+
	7648	+ // In order of importance: only the first 5,000 are remembered, and
	7649	+ // what is not remembered is reported again.
	7650	+ return array_values( array_unique( array_merge( $keys['config'], $keys['closed'], $keys['suspicious'], $keys['modified'], $keys['extra'] ) ) );
3817	7651	}
3818	7652
3819	7653	/**
3820	7654	* Collect the closed/removed plugins (excluding ignored slugs) so they can
		@@ -3849,8 +7683,10 @@
3849	7683	'suspicious' => array_merge( $results1['suspicious'] ?? array(), $results2['suspicious'] ?? array() ),
3850	7684	'extra' => array_merge( $results1['extra'] ?? array(), $results2['extra'] ?? array() ),
3851	7685	'new' => $results1['new'] ?? array(),
3852	7686	'errors' => array_merge( $results1['errors'] ?? array(), $results2['errors'] ?? array() ),
	7687	+ // Plugins and themes with no official copy to compare with.
	7688	+ 'unverified' => array_merge( $results1['unverified'] ?? array(), $results2['unverified'] ?? array() ),
3853	7689	'scan_time' => $results1['scan_time'] ?? 0,
3854	7690	'incomplete' => $results1['incomplete'] ?? false,
3855	7691	);
3856	7692	}
		@@ -3896,8 +7732,37 @@
3896	7732	$regular_modified[] = $item;
3897	7733	}
3898	7734	}
3899	7735
	7736	+ /*
	7737	+ * Self-protection does not travel in this email any more: it has its own
	7738	+ * alert, which no setting switches off (Vigilante_Self_Integrity::
	7739	+ * maybe_send_self_alert()). Older stored results can still carry its
	7740	+ * rows, so they are dropped here instead of being listed as ordinary
	7741	+ * files.
	7742	+ */
	7743	+ foreach ( array( 'suspicious', 'extra', 'missing' ) as $self_bucket ) {
	7744	+ if ( empty( $results[ $self_bucket ] ) || ! is_array( $results[ $self_bucket ] ) ) {
	7745	+ continue;
	7746	+ }
	7747	+ $results[ $self_bucket ] = array_values(
	7748	+ array_filter(
	7749	+ $results[ $self_bucket ],
	7750	+ function ( $item ) {
	7751	+ return ! ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) );
	7752	+ }
	7753	+ )
	7754	+ );
	7755	+ }
	7756	+ $regular_modified = array_values(
	7757	+ array_filter(
	7758	+ $regular_modified,
	7759	+ function ( $item ) {
	7760	+ return ! ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) );
	7761	+ }
	7762	+ )
	7763	+ );
	7764	+
3900	7765	$suspicious_count = count( $results['suspicious'] ?? array() );
3901	7766	$extra_count = count( $results['extra'] ?? array() );
3902	7767	$critical_config_count = count( $critical_config );
3903	7768	$modified_count = count( $regular_modified );
		@@ -3902,16 +7767,31 @@
3902	7767	$critical_config_count = count( $critical_config );
3903	7768	$modified_count = count( $regular_modified );
3904	7769	$closed_count = count( $closed_plugins );
3905	7770
3906		- // Use more urgent subject when suspicious files, critical config changes
3907		- // or closed plugins are found (all three are security-critical).
3908		- if ( $suspicious_count > 0 || $critical_config_count > 0 || $closed_count > 0 ) {
	7771	+ // The subject says what was found. Suspicious files and closed plugins
	7772	+ // keep the alert wording. A change in wp-config.php or .htaccess with
	7773	+ // nothing else next to it names the files instead: most of the time it
	7774	+ // is a plugin rewriting its own block, and "SECURITY ALERT" on every
	7775	+ // one of those taught people to read the subject as "I was hacked".
	7776	+ if ( $suspicious_count > 0 || $closed_count > 0 ) {
3909	7777	$subject = sprintf(
3910	7778	/* translators: %s: Site name */
3911	7779	__( '[%s] SECURITY ALERT: File integrity issues detected', 'vigilante' ),
3912	7780	$site_name
3913	7781	);
	7782	+ } elseif ( $critical_config_count > 0 ) {
	7783	+ $changed = array();
	7784	+ foreach ( $critical_config as $item ) {
	7785	+ $changed[] = (string) ( $item['file'] ?? '' );
	7786	+ }
	7787	+
	7788	+ $subject = sprintf(
	7789	+ /* translators: 1: Site name, 2: The file that changed, or both of them, such as "wp-config.php, .htaccess" */
	7790	+ __( '[%1$s] %2$s changed: review needed', 'vigilante' ),
	7791	+ $site_name,
	7792	+ implode( ', ', array_unique( array_filter( $changed ) ) )
	7793	+ );
3914	7794	} else {
3915	7795	$subject = sprintf(
3916	7796	/* translators: %s: Site name */
3917	7797	__( '[%s] File integrity issues detected', 'vigilante' ),
		@@ -3946,9 +7826,9 @@
3946	7826	// Suspicious files section
3947	7827	if ( ! empty( $results['suspicious'] ) ) {
3948	7828	$inner .= $this->get_section_html(
3949	7829	__( 'Suspicious files', 'vigilante' ),
3950		- __( 'These files may contain malicious code. Review immediately.', 'vigilante' ),
	7830	+ __( 'Files that can run code where none is expected, or that contain code written the way malware hides itself. Some are harmless, such as cache files a plugin generates or a .htaccess that protects a folder: check the path and the reason before acting.', 'vigilante' ),
3951	7831	$results['suspicious'],
3952	7832	'#d63638',
3953	7833	'#fef1f1',
3954	7834	20,
		@@ -3959,9 +7839,9 @@
3959	7839	// Extra files section
3960	7840	if ( ! empty( $results['extra'] ) ) {
3961	7841	$inner .= $this->get_section_html(
3962	7842	__( 'Extra files', 'vigilante' ),
3963		- __( 'PHP files not in the original WordPress.org distribution.', 'vigilante' ),
	7843	+ __( 'Files that are not part of WordPress, or of the plugin or theme they sit in. Many are legitimate. A copy of wp-config.php or a database dump in the site root should be moved out of it.', 'vigilante' ),
3964	7844	$results['extra'],
3965	7845	'#b32d2e',
3966	7846	'#fdf6f4',
3967	7847	20,
		@@ -3972,9 +7852,9 @@
3972	7852	// Critical config files section (wp-config.php, .htaccess modified outside Vigilante)
3973	7853	if ( ! empty( $critical_config ) ) {
3974	7854	$inner .= $this->get_section_html(
3975	7855	__( 'Critical config files modified', 'vigilante' ),
3976		- __( 'These files are common targets for code injection. Review the changes and approve if they are legitimate.', 'vigilante' ),
	7856	+ __( 'Changed since you last approved them. Cache, security and redirection plugins rewrite their own blocks in these files, often on every update, and attackers write to them too. Review the changes and approve them if they belong to something you use.', 'vigilante' ),
3977	7857	$critical_config,
3978	7858	'#e36210',
3979	7859	'#fdf2e6',
3980	7860	10,
		@@ -3985,9 +7865,9 @@
3985	7865	// Modified files section (only if notify_level is 'all')
3986	7866	if ( 'all' === $notify_level && ! empty( $regular_modified ) ) {
3987	7867	$inner .= $this->get_section_html(
3988	7868	__( 'Modified files', 'vigilante' ),
3989		- __( 'Checksum mismatch with WordPress.org originals.', 'vigilante' ),
	7869	+ __( 'These files do not match the copy WordPress.org publishes for the installed version. Reinstalling the plugin, the theme or WordPress brings the original back.', 'vigilante' ),
3990	7870	$regular_modified,
3991	7871	'#dba617',
3992	7872	'#fdf8e8',
3993	7873	15,
		@@ -4002,8 +7882,31 @@
4002	7882	if ( $closed_count > 0 ) {
4003	7883	$inner .= $this->build_closed_plugins_email_section( $closed_plugins );
4004	7884	}
4005	7885
	7886	+ // A partial scan says so and names what it did not get to. With no
	7887	+ // finding in a plugin that was never looked at, silence here read as
	7888	+ // "that plugin is fine".
	7889	+ if ( self::is_partial( $results ) ) {
	7890	+ $partial_lines = array_merge(
	7891	+ array_slice( array_map( 'strval', (array) ( $results['errors'] ?? array() ) ), 0, 10 ),
	7892	+ self::not_checked_lines( $results )
	7893	+ );
	7894	+
	7895	+ $inner .= '<p style="margin:0 0 8px;font-size:13px;color:#1d2327;"><strong>' . esc_html__( 'The last scan could not check everything, so its result is partial.', 'vigilante' ) . '</strong></p>';
	7896	+ $inner .= '<ul style="margin:0 0 16px 18px;padding:0;font-size:13px;color:#50575e;">';
	7897	+
	7898	+ foreach ( $partial_lines as $partial_line ) {
	7899	+ $inner .= '<li>' . esc_html( $partial_line ) . '</li>';
	7900	+ }
	7901	+
	7902	+ $inner .= '</ul>';
	7903	+ }
	7904	+
	7905	+ // Where the explanation is. The email stays a list; what each kind of
	7906	+ // finding usually is and what to do about it lives next to the results.
	7907	+ $inner .= '<p style="margin:0 0 16px;font-size:12px;color:#50575e;">' . esc_html__( 'File Integrity explains what each kind of finding usually is and what to do about it. A finding stays listed until you approve it, ignore it or fix it.', 'vigilante' ) . '</p>';
	7908	+
4006	7909	// CTA button
4007	7910	$inner .= Vigilante_Email_Template::button(
4008	7911	admin_url( 'admin.php?page=vigilante&tab=file-integrity#vigilante-section-fi-last-scan' ),
4009	7912	__( 'Review in Vigilant', 'vigilante' )
		@@ -4009,13 +7912,20 @@
4009	7912	__( 'Review in Vigilant', 'vigilante' )
4010	7913	);
4011	7914
4012	7915	$is_alert = ( $suspicious_count > 0 || $critical_config_count > 0 || $closed_count > 0 );
4013		- $title = $is_alert
4014		- ? __( 'Security alert', 'vigilante' )
4015		- : __( 'File integrity report', 'vigilante' );
4016	7916
4017		- Vigilante_Email_Template::send( $to, $subject, $title, $inner, $is_alert );
	7917	+ // Same three cases as the subject.
	7918	+ if ( $suspicious_count > 0 || $closed_count > 0 ) {
	7919	+ $title = __( 'Security alert', 'vigilante' );
	7920	+ } elseif ( $critical_config_count > 0 ) {
	7921	+ $title = __( 'Configuration file changed', 'vigilante' );
	7922	+ } else {
	7923	+ $title = __( 'File integrity report', 'vigilante' );
	7924	+ }
	7925	+
	7926	+ // The caller records what was reported only when the email went out.
	7927	+ return (bool) Vigilante_Email_Template::send( $to, $subject, $title, $inner, $is_alert );
4018	7928	}
4019	7929
4020	7930	/**
4021	7931	* Build the closed + removed plugins block for the scan email.
		@@ -4140,16 +8050,32 @@
4140	8050
4141	8051	/**
4142	8052	* Add a file to the ignored list
4143	8053	*
	8054	+ * The path is stored exactly as it comes: the callers are the AJAX
	8055	+ * handlers, which have already read it and checked it against the shared
	8056	+ * files and Vigilant's own, and the scan compares the stored strings with
	8057	+ * the paths it finds one by one (in_array(), strict). This used to run
	8058	+ * sanitize_text_field() over it, which deletes every %XX octet and collapses
	8059	+ * repeated spaces, so the entry never matched the file it was made for
	8060	+ * (measured on 1 oct 2026 against 3.0.1). Anything that is not a plain
	8061	+ * string, is empty or carries tags is not a path and is refused. That guards
	8062	+ * a direct caller: the AJAX handlers read the path with wp_strip_all_tags()
	8063	+ * first, which shortens a name with a stray < instead of handing it over
	8064	+ * intact (see ajax_ignore_file()).
	8065	+ *
4144	8066	* @param string $file_path Relative file path to ignore.
4145	8067	* @return bool
4146	8068	*/
4147	8069	public function ignore_file( $file_path ) {
	8070	+ if ( ! is_string( $file_path ) || '' === $file_path || wp_strip_all_tags( $file_path ) !== $file_path ) {
	8071	+ return false;
	8072	+ }
	8073	+
4148	8074	$ignored = get_option( 'vigilante_ignored_files', array() );
4149	8075
4150	8076	if ( ! in_array( $file_path, $ignored, true ) ) {
4151		- $ignored[] = sanitize_text_field( $file_path );
	8077	+ $ignored[] = $file_path;
4152	8078	return update_option( 'vigilante_ignored_files', $ignored );
4153	8079	}
4154	8080
4155	8081	return true;