← All changes | includes/class-file-integrity.php +5344 -353 2.11.2 → 3.0.4 View file →

		@@ -68,15 +68,50 @@
68	68	*/
69	69	private $scan_start_time = 0;
70	70
71	71	/**
	72	+ * Seconds a scan runs for at most
	73	+ *
	74	+ * A scan is one request, and it starts from the beginning every time. On
	75	+ * a site too large for this, what comes last is left unchecked on every
	76	+ * scan, so the results say what was not reached (see not_checked_lines()).
	77	+ */
	78	+ const MAX_SCAN_SECONDS = 60;
	79	+
	80	+ /**
72	81	* Maximum scan time in seconds (default 60s for thorough scanning)
73	82	*
74	83	* @var int
75	84	*/
76		- private $max_scan_time = 60;
	85	+ private $max_scan_time = self::MAX_SCAN_SECONDS;
77	86
78	87	/**
	88	+ * Largest file the search for hidden code reads, in bytes
	89	+ *
	90	+ * It used to be 512,000, and a larger file was not opened at all: in a
	91	+ * plugin with no official copy that left it out of the results as if it
	92	+ * were clean. There is still a cap because the file is read whole, but
	93	+ * what is above it is reported as not searched instead of being passed
	94	+ * over (see search_file()).
	95	+ */
	96	+ const MAX_SEARCHED_BYTES = 8388608;
	97	+
	98	+ /**
	99	+ * Seconds a scan gives to the folders of wp-content that belong to nothing
	100	+ *
	101	+ * @var int
	102	+ */
	103	+ private $content_folders_time = 10;
	104	+
	105	+ /**
	106	+ * Whether an expression of the search for hidden code gave up on the file
	107	+ * being searched (see found())
	108	+ *
	109	+ * @var bool
	110	+ */
	111	+ private $search_failed = false;
	112	+
	113	+ /**
79	114	* Option name for critical files baseline hashes.
80	115	*
81	116	* @var string
82	117	*/
		@@ -89,8 +124,73 @@
89	124	*/
90	125	const BASELINE_REDACTION_OPTION = 'vigilante_baseline_redaction';
91	126
92	127	/**
	128	+ * Network option recording that the one-off sweep of per-site baselines ran.
	129	+ *
	130	+ * @since 2.11.3
	131	+ */
	132	+ const BASELINE_SWEEP_OPTION = 'vigilante_baseline_sweep';
	133	+
	134	+ /**
	135	+ * The migration the sweep marker stands for.
	136	+ *
	137	+ * A literal, not VIGILANTE_VERSION, and the difference is the whole point.
	138	+ * 2.11.3 stored the running version, so every release after it rearmed the
	139	+ * sweep: the first dashboard load on the main site walked the network with
	140	+ * switch_to_blog() to find nothing, because there was nothing left to find,
	141	+ * for ever, at the price of the one walk the marker exists to avoid.
	142	+ *
	143	+ * A plain boolean would fix that too, and would also leave no way to fire a
	144	+ * second network sweep the day another migration needs one. A literal costs
	145	+ * nothing today and keeps that door open. The redaction marker keeps the
	146	+ * running version on purpose: there the point IS to run again when the list
	147	+ * of what has to be redacted grows, and the cost of reopening it is one
	148	+ * option read rather than a walk of the network.
	149	+ *
	150	+ * And it must be a value NO version ever wrote into this option. The first
	151	+ * draft used '2.11.3', which is precisely what 2.11.3 wrote there, as its
	152	+ * own VIGILANTE_VERSION and BEFORE starting the walk: out in the wild that
	153	+ * value means "started, maybe unfinished". Reading it as "finished" left
	154	+ * every network whose 2.11.3 walk was cut short unswept for good, subsites
	155	+ * still holding the database password and the eight keys. Reproduced on the
	156	+ * Multisite install by a third cross review. The price of the new value is
	157	+ * that networks that did finish in 2.11.3 walk once more and find nothing.
	158	+ *
	159	+ * @since 2.11.4
	160	+ */
	161	+ const BASELINE_SWEEP_MIGRATION = 'network-sweep-done';
	162	+
	163	+ /**
	164	+ * Network option with the fingerprint of every block Vigilant itself wrote
	165	+ * into wp-config.php or the root .htaccess.
	166	+ *
	167	+ * The integrity scan leaves Vigilant's own blocks out of the hash, so that
	168	+ * rewriting them is not reported as somebody else's change. Until 2.11.5 it
	169	+ * left out whatever sat between the markers, without looking. From 2.11.5 a
	170	+ * block is left out only if its content is exactly what Vigilant wrote, as
	171	+ * recorded here at write time.
	172	+ *
	173	+ * @since 2.11.5
	174	+ */
	175	+ const OWNED_BLOCKS_OPTION = 'vigilante_owned_blocks';
	176	+
	177	+ /**
	178	+ * Network option marking that the blocks already on disk have been claimed.
	179	+ *
	180	+ * @since 2.11.5
	181	+ */
	182	+ const OWNED_BLOCKS_CLAIM_OPTION = 'vigilante_owned_blocks_claim';
	183	+
	184	+ /**
	185	+ * Value stored when the claim is done. Deliberately not a version number:
	186	+ * that is the lesson of BASELINE_SWEEP_MIGRATION above.
	187	+ *
	188	+ * @since 2.11.5
	189	+ */
	190	+ const OWNED_BLOCKS_CLAIMED = 'claimed';
	191	+
	192	+ /**
93	193	* What replaces a secret value kept in the baseline.
94	194	*
95	195	* Fixed forever: if this string ever changes, every stored baseline
96	196	* suddenly differs from the freshly redacted file and every site reports a
		@@ -100,13 +200,16 @@
100	200	*/
101	201	const REDACTED_MARKER = '[redacted by Vigilant]';
102	202
103	203	/**
104		- * Constant names whose value never reaches the database.
	204	+ * Constant names whose value is checked even where the file does not name them
105	205	*
106		- * The eight WordPress keys and salts and the database credentials, plus
107		- * anything whose name reads like a credential, since a real wp-config.php
108		- * collects SMTP passwords, S3 keys and API tokens over the years.
	206	+ * The eight WordPress keys and salts and the database credentials. Until
	207	+ * 2.11.7 this list, plus names that read like a credential, was what got
	208	+ * redacted, and a real wp-config.php collects secrets under any name:
	209	+ * FTP_PASS, SMTP passwords, cloud keys inside serialize( array( ... ) ),
	210	+ * any const. Since 2.11.8 every value is redacted and this list only feeds
	211	+ * the output check of baseline_content().
109	212	*
110	213	* @since 2.11.2
111	214	*
112	215	* @var string[]
		@@ -117,8 +220,183 @@
117	220	'AUTH_SALT', 'SECURE_AUTH_SALT', 'LOGGED_IN_SALT', 'NONCE_SALT',
118	221	);
119	222
120	223	/**
	224	+ * Core constants whose value stays readable in the baseline copy
	225	+ *
	226	+ * Where the site lives, where its folders are, how much memory it gets:
	227	+ * none of it is a secret and all of it is what a diff of wp-config.php is
	228	+ * read for. Every other value is redacted. A list of what is secret can
	229	+ * never be complete, which is how 2.11.2 to 2.11.7 missed FTP_PASS; a list
	230	+ * of what is not can be short and still be right.
	231	+ *
	232	+ * @since 2.11.8
	233	+ *
	234	+ * @var string[]
	235	+ */
	236	+ private static $readable_constants = array(
	237	+ 'ABSPATH', 'WPINC', 'WP_HOME', 'WP_SITEURL', 'WP_CONTENT_DIR', 'WP_CONTENT_URL',
	238	+ 'WP_PLUGIN_DIR', 'WP_PLUGIN_URL', 'WPMU_PLUGIN_DIR', 'WPMU_PLUGIN_URL', 'UPLOADS',
	239	+ 'WP_LANG_DIR', 'WP_TEMP_DIR', 'WP_DEBUG_LOG', 'WP_MEMORY_LIMIT', 'WP_MAX_MEMORY_LIMIT',
	240	+ 'WP_ENVIRONMENT_TYPE', 'WP_DEVELOPMENT_MODE', 'WP_AUTO_UPDATE_CORE', 'FS_METHOD',
	241	+ 'DB_CHARSET', 'DB_COLLATE', 'DOMAIN_CURRENT_SITE', 'PATH_CURRENT_SITE', 'NOBLOGREDIRECT',
	242	+ 'COOKIE_DOMAIN', 'COOKIEPATH', 'SITECOOKIEPATH', 'ADMIN_COOKIE_PATH', 'PLUGINS_COOKIE_PATH',
	243	+ 'WP_DEFAULT_THEME', 'WPLANG',
	244	+ // Numeric core settings. Since 2.11.10 a number in the value of a
	245	+ // define() is redacted like any other value, so the ones that are known
	246	+ // not to be credentials are listed here to keep the diff useful.
	247	+ 'AUTOSAVE_INTERVAL', 'WP_POST_REVISIONS', 'EMPTY_TRASH_DAYS', 'WP_CRON_LOCK_TIMEOUT',
	248	+ 'FS_CHMOD_DIR', 'FS_CHMOD_FILE', 'SITE_ID_CURRENT_SITE', 'BLOG_ID_CURRENT_SITE',
	249	+ );
	250	+
	251	+ /**
	252	+ * Read the critical files baseline, from where it belongs
	253	+ *
	254	+ * Both watched files, wp-config.php and the root .htaccess, belong to the
	255	+ * whole network: there is one of each per installation, not one per site.
	256	+ * Keeping the baseline in a per-site option meant every site of a network
	257	+ * stored its own copy of the same wp-config.php, so a network of fifty
	258	+ * sites held fifty copies of the same credentials, and a cleanup that ran
	259	+ * on one site left the other forty nine untouched. Reported by @calzbert on
	260	+ * 10 sep 2026 and reproduced on the Multisite install. Since 2.11.3 there
	261	+ * is one baseline per network.
	262	+ *
	263	+ * No is_multisite() branch on purpose, and this is worth reading before
	264	+ * anyone adds one back: the core functions already make the distinction.
	265	+ * Verified in the installed core, wp-includes/option.php, where
	266	+ * get_network_option() falls back to get_option() on a single site and
	267	+ * update_network_option() falls back to update_option( $option, $value,
	268	+ * false ), autoload already off, which is exactly what this needs. Two
	269	+ * branches doing the same thing are two branches that can drift apart,
	270	+ * and one of them did during this very change.
	271	+ *
	272	+ * @since 2.11.3
	273	+ *
	274	+ * @return array
	275	+ */
	276	+ private function read_baseline() {
	277	+ $baseline = get_site_option( self::BASELINE_OPTION, array() );
	278	+
	279	+ return is_array( $baseline ) ? $baseline : array();
	280	+ }
	281	+
	282	+ /**
	283	+ * Store the critical files baseline where read_baseline() looks for it
	284	+ *
	285	+ * @since 2.11.3
	286	+ *
	287	+ * @param array $baseline Baseline to store.
	288	+ * @return bool
	289	+ */
	290	+ private function write_baseline( $baseline ) {
	291	+ return update_site_option( self::BASELINE_OPTION, $baseline );
	292	+ }
	293	+
	294	+ /**
	295	+ * Fingerprint of a block exactly as the integrity scan reads it back
	296	+ *
	297	+ * @since 2.11.5
	298	+ *
	299	+ * @param string $block Block from start marker to end marker, inclusive.
	300	+ * @return string
	301	+ */
	302	+ private static function block_fingerprint( $block ) {
	303	+ return md5( str_replace( array( "\r\n", "\r" ), "\n", (string) $block ) );
	304	+ }
	305	+
	306	+ /**
	307	+ * Record a block Vigilant has just written
	308	+ *
	309	+ * Called by the writers right after a verified write, so the scan can tell
	310	+ * Vigilant's block from anything else carrying the same markers. By default
	311	+ * it replaces the earlier record for that marker: after a write, only the
	312	+ * block just written is Vigilant's.
	313	+ *
	314	+ * @since 2.11.5
	315	+ *
	316	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	317	+ * @param string $marker_start Start marker of the block.
	318	+ * @param string $block Block from start marker to end marker, inclusive.
	319	+ * @param bool $replace Drop earlier records for the same marker first.
	320	+ * @return bool
	321	+ */
	322	+ public static function remember_owned_block( $filename, $marker_start, $block, $replace = true ) {
	323	+ $owned = get_site_option( self::OWNED_BLOCKS_OPTION, array() );
	324	+ $owned = is_array( $owned ) ? $owned : array();
	325	+ $file = ( isset( $owned[ $filename ] ) && is_array( $owned[ $filename ] ) ) ? $owned[ $filename ] : array();
	326	+
	327	+ if ( $replace ) {
	328	+ foreach ( $file as $fingerprint => $marker ) {
	329	+ if ( $marker === $marker_start ) {
	330	+ unset( $file[ $fingerprint ] );
	331	+ }
	332	+ }
	333	+ }
	334	+
	335	+ $file[ self::block_fingerprint( $block ) ] = $marker_start;
	336	+ $owned[ $filename ] = $file;
	337	+
	338	+ return update_site_option( self::OWNED_BLOCKS_OPTION, $owned );
	339	+ }
	340	+
	341	+ /**
	342	+ * Forget the blocks recorded for a marker, once Vigilant has removed them
	343	+ *
	344	+ * @since 2.11.5
	345	+ *
	346	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	347	+ * @param string $marker_start Start marker of the block.
	348	+ * @return bool
	349	+ */
	350	+ public static function forget_owned_blocks( $filename, $marker_start ) {
	351	+ $owned = get_site_option( self::OWNED_BLOCKS_OPTION, array() );
	352	+
	353	+ if ( ! is_array( $owned ) || empty( $owned[ $filename ] ) || ! is_array( $owned[ $filename ] ) ) {
	354	+ return true;
	355	+ }
	356	+
	357	+ $changed = false;
	358	+
	359	+ foreach ( $owned[ $filename ] as $fingerprint => $marker ) {
	360	+ if ( $marker === $marker_start ) {
	361	+ unset( $owned[ $filename ][ $fingerprint ] );
	362	+ $changed = true;
	363	+ }
	364	+ }
	365	+
	366	+ return $changed ? update_site_option( self::OWNED_BLOCKS_OPTION, $owned ) : true;
	367	+ }
	368	+
	369	+ /**
	370	+ * Whether a block is one Vigilant wrote
	371	+ *
	372	+ * @since 2.11.5
	373	+ *
	374	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	375	+ * @param string $block Block from start marker to end marker, inclusive.
	376	+ * @return bool
	377	+ */
	378	+ private static function is_owned_block( $filename, $block ) {
	379	+ $owned = get_site_option( self::OWNED_BLOCKS_OPTION, array() );
	380	+
	381	+ return is_array( $owned )
	382	+ && isset( $owned[ $filename ] )
	383	+ && is_array( $owned[ $filename ] )
	384	+ && isset( $owned[ $filename ][ self::block_fingerprint( $block ) ] );
	385	+ }
	386	+
	387	+ /**
	388	+ * Whether the blocks already on disk have been claimed
	389	+ *
	390	+ * @since 2.11.5
	391	+ *
	392	+ * @return bool
	393	+ */
	394	+ private function owned_blocks_claimed() {
	395	+ return self::OWNED_BLOCKS_CLAIMED === get_site_option( self::OWNED_BLOCKS_CLAIM_OPTION );
	396	+ }
	397	+
	398	+ /**
121	399	* The baseline copy of a critical file, with no secret in it
122	400	*
123	401	* The integrity scan keeps a copy of wp-config.php so it can show which
124	402	* lines changed. Until 2.11.1 that copy was the file itself minus the
		@@ -138,35 +416,61 @@
138	416	* @param string $normalized Normalized content.
139	417	* @return string Content safe to store, or '' when it cannot be made safe.
140	418	*/
141	419	private function baseline_content( $filename, $normalized ) {
	420	+ if ( '.htaccess' === $filename ) {
	421	+ return $this->redact_server_secrets( $normalized );
	422	+ }
	423	+
142	424	if ( 'wp-config.php' !== $filename ) {
143	425	return $normalized;
144	426	}
145	427
146		- $redacted = $this->redact_secrets( $normalized );
	428	+ // Calculados una sola vez: los usa la redaccion (para no conservar un
	429	+ // numero que ademas este en vigor) y el control de salida de abajo.
	430	+ $live_values = $this->values_in_force( $normalized );
	431	+ $redacted = $this->redact_secrets( $normalized, $live_values );
147	432
148	433	/*
149		- * Belt and braces, and this is the part that matters: the regular
150		- * expression above is the thing most likely to miss a shape nobody
151		- * thought of, and the cost of missing one is a secret in the database.
152		- * So the result is checked against the values actually in force, and
153		- * if any of them survived, nothing is stored at all. The scan then
154		- * reports the change without a line diff, which the interface already
155		- * handles, instead of leaking.
	434	+ * Belt and braces, and this is the part that matters: the redaction
	435	+ * above is the thing most likely to miss a shape nobody thought of,
	436	+ * and the cost of missing one is a secret in the database. So the
	437	+ * result is checked against the values actually in force, and if any
	438	+ * of them survived, nothing is stored at all. The scan then reports the
	439	+ * change without a line diff, which the interface already handles,
	440	+ * instead of leaking.
156	441	*
	442	+ * Until 2.11.7 the check covered the twelve constants of WordPress and
	443	+ * nothing else, so a value the regular expression missed went straight
	444	+ * through it. It now covers every constant the file names and every
	445	+ * environment variable it reads.
	446	+ *
	447	+ * It runs against the copy that is actually stored. A value in force
	448	+ * that sits inside the value of a readable constant, such as a Redis
	449	+ * prefix equal to the domain inside WP_HOME, is not a secret left
	450	+ * behind, so that one alone is not looked for; without that, every such
	451	+ * site would lose its diff. The first version of this checked a
	452	+ * stricter copy instead, and a secret inside a kept include path went
	453	+ * straight past it (cross review of 2.11.8).
	454	+ *
157	455	* Only values of eight characters or more are checked: DB_NAME is
158	456	* often something like "local" or "wp", and looking for that inside a
159	457	* PHP file matches by accident every time.
160	458	*/
161		- foreach ( self::$secret_constants as $name ) {
162		- if ( ! defined( $name ) ) {
163		- continue;
	459	+ if ( '' === $redacted ) {
	460	+ return '';
	461	+ }
	462	+
	463	+ $shown = $this->readable_values_in_force();
	464	+
	465	+ foreach ( $live_values as $value ) {
	466	+ foreach ( $shown as $readable ) {
	467	+ if ( false !== strpos( $readable, $value ) ) {
	468	+ continue 2;
	469	+ }
164	470	}
165	471
166		- $value = (string) constant( $name );
167		-
168		- if ( strlen( $value ) >= 8 && false !== strpos( $redacted, $value ) ) {
	472	+ if ( false !== strpos( $redacted, $value ) ) {
169	473	return '';
170	474	}
171	475	}
172	476
		@@ -173,51 +477,884 @@
173	477	return $redacted;
174	478	}
175	479
176	480	/**
177		- * Replace the value of every credential-looking define with a marker
	481	+ * Replace every value in wp-config.php with a marker
178	482	*
179		- * Keeps the line and the constant name, so the diff still shows that a
180		- * credential line was touched, and drops only the value.
	483	+ * Reads the file as PHP tokens and replaces every string in it: quoted,
	484	+ * with variables inside, heredoc and nowdoc. What stays is what names a
	485	+ * thing rather than holding it: the name passed to define(), defined(),
	486	+ * constant() and getenv(), the name in putenv( 'NAME=value' ), array keys,
	487	+ * an index such as $_ENV['NAME'], and strings of a single character that
	488	+ * are not the value of a define(). Also the value of the constants in
	489	+ * $readable_constants, the table prefix and a path passed to require or
	490	+ * include, which are not secrets and are what a diff of this file is read
	491	+ * for. A path is kept only while it looks like one, and only up to where
	492	+ * its expression ends.
181	493	*
	494	+ * Until 2.11.7 this was a regular expression over define() with a list of
	495	+ * names, and it missed FTP_PASS, SMTP passwords, cloud keys inside
	496	+ * serialize( array( ... ) ), every const and every value read with a
	497	+ * fallback. Measured while preparing 2.11.8: 10 of 15 real shapes stored
	498	+ * their secret.
	499	+ *
	500	+ * The marker always goes in single quotes, whatever the original used, so
	501	+ * a copy redacted by an earlier version and the same file redacted today
	502	+ * read the same line for line.
	503	+ *
182	504	* @since 2.11.2
	505	+ * @since 2.11.8 Reads tokens and redacts every value.
183	506	*
184	507	* @param string $content Normalized wp-config.php content.
	508	+ * @return string Redacted content, or '' when it cannot be read as tokens.
	509	+ */
	510	+ private function redact_secrets( $content, $live_values = array() ) {
	511	+ if ( ! function_exists( 'token_get_all' ) ) {
	512	+ return '';
	513	+ }
	514	+
	515	+ $marker = "'" . self::REDACTED_MARKER . "'";
	516	+ $tokens = self::merged_tokens( token_get_all( (string) $content ) );
	517	+ $count = count( $tokens );
	518	+ $names = defined( 'T_NAME_FULLY_QUALIFIED' ) ? array( T_STRING, T_NAME_FULLY_QUALIFIED ) : array( T_STRING );
	519	+ $includes = array( T_INCLUDE, T_INCLUDE_ONCE, T_REQUIRE, T_REQUIRE_ONCE );
	520	+ $out = '';
	521	+ $depth = 0;
	522	+ $keep_until = -1;
	523	+ $define_at = -1;
	524	+ $in_include = false;
	525	+ $include_depth = 0;
	526	+ $include_ends = array( T_CLOSE_TAG, T_BOOLEAN_OR, T_BOOLEAN_AND, T_LOGICAL_OR, T_LOGICAL_AND, T_COALESCE );
	527	+
	528	+ for ( $i = 0; $i < $count; $i++ ) {
	529	+ list( $type, $text, $plain ) = $tokens[ $i ];
	530	+
	531	+ if ( '(' === $type ) {
	532	+ $depth++;
	533	+ } elseif ( ')' === $type ) {
	534	+ // The closing parenthesis of a readable define(), or of any define().
	535	+ if ( $depth === $keep_until ) {
	536	+ $keep_until = -1;
	537	+ }
	538	+ if ( $depth === $define_at ) {
	539	+ $define_at = -1;
	540	+ }
	541	+ $depth--;
	542	+
	543	+ // A parenthesis that closes around the include ends its path.
	544	+ if ( $in_include && $depth < $include_depth ) {
	545	+ $in_include = false;
	546	+ }
	547	+ } elseif ( in_array( $type, $includes, true ) ) {
	548	+ $in_include = true;
	549	+ $include_depth = $depth;
	550	+ } elseif ( $in_include && ( in_array( $type, array( ';', '{', '}', '?', ':', ',' ), true ) || in_array( $type, $include_ends, true ) ) ) {
	551	+ /*
	552	+ * The path of an include ends where its expression does. The
	553	+ * first version of this only ended it at ';', so the value in
	554	+ * `( include 'db.php' ) || define( 'FTP_PASS', '...' )`, in a
	555	+ * ternary after require, or after a closing tag, was kept.
	556	+ * Found by the cross review of 2.11.8.
	557	+ */
	558	+ $in_include = false;
	559	+ }
	560	+
	561	+ if ( T_COMMENT === $type || T_DOC_COMMENT === $type ) {
	562	+ $out .= $this->redact_comment( $text );
	563	+ continue;
	564	+ }
	565	+
	566	+ if ( T_INLINE_HTML === $type ) {
	567	+ $out .= ( '' === trim( $text ) ) ? $text : $marker;
	568	+ continue;
	569	+ }
	570	+
	571	+ /*
	572	+ * A value that is not a quoted string is still a value. Until
	573	+ * 2.11.10 only string tokens were looked at, so
	574	+ * define( 'SERVICE_TOKEN', 12345678 ) put the live token in the copy
	575	+ * kept in the database. Reported by the wp.org automated review of
	576	+ * 2.11.9.
	577	+ *
	578	+ * The first fix here redacted a number only in the value position of
	579	+ * a define(), which is the shape that was reported and not the shape
	580	+ * of the problem. The second cross review of 2.11.10 measured nine
	581	+ * more: a negative number, one in parentheses, one inside
	582	+ * array( ... ), one in a ternary, a const, and four that are not
	583	+ * constants at all and so the output check cannot catch either, the
	584	+ * worst of them the documented way of configuring Redis,
	585	+ * $redis_server = array( 'auth' => 12345678 ). So a number is now
	586	+ * treated like a string: redacted unless the place it sits in is one
	587	+ * of the few that cannot hold a credential, which is how the rest of
	588	+ * this function has been written since 2.11.8 (a list of what may be
	589	+ * shown, never a list of what is secret).
	590	+ *
	591	+ * Losing a number from the diff costs little and buys the same trade
	592	+ * as everywhere else: the hash still covers the whole file, so a
	593	+ * change is detected even where the diff can no longer show it. The
	594	+ * numeric core settings are in $readable_constants so the diff of a
	595	+ * normal wp-config.php keeps saying what it used to.
	596	+ */
	597	+ if ( T_LNUMBER === $type || T_DNUMBER === $type ) {
	598	+ $nprev = self::significant_token( $tokens, $i, -1 );
	599	+ $nnext = self::significant_token( $tokens, $i, 1 );
	600	+ $nptype = ( null === $nprev ) ? null : $tokens[ $nprev ][0];
	601	+ $nntype = ( null === $nnext ) ? null : $tokens[ $nnext ][0];
	602	+ $nbefore = ( '[' === $nptype ) ? self::significant_token( $tokens, $nprev, -1 ) : null;
	603	+ $nbtoken = ( null === $nbefore ) ? array( null, null ) : $tokens[ $nbefore ];
	604	+ $nvalue = ( -1 !== $define_at && $depth === $define_at && ',' === $nptype );
	605	+
	606	+ $nkeep = $keep_until >= 0
	607	+ || T_DOUBLE_ARROW === $nntype
	608	+ || ( '[' === $nptype && ']' === $nntype && in_array( $nbtoken[0], array( T_VARIABLE, T_STRING, ']', ')', '}' ), true ) )
	609	+ || ( strlen( $text ) <= 1 && ! $nvalue );
	610	+
	611	+ /*
	612	+ * Except when that same number is a value actually in force. The
	613	+ * positions kept above are kept because a credential does not live
	614	+ * in them, which is true, but it says nothing about the number
	615	+ * itself: with
	616	+ * define( 'SERVICE_TOKEN', 12345678 );
	617	+ * $a = $config[12345678];
	618	+ * the value was redacted in the define and kept in the index, so it
	619	+ * survived, and the output check below did what it is there for and
	620	+ * threw the whole copy away. No leak, but the diff of that
	621	+ * wp-config.php was lost for good, which is the regression 2.11.8
	622	+ * fixed, coming back through the numbers added in 2.11.10. Found by
	623	+ * the third cross review.
	624	+ *
	625	+ * Strings are deliberately NOT treated this way: there, a value in
	626	+ * force sitting in a kept position (an include path, an array key)
	627	+ * can BE the secret, and losing the diff is the right answer. It is
	628	+ * what poc/wpconfig-baseline-secretos.sh checks and it stays.
	629	+ */
	630	+ if ( $nkeep && in_array( $text, $live_values, true ) ) {
	631	+ $nkeep = false;
	632	+ }
	633	+
	634	+ $out .= $nkeep ? $text : $marker;
	635	+ continue;
	636	+ }
	637	+
	638	+ if ( 'string' !== $type ) {
	639	+ $out .= $text;
	640	+ continue;
	641	+ }
	642	+
	643	+ $prev = self::significant_token( $tokens, $i, -1 );
	644	+ $next = self::significant_token( $tokens, $i, 1 );
	645	+ $ptype = ( null === $prev ) ? null : $tokens[ $prev ][0];
	646	+ $ntype = ( null === $next ) ? null : $tokens[ $next ][0];
	647	+ $call = ( '(' === $ptype ) ? self::significant_token( $tokens, $prev, -1 ) : null;
	648	+ $inner = $plain ? substr( $text, 1, -1 ) : null;
	649	+
	650	+ if ( $plain && null !== $call && in_array( $tokens[ $call ][0], $names, true ) ) {
	651	+ $function = strtolower( ltrim( $tokens[ $call ][1], '\\' ) );
	652	+
	653	+ if ( in_array( $function, array( 'define', 'defined', 'constant', 'getenv' ), true ) ) {
	654	+ if ( 'define' === $function ) {
	655	+ $define_at = $depth;
	656	+
	657	+ if ( in_array( $inner, self::$readable_constants, true ) ) {
	658	+ $keep_until = $depth;
	659	+ }
	660	+ }
	661	+ $out .= $text;
	662	+ continue;
	663	+ }
	664	+
	665	+ if ( 'putenv' === $function && false !== strpos( $inner, '=' ) ) {
	666	+ $out .= "'" . substr( $inner, 0, strpos( $inner, '=' ) + 1 ) . self::REDACTED_MARKER . "'";
	667	+ continue;
	668	+ }
	669	+ }
	670	+
	671	+ // The token before an opening bracket or an assignment, when there is one.
	672	+ $before = ( '[' === $ptype || '=' === $ptype ) ? self::significant_token( $tokens, $prev, -1 ) : null;
	673	+ $btoken = ( null === $before ) ? array( null, null ) : $tokens[ $before ];
	674	+
	675	+ /*
	676	+ * The value of a define() is redacted whatever its length, as it was
	677	+ * up to 2.11.7, so an empty password reads the same in a copy stored
	678	+ * then as in today's; the first version of this kept strings of one
	679	+ * character there and a file awaiting review showed credential lines
	680	+ * nobody had touched (cross review of 2.11.8).
	681	+ */
	682	+ $is_define_value = ( -1 !== $define_at && $depth === $define_at && ',' === $ptype );
	683	+ $is_path = $in_include && $plain
	684	+ && preg_match( '#^[A-Za-z0-9_./\-]+$#', (string) $inner )
	685	+ && ( false !== strpos( (string) $inner, '/' ) || '.php' === substr( (string) $inner, -4 ) );
	686	+
	687	+ $keep = ( $plain && strlen( $inner ) <= 1 && ! $is_define_value )
	688	+ || T_DOUBLE_ARROW === $ntype
	689	+ || ( '[' === $ptype && ']' === $ntype && in_array( $btoken[0], array( T_VARIABLE, T_STRING, ']', ')', '}' ), true ) )
	690	+ || $keep_until >= 0
	691	+ || $is_path
	692	+ || ( '=' === $ptype && ';' === $ntype && T_VARIABLE === $btoken[0] && '$table_prefix' === $btoken[1] );
	693	+
	694	+ $out .= $keep ? $text : $marker;
	695	+ }
	696	+
	697	+ return $out;
	698	+ }
	699	+
	700	+ /**
	701	+ * PHP tokens with every string folded into a single token
	702	+ *
	703	+ * The tokenizer splits a string with variables inside, a heredoc and a
	704	+ * backtick command into several tokens. For the redaction each of them is
	705	+ * one value, so they come back as a single token of type 'string'. The
	706	+ * third field says whether it is a plain quoted literal.
	707	+ *
	708	+ * @since 2.11.8
	709	+ *
	710	+ * @param array $raw Output of token_get_all().
	711	+ * @return array List of array( type, text, plain ).
	712	+ */
	713	+ private static function merged_tokens( $raw ) {
	714	+ $tokens = array();
	715	+ $count = count( $raw );
	716	+
	717	+ for ( $i = 0; $i < $count; $i++ ) {
	718	+ $token = $raw[ $i ];
	719	+
	720	+ if ( '"' === $token || '`' === $token ) {
	721	+ $text = $token;
	722	+ for ( $i++; $i < $count; $i++ ) {
	723	+ $text .= is_array( $raw[ $i ] ) ? $raw[ $i ][1] : $raw[ $i ];
	724	+ if ( $raw[ $i ] === $token ) {
	725	+ break;
	726	+ }
	727	+ }
	728	+ $tokens[] = array( 'string', $text, false );
	729	+ continue;
	730	+ }
	731	+
	732	+ if ( is_array( $token ) && T_START_HEREDOC === $token[0] ) {
	733	+ $text = $token[1];
	734	+ for ( $i++; $i < $count; $i++ ) {
	735	+ $text .= is_array( $raw[ $i ] ) ? $raw[ $i ][1] : $raw[ $i ];
	736	+ if ( is_array( $raw[ $i ] ) && T_END_HEREDOC === $raw[ $i ][0] ) {
	737	+ break;
	738	+ }
	739	+ }
	740	+ $tokens[] = array( 'string', $text, false );
	741	+ continue;
	742	+ }
	743	+
	744	+ // An unterminated string comes back as T_ENCAPSED_AND_WHITESPACE
	745	+ // on its own, and it is a value like any other.
	746	+ if ( is_array( $token ) && ( T_CONSTANT_ENCAPSED_STRING === $token[0] || T_ENCAPSED_AND_WHITESPACE === $token[0] ) ) {
	747	+ $tokens[] = array( 'string', $token[1], T_CONSTANT_ENCAPSED_STRING === $token[0] );
	748	+ continue;
	749	+ }
	750	+
	751	+ $tokens[] = is_array( $token ) ? array( $token[0], $token[1], false ) : array( $token, $token, false );
	752	+ }
	753	+
	754	+ return $tokens;
	755	+ }
	756	+
	757	+ /**
	758	+ * Index of the nearest token that is not whitespace or a comment
	759	+ *
	760	+ * @since 2.11.8
	761	+ *
	762	+ * @param array $tokens Output of merged_tokens().
	763	+ * @param int $from Index to start from, not included.
	764	+ * @param int $step -1 to look back, 1 to look ahead.
	765	+ * @return int|null
	766	+ */
	767	+ private static function significant_token( $tokens, $from, $step ) {
	768	+ $count = count( $tokens );
	769	+
	770	+ for ( $i = $from + $step; $i >= 0 && $i < $count; $i += $step ) {
	771	+ if ( ! in_array( $tokens[ $i ][0], array( T_WHITESPACE, T_COMMENT, T_DOC_COMMENT ), true ) ) {
	772	+ return $i;
	773	+ }
	774	+ }
	775	+
	776	+ return null;
	777	+ }
	778	+
	779	+ /**
	780	+ * Redact a comment, keeping its plain words
	781	+ *
	782	+ * To the tokenizer a comment is text, and wp-config.php files keep old
	783	+ * credentials in them, commented out or in a note. The first version of
	784	+ * this, in the same release, redacted what was between quotes: an
	785	+ * apostrophe in prose ("Don't use 'the-old-password'") paired with the
	786	+ * opening quote of the secret and left it out, and a secret without quotes
	787	+ * was never touched. Found by the cross review of 2.11.8.
	788	+ *
	789	+ * So it works the other way round. A comment keeps its plain words
	790	+ * (lowercase, capitalised or uppercase letters, or two capitalised parts
	791	+ * such as WordPress, and docblock tags), constant names, and anything
	792	+ * shorter than eight characters; every other run of characters, a URL, a
	793	+ * key, a password with a digit in it, becomes the marker. The value of a
	794	+ * commented-out define() goes in single quotes whatever its length, as in
	795	+ * code and as 2.11.2 to 2.11.7 wrote it, so a copy stored by those
	796	+ * versions reads the same line for line. What this cannot tell from prose
	797	+ * is a password made only of plain letters; the output check still
	798	+ * catches it when it is a value in force.
	799	+ *
	800	+ * @since 2.11.8
	801	+ *
	802	+ * @param string $comment Comment token text.
185	803	* @return string
186	804	*/
187		- private function redact_secrets( $content ) {
188		- $names = implode( '|', array_map( 'preg_quote', self::$secret_constants ) );
	805	+ private function redact_comment( $comment ) {
	806	+ $marker = self::REDACTED_MARKER;
	807	+ $readable = self::$readable_constants;
189	808
	809	+ // Only the text between the delimiters is redacted: "/**#@-*/" in
	810	+ // wp-config-sample.php is a single run of eight characters, and
	811	+ // replacing it whole took the comment markers with it.
	812	+ if ( ! preg_match( '#\A(/\*\*?|//|\#)(.*?)(\*/)?\z#s', $comment, $parts ) ) {
	813	+ $parts = array( $comment, '', $comment );
	814	+ }
	815	+
	816	+ $open = $parts[1];
	817	+ $close = isset( $parts[3] ) ? $parts[3] : '';
	818	+ $comment = preg_replace_callback(
	819	+ '/(\bdefine\s*\(\s*([\'"])((?:\\\\.|(?!\2).)*)\2\s*,\s*)([\'"])((?:\\\\.|(?!\4).)*)\4/i',
	820	+ function ( $match ) use ( $marker, $readable ) {
	821	+ return in_array( $match[3], $readable, true ) ? $match[0] : $match[1] . "'" . $marker . "'";
	822	+ },
	823	+ $parts[2]
	824	+ );
	825	+
	826	+ if ( null === $comment ) {
	827	+ return '';
	828	+ }
	829	+
	830	+ $redacted = preg_replace_callback(
	831	+ '/[^\s\'"`(),;\[\]{}<>=]+/u',
	832	+ function ( $match ) use ( $marker ) {
	833	+ $word = $match[0];
	834	+ $core = rtrim( $word, '.:!?' );
	835	+
	836	+ // Plain words only, without hyphens: a passphrase written as
	837	+ // lowercase words joined by hyphens reads as prose otherwise, and
	838	+ // the PoC of this very fix caught one surviving.
	839	+ if ( strlen( $core ) < 8
	840	+ || preg_match( '/^@?(?:\p{Lu}?\p{Ll}+|\p{Lu}+)$/u', $core )
	841	+ || preg_match( '/^\p{Lu}\p{Ll}+\p{Lu}\p{Ll}+$/u', $core )
	842	+ || preg_match( '/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/', $core )
	843	+ ) {
	844	+ return $word;
	845	+ }
	846	+
	847	+ return $marker . substr( $word, strlen( $core ) );
	848	+ },
	849	+ $comment
	850	+ );
	851	+
	852	+ // A failed replacement, on invalid UTF-8 for one, drops the comment
	853	+ // rather than keep it whole.
	854	+ return ( null === $redacted ) ? '' : $open . $redacted . $close;
	855	+ }
	856	+
	857	+ /**
	858	+ * Values in force of what a wp-config.php names
	859	+ *
	860	+ * Every user constant whose name appears in the file, the twelve of
	861	+ * WordPress wherever they were defined, and the environment variables the
	862	+ * file reads or sets. Arrays are walked to their leaves, since define()
	863	+ * takes arrays. Strings and numbers both: the first version of this counted
	864	+ * numbers and wiped the diff of any file with a large number in force (cross
	865	+ * review of 2.11.8), so they were dropped, and 2.11.10 had to bring them
	866	+ * back because a credential written as a number, which the wp.org review of
	867	+ * 2.11.9 reported, is exactly what this check has to be able to see. The
	868	+ * eight character floor is what keeps the old problem away. The readable
	869	+ * constants are left out, and so is anything shorter than that.
	870	+ *
	871	+ * @since 2.11.8
	872	+ *
	873	+ * @param string $content Normalized wp-config.php content.
	874	+ * @return string[]
	875	+ */
	876	+ private function values_in_force( $content ) {
	877	+ $defined = get_defined_constants( true );
	878	+ $user = isset( $defined['user'] ) ? $defined['user'] : array();
	879	+ $names = self::$secret_constants;
	880	+ $values = array();
	881	+
	882	+ if ( preg_match_all( '/[A-Za-z_][A-Za-z0-9_]*/', (string) $content, $words ) ) {
	883	+ $names = array_merge( $names, $words[0] );
	884	+ }
	885	+
	886	+ foreach ( array_unique( $names ) as $name ) {
	887	+ if ( array_key_exists( $name, $user ) && ! in_array( $name, self::$readable_constants, true ) ) {
	888	+ $values = array_merge( $values, self::string_leaves( $user[ $name ] ) );
	889	+ }
	890	+ }
	891	+
	892	+ if ( preg_match_all( '/\b(?:getenv|putenv)\s*\(\s*[\'"]([A-Za-z_][A-Za-z0-9_]*)|\$_ENV\s*\[\s*[\'"]([A-Za-z_][A-Za-z0-9_]*)/', (string) $content, $env ) ) {
	893	+ foreach ( array_filter( array_merge( $env[1], $env[2] ) ) as $name ) {
	894	+ $value = getenv( $name );
	895	+
	896	+ if ( is_string( $value ) ) {
	897	+ $values[] = $value;
	898	+ }
	899	+ }
	900	+ }
	901	+
	902	+ $long = array();
	903	+
	904	+ foreach ( $values as $value ) {
	905	+ if ( strlen( $value ) >= 8 ) {
	906	+ $long[ $value ] = $value;
	907	+ }
	908	+ }
	909	+
	910	+ return array_values( $long );
	911	+ }
	912	+
	913	+ /**
	914	+ * Every string inside a constant value
	915	+ *
	916	+ * @since 2.11.8
	917	+ *
	918	+ * @param mixed $value Constant value.
	919	+ * @return string[]
	920	+ */
	921	+ private static function string_leaves( $value ) {
	922	+ if ( is_array( $value ) ) {
	923	+ $leaves = array();
	924	+
	925	+ foreach ( $value as $item ) {
	926	+ $leaves = array_merge( $leaves, self::string_leaves( $item ) );
	927	+ }
	928	+
	929	+ return $leaves;
	930	+ }
	931	+
	932	+ if ( is_string( $value ) ) {
	933	+ return array( $value );
	934	+ }
	935	+
190	936	/*
191		- * define( 'NAME', 'value' ), matching the quoted literal itself rather
192		- * than reading up to the closing parenthesis.
	937	+ * A number is a value too. Until 2.11.10 this returned nothing for one,
	938	+ * so the output check had no way to see a credential written as
	939	+ * define( 'SERVICE_TOKEN', 12345678 ) and the redaction was left without
	940	+ * its safety net there. Booleans and null stay out on purpose: as text
	941	+ * they are '1' and '', which would match half the file.
	942	+ */
	943	+ return ( is_int( $value ) || is_float( $value ) ) ? array( (string) $value ) : array();
	944	+ }
	945	+
	946	+ /**
	947	+ * Values in force of the readable constants, the ones kept in the copy
	948	+ *
	949	+ * @since 2.11.8
	950	+ *
	951	+ * @return string[]
	952	+ */
	953	+ private function readable_values_in_force() {
	954	+ $values = array();
	955	+
	956	+ foreach ( self::$readable_constants as $name ) {
	957	+ if ( defined( $name ) ) {
	958	+ $values = array_merge( $values, self::string_leaves( constant( $name ) ) );
	959	+ }
	960	+ }
	961	+
	962	+ return $values;
	963	+ }
	964	+
	965	+ /**
	966	+ * Replace the values a root .htaccess can carry as credentials
	967	+ *
	968	+ * The .htaccess is not a secrets file, but it can hold a few: an
	969	+ * environment variable handed to PHP with SetEnv, an Authorization header
	970	+ * set for a backend, or a php_value with a password, a key, a licence or a
	971	+ * session store address with its auth in it. The directive and its name
	972	+ * stay, the value goes. Line based, which is how Apache reads it too. Since
	973	+ * the cross review of 2.11.8 also any request or response header whose name
	974	+ * reads like a credential (X-Api-Key, a cookie, a signature) and a
	975	+ * RewriteCond that compares against key=, token= or the like, the way a
	976	+ * staging site is opened with a secret in the query string. What it cannot
	977	+ * see is a credential written in any other shape.
	978	+ *
	979	+ * @since 2.11.8
	980	+ *
	981	+ * @param string $content Normalized .htaccess content.
	982	+ * @return string
	983	+ */
	984	+ private function redact_server_secrets( $content ) {
	985	+ $redacted = preg_replace(
	986	+ array(
	987	+ '/^([ \t]*SetEnv[ \t]+\S+[ \t]+)\S.*$/mi',
	988	+ '/^([ \t]*(?:RequestHeader|Header)[ \t]+(?:always[ \t]+)?\S+[ \t]+[\w-]*(?:auth|key|token|secret|pass|cookie|sig)[\w-]*[ \t]+)\S.*$/mi',
	989	+ '/^([ \t]*php_(?:admin_)?value[ \t]+\S*(?:pass|pw|secret|key|token|licen|auth|save_path)\S*[ \t]+)\S.*$/mi',
	990	+ '/^([ \t]*RewriteCond[ \t]+\S+[ \t]+)\S*(?:key|token|secret|pass|auth|sig)[\w-]*=\S*/mi',
	991	+ ),
	992	+ '${1}' . self::REDACTED_MARKER,
	993	+ (string) $content
	994	+ );
	995	+
	996	+ return ( null === $redacted ) ? '' : $redacted;
	997	+ }
	998	+
	999	+ /**
	1000	+ * Promote a per-site baseline to the network record before dropping it
	1001	+ *
	1002	+ * Up to 2.11.2 the baseline was a per-site option, so on a network every
	1003	+ * site kept its own copy of the same two files. Those copies go, but what a
	1004	+ * copy records is which version of the file the owner approved, and that
	1005	+ * has to survive: rebuilding the baseline from disk would take whatever is
	1006	+ * there right now as approved, so a wp-config.php modified and still
	1007	+ * awaiting review would be blessed in silence.
	1008	+ *
	1009	+ * WHICH copy becomes the network record is not a detail, and 2.11.3 got it
	1010	+ * wrong. This runs from the scan, under wp-cron, on whichever site gets
	1011	+ * traffic first, and the sweep from the main site can be hours away because
	1012	+ * it waits for a network administrator to open a dashboard. So on a network
	1013	+ * with traffic spread around, the record of the whole installation was
	1014	+ * whatever the first subsite to scan happened to hold.
	1015	+ *
	1016	+ * That is harmless while every copy agrees, which is the ordinary case. The
	1017	+ * reason they can disagree is the very thing 2.11.3 fixed: until then,
	1018	+ * approving a change to wp-config.php took manage_options, which on a
	1019	+ * network the administrator of every subsite holds. If a change was
	1020	+ * approved on some subsite while the main site still had it pending review,
	1021	+ * promoting that subsite's copy retires a warning nobody decided to retire.
	1022	+ *
	1023	+ * Hence the order, file by file: what the network record already holds
	1024	+ * wins, then the main site, then the site this runs on. Between the copies,
	1025	+ * the main site beats a subsite, which is @calzbert's point, reported after
	1026	+ * reading the 2.11.3 diff.
	1027	+ *
	1028	+ * What this does NOT protect, said plainly because an earlier wording
	1029	+ * claimed more: if the network record already holds a file, that entry
	1030	+ * wins, even when it was written from disk by the .htaccess writer on
	1031	+ * init:20 while a third-party edit was pending review. What survives is a
	1032	+ * file the network record does not hold yet, which is the wp-config.php
	1033	+ * case that 2.11.3 lost. The .htaccess case is pre-existing and needs the
	1034	+ * writers to pass their before-hash, see update_critical_file_baseline().
	1035	+ *
	1036	+ * @since 2.11.4
	1037	+ *
	1038	+ * @param array|null $per_site Baseline stored for the site this runs on.
	1039	+ * @return bool True when the network record covers everything the per-site
	1040	+ * copy had, which is the only case where dropping it is safe.
	1041	+ */
	1042	+ private function promote_per_site_baseline( $per_site ) {
	1043	+ $network = get_site_option( self::BASELINE_OPTION, array() );
	1044	+
	1045	+ if ( ! is_array( $network ) ) {
	1046	+ $network = array();
	1047	+ }
	1048	+
	1049	+ /*
	1050	+ * Three sources, filled in one from another, file by file. It used to
	1051	+ * be all or nothing: if the network record existed at all, this
	1052	+ * returned at once and the caller dropped the per-site copy anyway.
193	1053	*
194		- * The first version of this stopped at the first ';', which looked
195		- * reasonable and failed on the very first real file it saw: the salts
196		- * WordPress generates are full of punctuation and a ';' inside one cut
197		- * the match short, so nothing was redacted. Backreference 3 is the
198		- * opening quote and the value runs to its unescaped twin. No /s
199		- * modifier on purpose, so a file with an unterminated string breaks
200		- * one line instead of swallowing the rest of the file.
	1054	+ * That looked safe and was not, because the network record can be born
	1055	+ * holding ONE of the two files. maybe_sync_server_files() runs on init
	1056	+ * and rewrites the root .htaccess by itself, and the writer calls
	1057	+ * update_critical_file_baseline( '.htaccess' ), which creates the
	1058	+ * network option with that single entry. init runs before admin_init,
	1059	+ * so on a network on Apache this is the ordinary order of an update,
	1060	+ * not a race: the cleanup then found the option "already there", kept
	1061	+ * nothing, and deleted the per-site copies that held the approved
	1062	+ * record of wp-config.php. The next scan met a file it had never seen
	1063	+ * and stored whatever was on disk as approved, which is the silent
	1064	+ * blessing this whole function exists to prevent. Reproduced on the
	1065	+ * Multisite install on 10 sep 2026, found by a cross review.
	1066	+ *
	1067	+ * Order of authority: what the network already says wins, then the main
	1068	+ * site, then the site this runs on. Nothing is ever overwritten and
	1069	+ * nothing is dropped for being late.
201	1070	*/
202		- $pattern = '/(define\s*\(\s*([\'"])(?:' . $names . '|[A-Z0-9_]*(?:KEY|SALT|SECRET|PASSWORD|PASSWD|TOKEN|API)[A-Z0-9_]*)\2\s*,\s*)([\'"])(?:\\\\.|(?!\3).)*\3/i';
	1071	+ $sources = array( $network );
203	1072
204		- $redacted = preg_replace( $pattern, '${1}\'' . self::REDACTED_MARKER . '\'', $content );
	1073	+ if ( ! is_main_site() ) {
	1074	+ $from_main = get_blog_option( get_main_site_id(), self::BASELINE_OPTION, null );
205	1075
206		- // A failed preg_replace returns null, and storing null would wipe the
207		- // baseline copy silently. Falling back to the original is not an
208		- // option either, so the caller's guard turns this into "no content".
209		- return ( null === $redacted ) ? '' : $redacted;
	1076	+ if ( is_array( $from_main ) ) {
	1077	+ $sources[] = $from_main;
	1078	+ }
	1079	+ }
	1080	+
	1081	+ if ( is_array( $per_site ) ) {
	1082	+ $sources[] = $per_site;
	1083	+ }
	1084	+
	1085	+ $merged = array();
	1086	+
	1087	+ foreach ( $sources as $source ) {
	1088	+ foreach ( $source as $filename => $data ) {
	1089	+ if ( isset( $merged[ $filename ] ) || ! is_array( $data ) || ! isset( $data['hash'] ) ) {
	1090	+ continue;
	1091	+ }
	1092	+
	1093	+ // Only the content carries secrets; the hash and the size,
	1094	+ // which are what say "this is the version that was approved",
	1095	+ // go over untouched.
	1096	+ if ( isset( $data['content'] ) && is_string( $data['content'] ) ) {
	1097	+ $data['content'] = $this->baseline_content( $filename, $data['content'] );
	1098	+ }
	1099	+
	1100	+ $merged[ $filename ] = $data;
	1101	+ }
	1102	+ }
	1103	+
	1104	+ if ( array_diff_key( $merged, $network ) ) {
	1105	+ $this->write_baseline( $merged );
	1106	+ }
	1107	+
	1108	+ if ( ! is_array( $per_site ) ) {
	1109	+ return true;
	1110	+ }
	1111	+
	1112	+ /*
	1113	+ * Is every file this copy had a record of now on the network record?
	1114	+ * Only then may the caller drop it. And the question is asked of what
	1115	+ * is STORED, not of $merged, which is only what this request MEANT to
	1116	+ * store. Asking $merged makes the answer true by construction, because
	1117	+ * the copy is one of the sources above, so the guard could never fire
	1118	+ * and redact_in_place() in the caller was unreachable code.
	1119	+ *
	1120	+ * The write does not always land, and the case that matters is not a
	1121	+ * broken database, it is the same race as the bug this function fixes.
	1122	+ * On a network updating from 2.11.2 the network option does not exist
	1123	+ * yet, so update_network_option() takes the $old_value === false branch
	1124	+ * and delegates to add_network_option() (wp-includes/option.php:2434).
	1125	+ * If another request created the option in between, that call either
	1126	+ * returns false without writing (option.php:2201) or, when this process
	1127	+ * still holds "does not exist" in its own notoptions cache, skips the
	1128	+ * check and INSERTs a second row: wp_sitemeta has no unique index on
	1129	+ * meta_key, so the record ends up duplicated and get_network_option()
	1130	+ * hands back whichever row comes first. Reproduced on the Multisite
	1131	+ * install on 10 sep 2026, with the .htaccess writer of init:20 racing a
	1132	+ * promotion: two rows, the approved hash of wp-config.php out of reach,
	1133	+ * and the per-site copy deleted all the same. Found by a cross review.
	1134	+ *
	1135	+ * Both cache keys go before rereading, and that is not belt and braces.
	1136	+ * add_network_option() caches the value it believes it wrote
	1137	+ * (option.php:2221), so a plain read hands back the very array that did
	1138	+ * not survive; and a stale notoptions would answer "no such option"
	1139	+ * without touching the database, which reads as "nothing is covered".
	1140	+ * Measured: without dropping the cache this guard still returns true.
	1141	+ */
	1142	+ $network_id = get_current_network_id();
	1143	+ wp_cache_delete( $network_id . ':' . self::BASELINE_OPTION, 'site-options' );
	1144	+ wp_cache_delete( $network_id . ':notoptions', 'site-options' );
	1145	+
	1146	+ $stored = get_site_option( self::BASELINE_OPTION, array() );
	1147	+
	1148	+ if ( ! is_array( $stored ) ) {
	1149	+ return false;
	1150	+ }
	1151	+
	1152	+ foreach ( $per_site as $filename => $data ) {
	1153	+ if ( is_array( $data ) && isset( $data['hash'] ) && ! isset( $stored[ $filename ] ) ) {
	1154	+ return false;
	1155	+ }
	1156	+ }
	1157	+
	1158	+ return true;
210	1159	}
211	1160
212	1161	/**
213		- * Redact the baseline stored by an earlier version, once per version
	1162	+ * Strip the secrets from a per-site copy that cannot be dropped yet
214	1163	*
215		- * The fix above only covers what gets written from now on. Sites updating
216		- * from 2.11.1 or earlier already have the secrets sitting in the option,
217		- * so they are cleaned on the first admin request after the update. The
218		- * hash is left alone: it describes the file, not the copy.
	1164	+ * The copy stays because it holds the only record of an approved file, but
	1165	+ * what it must not keep for one more minute is the database password and
	1166	+ * the eight keys and salts. The two things are separable and this is where
	1167	+ * they get separated.
219	1168	*
	1169	+ * @since 2.11.4
	1170	+ *
	1171	+ * @param array $per_site Baseline stored for the current site.
	1172	+ * @return void
	1173	+ */
	1174	+ private function redact_in_place( $per_site ) {
	1175	+ $changed = false;
	1176	+
	1177	+ foreach ( $per_site as $filename => $data ) {
	1178	+ if ( ! is_array( $data ) || ! isset( $data['content'] ) || ! is_string( $data['content'] ) ) {
	1179	+ continue;
	1180	+ }
	1181	+
	1182	+ $safe = $this->baseline_content( $filename, $data['content'] );
	1183	+
	1184	+ if ( $safe !== $data['content'] ) {
	1185	+ $per_site[ $filename ]['content'] = $safe;
	1186	+ $changed = true;
	1187	+ }
	1188	+ }
	1189	+
	1190	+ if ( $changed ) {
	1191	+ update_option( self::BASELINE_OPTION, $per_site );
	1192	+ }
	1193	+ }
	1194	+
	1195	+ /**
	1196	+ * Network option recording the version whose results cleanup walked the network
	1197	+ *
	1198	+ * @since 2.11.8
	1199	+ */
	1200	+ const RESULTS_SWEEP_OPTION = 'vigilante_results_sweep';
	1201	+
	1202	+ /**
	1203	+ * Clean the stored scan results of every site of the network, once per version
	1204	+ *
	1205	+ * redact_stored_results() runs per site from admin_init and from the scan,
	1206	+ * so a subsite with the module off whose dashboard nobody opens kept the
	1207	+ * lines of wp-config.php its last scan stored, with whatever that version
	1208	+ * failed to redact. Same gap 2.11.3 and 2.11.4 closed for the baseline copy;
	1209	+ * found for the results by the cross review of 2.11.8. It runs from the
	1210	+ * network sweep, for a network administrator on the main site, and has its
	1211	+ * own marker because the baseline sweep is already done on every network
	1212	+ * that updated through 2.11.4.
	1213	+ *
	1214	+ * @since 2.11.8
	1215	+ */
	1216	+ private function maybe_sweep_network_results() {
	1217	+ if ( VIGILANTE_VERSION === get_site_option( self::RESULTS_SWEEP_OPTION ) ) {
	1218	+ return;
	1219	+ }
	1220	+
	1221	+ update_site_option( self::RESULTS_SWEEP_OPTION, VIGILANTE_VERSION );
	1222	+
	1223	+ $site_ids = get_sites(
	1224	+ array(
	1225	+ 'fields' => 'ids',
	1226	+ 'number' => 0,
	1227	+ 'network_id' => get_current_network_id(),
	1228	+ 'update_site_meta_cache' => false,
	1229	+ )
	1230	+ );
	1231	+
	1232	+ foreach ( $site_ids as $site_id ) {
	1233	+ switch_to_blog( $site_id );
	1234	+ $this->redact_stored_results();
	1235	+ restore_current_blog();
	1236	+ }
	1237	+ }
	1238	+
	1239	+ /**
	1240	+ * The diff of a shared file as a site that does not own it gets it
	1241	+ *
	1242	+ * No lines, and a flag the screens read to say where the lines are.
	1243	+ *
	1244	+ * @since 2.11.8
	1245	+ *
	1246	+ * @return array
	1247	+ */
	1248	+ public static function network_only_diff() {
	1249	+ return array(
	1250	+ 'added' => array(),
	1251	+ 'removed' => array(),
	1252	+ 'unavailable' => true,
	1253	+ 'network' => true,
	1254	+ );
	1255	+ }
	1256	+
	1257	+ /**
	1258	+ * Take out of the last stored scan what the baseline copy no longer keeps
	1259	+ *
	1260	+ * The results of the last scan are an option of each site, and the diff of
	1261	+ * a critical file travels inside them line by line, redacted the way the
	1262	+ * version that ran the scan redacted. Until 2.11.7 that let FTP_PASS and
	1263	+ * friends through, and on a network every subsite with the module on kept
	1264	+ * its own copy of the lines. This runs once per version with the rest of
	1265	+ * the cleanup:
	1266	+ *
	1267	+ * - Where the shared files do not belong to this site, no line is kept.
	1268	+ * - Lines of wp-config.php are dropped. A single line cannot be read as
	1269	+ * PHP reliably (half a heredoc is just words), and the next scan rebuilds
	1270	+ * them from the whole file.
	1271	+ * - Lines of .htaccess are directives, one per line, and are redacted in
	1272	+ * place.
	1273	+ *
	1274	+ * @since 2.11.8
	1275	+ */
	1276	+ private function redact_stored_results() {
	1277	+ $results = get_option( 'vigilante_last_integrity_results' );
	1278	+
	1279	+ if ( ! is_array( $results ) || empty( $results['modified'] ) || ! is_array( $results['modified'] ) ) {
	1280	+ return;
	1281	+ }
	1282	+
	1283	+ $owns = Vigilante_Settings::owns_shared_files();
	1284	+ $changed = false;
	1285	+
	1286	+ foreach ( $results['modified'] as $index => $item ) {
	1287	+ if ( ! is_array( $item ) || 'critical_config' !== ( $item['type'] ?? '' ) || ! isset( $item['diff'] ) || ! is_array( $item['diff'] ) ) {
	1288	+ continue;
	1289	+ }
	1290	+
	1291	+ if ( ! $owns ) {
	1292	+ if ( empty( $item['diff']['network'] ) ) {
	1293	+ $results['modified'][ $index ]['diff'] = self::network_only_diff();
	1294	+ $changed = true;
	1295	+ }
	1296	+ continue;
	1297	+ }
	1298	+
	1299	+ if ( 'wp-config.php' === ( $item['file'] ?? '' ) ) {
	1300	+ if ( ! empty( $item['diff']['added'] ) || ! empty( $item['diff']['removed'] ) ) {
	1301	+ $results['modified'][ $index ]['diff'] = array(
	1302	+ 'added' => array(),
	1303	+ 'removed' => array(),
	1304	+ 'unavailable' => true,
	1305	+ 'rescan' => true,
	1306	+ );
	1307	+ $changed = true;
	1308	+ }
	1309	+ continue;
	1310	+ }
	1311	+
	1312	+ foreach ( array( 'added', 'removed' ) as $side ) {
	1313	+ if ( empty( $item['diff'][ $side ] ) || ! is_array( $item['diff'][ $side ] ) ) {
	1314	+ continue;
	1315	+ }
	1316	+
	1317	+ foreach ( $item['diff'][ $side ] as $line_index => $line ) {
	1318	+ if ( ! is_array( $line ) || ! isset( $line['content'] ) || ! is_string( $line['content'] ) ) {
	1319	+ continue;
	1320	+ }
	1321	+
	1322	+ $safe = $this->redact_server_secrets( $line['content'] );
	1323	+
	1324	+ if ( $safe !== $line['content'] ) {
	1325	+ $results['modified'][ $index ]['diff'][ $side ][ $line_index ]['content'] = $safe;
	1326	+ $changed = true;
	1327	+ }
	1328	+ }
	1329	+ }
	1330	+ }
	1331	+
	1332	+ if ( $changed ) {
	1333	+ update_option( 'vigilante_last_integrity_results', $results );
	1334	+ }
	1335	+ }
	1336	+
	1337	+ /**
	1338	+ * Clean up what earlier versions stored, wherever they stored it
	1339	+ *
	1340	+ * Two jobs, and the second one only exists on a network.
	1341	+ *
	1342	+ * The first: versions up to 2.11.1 kept the contents of wp-config.php in
	1343	+ * the baseline, credentials included, so what is already on disk is
	1344	+ * redacted in place.
	1345	+ *
	1346	+ * The second: up to 2.11.2 that baseline was a per-site option, so on a
	1347	+ * network every site had its own copy of the same file. This runs per site
	1348	+ * and removes that copy, because the baseline now lives in a single
	1349	+ * network option. Doing it here is what makes the cleanup reach a site
	1350	+ * whose dashboard nobody ever opens: this method is called from the scan
	1351	+ * as well as from admin_init, and the scan runs on every site through
	1352	+ * wp-cron with front-end traffic alone.
	1353	+ *
	1354	+ * The gate option stays per site on purpose. It records that THIS site has
	1355	+ * been cleaned, which is exactly the per-site fact being tracked.
	1356	+ *
220	1357	* @since 2.11.2
221	1358	*/
222	1359	public function maybe_redact_stored_baseline() {
223	1360	if ( VIGILANTE_VERSION === get_option( self::BASELINE_REDACTION_OPTION ) ) {
		@@ -223,10 +1360,39 @@
223	1360	if ( VIGILANTE_VERSION === get_option( self::BASELINE_REDACTION_OPTION ) ) {
224	1361	return;
225	1362	}
226	1363
227		- $baseline = get_option( self::BASELINE_OPTION, array() );
	1364	+ /*
	1365	+ * The per-site copy left behind by 2.11.2 and earlier. On a network it
	1366	+ * holds the database password and the eight keys and salts, so it goes,
	1367	+ * but never before what it records has been carried over:
	1368	+ * promote_per_site_baseline() explains why the record has to outlive
	1369	+ * the copy, and which copy wins when they disagree. Measured on the
	1370	+ * Multisite install while writing 2.11.3: without that, the first scan
	1371	+ * after the migration reported zero modified files where it had to
	1372	+ * report one.
	1373	+ */
	1374	+ $pending = false;
228	1375
	1376	+ if ( is_multisite() ) {
	1377	+ $per_site = get_option( self::BASELINE_OPTION, null );
	1378	+
	1379	+ if ( null !== $per_site ) {
	1380	+ if ( $this->promote_per_site_baseline( $per_site ) ) {
	1381	+ delete_option( self::BASELINE_OPTION );
	1382	+ } elseif ( is_array( $per_site ) ) {
	1383	+ // Something this copy recorded is not on the network record
	1384	+ // yet, so it does not go: it is the only evidence of what
	1385	+ // was approved. The secrets do go, right now, because that
	1386	+ // part cannot wait for the next pass.
	1387	+ $this->redact_in_place( $per_site );
	1388	+ $pending = true;
	1389	+ }
	1390	+ }
	1391	+ }
	1392	+
	1393	+ $baseline = $this->read_baseline();
	1394	+
229	1395	if ( is_array( $baseline ) ) {
230	1396	$changed = false;
231	1397
232	1398	foreach ( $baseline as $filename => $data ) {
		@@ -242,16 +1408,148 @@
242	1408	}
243	1409	}
244	1410
245	1411	if ( $changed ) {
246		- update_option( self::BASELINE_OPTION, $baseline, false );
	1412	+ $this->write_baseline( $baseline );
247	1413	}
248	1414	}
249	1415
250		- update_option( self::BASELINE_REDACTION_OPTION, VIGILANTE_VERSION, false );
	1416	+ $this->redact_stored_results();
	1417	+
	1418	+ /*
	1419	+ * The gate does not close while a per-site copy is still waiting to be
	1420	+ * promoted. Closing it would end the retries for a whole version: the
	1421	+ * copy would sit there unread, the file it records would be missing
	1422	+ * from the network record, and the next scan would take whatever is on
	1423	+ * disk as approved. Not closing it is not free, though, and the first
	1424	+ * wording here said "one option read": measured cold on the Multisite
	1425	+ * install, it is 6 SQL queries per admin request against 0 with the gate
	1426	+ * closed, admin-ajax.php and the heartbeat included, two of them from the
	1427	+ * cache invalidation in promote_per_site_baseline(). Acceptable only
	1428	+ * because it converges: the stuck case this guards against resolves on
	1429	+ * the next pass that gets its write through.
	1430	+ */
	1431	+ if ( ! $pending ) {
	1432	+ update_option( self::BASELINE_REDACTION_OPTION, VIGILANTE_VERSION, false );
	1433	+ }
251	1434	}
252	1435
253	1436	/**
	1437	+ * Sweep the whole network once, so it does not wait for each site's cron
	1438	+ *
	1439	+ * The per-site cleanup above reaches a site when that site runs a scan or
	1440	+ * someone opens its dashboard, which on a quiet subsite can take a while.
	1441	+ * This walks every site once and gets it over with, and its marker is a
	1442	+ * network option so it does not repeat per site.
	1443	+ *
	1444	+ * Runs only on the main site of the network, where a network administrator
	1445	+ * works, and only there does it cost anything.
	1446	+ *
	1447	+ * @since 2.11.3
	1448	+ */
	1449	+ public function maybe_sweep_network_baselines() {
	1450	+ if ( ! is_multisite() || ! is_main_site() ) {
	1451	+ return;
	1452	+ }
	1453	+
	1454	+ /*
	1455	+ * A network administrator, and nobody else. admin_init fires for any
	1456	+ * logged-in visitor, a subscriber opening their own profile included,
	1457	+ * and this walks every site of the network writing to each one. What it
	1458	+ * removes is stale data that rebuilds itself, so the harm is small, but
	1459	+ * an action over the whole network belongs to whoever administers the
	1460	+ * network. The surface inventory cannot see this: it reads wp_ajax_*,
	1461	+ * admin_post_* and REST routes, and a hook on admin_init is outside its
	1462	+ * coverage by construction, which is exactly the blind spot written
	1463	+ * down as rule 23.
	1464	+ *
	1465	+ * The per-site cleanup is deliberately not gated the same way: it also
	1466	+ * runs from the scan, under wp-cron with no user at all, and it only
	1467	+ * touches the site it runs on.
	1468	+ */
	1469	+ if ( ! current_user_can( 'manage_network_options' ) ) {
	1470	+ return;
	1471	+ }
	1472	+
	1473	+ $this->maybe_sweep_network_results();
	1474	+
	1475	+ $marker = get_site_option( self::BASELINE_SWEEP_OPTION );
	1476	+
	1477	+ /*
	1478	+ * Two markers, because there are two different things to remember and
	1479	+ * 2.11.3 only remembered one of them.
	1480	+ *
	1481	+ * The walk is marked BEFORE it starts, on purpose: on a very large
	1482	+ * network it may not finish inside one request, and repeating it on
	1483	+ * every admin page load would be worse than leaving the rest to each
	1484	+ * site's own scan. But 2.11.3 wrote VIGILANTE_VERSION there, so an
	1485	+ * interrupted walk was retried by the next release, which was the only
	1486	+ * thing that ever finished it. Writing a fixed literal instead, as the
	1487	+ * first draft of 2.11.4 did, stopped the pointless rearming and took
	1488	+ * that retry away with it: a walk cut short would never be resumed by
	1489	+ * any version. And "each site's own scan cleans the rest" only holds
	1490	+ * where the module is on; with it off, the cleanup is registered under
	1491	+ * is_admin() alone, so a subsite nobody opens is exactly what the sweep
	1492	+ * exists for. Found by a cross review on 10 sep 2026.
	1493	+ *
	1494	+ * So: the running version means "started here and did not finish", and
	1495	+ * the migration literal means "finished, never again".
	1496	+ */
	1497	+ if ( self::BASELINE_SWEEP_MIGRATION === $marker ) {
	1498	+ return;
	1499	+ }
	1500	+
	1501	+ if ( VIGILANTE_VERSION === $marker ) {
	1502	+ return;
	1503	+ }
	1504	+
	1505	+ update_site_option( self::BASELINE_SWEEP_OPTION, VIGILANTE_VERSION );
	1506	+
	1507	+ // Only this network. WP_Site_Query filters by network solely when
	1508	+ // network_id is given, so on a multi-network install the walk would
	1509	+ // otherwise reach the sites of other networks and promote their copies
	1510	+ // into this network's record (get_current_network_id() below does not
	1511	+ // change with switch_to_blog()).
	1512	+ $site_ids = get_sites(
	1513	+ array(
	1514	+ 'fields' => 'ids',
	1515	+ 'number' => 0,
	1516	+ 'network_id' => get_current_network_id(),
	1517	+ 'update_site_meta_cache' => false,
	1518	+ )
	1519	+ );
	1520	+
	1521	+ $pending = 0;
	1522	+
	1523	+ foreach ( $site_ids as $site_id ) {
	1524	+ switch_to_blog( $site_id );
	1525	+
	1526	+ $per_site = get_option( self::BASELINE_OPTION, null );
	1527	+
	1528	+ if ( null !== $per_site ) {
	1529	+ // Same care as the per-site cleanup, and the same helper, so
	1530	+ // the two paths cannot drift apart the way they nearly did.
	1531	+ if ( $this->promote_per_site_baseline( $per_site ) ) {
	1532	+ delete_option( self::BASELINE_OPTION );
	1533	+ } elseif ( is_array( $per_site ) ) {
	1534	+ $this->redact_in_place( $per_site );
	1535	+ $pending++;
	1536	+ }
	1537	+ }
	1538	+
	1539	+ restore_current_blog();
	1540	+ }
	1541	+
	1542	+ // Finished, and with nothing left behind, so it never has to run again
	1543	+ // in any version. A site whose copy could not be promoted keeps the
	1544	+ // marker on the running version instead, which is what gets the walk
	1545	+ // retried by the next release.
	1546	+ if ( ! $pending ) {
	1547	+ update_site_option( self::BASELINE_SWEEP_OPTION, self::BASELINE_SWEEP_MIGRATION );
	1548	+ }
	1549	+ }
	1550	+
	1551	+ /**
254	1552	* Critical root files to monitor against a stored baseline.
255	1553	* These files have no official WordPress.org checksum because their
256	1554	* content is unique per installation.
257	1555	*
		@@ -289,16 +1587,25 @@
289	1587	array( '# BEGIN Vigilante Security Headers', '# END Vigilante Security Headers' ),
290	1588	);
291	1589
292	1590	/**
	1591	+ * Whether the core is being compared with the English checksums because
	1592	+ * WordPress.org has none for the language of the site. Set by
	1593	+ * get_core_checksums().
	1594	+ *
	1595	+ * @var bool
	1596	+ */
	1597	+ private $core_checksums_are_english = false;
	1598	+
	1599	+ /**
293	1600	* Core files known to produce false positives in checksum comparison.
294		- * These are skipped during core scanning (e.g. version.php is rewritten
295		- * during auto-updates and localized installs, readme files vary by locale).
	1601	+ * These are skipped during core scanning: the readme and the license vary
	1602	+ * by locale and are not code. version.php used to be here too, and is now
	1603	+ * compared (see matches_core_of_other_locale()).
296	1604	*
297	1605	* @var array
298	1606	*/
299	1607	private $core_known_false_positives = array(
300		- 'wp-includes/version.php',
301	1608	'readme.html',
302	1609	'license.txt',
303	1610	'licencia.txt',
304	1611	);
		@@ -380,9 +1687,24 @@
380	1687	$this->activity_log = $activity_log;
381	1688	$this->options = $settings ? $settings->get_section( 'file_integrity' ) : array();
382	1689	$this->wp_version = get_bloginfo( 'version' );
383	1690	$this->ignored_files = get_option( 'vigilante_ignored_files', array() );
	1691	+ }
384	1692
	1693	+ /**
	1694	+ * Register the hooks of the scanner itself
	1695	+ *
	1696	+ * Until 2.11.4 all of this lived in the constructor, and the constructor is
	1697	+ * called from a dozen places: the module gate, the activator, the hook that
	1698	+ * runs after Vigilant writes a watched file, and the admin handlers that
	1699	+ * only want the class as a tool. Every
	1700	+ * one of them registered these hooks again, and one runs during admin_init
	1701	+ * itself. Registering apart from constructing means a `new` is only a
	1702	+ * `new`, and it is what lets the cleanup below stand on its own.
	1703	+ *
	1704	+ * @since 2.11.4
	1705	+ */
	1706	+ public function init_hooks() {
385	1707	// Schedule automated scans only if options available
386	1708	if ( ! empty( $this->options['auto_scan'] ) ) {
387	1709	add_action( 'vigilante_file_integrity_scan', array( $this, 'run_scheduled_scan' ) );
388	1710	$this->schedule_scan();
		@@ -392,18 +1714,40 @@
392	1714	// WordPress.org immediately, and open a short grace window so the
393	1715	// scheduled scan does not raise false positives while wp.org is still
394	1716	// publishing the new version's checksums. Registered regardless of
395	1717	// auto_scan because it reacts to update events, not to the schedule.
396		- // Clean the secrets an earlier version stored in the baseline. On
397		- // admin_init because that is where the baseline is looked at, and it
398		- // does one option read per admin request until it has run once.
399		- add_action( 'admin_init', array( $this, 'maybe_redact_stored_baseline' ) );
400		-
401	1718	add_action( 'upgrader_process_complete', array( $this, 'on_upgrade_complete' ), 20, 2 );
402	1719	add_action( 'vigilante_fi_postupdate_verify', array( $this, 'run_postupdate_verify' ) );
403	1720	}
404	1721
405	1722	/**
	1723	+ * Register the cleanup of what earlier versions stored, module on or off
	1724	+ *
	1725	+ * These two are not integrity monitoring. They take out of the database
	1726	+ * something the plugin stored and should not have, which is the copy of
	1727	+ * wp-config.php carrying the database password and the eight keys and
	1728	+ * salts. Whoever switched the module off did not decide to keep that, and
	1729	+ * for that person the cleanup matters more, not less: they are not going
	1730	+ * to pass through the scanner again.
	1731	+ *
	1732	+ * Until 2.11.4 these were registered in the constructor, so they only ran
	1733	+ * where the module was on. A site with the module off kept the credentials
	1734	+ * with 2.11.3 installed, and a network whose main site had it off lost the
	1735	+ * sweep too, which was the one path that reached the sites nobody visits.
	1736	+ * Reported by @calzbert after reading the 2.11.3 diff.
	1737	+ *
	1738	+ * On admin_init because that is where the baseline is looked at, and it
	1739	+ * does one option read per admin request until it has run once.
	1740	+ *
	1741	+ * @since 2.11.4
	1742	+ */
	1743	+ public function init_cleanup_hooks() {
	1744	+ add_action( 'admin_init', array( $this, 'maybe_redact_stored_baseline' ) );
	1745	+ add_action( 'admin_init', array( $this, 'maybe_sweep_network_baselines' ) );
	1746	+ add_action( 'admin_init', array( $this, 'maybe_claim_owned_blocks_on_admin' ) );
	1747	+ }
	1748	+
	1749	+ /**
406	1750	* Check if scan time limit has been exceeded
407	1751	*
408	1752	* @return bool True if time exceeded.
409	1753	*/
		@@ -471,8 +1815,16 @@
471	1815	$files = array( $hook_extra['plugin'] );
472	1816	}
473	1817	foreach ( $files as $file ) {
474	1818	$slug = dirname( (string) $file );
	1819	+ // Vigilant itself is verified immediately (not after 90 s) by
	1820	+ // Vigilante_Self_Integrity::handle_upgrader() when the
	1821	+ // self-check is on; do not also open a grace window for it.
	1822	+ // Compared with the folder it really lives in, not the literal
	1823	+ // slug, so a renamed folder is skipped the same way.
	1824	+ if ( dirname( VIGILANTE_PLUGIN_BASENAME ) === $slug && Vigilante_Self_Integrity::is_on() ) {
	1825	+ continue;
	1826	+ }
475	1827	if ( '.' !== $slug && '' !== $slug ) {
476	1828	$targets['plugin'][] = $slug;
477	1829	}
478	1830	}
		@@ -541,8 +1893,17 @@
541	1893	*/
542	1894	private function verify_updated_slug( $type, $slug ) {
543	1895	$grace_key = 'vigilante_fi_grace_' . $type . '_' . md5( $slug );
544	1896
	1897	+ // Defensive skip for the first 2.11.x -> 3.0.x update: the OLD code in
	1898	+ // memory scheduled this event including Vigilant's own slug, and by the
	1899	+ // time it fires the NEW code (this one) is running with the self-check
	1900	+ // handling Vigilant on its own.
	1901	+ if ( 'plugin' === $type && dirname( VIGILANTE_PLUGIN_BASENAME ) === $slug && Vigilante_Self_Integrity::is_on() ) {
	1902	+ delete_transient( $grace_key );
	1903	+ return;
	1904	+ }
	1905	+
545	1906	if ( 'plugin' === $type ) {
546	1907	if ( ! function_exists( 'get_plugins' ) ) {
547	1908	require_once ABSPATH . 'wp-admin/includes/plugin.php';
548	1909	}
		@@ -693,8 +2054,56 @@
693	2054
694	2055	// Use settings from options page
695	2056	$options = is_array( $this->options ) ? $this->options : array();
696	2057
	2058	+ // Vigilant self-check runs FIRST and exempt from the time budget:
	2059	+ // ~60 small-file hashes cost < 50 ms and the guardian must never be
	2060	+ // dropped by the budget on plugin-heavy sites. User exclusions do not
	2061	+ // apply to it (see Vigilante_Self_Integrity::run_check()).
	2062	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	2063	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	2064	+ }
	2065	+ if ( Vigilante_Self_Integrity::is_on() ) {
	2066	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	2067	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	2068	+ }
	2069	+ $self = new Vigilante_Self_Integrity( $this->settings, $this->activity_log );
	2070	+ $self_result = $self->run_check( 'scan' );
	2071	+ // run_check() above updates this site's own state (status line and
	2072	+ // the analyzer check keep working everywhere). The plugin files are
	2073	+ // shared by the whole installation, so the self findings are folded
	2074	+ // Self-protection has its own alert, and it does not travel in the
	2075	+ // scan digest any more. That digest is governed by a notification
	2076	+ // setting that can be switched off, and switching off "tell me about
	2077	+ // changed files" was also switching off the alarm of the plugin
	2078	+ // itself. So the findings stay out of the scan results (they have
	2079	+ // their own block in File Integrity, with what each one means and how
	2080	+ // to repair it) and a critical one sends its own email from here,
	2081	+ // wherever the scan runs. maybe_send_self_alert() keeps it to the
	2082	+ // site that owns the shared files and dedupes by set of findings.
	2083	+ foreach ( (array) $self_result['findings'] as $self_finding ) {
	2084	+ if ( 'critical' === ( $self_finding['severity'] ?? '' ) ) {
	2085	+ $self->maybe_send_self_alert( $self_result['findings'], 'scan' );
	2086	+ break;
	2087	+ }
	2088	+ }
	2089	+ }
	2090	+
	2091	+ // What the time does not reach. A scan that runs out of time used to
	2092	+ // say only that it was partial, and it starts from the beginning
	2093	+ // every time, so on a large site the same plugins and themes were
	2094	+ // left out on every scan with nobody told which. They are named.
	2095	+ $not_checked = array(
	2096	+ 'areas' => array(),
	2097	+ 'plugins' => array(),
	2098	+ 'themes' => array(),
	2099	+ );
	2100	+
	2101	+ // And the folders of the plugins and themes it did check, which is
	2102	+ // what the tab offers to exclude so that a scan by hand reaches the
	2103	+ // rest (see folders_to_exclude()).
	2104	+ $checked_folders = array();
	2105	+
697	2106	// Scan uploads for suspicious files FIRST (highest security priority)
698	2107	// PHP files in uploads are almost always malware
699	2108	if ( ! empty( $options['scan_uploads'] ) && ! $this->is_time_exceeded() ) {
700	2109	$upload_results = $this->scan_uploads();
		@@ -699,8 +2108,11 @@
699	2108	if ( ! empty( $options['scan_uploads'] ) && ! $this->is_time_exceeded() ) {
700	2109	$upload_results = $this->scan_uploads();
701	2110	$results['suspicious'] = array_merge( $results['suspicious'], $upload_results['suspicious'] );
702	2111	$results['extra'] = array_merge( $results['extra'], $upload_results['extra'] );
	2112	+ $results['errors'] = array_merge( $results['errors'], $upload_results['errors'] ?? array() );
	2113	+ } elseif ( ! empty( $options['scan_uploads'] ) ) {
	2114	+ $not_checked['areas'][] = 'uploads';
703	2115	}
704	2116
705	2117	// Scan core files
706	2118	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
		@@ -705,8 +2117,10 @@
705	2117	// Scan core files
706	2118	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
707	2119	$core_results = $this->scan_core_files();
708	2120	$results = $this->merge_results( $results, $core_results );
	2121	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2122	+ $not_checked['areas'][] = 'core';
709	2123	}
710	2124
711	2125	// Scan root directory for non-core files (PHP = suspicious, others = additional)
712	2126	// Runs after core scan so checksums are already cached
		@@ -713,20 +2127,61 @@
713	2127	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
714	2128	$root_results = $this->scan_root_files();
715	2129	$results['suspicious'] = array_merge( $results['suspicious'], $root_results['suspicious'] );
716	2130	$results['extra'] = array_merge( $results['extra'], $root_results['extra'] );
	2131	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2132	+ $not_checked['areas'][] = 'core';
717	2133	}
718	2134
	2135	+ // Files added to wp-admin or wp-includes, which the comparison with
	2136	+ // the checksums never visits because the checksums do not name them.
	2137	+ if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
	2138	+ $folder_results = $this->scan_core_folders();
	2139	+ $results['suspicious'] = array_merge( $results['suspicious'], $folder_results['suspicious'] );
	2140	+ $results['extra'] = array_merge( $results['extra'], $folder_results['extra'] );
	2141	+ $results['errors'] = array_merge( $results['errors'], $folder_results['errors'] );
	2142	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2143	+ $not_checked['areas'][] = 'core';
	2144	+ }
	2145	+
719	2146	// Scan critical config files (wp-config.php, .htaccess) against stored baseline
720	2147	if ( ! empty( $options['scan_critical_config'] ) && ! $this->is_time_exceeded() ) {
721	2148	$critical_results = $this->scan_critical_root_files();
722	2149	$results['modified'] = array_merge( $results['modified'], $critical_results );
	2150	+ } elseif ( ! empty( $options['scan_critical_config'] ) ) {
	2151	+ $not_checked['areas'][] = 'config';
723	2152	}
724	2153
	2154	+ // The other folders of wp-content (cache, languages, upgrade and
	2155	+ // whatever else is there), which belong to no plugin and no theme and
	2156	+ // had no turn. Before the plugins and the themes, which on a large
	2157	+ // site can use up the whole scan, and with a share of the time of
	2158	+ // their own, so a cache of a hundred thousand files cannot do the
	2159	+ // same to them.
	2160	+ $content_results = null;
	2161	+ if ( ! empty( $options['scan_plugins'] ) && ! $this->is_time_exceeded() ) {
	2162	+ $content_results = $this->scan_content_folders();
	2163	+ $results['suspicious'] = array_merge( $results['suspicious'], $content_results['suspicious'] );
	2164	+ $results['extra'] = array_merge( $results['extra'], $content_results['extra'] );
	2165	+ $results['errors'] = array_merge( $results['errors'], $content_results['errors'] );
	2166	+ } elseif ( ! empty( $options['scan_plugins'] ) ) {
	2167	+ $not_checked['areas'][] = 'content';
	2168	+ }
	2169	+
725	2170	// Scan plugins
726	2171	if ( ! empty( $options['scan_plugins'] ) && ! $this->is_time_exceeded() ) {
727	2172	$plugin_results = $this->scan_plugins();
728	2173	$results = $this->merge_results( $results, $plugin_results );
	2174	+
	2175	+ $not_checked['plugins'] = $plugin_results['not_checked'] ?? array();
	2176	+ $checked_folders = $plugin_results['checked'] ?? array();
	2177	+
	2178	+ if ( empty( $plugin_results['unlisted_checked'] ) ) {
	2179	+ $not_checked['areas'][] = 'unlisted';
	2180	+ }
	2181	+ } elseif ( ! empty( $options['scan_plugins'] ) ) {
	2182	+ $not_checked['areas'][] = 'plugins';
	2183	+ $not_checked['areas'][] = 'unlisted';
729	2184	}
730	2185
731	2186	// Scan themes
732	2187	if ( ! empty( $options['scan_themes'] ) && ! $this->is_time_exceeded() ) {
		@@ -731,10 +2186,21 @@
731	2186	// Scan themes
732	2187	if ( ! empty( $options['scan_themes'] ) && ! $this->is_time_exceeded() ) {
733	2188	$theme_results = $this->scan_themes();
734	2189	$results = $this->merge_results( $results, $theme_results );
	2190	+
	2191	+ $not_checked['themes'] = $theme_results['not_checked'] ?? array();
	2192	+ $checked_folders = array_merge( $checked_folders, $theme_results['checked'] ?? array() );
	2193	+ } elseif ( ! empty( $options['scan_themes'] ) ) {
	2194	+ $not_checked['areas'][] = 'themes';
735	2195	}
736	2196
	2197	+ // What could only be searched for hidden code: plugins and themes
	2198	+ // first, as they are found, and the folders of wp-content after them.
	2199	+ if ( null !== $content_results ) {
	2200	+ $results['unverified'] = array_values( array_unique( array_merge( $results['unverified'] ?? array(), $content_results['unverified'] ) ) );
	2201	+ }
	2202	+
737	2203	// Mark as incomplete if time was exceeded
738	2204	if ( $this->is_time_exceeded() ) {
739	2205	$results['incomplete'] = true;
740	2206	$results['errors'][] = __( 'Scan was incomplete due to time limit. Results may be partial.', 'vigilante' );
		@@ -739,8 +2205,19 @@
739	2205	$results['incomplete'] = true;
740	2206	$results['errors'][] = __( 'Scan was incomplete due to time limit. Results may be partial.', 'vigilante' );
741	2207	}
742	2208
	2209	+ // Stored after the last merge: merge_results() keeps only the keys it
	2210	+ // knows.
	2211	+ $not_checked['areas'] = array_values( array_unique( $not_checked['areas'] ) );
	2212	+ $results['not_checked'] = $not_checked;
	2213	+
	2214	+ // Only with plugins or themes left out: a scan that reached them all
	2215	+ // has nothing to make room for.
	2216	+ if ( ! empty( $not_checked['plugins'] ) || ! empty( $not_checked['themes'] ) || array_intersect( array( 'plugins', 'themes' ), $not_checked['areas'] ) ) {
	2217	+ $results['checked_folders'] = array_values( array_unique( $checked_folders ) );
	2218	+ }
	2219	+
743	2220	// Filter out ignored files from all result categories
744	2221	$results['modified'] = $this->filter_ignored( $results['modified'] );
745	2222	$results['suspicious'] = $this->filter_ignored( $results['suspicious'] );
746	2223	$results['extra'] = $this->filter_ignored( $results['extra'] );
		@@ -751,14 +2228,21 @@
751	2228	if ( $this->activity_log ) {
752	2229	$has_issues = ! empty( $results['modified'] ) || ! empty( $results['suspicious'] ) || ! empty( $results['extra'] );
753	2230	$severity = $has_issues ? 'warning' : 'info';
754	2231
	2232	+ /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
	2233	+ $log_text = __( 'File integrity scan completed: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' );
	2234	+
	2235	+ if ( $results['incomplete'] ) {
	2236	+ /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
	2237	+ $log_text = __( 'File integrity scan ran out of time, so its result is partial: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' );
	2238	+ }
	2239	+
755	2240	$this->activity_log->log(
756	2241	'file',
757	2242	'integrity_scan',
758	2243	sprintf(
759		- /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
760		- __( 'File integrity scan completed: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' ),
	2244	+ $log_text,
761	2245	$results['scanned'],
762	2246	count( $results['modified'] ),
763	2247	count( $results['suspicious'] ),
764	2248	count( $results['extra'] )
		@@ -813,9 +2297,10 @@
813	2297	'errors' => array(),
814	2298	);
815	2299
816	2300	// Get official checksums from WordPress.org
817		- $checksums = $this->get_core_checksums();
	2301	+ $this->core_checksums_are_english = false;
	2302	+ $checksums = $this->get_core_checksums();
818	2303
819	2304	if ( is_wp_error( $checksums ) ) {
820	2305	$results['errors'][] = $checksums->get_error_message();
821	2306	return $results;
		@@ -820,8 +2305,37 @@
820	2305	$results['errors'][] = $checksums->get_error_message();
821	2306	return $results;
822	2307	}
823	2308
	2309	+ // The plugins and themes that get a turn of their own in this scan.
	2310	+ $own_turn = array(
	2311	+ 'plugins' => array(),
	2312	+ 'themes' => array(),
	2313	+ );
	2314	+
	2315	+ if ( ! empty( $this->options['scan_plugins'] ) ) {
	2316	+ if ( ! function_exists( 'get_plugins' ) ) {
	2317	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	2318	+ }
	2319	+
	2320	+ foreach ( array_keys( get_plugins() ) as $plugin_file ) {
	2321	+ $slash = strpos( $plugin_file, '/' );
	2322	+
	2323	+ if ( false !== $slash ) {
	2324	+ $own_turn['plugins'][ substr( $plugin_file, 0, $slash ) ] = true;
	2325	+ }
	2326	+ }
	2327	+ }
	2328	+
	2329	+ if ( ! empty( $this->options['scan_themes'] ) ) {
	2330	+ foreach ( array_keys( wp_get_themes() ) as $stylesheet ) {
	2331	+ $stylesheet = (string) $stylesheet;
	2332	+ $slash = strpos( $stylesheet, '/' );
	2333	+
	2334	+ $own_turn['themes'][ false === $slash ? $stylesheet : substr( $stylesheet, 0, $slash ) ] = true;
	2335	+ }
	2336	+ }
	2337	+
824	2338	foreach ( $checksums as $file => $expected_hash ) {
825	2339	// Check time limit
826	2340	if ( $this->is_time_exceeded() ) {
827	2341	break;
		@@ -838,9 +2352,9 @@
838	2352	if ( $this->is_extension_excluded( $file_path ) ) {
839	2353	continue;
840	2354	}
841	2355
842		- // Skip known false positives (e.g. version.php, readme.html)
	2356	+ // Skip known false positives (e.g. readme.html, license.txt)
843	2357	if ( in_array( $file, $this->core_known_false_positives, true ) ) {
844	2358	continue;
845	2359	}
846	2360
		@@ -855,8 +2369,30 @@
855	2369	|| 0 === strpos( $file, 'wp-content/languages/themes/' ) ) {
856	2370	continue;
857	2371	}
858	2372
	2373	+ // The bundled themes and plugins have their own turn. Akismet and
	2374	+ // the default themes are in this list at the version WordPress
	2375	+ // shipped, and they update on their own cycle: every one of those
	2376	+ // updates showed as a modified core file, and deleting one that is
	2377	+ // not in use as missing core files. The plugin and theme scans
	2378	+ // compare them with their own published copy, so they are left to
	2379	+ // those whenever those are on and have them in their list.
	2380	+ if ( preg_match( '#^wp-content/(plugins|themes)/([^/]+)/#', $file, $bundled ) ) {
	2381	+ // Deleted on purpose: nothing to compare and nothing missing.
	2382	+ if ( ! is_dir( ABSPATH . 'wp-content/' . $bundled[1] . '/' . $bundled[2] ) ) {
	2383	+ continue;
	2384	+ }
	2385	+
	2386	+ // Its own scan compares it, but only what WordPress lists as a
	2387	+ // plugin or as a theme gets that turn. A folder that is there
	2388	+ // and is not listed (a plugin without its header, a theme
	2389	+ // without its style.css) stays with the core.
	2390	+ if ( isset( $own_turn[ $bundled[1] ][ $bundled[2] ] ) ) {
	2391	+ continue;
	2392	+ }
	2393	+ }
	2394	+
859	2395	$results['scanned']++;
860	2396
861	2397	if ( ! file_exists( $file_path ) ) {
862	2398	$results['missing'][] = array(
		@@ -867,9 +2403,22 @@
867	2403	}
868	2404
869	2405	$actual_hash = md5_file( $file_path );
870	2406
871		- if ( $actual_hash !== $expected_hash ) {
	2407	+ if ( $actual_hash !== $expected_hash && ! $this->matches_core_of_other_locale( $file, $actual_hash ) ) {
	2408	+ // The two files a translated package changes cannot be told
	2409	+ // from a modified one while only the English list exists. Said
	2410	+ // as what it is, a file that could not be verified, instead of
	2411	+ // as a modified core file.
	2412	+ if ( $this->core_checksums_are_english && in_array( $file, array( 'wp-includes/version.php', 'wp-config-sample.php' ), true ) ) {
	2413	+ $results['errors'][] = sprintf(
	2414	+ /* translators: %s: File name */
	2415	+ __( '%s differs from the English package of WordPress, and WordPress.org has not published the checksums for the language of this site yet, so it could not be verified.', 'vigilante' ),
	2416	+ $file
	2417	+ );
	2418	+ continue;
	2419	+ }
	2420	+
872	2421	$results['modified'][] = array(
873	2422	'file' => $file,
874	2423	'type' => 'core',
875	2424	'expected_hash' => $expected_hash,
		@@ -983,9 +2532,9 @@
983	2532
984	2533	// Also add wp-config.php which is not in checksums but is core
985	2534	$core_root_files[] = 'wp-config.php';
986	2535
987		- $php_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar', 'phps' );
	2536	+ $php_extensions = self::php_extensions();
988	2537
989	2538	// Scan only direct children of ABSPATH (not recursive)
990	2539	$root_path = untrailingslashit( ABSPATH );
991	2540	$handle = opendir( $root_path );
		@@ -1003,9 +2552,22 @@
1003	2552	if ( '.' === $entry || '..' === $entry ) {
1004	2553	continue;
1005	2554	}
1006	2555
1007		- // Skip dotfiles (.htaccess, .user.ini, .env, etc.) — handled by firewall protection
	2556	+ // PHP reads .user.ini and php.ini from the folder of the script, and
	2557	+ // either can make it load a file before every request: the same
	2558	+ // door as .htaccess, for servers that run PHP outside Apache.
	2559	+ if ( in_array( strtolower( $entry ), array( '.user.ini', 'php.ini' ), true ) ) {
	2560	+ $config = $this->is_path_excluded( $root_path . '/' . $entry ) ? null : self::server_config_finding( $root_path . '/' . $entry, $entry );
	2561	+
	2562	+ if ( $config ) {
	2563	+ $config['item']['type'] = 'php_config_in_root';
	2564	+ $found['extra'][] = $config['item'];
	2565	+ }
	2566	+ continue;
	2567	+ }
	2568	+
	2569	+ // Skip dotfiles (.htaccess, .env, etc.): handled by firewall protection
1008	2570	if ( 0 === strpos( $entry, '.' ) ) {
1009	2571	continue;
1010	2572	}
1011	2573
		@@ -1030,8 +2592,13 @@
1030	2592	if ( in_array( strtolower( $entry ), $this->known_safe_root_files, true ) ) {
1031	2593	continue;
1032	2594	}
1033	2595
	2596	+ // Site verification files and sitemaps that are what their name says.
	2597	+ if ( self::is_harmless_root_file( $entry, $full_path ) ) {
	2598	+ continue;
	2599	+ }
	2600	+
1034	2601	$extension = strtolower( pathinfo( $entry, PATHINFO_EXTENSION ) );
1035	2602
1036	2603	if ( in_array( $extension, $php_extensions, true ) ) {
1037	2604	// Check if this is a legacy WordPress core file (removed from newer versions)
		@@ -1053,15 +2620,12 @@
1053	2620	// PHP file not in core = suspicious
1054	2621	$reason = __( 'Non-core PHP file in WordPress root directory', 'vigilante' );
1055	2622
1056	2623	// Scan content for specific patterns
1057		- if ( filesize( $full_path ) < 512000 ) {
1058		- $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
1059		- $pattern = $this->detect_suspicious_pattern( $content );
1060		- if ( $pattern ) {
1061		- /* translators: %s: Suspicious pattern found */
1062		- $reason = sprintf( __( 'Non-core PHP in root with suspicious code: %s', 'vigilante' ), $pattern );
1063		- }
	2624	+ $pattern = $this->search_file( $full_path );
	2625	+ if ( $pattern ) {
	2626	+ /* translators: %s: Suspicious pattern found */
	2627	+ $reason = sprintf( __( 'Non-core PHP in root with suspicious code: %s', 'vigilante' ), $pattern );
1064	2628	}
1065	2629
1066	2630	$found['suspicious'][] = array(
1067	2631	'file' => $entry,
		@@ -1068,8 +2632,20 @@
1068	2632	'type' => 'php_in_root',
1069	2633	'reason' => $reason,
1070	2634	);
1071	2635	} else {
	2636	+ // A copy of the configuration, a database dump or an archive
	2637	+ // is not one more loose file: whoever guesses its name can
	2638	+ // download it.
	2639	+ if ( false !== stripos( $entry, 'wp-config' ) || preg_match( '/\.(?:sql|bak|old|orig|save|swp|dump|zip|gz|tgz|tar|7z|rar)$/i', $entry ) ) {
	2640	+ $found['extra'][] = array(
	2641	+ 'file' => $entry,
	2642	+ 'type' => 'backup_in_root',
	2643	+ 'reason' => __( 'Backup or copy of a sensitive file in the site root, where it can be downloaded', 'vigilante' ),
	2644	+ );
	2645	+ continue;
	2646	+ }
	2647	+
1072	2648	// Non-PHP, non-known-safe file = additional (informational)
1073	2649	$found['extra'][] = array(
1074	2650	'file' => $entry,
1075	2651	'type' => 'extra_root',
		@@ -1082,8 +2658,864 @@
1082	2658
1083	2659	return $found;
1084	2660	}
1085	2661
	2662	+ /**
	2663	+ * The line of a .user.ini or php.ini that makes PHP load a file by itself
	2664	+ *
	2665	+ * @param string $path Absolute path of the file.
	2666	+ * @return string|null The line, an empty string when there is none, or
	2667	+ * null when the file is too large to be read, which
	2668	+ * the caller reports instead of taking for clean.
	2669	+ */
	2670	+ private static function php_ini_loads( $path ) {
	2671	+ // PHP runs as the same user: what it cannot read here it cannot apply.
	2672	+ if ( ! is_readable( $path ) ) {
	2673	+ return '';
	2674	+ }
	2675	+
	2676	+ if ( filesize( $path ) > MB_IN_BYTES ) {
	2677	+ return null;
	2678	+ }
	2679	+
	2680	+ $content = file_get_contents( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look at its directives; nothing is written.
	2681	+
	2682	+ foreach ( preg_split( '/\r\n|\r|\n/', (string) $content ) as $line ) {
	2683	+ $line = trim( $line );
	2684	+
	2685	+ if ( '' === $line || ';' === $line[0] || '#' === $line[0] ) {
	2686	+ continue;
	2687	+ }
	2688	+
	2689	+ if ( preg_match( '/^(auto_prepend_file|auto_append_file)\s*=\s*(.*)$/i', $line, $parts ) ) {
	2690	+ $value = trim( $parts[2], " \t\"'" );
	2691	+
	2692	+ if ( '' !== $value && 'none' !== strtolower( $value ) ) {
	2693	+ return strtolower( $parts[1] ) . ' = ' . substr( $value, 0, 200 );
	2694	+ }
	2695	+ }
	2696	+ }
	2697	+
	2698	+ return '';
	2699	+ }
	2700	+
	2701	+ /**
	2702	+ * What a .htaccess, .user.ini or php.ini outside uploads makes the server do
	2703	+ *
	2704	+ * Inside a plugin, a theme, wp-content or a WordPress folder, one of these
	2705	+ * files is a finding only when it makes the server run code or load a file.
	2706	+ * One that denies access, or does nothing of the kind, is left alone.
	2707	+ *
	2708	+ * @param string $file_path Absolute path.
	2709	+ * @param string $relative Path for display.
	2710	+ * @return array|null Array with 'category' and 'item', or null.
	2711	+ */
	2712	+ private static function server_config_finding( $file_path, $relative ) {
	2713	+ $item = array(
	2714	+ 'file' => $relative,
	2715	+ 'type' => 'server_config',
	2716	+ );
	2717	+
	2718	+ if ( '.htaccess' === strtolower( basename( $file_path ) ) ) {
	2719	+ if ( ! is_readable( $file_path ) ) {
	2720	+ return null;
	2721	+ }
	2722	+
	2723	+ if ( filesize( $file_path ) >= 65536 ) {
	2724	+ $item['reason'] = __( '.htaccess file that is too large to be read', 'vigilante' );
	2725	+
	2726	+ return array(
	2727	+ 'category' => 'extra',
	2728	+ 'item' => $item,
	2729	+ );
	2730	+ }
	2731	+
	2732	+ $facts = self::read_htaccess_rules( file_get_contents( $file_path ) ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look at its directives; nothing is written.
	2733	+
	2734	+ if ( empty( $facts['runs'] ) ) {
	2735	+ return null;
	2736	+ }
	2737	+
	2738	+ $item['reason'] = self::htaccess_run_reason( $facts );
	2739	+
	2740	+ return array(
	2741	+ 'category' => 'suspicious',
	2742	+ 'item' => $item,
	2743	+ );
	2744	+ }
	2745	+
	2746	+ $loads = self::php_ini_loads( $file_path );
	2747	+
	2748	+ if ( '' === $loads ) {
	2749	+ return null;
	2750	+ }
	2751	+
	2752	+ $item['reason'] = null === $loads
	2753	+ ? __( 'PHP configuration file that is too large to be read', 'vigilante' )
	2754	+ /* translators: %s: The line of the file that does it */
	2755	+ : sprintf( __( 'PHP configuration file that loads a file on every request: %s', 'vigilante' ), $loads );
	2756	+
	2757	+ return array(
	2758	+ 'category' => 'extra',
	2759	+ 'item' => $item,
	2760	+ );
	2761	+ }
	2762	+
	2763	+ /**
	2764	+ * Whether a loose file in the site root is a verification file or a sitemap
	2765	+ *
	2766	+ * By what it contains or by its kind, never by its name alone: a Google
	2767	+ * verification file is one line that repeats its own name, and a sitemap
	2768	+ * is XML, which no server runs.
	2769	+ *
	2770	+ * @param string $entry File name.
	2771	+ * @param string $full_path Absolute path.
	2772	+ * @return bool
	2773	+ */
	2774	+ private static function is_harmless_root_file( $entry, $full_path ) {
	2775	+ if ( preg_match( '/^[a-z0-9_-]*sitemap[a-z0-9_-]*\.xml(?:\.gz)?$/i', $entry ) ) {
	2776	+ return true;
	2777	+ }
	2778	+
	2779	+ if ( preg_match( '/^google[0-9a-f]{16}\.html$/', $entry ) && is_readable( $full_path ) && filesize( $full_path ) < 200 ) {
	2780	+ $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to compare it with its own name; nothing is written.
	2781	+
	2782	+ return 'google-site-verification: ' . $entry === trim( (string) $content );
	2783	+ }
	2784	+
	2785	+ return false;
	2786	+ }
	2787	+
	2788	+ /**
	2789	+ * Walk a folder and everything under it without stopping at what cannot be read
	2790	+ *
	2791	+ * A folder PHP cannot open used to end the whole walk in silence, which is
	2792	+ * all it took to blind a scan: one unreadable folder early in the order,
	2793	+ * and nothing after it was looked at. Now the walk goes past it, and the
	2794	+ * caller reports it (see unreadable_folder_error()).
	2795	+ *
	2796	+ * @param string $directory Folder to walk.
	2797	+ * @param callable|null $skip Given the path of a folder, whether to leave
	2798	+ * it and everything under it out of the walk.
	2799	+ * @return RecursiveIteratorIterator Folders included: the caller skips them.
	2800	+ */
	2801	+ private static function walk_folder( $directory, $skip = null ) {
	2802	+ $folder = new RecursiveDirectoryIterator( $directory, RecursiveDirectoryIterator::SKIP_DOTS );
	2803	+
	2804	+ if ( null !== $skip ) {
	2805	+ $folder = new RecursiveCallbackFilterIterator(
	2806	+ $folder,
	2807	+ static function ( $current ) use ( $skip ) {
	2808	+ return ! ( $current->isDir() && call_user_func( $skip, $current->getPathname() ) );
	2809	+ }
	2810	+ );
	2811	+ }
	2812	+
	2813	+ return new RecursiveIteratorIterator(
	2814	+ $folder,
	2815	+ RecursiveIteratorIterator::SELF_FIRST,
	2816	+ RecursiveIteratorIterator::CATCH_GET_CHILD
	2817	+ );
	2818	+ }
	2819	+
	2820	+ /**
	2821	+ * What the scan says about a folder it could not read
	2822	+ *
	2823	+ * @param string $path Absolute path of the folder.
	2824	+ * @return string
	2825	+ */
	2826	+ private static function unreadable_folder_error( $path ) {
	2827	+ return sprintf(
	2828	+ /* translators: %s: Folder path */
	2829	+ __( 'The folder %s could not be read, so what is inside it was not checked.', 'vigilante' ),
	2830	+ str_replace( ABSPATH, '', $path )
	2831	+ );
	2832	+ }
	2833	+
	2834	+ /**
	2835	+ * Extensions a server may be set up to run as PHP
	2836	+ *
	2837	+ * One list for uploads, the site root, the core folders and the plugin and
	2838	+ * theme folders. Each had its own until now, and none had them all.
	2839	+ *
	2840	+ * @return array
	2841	+ */
	2842	+ private static function php_extensions() {
	2843	+ return array( 'php', 'php2', 'php3', 'php4', 'php5', 'php6', 'php7', 'php8', 'phtml', 'pht', 'phar', 'phps', 'inc' );
	2844	+ }
	2845	+
	2846	+ /**
	2847	+ * Look in wp-admin and wp-includes for files WordPress does not ship
	2848	+ *
	2849	+ * The comparison with the official checksums only visits the files the
	2850	+ * checksums name, so a file added to either folder was never looked at. A
	2851	+ * PHP file there that is not part of the installed version is reported as
	2852	+ * suspicious. A file that changes how the server runs code (.htaccess,
	2853	+ * .user.ini, php.ini) is reported as extra, or as suspicious when it
	2854	+ * makes the server run code. Anything else that is not code, such as an
	2855	+ * error log the host writes there, is left alone.
	2856	+ *
	2857	+ * @return array Array with 'suspicious', 'extra' and 'errors' sub-arrays.
	2858	+ */
	2859	+ private function scan_core_folders() {
	2860	+ $found = array(
	2861	+ 'suspicious' => array(),
	2862	+ 'extra' => array(),
	2863	+ 'errors' => array(),
	2864	+ );
	2865	+
	2866	+ $checksums = $this->get_core_checksums();
	2867	+ if ( is_wp_error( $checksums ) ) {
	2868	+ return $found;
	2869	+ }
	2870	+
	2871	+ $php_extensions = self::php_extensions();
	2872	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	2873	+
	2874	+ foreach ( array( 'wp-admin', 'wp-includes' ) as $folder ) {
	2875	+ $directory = ABSPATH . $folder;
	2876	+
	2877	+ if ( ! is_dir( $directory ) ) {
	2878	+ continue;
	2879	+ }
	2880	+
	2881	+ try {
	2882	+ foreach ( self::walk_folder( $directory ) as $file ) {
	2883	+ if ( $this->is_time_exceeded() ) {
	2884	+ break 2;
	2885	+ }
	2886	+
	2887	+ $file_path = $file->getPathname();
	2888	+
	2889	+ if ( $file->isDir() ) {
	2890	+ if ( ! $file->isReadable() ) {
	2891	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	2892	+ }
	2893	+ continue;
	2894	+ }
	2895	+
	2896	+ $relative = $this->normalize_rel_path( str_replace( '\\', '/', str_replace( ABSPATH, '', $file_path ) ) );
	2897	+
	2898	+ if ( isset( $checksums[ $relative ] ) || $this->is_path_excluded( $file_path ) ) {
	2899	+ continue;
	2900	+ }
	2901	+
	2902	+ $extension = strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) );
	2903	+
	2904	+ if ( in_array( $extension, $php_extensions, true ) ) {
	2905	+ // The placeholder some hosts and tools drop in every folder.
	2906	+ if ( $this->is_silence_golden_file( $file_path ) ) {
	2907	+ continue;
	2908	+ }
	2909	+
	2910	+ // Translation files, on the installations old enough
	2911	+ // to keep them in wp-includes/languages: text and
	2912	+ // nothing else, which is checked and not assumed.
	2913	+ if ( self::is_inside_languages( $file_path ) && true === $this->is_literal_data( $file_path ) ) {
	2914	+ continue;
	2915	+ }
	2916	+
	2917	+ /* translators: %s: Folder name, wp-admin or wp-includes */
	2918	+ $reason = sprintf( __( 'File in %s that is not part of the installed WordPress version', 'vigilante' ), $folder );
	2919	+
	2920	+ $pattern = $this->search_file( $file_path );
	2921	+ if ( $pattern ) {
	2922	+ /* translators: 1: Folder name, wp-admin or wp-includes, 2: Suspicious pattern found */
	2923	+ $reason = sprintf( __( 'File in %1$s that is not part of WordPress, with suspicious code: %2$s', 'vigilante' ), $folder, $pattern );
	2924	+ }
	2925	+
	2926	+ $found['suspicious'][] = array(
	2927	+ 'file' => $relative,
	2928	+ 'type' => 'php_in_core',
	2929	+ 'reason' => $reason,
	2930	+ );
	2931	+ } elseif ( in_array( strtolower( basename( $file_path ) ), $config_files, true ) ) {
	2932	+ $config = self::server_config_finding( $file_path, $relative );
	2933	+
	2934	+ if ( $config && 'suspicious' === $config['category'] ) {
	2935	+ $found['suspicious'][] = $config['item'];
	2936	+ continue;
	2937	+ }
	2938	+
	2939	+ $found['extra'][] = array(
	2940	+ 'file' => $relative,
	2941	+ 'type' => 'config_in_core',
	2942	+ /* translators: %s: Folder name, wp-admin or wp-includes */
	2943	+ 'reason' => $config ? $config['item']['reason'] : sprintf( __( 'Server configuration file in %s', 'vigilante' ), $folder ),
	2944	+ );
	2945	+ }
	2946	+ }
	2947	+ } catch ( Exception $e ) {
	2948	+ $found['errors'][] = self::unreadable_folder_error( $directory );
	2949	+ }
	2950	+ }
	2951	+
	2952	+ return $found;
	2953	+ }
	2954	+
	2955	+ /**
	2956	+ * Look for code where there is no official copy to compare with
	2957	+ *
	2958	+ * Must-use plugins, drop-ins, the loose PHP files of wp-content, of the
	2959	+ * plugins folder and of the themes folder, and the folders in those two
	2960	+ * that WordPress does not list as a plugin or as a theme, were not opened
	2961	+ * by any part of the scan, although WordPress loads some of them on every
	2962	+ * request and the rest can be reached by their address. They are searched
	2963	+ * the way a plugin from outside WordPress.org is, for code written the way
	2964	+ * malware hides itself. A loose PHP file or a folder with PHP that is
	2965	+ * neither a plugin, a theme nor a drop-in is listed as extra, and so is a
	2966	+ * .htaccess, .user.ini or php.ini there that makes the server run code or
	2967	+ * load a file.
	2968	+ *
	2969	+ * @return array Array with 'suspicious', 'extra', 'unverified' and 'errors' sub-arrays.
	2970	+ */
	2971	+ private function scan_unlisted_code() {
	2972	+ $found = array(
	2973	+ 'suspicious' => array(),
	2974	+ 'extra' => array(),
	2975	+ 'unverified' => array(),
	2976	+ 'errors' => array(),
	2977	+ );
	2978	+
	2979	+ // Must-use plugins: the whole folder.
	2980	+ if ( defined( 'WPMU_PLUGIN_DIR' ) && is_dir( WPMU_PLUGIN_DIR ) ) {
	2981	+ $mu = $this->detect_extra_files( WPMU_PLUGIN_DIR, array(), 'plugin', __( 'Must-use plugins', 'vigilante' ), true );
	2982	+
	2983	+ $found['suspicious'] = array_merge( $found['suspicious'], $mu['suspicious'] );
	2984	+ $found['extra'] = array_merge( $found['extra'], $mu['extra'] );
	2985	+ $found['errors'] = array_merge( $found['errors'], $mu['errors'] );
	2986	+
	2987	+ if ( $mu['php_files'] > 0 ) {
	2988	+ $found['unverified'][] = __( 'Must-use plugins', 'vigilante' );
	2989	+ }
	2990	+ }
	2991	+
	2992	+ if ( ! function_exists( '_get_dropins' ) || ! function_exists( 'get_plugins' ) ) {
	2993	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	2994	+ }
	2995	+
	2996	+ $php_extensions = self::php_extensions();
	2997	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	2998	+ $dropins = array_keys( _get_dropins() );
	2999	+
	3000	+ // What WordPress lists as a plugin or as a theme, by the file or the
	3001	+ // folder it lives in.
	3002	+ $single_plugins = array();
	3003	+ $plugin_folders = array();
	3004	+ foreach ( get_plugins() as $plugin_file => $plugin_data ) {
	3005	+ if ( false === strpos( $plugin_file, '/' ) ) {
	3006	+ $single_plugins[ $plugin_file ] = $plugin_data['Name'] ?? $plugin_file;
	3007	+ } else {
	3008	+ $plugin_folders[ substr( $plugin_file, 0, strpos( $plugin_file, '/' ) ) ] = true;
	3009	+ }
	3010	+ }
	3011	+
	3012	+ // The themes by where they really are, because there can be more
	3013	+ // than one folder of themes and the same name in two of them.
	3014	+ $theme_folders = array();
	3015	+ foreach ( wp_get_themes() as $stylesheet => $theme ) {
	3016	+ $stylesheet = (string) $stylesheet;
	3017	+ $slash = strpos( $stylesheet, '/' );
	3018	+ $real = realpath( untrailingslashit( $theme->get_theme_root() ) . '/' . ( false === $slash ? $stylesheet : substr( $stylesheet, 0, $slash ) ) );
	3019	+
	3020	+ if ( false !== $real ) {
	3021	+ $theme_folders[ wp_normalize_path( $real ) ] = true;
	3022	+ }
	3023	+ }
	3024	+
	3025	+ $roots = array(
	3026	+ array( 'content', WP_CONTENT_DIR ),
	3027	+ array( 'plugins', WP_PLUGIN_DIR ),
	3028	+ );
	3029	+
	3030	+ // Every folder themes are registered in, not only the usual one. One
	3031	+ // that is inside a plugin belongs to that plugin, and has its turn
	3032	+ // with it.
	3033	+ global $wp_theme_directories;
	3034	+
	3035	+ $plugin_roots = array();
	3036	+ foreach ( array( WP_PLUGIN_DIR, defined( 'WPMU_PLUGIN_DIR' ) ? WPMU_PLUGIN_DIR : '' ) as $plugin_root ) {
	3037	+ $real = '' === (string) $plugin_root ? false : realpath( $plugin_root );
	3038	+
	3039	+ if ( false !== $real ) {
	3040	+ $plugin_roots[ wp_normalize_path( $real ) ] = true;
	3041	+ }
	3042	+ }
	3043	+
	3044	+ $theme_roots = array();
	3045	+ foreach ( array_merge( array( get_theme_root() ), is_array( $wp_theme_directories ) ? $wp_theme_directories : array() ) as $theme_root ) {
	3046	+ $real = '' === (string) $theme_root ? false : realpath( $theme_root );
	3047	+ $real = false === $real ? '' : wp_normalize_path( $real );
	3048	+
	3049	+ if ( '' === $real || isset( $theme_roots[ $real ] ) || self::is_inside_any( $real, $plugin_roots ) ) {
	3050	+ continue;
	3051	+ }
	3052	+
	3053	+ $theme_roots[ $real ] = true;
	3054	+ $roots[] = array( 'themes', untrailingslashit( $theme_root ) );
	3055	+ }
	3056	+
	3057	+ foreach ( $roots as $root ) {
	3058	+ list( $kind, $directory ) = $root;
	3059	+
	3060	+ $entries = is_dir( $directory ) ? scandir( $directory ) : false;
	3061	+
	3062	+ if ( ! is_array( $entries ) ) {
	3063	+ continue;
	3064	+ }
	3065	+
	3066	+ foreach ( $entries as $entry ) {
	3067	+ if ( '.' === $entry || '..' === $entry ) {
	3068	+ continue;
	3069	+ }
	3070	+
	3071	+ if ( $this->is_time_exceeded() ) {
	3072	+ break 2;
	3073	+ }
	3074	+
	3075	+ $path = $directory . '/' . $entry;
	3076	+
	3077	+ if ( $this->is_path_excluded( $path ) ) {
	3078	+ continue;
	3079	+ }
	3080	+
	3081	+ $relative = str_replace( ABSPATH, '', $path );
	3082	+
	3083	+ // A folder among the plugins or the themes that WordPress does
	3084	+ // not list as one: no scan had a turn for it.
	3085	+ if ( is_dir( $path ) ) {
	3086	+ $real = realpath( $path );
	3087	+ $listed = 'plugins' === $kind ? isset( $plugin_folders[ $entry ] ) : ( 'themes' === $kind ? ( false !== $real && isset( $theme_folders[ wp_normalize_path( $real ) ] ) ) : true );
	3088	+
	3089	+ // A link is followed like any other folder, because what
	3090	+ // is behind it is reached by its address just the same,
	3091	+ // unless it leads back to wp-content or above it, which
	3092	+ // would be walking the site a second time.
	3093	+ if ( $listed || ( is_link( $path ) && self::leads_back( $path ) ) ) {
	3094	+ continue;
	3095	+ }
	3096	+
	3097	+ $inside = $this->detect_extra_files( $path, array(), 'themes' === $kind ? 'theme' : 'plugin', $entry, true );
	3098	+
	3099	+ $found['suspicious'] = array_merge( $found['suspicious'], $inside['suspicious'] );
	3100	+ $found['extra'] = array_merge( $found['extra'], $inside['extra'] );
	3101	+ $found['errors'] = array_merge( $found['errors'], $inside['errors'] );
	3102	+
	3103	+ if ( $inside['php_files'] > 0 ) {
	3104	+ $found['extra'][] = array(
	3105	+ 'file' => $relative,
	3106	+ 'type' => 'php_in_content',
	3107	+ 'reason' => 'themes' === $kind
	3108	+ ? __( 'Folder with PHP files that WordPress does not list as a theme', 'vigilante' )
	3109	+ : __( 'Folder with PHP files that WordPress does not list as a plugin', 'vigilante' ),
	3110	+ );
	3111	+ }
	3112	+ continue;
	3113	+ }
	3114	+
	3115	+ if ( in_array( strtolower( $entry ), $config_files, true ) ) {
	3116	+ $config = self::server_config_finding( $path, $relative );
	3117	+
	3118	+ if ( $config ) {
	3119	+ $found[ $config['category'] ][] = $config['item'];
	3120	+ }
	3121	+ continue;
	3122	+ }
	3123	+
	3124	+ $extension = strtolower( pathinfo( $entry, PATHINFO_EXTENSION ) );
	3125	+
	3126	+ if ( ! in_array( $extension, $php_extensions, true ) || $this->is_silence_golden_file( $path ) ) {
	3127	+ continue;
	3128	+ }
	3129	+
	3130	+ // hello.php comes with WordPress and is compared with it.
	3131	+ if ( 'plugins' === $kind && 'hello.php' === $entry ) {
	3132	+ continue;
	3133	+ }
	3134	+
	3135	+ $pattern = $this->search_file( $path, true );
	3136	+
	3137	+ $known = ( 'plugins' === $kind && isset( $single_plugins[ $entry ] ) ) || ( 'content' === $kind && in_array( $entry, $dropins, true ) );
	3138	+
	3139	+ if ( $known ) {
	3140	+ $found['unverified'][] = 'plugins' === $kind ? $single_plugins[ $entry ] : __( 'Drop-ins', 'vigilante' );
	3141	+ }
	3142	+
	3143	+ if ( $pattern ) {
	3144	+ $found['suspicious'][] = array(
	3145	+ 'file' => $relative,
	3146	+ 'type' => 'suspicious_plugin',
	3147	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	3148	+ 'reason' => sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), dirname( $relative ), $pattern ),
	3149	+ );
	3150	+ } elseif ( ! $known ) {
	3151	+ $found['extra'][] = array(
	3152	+ 'file' => $relative,
	3153	+ 'type' => 'php_in_content',
	3154	+ 'reason' => __( 'PHP file that is not a plugin, a theme or a WordPress drop-in', 'vigilante' ),
	3155	+ );
	3156	+ } elseif ( null === $pattern ) {
	3157	+ $found['extra'][] = $this->not_searched_item( $path, $relative );
	3158	+ }
	3159	+ }
	3160	+ }
	3161	+
	3162	+ $found['unverified'] = array_values( array_unique( $found['unverified'] ) );
	3163	+
	3164	+ return $found;
	3165	+ }
	3166	+
	3167	+ /**
	3168	+ * Look in the folders of wp-content that belong to no plugin and no theme
	3169	+ *
	3170	+ * cache, languages, upgrade and whatever else is there were not opened by
	3171	+ * any part of the scan, and a PHP file in any of them can be reached by
	3172	+ * its address like one anywhere else. Every PHP file in them is searched
	3173	+ * for hidden code, the way a plugin from outside WordPress.org is, and a
	3174	+ * .htaccess, .user.ini or php.ini is reported when it makes the server run
	3175	+ * code or load a file. A folder with PHP files that could only be
	3176	+ * searched is named among what has no official copy.
	3177	+ *
	3178	+ * Translation files are the exception, because what they must hold is
	3179	+ * known: text. WordPress loads the .l10n.php files of the site language
	3180	+ * with include on every request
	3181	+ * (wp-includes/l10n/class-wp-translation-file-php.php:24), so one that
	3182	+ * holds anything else is reported whatever the code looks like, and any
	3183	+ * other PHP file among the translations is listed. A PHP file that holds
	3184	+ * literal data and nothing else cannot run anything, and is left alone
	3185	+ * wherever it is (see is_literal_data()).
	3186	+ *
	3187	+ * Plugins, themes, must-use plugins and uploads have their own scans and
	3188	+ * are skipped here. The folders whose name says cache go last, and the
	3189	+ * whole walk has a share of the scan time of its own, so a cache with a
	3190	+ * hundred thousand files costs that share and no more.
	3191	+ *
	3192	+ * @return array Array with 'suspicious', 'extra', 'unverified' and 'errors' sub-arrays.
	3193	+ */
	3194	+ private function scan_content_folders() {
	3195	+ $found = array(
	3196	+ 'suspicious' => array(),
	3197	+ 'extra' => array(),
	3198	+ 'unverified' => array(),
	3199	+ 'errors' => array(),
	3200	+ );
	3201	+
	3202	+ $entries = is_dir( WP_CONTENT_DIR ) ? scandir( WP_CONTENT_DIR ) : false;
	3203	+
	3204	+ if ( ! is_array( $entries ) ) {
	3205	+ return $found;
	3206	+ }
	3207	+
	3208	+ // The folders with a scan of their own, by where they really are.
	3209	+ global $wp_theme_directories;
	3210	+
	3211	+ $uploads = wp_get_upload_dir();
	3212	+ $uploads_real = empty( $uploads['basedir'] ) ? false : realpath( $uploads['basedir'] );
	3213	+ $uploads_real = false === $uploads_real ? '' : wp_normalize_path( $uploads_real );
	3214	+ $own = array();
	3215	+ $roots = array_merge(
	3216	+ array( WP_PLUGIN_DIR, defined( 'WPMU_PLUGIN_DIR' ) ? WPMU_PLUGIN_DIR : '', get_theme_root() ),
	3217	+ is_array( $wp_theme_directories ) ? $wp_theme_directories : array()
	3218	+ );
	3219	+
	3220	+ foreach ( $roots as $root ) {
	3221	+ $real = '' === (string) $root ? false : realpath( $root );
	3222	+
	3223	+ if ( false !== $real ) {
	3224	+ $own[ wp_normalize_path( $real ) ] = true;
	3225	+ }
	3226	+ }
	3227	+
	3228	+ if ( '' !== $uploads_real ) {
	3229	+ $own[ $uploads_real ] = true;
	3230	+ }
	3231	+
	3232	+ // On a site of a network that is not the main one, the uploads of the
	3233	+ // site live inside the uploads of the network, which are the main
	3234	+ // site's turn.
	3235	+ $network_uploads = is_multisite() && ! is_main_site() ? $uploads_real : '';
	3236	+
	3237	+ $folders = array();
	3238	+
	3239	+ foreach ( $entries as $entry ) {
	3240	+ $path = WP_CONTENT_DIR . '/' . $entry;
	3241	+
	3242	+ if ( '.' === $entry || '..' === $entry || ! is_dir( $path ) ) {
	3243	+ continue;
	3244	+ }
	3245	+
	3246	+ $real = realpath( $path );
	3247	+ $real = false === $real ? '' : wp_normalize_path( $real );
	3248	+
	3249	+ // A folder with a scan of its own, or a link into one. A link to
	3250	+ // anywhere else is walked like the folder it stands for: deploy
	3251	+ // tools keep languages or a cache behind one, and what is there
	3252	+ // is reached by its address all the same.
	3253	+ if ( '' === $real || self::is_inside_any( $real, $own ) || ( is_link( $path ) && self::leads_back( $path ) ) ) {
	3254	+ continue;
	3255	+ }
	3256	+
	3257	+ if ( '' !== $network_uploads && 0 === strpos( $network_uploads, $real . '/' ) ) {
	3258	+ continue;
	3259	+ }
	3260	+
	3261	+ if ( $this->is_path_excluded( $path . '/.' ) ) {
	3262	+ continue;
	3263	+ }
	3264	+
	3265	+ $folders[] = $entry;
	3266	+ }
	3267	+
	3268	+ usort(
	3269	+ $folders,
	3270	+ static function ( $a, $b ) {
	3271	+ $a_cache = false !== stripos( $a, 'cache' );
	3272	+ $b_cache = false !== stripos( $b, 'cache' );
	3273	+
	3274	+ return $a_cache === $b_cache ? strcmp( $a, $b ) : ( $a_cache ? 1 : -1 );
	3275	+ }
	3276	+ );
	3277	+
	3278	+ $php_extensions = self::php_extensions();
	3279	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	3280	+ $deadline = microtime( true ) + $this->content_folders_time;
	3281	+
	3282	+ // A folder with a scan of its own nested further down, or one the
	3283	+ // user left out, is not walked at all.
	3284	+ $skip = function ( $folder ) use ( $own ) {
	3285	+ $real = realpath( $folder );
	3286	+
	3287	+ return ( false !== $real && isset( $own[ wp_normalize_path( $real ) ] ) ) || $this->is_path_excluded( $folder . '/.' );
	3288	+ };
	3289	+
	3290	+ foreach ( $folders as $entry ) {
	3291	+ $path = WP_CONTENT_DIR . '/' . $entry;
	3292	+ $php_files = 0;
	3293	+
	3294	+ try {
	3295	+ foreach ( self::walk_folder( $path, $skip ) as $file ) {
	3296	+ if ( $this->is_time_exceeded() ) {
	3297	+ break 2;
	3298	+ }
	3299	+
	3300	+ if ( microtime( true ) > $deadline ) {
	3301	+ $found['errors'][] = sprintf(
	3302	+ /* translators: %s: Folder path */
	3303	+ __( 'The folders of wp-content outside plugins, themes and uploads were not checked completely: the time for them ran out in %s. If that folder only holds files that change all the time, such as a cache, add it to Excluded Paths.', 'vigilante' ),
	3304	+ str_replace( ABSPATH, '', $path )
	3305	+ );
	3306	+ break 2;
	3307	+ }
	3308	+
	3309	+ $file_path = $file->getPathname();
	3310	+
	3311	+ if ( $file->isDir() ) {
	3312	+ if ( ! $file->isReadable() ) {
	3313	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	3314	+ }
	3315	+ continue;
	3316	+ }
	3317	+
	3318	+ $basename = strtolower( basename( $file_path ) );
	3319	+
	3320	+ if ( in_array( $basename, $config_files, true ) ) {
	3321	+ $config = $this->is_path_excluded( $file_path ) ? null : self::server_config_finding( $file_path, str_replace( ABSPATH, '', $file_path ) );
	3322	+
	3323	+ if ( $config ) {
	3324	+ $found[ $config['category'] ][] = $config['item'];
	3325	+ }
	3326	+ continue;
	3327	+ }
	3328	+
	3329	+ if ( ! in_array( strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) ), $php_extensions, true ) ) {
	3330	+ continue;
	3331	+ }
	3332	+
	3333	+ if ( $this->is_path_excluded( $file_path ) || $this->is_silence_golden_file( $file_path ) ) {
	3334	+ continue;
	3335	+ }
	3336	+
	3337	+ $literal = $this->is_literal_data( $file_path );
	3338	+
	3339	+ if ( true === $literal ) {
	3340	+ continue;
	3341	+ }
	3342	+
	3343	+ $relative = str_replace( ABSPATH, '', $file_path );
	3344	+
	3345	+ if ( false === $literal && '.l10n.php' === substr( $basename, -9 ) ) {
	3346	+ // Reported whatever the search finds, like a PHP file
	3347	+ // in uploads: WordPress loads it on every request, and
	3348	+ // no tool writes anything but the table of texts in
	3349	+ // it. What the search finds is said next to it.
	3350	+ $pattern = $this->search_file( $file_path, true );
	3351	+ $reason = __( 'Translation file that holds something other than translations', 'vigilante' );
	3352	+
	3353	+ if ( $pattern ) {
	3354	+ /* translators: %s: Suspicious pattern found */
	3355	+ $reason = sprintf( __( 'Translation file with suspicious code: %s', 'vigilante' ), $pattern );
	3356	+ }
	3357	+
	3358	+ $found['suspicious'][] = array(
	3359	+ 'file' => $relative,
	3360	+ 'type' => 'translation_with_code',
	3361	+ 'reason' => $reason,
	3362	+ );
	3363	+ continue;
	3364	+ }
	3365	+
	3366	+ $pattern = $this->search_file( $file_path, true );
	3367	+
	3368	+ if ( $pattern ) {
	3369	+ $found['suspicious'][] = array(
	3370	+ 'file' => $relative,
	3371	+ 'type' => 'suspicious_content',
	3372	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	3373	+ 'reason' => sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), str_replace( ABSPATH, '', $path ), $pattern ),
	3374	+ );
	3375	+ } elseif ( null === $pattern ) {
	3376	+ $found['extra'][] = $this->not_searched_item( $file_path, $relative );
	3377	+ } elseif ( self::is_inside_languages( $file_path ) ) {
	3378	+ $found['extra'][] = array(
	3379	+ 'file' => $relative,
	3380	+ 'type' => 'php_in_content',
	3381	+ 'reason' => __( 'PHP file among the translations that is not a translation file', 'vigilante' ),
	3382	+ );
	3383	+ } else {
	3384	+ $php_files++;
	3385	+ }
	3386	+ }
	3387	+ } catch ( Exception $e ) {
	3388	+ $found['errors'][] = self::unreadable_folder_error( $path );
	3389	+ }
	3390	+
	3391	+ if ( $php_files > 0 ) {
	3392	+ $found['unverified'][] = str_replace( ABSPATH, '', $path );
	3393	+ }
	3394	+ }
	3395	+
	3396	+ return $found;
	3397	+ }
	3398	+
	3399	+ /**
	3400	+ * Whether a real path is one of a set of folders or lies inside one of them
	3401	+ *
	3402	+ * @param string $real Real path, with forward slashes.
	3403	+ * @param array $folders Real paths with forward slashes, as keys.
	3404	+ * @return bool
	3405	+ */
	3406	+ private static function is_inside_any( $real, $folders ) {
	3407	+ foreach ( array_keys( $folders ) as $folder ) {
	3408	+ if ( $real === $folder || 0 === strpos( $real, $folder . '/' ) ) {
	3409	+ return true;
	3410	+ }
	3411	+ }
	3412	+
	3413	+ return false;
	3414	+ }
	3415	+
	3416	+ /**
	3417	+ * Whether a link leads to wp-content itself or to a folder above it
	3418	+ *
	3419	+ * @param string $path Path of the link.
	3420	+ * @return bool True also when where it leads cannot be worked out.
	3421	+ */
	3422	+ private static function leads_back( $path ) {
	3423	+ $real = realpath( $path );
	3424	+ $content = realpath( WP_CONTENT_DIR );
	3425	+
	3426	+ if ( false === $real || false === $content ) {
	3427	+ return true;
	3428	+ }
	3429	+
	3430	+ return 0 === strpos( wp_normalize_path( $content ) . '/', wp_normalize_path( $real ) . '/' );
	3431	+ }
	3432	+
	3433	+ /**
	3434	+ * Whether a path is inside the folder WordPress keeps its translations in
	3435	+ *
	3436	+ * @param string $path Absolute path.
	3437	+ * @return bool
	3438	+ */
	3439	+ private static function is_inside_languages( $path ) {
	3440	+ if ( ! defined( 'WP_LANG_DIR' ) ) {
	3441	+ return false;
	3442	+ }
	3443	+
	3444	+ return 0 === strpos( wp_normalize_path( $path ), untrailingslashit( wp_normalize_path( WP_LANG_DIR ) ) . '/' );
	3445	+ }
	3446	+
	3447	+ /**
	3448	+ * Whether a PHP file holds literal data and nothing else
	3449	+ *
	3450	+ * A file such as "<?php return [ 'a' => 'b' ];" cannot run anything. It is
	3451	+ * how WordPress, GlotPress, WP-CLI and Loco Translate write translation
	3452	+ * files, and how plugins keep small tables. The file is read one piece at
	3453	+ * a time, and every piece has to be a quoted string with nothing
	3454	+ * interpolated in it, a number, true, false, null, return, an array
	3455	+ * bracket, a comma, "=>", a dot or a semicolon. A parenthesis is
	3456	+ * accepted only as part of "array(" and to close it, so
	3457	+ * nothing can be called, and with those pieces there is no way to name a
	3458	+ * variable, a function, a class or a file.
	3459	+ *
	3460	+ * Anything else, a comment included, and the answer is no. Saying no to a
	3461	+ * harmless file only means it is searched like any other; saying yes to
	3462	+ * a file with code would hide it. So this reads less than PHP does, on
	3463	+ * purpose. Each piece is also one PHP would cut the same way: a minus
	3464	+ * sign only in front of a number and a dot never in front of "=", or
	3465	+ * "-=>" and ".=>" would be read here as an arrow and by PHP as an
	3466	+ * assignment. What it accepts is checked against PHP's own reading of
	3467	+ * the same file, at random, in the release checks.
	3468	+ *
	3469	+ * @param string $file_path Absolute path.
	3470	+ * @return bool|null True when it holds only data, false when it holds
	3471	+ * anything else, null when it could not be read whole.
	3472	+ */
	3473	+ private function is_literal_data( $file_path ) {
	3474	+ if ( ! is_file( $file_path ) || ! is_readable( $file_path ) ) {
	3475	+ return null;
	3476	+ }
	3477	+
	3478	+ // With another source encoding set (zend.multibyte), a string does
	3479	+ // not end for PHP where it ends byte by byte: nothing is vouched for.
	3480	+ if ( ini_get( 'zend.multibyte' ) ) {
	3481	+ return null;
	3482	+ }
	3483	+
	3484	+ $size = filesize( $file_path );
	3485	+
	3486	+ if ( false === $size || $size > self::MAX_SEARCHED_BYTES ) {
	3487	+ return null;
	3488	+ }
	3489	+
	3490	+ $content = file_get_contents( $file_path, false, null, 0, self::MAX_SEARCHED_BYTES + 1 ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to see whether it holds anything but data; nothing is written.
	3491	+
	3492	+ if ( false === $content || strlen( $content ) > self::MAX_SEARCHED_BYTES ) {
	3493	+ return null;
	3494	+ }
	3495	+
	3496	+ if ( 1 !== preg_match( '/\A<\?php[ \t\r\n]/', $content ) ) {
	3497	+ return false;
	3498	+ }
	3499	+
	3500	+ $piece = '/\G(?:[ \t\r\n]++|\'[^\'\\\\]*+(?:\\\\.[^\'\\\\]*+)*+\'|"[^"\\\\$]*+(?:\\\\.[^"\\\\$]*+)*+"|-?+\d++(?:\.\d++)?+(?:e[+-]?+\d++)?+|=>|\.(?!=)|[\[\],;)]|(?:true|false|null|return)(?![a-z0-9_\x80-\xff])|array[ \t\r\n]*+\()/is';
	3501	+ $length = strlen( $content );
	3502	+ $offset = 6;
	3503	+
	3504	+ while ( $offset < $length ) {
	3505	+ $match = array();
	3506	+ $result = preg_match( $piece, $content, $match, 0, $offset );
	3507	+
	3508	+ if ( 1 !== $result ) {
	3509	+ return false === $result ? null : false;
	3510	+ }
	3511	+
	3512	+ $offset += strlen( $match[0] );
	3513	+ }
	3514	+
	3515	+ return true;
	3516	+ }
	3517	+
1086	3518	// =========================================================================
1087	3519	// Critical config file baseline monitoring (wp-config.php, .htaccess)
1088	3520	// =========================================================================
1089	3521
		@@ -1099,18 +3531,71 @@
1099	3531	* silently — there is nothing to compare against.
1100	3532	*
1101	3533	* @return array Array of modified file entries (same format as core modified).
1102	3534	*/
	3535	+ /**
	3536	+ * Where a critical root file actually lives
	3537	+ *
	3538	+ * WordPress supports wp-config.php one directory above ABSPATH, guarded by
	3539	+ * wp-settings.php not being there: that is literally what the installed core
	3540	+ * does in wp-load.php, and it is a common hardening layout. Until 2.11.10
	3541	+ * this module only looked inside ABSPATH, so on those installations
	3542	+ * wp-config.php was never added to the baseline, never compared and never
	3543	+ * mentioned: the module reported the site clean without having opened the
	3544	+ * one file it most needs to watch. A zero is justified, never assumed. The
	3545	+ * plugin already resolved both locations elsewhere
	3546	+ * (Vigilante_Database_Prefix::find_wpconfig_path()), just not here. Found by
	3547	+ * the file-by-file review of 2.11.10.
	3548	+ *
	3549	+ * @since 2.11.10
	3550	+ *
	3551	+ * @param string $filename Name of the file, such as wp-config.php.
	3552	+ * @return string|false Absolute path, or false when it cannot be found.
	3553	+ */
	3554	+ private function critical_file_path( $filename ) {
	3555	+ $root = untrailingslashit( ABSPATH );
	3556	+ $path = $root . '/' . $filename;
	3557	+
	3558	+ if ( file_exists( $path ) ) {
	3559	+ return $path;
	3560	+ }
	3561	+
	3562	+ if ( 'wp-config.php' === $filename ) {
	3563	+ $above = dirname( $root ) . '/wp-config.php';
	3564	+
	3565	+ // Suppressed like the core does in wp-load.php: the directory above
	3566	+ // the install is often outside open_basedir on shared hosting, and
	3567	+ // without the @ every scan emits a warning that can land in front of
	3568	+ // the JSON of an AJAX scan.
	3569	+ // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- The same @ the core uses for this same check in wp-load.php:52, where a wp-config.php one directory up is looked for: open_basedir makes file_exists() warn on a path outside it, and this must not print.
	3570	+ if ( @file_exists( $above ) && ! @file_exists( dirname( $root ) . '/wp-settings.php' ) ) {
	3571	+ return $above;
	3572	+ }
	3573	+ }
	3574	+
	3575	+ return false;
	3576	+ }
	3577	+
1103	3578	private function scan_critical_root_files() {
	3579	+ // Before reading anything: the scan is the only thing that reaches
	3580	+ // every site of a network on its own, through wp-cron and front-end
	3581	+ // traffic. Hooking the cleanup to admin_init alone left every subsite
	3582	+ // whose dashboard nobody opens with its old copy of wp-config.php,
	3583	+ // credentials included, for as long as nobody visited it.
	3584	+ $this->maybe_redact_stored_baseline();
	3585	+
	3586	+ // And claim the blocks already on disk before anything is compared,
	3587	+ // so the first scan after updating uses the rule that will stay.
	3588	+ $this->maybe_claim_owned_blocks();
	3589	+
1104	3590	$modified = array();
1105	3591	$baseline = $this->get_critical_files_baseline();
1106	3592	$baseline_changed = false;
1107		- $root_path = untrailingslashit( ABSPATH );
1108	3593
1109	3594	foreach ( $this->critical_root_files as $filename ) {
1110		- $full_path = $root_path . '/' . $filename;
	3595	+ $full_path = $this->critical_file_path( $filename );
1111	3596
1112		- if ( ! file_exists( $full_path ) ) {
	3597	+ if ( false === $full_path ) {
1113	3598	continue;
1114	3599	}
1115	3600
1116	3601	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -1139,12 +3624,53 @@
1139	3624	$baseline_changed = true;
1140	3625	continue;
1141	3626	}
1142	3627
1143		- // Compare against stored baseline
1144		- if ( $baseline[ $filename ]['hash'] !== $current_hash ) {
1145		- // Both sides go through the same redaction, or every
1146		- // credential line would read as a change nobody made.
	3628	+ /*
	3629	+ * The file has not changed, but the copy on record is not the copy
	3630	+ * that would be stored today: an entry written before 2.11.2 with
	3631	+ * the credentials in it, or one written before the redaction list
	3632	+ * grew. Rewrite it.
	3633	+ *
	3634	+ * Only when the hash matches, and that condition is the whole
	3635	+ * point: if the file HAD changed, this entry is the evidence of
	3636	+ * the change that the administrator still has to review, and
	3637	+ * rewriting it here would quietly destroy that evidence.
	3638	+ */
	3639	+ if ( $baseline[ $filename ]['hash'] === $current_hash ) {
	3640	+ $expected = $this->baseline_content( $filename, $normalized );
	3641	+
	3642	+ if ( $expected !== $baseline[ $filename ]['content'] ) {
	3643	+ $baseline[ $filename ]['content'] = $expected;
	3644	+ $baseline_changed = true;
	3645	+ }
	3646	+
	3647	+ continue;
	3648	+ }
	3649	+
	3650	+ /*
	3651	+ * Everything from here down is the changed file, and only that: the
	3652	+ * branch above returns on every matching hash, so there is no third
	3653	+ * case and no condition left to test. It used to be wrapped in an
	3654	+ * `if` repeating the opposite comparison, which read as if some
	3655	+ * other path could reach this point. It could not. Flagged by
	3656	+ * @calzbert, and worth the two lines it costs to say so.
	3657	+ *
	3658	+ * Both sides go through the same redaction, or every credential
	3659	+ * line would read as a change nobody made.
	3660	+ */
	3661	+ /*
	3662	+ * Where the shared files do not belong to this site, the lines are
	3663	+ * not computed at all. The diff is shown to whoever can open this
	3664	+ * site's screen, the administrator of a subsite included, and it
	3665	+ * was stored in the options of every subsite with the module on.
	3666	+ * Found by the audit of the admin surface for 2.11.8. The change is
	3667	+ * still reported, with both sizes, and the lines are read on the
	3668	+ * main site, where the change is approved.
	3669	+ */
	3670	+ if ( ! Vigilante_Settings::owns_shared_files() ) {
	3671	+ $diff = self::network_only_diff();
	3672	+ } else {
1147	3673	$baseline_content = $baseline[ $filename ]['content'] ?? '';
1148	3674	$current_content = $this->baseline_content( $filename, $normalized );
1149	3675	$diff = ( '' !== $baseline_content && '' !== $current_content )
1150	3676	? $this->compute_simple_diff( $baseline_content, $current_content )
		@@ -1149,22 +3675,29 @@
1149	3675	$diff = ( '' !== $baseline_content && '' !== $current_content )
1150	3676	? $this->compute_simple_diff( $baseline_content, $current_content )
1151	3677	: array( 'added' => array(), 'removed' => array(), 'unavailable' => true );
1152	3678
1153		- $modified[] = array(
1154		- 'file' => $filename,
1155		- 'type' => 'critical_config',
1156		- 'expected_hash' => $baseline[ $filename ]['hash'],
1157		- 'actual_hash' => $current_hash,
1158		- 'baseline_size' => $baseline[ $filename ]['size'],
1159		- 'current_size' => strlen( $content ),
1160		- 'diff' => $diff,
1161		- );
	3679	+ // Say why there are no lines when today's copy could not be
	3680	+ // made safe, which approving does not change: the generic
	3681	+ // message talks about an old baseline. Cross review of 2.11.8.
	3682	+ if ( '' === $current_content && 'wp-config.php' === $filename ) {
	3683	+ $diff['redaction'] = true;
	3684	+ }
1162	3685	}
	3686	+
	3687	+ $modified[] = array(
	3688	+ 'file' => $filename,
	3689	+ 'type' => 'critical_config',
	3690	+ 'expected_hash' => $baseline[ $filename ]['hash'],
	3691	+ 'actual_hash' => $current_hash,
	3692	+ 'baseline_size' => $baseline[ $filename ]['size'],
	3693	+ 'current_size' => strlen( $content ),
	3694	+ 'diff' => $diff,
	3695	+ );
1163	3696	}
1164	3697
1165	3698	if ( $baseline_changed ) {
1166		- update_option( self::BASELINE_OPTION, $baseline, false );
	3699	+ $this->write_baseline( $baseline );
1167	3700	}
1168	3701
1169	3702	return $modified;
1170	3703	}
		@@ -1236,30 +3769,49 @@
1236	3769	* @param string $filename File name (e.g. 'wp-config.php').
1237	3770	* @param string $content Raw file content.
1238	3771	* @return string Normalized content for hashing.
1239	3772	*/
1240		- private function normalize_critical_file( $filename, $content ) {
	3773	+ private function normalize_critical_file( $filename, $content, $drop_all_original = false ) {
1241	3774	// Normalize line endings first (CRLF and CR to LF)
1242	3775	$content = str_replace( array( "\r\n", "\r" ), "\n", $content );
1243	3776
	3777	+ /*
	3778	+ * Vigilant's own blocks are left out of the hash, so rewriting them is
	3779	+ * not reported as somebody else's change. Until 2.11.5 that covered
	3780	+ * everything between the markers, and every line carrying the
	3781	+ * [VIGILANTE_ORIGINAL] marker, whatever they contained. From 2.11.5 a
	3782	+ * block is left out only if it is exactly a block Vigilant wrote (see
	3783	+ * remember_owned_block()), and a marked line only while uncommenting it
	3784	+ * would still give a harmless define() (see is_vigilant_original_line()).
	3785	+ *
	3786	+ * Until the blocks already on disk have been claimed, the old rule
	3787	+ * applies unchanged. That is what keeps an update from changing the
	3788	+ * hash of a file nobody touched.
	3789	+ */
	3790	+ $claimed = $this->owned_blocks_claimed();
	3791	+
1244	3792	if ( 'wp-config.php' === $filename ) {
1245		- // Remove Vigilante constants blocks (current and legacy)
	3793	+ // Vigilante constants blocks (current and legacy)
1246	3794	foreach ( $this->wpconfig_markers as $markers ) {
1247		- $pattern = '/' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . '\s*/s';
1248		- $content = preg_replace( $pattern, '', $content );
	3795	+ $content = $this->strip_vigilant_blocks( $filename, $content, $markers, $claimed );
1249	3796	}
1250	3797
1251		- // Remove lines commented out by Vigilante (original constants)
1252		- $content = preg_replace(
	3798	+ // Lines commented out by Vigilante (original constants)
	3799	+ $content = preg_replace_callback(
1253	3800	'/^.*' . preg_quote( $this->wpconfig_original_marker, '/' ) . '.*$/m',
1254		- '',
	3801	+ function ( $line ) use ( $claimed, $drop_all_original ) {
	3802	+ // $drop_all_original reproduce la regla anterior a la 2.11.5 (quitar
	3803	+ // toda linea marcada) sobre los bloques de la regla nueva. Solo lo usa
	3804	+ // el re-base de la transicion, para decidir si la unica diferencia con
	3805	+ // el registro aprobado son estas lineas. Ver rebase_original_line_shift().
	3806	+ return ( ! $claimed || $drop_all_original || $this->is_vigilant_original_line( $line[0] ) ) ? '' : $line[0];
	3807	+ },
1255	3808	$content
1256	3809	);
1257	3810	} elseif ( '.htaccess' === $filename ) {
1258		- // Remove Vigilante htaccess blocks (firewall + security headers)
	3811	+ // Vigilante htaccess blocks (firewall + security headers)
1259	3812	foreach ( $this->htaccess_markers as $markers ) {
1260		- $pattern = '/' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . '\s*/s';
1261		- $content = preg_replace( $pattern, '', $content );
	3813	+ $content = $this->strip_vigilant_blocks( $filename, $content, $markers, $claimed );
1262	3814	}
1263	3815	}
1264	3816
1265	3817	// Collapse multiple blank lines into one (blocks removal leaves gaps)
		@@ -1268,15 +3820,645 @@
1268	3820	return trim( $content );
1269	3821	}
1270	3822
1271	3823	/**
	3824	+ * Leave Vigilant's blocks for one pair of markers out of the content
	3825	+ *
	3826	+ * Before the claim, every block, as it always was. After it, only the blocks
	3827	+ * whose fingerprint was recorded when Vigilant wrote them. A block that does
	3828	+ * not match, edited or planted, stays in the content: it counts in the hash
	3829	+ * and shows up in the diff.
	3830	+ *
	3831	+ * The match runs from marker to marker and the removal also takes the
	3832	+ * whitespace after the block, exactly as before, so a file whose blocks are
	3833	+ * all Vigilant's normalizes to the same text under both rules.
	3834	+ *
	3835	+ * @since 2.11.5
	3836	+ *
	3837	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	3838	+ * @param string $content Content with normalized line endings.
	3839	+ * @param array $markers Start and end marker.
	3840	+ * @param bool $claimed Whether the claim has run.
	3841	+ * @return string
	3842	+ */
	3843	+ private function strip_vigilant_blocks( $filename, $content, $markers, $claimed ) {
	3844	+ $pattern = '/(' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . ')\s*/s';
	3845	+
	3846	+ if ( ! $claimed ) {
	3847	+ return preg_replace( $pattern, '', $content );
	3848	+ }
	3849	+
	3850	+ return preg_replace_callback(
	3851	+ $pattern,
	3852	+ function ( $match ) use ( $filename ) {
	3853	+ return self::is_owned_block( $filename, $match[1] ) ? '' : $match[0];
	3854	+ },
	3855	+ $content
	3856	+ );
	3857	+ }
	3858	+
	3859	+ /**
	3860	+ * Whether a line carrying the original-constant marker is one Vigilant wrote
	3861	+ *
	3862	+ * comment_existing_constants() puts the marker in front of a define() of a
	3863	+ * constant it manages, and uncomment_original_constants() takes it away
	3864	+ * again whenever the constants are applied or removed, so whatever follows
	3865	+ * the marker gets to run some day. The line is left out of the hash only
	3866	+ * when there is nothing but indentation before the marker, nothing after it
	3867	+ * but a harmless define() and at most a line comment, and no PHP tag
	3868	+ * anywhere on it. That keeps it a comment today and harmless once
	3869	+ * uncommented. Anything else counts, and shows up in the diff.
	3870	+ *
	3871	+ * @since 2.11.5
	3872	+ *
	3873	+ * @param string $line One line of wp-config.php.
	3874	+ * @return bool
	3875	+ */
	3876	+ /**
	3877	+ * Whether every marked line of a file can run nothing at all
	3878	+ *
	3879	+ * The question the re-base has to answer before adopting a file is whether
	3880	+ * the lines that carry the marker are only comments. Asking a stricter one
	3881	+ * was wrong in both directions: the first version of the guard used
	3882	+ * is_vigilant_original_line(), which also requires the commented define to
	3883	+ * match a known harmless shape, so it refused to re-base a perfectly inert
	3884	+ * line carrying an unusual define, which is exactly the case the re-base
	3885	+ * exists for, leaving the function unable to act at all. Found by the cross
	3886	+ * review of 2.11.10.
	3887	+ *
	3888	+ * The second version read one line at a time and reasoned that the marker
	3889	+ * begins with //, so a line with nothing but whitespace before it is wholly
	3890	+ * a comment. That is true only where PHP is already reading code, and the
	3891	+ * second cross review of 2.11.10 built three files where it is not, all of
	3892	+ * them valid PHP, all of them passing that test and all of them running or
	3893	+ * printing something:
	3894	+ *
	3895	+ * - the marked line placed BEFORE the opening <?php, so it is inline HTML
	3896	+ * that the server prints verbatim to the browser;
	3897	+ * - the same after a ?> that the file already had;
	3898	+ * - the marked line ending a block comment opened on an earlier line and
	3899	+ * opening another one at its end, with a statement in between, which
	3900	+ * runs like any other statement.
	3901	+ *
	3902	+ * So the file is read the way PHP reads it, not the way the line looks. A
	3903	+ * marked line is inert when every token touching it is a comment or
	3904	+ * whitespace, which answers the three at once: inline HTML is not a comment,
	3905	+ * and neither is a statement. The shape the guard was written for, code
	3906	+ * BEFORE the marker, is the same question from the other side.
	3907	+ *
	3908	+ * The three shapes are in the harness as cells X2, X3 and X4 of
	3909	+ * matriz-escondite-marcadores.sh, written out in full there. They are not
	3910	+ * written out here on purpose: a literal payload in a shipped file is
	3911	+ * signature surface for the scanners this plugin is read by, and a comment
	3912	+ * is a bad place to pay for it.
	3913	+ *
	3914	+ * @since 2.11.10
	3915	+ *
	3916	+ * @param string $content Whole file content.
	3917	+ * @return bool True when no marked line can run or print anything.
	3918	+ */
	3919	+ /**
	3920	+ * The lines of a file that carry the original-value marker
	3921	+ *
	3922	+ * @since 2.11.10
	3923	+ *
	3924	+ * @param string $content Whole file content, newlines already normalised.
	3925	+ * @return string[]
	3926	+ */
	3927	+ private function marked_lines_of( $content ) {
	3928	+ $out = array();
	3929	+
	3930	+ foreach ( explode( "\n", $content ) as $text ) {
	3931	+ if ( false !== strpos( $text, $this->wpconfig_original_marker ) ) {
	3932	+ $out[] = $text;
	3933	+ }
	3934	+ }
	3935	+
	3936	+ return $out;
	3937	+ }
	3938	+
	3939	+ /**
	3940	+ * Whether what a marked line carries would still be harmless uncommented
	3941	+ *
	3942	+ * Only the part after the marker matters: what comes before it is answered by
	3943	+ * the token pass, which refuses anything that is not comment or whitespace.
	3944	+ * Here the question is what comes BACK when uncomment_original_constants()
	3945	+ * removes the marker, so the body has to be a single define() and nothing
	3946	+ * else, with at most a trailing line comment. Deliberately says nothing about
	3947	+ * WHICH constant it is: asking that was the first version of this guard, and
	3948	+ * it refused every define it did not recognise, which is exactly the case the
	3949	+ * re-base exists for.
	3950	+ *
	3951	+ * @since 2.11.10
	3952	+ *
	3953	+ * @param string $line One line carrying the marker.
	3954	+ * @return bool
	3955	+ */
	3956	+ private function marked_line_body_is_harmless( $line ) {
	3957	+ $at = strpos( $line, $this->wpconfig_original_marker );
	3958	+
	3959	+ if ( false === $at ) {
	3960	+ return true;
	3961	+ }
	3962	+
	3963	+ $body = trim( substr( $line, $at + strlen( $this->wpconfig_original_marker ) ) );
	3964	+
	3965	+ if ( '' === $body ) {
	3966	+ return true;
	3967	+ }
	3968	+
	3969	+ // Tokenised as PHP so the trailing comment, the strings and the nesting
	3970	+ // are read the way PHP reads them and not with a regular expression.
	3971	+ $tokens = @token_get_all( '<?php ' . $body ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- A marked line can carry anything; a warning here must not be printed, and an unreadable body is refused below.
	3972	+
	3973	+ if ( empty( $tokens ) ) {
	3974	+ return false;
	3975	+ }
	3976	+
	3977	+ $statements = 0;
	3978	+ $depth = 0;
	3979	+
	3980	+ foreach ( $tokens as $token ) {
	3981	+ $type = is_array( $token ) ? $token[0] : $token;
	3982	+
	3983	+ if ( in_array( $type, array( T_OPEN_TAG, T_WHITESPACE, T_COMMENT, T_DOC_COMMENT ), true ) ) {
	3984	+ continue;
	3985	+ }
	3986	+
	3987	+ if ( '(' === $type ) {
	3988	+ $depth++;
	3989	+ continue;
	3990	+ }
	3991	+
	3992	+ if ( ')' === $type ) {
	3993	+ $depth--;
	3994	+ continue;
	3995	+ }
	3996	+
	3997	+ // A semicolon at the top level closes a statement. More than one, or
	3998	+ // anything after the first, means the line carries something else.
	3999	+ if ( ';' === $type && 0 === $depth ) {
	4000	+ $statements++;
	4001	+ continue;
	4002	+ }
	4003	+
	4004	+ if ( $statements > 0 ) {
	4005	+ return false;
	4006	+ }
	4007	+ }
	4008	+
	4009	+ return ( $statements <= 1 );
	4010	+ }
	4011	+
	4012	+ private function marked_lines_are_inert( $content ) {
	4013	+ $content = str_replace( "\r\n", "\n", (string) $content );
	4014	+ $marker = $this->wpconfig_original_marker;
	4015	+
	4016	+ if ( '' === $content || false === strpos( $content, $marker ) ) {
	4017	+ return true;
	4018	+ }
	4019	+
	4020	+ $marked = array();
	4021	+
	4022	+ foreach ( explode( "\n", $content ) as $index => $text ) {
	4023	+ if ( false !== strpos( $text, $marker ) ) {
	4024	+ $marked[ $index + 1 ] = true;
	4025	+ }
	4026	+ }
	4027	+
	4028	+ // Lenient on purpose (no TOKEN_PARSE): a tampered file still has to be
	4029	+ // read, and a file that cannot be tokenised is never adopted.
	4030	+ // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- The file read here may have been tampered with, which is the whole point, and PHP 8 emits a warning when it cannot tokenise: printing it would put a parse error on whatever page ran the scan. An unreadable file is refused four lines below.
	4031	+ $tokens = @token_get_all( $content );
	4032	+
	4033	+ if ( empty( $tokens ) ) {
	4034	+ return false;
	4035	+ }
	4036	+
	4037	+ /*
	4038	+ * And the other half of the question, which the first token version left
	4039	+ * out: a marked line is a COMMENTED OUT value, and uncommenting it is what
	4040	+ * the feature exists for, so "runs nothing today" is not enough. Anything
	4041	+ * sharing the line after the define comes back with it. The shape is real
	4042	+ * and needs no attacker: comment_existing_constants() takes a define and
	4043	+ * everything on its line, so
	4044	+ * define( 'WP_DEBUG', false ); @ini_set( 'display_errors', 0 );
	4045	+ * is commented whole, and re-basing it would adopt as approved something
	4046	+ * that runs the moment the value is restored. The old rule refused this
	4047	+ * too, but along with every define whose NAME it did not recognise, which
	4048	+ * is what left the function unable to act at all. Found by the third cross
	4049	+ * review of 2.11.10.
	4050	+ */
	4051	+ foreach ( $this->marked_lines_of( $content ) as $text ) {
	4052	+ if ( ! $this->marked_line_body_is_harmless( $text ) ) {
	4053	+ return false;
	4054	+ }
	4055	+ }
	4056	+
	4057	+ $inocuos = array( T_COMMENT, T_DOC_COMMENT, T_WHITESPACE );
	4058	+ $linea = 1;
	4059	+
	4060	+ foreach ( $tokens as $token ) {
	4061	+ $texto = is_array( $token ) ? $token[1] : $token;
	4062	+ $tipo = is_array( $token ) ? $token[0] : null;
	4063	+ $saltos = substr_count( $texto, "\n" );
	4064	+ $desde = $linea;
	4065	+ $hasta = $linea + $saltos;
	4066	+
	4067	+ /*
	4068	+ * A token whose text ends in a newline puts nothing on the line that
	4069	+ * newline opens. Counting it would make the "<?php\n" of every file
	4070	+ * touch line 2 and refuse the legitimate case, which is what the
	4071	+ * first version of this did.
	4072	+ */
	4073	+ $ultima = ( $saltos > 0 && "\n" === substr( $texto, -1 ) ) ? $hasta - 1 : $hasta;
	4074	+ $linea = $hasta;
	4075	+
	4076	+ if ( null !== $tipo && in_array( $tipo, $inocuos, true ) ) {
	4077	+ continue;
	4078	+ }
	4079	+
	4080	+ for ( $l = $desde; $l <= $ultima; $l++ ) {
	4081	+ if ( isset( $marked[ $l ] ) ) {
	4082	+ return false;
	4083	+ }
	4084	+ }
	4085	+ }
	4086	+
	4087	+ return true;
	4088	+ }
	4089	+
	4090	+ private function is_vigilant_original_line( $line ) {
	4091	+ if ( false !== strpos( $line, '<?' ) || false !== strpos( $line, '?>' ) ) {
	4092	+ return false;
	4093	+ }
	4094	+
	4095	+ return 1 === preg_match(
	4096	+ '/^[ \t]*' . preg_quote( $this->wpconfig_original_marker, '/' ) . self::harmless_define_pattern() . '[ \t]*(?:(?:\/\/|#(?!\[)).*)?$/',
	4097	+ $line
	4098	+ );
	4099	+ }
	4100	+
	4101	+ /**
	4102	+ * A define() that runs nothing but itself, as a regular expression fragment
	4103	+ *
	4104	+ * The name is one of the constants Vigilant has managed in any version. The
	4105	+ * value is made only of literals (true, false, null, a number, a quoted
	4106	+ * string with nothing to interpolate) and of ABSPATH, WP_CONTENT_DIR and
	4107	+ * __DIR__, which is what a debug log path is usually built from, joined
	4108	+ * with dots. No call, no variable, no backtick, no include.
	4109	+ *
	4110	+ * @since 2.11.5
	4111	+ *
	4112	+ * @return string Pattern without delimiters.
	4113	+ */
	4114	+ private static function harmless_define_pattern() {
	4115	+ $names = 'DISALLOW_FILE_EDIT|DISALLOW_FILE_MODS|FORCE_SSL_ADMIN|FORCE_SSL_LOGIN|WP_DEBUG|WP_DEBUG_LOG|WP_DEBUG_DISPLAY|SCRIPT_DEBUG|DISABLE_WP_CRON'
	4116	+ . '|WP_POST_REVISIONS|AUTOSAVE_INTERVAL|EMPTY_TRASH_DAYS|WP_MEMORY_LIMIT|WP_MAX_MEMORY_LIMIT|WP_AUTO_UPDATE_CORE|CONCATENATE_SCRIPTS';
	4117	+
	4118	+ $value = '(?:(?i:true|false|null)|-?\d+|\'(?:[^\'\\\\]|\\\\.)*\'|"[^"\\\\$]*"|ABSPATH|WP_CONTENT_DIR|__DIR__)';
	4119	+
	4120	+ return 'define\s*\(\s*[\'"](?:' . $names . ')[\'"]\s*,\s*' . $value . '(?:\s*\.\s*' . $value . ')*\s*\)\s*;';
	4121	+ }
	4122	+
	4123	+ /**
	4124	+ * Whether a wp-config.php constants block can only be one Vigilant wrote
	4125	+ *
	4126	+ * Every version of generate_constants() has written the start marker on its
	4127	+ * own line, then comments, blank lines and define() calls, bare or wrapped
	4128	+ * in if ( ! defined() ), then the end marker on its own line. A block made
	4129	+ * only of those lines runs nothing but the defines, whatever version wrote
	4130	+ * it and whatever settings it was written with. One line of anything else,
	4131	+ * or a PHP tag on any line, and the block is not taken.
	4132	+ *
	4133	+ * @since 2.11.5
	4134	+ *
	4135	+ * @param string $block Block from start marker to end marker, inclusive.
	4136	+ * @param array $markers Start and end marker.
	4137	+ * @return bool
	4138	+ */
	4139	+ private static function is_harmless_constants_block( $block, $markers ) {
	4140	+ $lines = explode( "\n", str_replace( array( "\r\n", "\r" ), "\n", (string) $block ) );
	4141	+
	4142	+ if ( count( $lines ) < 2
	4143	+ || rtrim( array_shift( $lines ), " \t" ) !== $markers[0]
	4144	+ || ltrim( array_pop( $lines ), " \t" ) !== $markers[1]
	4145	+ ) {
	4146	+ return false;
	4147	+ }
	4148	+
	4149	+ $define = self::harmless_define_pattern();
	4150	+ $guarded = '/^if\s*\(\s*!\s*defined\s*\(\s*[\'"][A-Z_]+[\'"]\s*\)\s*\)\s*\{\s*' . $define . '\s*\}$/';
	4151	+
	4152	+ foreach ( $lines as $line ) {
	4153	+ $line = trim( $line, " \t" );
	4154	+
	4155	+ if ( false !== strpos( $line, '<?' ) || false !== strpos( $line, '?>' ) ) {
	4156	+ return false;
	4157	+ }
	4158	+
	4159	+ if ( '' === $line
	4160	+ || 0 === strpos( $line, '//' )
	4161	+ || preg_match( '/^' . $define . '$/', $line )
	4162	+ || preg_match( $guarded, $line )
	4163	+ ) {
	4164	+ continue;
	4165	+ }
	4166	+
	4167	+ return false;
	4168	+ }
	4169	+
	4170	+ return true;
	4171	+ }
	4172	+
	4173	+ /**
	4174	+ * Take ownership of the blocks already on disk, once
	4175	+ *
	4176	+ * Fingerprints are recorded when Vigilant writes a block, which leaves every
	4177	+ * block written before 2.11.5 without one. This records the blocks that can
	4178	+ * be recognised as Vigilant's without having seen them written:
	4179	+ *
	4180	+ * - A .htaccess block, when it is exactly what Vigilant would write today
	4181	+ * with the settings it has, the timestamp and the version apart. After an
	4182	+ * update, maybe_sync_server_files() rewrites those blocks on the next
	4183	+ * request, so the claim waits for it. Unless it has already failed: a
	4184	+ * block Vigilant cannot rewrite is not going to start matching, and
	4185	+ * waiting for it would keep the old rule for good.
	4186	+ * - A wp-config.php constants block, when every line in it is a comment, a
	4187	+ * blank line or a harmless define(). Nothing rewrites that block on an
	4188	+ * update and its format has changed five times, so comparing it with
	4189	+ * today's output would report every site that has not saved those
	4190	+ * settings since. A line that could run anything is never accepted.
	4191	+ *
	4192	+ * A block that is not recognised stays in the hash and is reported as a
	4193	+ * change, so the owner gets to look at it, and the activity log says why.
	4194	+ * Nothing in the stored baseline is rewritten.
	4195	+ *
	4196	+ * Only where the shared files belong, a single site or the main site of a
	4197	+ * network, because the expected blocks come from that site's settings. Until
	4198	+ * it has run, normalize_critical_file() keeps the old rule on every site.
	4199	+ *
	4200	+ * @since 2.11.5
	4201	+ */
	4202	+ /**
	4203	+ * The admin_init entry point of the claim, which does ask for an administrator
	4204	+ *
	4205	+ * admin-ajax.php fires admin_init before it decides who is asking
	4206	+ * (wp-admin/admin-ajax.php:45), so without this an anonymous request chose
	4207	+ * the moment the claim runs. Unlike its two neighbours in
	4208	+ * init_cleanup_hooks(), which only drop the plugin's own copy out of the
	4209	+ * database, the claim writes two network options, changes for the whole
	4210	+ * network the rule normalize_critical_file() applies, and re-bases the
	4211	+ * approved baseline.
	4212	+ *
	4213	+ * The gate lives here and not inside maybe_claim_owned_blocks() because the
	4214	+ * scan calls that one directly and the scan runs from wp-cron, with no user:
	4215	+ * putting the capability check inside left the claim unable to complete on
	4216	+ * any site whose dashboard nobody opens, and until it completes the older,
	4217	+ * permissive rule is the one in force, which is the hiding place 2.11.5 was
	4218	+ * written to close. Found by the cross review of 2.11.10.
	4219	+ *
	4220	+ * @since 2.11.10
	4221	+ */
	4222	+ public function maybe_claim_owned_blocks_on_admin() {
	4223	+ if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
	4224	+ return;
	4225	+ }
	4226	+
	4227	+ $this->maybe_claim_owned_blocks();
	4228	+ }
	4229	+
	4230	+ public function maybe_claim_owned_blocks() {
	4231	+ if ( $this->owned_blocks_claimed() || ! Vigilante_Settings::owns_shared_files() ) {
	4232	+ return;
	4233	+ }
	4234	+
	4235	+ $sync_due = get_option( 'vigilante_server_files_pending' )
	4236	+ || VIGILANTE_VERSION !== get_option( 'vigilante_server_files_version' );
	4237	+
	4238	+ if ( $sync_due && ! get_option( 'vigilante_server_files_retry_after' ) ) {
	4239	+ return;
	4240	+ }
	4241	+
	4242	+ $expected = null;
	4243	+ $unclaimed = array();
	4244	+
	4245	+ foreach ( $this->critical_root_files as $filename ) {
	4246	+ $full_path = $this->critical_file_path( $filename );
	4247	+
	4248	+ if ( false === $full_path ) {
	4249	+ continue;
	4250	+ }
	4251	+
	4252	+ $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
	4253	+
	4254	+ if ( false === $content ) {
	4255	+ // Unreadable right now: leave the claim open and try again later.
	4256	+ return;
	4257	+ }
	4258	+
	4259	+ $content = str_replace( array( "\r\n", "\r" ), "\n", $content );
	4260	+ $is_config = 'wp-config.php' === $filename;
	4261	+
	4262	+ foreach ( ( $is_config ? $this->wpconfig_markers : $this->htaccess_markers ) as $markers ) {
	4263	+ $pattern = '/' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . '/s';
	4264	+
	4265	+ if ( ! preg_match_all( $pattern, $content, $found ) ) {
	4266	+ continue;
	4267	+ }
	4268	+
	4269	+ foreach ( $found[0] as $block ) {
	4270	+ if ( $is_config ) {
	4271	+ $ours = self::is_harmless_constants_block( $block, $markers );
	4272	+ } else {
	4273	+ $expected = null === $expected ? $this->expected_htaccess_blocks() : $expected;
	4274	+ $ours = isset( $expected[ $markers[0] ] )
	4275	+ && self::comparable_block( $block ) === self::comparable_block( $expected[ $markers[0] ] );
	4276	+ }
	4277	+
	4278	+ if ( $ours ) {
	4279	+ self::remember_owned_block( $filename, $markers[0], $block, false );
	4280	+ } else {
	4281	+ $unclaimed[ $filename ] = $filename;
	4282	+ }
	4283	+ }
	4284	+ }
	4285	+
	4286	+ // The commented-out originals are judged line by line at scan time.
	4287	+ // Looking at them here only keeps the log entry below complete.
	4288	+ if ( $is_config && preg_match_all( '/^.*' . preg_quote( $this->wpconfig_original_marker, '/' ) . '.*$/m', $content, $marked ) ) {
	4289	+ foreach ( $marked[0] as $line ) {
	4290	+ if ( ! $this->is_vigilant_original_line( $line ) ) {
	4291	+ $unclaimed[ $filename ] = $filename;
	4292	+ }
	4293	+ }
	4294	+ }
	4295	+ }
	4296	+
	4297	+ update_site_option( self::OWNED_BLOCKS_CLAIM_OPTION, self::OWNED_BLOCKS_CLAIMED );
	4298	+
	4299	+ // With the claim in place normalize uses the new rule, so a file nobody
	4300	+ // touched whose only difference is an original line the old rule dropped
	4301	+ // would read as changed. Re-base those, and only those, once.
	4302	+ $this->rebase_original_line_shift();
	4303	+
	4304	+ if ( $unclaimed && $this->activity_log ) {
	4305	+ $this->activity_log->log(
	4306	+ 'file',
	4307	+ 'critical_file_unrecognized_block',
	4308	+ sprintf(
	4309	+ /* translators: %s: comma-separated file names, such as wp-config.php or .htaccess. */
	4310	+ __( 'Content marked as written by Vigilant in %s does not match what Vigilant writes. From now on it is checked like the rest of the file, so the file integrity scan reports it as a change for you to review.', 'vigilante' ),
	4311	+ implode( ', ', $unclaimed )
	4312	+ ),
	4313	+ array( 'files' => array_values( $unclaimed ) ),
	4314	+ 'warning'
	4315	+ );
	4316	+ }
	4317	+ }
	4318	+
	4319	+ /**
	4320	+ * Re-base the critical files whose only change is a newly kept original line
	4321	+ *
	4322	+ * Until 2.11.5 the hash left out every [VIGILANTE_ORIGINAL] line; from 2.11.5
	4323	+ * it keeps the ones whose value is not a plain constant define, which is the
	4324	+ * right thing for the hash but moves it on a file nobody edited: the stored
	4325	+ * baseline was taken under the old rule, and nothing re-bases wp-config.php on
	4326	+ * an update (maybe_sync_server_files() only rewrites the .htaccess). So the
	4327	+ * first scan after updating would report wp-config.php as changed.
	4328	+ *
	4329	+ * This runs once, in the same pass that claims the blocks. For each file it
	4330	+ * re-bases to the new hash only when the baseline still matches the file with
	4331	+ * every original line dropped, which means the blocks are exactly the approved
	4332	+ * ones and the sole difference is those lines, the user's own commented-out
	4333	+ * defines. A block that was edited or planted does not match with the lines
	4334	+ * dropped, so it is left to be reported: this closes the false positive
	4335	+ * without adopting anything that was hidden before.
	4336	+ *
	4337	+ * @since 2.11.5
	4338	+ */
	4339	+ private function rebase_original_line_shift() {
	4340	+ $baseline = $this->get_critical_files_baseline();
	4341	+ $changed = false;
	4342	+
	4343	+ foreach ( $this->critical_root_files as $filename ) {
	4344	+ $full_path = $this->critical_file_path( $filename );
	4345	+
	4346	+ if ( false === $full_path || empty( $baseline[ $filename ]['hash'] ) ) {
	4347	+ continue;
	4348	+ }
	4349	+
	4350	+ $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
	4351	+
	4352	+ if ( false === $content ) {
	4353	+ continue;
	4354	+ }
	4355	+
	4356	+ /*
	4357	+ * Never re-base a file that carries a marked line which is not
	4358	+ * wholly a comment. The test below only establishes that the
	4359	+ * difference lies in lines carrying the marker, and the old rule
	4360	+ * dropped the WHOLE line, so a line with a statement in front of the
	4361	+ * marker satisfies it (cell X1 of matriz-escondite-marcadores.sh,
	4362	+ * where the shape is written out): re-basing would write that line
	4363	+ * into the approved baseline and rewrite the stored content, so the
	4364	+ * diff would stop showing it. Adopting as approved what the previous rule
	4365	+ * hid is the one thing an integrity scanner must never do, and the
	4366	+ * log entry of maybe_claim_owned_blocks() already promises the
	4367	+ * opposite ("the scan reports it as a change for you to review").
	4368	+ * Those files are left to be reported. Found by the file-by-file
	4369	+ * review of 2.11.10.
	4370	+ *
	4371	+ * What counts as "wholly a comment" is decided by reading the file
	4372	+ * as PHP reads it, not by the shape of the line: see
	4373	+ * marked_lines_are_inert(). A line that is not recognised is not the
	4374	+ * same thing as a line that can run something, and the first
	4375	+ * wording of this guard confused the two.
	4376	+ */
	4377	+ if ( ! $this->marked_lines_are_inert( $content ) ) {
	4378	+ continue;
	4379	+ }
	4380	+
	4381	+ $current = md5( $this->normalize_critical_file( $filename, $content ) );
	4382	+
	4383	+ // Already in step, or a real change to something other than the
	4384	+ // original lines: nothing to re-base here.
	4385	+ if ( $baseline[ $filename ]['hash'] === $current
	4386	+ || $baseline[ $filename ]['hash'] !== md5( $this->normalize_critical_file( $filename, $content, true ) )
	4387	+ ) {
	4388	+ continue;
	4389	+ }
	4390	+
	4391	+ $normalized = $this->normalize_critical_file( $filename, $content );
	4392	+ $baseline[ $filename ]['hash'] = $current;
	4393	+ $baseline[ $filename ]['size'] = strlen( $content );
	4394	+ $baseline[ $filename ]['content'] = $this->baseline_content( $filename, $normalized );
	4395	+ $baseline[ $filename ]['updated'] = time();
	4396	+ $changed = true;
	4397	+ }
	4398	+
	4399	+ if ( $changed ) {
	4400	+ $this->write_baseline( $baseline );
	4401	+ }
	4402	+ }
	4403	+
	4404	+ /**
	4405	+ * The .htaccess blocks Vigilant would write today, keyed by start marker
	4406	+ *
	4407	+ * @since 2.11.5
	4408	+ *
	4409	+ * @return array
	4410	+ */
	4411	+ private function expected_htaccess_blocks() {
	4412	+ $settings = $this->settings ? $this->settings : new Vigilante_Settings();
	4413	+
	4414	+ $classes = array(
	4415	+ 'Vigilante_Htaccess_Protection' => 'class-htaccess-protection.php',
	4416	+ 'Vigilante_Security_Headers' => 'class-security-headers.php',
	4417	+ );
	4418	+
	4419	+ foreach ( $classes as $class => $file ) {
	4420	+ if ( ! class_exists( $class ) ) {
	4421	+ require_once VIGILANTE_INCLUDES_DIR . $file;
	4422	+ }
	4423	+ }
	4424	+
	4425	+ $headers = new Vigilante_Security_Headers( $settings );
	4426	+
	4427	+ return array(
	4428	+ Vigilante_Htaccess_Protection::MARKER_START => ( new Vigilante_Htaccess_Protection( $settings ) )->generate_rules(),
	4429	+ Vigilante_Security_Headers::MARKER_START => Vigilante_Security_Headers::MARKER_START . "\n" . $headers->generate_rules_content() . "\n" . Vigilante_Security_Headers::MARKER_END,
	4430	+ );
	4431	+ }
	4432	+
	4433	+ /**
	4434	+ * A .htaccess block with the parts that change on every write evened out
	4435	+ *
	4436	+ * Two blocks Vigilant wrote with the same settings differ only in the time
	4437	+ * they were generated and, across an update, in the version the firewall
	4438	+ * block names. Everything else has to be identical for the claim to take
	4439	+ * the block.
	4440	+ *
	4441	+ * @since 2.11.5
	4442	+ *
	4443	+ * @param string $block Block from start marker to end marker, inclusive.
	4444	+ * @return string
	4445	+ */
	4446	+ private static function comparable_block( $block ) {
	4447	+ $block = str_replace( array( "\r\n", "\r" ), "\n", (string) $block );
	4448	+ $block = preg_replace( '/^# Generated: \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} UTC$/m', '# Generated:', $block );
	4449	+ $block = preg_replace( '/^# Vigilante for WordPress - Firewall v[0-9][0-9A-Za-z.\-]*$/m', '# Vigilante for WordPress - Firewall v', $block );
	4450	+
	4451	+ return rtrim( $block, "\n" );
	4452	+ }
	4453	+
	4454	+ /**
1272	4455	* Get stored baseline hashes for critical files
1273	4456	*
1274	4457	* @return array Associative array keyed by filename.
1275	4458	*/
1276	4459	public function get_critical_files_baseline() {
1277		- $baseline = get_option( self::BASELINE_OPTION, array() );
1278		- return is_array( $baseline ) ? $baseline : array();
	4460	+ return $this->read_baseline();
1279	4461	}
1280	4462
1281	4463	/**
1282	4464	* Update baseline hash for a single critical file
		@@ -1287,11 +4469,11 @@
1287	4469	* @param string $filename File name relative to ABSPATH (e.g. 'wp-config.php').
1288	4470	* @return bool True on success.
1289	4471	*/
1290	4472	public function update_critical_file_baseline( $filename ) {
1291		- $full_path = untrailingslashit( ABSPATH ) . '/' . $filename;
	4473	+ $full_path = $this->critical_file_path( $filename );
1292	4474
1293		- if ( ! file_exists( $full_path ) ) {
	4475	+ if ( false === $full_path ) {
1294	4476	return false;
1295	4477	}
1296	4478
1297	4479	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -1301,8 +4483,36 @@
1301	4483
1302	4484	$normalized = $this->normalize_critical_file( $filename, $content );
1303	4485
1304	4486	$baseline = $this->get_critical_files_baseline();
	4487	+
	4488	+ /*
	4489	+ * No guard here, and there was one for a few hours during 2.11.4 that
	4490	+ * had to come out. It refused to rewrite the record when the stored hash
	4491	+ * no longer matched the file, meant to stop a write of ours from
	4492	+ * approving somebody else's pending edit. Two things were wrong with it,
	4493	+ * both measured on 10 sep 2026 by a third cross review:
	4494	+ *
	4495	+ * - This is also the Approve button (Vigilante_Admin_Ajax::
	4496	+ * ajax_approve_critical_file). A moved hash is exactly the state in
	4497	+ * which Approve is pressed, so the guard made Approve fail every time
	4498	+ * and the warning could never be closed.
	4499	+ * - Its premise, "our own write cannot move the normalized hash", holds
	4500	+ * for the block and not for the rest of what the writers do.
	4501	+ * comment_existing_constants() turns a define() into a
	4502	+ * [VIGILANTE_ORIGINAL] line that normalize_critical_file() leaves as
	4503	+ * an empty line, and remove_old_rules() deletes legacy .htaccess blocks
	4504	+ * that normalize_critical_file() does not know. Both move the hash, so
	4505	+ * the guard would have raised a false "file modified" after Vigilant's
	4506	+ * own work, on sites that updated.
	4507	+ *
	4508	+ * The real fix is to know what the hash was before WE touched the file:
	4509	+ * the writers capture it and pass it along vigilante_critical_file_
	4510	+ * written, and this compares against that instead of against the
	4511	+ * record. Until then this behaves as it always has, which does mean a
	4512	+ * write of ours can adopt a third-party edit that was pending review.
	4513	+ * That is pre-existing, and written down in the roadmap.
	4514	+ */
1305	4515	$baseline[ $filename ] = array(
1306	4516	'hash' => md5( $normalized ),
1307	4517	'size' => strlen( $content ),
1308	4518	'content' => $this->baseline_content( $filename, $normalized ),
		@@ -1308,9 +4518,9 @@
1308	4518	'content' => $this->baseline_content( $filename, $normalized ),
1309	4519	'updated' => time(),
1310	4520	);
1311	4521
1312		- return update_option( self::BASELINE_OPTION, $baseline, false );
	4522	+ return $this->write_baseline( $baseline );
1313	4523	}
1314	4524
1315	4525	/**
1316	4526	* Regenerate baseline for all critical files
		@@ -1320,14 +4530,13 @@
1320	4530	* @return array Updated baseline data.
1321	4531	*/
1322	4532	public function regenerate_all_baselines() {
1323	4533	$baseline = array();
1324		- $root_path = untrailingslashit( ABSPATH );
1325	4534
1326	4535	foreach ( $this->critical_root_files as $filename ) {
1327		- $full_path = $root_path . '/' . $filename;
	4536	+ $full_path = $this->critical_file_path( $filename );
1328	4537
1329		- if ( ! file_exists( $full_path ) ) {
	4538	+ if ( false === $full_path ) {
1330	4539	continue;
1331	4540	}
1332	4541
1333	4542	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -1343,9 +4552,9 @@
1343	4552	'updated' => time(),
1344	4553	);
1345	4554	}
1346	4555
1347		- update_option( self::BASELINE_OPTION, $baseline, false );
	4556	+ $this->write_baseline( $baseline );
1348	4557
1349	4558	return $baseline;
1350	4559	}
1351	4560
		@@ -1354,10 +4563,10 @@
1354	4563	*
1355	4564	* @param bool $force_refresh Skip the cached copy and ask wp.org again.
1356	4565	* @return array|WP_Error Checksums or error.
1357	4566	*/
1358		- private function get_core_checksums( $force_refresh = false ) {
1359		- $locale = get_locale();
	4567	+ private function get_core_checksums( $force_refresh = false, $locale = null, $english_fallback = true ) {
	4568	+ $locale = null === $locale ? get_locale() : $locale;
1360	4569	$version = $this->wp_version;
1361	4570
1362	4571	// Check cache first
1363	4572	$cache_key = 'vigilante_core_checksums_' . md5( $version . $locale );
		@@ -1386,8 +4595,26 @@
1386	4595
1387	4596	$body = json_decode( wp_remote_retrieve_body( $response ), true );
1388	4597
1389	4598	if ( empty( $body['checksums'] ) ) {
	4599	+ /*
	4600	+ * WordPress.org has no list for this version in this language. That
	4601	+ * is the normal state of every site that is not in English for the
	4602	+ * hours or days after a release, until the package of its language
	4603	+ * is built, and of the languages that never get one. Until now the
	4604	+ * core was then not compared at all. Those sites run the English
	4605	+ * files, so the English list is the one to compare with. It is not
	4606	+ * kept under this language, so the next scan asks again.
	4607	+ */
	4608	+ if ( 'en_US' !== $locale && $english_fallback ) {
	4609	+ $english = $this->get_core_checksums( $force_refresh, 'en_US' );
	4610	+
	4611	+ if ( is_array( $english ) ) {
	4612	+ $this->core_checksums_are_english = true;
	4613	+ return $english;
	4614	+ }
	4615	+ }
	4616	+
1390	4617	return new WP_Error( 'no_checksums', __( 'Could not retrieve WordPress core checksums', 'vigilante' ) );
1391	4618	}
1392	4619
1393	4620	$checksums = $body['checksums'];
		@@ -1403,8 +4630,52 @@
1403	4630	return $checksums;
1404	4631	}
1405	4632
1406	4633	/**
	4634	+ * Whether a core file is the official copy of another language
	4635	+ *
	4636	+ * The checksums are asked for in the language of the site, and a site does
	4637	+ * not always run the package of its language: one installed in English and
	4638	+ * switched to Spanish afterwards keeps the English files, so its
	4639	+ * version.php and its wp-config-sample.php do not match the Spanish list.
	4640	+ * That is why version.php used to be left out of the comparison altogether,
	4641	+ * which left a file WordPress loads on every request unchecked. A file that
	4642	+ * matches the official copy of the same version in English, or in the
	4643	+ * language its own package declares, is an official file. The language
	4644	+ * only chooses which official list to look at: a file that was tampered
	4645	+ * with matches none of them.
	4646	+ *
	4647	+ * @param string $file Path relative to the WordPress root.
	4648	+ * @param string $actual_hash md5 of the file on disk.
	4649	+ * @return bool
	4650	+ */
	4651	+ private function matches_core_of_other_locale( $file, $actual_hash ) {
	4652	+ $current = get_locale();
	4653	+ $others = array( 'en_US' );
	4654	+
	4655	+ if ( ! empty( $GLOBALS['wp_local_package'] ) && is_string( $GLOBALS['wp_local_package'] ) ) {
	4656	+ $others[] = $GLOBALS['wp_local_package'];
	4657	+ }
	4658	+
	4659	+ foreach ( array_unique( $others ) as $locale ) {
	4660	+ if ( $locale === $current || ! preg_match( '/^[A-Za-z0-9_]{2,24}$/', $locale ) ) {
	4661	+ continue;
	4662	+ }
	4663	+
	4664	+ // Without the English list in its place: asking about another
	4665	+ // language must not leave the scan believing that the list of the
	4666	+ // site itself was missing.
	4667	+ $checksums = $this->get_core_checksums( false, $locale, false );
	4668	+
	4669	+ if ( is_array( $checksums ) && isset( $checksums[ $file ] ) && $checksums[ $file ] === $actual_hash ) {
	4670	+ return true;
	4671	+ }
	4672	+ }
	4673	+
	4674	+ return false;
	4675	+ }
	4676	+
	4677	+ /**
1407	4678	* Scan plugins for modifications
1408	4679	*
1409	4680	* @return array Scan results.
1410	4681	*/
		@@ -1422,9 +4693,10 @@
1422	4693	if ( ! function_exists( 'get_plugins' ) ) {
1423	4694	require_once ABSPATH . 'wp-admin/includes/plugin.php';
1424	4695	}
1425	4696
1426		- $plugins = get_plugins();
	4697	+ $plugins = get_plugins();
	4698	+ $finished = array();
1427	4699
1428	4700	foreach ( $plugins as $plugin_file => $plugin_data ) {
1429	4701	// Check time limit
1430	4702	if ( $this->is_time_exceeded() ) {
		@@ -1432,21 +4704,12 @@
1432	4704	}
1433	4705
1434	4706	$plugin_slug = dirname( $plugin_file );
1435	4707
1436		- // Skip single-file plugins
1437		- if ( '.' === $plugin_slug ) {
	4708	+ if ( ! $this->plugin_has_turn( $plugin_slug ) ) {
1438	4709	continue;
1439	4710	}
1440	4711
1441		- // Skip slugs in their post-update grace window: wp.org may still be
1442		- // publishing the new version's checksums, so a scheduled scan here
1443		- // would raise benign "modified/extra" noise. The dedicated post-update
1444		- // verifier (vigilante_fi_postupdate_verify) handles these instead.
1445		- if ( $this->in_post_update_grace( 'plugin', $plugin_slug ) ) {
1446		- continue;
1447		- }
1448		-
1449	4712	// Get checksums from WordPress.org
1450	4713	$version = $plugin_data['Version'] ?? '';
1451	4714	$checksums = $this->get_plugin_checksums( $plugin_slug, $version );
1452	4715
		@@ -1451,8 +4714,22 @@
1451	4714	$checksums = $this->get_plugin_checksums( $plugin_slug, $version );
1452	4715
1453	4716	$has_checksums = ! is_wp_error( $checksums ) && 'not_found' !== $checksums;
1454	4717
	4718	+ // Say which plugins could not be compared, and why. A plugin that
	4719	+ // is not on WordPress.org is named as such; a failed request is an
	4720	+ // error of this scan, not a plugin without an official copy.
	4721	+ if ( is_wp_error( $checksums ) ) {
	4722	+ $results['errors'][] = sprintf(
	4723	+ /* translators: 1: Plugin name, 2: What went wrong */
	4724	+ __( 'The plugin %1$s could not be compared with its copy on WordPress.org: %2$s', 'vigilante' ),
	4725	+ $plugin_data['Name'] ?? $plugin_slug,
	4726	+ $checksums->get_error_message()
	4727	+ );
	4728	+ } elseif ( ! $has_checksums ) {
	4729	+ $results['unverified'][] = $plugin_data['Name'] ?? $plugin_slug;
	4730	+ }
	4731	+
1455	4732	$plugin_dir = WP_PLUGIN_DIR . '/' . $plugin_slug;
1456	4733
1457	4734	// Check known files against checksums (only if available)
1458	4735	if ( $has_checksums ) {
		@@ -1481,9 +4758,17 @@
1481	4758
1482	4759	$results['scanned']++;
1483	4760
1484	4761	if ( ! file_exists( $file_path ) ) {
1485		- continue; // Some files might not be installed
	4762	+ // Reported, and not just skipped: a file that is in the
	4763	+ // published copy and not on the server is part of what
	4764	+ // the scan found.
	4765	+ $results['missing'][] = array(
	4766	+ 'file' => 'plugins/' . $plugin_slug . '/' . $file,
	4767	+ 'type' => 'plugin',
	4768	+ 'plugin' => $plugin_data['Name'] ?? $plugin_slug,
	4769	+ );
	4770	+ continue;
1486	4771	}
1487	4772
1488	4773	if ( ! $this->hash_matches_published( $file_path, $expected_hash ) ) {
1489	4774	$results['modified'][] = array(
		@@ -1507,15 +4792,84 @@
1507	4792	$suspicious_only = ! $has_checksums; // Without checksums, only report files with suspicious code
1508	4793	$extra_results = $this->detect_extra_files( $plugin_dir, $known_files, 'plugin', $plugin_data['Name'], $suspicious_only );
1509	4794	$results['extra'] = array_merge( $results['extra'] ?? array(), $extra_results['extra'] );
1510	4795	$results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $extra_results['suspicious'] );
	4796	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $extra_results['errors'] ?? array() );
1511	4797	}
	4798	+
	4799	+ // The plugin had its whole turn. The one the time runs out on
	4800	+ // does not get here with time left, and is named with the ones
	4801	+ // behind it.
	4802	+ if ( ! $this->is_time_exceeded() ) {
	4803	+ $finished[ $plugin_file ] = true;
	4804	+
	4805	+ // Its folder, as a line for Excluded Paths: what a partial
	4806	+ // scan offers so that the next one spends its time on the
	4807	+ // rest. One that is already excluded was not looked at.
	4808	+ if ( ! $this->is_path_excluded( $plugin_dir . '/.' ) ) {
	4809	+ $results['checked'][] = $this->relative_path( $plugin_dir );
	4810	+ }
	4811	+ }
1512	4812	}
1513	4813
	4814	+ // The plugins the time did not reach, by name.
	4815	+ $results['not_checked'] = array();
	4816	+
	4817	+ foreach ( $plugins as $plugin_file => $plugin_data ) {
	4818	+ if ( isset( $finished[ $plugin_file ] ) || ! $this->plugin_has_turn( dirname( $plugin_file ) ) ) {
	4819	+ continue;
	4820	+ }
	4821	+
	4822	+ $results['not_checked'][] = (string) ( $plugin_data['Name'] ?? dirname( $plugin_file ) );
	4823	+ }
	4824	+
	4825	+ // Must-use plugins, drop-ins and loose PHP files, which have no
	4826	+ // official copy and no entry in the list above.
	4827	+ $results['unlisted_checked'] = false;
	4828	+
	4829	+ if ( ! $this->is_time_exceeded() ) {
	4830	+ $unlisted = $this->scan_unlisted_code();
	4831	+
	4832	+ $results['extra'] = array_merge( $results['extra'] ?? array(), $unlisted['extra'] );
	4833	+ $results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $unlisted['suspicious'] );
	4834	+ $results['unverified'] = array_merge( $results['unverified'] ?? array(), $unlisted['unverified'] );
	4835	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $unlisted['errors'] );
	4836	+
	4837	+ $results['unlisted_checked'] = ! $this->is_time_exceeded();
	4838	+ }
	4839	+
1514	4840	return $results;
1515	4841	}
1516	4842
1517	4843	/**
	4844	+ * Whether a plugin gets a turn of its own in scan_plugins()
	4845	+ *
	4846	+ * @param string $plugin_slug Folder of the plugin, or "." for a single file.
	4847	+ * @return bool
	4848	+ */
	4849	+ private function plugin_has_turn( $plugin_slug ) {
	4850	+ // Single-file plugins are loose PHP files: scan_unlisted_code().
	4851	+ if ( '.' === $plugin_slug ) {
	4852	+ return false;
	4853	+ }
	4854	+
	4855	+ // With the self-check on, Vigilant itself is verified by the
	4856	+ // sha256 triple-anchor block at the start of run_scan(): scanning
	4857	+ // it here again would duplicate findings and the md5 fetch. With
	4858	+ // the check off by filter, Vigilant is a regular plugin (legacy
	4859	+ // behaviour).
	4860	+ if ( dirname( VIGILANTE_PLUGIN_BASENAME ) === $plugin_slug && Vigilante_Self_Integrity::is_on() ) {
	4861	+ return false;
	4862	+ }
	4863	+
	4864	+ // Skip slugs in their post-update grace window: wp.org may still be
	4865	+ // publishing the new version's checksums, so a scheduled scan here
	4866	+ // would raise benign "modified/extra" noise. The dedicated post-update
	4867	+ // verifier (vigilante_fi_postupdate_verify) handles these instead.
	4868	+ return ! $this->in_post_update_grace( 'plugin', $plugin_slug );
	4869	+ }
	4870	+
	4871	+ /**
1518	4872	* Whether a file on disk matches a hash WordPress.org publishes for it.
1519	4873	*
1520	4874	* The wp.org checksums JSON gives, per file, an md5 (and usually a sha256)
1521	4875	* that may be a single string OR an array of strings: a file whose content
		@@ -1645,9 +4999,9 @@
1645	4999	return $response;
1646	5000	}
1647	5001
1648	5002	$status = wp_remote_retrieve_response_code( $response );
1649		- if ( 200 !== $status ) {
	5003	+ if ( 404 === (int) $status ) {
1650	5004	// Cache "not found" to avoid repeated requests (never during grace).
1651	5005	if ( ! $grace ) {
1652	5006	set_transient( $cache_key, 'not_found', HOUR_IN_SECONDS );
1653	5007	}
		@@ -1653,8 +5007,19 @@
1653	5007	}
1654	5008	return 'not_found';
1655	5009	}
1656	5010
	5011	+ if ( 200 !== (int) $status ) {
	5012	+ // WordPress.org answered, but not with the checksums. An outage is
	5013	+ // not a plugin with no published copy, and until now it passed
	5014	+ // for one: the plugin was quietly left uncompared.
	5015	+ return new WP_Error(
	5016	+ 'http_error',
	5017	+ /* translators: %d: HTTP status code */
	5018	+ sprintf( __( 'WordPress.org answered with status %d', 'vigilante' ), (int) $status )
	5019	+ );
	5020	+ }
	5021	+
1657	5022	$body = json_decode( wp_remote_retrieve_body( $response ), true );
1658	5023
1659	5024	if ( empty( $body['files'] ) ) {
1660	5025	return new WP_Error( 'no_checksums', __( 'No checksums found', 'vigilante' ) );
		@@ -1693,9 +5058,10 @@
1693	5058	'extra' => array(),
1694	5059	'errors' => array(),
1695	5060	);
1696	5061
1697		- $themes = wp_get_themes();
	5062	+ $themes = wp_get_themes();
	5063	+ $finished = array();
1698	5064
1699	5065	foreach ( $themes as $theme_slug => $theme ) {
1700	5066	// Check time limit
1701	5067	if ( $this->is_time_exceeded() ) {
		@@ -1711,8 +5077,20 @@
1711	5077	$checksums = $this->get_theme_checksums( $theme_slug, $version );
1712	5078
1713	5079	$has_checksums = ! is_wp_error( $checksums ) && 'not_found' !== $checksums;
1714	5080
	5081	+ // Same as for plugins: name what could not be compared, and why.
	5082	+ if ( is_wp_error( $checksums ) && 'not_found' !== $checksums->get_error_code() ) {
	5083	+ $results['errors'][] = sprintf(
	5084	+ /* translators: 1: Theme name, 2: What went wrong */
	5085	+ __( 'The theme %1$s could not be compared with its copy on WordPress.org: %2$s', 'vigilante' ),
	5086	+ $theme->get( 'Name' ),
	5087	+ $checksums->get_error_message()
	5088	+ );
	5089	+ } elseif ( ! $has_checksums ) {
	5090	+ $results['unverified'][] = $theme->get( 'Name' );
	5091	+ }
	5092	+
1715	5093	$theme_dir = $theme->get_stylesheet_directory();
1716	5094
1717	5095	// Check known files against checksums (only if available)
1718	5096	if ( $has_checksums ) {
		@@ -1741,8 +5119,13 @@
1741	5119
1742	5120	$results['scanned']++;
1743	5121
1744	5122	if ( ! file_exists( $file_path ) ) {
	5123	+ $results['missing'][] = array(
	5124	+ 'file' => 'themes/' . $theme_slug . '/' . $file,
	5125	+ 'type' => 'theme',
	5126	+ 'theme' => $theme->get( 'Name' ),
	5127	+ );
1745	5128	continue;
1746	5129	}
1747	5130
1748	5131	if ( ! $this->hash_matches_published( $file_path, $expected_hash ) ) {
		@@ -1765,11 +5148,32 @@
1765	5148	$suspicious_only = ! $has_checksums;
1766	5149	$extra_results = $this->detect_extra_files( $theme_dir, $known_files, 'theme', $theme->get( 'Name' ), $suspicious_only );
1767	5150	$results['extra'] = array_merge( $results['extra'] ?? array(), $extra_results['extra'] );
1768	5151	$results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $extra_results['suspicious'] );
	5152	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $extra_results['errors'] ?? array() );
1769	5153	}
	5154	+
	5155	+ // Same as for plugins: a whole turn, with time left.
	5156	+ if ( ! $this->is_time_exceeded() ) {
	5157	+ $finished[ $theme_slug ] = true;
	5158	+
	5159	+ if ( ! $this->is_path_excluded( $theme_dir . '/.' ) ) {
	5160	+ $results['checked'][] = $this->relative_path( $theme_dir );
	5161	+ }
	5162	+ }
1770	5163	}
1771	5164
	5165	+ // The themes the time did not reach, by name.
	5166	+ $results['not_checked'] = array();
	5167	+
	5168	+ foreach ( $themes as $theme_slug => $theme ) {
	5169	+ if ( isset( $finished[ $theme_slug ] ) || $this->in_post_update_grace( 'theme', $theme_slug ) ) {
	5170	+ continue;
	5171	+ }
	5172	+
	5173	+ $results['not_checked'][] = (string) $theme->get( 'Name' );
	5174	+ }
	5175	+
1772	5176	return $results;
1773	5177	}
1774	5178
1775	5179	/**
		@@ -1779,9 +5183,9 @@
1779	5183	* @param string $version Theme version.
1780	5184	* @return array|WP_Error
1781	5185	*/
1782	5186	private function get_theme_checksums( $slug, $version ) {
1783		- $cache_key = 'vigilante_theme_checksums_' . md5( $slug . $version );
	5187	+ $cache_key = 'vigilante_theme_package_' . md5( $slug . $version );
1784	5188
1785	5189	// Bypass the cache during the post-update grace window (see plugin path).
1786	5190	$grace = $this->in_post_update_grace( 'theme', $slug );
1787	5191
		@@ -1791,48 +5195,103 @@
1791	5195	return $cached;
1792	5196	}
1793	5197	}
1794	5198
1795		- $url = sprintf(
1796		- 'https://downloads.wordpress.org/theme-checksums/%s/%s.json',
1797		- $slug,
1798		- $version
1799		- );
	5199	+ /*
	5200	+ * WordPress.org publishes checksums for plugins and for core, and none
	5201	+ * for themes: the address this method asked until now answers 404 for
	5202	+ * every theme, so no theme was ever compared with anything and they
	5203	+ * were all treated as themes from elsewhere. What WordPress.org does
	5204	+ * publish is the package of each version, so the checksums are taken
	5205	+ * from there: the package is downloaded once per version, each file in
	5206	+ * it is hashed straight from the archive, nothing is unpacked to disk,
	5207	+ * and the result is kept for a month.
	5208	+ */
	5209	+ if ( '' === (string) $version || ! preg_match( '/^[A-Za-z0-9._-]+$/', (string) $slug ) ) {
	5210	+ return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
	5211	+ }
1800	5212
1801		- $response = wp_remote_get( $url, array( 'timeout' => 10 ) );
	5213	+ if ( ! class_exists( 'ZipArchive' ) ) {
	5214	+ return new WP_Error( 'no_zip', __( 'the zip extension of PHP is missing on this server', 'vigilante' ) );
	5215	+ }
1802	5216
1803		- if ( is_wp_error( $response ) ) {
1804		- return $response;
	5217	+ if ( ! function_exists( 'download_url' ) ) {
	5218	+ require_once ABSPATH . 'wp-admin/includes/file.php';
1805	5219	}
1806	5220
1807		- $status = wp_remote_retrieve_response_code( $response );
1808		- if ( 200 !== $status ) {
1809		- // Cache "not found" to avoid repeated requests (never during grace).
1810		- if ( ! $grace ) {
1811		- set_transient( $cache_key, 'not_found', HOUR_IN_SECONDS );
	5221	+ $package = download_url(
	5222	+ sprintf( 'https://downloads.wordpress.org/theme/%s.%s.zip', rawurlencode( $slug ), rawurlencode( (string) $version ) ),
	5223	+ 30
	5224	+ );
	5225	+
	5226	+ if ( is_wp_error( $package ) ) {
	5227	+ $data = $package->get_error_data();
	5228	+
	5229	+ // WordPress.org has no such theme or no such version: a theme from
	5230	+ // somewhere else. Anything other than a 404 is a failed download,
	5231	+ // and is reported as that instead of passing for a theme with no
	5232	+ // official copy.
	5233	+ if ( is_array( $data ) && isset( $data['code'] ) && 404 === (int) $data['code'] ) {
	5234	+ if ( ! $grace ) {
	5235	+ set_transient( $cache_key, 'not_found', 12 * HOUR_IN_SECONDS );
	5236	+ }
	5237	+ return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
1812	5238	}
1813		- return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
	5239	+
	5240	+ return $package;
1814	5241	}
1815	5242
1816		- $body = json_decode( wp_remote_retrieve_body( $response ), true );
	5243	+ $checksums = array();
	5244	+ $archive = new ZipArchive();
1817	5245
1818		- if ( empty( $body['files'] ) ) {
1819		- return new WP_Error( 'no_checksums', __( 'No checksums found', 'vigilante' ) );
	5246	+ if ( true === $archive->open( $package ) ) {
	5247	+ $prefix = $slug . '/';
	5248	+ $max_entry = 16 * MB_IN_BYTES;
	5249	+
	5250	+ for ( $i = 0; $i < $archive->numFiles; $i++ ) {
	5251	+ $entry = $archive->statIndex( $i );
	5252	+ $name = is_array( $entry ) ? (string) $entry['name'] : '';
	5253	+
	5254	+ // Everything in the package lives under the folder of the theme.
	5255	+ // Folders, anything outside it and any path with a ".."
	5256	+ // segment are not files of the theme.
	5257	+ if ( '' === $name || '/' === substr( $name, -1 ) || 0 !== strpos( $name, $prefix ) || preg_match( '#(?:^|/)\.\.(?:/|$)#', $name ) ) {
	5258	+ continue;
	5259	+ }
	5260	+
	5261	+ // Read up to a limit: an entry larger than this is not code,
	5262	+ // and is left out of the comparison instead of being loaded
	5263	+ // whole into memory.
	5264	+ $content = $archive->getFromIndex( $i, $max_entry + 1 );
	5265	+
	5266	+ if ( false === $content ) {
	5267	+ $checksums = array();
	5268	+ break;
	5269	+ }
	5270	+
	5271	+ if ( strlen( $content ) > $max_entry ) {
	5272	+ continue;
	5273	+ }
	5274	+
	5275	+ $checksums[ substr( $name, strlen( $prefix ) ) ] = array(
	5276	+ 'md5' => md5( $content ),
	5277	+ 'sha256' => hash( 'sha256', $content ),
	5278	+ );
	5279	+ }
	5280	+
	5281	+ $archive->close();
1820	5282	}
1821	5283
1822		- // Store the full per-file record (md5 + sha256), either of which may be a
1823		- // string or an array; hash_matches_published() handles both shapes.
1824		- $checksums = array();
1825		- foreach ( $body['files'] as $file => $data ) {
1826		- $checksums[ $file ] = array(
1827		- 'md5' => isset( $data['md5'] ) ? $data['md5'] : null,
1828		- 'sha256' => isset( $data['sha256'] ) ? $data['sha256'] : null,
1829		- );
	5284	+ wp_delete_file( $package );
	5285	+
	5286	+ if ( empty( $checksums ) ) {
	5287	+ return new WP_Error( 'no_checksums', __( 'the package from WordPress.org could not be read', 'vigilante' ) );
1830	5288	}
1831	5289
1832		- // Cache for 24 hours (never during grace).
	5290	+ // The package of a published version does not change, so it is kept
	5291	+ // for a month (never during grace).
1833	5292	if ( ! $grace ) {
1834		- set_transient( $cache_key, $checksums, DAY_IN_SECONDS );
	5293	+ set_transient( $cache_key, $checksums, MONTH_IN_SECONDS );
1835	5294	}
1836	5295
1837	5296	return $checksums;
1838	5297	}
		@@ -1845,36 +5304,56 @@
1845	5304	private function scan_uploads() {
1846	5305	$found = array(
1847	5306	'suspicious' => array(),
1848	5307	'extra' => array(),
	5308	+ 'errors' => array(),
1849	5309	);
1850	5310	$upload_dir = wp_upload_dir();
1851	5311	$base_dir = $upload_dir['basedir'];
1852		- $max_files = 10000; // Increased limit for thorough scanning
1853	5312	$files_checked = 0;
1854	5313
	5314	+ // The walk used to stop after 10,000 files without saying so, and a
	5315	+ // media library passes that with a few thousand images. Now it goes on
	5316	+ // for as long as its share of the scan time lasts, and says so when it
	5317	+ // is cut short. The share keeps a huge library from leaving the core
	5318	+ // and the plugins without their turn.
	5319	+ $deadline = $this->scan_start_time > 0 ? $this->scan_start_time + ( 0.4 * $this->max_scan_time ) : 0;
	5320	+
1855	5321	// Executable extensions that should never be in uploads
1856		- $dangerous_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar', 'phps' );
	5322	+ $dangerous_extensions = self::php_extensions();
1857	5323
	5324	+ // Files that change how PHP runs in the folder they are in.
	5325	+ $php_config_files = array( '.user.ini', 'php.ini' );
	5326	+
	5327	+ // Scripts a server can be told to run through CGI.
	5328	+ $script_extensions = array( 'cgi', 'pl', 'py', 'sh', 'shtml' );
	5329	+
1858	5330	if ( ! is_dir( $base_dir ) ) {
1859	5331	return $found;
1860	5332	}
1861	5333
1862	5334	try {
1863		- $iterator = new RecursiveIteratorIterator(
1864		- new RecursiveDirectoryIterator( $base_dir, RecursiveDirectoryIterator::SKIP_DOTS ),
1865		- RecursiveIteratorIterator::LEAVES_ONLY
1866		- );
1867		-
1868		- foreach ( $iterator as $file ) {
	5335	+ foreach ( self::walk_folder( $base_dir ) as $file ) {
1869	5336	// Check global time limit
1870	5337	if ( $this->is_time_exceeded() ) {
1871	5338	break;
1872	5339	}
1873	5340
1874		- // Check file limit
	5341	+ if ( $file->isDir() ) {
	5342	+ if ( ! $file->isReadable() ) {
	5343	+ $found['errors'][] = self::unreadable_folder_error( $file->getPathname() );
	5344	+ }
	5345	+ continue;
	5346	+ }
	5347	+
	5348	+ // Check the share of the scan time (every 500 files)
1875	5349	$files_checked++;
1876		- if ( $files_checked > $max_files ) {
	5350	+ if ( $deadline > 0 && 0 === $files_checked % 500 && microtime( true ) > $deadline ) {
	5351	+ $found['errors'][] = sprintf(
	5352	+ /* translators: %s: Number of files */
	5353	+ __( 'The uploads folder was not checked completely: the time for it ran out after %s files.', 'vigilante' ),
	5354	+ number_format_i18n( $files_checked )
	5355	+ );
1877	5356	break;
1878	5357	}
1879	5358
1880	5359	$file_path = $file->getPathname();
		@@ -1899,15 +5378,12 @@
1899	5378
1900	5379	$reason = __( 'PHP file found in uploads directory', 'vigilante' );
1901	5380
1902	5381	// Scan content for specific suspicious patterns
1903		- if ( $file->getSize() < 512000 ) { // Only scan files < 500KB
1904		- $content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
1905		- $pattern = $this->detect_suspicious_pattern( $content );
1906		- if ( $pattern ) {
1907		- /* translators: %s: Suspicious pattern found */
1908		- $reason = sprintf( __( 'PHP in uploads with suspicious code: %s', 'vigilante' ), $pattern );
1909		- }
	5382	+ $pattern = $this->search_file( $file_path );
	5383	+ if ( $pattern ) {
	5384	+ /* translators: %s: Suspicious pattern found */
	5385	+ $reason = sprintf( __( 'PHP in uploads with suspicious code: %s', 'vigilante' ), $pattern );
1910	5386	}
1911	5387
1912	5388	$found['suspicious'][] = array(
1913	5389	'file' => $relative,
		@@ -1917,9 +5393,12 @@
1917	5393	continue;
1918	5394	}
1919	5395
1920	5396	// 2. Check for double extensions (image.php.jpg, file.phtml.png)
1921		- if ( preg_match( '/\.(' . implode( '|', $dangerous_extensions ) . ')\.[a-z]{2,4}$/i', $basename ) ) {
	5397	+ // The second extension can be anything: a script renamed by a
	5398	+ // malware cleaner (shell.php.suspected) or numbered (shell.php.1)
	5399	+ // is as much of a finding as one dressed up as an image.
	5400	+ if ( preg_match( '/\.(' . implode( '|', $dangerous_extensions ) . ')\.[a-z0-9_~-]{1,16}$/i', $basename ) ) {
1922	5401	$found['suspicious'][] = array(
1923	5402	'file' => $relative,
1924	5403	'type' => 'double_extension',
1925	5404	'reason' => __( 'Double extension detected (possible disguised executable)', 'vigilante' ),
		@@ -1926,17 +5405,41 @@
1926	5405	);
1927	5406	continue;
1928	5407	}
1929	5408
	5409	+ // 2b. Files that change how PHP runs in this folder
	5410	+ if ( in_array( strtolower( $basename ), $php_config_files, true ) ) {
	5411	+ $found['suspicious'][] = array(
	5412	+ 'file' => $relative,
	5413	+ 'type' => 'php_config_in_uploads',
	5414	+ 'reason' => __( 'PHP configuration file in uploads', 'vigilante' ),
	5415	+ );
	5416	+ continue;
	5417	+ }
	5418	+
	5419	+ // 2c. Scripts in other languages
	5420	+ if ( in_array( $extension, $script_extensions, true ) ) {
	5421	+ $found['extra'][] = array(
	5422	+ 'file' => $relative,
	5423	+ 'type' => 'script_in_uploads',
	5424	+ 'reason' => __( 'Script file in uploads', 'vigilante' ),
	5425	+ );
	5426	+ continue;
	5427	+ }
	5428	+
1930	5429	// 3. Check for .htaccess files in uploads
1931		- // Read content to classify: dangerous rules = suspicious, protective rules = extra
	5430	+ // Read content to classify (see classify_htaccess_in_uploads())
1932	5431	if ( '.htaccess' === $basename ) {
1933	5432	$htaccess_result = $this->classify_htaccess_in_uploads( $file_path, $relative );
1934		- $found[ $htaccess_result['category'] ][] = $htaccess_result['item'];
	5433	+
	5434	+ // One that only denies access, or does nothing, is not a finding.
	5435	+ if ( 'none' !== $htaccess_result['category'] ) {
	5436	+ $found[ $htaccess_result['category'] ][] = $htaccess_result['item'];
	5437	+ }
1935	5438	}
1936	5439	}
1937	5440	} catch ( Exception $e ) {
1938		- // Ignore iterator errors
	5441	+ $found['errors'][] = self::unreadable_folder_error( $base_dir );
1939	5442	}
1940	5443
1941	5444	return $found;
1942	5445	}
		@@ -1943,94 +5446,515 @@
1943	5446
1944	5447	/**
1945	5448	* Classify a .htaccess file found in uploads directory
1946	5449	*
1947		- * Reads the file content to determine if it contains dangerous rules
1948		- * (enabling PHP execution, rewriting to executables) or protective rules
1949		- * (deny access, disable indexes). Dangerous = suspicious, protective = extra.
	5450	+ * The file is read the way Apache reads it: continued lines are joined,
	5451	+ * comments are dropped and each directive is looked at on its own. That
	5452	+ * replaces a handful of expressions run over the whole text, which took a
	5453	+ * commented line for a live one and the rule that forbids PHP for one that
	5454	+ * runs it, and let through the directives that turn CGI on.
1950	5455	*
	5456	+ * - Something that makes the server run code: suspicious.
	5457	+ * - Only directives that deny or switch something off: not reported.
	5458	+ * - Rewrite rules of its own and nothing that denies PHP: extra, because in
	5459	+ * that folder they replace the rules of the site root, the one that
	5460	+ * blocks PHP in uploads included (measured on Apache, 3 Oct 2026).
	5461	+ * - Anything else: extra, with what it contains.
	5462	+ *
1951	5463	* @param string $file_path Absolute file path.
1952	5464	* @param string $relative Relative file path for display.
1953		- * @return array Array with 'category' ('suspicious' or 'extra') and 'item' data.
	5465	+ * @return array Array with 'category' ('suspicious', 'extra' or 'none') and 'item' data.
1954	5466	*/
1955	5467	private function classify_htaccess_in_uploads( $file_path, $relative ) {
1956		- $content = '';
	5468	+ $content = false;
1957	5469
1958	5470	if ( filesize( $file_path ) < 65536 ) { // Only read files < 64KB
1959	5471	$content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
1960	5472	}
1961	5473
1962		- // If we can't read it or it's empty, treat as suspicious (unknown)
1963		- if ( empty( trim( $content ) ) ) {
	5474	+ $item = array(
	5475	+ 'file' => $relative,
	5476	+ 'type' => 'htaccess_in_uploads',
	5477	+ );
	5478	+
	5479	+ // A file that cannot be read cannot be vouched for.
	5480	+ if ( false === $content ) {
	5481	+ $item['reason'] = __( '.htaccess file in uploads directory that could not be read', 'vigilante' );
	5482	+
1964	5483	return array(
1965	5484	'category' => 'suspicious',
1966		- 'item' => array(
1967		- 'file' => $relative,
1968		- 'type' => 'htaccess_in_uploads',
1969		- 'reason' => __( '.htaccess file in uploads directory (empty or unreadable)', 'vigilante' ),
1970		- ),
	5485	+ 'item' => $item,
1971	5486	);
1972	5487	}
1973	5488
1974		- // Dangerous patterns: rules that enable code execution or rewrite to executables
1975		- $dangerous_patterns = array(
1976		- '/AddHandler\s+.*(php|cgi|pl|py)/i' => 'AddHandler enabling script execution',
1977		- '/AddType\s+application\/x-httpd-php/i' => 'AddType enabling PHP execution',
1978		- '/SetHandler\s+.*(php|cgi)/i' => 'SetHandler enabling script execution',
1979		- '/php_flag\s+engine\s+on/i' => 'PHP engine enabled',
1980		- '/php_admin_flag\s+engine\s+on/i' => 'PHP admin engine enabled',
1981		- '/RewriteRule\s+.*\.(php|phtml|phar)/i' => 'Rewrite rule targeting PHP files',
1982		- '/auto_prepend_file/i' => 'auto_prepend_file directive',
1983		- '/auto_append_file/i' => 'auto_append_file directive',
	5489	+ $facts = self::read_htaccess_rules( $content );
	5490	+
	5491	+ if ( ! empty( $facts['runs'] ) ) {
	5492	+ $item['reason'] = self::htaccess_run_reason( $facts );
	5493	+
	5494	+ return array(
	5495	+ 'category' => 'suspicious',
	5496	+ 'item' => $item,
	5497	+ );
	5498	+ }
	5499	+
	5500	+ if ( $facts['rewrite'] && ! $facts['denies_php'] ) {
	5501	+ $item['reason'] = __( '.htaccess in uploads with rewrite rules of its own: in this folder they replace the ones of the site root, the rule that blocks PHP in uploads included', 'vigilante' );
	5502	+
	5503	+ return array(
	5504	+ 'category' => 'extra',
	5505	+ 'item' => $item,
	5506	+ );
	5507	+ }
	5508	+
	5509	+ // Empty, or nothing in it that does not deny or switch something off:
	5510	+ // it protects the folder, or does nothing, and is not a finding.
	5511	+ if ( empty( $facts['other'] ) ) {
	5512	+ return array(
	5513	+ 'category' => 'none',
	5514	+ 'item' => null,
	5515	+ );
	5516	+ }
	5517	+
	5518	+ $kinds = array(
	5519	+ 'access' => __( 'access rules', 'vigilante' ),
	5520	+ 'rewrite' => __( 'rewrite rules', 'vigilante' ),
	5521	+ 'headers' => __( 'cache or header rules', 'vigilante' ),
	5522	+ 'other' => __( 'other rules', 'vigilante' ),
1984	5523	);
1985	5524
1986		- foreach ( $dangerous_patterns as $pattern => $label ) {
1987		- if ( preg_match( $pattern, $content ) ) {
1988		- return array(
1989		- 'category' => 'suspicious',
1990		- 'item' => array(
1991		- 'file' => $relative,
1992		- 'type' => 'htaccess_in_uploads',
1993		- /* translators: %s: Dangerous rule description */
1994		- 'reason' => sprintf( __( '.htaccess with dangerous rule: %s', 'vigilante' ), $label ),
1995		- ),
1996		- );
	5525	+ /* translators: %s: Summary of rules found in the .htaccess file */
	5526	+ $item['reason'] = sprintf( __( '.htaccess in uploads (likely from plugin). Contains: %s', 'vigilante' ), implode( ', ', array_intersect_key( $kinds, $facts['other'] ) ) );
	5527	+
	5528	+ return array(
	5529	+ 'category' => 'extra',
	5530	+ 'item' => $item,
	5531	+ );
	5532	+ }
	5533	+
	5534	+ /**
	5535	+ * The reason shown for a .htaccess that makes the server run code
	5536	+ *
	5537	+ * @param array $facts What read_htaccess_rules() found.
	5538	+ * @return string
	5539	+ */
	5540	+ private static function htaccess_run_reason( $facts ) {
	5541	+ $labels = array(
	5542	+ 'run' => __( 'makes the server run files of this folder as code', 'vigilante' ),
	5543	+ 'load' => __( 'loads a file on every PHP request', 'vigilante' ),
	5544	+ 'rewrite' => __( 'sends requests to a PHP file', 'vigilante' ),
	5545	+ 'cgi' => __( 'turns on CGI or server-side includes', 'vigilante' ),
	5546	+ );
	5547	+
	5548	+ /* translators: %s: What the rule does */
	5549	+ return sprintf( __( '.htaccess with a rule that affects how code runs: %s', 'vigilante' ), implode( '; ', array_intersect_key( $labels, $facts['runs'] ) ) );
	5550	+ }
	5551	+
	5552	+ /**
	5553	+ * What a section of a .htaccess says about the directives inside it
	5554	+ *
	5555	+ * @param string $name Section name, in lower case.
	5556	+ * @param string $args What follows the name, as written.
	5557	+ * @return string '' when it changes nothing (<RequireAll>), 'rewrite' for
	5558	+ * <IfModule mod_rewrite.c>, 'maybe' for any other test of
	5559	+ * what the server has, 'files-php' for a <Files> or
	5560	+ * <FilesMatch> that names PHP files, 'files' for one that
	5561	+ * names other files, and 'condition' for the rest (<Limit>,
	5562	+ * <If>, <RequireAny>...), which apply to some requests only.
	5563	+ */
	5564	+ private static function htaccess_section_kind( $name, $args ) {
	5565	+ $args = trim( rtrim( trim( $args ), '>' ) );
	5566	+
	5567	+ if ( 'requireall' === $name ) {
	5568	+ return '';
	5569	+ }
	5570	+
	5571	+ if ( 'ifmodule' === $name ) {
	5572	+ return in_array( strtolower( trim( $args, '"\' ' ) ), array( 'mod_rewrite.c', 'rewrite_module' ), true ) ? 'rewrite' : 'maybe';
	5573	+ }
	5574	+
	5575	+ if ( in_array( $name, array( 'ifdefine', 'ifversion' ), true ) ) {
	5576	+ return 'maybe';
	5577	+ }
	5578	+
	5579	+ if ( 'files' === $name || 'filesmatch' === $name ) {
	5580	+ $regex = 'filesmatch' === $name;
	5581	+
	5582	+ if ( ! $regex && '~' === substr( $args, 0, 1 ) ) {
	5583	+ $regex = true;
	5584	+ $args = trim( substr( $args, 1 ) );
1997	5585	}
	5586	+
	5587	+ return true === self::extension_pattern_names_php( trim( $args, '"\'' ), $regex, false ) ? 'files-php' : 'files';
1998	5588	}
1999	5589
2000		- // Identify what protective/benign rules it contains for informational display
2001		- $found_rules = array();
	5590	+ return 'condition';
	5591	+ }
2002	5592
2003		- $benign_patterns = array(
2004		- '/Deny\s+from\s+all/i' => 'Deny from all',
2005		- '/Require\s+all\s+denied/i' => 'Require all denied',
2006		- '/Options\s+.*-Indexes/i' => 'Options -Indexes',
2007		- '/Header\s+set/i' => 'Header rules',
2008		- '/ExpiresActive/i' => 'Expires/cache rules',
2009		- '/RewriteEngine/i' => 'Rewrite rules',
2010		- '/FilesMatch/i' => 'FilesMatch rules',
2011		- '/ForceType\s+application\/octet/i' => 'ForceType (force download)',
	5593	+ /**
	5594	+ * Whether a pattern that goes only by the extension of a file names the PHP ones
	5595	+ *
	5596	+ * "Every PHP file" cannot be asked of a sample name. A sample is public,
	5597	+ * so a section can be written for it and nothing else, and an expression
	5598	+ * can name every file but one ("all but shell.php") in more ways than can
	5599	+ * be tried. So the pattern has to be of a kind that cannot tell one name
	5600	+ * from another: any name, a dot and a list of extensions, to the end. In
	5601	+ * that kind there is nothing to make an exception with, and whether .php
	5602	+ * is on the list is then a fair question for a sample. Anything else is
	5603	+ * not taken for a denial of PHP, which only means the .htaccess is listed.
	5604	+ *
	5605	+ * @param string $pattern Pattern, without its quotes.
	5606	+ * @param bool $regex Whether it is an expression (FilesMatch, "Files ~",
	5607	+ * RewriteRule) or a wildcard (Files).
	5608	+ * @param bool $nocase Whether it ignores case.
	5609	+ * @return bool|null True when it names every .php file, false when it goes
	5610	+ * by the extension and .php is not one of them, null
	5611	+ * when it is not of that kind.
	5612	+ */
	5613	+ private static function extension_pattern_names_php( $pattern, $regex, $nocase ) {
	5614	+ if ( ! $regex ) {
	5615	+ if ( 1 !== preg_match( '/^\*\.[a-z0-9*?]+$/i', $pattern ) ) {
	5616	+ return null;
	5617	+ }
	5618	+
	5619	+ return function_exists( 'fnmatch' ) ? fnmatch( $pattern, 'x.php' ) : '*.php' === $pattern;
	5620	+ }
	5621	+
	5622	+ $rest = $pattern;
	5623	+
	5624	+ if ( 0 === stripos( $rest, '(?i)' ) ) {
	5625	+ $rest = substr( $rest, 4 );
	5626	+ $nocase = true;
	5627	+ }
	5628	+
	5629	+ // "Any name" in front, written out or left out, and then a dot, the
	5630	+ // extensions and the end, written out or left out too. The extensions
	5631	+ // are letters, digits, groups, alternatives and classes of letters and
	5632	+ // digits: no dot, no "any character", nothing negated and nothing
	5633	+ // that looks around.
	5634	+ $rest = preg_replace( '/^\^?\.[*+]/', '', $rest, 1 );
	5635	+
	5636	+ if ( 1 !== preg_match( '/^\\\\\.(?:[a-z0-9|?*+)]|\\\\d|\[[a-z0-9-]+\]|\((?:\?i?:)?)+\$?$/i', (string) $rest ) ) {
	5637	+ return null;
	5638	+ }
	5639	+
	5640	+ // The dot has to be there: with "?" or "*" after it, what follows
	5641	+ // would be looked for anywhere in the name. And an alternative
	5642	+ // outside a group is a second pattern with no dot in front of it,
	5643	+ // which goes by the name again.
	5644	+ if ( 1 === preg_match( '/^\\\\\.[?*+]/', $rest ) ) {
	5645	+ return null;
	5646	+ }
	5647	+
	5648	+ $depth = 0;
	5649	+
	5650	+ for ( $i = 0, $length = strlen( $rest ); $i < $length; $i++ ) {
	5651	+ if ( '(' === $rest[ $i ] ) {
	5652	+ $depth++;
	5653	+ } elseif ( ')' === $rest[ $i ] ) {
	5654	+ $depth--;
	5655	+ }
	5656	+
	5657	+ if ( $depth < 0 || ( 0 === $depth && '|' === $rest[ $i ] ) ) {
	5658	+ return null;
	5659	+ }
	5660	+ }
	5661	+
	5662	+ if ( 0 !== $depth ) {
	5663	+ return null;
	5664	+ }
	5665	+
	5666	+ $expression = '~' . str_replace( '~', '\\~', $pattern ) . '~' . ( $nocase ? 'i' : '' );
	5667	+
	5668	+ foreach ( array( 'x.php', 'a/b/x.php' ) as $sample ) {
	5669	+ $matched = @preg_match( $expression, $sample ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- A pattern Apache would refuse names nothing.
	5670	+
	5671	+ if ( false === $matched ) {
	5672	+ return null;
	5673	+ }
	5674	+
	5675	+ if ( 0 === $matched ) {
	5676	+ return false;
	5677	+ }
	5678	+ }
	5679	+
	5680	+ return true;
	5681	+ }
	5682	+
	5683	+ /**
	5684	+ * Whether a RewriteRule that refuses requests refuses every PHP file
	5685	+ *
	5686	+ * A pattern with a "!" in front refuses what it does not match, so it
	5687	+ * refuses PHP when it goes by the extension and .php is not one of them
	5688	+ * ("!\.(jpe?g|png)$": everything but the images).
	5689	+ *
	5690	+ * @param string $pattern Pattern of the rule.
	5691	+ * @param string $flags Flags of the rule, in lower case.
	5692	+ * @return bool
	5693	+ */
	5694	+ private static function rewrite_rule_refuses_php( $pattern, $flags ) {
	5695	+ $pattern = trim( $pattern, '"\'' );
	5696	+ $negated = '' !== $pattern && '!' === $pattern[0];
	5697	+
	5698	+ if ( $negated ) {
	5699	+ $pattern = substr( $pattern, 1 );
	5700	+ }
	5701	+
	5702	+ if ( '' === $pattern ) {
	5703	+ return false;
	5704	+ }
	5705	+
	5706	+ $names = self::extension_pattern_names_php( $pattern, true, (bool) preg_match( '/[\[,]\s*(?:nc|nocase)\s*[,\]]/', $flags ) );
	5707	+
	5708	+ return $negated ? false === $names : true === $names;
	5709	+ }
	5710	+
	5711	+ /**
	5712	+ * What the directives of a .htaccess do, as far as running code goes
	5713	+ *
	5714	+ * @param string $content Content of the file.
	5715	+ * @return array {
	5716	+ * @type array $runs Ways it makes the server run code, as keys:
	5717	+ * 'run', 'load', 'rewrite', 'cgi'.
	5718	+ * @type array $other Kinds of directive that neither run code nor
	5719	+ * only deny, as keys: 'access', 'rewrite',
	5720	+ * 'headers', 'other'.
	5721	+ * @type bool $rewrite Whether it has rewrite directives of its own.
	5722	+ * @type bool $denies_php Whether it denies access to every PHP file
	5723	+ * itself, for every request and whatever the
	5724	+ * server has loaded.
	5725	+ * }
	5726	+ */
	5727	+ private static function read_htaccess_rules( $content ) {
	5728	+ $facts = array(
	5729	+ 'runs' => array(),
	5730	+ 'other' => array(),
	5731	+ 'rewrite' => false,
	5732	+ 'denies_php' => false,
2012	5733	);
2013	5734
2014		- foreach ( $benign_patterns as $pattern => $label ) {
2015		- if ( preg_match( $pattern, $content ) ) {
2016		- $found_rules[] = $label;
	5735	+ // A line that ends in a backslash goes on in the next one, and Apache
	5736	+ // joins the two before it looks at anything else, comments included.
	5737	+ $content = str_replace( array( "\r\n", "\r" ), "\n", (string) $content );
	5738	+ $content = preg_replace( '/(?<!\\\\)\\\\\n/', '', $content );
	5739	+
	5740	+ // "script" as a word of its own: cgi-script and php-script are
	5741	+ // handlers that run code, application/javascript is a kind of file.
	5742	+ $scripts = '/php|cgi|(?<![a-z])script|lsapi|server-parsed|proxy:|python-program/';
	5743	+ $php_target = '/\.(?:ph(?:p\d*|tml|t|ar|ps)|inc)(?![a-z0-9])/';
	5744	+ $containers = array();
	5745	+ $cgi_handler = false;
	5746	+ $execcgi_on = false;
	5747	+ $execcgi_off = false;
	5748	+
	5749	+ foreach ( explode( "\n", (string) $content ) as $line ) {
	5750	+ $line = trim( $line );
	5751	+
	5752	+ if ( '' === $line || '#' === $line[0] ) {
	5753	+ continue;
2017	5754	}
	5755	+
	5756	+ // Sections are remembered, to know what a directive inside them
	5757	+ // applies to (see htaccess_section_kind()).
	5758	+ if ( '<' === $line[0] ) {
	5759	+ if ( preg_match( '/^<\s*\//', $line ) ) {
	5760	+ array_pop( $containers );
	5761	+ } elseif ( preg_match( '/^<\s*([A-Za-z]+)\b(.*)$/', $line, $section ) ) {
	5762	+ $containers[] = self::htaccess_section_kind( strtolower( $section[1] ), $section[2] );
	5763	+ }
	5764	+ continue;
	5765	+ }
	5766	+
	5767	+ if ( ! preg_match( '/^([A-Za-z_]+)\s*(.*)$/', $line, $parts ) ) {
	5768	+ $facts['other']['other'] = true;
	5769	+ continue;
	5770	+ }
	5771	+
	5772	+ $name = strtolower( $parts[1] );
	5773	+ $args = trim( $parts[2] );
	5774	+ $low = strtolower( $args );
	5775	+ $words = preg_split( '/\s+/', $low, -1, PREG_SPLIT_NO_EMPTY );
	5776	+ $first = isset( $words[0] ) ? trim( $words[0], '"\'' ) : '';
	5777	+
	5778	+ // The sections around this line that put a condition on it.
	5779	+ $inside = array_values( array_diff( $containers, array( '' ) ) );
	5780	+
	5781	+ switch ( $name ) {
	5782	+ case 'sethandler':
	5783	+ case 'addhandler':
	5784	+ case 'addtype':
	5785	+ case 'forcetype':
	5786	+ if ( preg_match( $scripts, $first ) ) {
	5787	+ // "AddHandler cgi-script" next to "Options -ExecCGI" is
	5788	+ // the old recipe that hands every script to CGI and
	5789	+ // forbids CGI. Which of the two it is gets decided
	5790	+ // once the whole file has been read.
	5791	+ if ( 'addhandler' === $name && false !== strpos( $first, 'cgi' ) ) {
	5792	+ $cgi_handler = true;
	5793	+ } else {
	5794	+ $facts['runs']['run'] = true;
	5795	+ }
	5796	+ } elseif ( ! in_array( $first, array( 'none', 'default-handler', 'text/plain', 'application/octet-stream' ), true ) ) {
	5797	+ $facts['other']['other'] = true;
	5798	+ }
	5799	+ break;
	5800	+
	5801	+ case 'php_flag':
	5802	+ case 'php_admin_flag':
	5803	+ case 'php_value':
	5804	+ case 'php_admin_value':
	5805	+ $value = isset( $words[1] ) ? trim( $words[1], '"\'' ) : '';
	5806	+
	5807	+ if ( 'engine' === $first ) {
	5808	+ if ( ! in_array( $value, array( 'off', '0', 'false', 'no' ), true ) ) {
	5809	+ $facts['runs']['run'] = true;
	5810	+ }
	5811	+ } elseif ( in_array( $first, array( 'auto_prepend_file', 'auto_append_file' ), true ) ) {
	5812	+ if ( '' !== $value && 'none' !== $value ) {
	5813	+ $facts['runs']['load'] = true;
	5814	+ }
	5815	+ } else {
	5816	+ $facts['other']['other'] = true;
	5817	+ }
	5818	+ break;
	5819	+
	5820	+ case 'options':
	5821	+ foreach ( $words as $option ) {
	5822	+ // Only a ban on CGI that holds for everybody counts as one.
	5823	+ if ( '-execcgi' === $option && empty( $inside ) ) {
	5824	+ $execcgi_off = true;
	5825	+ }
	5826	+
	5827	+ if ( '-' === $option[0] || 'none' === $option ) {
	5828	+ continue;
	5829	+ }
	5830	+
	5831	+ $option = ltrim( $option, '+' );
	5832	+
	5833	+ if ( in_array( $option, array( 'execcgi', 'includes', 'all' ), true ) ) {
	5834	+ $facts['runs']['cgi'] = true;
	5835	+ $execcgi_on = true;
	5836	+ } else {
	5837	+ $facts['other']['other'] = true;
	5838	+ }
	5839	+ }
	5840	+ break;
	5841	+
	5842	+ case 'addoutputfilter':
	5843	+ case 'setoutputfilter':
	5844	+ case 'addoutputfilterbytype':
	5845	+ if ( false !== strpos( $low, 'includes' ) ) {
	5846	+ $facts['runs']['cgi'] = true;
	5847	+ } else {
	5848	+ $facts['other']['other'] = true;
	5849	+ }
	5850	+ break;
	5851	+
	5852	+ case 'action':
	5853	+ $facts['runs']['cgi'] = true;
	5854	+ break;
	5855	+
	5856	+ case 'xbithack':
	5857	+ // Server-side includes for every file with the execute bit.
	5858	+ if ( 'off' !== $first ) {
	5859	+ $facts['runs']['cgi'] = true;
	5860	+ }
	5861	+ break;
	5862	+
	5863	+ case 'deny':
	5864	+ case 'require':
	5865	+ $denies = 'deny' === $name ? ( 'from' === $first && isset( $words[1] ) && 'all' === $words[1] ) : ( 'all' === $first && isset( $words[1] ) && 'denied' === $words[1] );
	5866	+
	5867	+ if ( ! $denies || in_array( 'condition', $inside, true ) ) {
	5868	+ $facts['other']['access'] = true;
	5869	+ } elseif ( ! array_diff( $inside, array( 'rewrite', 'files-php' ) ) ) {
	5870	+ // For every request, on any server, and for every file
	5871	+ // or for the PHP ones. A denial that depends on a
	5872	+ // module being there, or that names other files, still
	5873	+ // protects, but it does not make up for rewrite rules
	5874	+ // that switch off the ones of the site root.
	5875	+ $facts['denies_php'] = true;
	5876	+ }
	5877	+ break;
	5878	+
	5879	+ case 'order':
	5880	+ case 'indexignore':
	5881	+ break;
	5882	+
	5883	+ case 'allow':
	5884	+ case 'satisfy':
	5885	+ case 'authtype':
	5886	+ case 'authname':
	5887	+ case 'authuserfile':
	5888	+ case 'authgroupfile':
	5889	+ $facts['other']['access'] = true;
	5890	+ break;
	5891	+
	5892	+ case 'rewriteengine':
	5893	+ case 'rewritebase':
	5894	+ case 'rewriteoptions':
	5895	+ $facts['rewrite'] = true;
	5896	+ break;
	5897	+
	5898	+ case 'rewritecond':
	5899	+ // A condition makes the rule after it apply to some
	5900	+ // requests and not to others, a denial included.
	5901	+ $facts['rewrite'] = true;
	5902	+ $facts['other']['rewrite'] = true;
	5903	+ break;
	5904	+
	5905	+ case 'rewriterule':
	5906	+ $facts['rewrite'] = true;
	5907	+
	5908	+ $rule = preg_split( '/\s+/', $args, 3 );
	5909	+ $pattern = isset( $rule[0] ) ? $rule[0] : '';
	5910	+ $target = isset( $rule[1] ) ? strtolower( trim( $rule[1], '"\'' ) ) : '';
	5911	+ $flags = isset( $rule[2] ) ? strtolower( $rule[2] ) : '';
	5912	+
	5913	+ if ( preg_match( '/[\[,]\s*h=/', $flags ) || preg_match( '/[\[,]\s*t=[^,\]]*(?:php|cgi|(?<![a-z])script)/', $flags ) ) {
	5914	+ // A handler or a type forced from the rule itself.
	5915	+ $facts['runs']['run'] = true;
	5916	+ } elseif ( '-' === $target && preg_match( '/[\[,]\s*(?:f|forbidden|g|gone)\s*[,\]]/', $flags ) ) {
	5917	+ // Rewrites nothing and refuses the request. It stands
	5918	+ // for the rule of the site root only when it refuses
	5919	+ // every PHP file, for every request.
	5920	+ if ( ! array_diff( $inside, array( 'rewrite' ) ) && self::rewrite_rule_refuses_php( $pattern, $flags ) ) {
	5921	+ $facts['denies_php'] = true;
	5922	+ } else {
	5923	+ $facts['other']['rewrite'] = true;
	5924	+ }
	5925	+ } elseif ( '-' === $target ) {
	5926	+ // Rewrites nothing and lets the request through, which
	5927	+ // can be the way to keep one file out of the denial
	5928	+ // that follows: it is not part of a file that only
	5929	+ // protects.
	5930	+ $facts['other']['rewrite'] = true;
	5931	+ } elseif ( preg_match( $php_target, $target ) && '/index.php' !== $target ) {
	5932	+ $facts['runs']['rewrite'] = true;
	5933	+ } else {
	5934	+ $facts['other']['rewrite'] = true;
	5935	+ }
	5936	+ break;
	5937	+
	5938	+ case 'header':
	5939	+ case 'requestheader':
	5940	+ case 'expiresactive':
	5941	+ case 'expiresbytype':
	5942	+ case 'expiresdefault':
	5943	+ case 'fileetag':
	5944	+ $facts['other']['headers'] = true;
	5945	+ break;
	5946	+
	5947	+ default:
	5948	+ $facts['other']['other'] = true;
	5949	+ }
2018	5950	}
2019	5951
2020		- $rules_summary = ! empty( $found_rules )
2021		- ? implode( ', ', $found_rules )
2022		- : __( 'Custom rules', 'vigilante' );
	5952	+ if ( $cgi_handler && ( $execcgi_on || ! $execcgi_off ) ) {
	5953	+ $facts['runs']['cgi'] = true;
	5954	+ }
2023	5955
2024		- return array(
2025		- 'category' => 'extra',
2026		- 'item' => array(
2027		- 'file' => $relative,
2028		- 'type' => 'htaccess_in_uploads',
2029		- /* translators: %s: Summary of rules found in the .htaccess file */
2030		- 'reason' => sprintf( __( '.htaccess in uploads (likely from plugin). Contains: %s', 'vigilante' ), $rules_summary ),
2031		- ),
2032		- );
	5956	+ return $facts;
2033	5957	}
2034	5958
2035	5959	/**
2036	5960	* Check content for suspicious patterns
		@@ -2074,25 +5998,45 @@
2074	5998	foreach ( $patterns_data['standard_patterns'] as $encoded_needle => $label ) {
2075	5999	// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- Decoding pattern definitions, not user input.
2076	6000	$needle = base64_decode( $encoded_needle );
2077	6001	if ( $this->needle_present( $content, $needle ) ) {
2078		- return $label;
	6002	+ // The labels live in the pattern file, in English: "$_GET access"
	6003	+ // becomes "$_GET", which needs no translation.
	6004	+ return preg_replace( '/ access$/', '', (string) $label );
2079	6005	}
2080	6006	}
2081	6007
2082		- // Check for preg_replace with /e modifier (code execution)
2083		- if ( preg_match( '/preg_replace\s*\(\s*[\'"].*\/e[\'"]/i', $content ) ) {
2084		- return 'preg_replace /e modifier';
	6008	+ return $this->detect_common_pattern( $content );
	6009	+ }
	6010	+
	6011	+ /**
	6012	+ * The three checks both levels of the search share
	6013	+ *
	6014	+ * @param string $content File content.
	6015	+ * @return string|false The pattern found, or false.
	6016	+ */
	6017	+ private function detect_common_pattern( $content ) {
	6018	+ // preg_replace with the /e modifier (arbitrary code execution,
	6019	+ // deprecated). The modifier is looked for on the same line and within
	6020	+ // 300 characters of the opening quote. With ".*" every preg_replace of
	6021	+ // a long line cost a pass over the whole line: 88 seconds for a file
	6022	+ // of 500 KB made for it, measured without the PCRE compiler.
	6023	+ if ( $this->found( '/preg_replace\s*+\(\s*+[\'"][^\n]{0,300}?\/e[\'"]/i', $content ) ) {
	6024	+ return __( 'preg_replace with the /e modifier, which runs code', 'vigilante' );
2085	6025	}
2086	6026
2087		- // Check for long hex-encoded strings (obfuscated payloads)
2088		- if ( preg_match( '/\\\\x[0-9a-f]{2}(\\\\x[0-9a-f]{2}){10,}/i', $content ) ) {
2089		- return 'hex-encoded string';
	6027	+ // Long hex-encoded strings (obfuscated payloads). Eleven escapes in a
	6028	+ // row and not "ten or more after the first": asked to take them all,
	6029	+ // PCRE gave up on a run of some 12,000, and a search that gave up
	6030	+ // read as "nothing found". The longer the payload, the less it was
	6031	+ // found.
	6032	+ if ( $this->found( '/(?:\\\\x[0-9a-f]{2}){11}/i', $content ) ) {
	6033	+ return __( 'a long string written in hexadecimal', 'vigilante' );
2090	6034	}
2091	6035
2092		- // Check for heavily concatenated chr() calls (char-by-char obfuscation)
2093		- if ( preg_match( '/chr\s*\(\s*\d+\s*\)\s*\.\s*chr\s*\(\s*\d+\s*\)\s*\.\s*chr/i', $content ) ) {
2094		- return 'chr() concatenation obfuscation';
	6036	+ // Heavily concatenated chr() calls (char-by-char obfuscation)
	6037	+ if ( $this->found( '/chr\s*+\(\s*+\d++\s*+\)\s*+\.\s*+chr\s*+\(\s*+\d++\s*+\)\s*+\.\s*+chr/i', $content ) ) {
	6038	+ return __( 'text built character by character with chr()', 'vigilante' );
2095	6039	}
2096	6040
2097	6041	return false;
2098	6042	}
		@@ -2129,29 +6073,94 @@
2129	6073	$as = $fragments['as'] ?? '';
2130	6074	$ss = $fragments['ss'] ?? '';
2131	6075	$cf = $fragments['cf'] ?? '';
2132	6076
2133		- // Obfuscation combos: dangerous function wrapping decoded content
	6077	+ // Obfuscation combos: dangerous function wrapping decoded content.
	6078	+ // The labels name the two functions side by side and not one inside
	6079	+ // the other. Written the way the code is written, a label was itself
	6080	+ // a match: the results of a scan, kept in a cache that stores options
	6081	+ // as PHP files under wp-content, would have been the next finding.
	6082	+ // The possessive quantifiers ("*+") change nothing in what matches,
	6083	+ // because what follows each run of spaces is never a space. They keep
	6084	+ // PCRE from walking a long run back one space at a time, which is
	6085	+ // where it gives up when it runs without its compiler.
2134	6086	$obfuscation_combos = array(
2135		- '/' . $ev . '\s*\(\s*' . $b6 . '\s*\(/i' => $ev . '(' . $b6 . '())',
2136		- '/' . $ev . '\s*\(\s*' . $gz . '\s*\(/i' => $ev . '(' . $gz . '())',
2137		- '/' . $ev . '\s*\(\s*' . $gu . '\s*\(/i' => $ev . '(' . $gu . '())',
2138		- '/' . $ev . '\s*\(\s*' . $sr . '\s*\(/i' => $ev . '(' . $sr . '())',
2139		- '/' . $ev . '\s*\(\s*' . $hb . '\s*\(/i' => $ev . '(' . $hb . '())',
2140		- '/' . $as . '\s*\(\s*' . $b6 . '\s*\(/i' => $as . '(' . $b6 . '())',
2141		- '/' . $ev . '\s*\(\s*\$[a-z_]+\s*\(/i' => $ev . '($variable())',
2142		- '/' . $ev . '\s*\(\s*' . $ss . '\s*\(/i' => $ev . '(' . $ss . '())',
	6087	+ '/' . $ev . '\s*+\(\s*+' . $b6 . '\s*+\(/i' => $ev . '() + ' . $b6 . '()',
	6088	+ '/' . $ev . '\s*+\(\s*+' . $gz . '\s*+\(/i' => $ev . '() + ' . $gz . '()',
	6089	+ '/' . $ev . '\s*+\(\s*+' . $gu . '\s*+\(/i' => $ev . '() + ' . $gu . '()',
	6090	+ '/' . $ev . '\s*+\(\s*+' . $sr . '\s*+\(/i' => $ev . '() + ' . $sr . '()',
	6091	+ '/' . $ev . '\s*+\(\s*+' . $hb . '\s*+\(/i' => $ev . '() + ' . $hb . '()',
	6092	+ '/' . $as . '\s*+\(\s*+' . $b6 . '\s*+\(/i' => $as . '() + ' . $b6 . '()',
	6093	+ '/' . $ev . '\s*+\(\s*+\$[a-z_]++\s*+\(/i' => $ev . '() + $variable()',
	6094	+ '/' . $ev . '\s*+\(\s*+' . $ss . '\s*+\(/i' => $ev . '() + ' . $ss . '()',
2143	6095	);
2144	6096
2145	6097	foreach ( $obfuscation_combos as $regex => $label ) {
2146		- if ( preg_match( $regex, $content ) ) {
	6098	+ if ( $this->found( $regex, $content ) ) {
2147	6099	return $label;
2148	6100	}
2149	6101	}
2150	6102
	6103	+ // The plain backdoor, with nothing to hide: data from the request
	6104	+ // handed straight to code or to the system, a function the request
	6105	+ // chooses, or a file included from another server. The names come
	6106	+ // from the list the concatenation check below uses, minus the decoders,
	6107	+ // so they are not written here either. That list is decoded once, for both.
	6108	+ $dangerous_names = array();
	6109	+ if ( ! empty( $patterns_data['dangerous_names'] ) ) {
	6110	+ foreach ( $patterns_data['dangerous_names'] as $encoded_name ) {
	6111	+ // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
	6112	+ $dangerous_names[] = base64_decode( $encoded_name );
	6113	+ }
	6114	+ }
	6115	+
	6116	+ $runners = array_merge( array_filter( array( $ev, $as ) ), array_diff( $dangerous_names, array( $b6, $gz, $gu, $sr, $hb ) ) );
	6117	+
	6118	+ // These three read as code what PHP reads as code, so they are
	6119	+ // searched with the comments of the file turned into blank space
	6120	+ // (blank_comments()). A comment that quotes one of them ("never do
	6121	+ // this: ...") is then not a finding, and a comment slipped between a
	6122	+ // name and its parenthesis hides nothing. The first two cannot match
	6123	+ // without a superglobal of the request, so only the files that name
	6124	+ // one are prepared that way, about one in twenty. The third is looked
	6125	+ // for in the file as it is and checked again that way when it matches.
	6126	+ $code = null;
	6127	+
	6128	+ if ( $this->found( '/\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b/', $content ) ) {
	6129	+ $code = $this->blank_comments( $content );
	6130	+
	6131	+ // When PHP cannot be asked what is a comment, the file is
	6132	+ // searched as it is: a comment may then be reported, and nothing
	6133	+ // that runs is left out.
	6134	+ $subject = false === $code ? $content : $code;
	6135	+
	6136	+ if ( ! empty( $runners ) ) {
	6137	+ $names = implode( '|', array_map( 'preg_quote', $runners ) );
	6138	+ // What the visitor sends, when it is not just being asked about
	6139	+ // with isset() or empty(). The path of an uploaded file is not in
	6140	+ // the list: handing it to a command is how images get processed.
	6141	+ $from_request = '(?<!isset\()(?<!isset\( )(?<!empty\()(?<!empty\( )(?:\$_(?:GET|POST|REQUEST|COOKIE)\b|\$_SERVER\s*\[\s*[\'"]HTTP_)';
	6142	+
	6143	+ // The possessive quantifiers keep a file made of spaces from
	6144	+ // costing a try per space.
	6145	+ if ( $this->found( '/(?<![a-z0-9_>:$])(?:' . $names . ')\s*+\(\s*+[^;\n]{0,80}?' . $from_request . '/i', $subject ) ) {
	6146	+ return __( 'data from the request is run as code or as a command', 'vigilante' );
	6147	+ }
	6148	+ }
	6149	+
	6150	+ if ( $this->found( '/\$_(?:GET|POST|REQUEST|COOKIE)\s*+\[[^\]\n]{1,60}\]\s*+\(/', $subject ) ) {
	6151	+ return __( 'a function chosen by the request is called', 'vigilante' );
	6152	+ }
	6153	+ }
	6154	+
	6155	+ if ( $this->found_in_code( '/(?<![a-z0-9_>$])(?:include|require)(?:_once)?\s*+(?:\(\s*+)?[\'"]https?:\/\//i', $content, $code ) ) {
	6156	+ return __( 'a file from another server is included', 'vigilante' );
	6157	+ }
	6158	+
2151	6159	// Deprecated dynamic function constructor, nearly always malicious in modern code
2152	6160	if ( ! empty( $cf ) && $this->needle_present( $content, $cf ) ) {
2153		- return $cf . ')';
	6161	+ // The name alone, for the same reason as the labels above.
	6162	+ return rtrim( $cf, '(' );
2154	6163	}
2155	6164
2156	6165	// Remote fetch piped into unserialize: a PHP object-injection / supply-chain
2157	6166	// vector seen in trojanized or nulled plugins (download a payload from a
		@@ -2161,11 +6170,21 @@
2161	6170	// checked that both strings appeared somewhere in the file, which
2162	6171	// false-positived on legitimate code using both in unrelated methods
2163	6172	// (e.g. a theme reading a transient with maybe_unserialize() while
2164	6173	// fetching its public IP with wp_remote_get()).
2165		- $us = $fragments['us'] ?? '';
2166		- if ( '' !== $us ) {
2167		- $us_regex = '/(?<![a-z0-9_])' . preg_quote( $us, '/' ) . '\s*\(/i';
	6174	+ //
	6175	+ // The search runs on a copy of the file in lower case, with
	6176	+ // expressions that tell the case apart, and only when the file names
	6177	+ // the function at all. PCRE without its compiler looks ahead for the
	6178	+ // first letter of an expression in both cases before each try, and
	6179	+ // when one of the two is not in the file that look runs to the end of
	6180	+ // it. pattern_near() asks once per match, so a file with thousands of
	6181	+ // them cost thousands of passes (26 seconds for 8 MB, measured). With
	6182	+ // one case to look for, each look stops at the next candidate.
	6183	+ $us = self::lower_ascii( $fragments['us'] ?? '' );
	6184	+ if ( '' !== $us && false !== stripos( $content, $us ) ) {
	6185	+ $lower = self::lower_ascii( $content );
	6186	+ $us_regex = '/(?<![a-z0-9_])' . preg_quote( $us, '/' ) . '\s*+\(/';
2168	6187	$remote_fetchers = array(
2169	6188	$fragments['wr'] ?? '', // wp_remote_get
2170	6189	$fragments['rb'] ?? '', // wp_remote_retrieve_body
2171	6190	$fragments['ce'] ?? '', // curl_exec
		@@ -2173,11 +6192,12 @@
2173	6192	foreach ( $remote_fetchers as $rf ) {
2174	6193	if ( '' === $rf ) {
2175	6194	continue;
2176	6195	}
2177		- $rf_regex = '/(?<![a-z0-9_])' . preg_quote( $rf, '/' ) . '\s*\(/i';
2178		- if ( $this->pattern_near( $content, $us_regex, $rf_regex, 600 ) ) {
2179		- return $rf . '() + ' . $us . '() remote deserialization';
	6196	+ $rf_regex = '/(?<![a-z0-9_])' . preg_quote( self::lower_ascii( $rf ), '/' ) . '\s*+\(/';
	6197	+ if ( $this->pattern_near( $lower, $us_regex, $rf_regex, 600 ) ) {
	6198	+ /* translators: 1: Function that downloads, 2: Function that unserializes */
	6199	+ return sprintf( __( 'data downloaded from another server is unserialized (%1$s and %2$s)', 'vigilante' ), $rf, $us );
2180	6200	}
2181	6201	}
2182	6202
2183	6203	// file_get_contents() is treated separately from the fetchers
		@@ -2190,51 +6210,106 @@
2190	6210	// argument is a URL, so the combo additionally requires a
2191	6211	// remote-scheme literal near the call before it fires.
2192	6212	$fg = $fragments['fg'] ?? '';
2193	6213	if ( '' !== $fg ) {
2194		- $fg_regex = '/(?<![a-z0-9_])' . preg_quote( $fg, '/' ) . '\s*\(/i';
2195		- $scheme_regex = '/(?:https?|ftps?):\/\/|php:\/\/input/i';
	6214	+ $fg_regex = '/(?<![a-z0-9_])' . preg_quote( self::lower_ascii( $fg ), '/' ) . '\s*+\(/';
	6215	+ $scheme_regex = '/(?:https?|ftps?):\/\/|php:\/\/input/';
2196	6216
2197		- if ( $this->pattern_near( $content, $us_regex, $fg_regex, 600 )
2198		- && $this->pattern_near( $content, $fg_regex, $scheme_regex, 600 ) ) {
2199		- return $fg . '() + ' . $us . '() remote deserialization';
	6217	+ if ( $this->pattern_near( $lower, $us_regex, $fg_regex, 600 )
	6218	+ && $this->pattern_near( $lower, $fg_regex, $scheme_regex, 600 ) ) {
	6219	+ /* translators: 1: Function that downloads, 2: Function that unserializes */
	6220	+ return sprintf( __( 'data downloaded from another server is unserialized (%1$s and %2$s)', 'vigilante' ), $fg, $us );
2200	6221	}
2201	6222	}
2202	6223	}
2203	6224
2204		- // preg_replace with /e modifier (arbitrary code execution, deprecated)
2205		- if ( preg_match( '/preg_replace\s*\(\s*[\'"].*\/e[\'"]/i', $content ) ) {
2206		- return 'preg_replace /e modifier';
	6225	+ $common = $this->detect_common_pattern( $content );
	6226	+ if ( $common ) {
	6227	+ return $common;
2207	6228	}
2208	6229
2209		- // Long hex-encoded strings (obfuscated payloads)
2210		- if ( preg_match( '/\\\\x[0-9a-f]{2}(\\\\x[0-9a-f]{2}){10,}/i', $content ) ) {
2211		- return 'hex-encoded string';
	6230	+ // Dangerous function names built from string concatenation: a variable
	6231	+ // given a name in pieces and then called. The assignments are taken
	6232	+ // one at a time and the calls are looked up in one pass. Collecting
	6233	+ // every assignment of the file first, and then searching the whole
	6234	+ // file again for each one, took memory and time that grew with the
	6235	+ // square of the file.
	6236	+ $split = array();
	6237	+ $capped = false;
	6238	+ $offset = 0;
	6239	+
	6240	+ while ( true ) {
	6241	+ // A variable, "=" and a quoted piece followed by a dot: where a
	6242	+ // string put together from pieces starts.
	6243	+ $start = $this->next_match( '/\$([a-z_]\w*)\s*+=\s*+(?=["\'][a-z0-9_]*+["\']\s*+\.)/i', $content, $offset );
	6244	+
	6245	+ if ( null === $start ) {
	6246	+ break;
	6247	+ }
	6248	+
	6249	+ // The pieces are taken one by one, however many there are: a name
	6250	+ // can be padded with as many empty ones as its author likes, and
	6251	+ // asking PCRE for the whole chain at once is what made it give up.
	6252	+ $position = $start[0][1] + strlen( $start[0][0] );
	6253	+ $combined = '';
	6254	+ $closed = false;
	6255	+
	6256	+ while ( true ) {
	6257	+ $piece = $this->next_match( '/\G["\']([a-z0-9_]*+)["\']\s*+(\.\s*+|;)?+/i', $content, $position );
	6258	+
	6259	+ if ( null === $piece ) {
	6260	+ break;
	6261	+ }
	6262	+
	6263	+ // No name on the list is this long: past it, the letters are
	6264	+ // not kept, and the chain is still walked to its end.
	6265	+ if ( strlen( $combined ) <= 64 ) {
	6266	+ $combined .= self::lower_ascii( $piece[1][0] );
	6267	+ }
	6268	+
	6269	+ $position = $piece[0][1] + strlen( $piece[0][0] );
	6270	+ $after = isset( $piece[2] ) && $piece[2][1] >= 0 ? $piece[2][0] : '';
	6271	+
	6272	+ if ( '' === $after || ';' === $after ) {
	6273	+ $closed = ';' === $after;
	6274	+ break;
	6275	+ }
	6276	+ }
	6277	+
	6278	+ $offset = max( $position, $start[0][1] + 1 );
	6279	+
	6280	+ if ( $closed && in_array( $combined, $dangerous_names, true ) && ! isset( $split[ $start[1][0] ] ) ) {
	6281	+ $split[ $start[1][0] ] = $combined;
	6282	+
	6283	+ if ( count( $split ) >= 500 ) {
	6284	+ $capped = true;
	6285	+ break;
	6286	+ }
	6287	+ }
2212	6288	}
2213	6289
2214		- // Heavily concatenated chr() calls (char-by-char obfuscation)
2215		- if ( preg_match( '/chr\s*\(\s*\d+\s*\)\s*\.\s*chr\s*\(\s*\d+\s*\)\s*\.\s*chr/i', $content ) ) {
2216		- return 'chr() concatenation obfuscation';
2217		- }
	6290	+ if ( ! empty( $split ) ) {
	6291	+ $offset = 0;
2218	6292
2219		- // Detect dangerous function names built from string concatenation
2220		- if ( preg_match_all( '/\$([a-z_]\w*)\s*=\s*((?:["\'][a-z0-9_]*["\']\s*\.\s*)+["\'][a-z0-9_]*["\'])\s*;/i', $content, $matches, PREG_SET_ORDER ) ) {
2221		- $dangerous_names = array();
2222		- if ( ! empty( $patterns_data['dangerous_names'] ) ) {
2223		- foreach ( $patterns_data['dangerous_names'] as $encoded_name ) {
2224		- // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
2225		- $dangerous_names[] = base64_decode( $encoded_name );
	6293	+ while ( true ) {
	6294	+ $call = $this->next_match( '/\$([a-z_]\w*)\s*+\(/i', $content, $offset );
	6295	+
	6296	+ if ( null === $call ) {
	6297	+ break;
2226	6298	}
	6299	+
	6300	+ if ( isset( $split[ $call[1][0] ] ) ) {
	6301	+ /* translators: %s: Function name */
	6302	+ return sprintf( __( 'call to %s() with its name split in pieces', 'vigilante' ), $split[ $call[1][0] ] );
	6303	+ }
	6304	+
	6305	+ $offset = $call[0][1] + strlen( $call[0][0] );
2227	6306	}
2228	6307
2229		- foreach ( $matches as $match ) {
2230		- $combined = strtolower( preg_replace( '/["\'\s\.]/', '', $match[2] ) );
2231		- if ( in_array( $combined, $dangerous_names, true ) ) {
2232		- $var_pattern = '/\$' . preg_quote( $match[1], '/' ) . '\s*\(/';
2233		- if ( preg_match( $var_pattern, $content ) ) {
2234		- return 'obfuscated ' . $combined . '() call';
2235		- }
2236		- }
	6308	+ // More names in pieces than a file has any reason to hold, and
	6309	+ // not every one was followed: not searched, rather than clean.
	6310	+ if ( $capped ) {
	6311	+ $this->search_failed = true;
2237	6312	}
2238	6313	}
2239	6314
2240	6315	return false;
		@@ -2260,9 +6335,9 @@
2260	6335	return false;
2261	6336	}
2262	6337	if ( preg_match( '/^[a-z_][a-z0-9_]*\($/i', $needle ) ) {
2263	6338	$fn = rtrim( $needle, '(' );
2264		- return (bool) preg_match( '/(?<![a-z0-9_])' . preg_quote( $fn, '/' ) . '\s*\(/i', $content );
	6339	+ return $this->found( '/(?<![a-z0-9_])' . preg_quote( $fn, '/' ) . '\s*+\(/i', $content );
2265	6340	}
2266	6341	return stripos( $content, $needle ) !== false;
2267	6342	}
2268	6343
		@@ -2280,25 +6355,266 @@
2280	6355	* @param int $window Maximum byte distance between a match of each.
2281	6356	* @return bool
2282	6357	*/
2283	6358	private function pattern_near( $content, $regex_a, $regex_b, $window ) {
2284		- if ( ! preg_match_all( $regex_a, $content, $m_a, PREG_OFFSET_CAPTURE ) ) {
	6359	+ // Both lists come in order, so they are walked together: the match
	6360	+ // that is behind moves on, and no pair is compared twice. Every match
	6361	+ // of one used to be compared with every match of the other.
	6362	+ $a = $this->next_match( $regex_a, $content, 0 );
	6363	+ $b = $this->next_match( $regex_b, $content, 0 );
	6364	+
	6365	+ while ( null !== $a && null !== $b ) {
	6366	+ if ( abs( $a[0][1] - $b[0][1] ) <= $window ) {
	6367	+ return true;
	6368	+ }
	6369	+
	6370	+ if ( $a[0][1] < $b[0][1] ) {
	6371	+ $a = $this->next_match( $regex_a, $content, $a[0][1] + 1 );
	6372	+ } else {
	6373	+ $b = $this->next_match( $regex_b, $content, $b[0][1] + 1 );
	6374	+ }
	6375	+ }
	6376	+
	6377	+ return false;
	6378	+ }
	6379	+
	6380	+ /**
	6381	+ * A text with its capital letters from A to Z in lower case, and nothing else
	6382	+ *
	6383	+ * strtolower() follows the language of the server until PHP 8.2, and in
	6384	+ * Turkish a capital I does not become an i: a function name written in
	6385	+ * capitals would not be found there.
	6386	+ *
	6387	+ * @param string $text Text.
	6388	+ * @return string
	6389	+ */
	6390	+ private static function lower_ascii( $text ) {
	6391	+ return strtr( (string) $text, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz' );
	6392	+ }
	6393	+
	6394	+ /**
	6395	+ * Whether an expression matches, without taking a search that gave up for a "no"
	6396	+ *
	6397	+ * preg_match() answers false, and not 0, when PCRE stops before the end
	6398	+ * because a long run used up the stack of its compiler or its
	6399	+ * backtracking limit. Read as "nothing found", that is a file that passes
	6400	+ * as clean without having been searched. Measured on what was published
	6401	+ * until now: a hexadecimal string of some 12,000 characters made the
	6402	+ * expression that looks for hexadecimal strings give up. Every expression
	6403	+ * of the search goes through here or through next_match(), and a file on
	6404	+ * which one of them gave up is reported as not searched (search_file()).
	6405	+ *
	6406	+ * @param string $regex Expression, with delimiters and flags.
	6407	+ * @param string $content Text to search.
	6408	+ * @return bool
	6409	+ */
	6410	+ private function found( $regex, $content ) {
	6411	+ $result = preg_match( $regex, $content );
	6412	+
	6413	+ if ( false === $result ) {
	6414	+ $this->search_failed = true;
	6415	+ }
	6416	+
	6417	+ return 1 === $result;
	6418	+ }
	6419	+
	6420	+ /**
	6421	+ * The next match of an expression from a position on
	6422	+ *
	6423	+ * For the checks that walk every match. Asked for one at a time they take
	6424	+ * no memory to speak of, where preg_match_all() held every match of the
	6425	+ * file at once.
	6426	+ *
	6427	+ * @param string $regex Expression, with delimiters and flags.
	6428	+ * @param string $content Text to search.
	6429	+ * @param int $offset Where to start.
	6430	+ * @return array|null The match as PREG_OFFSET_CAPTURE gives it, or null.
	6431	+ */
	6432	+ private function next_match( $regex, $content, $offset ) {
	6433	+ $match = array();
	6434	+ $result = preg_match( $regex, $content, $match, PREG_OFFSET_CAPTURE, $offset );
	6435	+
	6436	+ if ( false === $result ) {
	6437	+ $this->search_failed = true;
	6438	+ }
	6439	+
	6440	+ return 1 === $result ? $match : null;
	6441	+ }
	6442	+
	6443	+ /**
	6444	+ * Whether an expression matches in the code of a file and not only in its comments
	6445	+ *
	6446	+ * @param string $regex Expression, with delimiters and flags.
	6447	+ * @param string $content File content.
	6448	+ * @param string|false|null $code The content with its comments blanked. Worked
	6449	+ * out here the first time it is needed and kept
	6450	+ * by the caller; false when it cannot be.
	6451	+ * @return bool
	6452	+ */
	6453	+ private function found_in_code( $regex, $content, &$code ) {
	6454	+ if ( ! $this->found( $regex, $content ) ) {
2285	6455	return false;
2286	6456	}
2287		- if ( ! preg_match_all( $regex_b, $content, $m_b, PREG_OFFSET_CAPTURE ) ) {
	6457	+
	6458	+ if ( null === $code ) {
	6459	+ $code = $this->blank_comments( $content );
	6460	+ }
	6461	+
	6462	+ // When PHP cannot be asked what is a comment, the match stands.
	6463	+ return false === $code || $this->found( $regex, $code );
	6464	+ }
	6465	+
	6466	+ /**
	6467	+ * The content of a PHP file with its comments turned into blank space
	6468	+ *
	6469	+ * PHP itself says what is a comment (token_get_all()), so nothing that
	6470	+ * runs can be taken for one: a "//" comment ends at "?>", a string that
	6471	+ * holds "/*" opens nothing, and so on, without a second reader of the
	6472	+ * language here to get any of it wrong. Each comment is replaced by as
	6473	+ * many spaces as it had characters, line breaks kept, so the result is as
	6474	+ * long as the original and what was on one line stays on one line.
	6475	+ *
	6476	+ * Three cases are left as they are, and then the match stands:
	6477	+ *
	6478	+ * - A file with a "<?" that is not "<?php" or "<?=". Whether PHP reads
	6479	+ * that as an opening tag depends on short_open_tag, which may not be
	6480	+ * set the same for the PHP that runs this scan as for the one that
	6481	+ * serves the site, and with it changes where the code starts and so
	6482	+ * what is a comment.
	6483	+ * - A comment that starts with "#[". PHP 8 reads that as an attribute and
	6484	+ * runs what follows it on the line; PHP 7 reads the whole line as a
	6485	+ * comment.
	6486	+ * - A file whose tokens would not fit in the memory that is left, or
	6487	+ * would take more than 64 MB. PHP returns one array per token, up to
	6488	+ * 450 bytes each, and a file can be written so that every byte is one:
	6489	+ * 400 KB of that took 180 MB with PHP 7.4 (measured). How many tokens
	6490	+ * there can be is counted first, without making them.
	6491	+ * - Any file, when PHP is set to read its source in another encoding
	6492	+ * (zend.multibyte). In Shift JIS, Big5 or GBK the second byte of a
	6493	+ * character can be a backslash, so where a string ends is not where
	6494	+ * it ends for a reader that goes byte by byte.
	6495	+ *
	6496	+ * @param string $content File content.
	6497	+ * @return string|false The content without its comments, or false when it
	6498	+ * cannot be told what is a comment.
	6499	+ */
	6500	+ private function blank_comments( $content ) {
	6501	+ if ( ! function_exists( 'token_get_all' ) || ini_get( 'zend.multibyte' ) || preg_match( '/<\?(?!php[ \t\r\n]|=)/i', $content ) ) {
2288	6502	return false;
2289	6503	}
2290		- foreach ( $m_a[0] as $a ) {
2291		- foreach ( $m_b[0] as $b ) {
2292		- if ( abs( $a[1] - $b[1] ) <= $window ) {
2293		- return true;
2294		- }
	6504	+
	6505	+ // No more tokens than this: each character that is not part of a
	6506	+ // word can be one, and so can each run of digits and each word.
	6507	+ $words = 0;
	6508	+ $others = preg_replace( '/[a-z_\x80-\xff][a-z0-9_\x80-\xff]*+|[0-9]++/i', '', $content, -1, $words );
	6509	+
	6510	+ if ( null === $others ) {
	6511	+ return false;
	6512	+ }
	6513	+
	6514	+ $needed = 450 * ( strlen( $others ) + $words + 2 ) + strlen( $content );
	6515	+ $limit = wp_convert_hr_to_bytes( ini_get( 'memory_limit' ) );
	6516	+ unset( $others );
	6517	+
	6518	+ if ( $needed > 64 * MB_IN_BYTES || ( $limit > 0 && ( $limit - memory_get_usage() ) < $needed ) ) {
	6519	+ return false;
	6520	+ }
	6521	+
	6522	+ $tokens = @token_get_all( $content ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- PHP 7 warns about what it cannot read in the file being scanned, such as a comment left open; the warning says nothing about this code.
	6523	+ $code = '';
	6524	+ $length = 0;
	6525	+
	6526	+ foreach ( $tokens as $token ) {
	6527	+ $text = is_array( $token ) ? $token[1] : $token;
	6528	+ $length += strlen( $text );
	6529	+
	6530	+ if ( is_array( $token ) && ( T_COMMENT === $token[0] || T_DOC_COMMENT === $token[0] ) && 0 !== strpos( $text, '#[' ) ) {
	6531	+ $text = preg_replace( '/[^\n]/', ' ', $text );
2295	6532	}
	6533	+
	6534	+ $code .= $text;
2296	6535	}
2297		- return false;
	6536	+
	6537	+ // The pieces have to add up to the file. If they do not, the
	6538	+ // positions cannot be trusted and neither can the result.
	6539	+ if ( strlen( $content ) !== $length || strlen( $code ) !== $length ) {
	6540	+ return false;
	6541	+ }
	6542	+
	6543	+ return $code;
2298	6544	}
2299	6545
2300	6546	/**
	6547	+ * Search one file for hidden code
	6548	+ *
	6549	+ * The one place where a file is read for that. Each scan used to read it
	6550	+ * by itself, and only when it was under 512,000 bytes: a larger file was
	6551	+ * not opened, and where the file was not going to be listed anyway (a
	6552	+ * plugin or a theme with no official copy) that was the same as calling
	6553	+ * it clean. Padding a file was enough to keep it out of the results.
	6554	+ *
	6555	+ * @param string $file_path Absolute path.
	6556	+ * @param bool $strict Use strict mode (see detect_suspicious_pattern()).
	6557	+ * @return string|false|null The pattern found, false when the file was
	6558	+ * searched and has none, or null when it could
	6559	+ * not be searched: it is larger than
	6560	+ * MAX_SEARCHED_BYTES, it cannot be read, or an
	6561	+ * expression gave up on it. The caller reports
	6562	+ * that instead of taking it for clean.
	6563	+ */
	6564	+ private function search_file( $file_path, $strict = false ) {
	6565	+ if ( ! is_file( $file_path ) || ! is_readable( $file_path ) ) {
	6566	+ return null;
	6567	+ }
	6568	+
	6569	+ $size = filesize( $file_path );
	6570	+
	6571	+ if ( false === $size || $size > self::MAX_SEARCHED_BYTES ) {
	6572	+ return null;
	6573	+ }
	6574	+
	6575	+ // One byte past the cap and no more, whatever the size said: a file
	6576	+ // that grew since it was measured is not read whole.
	6577	+ $content = file_get_contents( $file_path, false, null, 0, self::MAX_SEARCHED_BYTES + 1 ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look for hidden code; nothing is written.
	6578	+
	6579	+ if ( false === $content || strlen( $content ) > self::MAX_SEARCHED_BYTES ) {
	6580	+ return null;
	6581	+ }
	6582	+
	6583	+ $this->search_failed = false;
	6584	+ $pattern = $this->detect_suspicious_pattern( $content, $strict );
	6585	+
	6586	+ if ( $pattern ) {
	6587	+ return $pattern;
	6588	+ }
	6589	+
	6590	+ return $this->search_failed ? null : false;
	6591	+ }
	6592	+
	6593	+ /**
	6594	+ * The finding for a PHP file with no official copy that could not be searched
	6595	+ *
	6596	+ * @param string $file_path Absolute path.
	6597	+ * @param string $relative Path for display.
	6598	+ * @return array
	6599	+ */
	6600	+ private function not_searched_item( $file_path, $relative ) {
	6601	+ $size = is_file( $file_path ) ? filesize( $file_path ) : false;
	6602	+ $reason = __( 'PHP file that could not be searched for hidden code', 'vigilante' );
	6603	+
	6604	+ if ( false !== $size && $size > self::MAX_SEARCHED_BYTES ) {
	6605	+ /* translators: %s: File size, such as 12 MB */
	6606	+ $reason = sprintf( __( 'PHP file of %s, too large to be searched for hidden code', 'vigilante' ), size_format( $size ) );
	6607	+ }
	6608	+
	6609	+ return array(
	6610	+ 'file' => $relative,
	6611	+ 'type' => 'not_searched',
	6612	+ 'reason' => $reason,
	6613	+ );
	6614	+ }
	6615	+
	6616	+ /**
2301	6617	* Whether a file is a text file worth normalizing before the fallback hash
2302	6618	* comparison in hash_matches_published().
2303	6619	*
2304	6620	* @param string $file_path Absolute path.
		@@ -2382,14 +6698,22 @@
2382	6698	private function detect_extra_files( $directory, $checksums, $type, $name, $suspicious_only = false ) {
2383	6699	$found = array(
2384	6700	'suspicious' => array(),
2385	6701	'extra' => array(),
	6702	+ 'errors' => array(),
	6703	+ 'php_files' => 0,
2386	6704	);
2387		- $max_extra = 50; // Limit to prevent timeout on large plugins
2388		- $count = 0;
	6705	+ // Every PHP file is examined. Until now the walk stopped after 50, which
	6706	+ // in a plugin or theme with no official copy meant the first 50 files
	6707	+ // of the folder and nothing else. Only the list of plain extra files is
	6708	+ // bounded, so a folder full of generated PHP cannot fill the results;
	6709	+ // hidden code is reported wherever it is.
	6710	+ $max_listed = 500;
	6711	+ $listed = 0;
	6712	+ $truncated = false;
2389	6713
2390	6714	// Only check PHP files for performance
2391		- $php_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar' );
	6715	+ $php_extensions = self::php_extensions();
2392	6716
2393	6717	// Pre-normalize the checksum keys once so path-shape differences
2394	6718	// (Windows backslashes, a leading "./", doubled slashes) don't make a
2395	6719	// known file look "extra" and get scanned or flagged. Case is preserved.
		@@ -2398,21 +6722,39 @@
2398	6722	$known_normalized[ $this->normalize_rel_path( $known_file ) ] = true;
2399	6723	}
2400	6724
2401	6725	try {
2402		- $iterator = new RecursiveIteratorIterator(
2403		- new RecursiveDirectoryIterator( $directory, RecursiveDirectoryIterator::SKIP_DOTS ),
2404		- RecursiveIteratorIterator::LEAVES_ONLY
2405		- );
2406		-
2407		- foreach ( $iterator as $file ) {
2408		- if ( $this->is_time_exceeded() || $count >= $max_extra ) {
	6726	+ foreach ( self::walk_folder( $directory ) as $file ) {
	6727	+ if ( $this->is_time_exceeded() ) {
2409	6728	break;
2410	6729	}
2411	6730
2412	6731	$file_path = $file->getPathname();
	6732	+
	6733	+ if ( $file->isDir() ) {
	6734	+ if ( ! $file->isReadable() ) {
	6735	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	6736	+ }
	6737	+ continue;
	6738	+ }
	6739	+
2413	6740	$extension = strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) );
2414	6741
	6742	+ // A .htaccess, .user.ini or php.ini that is not part of the
	6743	+ // published copy is looked at for what it makes the server do.
	6744	+ if ( in_array( strtolower( basename( $file_path ) ), array( '.htaccess', '.user.ini', 'php.ini' ), true ) ) {
	6745	+ $config_path = $this->normalize_rel_path( str_replace( str_replace( '\\', '/', $directory ) . '/', '', str_replace( '\\', '/', $file_path ) ) );
	6746	+
	6747	+ if ( ! isset( $known_normalized[ $config_path ] ) && ! $this->is_path_excluded( $file_path ) ) {
	6748	+ $config = self::server_config_finding( $file_path, str_replace( ABSPATH, '', $file_path ) );
	6749	+
	6750	+ if ( $config ) {
	6751	+ $found[ $config['category'] ][] = $config['item'];
	6752	+ }
	6753	+ }
	6754	+ continue;
	6755	+ }
	6756	+
2415	6757	// Only check PHP files
2416	6758	if ( ! in_array( $extension, $php_extensions, true ) ) {
2417	6759	continue;
2418	6760	}
		@@ -2440,18 +6782,15 @@
2440	6782	if ( $this->is_silence_golden_file( $file_path ) ) {
2441	6783	continue;
2442	6784	}
2443	6785
2444		- $count++;
	6786	+ $found['php_files']++;
	6787	+
2445	6788	$relative = str_replace( ABSPATH, '', $file_path );
2446		- $pattern = false;
2447	6789
2448	6790	// Check for suspicious content in extra files
2449	6791	// Use strict mode for plugins without checksums to avoid false positives
2450		- if ( $file->getSize() < 512000 ) { // Only scan files < 500KB
2451		- $content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
2452		- $pattern = $this->detect_suspicious_pattern( $content, $suspicious_only );
2453		- }
	6792	+ $pattern = $this->search_file( $file_path, $suspicious_only );
2454	6793
2455	6794	$item = array(
2456	6795	'file' => $relative,
2457	6796	$type => $name,
		@@ -2459,21 +6798,49 @@
2459	6798
2460	6799	if ( $pattern ) {
2461	6800	// Suspicious content: promote to suspicious category
2462	6801	$item['type'] = 'suspicious_' . $type;
2463		- /* translators: 1: Plugin or theme name, 2: Suspicious pattern found */
2464		- $item['reason'] = sprintf( __( 'Injected file in %1$s with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6802	+
	6803	+ // With an official copy to compare with, the file is known
	6804	+ // not to belong to it. Without one it may well be the
	6805	+ // plugin's own, so it is not called injected.
	6806	+ if ( $suspicious_only ) {
	6807	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	6808	+ $item['reason'] = sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6809	+ } else {
	6810	+ /* translators: 1: Plugin or theme name, 2: Suspicious pattern found */
	6811	+ $item['reason'] = sprintf( __( 'File that is not part of %1$s, with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6812	+ }
	6813	+
2465	6814	$found['suspicious'][] = $item;
2466	6815	} elseif ( ! $suspicious_only ) {
2467	6816	// No suspicious patterns and checksums available: report as extra
2468	6817	// Skipped in suspicious_only mode (no checksums) to avoid noise
	6818	+ if ( $listed >= $max_listed ) {
	6819	+ if ( ! $truncated ) {
	6820	+ $truncated = true;
	6821	+ $found['errors'][] = sprintf(
	6822	+ /* translators: 1: Plugin or theme name, 2: Number of files */
	6823	+ __( '%1$s has more extra files than can be listed: only the first %2$d are shown.', 'vigilante' ),
	6824	+ $name,
	6825	+ $max_listed
	6826	+ );
	6827	+ }
	6828	+ continue;
	6829	+ }
	6830	+
	6831	+ $listed++;
2469	6832	$item['type'] = 'extra_' . $type;
2470	6833	$item['reason'] = __( 'PHP file not present in original distribution', 'vigilante' );
2471	6834	$found['extra'][] = $item;
	6835	+ } elseif ( null === $pattern ) {
	6836	+ // No official copy to compare with, and the search could
	6837	+ // not look inside either: said, not passed over.
	6838	+ $found['extra'][] = $this->not_searched_item( $file_path, $relative );
2472	6839	}
2473	6840	}
2474	6841	} catch ( Exception $e ) {
2475		- // Ignore iterator errors
	6842	+ $found['errors'][] = self::unreadable_folder_error( $directory );
2476	6843	}
2477	6844
2478	6845	return $found;
2479	6846	}
		@@ -2506,9 +6873,14 @@
2506	6873	if ( false === $content ) {
2507	6874	return false;
2508	6875	}
2509	6876
2510		- $normalized = strtolower( trim( str_replace( array( "\r\n", "\r" ), "\n", $content ) ) );
	6877	+ // Every run of whitespace counts as one space, so the placeholder
	6878	+ // WordPress itself ships (the opening tag, a line break and the comment)
	6879	+ // matches the same entries as the one-line form. The comparison is
	6880	+ // still against the whole file: nothing can follow these few words, and
	6881	+ // no arrangement of them on several lines is code that runs.
	6882	+ $normalized = strtolower( trim( preg_replace( '/\s+/', ' ', $content ) ) );
2511	6883
2512	6884	$known = array(
2513	6885	'',
2514	6886	'<?php',
		@@ -2521,8 +6893,391 @@
2521	6893	return in_array( $normalized, $known, true );
2522	6894	}
2523	6895
2524	6896	/**
	6897	+ * Folders of the installation that hold plugins or themes
	6898	+ *
	6899	+ * @return array Relative path => true, for the plugins folder and every
	6900	+ * theme root that lies inside the WordPress directory.
	6901	+ */
	6902	+ private function code_roots() {
	6903	+ global $wp_theme_directories;
	6904	+
	6905	+ $roots = array();
	6906	+
	6907	+ foreach ( array_merge( array( WP_PLUGIN_DIR, get_theme_root() ), is_array( $wp_theme_directories ) ? $wp_theme_directories : array() ) as $root ) {
	6908	+ $root = untrailingslashit( str_replace( '\\', '/', (string) $root ) );
	6909	+
	6910	+ if ( '' !== $root && 0 === strpos( $root . '/', str_replace( '\\', '/', ABSPATH ) ) ) {
	6911	+ $roots[ $this->relative_path( $root ) ] = true;
	6912	+ }
	6913	+ }
	6914	+
	6915	+ return $roots;
	6916	+ }
	6917	+
	6918	+ /**
	6919	+ * What a partial scan offers to exclude, so that the next one reaches the rest
	6920	+ *
	6921	+ * The folders of the plugins and themes the scan did check, as lines for
	6922	+ * Excluded Paths, less the ones that are excluded by now. A scan starts
	6923	+ * from the beginning every time, so with these out of the way a scan
	6924	+ * run by hand spends its time on what the last one never got to. They
	6925	+ * have to come out of the list afterwards, and the tab says so for as
	6926	+ * long as they are there (see excluded_code_folders()).
	6927	+ *
	6928	+ * The list comes from stored results, and whoever reads it is told to
	6929	+ * paste it into the exclusions, so only what can be the folder of a
	6930	+ * plugin or of a theme is let through: one line with anything else in it
	6931	+ * would exclude far more than it says.
	6932	+ *
	6933	+ * @param mixed $results Scan results, as run_scan() returns them.
	6934	+ * @return array Relative paths, one per folder.
	6935	+ */
	6936	+ public function folders_to_exclude( $results ) {
	6937	+ $stored = is_array( $results ) && isset( $results['checked_folders'] ) && is_array( $results['checked_folders'] ) ? $results['checked_folders'] : array();
	6938	+ $roots = $this->code_roots();
	6939	+ $lines = array();
	6940	+
	6941	+ foreach ( $stored as $folder ) {
	6942	+ if ( ! is_string( $folder ) || 1 === preg_match( '/[\\x00-\\x1f\\x7f]/', $folder ) ) {
	6943	+ continue;
	6944	+ }
	6945	+
	6946	+ $folder = trim( str_replace( '\\', '/', $folder ), '/' );
	6947	+ $name = basename( $folder );
	6948	+
	6949	+ if ( '' === $name || '.' === $name || '..' === $name || ! isset( $roots[ dirname( $folder ) ] ) ) {
	6950	+ continue;
	6951	+ }
	6952	+
	6953	+ if ( ! is_dir( ABSPATH . $folder ) || $this->is_path_excluded( ABSPATH . $folder . '/.' ) ) {
	6954	+ continue;
	6955	+ }
	6956	+
	6957	+ $lines[ $folder ] = true;
	6958	+ }
	6959	+
	6960	+ return array_keys( $lines );
	6961	+ }
	6962	+
	6963	+ /**
	6964	+ * Whole folders of code, or the uploads folder, that Excluded Paths keeps out of every scan
	6965	+ *
	6966	+ * A subfolder of uploads or of a plugin is an ordinary exclusion (a cache
	6967	+ * of compiled templates, say). A whole plugin, a whole theme, the
	6968	+ * must-use plugins or all of uploads is something else: the scan comes
	6969	+ * out complete and clean without having looked there. The tab and
	6970	+ * Security Check go by this list, so that nobody is left thinking those
	6971	+ * folders are being watched.
	6972	+ *
	6973	+ * @return array Relative paths. A folder that holds others (the plugins
	6974	+ * folder, a theme root) stands for all of them.
	6975	+ */
	6976	+ public function excluded_code_folders() {
	6977	+ if ( empty( $this->options['excluded_paths'] ) || ! is_array( $this->options['excluded_paths'] ) ) {
	6978	+ return array();
	6979	+ }
	6980	+
	6981	+ if ( ! function_exists( 'get_plugins' ) ) {
	6982	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	6983	+ }
	6984	+
	6985	+ $found = array();
	6986	+ $roots = array_keys( $this->code_roots() );
	6987	+
	6988	+ foreach ( $roots as $root ) {
	6989	+ if ( $this->is_path_excluded( ABSPATH . $root . '/.' ) ) {
	6990	+ $found[ $root ] = true;
	6991	+ }
	6992	+ }
	6993	+
	6994	+ $plugins_root = $this->relative_path( WP_PLUGIN_DIR );
	6995	+
	6996	+ if ( ! isset( $found[ $plugins_root ] ) ) {
	6997	+ foreach ( array_keys( get_plugins() ) as $plugin_file ) {
	6998	+ $slug = dirname( $plugin_file );
	6999	+
	7000	+ if ( '.' !== $slug && $this->is_path_excluded( WP_PLUGIN_DIR . '/' . $slug . '/.' ) ) {
	7001	+ $found[ $this->relative_path( WP_PLUGIN_DIR . '/' . $slug ) ] = true;
	7002	+ }
	7003	+ }
	7004	+ }
	7005	+
	7006	+ foreach ( wp_get_themes() as $theme ) {
	7007	+ $dir = $theme->get_stylesheet_directory();
	7008	+
	7009	+ if ( ! isset( $found[ $this->relative_path( dirname( $dir ) ) ] ) && $this->is_path_excluded( $dir . '/.' ) ) {
	7010	+ $found[ $this->relative_path( $dir ) ] = true;
	7011	+ }
	7012	+ }
	7013	+
	7014	+ if ( defined( 'WPMU_PLUGIN_DIR' ) && is_dir( WPMU_PLUGIN_DIR ) && $this->is_path_excluded( WPMU_PLUGIN_DIR . '/.' ) ) {
	7015	+ $found[ $this->relative_path( WPMU_PLUGIN_DIR ) ] = true;
	7016	+ }
	7017	+
	7018	+ $uploads = wp_get_upload_dir();
	7019	+
	7020	+ if ( ! empty( $uploads['basedir'] ) && $this->is_path_excluded( $uploads['basedir'] . '/.' ) ) {
	7021	+ $found[ $this->relative_path( $uploads['basedir'] ) ] = true;
	7022	+ }
	7023	+
	7024	+ return array_keys( $found );
	7025	+ }
	7026	+
	7027	+ /**
	7028	+ * Whether a scan checked less than it was asked to
	7029	+ *
	7030	+ * Either it ran out of time, or something could not be read or compared
	7031	+ * (a folder, a plugin whose copy on WordPress.org could not be fetched).
	7032	+ * The tab, the scan email and Security Check go by this, so none of them
	7033	+ * calls clean a result that covers only part of the site.
	7034	+ *
	7035	+ * @param mixed $results Scan results, as run_scan() returns them.
	7036	+ * @return bool
	7037	+ */
	7038	+ public static function is_partial( $results ) {
	7039	+ return is_array( $results ) && ( ! empty( $results['incomplete'] ) || ! empty( $results['errors'] ) );
	7040	+ }
	7041	+
	7042	+ /**
	7043	+ * What a scan did not get to, one line per thing
	7044	+ *
	7045	+ * The one source of that text, for the tab, the scan email and anything
	7046	+ * else that shows the result of a scan. In the order of the scan.
	7047	+ *
	7048	+ * @param mixed $results Scan results, as run_scan() returns them.
	7049	+ * @return array Lines ready to show, not escaped. Empty when nothing was
	7050	+ * left out.
	7051	+ */
	7052	+ public static function not_checked_lines( $results ) {
	7053	+ $left = is_array( $results ) && isset( $results['not_checked'] ) && is_array( $results['not_checked'] ) ? $results['not_checked'] : array();
	7054	+
	7055	+ $areas = isset( $left['areas'] ) && is_array( $left['areas'] ) ? $left['areas'] : array();
	7056	+ $plugins = isset( $left['plugins'] ) && is_array( $left['plugins'] ) ? array_filter( array_map( 'strval', $left['plugins'] ), 'strlen' ) : array();
	7057	+ $themes = isset( $left['themes'] ) && is_array( $left['themes'] ) ? array_filter( array_map( 'strval', $left['themes'] ), 'strlen' ) : array();
	7058	+ $lines = array();
	7059	+
	7060	+ if ( in_array( 'uploads', $areas, true ) ) {
	7061	+ $lines[] = __( 'The uploads folder was not checked.', 'vigilante' );
	7062	+ }
	7063	+
	7064	+ if ( in_array( 'core', $areas, true ) ) {
	7065	+ $lines[] = __( 'The WordPress files were not checked completely.', 'vigilante' );
	7066	+ }
	7067	+
	7068	+ if ( in_array( 'config', $areas, true ) ) {
	7069	+ $lines[] = __( 'wp-config.php and .htaccess were not compared.', 'vigilante' );
	7070	+ }
	7071	+
	7072	+ if ( in_array( 'content', $areas, true ) ) {
	7073	+ $lines[] = __( 'The other folders of wp-content were not checked.', 'vigilante' );
	7074	+ }
	7075	+
	7076	+ if ( in_array( 'plugins', $areas, true ) ) {
	7077	+ $lines[] = __( 'No plugin was checked.', 'vigilante' );
	7078	+ } elseif ( ! empty( $plugins ) ) {
	7079	+ /* translators: %s: Comma separated list of plugin names */
	7080	+ $lines[] = sprintf( __( 'Plugins not checked: %s.', 'vigilante' ), implode( ', ', $plugins ) );
	7081	+ }
	7082	+
	7083	+ if ( in_array( 'unlisted', $areas, true ) ) {
	7084	+ $lines[] = __( 'Must-use plugins, drop-ins and loose PHP files were not checked.', 'vigilante' );
	7085	+ }
	7086	+
	7087	+ if ( in_array( 'themes', $areas, true ) ) {
	7088	+ $lines[] = __( 'No theme was checked.', 'vigilante' );
	7089	+ } elseif ( ! empty( $themes ) ) {
	7090	+ /* translators: %s: Comma separated list of theme names */
	7091	+ $lines[] = sprintf( __( 'Themes not checked: %s.', 'vigilante' ), implode( ', ', $themes ) );
	7092	+ }
	7093	+
	7094	+ return $lines;
	7095	+ }
	7096	+
	7097	+ /**
	7098	+ * Whether the scheduled scan has not finished for longer than it should
	7099	+ *
	7100	+ * A scan that PHP or the server stops halfway stores nothing, so the date
	7101	+ * of the last one that finished is the only sign left. Twice the interval
	7102	+ * and one day more, because WP-Cron only runs when the site has a visit.
	7103	+ *
	7104	+ * @param int $last_scan Time of the last stored scan, 0 for none.
	7105	+ * @param string $frequency 'daily' or 'weekly'.
	7106	+ * @return bool
	7107	+ */
	7108	+ public static function is_scan_overdue( $last_scan, $frequency ) {
	7109	+ $last_scan = (int) $last_scan;
	7110	+
	7111	+ if ( $last_scan <= 0 ) {
	7112	+ return false;
	7113	+ }
	7114	+
	7115	+ $every = 'weekly' === $frequency ? WEEK_IN_SECONDS : DAY_IN_SECONDS;
	7116	+
	7117	+ return ( time() - $last_scan ) > ( 2 * $every + DAY_IN_SECONDS );
	7118	+ }
	7119	+
	7120	+ /**
	7121	+ * What a kind of finding usually is, and what to do about it
	7122	+ *
	7123	+ * The one source of the text shown next to the findings of a scan, so the
	7124	+ * File Integrity tab and anything else that explains them say the same.
	7125	+ * Vigilant's own files have their own source,
	7126	+ * Vigilante_Self_Integrity_Guidance.
	7127	+ *
	7128	+ * @param string $type Finding type as stored in the scan results.
	7129	+ * @return array {
	7130	+ * @type string $label Name of the kind of finding, for a table cell.
	7131	+ * @type string $advice What it usually is and what to do. Empty for a
	7132	+ * type this method does not know.
	7133	+ * }
	7134	+ */
	7135	+ public static function finding_guidance( $type ) {
	7136	+ switch ( $type ) {
	7137	+ case 'php_in_uploads':
	7138	+ return array(
	7139	+ 'label' => __( 'PHP in uploads', 'vigilante' ),
	7140	+ 'advice' => __( 'Uploads is meant for media, not for code. It is normal only when a plugin you use writes PHP there, such as compiled templates or cache files: ignore the file, or add its folder to Excluded Paths if new ones keep appearing. If nothing you use explains it, treat it as malware.', 'vigilante' ),
	7141	+ );
	7142	+
	7143	+ case 'double_extension':
	7144	+ return array(
	7145	+ 'label' => __( 'Double extension', 'vigilante' ),
	7146	+ 'advice' => __( 'A name such as photo.php.jpg is a common way to pass a script off as an image. Delete it unless you know who or what uploaded it.', 'vigilante' ),
	7147	+ );
	7148	+
	7149	+ case 'htaccess_in_uploads':
	7150	+ return array(
	7151	+ 'label' => __( '.htaccess in uploads', 'vigilante' ),
	7152	+ 'advice' => __( 'A .htaccess here changes how the server treats this folder. One that only denies access is not listed. If it makes files run as code (AddHandler, SetHandler, php_value, Options ExecCGI) and you did not put it there, it is a sign of infection. If it only has rewrite rules, it usually belongs to an image or cache plugin, and it switches off for this folder the rule that blocks PHP in uploads.', 'vigilante' ),
	7153	+ );
	7154	+
	7155	+ case 'php_in_root':
	7156	+ return array(
	7157	+ 'label' => __( 'PHP in the site root', 'vigilante' ),
	7158	+ 'advice' => __( 'A PHP file next to wp-config.php that WordPress does not ship. Hosting tools, firewalls and verification scripts put files here, and so do attackers. Ignore it if you know where it comes from; if you do not, look at what it contains before anything else.', 'vigilante' ),
	7159	+ );
	7160	+
	7161	+ case 'extra_root':
	7162	+ return array(
	7163	+ 'label' => __( 'Extra file in the site root', 'vigilante' ),
	7164	+ 'advice' => __( 'WordPress does not ship this file. Verification files and the like are harmless. A copy of wp-config.php, a database dump or a backup archive here can be downloaded by anyone who guesses its name: move it out of the web root.', 'vigilante' ),
	7165	+ );
	7166	+
	7167	+ case 'legacy_core':
	7168	+ return array(
	7169	+ 'label' => __( 'Old core file', 'vigilante' ),
	7170	+ 'advice' => __( 'Left behind by an earlier version of WordPress. Nothing uses it any more and it can be deleted.', 'vigilante' ),
	7171	+ );
	7172	+
	7173	+ case 'suspicious_plugin':
	7174	+ case 'suspicious_theme':
	7175	+ return array(
	7176	+ 'label' => 'suspicious_theme' === $type ? __( 'Hidden code in a theme', 'vigilante' ) : __( 'Hidden code in a plugin', 'vigilante' ),
	7177	+ 'advice' => __( 'The file contains code written the way malware hides itself, and it is not part of the published copy, or there is no published copy to compare with. Some commercial plugins and themes obfuscate their own code and end up here. If you cannot tell, replace the plugin or theme with a clean copy from its author.', 'vigilante' ),
	7178	+ );
	7179	+
	7180	+ case 'extra_plugin':
	7181	+ case 'extra_theme':
	7182	+ return array(
	7183	+ 'label' => 'extra_theme' === $type ? __( 'Extra file in a theme', 'vigilante' ) : __( 'Extra file in a plugin', 'vigilante' ),
	7184	+ 'advice' => __( 'A PHP file that is not in the copy WordPress.org publishes for the installed version. Some plugins and themes create files after they are installed, and a manual fix adds them too. If you cannot explain it, reinstall the plugin or theme: that removes everything that does not belong to it.', 'vigilante' ),
	7185	+ );
	7186	+
	7187	+ case 'php_in_core':
	7188	+ return array(
	7189	+ 'label' => __( 'PHP in a WordPress folder', 'vigilante' ),
	7190	+ 'advice' => __( 'A PHP file in wp-admin or wp-includes that the installed version of WordPress does not ship. It is either left over from an older version or put there by someone: compare it with a clean copy of WordPress and delete it if it is not in it.', 'vigilante' ),
	7191	+ );
	7192	+
	7193	+ case 'config_in_core':
	7194	+ return array(
	7195	+ 'label' => __( 'Configuration file in a WordPress folder', 'vigilante' ),
	7196	+ 'advice' => __( 'A .htaccess, .user.ini or php.ini in wp-admin or wp-includes. A .htaccess that asks for a password in wp-admin is a common protection, and some hosts leave a php.ini there. A line with auto_prepend_file or auto_append_file loads a file on every request: make sure you know which one.', 'vigilante' ),
	7197	+ );
	7198	+
	7199	+ case 'php_config_in_uploads':
	7200	+ return array(
	7201	+ 'label' => __( 'PHP configuration in uploads', 'vigilante' ),
	7202	+ 'advice' => __( 'A .user.ini or php.ini here changes how PHP runs for this folder, and can make it load another file on every request. Nothing in uploads needs one: delete it unless you put it there.', 'vigilante' ),
	7203	+ );
	7204	+
	7205	+ case 'script_in_uploads':
	7206	+ return array(
	7207	+ 'label' => __( 'Script in uploads', 'vigilante' ),
	7208	+ 'advice' => __( 'A script in another language (shell, Perl, Python, CGI). It only runs if the server is told to run it, which a .htaccess in the same folder can do. Delete it unless you know why it is there.', 'vigilante' ),
	7209	+ );
	7210	+
	7211	+ case 'php_config_in_root':
	7212	+ return array(
	7213	+ 'label' => __( 'PHP configuration in the site root', 'vigilante' ),
	7214	+ 'advice' => __( 'This file makes PHP load another file before every request. Firewalls such as Wordfence set it up for themselves, and so do some hosts: check that the file it names is theirs. If nothing you installed needs it, that file runs before WordPress on every visit: treat it as a backdoor.', 'vigilante' ),
	7215	+ );
	7216	+
	7217	+ case 'backup_in_root':
	7218	+ return array(
	7219	+ 'label' => __( 'Backup in the site root', 'vigilante' ),
	7220	+ 'advice' => __( 'A copy of wp-config.php, a database dump or an archive next to WordPress can be downloaded by anyone who guesses its name, and it holds passwords or the whole site. Move it out of the web root or delete it.', 'vigilante' ),
	7221	+ );
	7222	+
	7223	+ case 'php_in_content':
	7224	+ return array(
	7225	+ 'label' => __( 'Loose PHP in wp-content', 'vigilante' ),
	7226	+ 'advice' => __( 'A PHP file, or a folder with PHP files, in wp-content or among the plugins or the themes, that WordPress does not list as a plugin, a theme or a drop-in. It does not show on the Plugins screen, and it can still be reached by its address. Some plugins keep a settings file there, WP Super Cache for one. If nothing you use explains it, look at what it contains.', 'vigilante' ),
	7227	+ );
	7228	+
	7229	+ case 'suspicious_content':
	7230	+ return array(
	7231	+ 'label' => __( 'Hidden code in wp-content', 'vigilante' ),
	7232	+ 'advice' => __( 'The file contains code written the way malware hides itself, in a folder of wp-content that belongs to no plugin and no theme. Cache, backup and security plugins keep files in folders like these, and what they store can look like this. Find out which one the folder belongs to. If nothing you use explains the file, treat it as malware.', 'vigilante' ),
	7233	+ );
	7234	+
	7235	+ case 'translation_with_code':
	7236	+ return array(
	7237	+ 'label' => __( 'Translation file with code', 'vigilante' ),
	7238	+ 'advice' => __( 'WordPress loads the translation files of the site language on every request, and a translation file holds text and nothing else. This one holds something more. Delete it and get the translations again from Dashboard > Updates. If it comes back, something on the site is writing it.', 'vigilante' ),
	7239	+ );
	7240	+
	7241	+ case 'not_searched':
	7242	+ return array(
	7243	+ 'label' => __( 'File not searched', 'vigilante' ),
	7244	+ 'advice' => __( 'The search for hidden code could not look inside this file, nearly always because it is very large, and there is no official copy to compare it with. A PHP file of that size is unusual. Check that it belongs to the plugin, the theme or the folder it is in, and ignore it if it does.', 'vigilante' ),
	7245	+ );
	7246	+
	7247	+ case 'server_config':
	7248	+ return array(
	7249	+ 'label' => __( 'Server configuration file', 'vigilante' ),
	7250	+ 'advice' => __( 'A .htaccess, .user.ini or php.ini outside uploads that makes the server run files as code or load a file on every request. Plugins rarely need one. If you cannot tell which one put it there, treat it as a sign of infection.', 'vigilante' ),
	7251	+ );
	7252	+
	7253	+ case 'core':
	7254	+ return array(
	7255	+ 'label' => __( 'WordPress core', 'vigilante' ),
	7256	+ 'advice' => __( 'Does not match the copy WordPress.org publishes for your version and language. For a file in wp-admin, wp-includes or the site root, reinstall WordPress from Dashboard > Updates and scan again. A file of a bundled theme or of Akismet, under wp-content, appears here after that theme or plugin updates on its own, which is normal.', 'vigilante' ),
	7257	+ );
	7258	+
	7259	+ case 'plugin':
	7260	+ case 'theme':
	7261	+ return array(
	7262	+ 'label' => 'theme' === $type ? __( 'Theme', 'vigilante' ) : __( 'Plugin', 'vigilante' ),
	7263	+ 'advice' => __( 'Does not match the copy WordPress.org publishes for the installed version. The usual causes are an update that did not finish, a release replaced on WordPress.org without a new version number, or a manual edit. Reinstall it; if the file changes again by itself, investigate.', 'vigilante' ),
	7264	+ );
	7265	+
	7266	+ case 'critical_config':
	7267	+ return array(
	7268	+ 'label' => __( 'Configuration file', 'vigilante' ),
	7269	+ 'advice' => __( 'Changed since you last approved it. Cache, security and redirection plugins rewrite their own blocks in these files, often on every update, and that shows up here too. Review the changes and approve them if they belong to something you use. Lines you cannot explain, above all the ones that load a file or send requests to one, need a closer look.', 'vigilante' ),
	7270	+ );
	7271	+ }
	7272	+
	7273	+ return array(
	7274	+ 'label' => (string) $type,
	7275	+ 'advice' => '',
	7276	+ );
	7277	+ }
	7278	+
	7279	+ /**
2525	7280	* Check if a path is excluded from scanning
2526	7281	*
2527	7282	* @param string $path File path.
2528	7283	* @return bool
		@@ -2672,8 +7427,39 @@
2672	7427	return array_values(
2673	7428	array_filter(
2674	7429	$items,
2675	7430	function ( $item ) {
	7431	+ /*
	7432	+ * On a network, wp-config.php and the root .htaccess are not a
	7433	+ * site's to silence: a change to them is closed by approving it,
	7434	+ * and approving takes a network administrator since 2.11.3. The
	7435	+ * ignore list is an option of each site, so until 2.11.8 the
	7436	+ * administrator of the main site without network rights hid a
	7437	+ * pending change from the network administrator's own screen by
	7438	+ * posting the file name to the ignore handler.
	7439	+ */
	7440	+ if ( is_multisite() && is_array( $item ) && 'critical_config' === ( $item['type'] ?? '' ) ) {
	7441	+ return true;
	7442	+ }
	7443	+
	7444	+ // Findings about the manifest and the version of Vigilant
	7445	+ // itself are not about one file, so no entry of the list may
	7446	+ // hide them, on a single site either: ignoring the row of
	7447	+ // MANIFEST.sha256 took a replaced manifest out of the email.
	7448	+ // Vigilante_Self_Integrity::filter_ignored_findings() keeps
	7449	+ // them the same way.
	7450	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) && in_array( $item['self_finding'] ?? '', array( 'manifest_replaced', 'manifest_unverified', 'manifest_missing', 'manifest_invalid', 'self_downgraded' ), true ) ) {
	7451	+ return true;
	7452	+ }
	7453	+ // Nor the findings of the walk of Vigilant's folder (a folder
	7454	+ // that cannot be listed, the folder that could not be walked):
	7455	+ // their path ends in a slash, and ignoring that row left the
	7456	+ // scan with no row and no email while the self-protection
	7457	+ // status stayed critical.
	7458	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) && '/' === substr( (string) ( $item['file'] ?? '' ), -1 ) ) {
	7459	+ return true;
	7460	+ }
	7461	+
2676	7462	$file = is_array( $item ) && isset( $item['file'] ) ? $item['file'] : '';
2677	7463	return ! in_array( $file, $this->ignored_files, true );
2678	7464	}
2679	7465	)
		@@ -2694,32 +7480,25 @@
2694	7480	*/
2695	7481	private function maybe_send_notification( $results ) {
2696	7482	$options = is_array( $this->options ) ? $this->options : array();
2697	7483
2698		- // Count critical_config separately from regular modified so we can treat it
2699		- // as "serious" for notification level purposes (same tier as suspicious/extra).
2700		- $has_critical_config = false;
2701		- foreach ( $results['modified'] ?? array() as $item ) {
2702		- if ( is_array( $item ) && isset( $item['type'] ) && 'critical_config' === $item['type'] ) {
2703		- $has_critical_config = true;
2704		- break;
2705		- }
2706		- }
2707		-
2708		- // Collect closed/removed plugins (excluding ignored slugs). These count
2709		- // as "serious" for notification purposes: a closed plugin in wp.org is
2710		- // a security-critical finding, same tier as a suspicious file.
	7484	+ // Closed/removed plugins (excluding ignored slugs) travel in this
	7485	+ // email, in the same tier as a suspicious file.
2711	7486	$closed_plugins = $this->collect_closed_plugins_for_email();
2712		- $has_closed = ! empty( $closed_plugins );
2713	7487
2714		- $has_suspicious = ! empty( $results['suspicious'] ) || ! empty( $results['extra'] ) || $has_critical_config || $has_closed;
2715		- $has_modified = ! empty( $results['modified'] );
	7488	+ /*
	7489	+ * Self-protection is not part of this decision. Its alert is its own
	7490	+ * and no setting switches it off, so this email is about the files of
	7491	+ * the site: core, plugins, themes, uploads and the two shared
	7492	+ * configuration files. Missing files do not send it on their own: it
	7493	+ * has no section to list them in.
	7494	+ */
2716	7495
2717		- // Instant alert: send for suspicious, extra, critical_config, modified
2718		- // files, or closed plugins.
2719		- $instant_alert = ! empty( $options['instant_alert'] );
2720		- if ( $instant_alert && ( $has_suspicious || $has_modified ) ) {
2721		- $this->send_notification( $results, 'all', $closed_plugins );
	7496	+ // Instant alert: every finding travels, modified files included,
	7497	+ // whatever the level below says. A scan with nothing to report goes
	7498	+ // through as well, so that what was reported is forgotten.
	7499	+ if ( ! empty( $options['instant_alert'] ) ) {
	7500	+ $this->send_new_findings( $results, 'all', $closed_plugins );
2722	7501	return;
2723	7502	}
2724	7503
2725	7504	// Determine notify level with backward compatibility
		@@ -2734,22 +7513,142 @@
2734	7513	}
2735	7514	}
2736	7515
2737	7516	if ( 'disabled' === $notify_level ) {
	7517	+ // Nothing is sent, and nothing stays on record as reported:
	7518	+ // whoever switches the email back on is told about everything
	7519	+ // that is pending then.
	7520	+ delete_option( self::NOTIFIED_OPTION );
2738	7521	return;
2739	7522	}
2740	7523
2741	7524	// 'suspicious_only' treats suspicious/extra, critical_config AND closed
2742		- // plugins as serious.
2743		- if ( 'suspicious_only' === $notify_level && ! $has_suspicious ) {
	7525	+ // plugins as serious. A scan with nothing to send at this level still
	7526	+ // goes through send_new_findings(), which then forgets what it had
	7527	+ // reported, so a finding that goes away and comes back is new again.
	7528	+ $this->send_new_findings( $results, $notify_level, $closed_plugins );
	7529	+ }
	7530	+
	7531	+ /**
	7532	+ * What the scan email has already reported to the recipients
	7533	+ */
	7534	+ const NOTIFIED_OPTION = 'vigilante_integrity_notified';
	7535	+
	7536	+ /**
	7537	+ * Send the scan email only when the scan found something new
	7538	+ *
	7539	+ * Until now the email went out after every scan for as long as a finding
	7540	+ * was still listed, so a plugin that rewrote its block in .htaccess meant
	7541	+ * the same alert every day until somebody approved the change. Now every
	7542	+ * finding is reported once: the email goes out when a scan finds something
	7543	+ * the recipients have not been told about, and it lists everything that is
	7544	+ * pending, old and new.
	7545	+ *
	7546	+ * A finding is the file, its kind and its content (by its hash), so a
	7547	+ * file that changes again under the same name is new, also when the
	7548	+ * change keeps its size and its date. What goes away is forgotten, so it
	7549	+ * is new again if it comes back. Nothing is recorded when the email could
	7550	+ * not be sent, and the next scan tries again.
	7551	+ *
	7552	+ * @param array $results Scan results.
	7553	+ * @param string $notify_level 'all' or 'suspicious_only'.
	7554	+ * @param array $closed_plugins Closed plugins, keyed by slug.
	7555	+ */
	7556	+ private function send_new_findings( $results, $notify_level, $closed_plugins ) {
	7557	+ $keys = $this->notification_keys( $results, $closed_plugins, 'all' === $notify_level );
	7558	+ $told = get_option( self::NOTIFIED_OPTION, array() );
	7559	+ $told = is_array( $told ) ? $told : array();
	7560	+
	7561	+ // A partial scan cannot tell whether what it did not reach is still
	7562	+ // there, so it forgets nothing: with the findings of an unchecked
	7563	+ // plugin forgotten, the next scan that reached it would report them
	7564	+ // again as new, and on a site whose scans are always partial that
	7565	+ // is the same email over and over.
	7566	+ $known = self::is_partial( $results ) ? array_values( array_unique( array_merge( $keys, $told ) ) ) : $keys;
	7567	+
	7568	+ // The record is bounded, and the comparison is not: what does not fit
	7569	+ // in the record is reported again, never left out. The keys come in
	7570	+ // order of importance, so what does not fit is the least of it.
	7571	+ $record = array_slice( $known, 0, 5000 );
	7572	+
	7573	+ if ( empty( array_diff( $keys, $told ) ) ) {
	7574	+ if ( count( $record ) !== count( $told ) ) {
	7575	+ update_option( self::NOTIFIED_OPTION, $record, false );
	7576	+ }
2744	7577	return;
2745	7578	}
2746	7579
2747		- if ( ! $has_suspicious && ! $has_modified ) {
2748		- return;
	7580	+ if ( $this->send_notification( $results, $notify_level, $closed_plugins ) ) {
	7581	+ update_option( self::NOTIFIED_OPTION, $record, false );
2749	7582	}
	7583	+ }
2750	7584
2751		- $this->send_notification( $results, $notify_level, $closed_plugins );
	7585	+ /**
	7586	+ * One key per finding the scan email would carry at this level
	7587	+ *
	7588	+ * @param array $results Scan results.
	7589	+ * @param array $closed_plugins Closed plugins, keyed by slug.
	7590	+ * @param bool $with_modified Whether files that are only modified travel
	7591	+ * in the email at this level.
	7592	+ * @return array
	7593	+ */
	7594	+ private function notification_keys( $results, $closed_plugins, $with_modified ) {
	7595	+ $keys = array(
	7596	+ 'config' => array(),
	7597	+ 'closed' => array(),
	7598	+ 'suspicious' => array(),
	7599	+ 'modified' => array(),
	7600	+ 'extra' => array(),
	7601	+ );
	7602	+
	7603	+ foreach ( (array) ( $results['modified'] ?? array() ) as $item ) {
	7604	+ if ( ! is_array( $item ) ) {
	7605	+ continue;
	7606	+ }
	7607	+
	7608	+ $type = (string) ( $item['type'] ?? '' );
	7609	+ $config = 'critical_config' === $type;
	7610	+
	7611	+ // Vigilant's own files have their own alert.
	7612	+ if ( 'vigilante_self' === $type || ( ! $config && ! $with_modified ) ) {
	7613	+ continue;
	7614	+ }
	7615	+
	7616	+ $keys[ $config ? 'config' : 'modified' ][] = md5( 'modified|' . $type . '|' . (string) ( $item['file'] ?? '' ) . '|' . (string) ( $item['actual_hash'] ?? '' ) );
	7617	+ }
	7618	+
	7619	+ foreach ( (array) $closed_plugins as $slug => $info ) {
	7620	+ $keys['closed'][] = md5( 'closed|' . $slug . '|' . ( is_array( $info ) ? (string) ( $info['state'] ?? '' ) : '' ) );
	7621	+ }
	7622	+
	7623	+ foreach ( array( 'suspicious', 'extra' ) as $bucket ) {
	7624	+ foreach ( (array) ( $results[ $bucket ] ?? array() ) as $item ) {
	7625	+ $type = is_array( $item ) ? (string) ( $item['type'] ?? '' ) : '';
	7626	+
	7627	+ if ( 'vigilante_self' === $type ) {
	7628	+ continue;
	7629	+ }
	7630	+
	7631	+ $file = is_array( $item ) ? (string) ( $item['file'] ?? '' ) : (string) $item;
	7632	+ $state = '';
	7633	+ $path = ABSPATH . ltrim( $file, '/' );
	7634	+
	7635	+ // By content, so a file rewritten with the same size and the
	7636	+ // same date is still a different file. The ones too large to
	7637	+ // hash on every scan go by size, date and the time of their
	7638	+ // last change of any kind, which writing to a file moves and
	7639	+ // which cannot be set back the way the date can.
	7640	+ if ( '' !== $file && is_file( $path ) ) {
	7641	+ $state = filesize( $path ) <= MB_IN_BYTES ? (string) md5_file( $path ) : filesize( $path ) . ':' . filemtime( $path ) . ':' . filectime( $path );
	7642	+ }
	7643	+
	7644	+ $keys[ $bucket ][] = md5( $bucket . '|' . $type . '|' . $file . '|' . $state );
	7645	+ }
	7646	+ }
	7647	+
	7648	+ // In order of importance: only the first 5,000 are remembered, and
	7649	+ // what is not remembered is reported again.
	7650	+ return array_values( array_unique( array_merge( $keys['config'], $keys['closed'], $keys['suspicious'], $keys['modified'], $keys['extra'] ) ) );
2752	7651	}
2753	7652
2754	7653	/**
2755	7654	* Collect the closed/removed plugins (excluding ignored slugs) so they can
		@@ -2784,8 +7683,10 @@
2784	7683	'suspicious' => array_merge( $results1['suspicious'] ?? array(), $results2['suspicious'] ?? array() ),
2785	7684	'extra' => array_merge( $results1['extra'] ?? array(), $results2['extra'] ?? array() ),
2786	7685	'new' => $results1['new'] ?? array(),
2787	7686	'errors' => array_merge( $results1['errors'] ?? array(), $results2['errors'] ?? array() ),
	7687	+ // Plugins and themes with no official copy to compare with.
	7688	+ 'unverified' => array_merge( $results1['unverified'] ?? array(), $results2['unverified'] ?? array() ),
2788	7689	'scan_time' => $results1['scan_time'] ?? 0,
2789	7690	'incomplete' => $results1['incomplete'] ?? false,
2790	7691	);
2791	7692	}
		@@ -2831,8 +7732,37 @@
2831	7732	$regular_modified[] = $item;
2832	7733	}
2833	7734	}
2834	7735
	7736	+ /*
	7737	+ * Self-protection does not travel in this email any more: it has its own
	7738	+ * alert, which no setting switches off (Vigilante_Self_Integrity::
	7739	+ * maybe_send_self_alert()). Older stored results can still carry its
	7740	+ * rows, so they are dropped here instead of being listed as ordinary
	7741	+ * files.
	7742	+ */
	7743	+ foreach ( array( 'suspicious', 'extra', 'missing' ) as $self_bucket ) {
	7744	+ if ( empty( $results[ $self_bucket ] ) || ! is_array( $results[ $self_bucket ] ) ) {
	7745	+ continue;
	7746	+ }
	7747	+ $results[ $self_bucket ] = array_values(
	7748	+ array_filter(
	7749	+ $results[ $self_bucket ],
	7750	+ function ( $item ) {
	7751	+ return ! ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) );
	7752	+ }
	7753	+ )
	7754	+ );
	7755	+ }
	7756	+ $regular_modified = array_values(
	7757	+ array_filter(
	7758	+ $regular_modified,
	7759	+ function ( $item ) {
	7760	+ return ! ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) );
	7761	+ }
	7762	+ )
	7763	+ );
	7764	+
2835	7765	$suspicious_count = count( $results['suspicious'] ?? array() );
2836	7766	$extra_count = count( $results['extra'] ?? array() );
2837	7767	$critical_config_count = count( $critical_config );
2838	7768	$modified_count = count( $regular_modified );
		@@ -2837,16 +7767,31 @@
2837	7767	$critical_config_count = count( $critical_config );
2838	7768	$modified_count = count( $regular_modified );
2839	7769	$closed_count = count( $closed_plugins );
2840	7770
2841		- // Use more urgent subject when suspicious files, critical config changes
2842		- // or closed plugins are found (all three are security-critical).
2843		- if ( $suspicious_count > 0 || $critical_config_count > 0 || $closed_count > 0 ) {
	7771	+ // The subject says what was found. Suspicious files and closed plugins
	7772	+ // keep the alert wording. A change in wp-config.php or .htaccess with
	7773	+ // nothing else next to it names the files instead: most of the time it
	7774	+ // is a plugin rewriting its own block, and "SECURITY ALERT" on every
	7775	+ // one of those taught people to read the subject as "I was hacked".
	7776	+ if ( $suspicious_count > 0 || $closed_count > 0 ) {
2844	7777	$subject = sprintf(
2845	7778	/* translators: %s: Site name */
2846	7779	__( '[%s] SECURITY ALERT: File integrity issues detected', 'vigilante' ),
2847	7780	$site_name
2848	7781	);
	7782	+ } elseif ( $critical_config_count > 0 ) {
	7783	+ $changed = array();
	7784	+ foreach ( $critical_config as $item ) {
	7785	+ $changed[] = (string) ( $item['file'] ?? '' );
	7786	+ }
	7787	+
	7788	+ $subject = sprintf(
	7789	+ /* translators: 1: Site name, 2: The file that changed, or both of them, such as "wp-config.php, .htaccess" */
	7790	+ __( '[%1$s] %2$s changed: review needed', 'vigilante' ),
	7791	+ $site_name,
	7792	+ implode( ', ', array_unique( array_filter( $changed ) ) )
	7793	+ );
2849	7794	} else {
2850	7795	$subject = sprintf(
2851	7796	/* translators: %s: Site name */
2852	7797	__( '[%s] File integrity issues detected', 'vigilante' ),
		@@ -2881,9 +7826,9 @@
2881	7826	// Suspicious files section
2882	7827	if ( ! empty( $results['suspicious'] ) ) {
2883	7828	$inner .= $this->get_section_html(
2884	7829	__( 'Suspicious files', 'vigilante' ),
2885		- __( 'These files may contain malicious code. Review immediately.', 'vigilante' ),
	7830	+ __( 'Files that can run code where none is expected, or that contain code written the way malware hides itself. Some are harmless, such as cache files a plugin generates or a .htaccess that protects a folder: check the path and the reason before acting.', 'vigilante' ),
2886	7831	$results['suspicious'],
2887	7832	'#d63638',
2888	7833	'#fef1f1',
2889	7834	20,
		@@ -2894,9 +7839,9 @@
2894	7839	// Extra files section
2895	7840	if ( ! empty( $results['extra'] ) ) {
2896	7841	$inner .= $this->get_section_html(
2897	7842	__( 'Extra files', 'vigilante' ),
2898		- __( 'PHP files not in the original WordPress.org distribution.', 'vigilante' ),
	7843	+ __( 'Files that are not part of WordPress, or of the plugin or theme they sit in. Many are legitimate. A copy of wp-config.php or a database dump in the site root should be moved out of it.', 'vigilante' ),
2899	7844	$results['extra'],
2900	7845	'#b32d2e',
2901	7846	'#fdf6f4',
2902	7847	20,
		@@ -2907,9 +7852,9 @@
2907	7852	// Critical config files section (wp-config.php, .htaccess modified outside Vigilante)
2908	7853	if ( ! empty( $critical_config ) ) {
2909	7854	$inner .= $this->get_section_html(
2910	7855	__( 'Critical config files modified', 'vigilante' ),
2911		- __( 'These files are common targets for code injection. Review the changes and approve if they are legitimate.', 'vigilante' ),
	7856	+ __( 'Changed since you last approved them. Cache, security and redirection plugins rewrite their own blocks in these files, often on every update, and attackers write to them too. Review the changes and approve them if they belong to something you use.', 'vigilante' ),
2912	7857	$critical_config,
2913	7858	'#e36210',
2914	7859	'#fdf2e6',
2915	7860	10,
		@@ -2920,9 +7865,9 @@
2920	7865	// Modified files section (only if notify_level is 'all')
2921	7866	if ( 'all' === $notify_level && ! empty( $regular_modified ) ) {
2922	7867	$inner .= $this->get_section_html(
2923	7868	__( 'Modified files', 'vigilante' ),
2924		- __( 'Checksum mismatch with WordPress.org originals.', 'vigilante' ),
	7869	+ __( 'These files do not match the copy WordPress.org publishes for the installed version. Reinstalling the plugin, the theme or WordPress brings the original back.', 'vigilante' ),
2925	7870	$regular_modified,
2926	7871	'#dba617',
2927	7872	'#fdf8e8',
2928	7873	15,
		@@ -2937,8 +7882,31 @@
2937	7882	if ( $closed_count > 0 ) {
2938	7883	$inner .= $this->build_closed_plugins_email_section( $closed_plugins );
2939	7884	}
2940	7885
	7886	+ // A partial scan says so and names what it did not get to. With no
	7887	+ // finding in a plugin that was never looked at, silence here read as
	7888	+ // "that plugin is fine".
	7889	+ if ( self::is_partial( $results ) ) {
	7890	+ $partial_lines = array_merge(
	7891	+ array_slice( array_map( 'strval', (array) ( $results['errors'] ?? array() ) ), 0, 10 ),
	7892	+ self::not_checked_lines( $results )
	7893	+ );
	7894	+
	7895	+ $inner .= '<p style="margin:0 0 8px;font-size:13px;color:#1d2327;"><strong>' . esc_html__( 'The last scan could not check everything, so its result is partial.', 'vigilante' ) . '</strong></p>';
	7896	+ $inner .= '<ul style="margin:0 0 16px 18px;padding:0;font-size:13px;color:#50575e;">';
	7897	+
	7898	+ foreach ( $partial_lines as $partial_line ) {
	7899	+ $inner .= '<li>' . esc_html( $partial_line ) . '</li>';
	7900	+ }
	7901	+
	7902	+ $inner .= '</ul>';
	7903	+ }
	7904	+
	7905	+ // Where the explanation is. The email stays a list; what each kind of
	7906	+ // finding usually is and what to do about it lives next to the results.
	7907	+ $inner .= '<p style="margin:0 0 16px;font-size:12px;color:#50575e;">' . esc_html__( 'File Integrity explains what each kind of finding usually is and what to do about it. A finding stays listed until you approve it, ignore it or fix it.', 'vigilante' ) . '</p>';
	7908	+
2941	7909	// CTA button
2942	7910	$inner .= Vigilante_Email_Template::button(
2943	7911	admin_url( 'admin.php?page=vigilante&tab=file-integrity#vigilante-section-fi-last-scan' ),
2944	7912	__( 'Review in Vigilant', 'vigilante' )
		@@ -2944,13 +7912,20 @@
2944	7912	__( 'Review in Vigilant', 'vigilante' )
2945	7913	);
2946	7914
2947	7915	$is_alert = ( $suspicious_count > 0 || $critical_config_count > 0 || $closed_count > 0 );
2948		- $title = $is_alert
2949		- ? __( 'Security alert', 'vigilante' )
2950		- : __( 'File integrity report', 'vigilante' );
2951	7916
2952		- Vigilante_Email_Template::send( $to, $subject, $title, $inner, $is_alert );
	7917	+ // Same three cases as the subject.
	7918	+ if ( $suspicious_count > 0 || $closed_count > 0 ) {
	7919	+ $title = __( 'Security alert', 'vigilante' );
	7920	+ } elseif ( $critical_config_count > 0 ) {
	7921	+ $title = __( 'Configuration file changed', 'vigilante' );
	7922	+ } else {
	7923	+ $title = __( 'File integrity report', 'vigilante' );
	7924	+ }
	7925	+
	7926	+ // The caller records what was reported only when the email went out.
	7927	+ return (bool) Vigilante_Email_Template::send( $to, $subject, $title, $inner, $is_alert );
2953	7928	}
2954	7929
2955	7930	/**
2956	7931	* Build the closed + removed plugins block for the scan email.
		@@ -3075,16 +8050,32 @@
3075	8050
3076	8051	/**
3077	8052	* Add a file to the ignored list
3078	8053	*
	8054	+ * The path is stored exactly as it comes: the callers are the AJAX
	8055	+ * handlers, which have already read it and checked it against the shared
	8056	+ * files and Vigilant's own, and the scan compares the stored strings with
	8057	+ * the paths it finds one by one (in_array(), strict). This used to run
	8058	+ * sanitize_text_field() over it, which deletes every %XX octet and collapses
	8059	+ * repeated spaces, so the entry never matched the file it was made for
	8060	+ * (measured on 1 oct 2026 against 3.0.1). Anything that is not a plain
	8061	+ * string, is empty or carries tags is not a path and is refused. That guards
	8062	+ * a direct caller: the AJAX handlers read the path with wp_strip_all_tags()
	8063	+ * first, which shortens a name with a stray < instead of handing it over
	8064	+ * intact (see ajax_ignore_file()).
	8065	+ *
3079	8066	* @param string $file_path Relative file path to ignore.
3080	8067	* @return bool
3081	8068	*/
3082	8069	public function ignore_file( $file_path ) {
	8070	+ if ( ! is_string( $file_path ) || '' === $file_path || wp_strip_all_tags( $file_path ) !== $file_path ) {
	8071	+ return false;
	8072	+ }
	8073	+
3083	8074	$ignored = get_option( 'vigilante_ignored_files', array() );
3084	8075
3085	8076	if ( ! in_array( $file_path, $ignored, true ) ) {
3086		- $ignored[] = sanitize_text_field( $file_path );
	8077	+ $ignored[] = $file_path;
3087	8078	return update_option( 'vigilante_ignored_files', $ignored );
3088	8079	}
3089	8080
3090	8081	return true;