← All changes | includes/class-file-integrity.php +4776 -327 2.11.4 → 3.0.4 View file →

		@@ -68,15 +68,50 @@
68	68	*/
69	69	private $scan_start_time = 0;
70	70
71	71	/**
	72	+ * Seconds a scan runs for at most
	73	+ *
	74	+ * A scan is one request, and it starts from the beginning every time. On
	75	+ * a site too large for this, what comes last is left unchecked on every
	76	+ * scan, so the results say what was not reached (see not_checked_lines()).
	77	+ */
	78	+ const MAX_SCAN_SECONDS = 60;
	79	+
	80	+ /**
72	81	* Maximum scan time in seconds (default 60s for thorough scanning)
73	82	*
74	83	* @var int
75	84	*/
76		- private $max_scan_time = 60;
	85	+ private $max_scan_time = self::MAX_SCAN_SECONDS;
77	86
78	87	/**
	88	+ * Largest file the search for hidden code reads, in bytes
	89	+ *
	90	+ * It used to be 512,000, and a larger file was not opened at all: in a
	91	+ * plugin with no official copy that left it out of the results as if it
	92	+ * were clean. There is still a cap because the file is read whole, but
	93	+ * what is above it is reported as not searched instead of being passed
	94	+ * over (see search_file()).
	95	+ */
	96	+ const MAX_SEARCHED_BYTES = 8388608;
	97	+
	98	+ /**
	99	+ * Seconds a scan gives to the folders of wp-content that belong to nothing
	100	+ *
	101	+ * @var int
	102	+ */
	103	+ private $content_folders_time = 10;
	104	+
	105	+ /**
	106	+ * Whether an expression of the search for hidden code gave up on the file
	107	+ * being searched (see found())
	108	+ *
	109	+ * @var bool
	110	+ */
	111	+ private $search_failed = false;
	112	+
	113	+ /**
79	114	* Option name for critical files baseline hashes.
80	115	*
81	116	* @var string
82	117	*/
		@@ -125,8 +160,37 @@
125	160	*/
126	161	const BASELINE_SWEEP_MIGRATION = 'network-sweep-done';
127	162
128	163	/**
	164	+ * Network option with the fingerprint of every block Vigilant itself wrote
	165	+ * into wp-config.php or the root .htaccess.
	166	+ *
	167	+ * The integrity scan leaves Vigilant's own blocks out of the hash, so that
	168	+ * rewriting them is not reported as somebody else's change. Until 2.11.5 it
	169	+ * left out whatever sat between the markers, without looking. From 2.11.5 a
	170	+ * block is left out only if its content is exactly what Vigilant wrote, as
	171	+ * recorded here at write time.
	172	+ *
	173	+ * @since 2.11.5
	174	+ */
	175	+ const OWNED_BLOCKS_OPTION = 'vigilante_owned_blocks';
	176	+
	177	+ /**
	178	+ * Network option marking that the blocks already on disk have been claimed.
	179	+ *
	180	+ * @since 2.11.5
	181	+ */
	182	+ const OWNED_BLOCKS_CLAIM_OPTION = 'vigilante_owned_blocks_claim';
	183	+
	184	+ /**
	185	+ * Value stored when the claim is done. Deliberately not a version number:
	186	+ * that is the lesson of BASELINE_SWEEP_MIGRATION above.
	187	+ *
	188	+ * @since 2.11.5
	189	+ */
	190	+ const OWNED_BLOCKS_CLAIMED = 'claimed';
	191	+
	192	+ /**
129	193	* What replaces a secret value kept in the baseline.
130	194	*
131	195	* Fixed forever: if this string ever changes, every stored baseline
132	196	* suddenly differs from the freshly redacted file and every site reports a
		@@ -136,13 +200,16 @@
136	200	*/
137	201	const REDACTED_MARKER = '[redacted by Vigilant]';
138	202
139	203	/**
140		- * Constant names whose value never reaches the database.
	204	+ * Constant names whose value is checked even where the file does not name them
141	205	*
142		- * The eight WordPress keys and salts and the database credentials, plus
143		- * anything whose name reads like a credential, since a real wp-config.php
144		- * collects SMTP passwords, S3 keys and API tokens over the years.
	206	+ * The eight WordPress keys and salts and the database credentials. Until
	207	+ * 2.11.7 this list, plus names that read like a credential, was what got
	208	+ * redacted, and a real wp-config.php collects secrets under any name:
	209	+ * FTP_PASS, SMTP passwords, cloud keys inside serialize( array( ... ) ),
	210	+ * any const. Since 2.11.8 every value is redacted and this list only feeds
	211	+ * the output check of baseline_content().
145	212	*
146	213	* @since 2.11.2
147	214	*
148	215	* @var string[]
		@@ -153,8 +220,36 @@
153	220	'AUTH_SALT', 'SECURE_AUTH_SALT', 'LOGGED_IN_SALT', 'NONCE_SALT',
154	221	);
155	222
156	223	/**
	224	+ * Core constants whose value stays readable in the baseline copy
	225	+ *
	226	+ * Where the site lives, where its folders are, how much memory it gets:
	227	+ * none of it is a secret and all of it is what a diff of wp-config.php is
	228	+ * read for. Every other value is redacted. A list of what is secret can
	229	+ * never be complete, which is how 2.11.2 to 2.11.7 missed FTP_PASS; a list
	230	+ * of what is not can be short and still be right.
	231	+ *
	232	+ * @since 2.11.8
	233	+ *
	234	+ * @var string[]
	235	+ */
	236	+ private static $readable_constants = array(
	237	+ 'ABSPATH', 'WPINC', 'WP_HOME', 'WP_SITEURL', 'WP_CONTENT_DIR', 'WP_CONTENT_URL',
	238	+ 'WP_PLUGIN_DIR', 'WP_PLUGIN_URL', 'WPMU_PLUGIN_DIR', 'WPMU_PLUGIN_URL', 'UPLOADS',
	239	+ 'WP_LANG_DIR', 'WP_TEMP_DIR', 'WP_DEBUG_LOG', 'WP_MEMORY_LIMIT', 'WP_MAX_MEMORY_LIMIT',
	240	+ 'WP_ENVIRONMENT_TYPE', 'WP_DEVELOPMENT_MODE', 'WP_AUTO_UPDATE_CORE', 'FS_METHOD',
	241	+ 'DB_CHARSET', 'DB_COLLATE', 'DOMAIN_CURRENT_SITE', 'PATH_CURRENT_SITE', 'NOBLOGREDIRECT',
	242	+ 'COOKIE_DOMAIN', 'COOKIEPATH', 'SITECOOKIEPATH', 'ADMIN_COOKIE_PATH', 'PLUGINS_COOKIE_PATH',
	243	+ 'WP_DEFAULT_THEME', 'WPLANG',
	244	+ // Numeric core settings. Since 2.11.10 a number in the value of a
	245	+ // define() is redacted like any other value, so the ones that are known
	246	+ // not to be credentials are listed here to keep the diff useful.
	247	+ 'AUTOSAVE_INTERVAL', 'WP_POST_REVISIONS', 'EMPTY_TRASH_DAYS', 'WP_CRON_LOCK_TIMEOUT',
	248	+ 'FS_CHMOD_DIR', 'FS_CHMOD_FILE', 'SITE_ID_CURRENT_SITE', 'BLOG_ID_CURRENT_SITE',
	249	+ );
	250	+
	251	+ /**
157	252	* Read the critical files baseline, from where it belongs
158	253	*
159	254	* Both watched files, wp-config.php and the root .htaccess, belong to the
160	255	* whole network: there is one of each per installation, not one per site.
		@@ -196,8 +291,112 @@
196	291	return update_site_option( self::BASELINE_OPTION, $baseline );
197	292	}
198	293
199	294	/**
	295	+ * Fingerprint of a block exactly as the integrity scan reads it back
	296	+ *
	297	+ * @since 2.11.5
	298	+ *
	299	+ * @param string $block Block from start marker to end marker, inclusive.
	300	+ * @return string
	301	+ */
	302	+ private static function block_fingerprint( $block ) {
	303	+ return md5( str_replace( array( "\r\n", "\r" ), "\n", (string) $block ) );
	304	+ }
	305	+
	306	+ /**
	307	+ * Record a block Vigilant has just written
	308	+ *
	309	+ * Called by the writers right after a verified write, so the scan can tell
	310	+ * Vigilant's block from anything else carrying the same markers. By default
	311	+ * it replaces the earlier record for that marker: after a write, only the
	312	+ * block just written is Vigilant's.
	313	+ *
	314	+ * @since 2.11.5
	315	+ *
	316	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	317	+ * @param string $marker_start Start marker of the block.
	318	+ * @param string $block Block from start marker to end marker, inclusive.
	319	+ * @param bool $replace Drop earlier records for the same marker first.
	320	+ * @return bool
	321	+ */
	322	+ public static function remember_owned_block( $filename, $marker_start, $block, $replace = true ) {
	323	+ $owned = get_site_option( self::OWNED_BLOCKS_OPTION, array() );
	324	+ $owned = is_array( $owned ) ? $owned : array();
	325	+ $file = ( isset( $owned[ $filename ] ) && is_array( $owned[ $filename ] ) ) ? $owned[ $filename ] : array();
	326	+
	327	+ if ( $replace ) {
	328	+ foreach ( $file as $fingerprint => $marker ) {
	329	+ if ( $marker === $marker_start ) {
	330	+ unset( $file[ $fingerprint ] );
	331	+ }
	332	+ }
	333	+ }
	334	+
	335	+ $file[ self::block_fingerprint( $block ) ] = $marker_start;
	336	+ $owned[ $filename ] = $file;
	337	+
	338	+ return update_site_option( self::OWNED_BLOCKS_OPTION, $owned );
	339	+ }
	340	+
	341	+ /**
	342	+ * Forget the blocks recorded for a marker, once Vigilant has removed them
	343	+ *
	344	+ * @since 2.11.5
	345	+ *
	346	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	347	+ * @param string $marker_start Start marker of the block.
	348	+ * @return bool
	349	+ */
	350	+ public static function forget_owned_blocks( $filename, $marker_start ) {
	351	+ $owned = get_site_option( self::OWNED_BLOCKS_OPTION, array() );
	352	+
	353	+ if ( ! is_array( $owned ) || empty( $owned[ $filename ] ) || ! is_array( $owned[ $filename ] ) ) {
	354	+ return true;
	355	+ }
	356	+
	357	+ $changed = false;
	358	+
	359	+ foreach ( $owned[ $filename ] as $fingerprint => $marker ) {
	360	+ if ( $marker === $marker_start ) {
	361	+ unset( $owned[ $filename ][ $fingerprint ] );
	362	+ $changed = true;
	363	+ }
	364	+ }
	365	+
	366	+ return $changed ? update_site_option( self::OWNED_BLOCKS_OPTION, $owned ) : true;
	367	+ }
	368	+
	369	+ /**
	370	+ * Whether a block is one Vigilant wrote
	371	+ *
	372	+ * @since 2.11.5
	373	+ *
	374	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	375	+ * @param string $block Block from start marker to end marker, inclusive.
	376	+ * @return bool
	377	+ */
	378	+ private static function is_owned_block( $filename, $block ) {
	379	+ $owned = get_site_option( self::OWNED_BLOCKS_OPTION, array() );
	380	+
	381	+ return is_array( $owned )
	382	+ && isset( $owned[ $filename ] )
	383	+ && is_array( $owned[ $filename ] )
	384	+ && isset( $owned[ $filename ][ self::block_fingerprint( $block ) ] );
	385	+ }
	386	+
	387	+ /**
	388	+ * Whether the blocks already on disk have been claimed
	389	+ *
	390	+ * @since 2.11.5
	391	+ *
	392	+ * @return bool
	393	+ */
	394	+ private function owned_blocks_claimed() {
	395	+ return self::OWNED_BLOCKS_CLAIMED === get_site_option( self::OWNED_BLOCKS_CLAIM_OPTION );
	396	+ }
	397	+
	398	+ /**
200	399	* The baseline copy of a critical file, with no secret in it
201	400	*
202	401	* The integrity scan keeps a copy of wp-config.php so it can show which
203	402	* lines changed. Until 2.11.1 that copy was the file itself minus the
		@@ -217,35 +416,61 @@
217	416	* @param string $normalized Normalized content.
218	417	* @return string Content safe to store, or '' when it cannot be made safe.
219	418	*/
220	419	private function baseline_content( $filename, $normalized ) {
	420	+ if ( '.htaccess' === $filename ) {
	421	+ return $this->redact_server_secrets( $normalized );
	422	+ }
	423	+
221	424	if ( 'wp-config.php' !== $filename ) {
222	425	return $normalized;
223	426	}
224	427
225		- $redacted = $this->redact_secrets( $normalized );
	428	+ // Calculados una sola vez: los usa la redaccion (para no conservar un
	429	+ // numero que ademas este en vigor) y el control de salida de abajo.
	430	+ $live_values = $this->values_in_force( $normalized );
	431	+ $redacted = $this->redact_secrets( $normalized, $live_values );
226	432
227	433	/*
228		- * Belt and braces, and this is the part that matters: the regular
229		- * expression above is the thing most likely to miss a shape nobody
230		- * thought of, and the cost of missing one is a secret in the database.
231		- * So the result is checked against the values actually in force, and
232		- * if any of them survived, nothing is stored at all. The scan then
233		- * reports the change without a line diff, which the interface already
234		- * handles, instead of leaking.
	434	+ * Belt and braces, and this is the part that matters: the redaction
	435	+ * above is the thing most likely to miss a shape nobody thought of,
	436	+ * and the cost of missing one is a secret in the database. So the
	437	+ * result is checked against the values actually in force, and if any
	438	+ * of them survived, nothing is stored at all. The scan then reports the
	439	+ * change without a line diff, which the interface already handles,
	440	+ * instead of leaking.
235	441	*
	442	+ * Until 2.11.7 the check covered the twelve constants of WordPress and
	443	+ * nothing else, so a value the regular expression missed went straight
	444	+ * through it. It now covers every constant the file names and every
	445	+ * environment variable it reads.
	446	+ *
	447	+ * It runs against the copy that is actually stored. A value in force
	448	+ * that sits inside the value of a readable constant, such as a Redis
	449	+ * prefix equal to the domain inside WP_HOME, is not a secret left
	450	+ * behind, so that one alone is not looked for; without that, every such
	451	+ * site would lose its diff. The first version of this checked a
	452	+ * stricter copy instead, and a secret inside a kept include path went
	453	+ * straight past it (cross review of 2.11.8).
	454	+ *
236	455	* Only values of eight characters or more are checked: DB_NAME is
237	456	* often something like "local" or "wp", and looking for that inside a
238	457	* PHP file matches by accident every time.
239	458	*/
240		- foreach ( self::$secret_constants as $name ) {
241		- if ( ! defined( $name ) ) {
242		- continue;
	459	+ if ( '' === $redacted ) {
	460	+ return '';
	461	+ }
	462	+
	463	+ $shown = $this->readable_values_in_force();
	464	+
	465	+ foreach ( $live_values as $value ) {
	466	+ foreach ( $shown as $readable ) {
	467	+ if ( false !== strpos( $readable, $value ) ) {
	468	+ continue 2;
	469	+ }
243	470	}
244	471
245		- $value = (string) constant( $name );
246		-
247		- if ( strlen( $value ) >= 8 && false !== strpos( $redacted, $value ) ) {
	472	+ if ( false !== strpos( $redacted, $value ) ) {
248	473	return '';
249	474	}
250	475	}
251	476
		@@ -252,40 +477,523 @@
252	477	return $redacted;
253	478	}
254	479
255	480	/**
256		- * Replace the value of every credential-looking define with a marker
	481	+ * Replace every value in wp-config.php with a marker
257	482	*
258		- * Keeps the line and the constant name, so the diff still shows that a
259		- * credential line was touched, and drops only the value.
	483	+ * Reads the file as PHP tokens and replaces every string in it: quoted,
	484	+ * with variables inside, heredoc and nowdoc. What stays is what names a
	485	+ * thing rather than holding it: the name passed to define(), defined(),
	486	+ * constant() and getenv(), the name in putenv( 'NAME=value' ), array keys,
	487	+ * an index such as $_ENV['NAME'], and strings of a single character that
	488	+ * are not the value of a define(). Also the value of the constants in
	489	+ * $readable_constants, the table prefix and a path passed to require or
	490	+ * include, which are not secrets and are what a diff of this file is read
	491	+ * for. A path is kept only while it looks like one, and only up to where
	492	+ * its expression ends.
260	493	*
	494	+ * Until 2.11.7 this was a regular expression over define() with a list of
	495	+ * names, and it missed FTP_PASS, SMTP passwords, cloud keys inside
	496	+ * serialize( array( ... ) ), every const and every value read with a
	497	+ * fallback. Measured while preparing 2.11.8: 10 of 15 real shapes stored
	498	+ * their secret.
	499	+ *
	500	+ * The marker always goes in single quotes, whatever the original used, so
	501	+ * a copy redacted by an earlier version and the same file redacted today
	502	+ * read the same line for line.
	503	+ *
261	504	* @since 2.11.2
	505	+ * @since 2.11.8 Reads tokens and redacts every value.
262	506	*
263	507	* @param string $content Normalized wp-config.php content.
	508	+ * @return string Redacted content, or '' when it cannot be read as tokens.
	509	+ */
	510	+ private function redact_secrets( $content, $live_values = array() ) {
	511	+ if ( ! function_exists( 'token_get_all' ) ) {
	512	+ return '';
	513	+ }
	514	+
	515	+ $marker = "'" . self::REDACTED_MARKER . "'";
	516	+ $tokens = self::merged_tokens( token_get_all( (string) $content ) );
	517	+ $count = count( $tokens );
	518	+ $names = defined( 'T_NAME_FULLY_QUALIFIED' ) ? array( T_STRING, T_NAME_FULLY_QUALIFIED ) : array( T_STRING );
	519	+ $includes = array( T_INCLUDE, T_INCLUDE_ONCE, T_REQUIRE, T_REQUIRE_ONCE );
	520	+ $out = '';
	521	+ $depth = 0;
	522	+ $keep_until = -1;
	523	+ $define_at = -1;
	524	+ $in_include = false;
	525	+ $include_depth = 0;
	526	+ $include_ends = array( T_CLOSE_TAG, T_BOOLEAN_OR, T_BOOLEAN_AND, T_LOGICAL_OR, T_LOGICAL_AND, T_COALESCE );
	527	+
	528	+ for ( $i = 0; $i < $count; $i++ ) {
	529	+ list( $type, $text, $plain ) = $tokens[ $i ];
	530	+
	531	+ if ( '(' === $type ) {
	532	+ $depth++;
	533	+ } elseif ( ')' === $type ) {
	534	+ // The closing parenthesis of a readable define(), or of any define().
	535	+ if ( $depth === $keep_until ) {
	536	+ $keep_until = -1;
	537	+ }
	538	+ if ( $depth === $define_at ) {
	539	+ $define_at = -1;
	540	+ }
	541	+ $depth--;
	542	+
	543	+ // A parenthesis that closes around the include ends its path.
	544	+ if ( $in_include && $depth < $include_depth ) {
	545	+ $in_include = false;
	546	+ }
	547	+ } elseif ( in_array( $type, $includes, true ) ) {
	548	+ $in_include = true;
	549	+ $include_depth = $depth;
	550	+ } elseif ( $in_include && ( in_array( $type, array( ';', '{', '}', '?', ':', ',' ), true ) || in_array( $type, $include_ends, true ) ) ) {
	551	+ /*
	552	+ * The path of an include ends where its expression does. The
	553	+ * first version of this only ended it at ';', so the value in
	554	+ * `( include 'db.php' ) || define( 'FTP_PASS', '...' )`, in a
	555	+ * ternary after require, or after a closing tag, was kept.
	556	+ * Found by the cross review of 2.11.8.
	557	+ */
	558	+ $in_include = false;
	559	+ }
	560	+
	561	+ if ( T_COMMENT === $type || T_DOC_COMMENT === $type ) {
	562	+ $out .= $this->redact_comment( $text );
	563	+ continue;
	564	+ }
	565	+
	566	+ if ( T_INLINE_HTML === $type ) {
	567	+ $out .= ( '' === trim( $text ) ) ? $text : $marker;
	568	+ continue;
	569	+ }
	570	+
	571	+ /*
	572	+ * A value that is not a quoted string is still a value. Until
	573	+ * 2.11.10 only string tokens were looked at, so
	574	+ * define( 'SERVICE_TOKEN', 12345678 ) put the live token in the copy
	575	+ * kept in the database. Reported by the wp.org automated review of
	576	+ * 2.11.9.
	577	+ *
	578	+ * The first fix here redacted a number only in the value position of
	579	+ * a define(), which is the shape that was reported and not the shape
	580	+ * of the problem. The second cross review of 2.11.10 measured nine
	581	+ * more: a negative number, one in parentheses, one inside
	582	+ * array( ... ), one in a ternary, a const, and four that are not
	583	+ * constants at all and so the output check cannot catch either, the
	584	+ * worst of them the documented way of configuring Redis,
	585	+ * $redis_server = array( 'auth' => 12345678 ). So a number is now
	586	+ * treated like a string: redacted unless the place it sits in is one
	587	+ * of the few that cannot hold a credential, which is how the rest of
	588	+ * this function has been written since 2.11.8 (a list of what may be
	589	+ * shown, never a list of what is secret).
	590	+ *
	591	+ * Losing a number from the diff costs little and buys the same trade
	592	+ * as everywhere else: the hash still covers the whole file, so a
	593	+ * change is detected even where the diff can no longer show it. The
	594	+ * numeric core settings are in $readable_constants so the diff of a
	595	+ * normal wp-config.php keeps saying what it used to.
	596	+ */
	597	+ if ( T_LNUMBER === $type || T_DNUMBER === $type ) {
	598	+ $nprev = self::significant_token( $tokens, $i, -1 );
	599	+ $nnext = self::significant_token( $tokens, $i, 1 );
	600	+ $nptype = ( null === $nprev ) ? null : $tokens[ $nprev ][0];
	601	+ $nntype = ( null === $nnext ) ? null : $tokens[ $nnext ][0];
	602	+ $nbefore = ( '[' === $nptype ) ? self::significant_token( $tokens, $nprev, -1 ) : null;
	603	+ $nbtoken = ( null === $nbefore ) ? array( null, null ) : $tokens[ $nbefore ];
	604	+ $nvalue = ( -1 !== $define_at && $depth === $define_at && ',' === $nptype );
	605	+
	606	+ $nkeep = $keep_until >= 0
	607	+ || T_DOUBLE_ARROW === $nntype
	608	+ || ( '[' === $nptype && ']' === $nntype && in_array( $nbtoken[0], array( T_VARIABLE, T_STRING, ']', ')', '}' ), true ) )
	609	+ || ( strlen( $text ) <= 1 && ! $nvalue );
	610	+
	611	+ /*
	612	+ * Except when that same number is a value actually in force. The
	613	+ * positions kept above are kept because a credential does not live
	614	+ * in them, which is true, but it says nothing about the number
	615	+ * itself: with
	616	+ * define( 'SERVICE_TOKEN', 12345678 );
	617	+ * $a = $config[12345678];
	618	+ * the value was redacted in the define and kept in the index, so it
	619	+ * survived, and the output check below did what it is there for and
	620	+ * threw the whole copy away. No leak, but the diff of that
	621	+ * wp-config.php was lost for good, which is the regression 2.11.8
	622	+ * fixed, coming back through the numbers added in 2.11.10. Found by
	623	+ * the third cross review.
	624	+ *
	625	+ * Strings are deliberately NOT treated this way: there, a value in
	626	+ * force sitting in a kept position (an include path, an array key)
	627	+ * can BE the secret, and losing the diff is the right answer. It is
	628	+ * what poc/wpconfig-baseline-secretos.sh checks and it stays.
	629	+ */
	630	+ if ( $nkeep && in_array( $text, $live_values, true ) ) {
	631	+ $nkeep = false;
	632	+ }
	633	+
	634	+ $out .= $nkeep ? $text : $marker;
	635	+ continue;
	636	+ }
	637	+
	638	+ if ( 'string' !== $type ) {
	639	+ $out .= $text;
	640	+ continue;
	641	+ }
	642	+
	643	+ $prev = self::significant_token( $tokens, $i, -1 );
	644	+ $next = self::significant_token( $tokens, $i, 1 );
	645	+ $ptype = ( null === $prev ) ? null : $tokens[ $prev ][0];
	646	+ $ntype = ( null === $next ) ? null : $tokens[ $next ][0];
	647	+ $call = ( '(' === $ptype ) ? self::significant_token( $tokens, $prev, -1 ) : null;
	648	+ $inner = $plain ? substr( $text, 1, -1 ) : null;
	649	+
	650	+ if ( $plain && null !== $call && in_array( $tokens[ $call ][0], $names, true ) ) {
	651	+ $function = strtolower( ltrim( $tokens[ $call ][1], '\\' ) );
	652	+
	653	+ if ( in_array( $function, array( 'define', 'defined', 'constant', 'getenv' ), true ) ) {
	654	+ if ( 'define' === $function ) {
	655	+ $define_at = $depth;
	656	+
	657	+ if ( in_array( $inner, self::$readable_constants, true ) ) {
	658	+ $keep_until = $depth;
	659	+ }
	660	+ }
	661	+ $out .= $text;
	662	+ continue;
	663	+ }
	664	+
	665	+ if ( 'putenv' === $function && false !== strpos( $inner, '=' ) ) {
	666	+ $out .= "'" . substr( $inner, 0, strpos( $inner, '=' ) + 1 ) . self::REDACTED_MARKER . "'";
	667	+ continue;
	668	+ }
	669	+ }
	670	+
	671	+ // The token before an opening bracket or an assignment, when there is one.
	672	+ $before = ( '[' === $ptype || '=' === $ptype ) ? self::significant_token( $tokens, $prev, -1 ) : null;
	673	+ $btoken = ( null === $before ) ? array( null, null ) : $tokens[ $before ];
	674	+
	675	+ /*
	676	+ * The value of a define() is redacted whatever its length, as it was
	677	+ * up to 2.11.7, so an empty password reads the same in a copy stored
	678	+ * then as in today's; the first version of this kept strings of one
	679	+ * character there and a file awaiting review showed credential lines
	680	+ * nobody had touched (cross review of 2.11.8).
	681	+ */
	682	+ $is_define_value = ( -1 !== $define_at && $depth === $define_at && ',' === $ptype );
	683	+ $is_path = $in_include && $plain
	684	+ && preg_match( '#^[A-Za-z0-9_./\-]+$#', (string) $inner )
	685	+ && ( false !== strpos( (string) $inner, '/' ) || '.php' === substr( (string) $inner, -4 ) );
	686	+
	687	+ $keep = ( $plain && strlen( $inner ) <= 1 && ! $is_define_value )
	688	+ || T_DOUBLE_ARROW === $ntype
	689	+ || ( '[' === $ptype && ']' === $ntype && in_array( $btoken[0], array( T_VARIABLE, T_STRING, ']', ')', '}' ), true ) )
	690	+ || $keep_until >= 0
	691	+ || $is_path
	692	+ || ( '=' === $ptype && ';' === $ntype && T_VARIABLE === $btoken[0] && '$table_prefix' === $btoken[1] );
	693	+
	694	+ $out .= $keep ? $text : $marker;
	695	+ }
	696	+
	697	+ return $out;
	698	+ }
	699	+
	700	+ /**
	701	+ * PHP tokens with every string folded into a single token
	702	+ *
	703	+ * The tokenizer splits a string with variables inside, a heredoc and a
	704	+ * backtick command into several tokens. For the redaction each of them is
	705	+ * one value, so they come back as a single token of type 'string'. The
	706	+ * third field says whether it is a plain quoted literal.
	707	+ *
	708	+ * @since 2.11.8
	709	+ *
	710	+ * @param array $raw Output of token_get_all().
	711	+ * @return array List of array( type, text, plain ).
	712	+ */
	713	+ private static function merged_tokens( $raw ) {
	714	+ $tokens = array();
	715	+ $count = count( $raw );
	716	+
	717	+ for ( $i = 0; $i < $count; $i++ ) {
	718	+ $token = $raw[ $i ];
	719	+
	720	+ if ( '"' === $token || '`' === $token ) {
	721	+ $text = $token;
	722	+ for ( $i++; $i < $count; $i++ ) {
	723	+ $text .= is_array( $raw[ $i ] ) ? $raw[ $i ][1] : $raw[ $i ];
	724	+ if ( $raw[ $i ] === $token ) {
	725	+ break;
	726	+ }
	727	+ }
	728	+ $tokens[] = array( 'string', $text, false );
	729	+ continue;
	730	+ }
	731	+
	732	+ if ( is_array( $token ) && T_START_HEREDOC === $token[0] ) {
	733	+ $text = $token[1];
	734	+ for ( $i++; $i < $count; $i++ ) {
	735	+ $text .= is_array( $raw[ $i ] ) ? $raw[ $i ][1] : $raw[ $i ];
	736	+ if ( is_array( $raw[ $i ] ) && T_END_HEREDOC === $raw[ $i ][0] ) {
	737	+ break;
	738	+ }
	739	+ }
	740	+ $tokens[] = array( 'string', $text, false );
	741	+ continue;
	742	+ }
	743	+
	744	+ // An unterminated string comes back as T_ENCAPSED_AND_WHITESPACE
	745	+ // on its own, and it is a value like any other.
	746	+ if ( is_array( $token ) && ( T_CONSTANT_ENCAPSED_STRING === $token[0] || T_ENCAPSED_AND_WHITESPACE === $token[0] ) ) {
	747	+ $tokens[] = array( 'string', $token[1], T_CONSTANT_ENCAPSED_STRING === $token[0] );
	748	+ continue;
	749	+ }
	750	+
	751	+ $tokens[] = is_array( $token ) ? array( $token[0], $token[1], false ) : array( $token, $token, false );
	752	+ }
	753	+
	754	+ return $tokens;
	755	+ }
	756	+
	757	+ /**
	758	+ * Index of the nearest token that is not whitespace or a comment
	759	+ *
	760	+ * @since 2.11.8
	761	+ *
	762	+ * @param array $tokens Output of merged_tokens().
	763	+ * @param int $from Index to start from, not included.
	764	+ * @param int $step -1 to look back, 1 to look ahead.
	765	+ * @return int|null
	766	+ */
	767	+ private static function significant_token( $tokens, $from, $step ) {
	768	+ $count = count( $tokens );
	769	+
	770	+ for ( $i = $from + $step; $i >= 0 && $i < $count; $i += $step ) {
	771	+ if ( ! in_array( $tokens[ $i ][0], array( T_WHITESPACE, T_COMMENT, T_DOC_COMMENT ), true ) ) {
	772	+ return $i;
	773	+ }
	774	+ }
	775	+
	776	+ return null;
	777	+ }
	778	+
	779	+ /**
	780	+ * Redact a comment, keeping its plain words
	781	+ *
	782	+ * To the tokenizer a comment is text, and wp-config.php files keep old
	783	+ * credentials in them, commented out or in a note. The first version of
	784	+ * this, in the same release, redacted what was between quotes: an
	785	+ * apostrophe in prose ("Don't use 'the-old-password'") paired with the
	786	+ * opening quote of the secret and left it out, and a secret without quotes
	787	+ * was never touched. Found by the cross review of 2.11.8.
	788	+ *
	789	+ * So it works the other way round. A comment keeps its plain words
	790	+ * (lowercase, capitalised or uppercase letters, or two capitalised parts
	791	+ * such as WordPress, and docblock tags), constant names, and anything
	792	+ * shorter than eight characters; every other run of characters, a URL, a
	793	+ * key, a password with a digit in it, becomes the marker. The value of a
	794	+ * commented-out define() goes in single quotes whatever its length, as in
	795	+ * code and as 2.11.2 to 2.11.7 wrote it, so a copy stored by those
	796	+ * versions reads the same line for line. What this cannot tell from prose
	797	+ * is a password made only of plain letters; the output check still
	798	+ * catches it when it is a value in force.
	799	+ *
	800	+ * @since 2.11.8
	801	+ *
	802	+ * @param string $comment Comment token text.
264	803	* @return string
265	804	*/
266		- private function redact_secrets( $content ) {
267		- $names = implode( '|', array_map( 'preg_quote', self::$secret_constants ) );
	805	+ private function redact_comment( $comment ) {
	806	+ $marker = self::REDACTED_MARKER;
	807	+ $readable = self::$readable_constants;
268	808
	809	+ // Only the text between the delimiters is redacted: "/**#@-*/" in
	810	+ // wp-config-sample.php is a single run of eight characters, and
	811	+ // replacing it whole took the comment markers with it.
	812	+ if ( ! preg_match( '#\A(/\*\*?|//|\#)(.*?)(\*/)?\z#s', $comment, $parts ) ) {
	813	+ $parts = array( $comment, '', $comment );
	814	+ }
	815	+
	816	+ $open = $parts[1];
	817	+ $close = isset( $parts[3] ) ? $parts[3] : '';
	818	+ $comment = preg_replace_callback(
	819	+ '/(\bdefine\s*\(\s*([\'"])((?:\\\\.|(?!\2).)*)\2\s*,\s*)([\'"])((?:\\\\.|(?!\4).)*)\4/i',
	820	+ function ( $match ) use ( $marker, $readable ) {
	821	+ return in_array( $match[3], $readable, true ) ? $match[0] : $match[1] . "'" . $marker . "'";
	822	+ },
	823	+ $parts[2]
	824	+ );
	825	+
	826	+ if ( null === $comment ) {
	827	+ return '';
	828	+ }
	829	+
	830	+ $redacted = preg_replace_callback(
	831	+ '/[^\s\'"`(),;\[\]{}<>=]+/u',
	832	+ function ( $match ) use ( $marker ) {
	833	+ $word = $match[0];
	834	+ $core = rtrim( $word, '.:!?' );
	835	+
	836	+ // Plain words only, without hyphens: a passphrase written as
	837	+ // lowercase words joined by hyphens reads as prose otherwise, and
	838	+ // the PoC of this very fix caught one surviving.
	839	+ if ( strlen( $core ) < 8
	840	+ || preg_match( '/^@?(?:\p{Lu}?\p{Ll}+|\p{Lu}+)$/u', $core )
	841	+ || preg_match( '/^\p{Lu}\p{Ll}+\p{Lu}\p{Ll}+$/u', $core )
	842	+ || preg_match( '/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/', $core )
	843	+ ) {
	844	+ return $word;
	845	+ }
	846	+
	847	+ return $marker . substr( $word, strlen( $core ) );
	848	+ },
	849	+ $comment
	850	+ );
	851	+
	852	+ // A failed replacement, on invalid UTF-8 for one, drops the comment
	853	+ // rather than keep it whole.
	854	+ return ( null === $redacted ) ? '' : $open . $redacted . $close;
	855	+ }
	856	+
	857	+ /**
	858	+ * Values in force of what a wp-config.php names
	859	+ *
	860	+ * Every user constant whose name appears in the file, the twelve of
	861	+ * WordPress wherever they were defined, and the environment variables the
	862	+ * file reads or sets. Arrays are walked to their leaves, since define()
	863	+ * takes arrays. Strings and numbers both: the first version of this counted
	864	+ * numbers and wiped the diff of any file with a large number in force (cross
	865	+ * review of 2.11.8), so they were dropped, and 2.11.10 had to bring them
	866	+ * back because a credential written as a number, which the wp.org review of
	867	+ * 2.11.9 reported, is exactly what this check has to be able to see. The
	868	+ * eight character floor is what keeps the old problem away. The readable
	869	+ * constants are left out, and so is anything shorter than that.
	870	+ *
	871	+ * @since 2.11.8
	872	+ *
	873	+ * @param string $content Normalized wp-config.php content.
	874	+ * @return string[]
	875	+ */
	876	+ private function values_in_force( $content ) {
	877	+ $defined = get_defined_constants( true );
	878	+ $user = isset( $defined['user'] ) ? $defined['user'] : array();
	879	+ $names = self::$secret_constants;
	880	+ $values = array();
	881	+
	882	+ if ( preg_match_all( '/[A-Za-z_][A-Za-z0-9_]*/', (string) $content, $words ) ) {
	883	+ $names = array_merge( $names, $words[0] );
	884	+ }
	885	+
	886	+ foreach ( array_unique( $names ) as $name ) {
	887	+ if ( array_key_exists( $name, $user ) && ! in_array( $name, self::$readable_constants, true ) ) {
	888	+ $values = array_merge( $values, self::string_leaves( $user[ $name ] ) );
	889	+ }
	890	+ }
	891	+
	892	+ if ( preg_match_all( '/\b(?:getenv|putenv)\s*\(\s*[\'"]([A-Za-z_][A-Za-z0-9_]*)|\$_ENV\s*\[\s*[\'"]([A-Za-z_][A-Za-z0-9_]*)/', (string) $content, $env ) ) {
	893	+ foreach ( array_filter( array_merge( $env[1], $env[2] ) ) as $name ) {
	894	+ $value = getenv( $name );
	895	+
	896	+ if ( is_string( $value ) ) {
	897	+ $values[] = $value;
	898	+ }
	899	+ }
	900	+ }
	901	+
	902	+ $long = array();
	903	+
	904	+ foreach ( $values as $value ) {
	905	+ if ( strlen( $value ) >= 8 ) {
	906	+ $long[ $value ] = $value;
	907	+ }
	908	+ }
	909	+
	910	+ return array_values( $long );
	911	+ }
	912	+
	913	+ /**
	914	+ * Every string inside a constant value
	915	+ *
	916	+ * @since 2.11.8
	917	+ *
	918	+ * @param mixed $value Constant value.
	919	+ * @return string[]
	920	+ */
	921	+ private static function string_leaves( $value ) {
	922	+ if ( is_array( $value ) ) {
	923	+ $leaves = array();
	924	+
	925	+ foreach ( $value as $item ) {
	926	+ $leaves = array_merge( $leaves, self::string_leaves( $item ) );
	927	+ }
	928	+
	929	+ return $leaves;
	930	+ }
	931	+
	932	+ if ( is_string( $value ) ) {
	933	+ return array( $value );
	934	+ }
	935	+
269	936	/*
270		- * define( 'NAME', 'value' ), matching the quoted literal itself rather
271		- * than reading up to the closing parenthesis.
272		- *
273		- * The first version of this stopped at the first ';', which looked
274		- * reasonable and failed on the very first real file it saw: the salts
275		- * WordPress generates are full of punctuation and a ';' inside one cut
276		- * the match short, so nothing was redacted. Backreference 3 is the
277		- * opening quote and the value runs to its unescaped twin. No /s
278		- * modifier on purpose, so a file with an unterminated string breaks
279		- * one line instead of swallowing the rest of the file.
	937	+ * A number is a value too. Until 2.11.10 this returned nothing for one,
	938	+ * so the output check had no way to see a credential written as
	939	+ * define( 'SERVICE_TOKEN', 12345678 ) and the redaction was left without
	940	+ * its safety net there. Booleans and null stay out on purpose: as text
	941	+ * they are '1' and '', which would match half the file.
280	942	*/
281		- $pattern = '/(define\s*\(\s*([\'"])(?:' . $names . '|[A-Z0-9_]*(?:KEY|SALT|SECRET|PASSWORD|PASSWD|TOKEN|API)[A-Z0-9_]*)\2\s*,\s*)([\'"])(?:\\\\.|(?!\3).)*\3/i';
	943	+ return ( is_int( $value ) || is_float( $value ) ) ? array( (string) $value ) : array();
	944	+ }
282	945
283		- $redacted = preg_replace( $pattern, '${1}\'' . self::REDACTED_MARKER . '\'', $content );
	946	+ /**
	947	+ * Values in force of the readable constants, the ones kept in the copy
	948	+ *
	949	+ * @since 2.11.8
	950	+ *
	951	+ * @return string[]
	952	+ */
	953	+ private function readable_values_in_force() {
	954	+ $values = array();
284	955
285		- // A failed preg_replace returns null, and storing null would wipe the
286		- // baseline copy silently. Falling back to the original is not an
287		- // option either, so the caller's guard turns this into "no content".
	956	+ foreach ( self::$readable_constants as $name ) {
	957	+ if ( defined( $name ) ) {
	958	+ $values = array_merge( $values, self::string_leaves( constant( $name ) ) );
	959	+ }
	960	+ }
	961	+
	962	+ return $values;
	963	+ }
	964	+
	965	+ /**
	966	+ * Replace the values a root .htaccess can carry as credentials
	967	+ *
	968	+ * The .htaccess is not a secrets file, but it can hold a few: an
	969	+ * environment variable handed to PHP with SetEnv, an Authorization header
	970	+ * set for a backend, or a php_value with a password, a key, a licence or a
	971	+ * session store address with its auth in it. The directive and its name
	972	+ * stay, the value goes. Line based, which is how Apache reads it too. Since
	973	+ * the cross review of 2.11.8 also any request or response header whose name
	974	+ * reads like a credential (X-Api-Key, a cookie, a signature) and a
	975	+ * RewriteCond that compares against key=, token= or the like, the way a
	976	+ * staging site is opened with a secret in the query string. What it cannot
	977	+ * see is a credential written in any other shape.
	978	+ *
	979	+ * @since 2.11.8
	980	+ *
	981	+ * @param string $content Normalized .htaccess content.
	982	+ * @return string
	983	+ */
	984	+ private function redact_server_secrets( $content ) {
	985	+ $redacted = preg_replace(
	986	+ array(
	987	+ '/^([ \t]*SetEnv[ \t]+\S+[ \t]+)\S.*$/mi',
	988	+ '/^([ \t]*(?:RequestHeader|Header)[ \t]+(?:always[ \t]+)?\S+[ \t]+[\w-]*(?:auth|key|token|secret|pass|cookie|sig)[\w-]*[ \t]+)\S.*$/mi',
	989	+ '/^([ \t]*php_(?:admin_)?value[ \t]+\S*(?:pass|pw|secret|key|token|licen|auth|save_path)\S*[ \t]+)\S.*$/mi',
	990	+ '/^([ \t]*RewriteCond[ \t]+\S+[ \t]+)\S*(?:key|token|secret|pass|auth|sig)[\w-]*=\S*/mi',
	991	+ ),
	992	+ '${1}' . self::REDACTED_MARKER,
	993	+ (string) $content
	994	+ );
	995	+
288	996	return ( null === $redacted ) ? '' : $redacted;
289	997	}
290	998
291	999	/**
		@@ -484,8 +1192,150 @@
484	1192	}
485	1193	}
486	1194
487	1195	/**
	1196	+ * Network option recording the version whose results cleanup walked the network
	1197	+ *
	1198	+ * @since 2.11.8
	1199	+ */
	1200	+ const RESULTS_SWEEP_OPTION = 'vigilante_results_sweep';
	1201	+
	1202	+ /**
	1203	+ * Clean the stored scan results of every site of the network, once per version
	1204	+ *
	1205	+ * redact_stored_results() runs per site from admin_init and from the scan,
	1206	+ * so a subsite with the module off whose dashboard nobody opens kept the
	1207	+ * lines of wp-config.php its last scan stored, with whatever that version
	1208	+ * failed to redact. Same gap 2.11.3 and 2.11.4 closed for the baseline copy;
	1209	+ * found for the results by the cross review of 2.11.8. It runs from the
	1210	+ * network sweep, for a network administrator on the main site, and has its
	1211	+ * own marker because the baseline sweep is already done on every network
	1212	+ * that updated through 2.11.4.
	1213	+ *
	1214	+ * @since 2.11.8
	1215	+ */
	1216	+ private function maybe_sweep_network_results() {
	1217	+ if ( VIGILANTE_VERSION === get_site_option( self::RESULTS_SWEEP_OPTION ) ) {
	1218	+ return;
	1219	+ }
	1220	+
	1221	+ update_site_option( self::RESULTS_SWEEP_OPTION, VIGILANTE_VERSION );
	1222	+
	1223	+ $site_ids = get_sites(
	1224	+ array(
	1225	+ 'fields' => 'ids',
	1226	+ 'number' => 0,
	1227	+ 'network_id' => get_current_network_id(),
	1228	+ 'update_site_meta_cache' => false,
	1229	+ )
	1230	+ );
	1231	+
	1232	+ foreach ( $site_ids as $site_id ) {
	1233	+ switch_to_blog( $site_id );
	1234	+ $this->redact_stored_results();
	1235	+ restore_current_blog();
	1236	+ }
	1237	+ }
	1238	+
	1239	+ /**
	1240	+ * The diff of a shared file as a site that does not own it gets it
	1241	+ *
	1242	+ * No lines, and a flag the screens read to say where the lines are.
	1243	+ *
	1244	+ * @since 2.11.8
	1245	+ *
	1246	+ * @return array
	1247	+ */
	1248	+ public static function network_only_diff() {
	1249	+ return array(
	1250	+ 'added' => array(),
	1251	+ 'removed' => array(),
	1252	+ 'unavailable' => true,
	1253	+ 'network' => true,
	1254	+ );
	1255	+ }
	1256	+
	1257	+ /**
	1258	+ * Take out of the last stored scan what the baseline copy no longer keeps
	1259	+ *
	1260	+ * The results of the last scan are an option of each site, and the diff of
	1261	+ * a critical file travels inside them line by line, redacted the way the
	1262	+ * version that ran the scan redacted. Until 2.11.7 that let FTP_PASS and
	1263	+ * friends through, and on a network every subsite with the module on kept
	1264	+ * its own copy of the lines. This runs once per version with the rest of
	1265	+ * the cleanup:
	1266	+ *
	1267	+ * - Where the shared files do not belong to this site, no line is kept.
	1268	+ * - Lines of wp-config.php are dropped. A single line cannot be read as
	1269	+ * PHP reliably (half a heredoc is just words), and the next scan rebuilds
	1270	+ * them from the whole file.
	1271	+ * - Lines of .htaccess are directives, one per line, and are redacted in
	1272	+ * place.
	1273	+ *
	1274	+ * @since 2.11.8
	1275	+ */
	1276	+ private function redact_stored_results() {
	1277	+ $results = get_option( 'vigilante_last_integrity_results' );
	1278	+
	1279	+ if ( ! is_array( $results ) || empty( $results['modified'] ) || ! is_array( $results['modified'] ) ) {
	1280	+ return;
	1281	+ }
	1282	+
	1283	+ $owns = Vigilante_Settings::owns_shared_files();
	1284	+ $changed = false;
	1285	+
	1286	+ foreach ( $results['modified'] as $index => $item ) {
	1287	+ if ( ! is_array( $item ) || 'critical_config' !== ( $item['type'] ?? '' ) || ! isset( $item['diff'] ) || ! is_array( $item['diff'] ) ) {
	1288	+ continue;
	1289	+ }
	1290	+
	1291	+ if ( ! $owns ) {
	1292	+ if ( empty( $item['diff']['network'] ) ) {
	1293	+ $results['modified'][ $index ]['diff'] = self::network_only_diff();
	1294	+ $changed = true;
	1295	+ }
	1296	+ continue;
	1297	+ }
	1298	+
	1299	+ if ( 'wp-config.php' === ( $item['file'] ?? '' ) ) {
	1300	+ if ( ! empty( $item['diff']['added'] ) || ! empty( $item['diff']['removed'] ) ) {
	1301	+ $results['modified'][ $index ]['diff'] = array(
	1302	+ 'added' => array(),
	1303	+ 'removed' => array(),
	1304	+ 'unavailable' => true,
	1305	+ 'rescan' => true,
	1306	+ );
	1307	+ $changed = true;
	1308	+ }
	1309	+ continue;
	1310	+ }
	1311	+
	1312	+ foreach ( array( 'added', 'removed' ) as $side ) {
	1313	+ if ( empty( $item['diff'][ $side ] ) || ! is_array( $item['diff'][ $side ] ) ) {
	1314	+ continue;
	1315	+ }
	1316	+
	1317	+ foreach ( $item['diff'][ $side ] as $line_index => $line ) {
	1318	+ if ( ! is_array( $line ) || ! isset( $line['content'] ) || ! is_string( $line['content'] ) ) {
	1319	+ continue;
	1320	+ }
	1321	+
	1322	+ $safe = $this->redact_server_secrets( $line['content'] );
	1323	+
	1324	+ if ( $safe !== $line['content'] ) {
	1325	+ $results['modified'][ $index ]['diff'][ $side ][ $line_index ]['content'] = $safe;
	1326	+ $changed = true;
	1327	+ }
	1328	+ }
	1329	+ }
	1330	+ }
	1331	+
	1332	+ if ( $changed ) {
	1333	+ update_option( 'vigilante_last_integrity_results', $results );
	1334	+ }
	1335	+ }
	1336	+
	1337	+ /**
488	1338	* Clean up what earlier versions stored, wherever they stored it
489	1339	*
490	1340	* Two jobs, and the second one only exists on a network.
491	1341	*
		@@ -562,8 +1412,10 @@
562	1412	$this->write_baseline( $baseline );
563	1413	}
564	1414	}
565	1415
	1416	+ $this->redact_stored_results();
	1417	+
566	1418	/*
567	1419	* The gate does not close while a per-site copy is still waiting to be
568	1420	* promoted. Closing it would end the retries for a whole version: the
569	1421	* copy would sit there unread, the file it records would be missing
		@@ -617,8 +1469,10 @@
617	1469	if ( ! current_user_can( 'manage_network_options' ) ) {
618	1470	return;
619	1471	}
620	1472
	1473	+ $this->maybe_sweep_network_results();
	1474	+
621	1475	$marker = get_site_option( self::BASELINE_SWEEP_OPTION );
622	1476
623	1477	/*
624	1478	* Two markers, because there are two different things to remember and
		@@ -733,16 +1587,25 @@
733	1587	array( '# BEGIN Vigilante Security Headers', '# END Vigilante Security Headers' ),
734	1588	);
735	1589
736	1590	/**
	1591	+ * Whether the core is being compared with the English checksums because
	1592	+ * WordPress.org has none for the language of the site. Set by
	1593	+ * get_core_checksums().
	1594	+ *
	1595	+ * @var bool
	1596	+ */
	1597	+ private $core_checksums_are_english = false;
	1598	+
	1599	+ /**
737	1600	* Core files known to produce false positives in checksum comparison.
738		- * These are skipped during core scanning (e.g. version.php is rewritten
739		- * during auto-updates and localized installs, readme files vary by locale).
	1601	+ * These are skipped during core scanning: the readme and the license vary
	1602	+ * by locale and are not code. version.php used to be here too, and is now
	1603	+ * compared (see matches_core_of_other_locale()).
740	1604	*
741	1605	* @var array
742	1606	*/
743	1607	private $core_known_false_positives = array(
744		- 'wp-includes/version.php',
745	1608	'readme.html',
746	1609	'license.txt',
747	1610	'licencia.txt',
748	1611	);
		@@ -879,8 +1742,9 @@
879	1742	*/
880	1743	public function init_cleanup_hooks() {
881	1744	add_action( 'admin_init', array( $this, 'maybe_redact_stored_baseline' ) );
882	1745	add_action( 'admin_init', array( $this, 'maybe_sweep_network_baselines' ) );
	1746	+ add_action( 'admin_init', array( $this, 'maybe_claim_owned_blocks_on_admin' ) );
883	1747	}
884	1748
885	1749	/**
886	1750	* Check if scan time limit has been exceeded
		@@ -951,8 +1815,16 @@
951	1815	$files = array( $hook_extra['plugin'] );
952	1816	}
953	1817	foreach ( $files as $file ) {
954	1818	$slug = dirname( (string) $file );
	1819	+ // Vigilant itself is verified immediately (not after 90 s) by
	1820	+ // Vigilante_Self_Integrity::handle_upgrader() when the
	1821	+ // self-check is on; do not also open a grace window for it.
	1822	+ // Compared with the folder it really lives in, not the literal
	1823	+ // slug, so a renamed folder is skipped the same way.
	1824	+ if ( dirname( VIGILANTE_PLUGIN_BASENAME ) === $slug && Vigilante_Self_Integrity::is_on() ) {
	1825	+ continue;
	1826	+ }
955	1827	if ( '.' !== $slug && '' !== $slug ) {
956	1828	$targets['plugin'][] = $slug;
957	1829	}
958	1830	}
		@@ -1021,8 +1893,17 @@
1021	1893	*/
1022	1894	private function verify_updated_slug( $type, $slug ) {
1023	1895	$grace_key = 'vigilante_fi_grace_' . $type . '_' . md5( $slug );
1024	1896
	1897	+ // Defensive skip for the first 2.11.x -> 3.0.x update: the OLD code in
	1898	+ // memory scheduled this event including Vigilant's own slug, and by the
	1899	+ // time it fires the NEW code (this one) is running with the self-check
	1900	+ // handling Vigilant on its own.
	1901	+ if ( 'plugin' === $type && dirname( VIGILANTE_PLUGIN_BASENAME ) === $slug && Vigilante_Self_Integrity::is_on() ) {
	1902	+ delete_transient( $grace_key );
	1903	+ return;
	1904	+ }
	1905	+
1025	1906	if ( 'plugin' === $type ) {
1026	1907	if ( ! function_exists( 'get_plugins' ) ) {
1027	1908	require_once ABSPATH . 'wp-admin/includes/plugin.php';
1028	1909	}
		@@ -1173,8 +2054,56 @@
1173	2054
1174	2055	// Use settings from options page
1175	2056	$options = is_array( $this->options ) ? $this->options : array();
1176	2057
	2058	+ // Vigilant self-check runs FIRST and exempt from the time budget:
	2059	+ // ~60 small-file hashes cost < 50 ms and the guardian must never be
	2060	+ // dropped by the budget on plugin-heavy sites. User exclusions do not
	2061	+ // apply to it (see Vigilante_Self_Integrity::run_check()).
	2062	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	2063	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	2064	+ }
	2065	+ if ( Vigilante_Self_Integrity::is_on() ) {
	2066	+ if ( ! class_exists( 'Vigilante_Self_Integrity' ) ) {
	2067	+ require_once VIGILANTE_INCLUDES_DIR . 'class-self-integrity.php';
	2068	+ }
	2069	+ $self = new Vigilante_Self_Integrity( $this->settings, $this->activity_log );
	2070	+ $self_result = $self->run_check( 'scan' );
	2071	+ // run_check() above updates this site's own state (status line and
	2072	+ // the analyzer check keep working everywhere). The plugin files are
	2073	+ // shared by the whole installation, so the self findings are folded
	2074	+ // Self-protection has its own alert, and it does not travel in the
	2075	+ // scan digest any more. That digest is governed by a notification
	2076	+ // setting that can be switched off, and switching off "tell me about
	2077	+ // changed files" was also switching off the alarm of the plugin
	2078	+ // itself. So the findings stay out of the scan results (they have
	2079	+ // their own block in File Integrity, with what each one means and how
	2080	+ // to repair it) and a critical one sends its own email from here,
	2081	+ // wherever the scan runs. maybe_send_self_alert() keeps it to the
	2082	+ // site that owns the shared files and dedupes by set of findings.
	2083	+ foreach ( (array) $self_result['findings'] as $self_finding ) {
	2084	+ if ( 'critical' === ( $self_finding['severity'] ?? '' ) ) {
	2085	+ $self->maybe_send_self_alert( $self_result['findings'], 'scan' );
	2086	+ break;
	2087	+ }
	2088	+ }
	2089	+ }
	2090	+
	2091	+ // What the time does not reach. A scan that runs out of time used to
	2092	+ // say only that it was partial, and it starts from the beginning
	2093	+ // every time, so on a large site the same plugins and themes were
	2094	+ // left out on every scan with nobody told which. They are named.
	2095	+ $not_checked = array(
	2096	+ 'areas' => array(),
	2097	+ 'plugins' => array(),
	2098	+ 'themes' => array(),
	2099	+ );
	2100	+
	2101	+ // And the folders of the plugins and themes it did check, which is
	2102	+ // what the tab offers to exclude so that a scan by hand reaches the
	2103	+ // rest (see folders_to_exclude()).
	2104	+ $checked_folders = array();
	2105	+
1177	2106	// Scan uploads for suspicious files FIRST (highest security priority)
1178	2107	// PHP files in uploads are almost always malware
1179	2108	if ( ! empty( $options['scan_uploads'] ) && ! $this->is_time_exceeded() ) {
1180	2109	$upload_results = $this->scan_uploads();
		@@ -1179,8 +2108,11 @@
1179	2108	if ( ! empty( $options['scan_uploads'] ) && ! $this->is_time_exceeded() ) {
1180	2109	$upload_results = $this->scan_uploads();
1181	2110	$results['suspicious'] = array_merge( $results['suspicious'], $upload_results['suspicious'] );
1182	2111	$results['extra'] = array_merge( $results['extra'], $upload_results['extra'] );
	2112	+ $results['errors'] = array_merge( $results['errors'], $upload_results['errors'] ?? array() );
	2113	+ } elseif ( ! empty( $options['scan_uploads'] ) ) {
	2114	+ $not_checked['areas'][] = 'uploads';
1183	2115	}
1184	2116
1185	2117	// Scan core files
1186	2118	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
		@@ -1185,8 +2117,10 @@
1185	2117	// Scan core files
1186	2118	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
1187	2119	$core_results = $this->scan_core_files();
1188	2120	$results = $this->merge_results( $results, $core_results );
	2121	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2122	+ $not_checked['areas'][] = 'core';
1189	2123	}
1190	2124
1191	2125	// Scan root directory for non-core files (PHP = suspicious, others = additional)
1192	2126	// Runs after core scan so checksums are already cached
		@@ -1193,20 +2127,61 @@
1193	2127	if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
1194	2128	$root_results = $this->scan_root_files();
1195	2129	$results['suspicious'] = array_merge( $results['suspicious'], $root_results['suspicious'] );
1196	2130	$results['extra'] = array_merge( $results['extra'], $root_results['extra'] );
	2131	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2132	+ $not_checked['areas'][] = 'core';
1197	2133	}
1198	2134
	2135	+ // Files added to wp-admin or wp-includes, which the comparison with
	2136	+ // the checksums never visits because the checksums do not name them.
	2137	+ if ( ! empty( $options['scan_core'] ) && ! $this->is_time_exceeded() ) {
	2138	+ $folder_results = $this->scan_core_folders();
	2139	+ $results['suspicious'] = array_merge( $results['suspicious'], $folder_results['suspicious'] );
	2140	+ $results['extra'] = array_merge( $results['extra'], $folder_results['extra'] );
	2141	+ $results['errors'] = array_merge( $results['errors'], $folder_results['errors'] );
	2142	+ } elseif ( ! empty( $options['scan_core'] ) ) {
	2143	+ $not_checked['areas'][] = 'core';
	2144	+ }
	2145	+
1199	2146	// Scan critical config files (wp-config.php, .htaccess) against stored baseline
1200	2147	if ( ! empty( $options['scan_critical_config'] ) && ! $this->is_time_exceeded() ) {
1201	2148	$critical_results = $this->scan_critical_root_files();
1202	2149	$results['modified'] = array_merge( $results['modified'], $critical_results );
	2150	+ } elseif ( ! empty( $options['scan_critical_config'] ) ) {
	2151	+ $not_checked['areas'][] = 'config';
1203	2152	}
1204	2153
	2154	+ // The other folders of wp-content (cache, languages, upgrade and
	2155	+ // whatever else is there), which belong to no plugin and no theme and
	2156	+ // had no turn. Before the plugins and the themes, which on a large
	2157	+ // site can use up the whole scan, and with a share of the time of
	2158	+ // their own, so a cache of a hundred thousand files cannot do the
	2159	+ // same to them.
	2160	+ $content_results = null;
	2161	+ if ( ! empty( $options['scan_plugins'] ) && ! $this->is_time_exceeded() ) {
	2162	+ $content_results = $this->scan_content_folders();
	2163	+ $results['suspicious'] = array_merge( $results['suspicious'], $content_results['suspicious'] );
	2164	+ $results['extra'] = array_merge( $results['extra'], $content_results['extra'] );
	2165	+ $results['errors'] = array_merge( $results['errors'], $content_results['errors'] );
	2166	+ } elseif ( ! empty( $options['scan_plugins'] ) ) {
	2167	+ $not_checked['areas'][] = 'content';
	2168	+ }
	2169	+
1205	2170	// Scan plugins
1206	2171	if ( ! empty( $options['scan_plugins'] ) && ! $this->is_time_exceeded() ) {
1207	2172	$plugin_results = $this->scan_plugins();
1208	2173	$results = $this->merge_results( $results, $plugin_results );
	2174	+
	2175	+ $not_checked['plugins'] = $plugin_results['not_checked'] ?? array();
	2176	+ $checked_folders = $plugin_results['checked'] ?? array();
	2177	+
	2178	+ if ( empty( $plugin_results['unlisted_checked'] ) ) {
	2179	+ $not_checked['areas'][] = 'unlisted';
	2180	+ }
	2181	+ } elseif ( ! empty( $options['scan_plugins'] ) ) {
	2182	+ $not_checked['areas'][] = 'plugins';
	2183	+ $not_checked['areas'][] = 'unlisted';
1209	2184	}
1210	2185
1211	2186	// Scan themes
1212	2187	if ( ! empty( $options['scan_themes'] ) && ! $this->is_time_exceeded() ) {
		@@ -1211,10 +2186,21 @@
1211	2186	// Scan themes
1212	2187	if ( ! empty( $options['scan_themes'] ) && ! $this->is_time_exceeded() ) {
1213	2188	$theme_results = $this->scan_themes();
1214	2189	$results = $this->merge_results( $results, $theme_results );
	2190	+
	2191	+ $not_checked['themes'] = $theme_results['not_checked'] ?? array();
	2192	+ $checked_folders = array_merge( $checked_folders, $theme_results['checked'] ?? array() );
	2193	+ } elseif ( ! empty( $options['scan_themes'] ) ) {
	2194	+ $not_checked['areas'][] = 'themes';
1215	2195	}
1216	2196
	2197	+ // What could only be searched for hidden code: plugins and themes
	2198	+ // first, as they are found, and the folders of wp-content after them.
	2199	+ if ( null !== $content_results ) {
	2200	+ $results['unverified'] = array_values( array_unique( array_merge( $results['unverified'] ?? array(), $content_results['unverified'] ) ) );
	2201	+ }
	2202	+
1217	2203	// Mark as incomplete if time was exceeded
1218	2204	if ( $this->is_time_exceeded() ) {
1219	2205	$results['incomplete'] = true;
1220	2206	$results['errors'][] = __( 'Scan was incomplete due to time limit. Results may be partial.', 'vigilante' );
		@@ -1219,8 +2205,19 @@
1219	2205	$results['incomplete'] = true;
1220	2206	$results['errors'][] = __( 'Scan was incomplete due to time limit. Results may be partial.', 'vigilante' );
1221	2207	}
1222	2208
	2209	+ // Stored after the last merge: merge_results() keeps only the keys it
	2210	+ // knows.
	2211	+ $not_checked['areas'] = array_values( array_unique( $not_checked['areas'] ) );
	2212	+ $results['not_checked'] = $not_checked;
	2213	+
	2214	+ // Only with plugins or themes left out: a scan that reached them all
	2215	+ // has nothing to make room for.
	2216	+ if ( ! empty( $not_checked['plugins'] ) || ! empty( $not_checked['themes'] ) || array_intersect( array( 'plugins', 'themes' ), $not_checked['areas'] ) ) {
	2217	+ $results['checked_folders'] = array_values( array_unique( $checked_folders ) );
	2218	+ }
	2219	+
1223	2220	// Filter out ignored files from all result categories
1224	2221	$results['modified'] = $this->filter_ignored( $results['modified'] );
1225	2222	$results['suspicious'] = $this->filter_ignored( $results['suspicious'] );
1226	2223	$results['extra'] = $this->filter_ignored( $results['extra'] );
		@@ -1231,14 +2228,21 @@
1231	2228	if ( $this->activity_log ) {
1232	2229	$has_issues = ! empty( $results['modified'] ) || ! empty( $results['suspicious'] ) || ! empty( $results['extra'] );
1233	2230	$severity = $has_issues ? 'warning' : 'info';
1234	2231
	2232	+ /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
	2233	+ $log_text = __( 'File integrity scan completed: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' );
	2234	+
	2235	+ if ( $results['incomplete'] ) {
	2236	+ /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
	2237	+ $log_text = __( 'File integrity scan ran out of time, so its result is partial: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' );
	2238	+ }
	2239	+
1235	2240	$this->activity_log->log(
1236	2241	'file',
1237	2242	'integrity_scan',
1238	2243	sprintf(
1239		- /* translators: 1: Scanned count, 2: Modified count, 3: Suspicious count, 4: Extra files count */
1240		- __( 'File integrity scan completed: %1$d files scanned, %2$d modified, %3$d suspicious, %4$d extra', 'vigilante' ),
	2244	+ $log_text,
1241	2245	$results['scanned'],
1242	2246	count( $results['modified'] ),
1243	2247	count( $results['suspicious'] ),
1244	2248	count( $results['extra'] )
		@@ -1293,9 +2297,10 @@
1293	2297	'errors' => array(),
1294	2298	);
1295	2299
1296	2300	// Get official checksums from WordPress.org
1297		- $checksums = $this->get_core_checksums();
	2301	+ $this->core_checksums_are_english = false;
	2302	+ $checksums = $this->get_core_checksums();
1298	2303
1299	2304	if ( is_wp_error( $checksums ) ) {
1300	2305	$results['errors'][] = $checksums->get_error_message();
1301	2306	return $results;
		@@ -1300,8 +2305,37 @@
1300	2305	$results['errors'][] = $checksums->get_error_message();
1301	2306	return $results;
1302	2307	}
1303	2308
	2309	+ // The plugins and themes that get a turn of their own in this scan.
	2310	+ $own_turn = array(
	2311	+ 'plugins' => array(),
	2312	+ 'themes' => array(),
	2313	+ );
	2314	+
	2315	+ if ( ! empty( $this->options['scan_plugins'] ) ) {
	2316	+ if ( ! function_exists( 'get_plugins' ) ) {
	2317	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	2318	+ }
	2319	+
	2320	+ foreach ( array_keys( get_plugins() ) as $plugin_file ) {
	2321	+ $slash = strpos( $plugin_file, '/' );
	2322	+
	2323	+ if ( false !== $slash ) {
	2324	+ $own_turn['plugins'][ substr( $plugin_file, 0, $slash ) ] = true;
	2325	+ }
	2326	+ }
	2327	+ }
	2328	+
	2329	+ if ( ! empty( $this->options['scan_themes'] ) ) {
	2330	+ foreach ( array_keys( wp_get_themes() ) as $stylesheet ) {
	2331	+ $stylesheet = (string) $stylesheet;
	2332	+ $slash = strpos( $stylesheet, '/' );
	2333	+
	2334	+ $own_turn['themes'][ false === $slash ? $stylesheet : substr( $stylesheet, 0, $slash ) ] = true;
	2335	+ }
	2336	+ }
	2337	+
1304	2338	foreach ( $checksums as $file => $expected_hash ) {
1305	2339	// Check time limit
1306	2340	if ( $this->is_time_exceeded() ) {
1307	2341	break;
		@@ -1318,9 +2352,9 @@
1318	2352	if ( $this->is_extension_excluded( $file_path ) ) {
1319	2353	continue;
1320	2354	}
1321	2355
1322		- // Skip known false positives (e.g. version.php, readme.html)
	2356	+ // Skip known false positives (e.g. readme.html, license.txt)
1323	2357	if ( in_array( $file, $this->core_known_false_positives, true ) ) {
1324	2358	continue;
1325	2359	}
1326	2360
		@@ -1335,8 +2369,30 @@
1335	2369	|| 0 === strpos( $file, 'wp-content/languages/themes/' ) ) {
1336	2370	continue;
1337	2371	}
1338	2372
	2373	+ // The bundled themes and plugins have their own turn. Akismet and
	2374	+ // the default themes are in this list at the version WordPress
	2375	+ // shipped, and they update on their own cycle: every one of those
	2376	+ // updates showed as a modified core file, and deleting one that is
	2377	+ // not in use as missing core files. The plugin and theme scans
	2378	+ // compare them with their own published copy, so they are left to
	2379	+ // those whenever those are on and have them in their list.
	2380	+ if ( preg_match( '#^wp-content/(plugins|themes)/([^/]+)/#', $file, $bundled ) ) {
	2381	+ // Deleted on purpose: nothing to compare and nothing missing.
	2382	+ if ( ! is_dir( ABSPATH . 'wp-content/' . $bundled[1] . '/' . $bundled[2] ) ) {
	2383	+ continue;
	2384	+ }
	2385	+
	2386	+ // Its own scan compares it, but only what WordPress lists as a
	2387	+ // plugin or as a theme gets that turn. A folder that is there
	2388	+ // and is not listed (a plugin without its header, a theme
	2389	+ // without its style.css) stays with the core.
	2390	+ if ( isset( $own_turn[ $bundled[1] ][ $bundled[2] ] ) ) {
	2391	+ continue;
	2392	+ }
	2393	+ }
	2394	+
1339	2395	$results['scanned']++;
1340	2396
1341	2397	if ( ! file_exists( $file_path ) ) {
1342	2398	$results['missing'][] = array(
		@@ -1347,9 +2403,22 @@
1347	2403	}
1348	2404
1349	2405	$actual_hash = md5_file( $file_path );
1350	2406
1351		- if ( $actual_hash !== $expected_hash ) {
	2407	+ if ( $actual_hash !== $expected_hash && ! $this->matches_core_of_other_locale( $file, $actual_hash ) ) {
	2408	+ // The two files a translated package changes cannot be told
	2409	+ // from a modified one while only the English list exists. Said
	2410	+ // as what it is, a file that could not be verified, instead of
	2411	+ // as a modified core file.
	2412	+ if ( $this->core_checksums_are_english && in_array( $file, array( 'wp-includes/version.php', 'wp-config-sample.php' ), true ) ) {
	2413	+ $results['errors'][] = sprintf(
	2414	+ /* translators: %s: File name */
	2415	+ __( '%s differs from the English package of WordPress, and WordPress.org has not published the checksums for the language of this site yet, so it could not be verified.', 'vigilante' ),
	2416	+ $file
	2417	+ );
	2418	+ continue;
	2419	+ }
	2420	+
1352	2421	$results['modified'][] = array(
1353	2422	'file' => $file,
1354	2423	'type' => 'core',
1355	2424	'expected_hash' => $expected_hash,
		@@ -1463,9 +2532,9 @@
1463	2532
1464	2533	// Also add wp-config.php which is not in checksums but is core
1465	2534	$core_root_files[] = 'wp-config.php';
1466	2535
1467		- $php_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar', 'phps' );
	2536	+ $php_extensions = self::php_extensions();
1468	2537
1469	2538	// Scan only direct children of ABSPATH (not recursive)
1470	2539	$root_path = untrailingslashit( ABSPATH );
1471	2540	$handle = opendir( $root_path );
		@@ -1483,9 +2552,22 @@
1483	2552	if ( '.' === $entry || '..' === $entry ) {
1484	2553	continue;
1485	2554	}
1486	2555
1487		- // Skip dotfiles (.htaccess, .user.ini, .env, etc.) — handled by firewall protection
	2556	+ // PHP reads .user.ini and php.ini from the folder of the script, and
	2557	+ // either can make it load a file before every request: the same
	2558	+ // door as .htaccess, for servers that run PHP outside Apache.
	2559	+ if ( in_array( strtolower( $entry ), array( '.user.ini', 'php.ini' ), true ) ) {
	2560	+ $config = $this->is_path_excluded( $root_path . '/' . $entry ) ? null : self::server_config_finding( $root_path . '/' . $entry, $entry );
	2561	+
	2562	+ if ( $config ) {
	2563	+ $config['item']['type'] = 'php_config_in_root';
	2564	+ $found['extra'][] = $config['item'];
	2565	+ }
	2566	+ continue;
	2567	+ }
	2568	+
	2569	+ // Skip dotfiles (.htaccess, .env, etc.): handled by firewall protection
1488	2570	if ( 0 === strpos( $entry, '.' ) ) {
1489	2571	continue;
1490	2572	}
1491	2573
		@@ -1510,8 +2592,13 @@
1510	2592	if ( in_array( strtolower( $entry ), $this->known_safe_root_files, true ) ) {
1511	2593	continue;
1512	2594	}
1513	2595
	2596	+ // Site verification files and sitemaps that are what their name says.
	2597	+ if ( self::is_harmless_root_file( $entry, $full_path ) ) {
	2598	+ continue;
	2599	+ }
	2600	+
1514	2601	$extension = strtolower( pathinfo( $entry, PATHINFO_EXTENSION ) );
1515	2602
1516	2603	if ( in_array( $extension, $php_extensions, true ) ) {
1517	2604	// Check if this is a legacy WordPress core file (removed from newer versions)
		@@ -1533,15 +2620,12 @@
1533	2620	// PHP file not in core = suspicious
1534	2621	$reason = __( 'Non-core PHP file in WordPress root directory', 'vigilante' );
1535	2622
1536	2623	// Scan content for specific patterns
1537		- if ( filesize( $full_path ) < 512000 ) {
1538		- $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
1539		- $pattern = $this->detect_suspicious_pattern( $content );
1540		- if ( $pattern ) {
1541		- /* translators: %s: Suspicious pattern found */
1542		- $reason = sprintf( __( 'Non-core PHP in root with suspicious code: %s', 'vigilante' ), $pattern );
1543		- }
	2624	+ $pattern = $this->search_file( $full_path );
	2625	+ if ( $pattern ) {
	2626	+ /* translators: %s: Suspicious pattern found */
	2627	+ $reason = sprintf( __( 'Non-core PHP in root with suspicious code: %s', 'vigilante' ), $pattern );
1544	2628	}
1545	2629
1546	2630	$found['suspicious'][] = array(
1547	2631	'file' => $entry,
		@@ -1548,8 +2632,20 @@
1548	2632	'type' => 'php_in_root',
1549	2633	'reason' => $reason,
1550	2634	);
1551	2635	} else {
	2636	+ // A copy of the configuration, a database dump or an archive
	2637	+ // is not one more loose file: whoever guesses its name can
	2638	+ // download it.
	2639	+ if ( false !== stripos( $entry, 'wp-config' ) || preg_match( '/\.(?:sql|bak|old|orig|save|swp|dump|zip|gz|tgz|tar|7z|rar)$/i', $entry ) ) {
	2640	+ $found['extra'][] = array(
	2641	+ 'file' => $entry,
	2642	+ 'type' => 'backup_in_root',
	2643	+ 'reason' => __( 'Backup or copy of a sensitive file in the site root, where it can be downloaded', 'vigilante' ),
	2644	+ );
	2645	+ continue;
	2646	+ }
	2647	+
1552	2648	// Non-PHP, non-known-safe file = additional (informational)
1553	2649	$found['extra'][] = array(
1554	2650	'file' => $entry,
1555	2651	'type' => 'extra_root',
		@@ -1562,8 +2658,864 @@
1562	2658
1563	2659	return $found;
1564	2660	}
1565	2661
	2662	+ /**
	2663	+ * The line of a .user.ini or php.ini that makes PHP load a file by itself
	2664	+ *
	2665	+ * @param string $path Absolute path of the file.
	2666	+ * @return string|null The line, an empty string when there is none, or
	2667	+ * null when the file is too large to be read, which
	2668	+ * the caller reports instead of taking for clean.
	2669	+ */
	2670	+ private static function php_ini_loads( $path ) {
	2671	+ // PHP runs as the same user: what it cannot read here it cannot apply.
	2672	+ if ( ! is_readable( $path ) ) {
	2673	+ return '';
	2674	+ }
	2675	+
	2676	+ if ( filesize( $path ) > MB_IN_BYTES ) {
	2677	+ return null;
	2678	+ }
	2679	+
	2680	+ $content = file_get_contents( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look at its directives; nothing is written.
	2681	+
	2682	+ foreach ( preg_split( '/\r\n|\r|\n/', (string) $content ) as $line ) {
	2683	+ $line = trim( $line );
	2684	+
	2685	+ if ( '' === $line || ';' === $line[0] || '#' === $line[0] ) {
	2686	+ continue;
	2687	+ }
	2688	+
	2689	+ if ( preg_match( '/^(auto_prepend_file|auto_append_file)\s*=\s*(.*)$/i', $line, $parts ) ) {
	2690	+ $value = trim( $parts[2], " \t\"'" );
	2691	+
	2692	+ if ( '' !== $value && 'none' !== strtolower( $value ) ) {
	2693	+ return strtolower( $parts[1] ) . ' = ' . substr( $value, 0, 200 );
	2694	+ }
	2695	+ }
	2696	+ }
	2697	+
	2698	+ return '';
	2699	+ }
	2700	+
	2701	+ /**
	2702	+ * What a .htaccess, .user.ini or php.ini outside uploads makes the server do
	2703	+ *
	2704	+ * Inside a plugin, a theme, wp-content or a WordPress folder, one of these
	2705	+ * files is a finding only when it makes the server run code or load a file.
	2706	+ * One that denies access, or does nothing of the kind, is left alone.
	2707	+ *
	2708	+ * @param string $file_path Absolute path.
	2709	+ * @param string $relative Path for display.
	2710	+ * @return array|null Array with 'category' and 'item', or null.
	2711	+ */
	2712	+ private static function server_config_finding( $file_path, $relative ) {
	2713	+ $item = array(
	2714	+ 'file' => $relative,
	2715	+ 'type' => 'server_config',
	2716	+ );
	2717	+
	2718	+ if ( '.htaccess' === strtolower( basename( $file_path ) ) ) {
	2719	+ if ( ! is_readable( $file_path ) ) {
	2720	+ return null;
	2721	+ }
	2722	+
	2723	+ if ( filesize( $file_path ) >= 65536 ) {
	2724	+ $item['reason'] = __( '.htaccess file that is too large to be read', 'vigilante' );
	2725	+
	2726	+ return array(
	2727	+ 'category' => 'extra',
	2728	+ 'item' => $item,
	2729	+ );
	2730	+ }
	2731	+
	2732	+ $facts = self::read_htaccess_rules( file_get_contents( $file_path ) ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look at its directives; nothing is written.
	2733	+
	2734	+ if ( empty( $facts['runs'] ) ) {
	2735	+ return null;
	2736	+ }
	2737	+
	2738	+ $item['reason'] = self::htaccess_run_reason( $facts );
	2739	+
	2740	+ return array(
	2741	+ 'category' => 'suspicious',
	2742	+ 'item' => $item,
	2743	+ );
	2744	+ }
	2745	+
	2746	+ $loads = self::php_ini_loads( $file_path );
	2747	+
	2748	+ if ( '' === $loads ) {
	2749	+ return null;
	2750	+ }
	2751	+
	2752	+ $item['reason'] = null === $loads
	2753	+ ? __( 'PHP configuration file that is too large to be read', 'vigilante' )
	2754	+ /* translators: %s: The line of the file that does it */
	2755	+ : sprintf( __( 'PHP configuration file that loads a file on every request: %s', 'vigilante' ), $loads );
	2756	+
	2757	+ return array(
	2758	+ 'category' => 'extra',
	2759	+ 'item' => $item,
	2760	+ );
	2761	+ }
	2762	+
	2763	+ /**
	2764	+ * Whether a loose file in the site root is a verification file or a sitemap
	2765	+ *
	2766	+ * By what it contains or by its kind, never by its name alone: a Google
	2767	+ * verification file is one line that repeats its own name, and a sitemap
	2768	+ * is XML, which no server runs.
	2769	+ *
	2770	+ * @param string $entry File name.
	2771	+ * @param string $full_path Absolute path.
	2772	+ * @return bool
	2773	+ */
	2774	+ private static function is_harmless_root_file( $entry, $full_path ) {
	2775	+ if ( preg_match( '/^[a-z0-9_-]*sitemap[a-z0-9_-]*\.xml(?:\.gz)?$/i', $entry ) ) {
	2776	+ return true;
	2777	+ }
	2778	+
	2779	+ if ( preg_match( '/^google[0-9a-f]{16}\.html$/', $entry ) && is_readable( $full_path ) && filesize( $full_path ) < 200 ) {
	2780	+ $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to compare it with its own name; nothing is written.
	2781	+
	2782	+ return 'google-site-verification: ' . $entry === trim( (string) $content );
	2783	+ }
	2784	+
	2785	+ return false;
	2786	+ }
	2787	+
	2788	+ /**
	2789	+ * Walk a folder and everything under it without stopping at what cannot be read
	2790	+ *
	2791	+ * A folder PHP cannot open used to end the whole walk in silence, which is
	2792	+ * all it took to blind a scan: one unreadable folder early in the order,
	2793	+ * and nothing after it was looked at. Now the walk goes past it, and the
	2794	+ * caller reports it (see unreadable_folder_error()).
	2795	+ *
	2796	+ * @param string $directory Folder to walk.
	2797	+ * @param callable|null $skip Given the path of a folder, whether to leave
	2798	+ * it and everything under it out of the walk.
	2799	+ * @return RecursiveIteratorIterator Folders included: the caller skips them.
	2800	+ */
	2801	+ private static function walk_folder( $directory, $skip = null ) {
	2802	+ $folder = new RecursiveDirectoryIterator( $directory, RecursiveDirectoryIterator::SKIP_DOTS );
	2803	+
	2804	+ if ( null !== $skip ) {
	2805	+ $folder = new RecursiveCallbackFilterIterator(
	2806	+ $folder,
	2807	+ static function ( $current ) use ( $skip ) {
	2808	+ return ! ( $current->isDir() && call_user_func( $skip, $current->getPathname() ) );
	2809	+ }
	2810	+ );
	2811	+ }
	2812	+
	2813	+ return new RecursiveIteratorIterator(
	2814	+ $folder,
	2815	+ RecursiveIteratorIterator::SELF_FIRST,
	2816	+ RecursiveIteratorIterator::CATCH_GET_CHILD
	2817	+ );
	2818	+ }
	2819	+
	2820	+ /**
	2821	+ * What the scan says about a folder it could not read
	2822	+ *
	2823	+ * @param string $path Absolute path of the folder.
	2824	+ * @return string
	2825	+ */
	2826	+ private static function unreadable_folder_error( $path ) {
	2827	+ return sprintf(
	2828	+ /* translators: %s: Folder path */
	2829	+ __( 'The folder %s could not be read, so what is inside it was not checked.', 'vigilante' ),
	2830	+ str_replace( ABSPATH, '', $path )
	2831	+ );
	2832	+ }
	2833	+
	2834	+ /**
	2835	+ * Extensions a server may be set up to run as PHP
	2836	+ *
	2837	+ * One list for uploads, the site root, the core folders and the plugin and
	2838	+ * theme folders. Each had its own until now, and none had them all.
	2839	+ *
	2840	+ * @return array
	2841	+ */
	2842	+ private static function php_extensions() {
	2843	+ return array( 'php', 'php2', 'php3', 'php4', 'php5', 'php6', 'php7', 'php8', 'phtml', 'pht', 'phar', 'phps', 'inc' );
	2844	+ }
	2845	+
	2846	+ /**
	2847	+ * Look in wp-admin and wp-includes for files WordPress does not ship
	2848	+ *
	2849	+ * The comparison with the official checksums only visits the files the
	2850	+ * checksums name, so a file added to either folder was never looked at. A
	2851	+ * PHP file there that is not part of the installed version is reported as
	2852	+ * suspicious. A file that changes how the server runs code (.htaccess,
	2853	+ * .user.ini, php.ini) is reported as extra, or as suspicious when it
	2854	+ * makes the server run code. Anything else that is not code, such as an
	2855	+ * error log the host writes there, is left alone.
	2856	+ *
	2857	+ * @return array Array with 'suspicious', 'extra' and 'errors' sub-arrays.
	2858	+ */
	2859	+ private function scan_core_folders() {
	2860	+ $found = array(
	2861	+ 'suspicious' => array(),
	2862	+ 'extra' => array(),
	2863	+ 'errors' => array(),
	2864	+ );
	2865	+
	2866	+ $checksums = $this->get_core_checksums();
	2867	+ if ( is_wp_error( $checksums ) ) {
	2868	+ return $found;
	2869	+ }
	2870	+
	2871	+ $php_extensions = self::php_extensions();
	2872	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	2873	+
	2874	+ foreach ( array( 'wp-admin', 'wp-includes' ) as $folder ) {
	2875	+ $directory = ABSPATH . $folder;
	2876	+
	2877	+ if ( ! is_dir( $directory ) ) {
	2878	+ continue;
	2879	+ }
	2880	+
	2881	+ try {
	2882	+ foreach ( self::walk_folder( $directory ) as $file ) {
	2883	+ if ( $this->is_time_exceeded() ) {
	2884	+ break 2;
	2885	+ }
	2886	+
	2887	+ $file_path = $file->getPathname();
	2888	+
	2889	+ if ( $file->isDir() ) {
	2890	+ if ( ! $file->isReadable() ) {
	2891	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	2892	+ }
	2893	+ continue;
	2894	+ }
	2895	+
	2896	+ $relative = $this->normalize_rel_path( str_replace( '\\', '/', str_replace( ABSPATH, '', $file_path ) ) );
	2897	+
	2898	+ if ( isset( $checksums[ $relative ] ) || $this->is_path_excluded( $file_path ) ) {
	2899	+ continue;
	2900	+ }
	2901	+
	2902	+ $extension = strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) );
	2903	+
	2904	+ if ( in_array( $extension, $php_extensions, true ) ) {
	2905	+ // The placeholder some hosts and tools drop in every folder.
	2906	+ if ( $this->is_silence_golden_file( $file_path ) ) {
	2907	+ continue;
	2908	+ }
	2909	+
	2910	+ // Translation files, on the installations old enough
	2911	+ // to keep them in wp-includes/languages: text and
	2912	+ // nothing else, which is checked and not assumed.
	2913	+ if ( self::is_inside_languages( $file_path ) && true === $this->is_literal_data( $file_path ) ) {
	2914	+ continue;
	2915	+ }
	2916	+
	2917	+ /* translators: %s: Folder name, wp-admin or wp-includes */
	2918	+ $reason = sprintf( __( 'File in %s that is not part of the installed WordPress version', 'vigilante' ), $folder );
	2919	+
	2920	+ $pattern = $this->search_file( $file_path );
	2921	+ if ( $pattern ) {
	2922	+ /* translators: 1: Folder name, wp-admin or wp-includes, 2: Suspicious pattern found */
	2923	+ $reason = sprintf( __( 'File in %1$s that is not part of WordPress, with suspicious code: %2$s', 'vigilante' ), $folder, $pattern );
	2924	+ }
	2925	+
	2926	+ $found['suspicious'][] = array(
	2927	+ 'file' => $relative,
	2928	+ 'type' => 'php_in_core',
	2929	+ 'reason' => $reason,
	2930	+ );
	2931	+ } elseif ( in_array( strtolower( basename( $file_path ) ), $config_files, true ) ) {
	2932	+ $config = self::server_config_finding( $file_path, $relative );
	2933	+
	2934	+ if ( $config && 'suspicious' === $config['category'] ) {
	2935	+ $found['suspicious'][] = $config['item'];
	2936	+ continue;
	2937	+ }
	2938	+
	2939	+ $found['extra'][] = array(
	2940	+ 'file' => $relative,
	2941	+ 'type' => 'config_in_core',
	2942	+ /* translators: %s: Folder name, wp-admin or wp-includes */
	2943	+ 'reason' => $config ? $config['item']['reason'] : sprintf( __( 'Server configuration file in %s', 'vigilante' ), $folder ),
	2944	+ );
	2945	+ }
	2946	+ }
	2947	+ } catch ( Exception $e ) {
	2948	+ $found['errors'][] = self::unreadable_folder_error( $directory );
	2949	+ }
	2950	+ }
	2951	+
	2952	+ return $found;
	2953	+ }
	2954	+
	2955	+ /**
	2956	+ * Look for code where there is no official copy to compare with
	2957	+ *
	2958	+ * Must-use plugins, drop-ins, the loose PHP files of wp-content, of the
	2959	+ * plugins folder and of the themes folder, and the folders in those two
	2960	+ * that WordPress does not list as a plugin or as a theme, were not opened
	2961	+ * by any part of the scan, although WordPress loads some of them on every
	2962	+ * request and the rest can be reached by their address. They are searched
	2963	+ * the way a plugin from outside WordPress.org is, for code written the way
	2964	+ * malware hides itself. A loose PHP file or a folder with PHP that is
	2965	+ * neither a plugin, a theme nor a drop-in is listed as extra, and so is a
	2966	+ * .htaccess, .user.ini or php.ini there that makes the server run code or
	2967	+ * load a file.
	2968	+ *
	2969	+ * @return array Array with 'suspicious', 'extra', 'unverified' and 'errors' sub-arrays.
	2970	+ */
	2971	+ private function scan_unlisted_code() {
	2972	+ $found = array(
	2973	+ 'suspicious' => array(),
	2974	+ 'extra' => array(),
	2975	+ 'unverified' => array(),
	2976	+ 'errors' => array(),
	2977	+ );
	2978	+
	2979	+ // Must-use plugins: the whole folder.
	2980	+ if ( defined( 'WPMU_PLUGIN_DIR' ) && is_dir( WPMU_PLUGIN_DIR ) ) {
	2981	+ $mu = $this->detect_extra_files( WPMU_PLUGIN_DIR, array(), 'plugin', __( 'Must-use plugins', 'vigilante' ), true );
	2982	+
	2983	+ $found['suspicious'] = array_merge( $found['suspicious'], $mu['suspicious'] );
	2984	+ $found['extra'] = array_merge( $found['extra'], $mu['extra'] );
	2985	+ $found['errors'] = array_merge( $found['errors'], $mu['errors'] );
	2986	+
	2987	+ if ( $mu['php_files'] > 0 ) {
	2988	+ $found['unverified'][] = __( 'Must-use plugins', 'vigilante' );
	2989	+ }
	2990	+ }
	2991	+
	2992	+ if ( ! function_exists( '_get_dropins' ) || ! function_exists( 'get_plugins' ) ) {
	2993	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	2994	+ }
	2995	+
	2996	+ $php_extensions = self::php_extensions();
	2997	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	2998	+ $dropins = array_keys( _get_dropins() );
	2999	+
	3000	+ // What WordPress lists as a plugin or as a theme, by the file or the
	3001	+ // folder it lives in.
	3002	+ $single_plugins = array();
	3003	+ $plugin_folders = array();
	3004	+ foreach ( get_plugins() as $plugin_file => $plugin_data ) {
	3005	+ if ( false === strpos( $plugin_file, '/' ) ) {
	3006	+ $single_plugins[ $plugin_file ] = $plugin_data['Name'] ?? $plugin_file;
	3007	+ } else {
	3008	+ $plugin_folders[ substr( $plugin_file, 0, strpos( $plugin_file, '/' ) ) ] = true;
	3009	+ }
	3010	+ }
	3011	+
	3012	+ // The themes by where they really are, because there can be more
	3013	+ // than one folder of themes and the same name in two of them.
	3014	+ $theme_folders = array();
	3015	+ foreach ( wp_get_themes() as $stylesheet => $theme ) {
	3016	+ $stylesheet = (string) $stylesheet;
	3017	+ $slash = strpos( $stylesheet, '/' );
	3018	+ $real = realpath( untrailingslashit( $theme->get_theme_root() ) . '/' . ( false === $slash ? $stylesheet : substr( $stylesheet, 0, $slash ) ) );
	3019	+
	3020	+ if ( false !== $real ) {
	3021	+ $theme_folders[ wp_normalize_path( $real ) ] = true;
	3022	+ }
	3023	+ }
	3024	+
	3025	+ $roots = array(
	3026	+ array( 'content', WP_CONTENT_DIR ),
	3027	+ array( 'plugins', WP_PLUGIN_DIR ),
	3028	+ );
	3029	+
	3030	+ // Every folder themes are registered in, not only the usual one. One
	3031	+ // that is inside a plugin belongs to that plugin, and has its turn
	3032	+ // with it.
	3033	+ global $wp_theme_directories;
	3034	+
	3035	+ $plugin_roots = array();
	3036	+ foreach ( array( WP_PLUGIN_DIR, defined( 'WPMU_PLUGIN_DIR' ) ? WPMU_PLUGIN_DIR : '' ) as $plugin_root ) {
	3037	+ $real = '' === (string) $plugin_root ? false : realpath( $plugin_root );
	3038	+
	3039	+ if ( false !== $real ) {
	3040	+ $plugin_roots[ wp_normalize_path( $real ) ] = true;
	3041	+ }
	3042	+ }
	3043	+
	3044	+ $theme_roots = array();
	3045	+ foreach ( array_merge( array( get_theme_root() ), is_array( $wp_theme_directories ) ? $wp_theme_directories : array() ) as $theme_root ) {
	3046	+ $real = '' === (string) $theme_root ? false : realpath( $theme_root );
	3047	+ $real = false === $real ? '' : wp_normalize_path( $real );
	3048	+
	3049	+ if ( '' === $real || isset( $theme_roots[ $real ] ) || self::is_inside_any( $real, $plugin_roots ) ) {
	3050	+ continue;
	3051	+ }
	3052	+
	3053	+ $theme_roots[ $real ] = true;
	3054	+ $roots[] = array( 'themes', untrailingslashit( $theme_root ) );
	3055	+ }
	3056	+
	3057	+ foreach ( $roots as $root ) {
	3058	+ list( $kind, $directory ) = $root;
	3059	+
	3060	+ $entries = is_dir( $directory ) ? scandir( $directory ) : false;
	3061	+
	3062	+ if ( ! is_array( $entries ) ) {
	3063	+ continue;
	3064	+ }
	3065	+
	3066	+ foreach ( $entries as $entry ) {
	3067	+ if ( '.' === $entry || '..' === $entry ) {
	3068	+ continue;
	3069	+ }
	3070	+
	3071	+ if ( $this->is_time_exceeded() ) {
	3072	+ break 2;
	3073	+ }
	3074	+
	3075	+ $path = $directory . '/' . $entry;
	3076	+
	3077	+ if ( $this->is_path_excluded( $path ) ) {
	3078	+ continue;
	3079	+ }
	3080	+
	3081	+ $relative = str_replace( ABSPATH, '', $path );
	3082	+
	3083	+ // A folder among the plugins or the themes that WordPress does
	3084	+ // not list as one: no scan had a turn for it.
	3085	+ if ( is_dir( $path ) ) {
	3086	+ $real = realpath( $path );
	3087	+ $listed = 'plugins' === $kind ? isset( $plugin_folders[ $entry ] ) : ( 'themes' === $kind ? ( false !== $real && isset( $theme_folders[ wp_normalize_path( $real ) ] ) ) : true );
	3088	+
	3089	+ // A link is followed like any other folder, because what
	3090	+ // is behind it is reached by its address just the same,
	3091	+ // unless it leads back to wp-content or above it, which
	3092	+ // would be walking the site a second time.
	3093	+ if ( $listed || ( is_link( $path ) && self::leads_back( $path ) ) ) {
	3094	+ continue;
	3095	+ }
	3096	+
	3097	+ $inside = $this->detect_extra_files( $path, array(), 'themes' === $kind ? 'theme' : 'plugin', $entry, true );
	3098	+
	3099	+ $found['suspicious'] = array_merge( $found['suspicious'], $inside['suspicious'] );
	3100	+ $found['extra'] = array_merge( $found['extra'], $inside['extra'] );
	3101	+ $found['errors'] = array_merge( $found['errors'], $inside['errors'] );
	3102	+
	3103	+ if ( $inside['php_files'] > 0 ) {
	3104	+ $found['extra'][] = array(
	3105	+ 'file' => $relative,
	3106	+ 'type' => 'php_in_content',
	3107	+ 'reason' => 'themes' === $kind
	3108	+ ? __( 'Folder with PHP files that WordPress does not list as a theme', 'vigilante' )
	3109	+ : __( 'Folder with PHP files that WordPress does not list as a plugin', 'vigilante' ),
	3110	+ );
	3111	+ }
	3112	+ continue;
	3113	+ }
	3114	+
	3115	+ if ( in_array( strtolower( $entry ), $config_files, true ) ) {
	3116	+ $config = self::server_config_finding( $path, $relative );
	3117	+
	3118	+ if ( $config ) {
	3119	+ $found[ $config['category'] ][] = $config['item'];
	3120	+ }
	3121	+ continue;
	3122	+ }
	3123	+
	3124	+ $extension = strtolower( pathinfo( $entry, PATHINFO_EXTENSION ) );
	3125	+
	3126	+ if ( ! in_array( $extension, $php_extensions, true ) || $this->is_silence_golden_file( $path ) ) {
	3127	+ continue;
	3128	+ }
	3129	+
	3130	+ // hello.php comes with WordPress and is compared with it.
	3131	+ if ( 'plugins' === $kind && 'hello.php' === $entry ) {
	3132	+ continue;
	3133	+ }
	3134	+
	3135	+ $pattern = $this->search_file( $path, true );
	3136	+
	3137	+ $known = ( 'plugins' === $kind && isset( $single_plugins[ $entry ] ) ) || ( 'content' === $kind && in_array( $entry, $dropins, true ) );
	3138	+
	3139	+ if ( $known ) {
	3140	+ $found['unverified'][] = 'plugins' === $kind ? $single_plugins[ $entry ] : __( 'Drop-ins', 'vigilante' );
	3141	+ }
	3142	+
	3143	+ if ( $pattern ) {
	3144	+ $found['suspicious'][] = array(
	3145	+ 'file' => $relative,
	3146	+ 'type' => 'suspicious_plugin',
	3147	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	3148	+ 'reason' => sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), dirname( $relative ), $pattern ),
	3149	+ );
	3150	+ } elseif ( ! $known ) {
	3151	+ $found['extra'][] = array(
	3152	+ 'file' => $relative,
	3153	+ 'type' => 'php_in_content',
	3154	+ 'reason' => __( 'PHP file that is not a plugin, a theme or a WordPress drop-in', 'vigilante' ),
	3155	+ );
	3156	+ } elseif ( null === $pattern ) {
	3157	+ $found['extra'][] = $this->not_searched_item( $path, $relative );
	3158	+ }
	3159	+ }
	3160	+ }
	3161	+
	3162	+ $found['unverified'] = array_values( array_unique( $found['unverified'] ) );
	3163	+
	3164	+ return $found;
	3165	+ }
	3166	+
	3167	+ /**
	3168	+ * Look in the folders of wp-content that belong to no plugin and no theme
	3169	+ *
	3170	+ * cache, languages, upgrade and whatever else is there were not opened by
	3171	+ * any part of the scan, and a PHP file in any of them can be reached by
	3172	+ * its address like one anywhere else. Every PHP file in them is searched
	3173	+ * for hidden code, the way a plugin from outside WordPress.org is, and a
	3174	+ * .htaccess, .user.ini or php.ini is reported when it makes the server run
	3175	+ * code or load a file. A folder with PHP files that could only be
	3176	+ * searched is named among what has no official copy.
	3177	+ *
	3178	+ * Translation files are the exception, because what they must hold is
	3179	+ * known: text. WordPress loads the .l10n.php files of the site language
	3180	+ * with include on every request
	3181	+ * (wp-includes/l10n/class-wp-translation-file-php.php:24), so one that
	3182	+ * holds anything else is reported whatever the code looks like, and any
	3183	+ * other PHP file among the translations is listed. A PHP file that holds
	3184	+ * literal data and nothing else cannot run anything, and is left alone
	3185	+ * wherever it is (see is_literal_data()).
	3186	+ *
	3187	+ * Plugins, themes, must-use plugins and uploads have their own scans and
	3188	+ * are skipped here. The folders whose name says cache go last, and the
	3189	+ * whole walk has a share of the scan time of its own, so a cache with a
	3190	+ * hundred thousand files costs that share and no more.
	3191	+ *
	3192	+ * @return array Array with 'suspicious', 'extra', 'unverified' and 'errors' sub-arrays.
	3193	+ */
	3194	+ private function scan_content_folders() {
	3195	+ $found = array(
	3196	+ 'suspicious' => array(),
	3197	+ 'extra' => array(),
	3198	+ 'unverified' => array(),
	3199	+ 'errors' => array(),
	3200	+ );
	3201	+
	3202	+ $entries = is_dir( WP_CONTENT_DIR ) ? scandir( WP_CONTENT_DIR ) : false;
	3203	+
	3204	+ if ( ! is_array( $entries ) ) {
	3205	+ return $found;
	3206	+ }
	3207	+
	3208	+ // The folders with a scan of their own, by where they really are.
	3209	+ global $wp_theme_directories;
	3210	+
	3211	+ $uploads = wp_get_upload_dir();
	3212	+ $uploads_real = empty( $uploads['basedir'] ) ? false : realpath( $uploads['basedir'] );
	3213	+ $uploads_real = false === $uploads_real ? '' : wp_normalize_path( $uploads_real );
	3214	+ $own = array();
	3215	+ $roots = array_merge(
	3216	+ array( WP_PLUGIN_DIR, defined( 'WPMU_PLUGIN_DIR' ) ? WPMU_PLUGIN_DIR : '', get_theme_root() ),
	3217	+ is_array( $wp_theme_directories ) ? $wp_theme_directories : array()
	3218	+ );
	3219	+
	3220	+ foreach ( $roots as $root ) {
	3221	+ $real = '' === (string) $root ? false : realpath( $root );
	3222	+
	3223	+ if ( false !== $real ) {
	3224	+ $own[ wp_normalize_path( $real ) ] = true;
	3225	+ }
	3226	+ }
	3227	+
	3228	+ if ( '' !== $uploads_real ) {
	3229	+ $own[ $uploads_real ] = true;
	3230	+ }
	3231	+
	3232	+ // On a site of a network that is not the main one, the uploads of the
	3233	+ // site live inside the uploads of the network, which are the main
	3234	+ // site's turn.
	3235	+ $network_uploads = is_multisite() && ! is_main_site() ? $uploads_real : '';
	3236	+
	3237	+ $folders = array();
	3238	+
	3239	+ foreach ( $entries as $entry ) {
	3240	+ $path = WP_CONTENT_DIR . '/' . $entry;
	3241	+
	3242	+ if ( '.' === $entry || '..' === $entry || ! is_dir( $path ) ) {
	3243	+ continue;
	3244	+ }
	3245	+
	3246	+ $real = realpath( $path );
	3247	+ $real = false === $real ? '' : wp_normalize_path( $real );
	3248	+
	3249	+ // A folder with a scan of its own, or a link into one. A link to
	3250	+ // anywhere else is walked like the folder it stands for: deploy
	3251	+ // tools keep languages or a cache behind one, and what is there
	3252	+ // is reached by its address all the same.
	3253	+ if ( '' === $real || self::is_inside_any( $real, $own ) || ( is_link( $path ) && self::leads_back( $path ) ) ) {
	3254	+ continue;
	3255	+ }
	3256	+
	3257	+ if ( '' !== $network_uploads && 0 === strpos( $network_uploads, $real . '/' ) ) {
	3258	+ continue;
	3259	+ }
	3260	+
	3261	+ if ( $this->is_path_excluded( $path . '/.' ) ) {
	3262	+ continue;
	3263	+ }
	3264	+
	3265	+ $folders[] = $entry;
	3266	+ }
	3267	+
	3268	+ usort(
	3269	+ $folders,
	3270	+ static function ( $a, $b ) {
	3271	+ $a_cache = false !== stripos( $a, 'cache' );
	3272	+ $b_cache = false !== stripos( $b, 'cache' );
	3273	+
	3274	+ return $a_cache === $b_cache ? strcmp( $a, $b ) : ( $a_cache ? 1 : -1 );
	3275	+ }
	3276	+ );
	3277	+
	3278	+ $php_extensions = self::php_extensions();
	3279	+ $config_files = array( '.htaccess', '.user.ini', 'php.ini' );
	3280	+ $deadline = microtime( true ) + $this->content_folders_time;
	3281	+
	3282	+ // A folder with a scan of its own nested further down, or one the
	3283	+ // user left out, is not walked at all.
	3284	+ $skip = function ( $folder ) use ( $own ) {
	3285	+ $real = realpath( $folder );
	3286	+
	3287	+ return ( false !== $real && isset( $own[ wp_normalize_path( $real ) ] ) ) || $this->is_path_excluded( $folder . '/.' );
	3288	+ };
	3289	+
	3290	+ foreach ( $folders as $entry ) {
	3291	+ $path = WP_CONTENT_DIR . '/' . $entry;
	3292	+ $php_files = 0;
	3293	+
	3294	+ try {
	3295	+ foreach ( self::walk_folder( $path, $skip ) as $file ) {
	3296	+ if ( $this->is_time_exceeded() ) {
	3297	+ break 2;
	3298	+ }
	3299	+
	3300	+ if ( microtime( true ) > $deadline ) {
	3301	+ $found['errors'][] = sprintf(
	3302	+ /* translators: %s: Folder path */
	3303	+ __( 'The folders of wp-content outside plugins, themes and uploads were not checked completely: the time for them ran out in %s. If that folder only holds files that change all the time, such as a cache, add it to Excluded Paths.', 'vigilante' ),
	3304	+ str_replace( ABSPATH, '', $path )
	3305	+ );
	3306	+ break 2;
	3307	+ }
	3308	+
	3309	+ $file_path = $file->getPathname();
	3310	+
	3311	+ if ( $file->isDir() ) {
	3312	+ if ( ! $file->isReadable() ) {
	3313	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	3314	+ }
	3315	+ continue;
	3316	+ }
	3317	+
	3318	+ $basename = strtolower( basename( $file_path ) );
	3319	+
	3320	+ if ( in_array( $basename, $config_files, true ) ) {
	3321	+ $config = $this->is_path_excluded( $file_path ) ? null : self::server_config_finding( $file_path, str_replace( ABSPATH, '', $file_path ) );
	3322	+
	3323	+ if ( $config ) {
	3324	+ $found[ $config['category'] ][] = $config['item'];
	3325	+ }
	3326	+ continue;
	3327	+ }
	3328	+
	3329	+ if ( ! in_array( strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) ), $php_extensions, true ) ) {
	3330	+ continue;
	3331	+ }
	3332	+
	3333	+ if ( $this->is_path_excluded( $file_path ) || $this->is_silence_golden_file( $file_path ) ) {
	3334	+ continue;
	3335	+ }
	3336	+
	3337	+ $literal = $this->is_literal_data( $file_path );
	3338	+
	3339	+ if ( true === $literal ) {
	3340	+ continue;
	3341	+ }
	3342	+
	3343	+ $relative = str_replace( ABSPATH, '', $file_path );
	3344	+
	3345	+ if ( false === $literal && '.l10n.php' === substr( $basename, -9 ) ) {
	3346	+ // Reported whatever the search finds, like a PHP file
	3347	+ // in uploads: WordPress loads it on every request, and
	3348	+ // no tool writes anything but the table of texts in
	3349	+ // it. What the search finds is said next to it.
	3350	+ $pattern = $this->search_file( $file_path, true );
	3351	+ $reason = __( 'Translation file that holds something other than translations', 'vigilante' );
	3352	+
	3353	+ if ( $pattern ) {
	3354	+ /* translators: %s: Suspicious pattern found */
	3355	+ $reason = sprintf( __( 'Translation file with suspicious code: %s', 'vigilante' ), $pattern );
	3356	+ }
	3357	+
	3358	+ $found['suspicious'][] = array(
	3359	+ 'file' => $relative,
	3360	+ 'type' => 'translation_with_code',
	3361	+ 'reason' => $reason,
	3362	+ );
	3363	+ continue;
	3364	+ }
	3365	+
	3366	+ $pattern = $this->search_file( $file_path, true );
	3367	+
	3368	+ if ( $pattern ) {
	3369	+ $found['suspicious'][] = array(
	3370	+ 'file' => $relative,
	3371	+ 'type' => 'suspicious_content',
	3372	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	3373	+ 'reason' => sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), str_replace( ABSPATH, '', $path ), $pattern ),
	3374	+ );
	3375	+ } elseif ( null === $pattern ) {
	3376	+ $found['extra'][] = $this->not_searched_item( $file_path, $relative );
	3377	+ } elseif ( self::is_inside_languages( $file_path ) ) {
	3378	+ $found['extra'][] = array(
	3379	+ 'file' => $relative,
	3380	+ 'type' => 'php_in_content',
	3381	+ 'reason' => __( 'PHP file among the translations that is not a translation file', 'vigilante' ),
	3382	+ );
	3383	+ } else {
	3384	+ $php_files++;
	3385	+ }
	3386	+ }
	3387	+ } catch ( Exception $e ) {
	3388	+ $found['errors'][] = self::unreadable_folder_error( $path );
	3389	+ }
	3390	+
	3391	+ if ( $php_files > 0 ) {
	3392	+ $found['unverified'][] = str_replace( ABSPATH, '', $path );
	3393	+ }
	3394	+ }
	3395	+
	3396	+ return $found;
	3397	+ }
	3398	+
	3399	+ /**
	3400	+ * Whether a real path is one of a set of folders or lies inside one of them
	3401	+ *
	3402	+ * @param string $real Real path, with forward slashes.
	3403	+ * @param array $folders Real paths with forward slashes, as keys.
	3404	+ * @return bool
	3405	+ */
	3406	+ private static function is_inside_any( $real, $folders ) {
	3407	+ foreach ( array_keys( $folders ) as $folder ) {
	3408	+ if ( $real === $folder || 0 === strpos( $real, $folder . '/' ) ) {
	3409	+ return true;
	3410	+ }
	3411	+ }
	3412	+
	3413	+ return false;
	3414	+ }
	3415	+
	3416	+ /**
	3417	+ * Whether a link leads to wp-content itself or to a folder above it
	3418	+ *
	3419	+ * @param string $path Path of the link.
	3420	+ * @return bool True also when where it leads cannot be worked out.
	3421	+ */
	3422	+ private static function leads_back( $path ) {
	3423	+ $real = realpath( $path );
	3424	+ $content = realpath( WP_CONTENT_DIR );
	3425	+
	3426	+ if ( false === $real || false === $content ) {
	3427	+ return true;
	3428	+ }
	3429	+
	3430	+ return 0 === strpos( wp_normalize_path( $content ) . '/', wp_normalize_path( $real ) . '/' );
	3431	+ }
	3432	+
	3433	+ /**
	3434	+ * Whether a path is inside the folder WordPress keeps its translations in
	3435	+ *
	3436	+ * @param string $path Absolute path.
	3437	+ * @return bool
	3438	+ */
	3439	+ private static function is_inside_languages( $path ) {
	3440	+ if ( ! defined( 'WP_LANG_DIR' ) ) {
	3441	+ return false;
	3442	+ }
	3443	+
	3444	+ return 0 === strpos( wp_normalize_path( $path ), untrailingslashit( wp_normalize_path( WP_LANG_DIR ) ) . '/' );
	3445	+ }
	3446	+
	3447	+ /**
	3448	+ * Whether a PHP file holds literal data and nothing else
	3449	+ *
	3450	+ * A file such as "<?php return [ 'a' => 'b' ];" cannot run anything. It is
	3451	+ * how WordPress, GlotPress, WP-CLI and Loco Translate write translation
	3452	+ * files, and how plugins keep small tables. The file is read one piece at
	3453	+ * a time, and every piece has to be a quoted string with nothing
	3454	+ * interpolated in it, a number, true, false, null, return, an array
	3455	+ * bracket, a comma, "=>", a dot or a semicolon. A parenthesis is
	3456	+ * accepted only as part of "array(" and to close it, so
	3457	+ * nothing can be called, and with those pieces there is no way to name a
	3458	+ * variable, a function, a class or a file.
	3459	+ *
	3460	+ * Anything else, a comment included, and the answer is no. Saying no to a
	3461	+ * harmless file only means it is searched like any other; saying yes to
	3462	+ * a file with code would hide it. So this reads less than PHP does, on
	3463	+ * purpose. Each piece is also one PHP would cut the same way: a minus
	3464	+ * sign only in front of a number and a dot never in front of "=", or
	3465	+ * "-=>" and ".=>" would be read here as an arrow and by PHP as an
	3466	+ * assignment. What it accepts is checked against PHP's own reading of
	3467	+ * the same file, at random, in the release checks.
	3468	+ *
	3469	+ * @param string $file_path Absolute path.
	3470	+ * @return bool|null True when it holds only data, false when it holds
	3471	+ * anything else, null when it could not be read whole.
	3472	+ */
	3473	+ private function is_literal_data( $file_path ) {
	3474	+ if ( ! is_file( $file_path ) || ! is_readable( $file_path ) ) {
	3475	+ return null;
	3476	+ }
	3477	+
	3478	+ // With another source encoding set (zend.multibyte), a string does
	3479	+ // not end for PHP where it ends byte by byte: nothing is vouched for.
	3480	+ if ( ini_get( 'zend.multibyte' ) ) {
	3481	+ return null;
	3482	+ }
	3483	+
	3484	+ $size = filesize( $file_path );
	3485	+
	3486	+ if ( false === $size || $size > self::MAX_SEARCHED_BYTES ) {
	3487	+ return null;
	3488	+ }
	3489	+
	3490	+ $content = file_get_contents( $file_path, false, null, 0, self::MAX_SEARCHED_BYTES + 1 ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to see whether it holds anything but data; nothing is written.
	3491	+
	3492	+ if ( false === $content || strlen( $content ) > self::MAX_SEARCHED_BYTES ) {
	3493	+ return null;
	3494	+ }
	3495	+
	3496	+ if ( 1 !== preg_match( '/\A<\?php[ \t\r\n]/', $content ) ) {
	3497	+ return false;
	3498	+ }
	3499	+
	3500	+ $piece = '/\G(?:[ \t\r\n]++|\'[^\'\\\\]*+(?:\\\\.[^\'\\\\]*+)*+\'|"[^"\\\\$]*+(?:\\\\.[^"\\\\$]*+)*+"|-?+\d++(?:\.\d++)?+(?:e[+-]?+\d++)?+|=>|\.(?!=)|[\[\],;)]|(?:true|false|null|return)(?![a-z0-9_\x80-\xff])|array[ \t\r\n]*+\()/is';
	3501	+ $length = strlen( $content );
	3502	+ $offset = 6;
	3503	+
	3504	+ while ( $offset < $length ) {
	3505	+ $match = array();
	3506	+ $result = preg_match( $piece, $content, $match, 0, $offset );
	3507	+
	3508	+ if ( 1 !== $result ) {
	3509	+ return false === $result ? null : false;
	3510	+ }
	3511	+
	3512	+ $offset += strlen( $match[0] );
	3513	+ }
	3514	+
	3515	+ return true;
	3516	+ }
	3517	+
1566	3518	// =========================================================================
1567	3519	// Critical config file baseline monitoring (wp-config.php, .htaccess)
1568	3520	// =========================================================================
1569	3521
		@@ -1579,8 +3531,51 @@
1579	3531	* silently — there is nothing to compare against.
1580	3532	*
1581	3533	* @return array Array of modified file entries (same format as core modified).
1582	3534	*/
	3535	+ /**
	3536	+ * Where a critical root file actually lives
	3537	+ *
	3538	+ * WordPress supports wp-config.php one directory above ABSPATH, guarded by
	3539	+ * wp-settings.php not being there: that is literally what the installed core
	3540	+ * does in wp-load.php, and it is a common hardening layout. Until 2.11.10
	3541	+ * this module only looked inside ABSPATH, so on those installations
	3542	+ * wp-config.php was never added to the baseline, never compared and never
	3543	+ * mentioned: the module reported the site clean without having opened the
	3544	+ * one file it most needs to watch. A zero is justified, never assumed. The
	3545	+ * plugin already resolved both locations elsewhere
	3546	+ * (Vigilante_Database_Prefix::find_wpconfig_path()), just not here. Found by
	3547	+ * the file-by-file review of 2.11.10.
	3548	+ *
	3549	+ * @since 2.11.10
	3550	+ *
	3551	+ * @param string $filename Name of the file, such as wp-config.php.
	3552	+ * @return string|false Absolute path, or false when it cannot be found.
	3553	+ */
	3554	+ private function critical_file_path( $filename ) {
	3555	+ $root = untrailingslashit( ABSPATH );
	3556	+ $path = $root . '/' . $filename;
	3557	+
	3558	+ if ( file_exists( $path ) ) {
	3559	+ return $path;
	3560	+ }
	3561	+
	3562	+ if ( 'wp-config.php' === $filename ) {
	3563	+ $above = dirname( $root ) . '/wp-config.php';
	3564	+
	3565	+ // Suppressed like the core does in wp-load.php: the directory above
	3566	+ // the install is often outside open_basedir on shared hosting, and
	3567	+ // without the @ every scan emits a warning that can land in front of
	3568	+ // the JSON of an AJAX scan.
	3569	+ // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- The same @ the core uses for this same check in wp-load.php:52, where a wp-config.php one directory up is looked for: open_basedir makes file_exists() warn on a path outside it, and this must not print.
	3570	+ if ( @file_exists( $above ) && ! @file_exists( dirname( $root ) . '/wp-settings.php' ) ) {
	3571	+ return $above;
	3572	+ }
	3573	+ }
	3574	+
	3575	+ return false;
	3576	+ }
	3577	+
1583	3578	private function scan_critical_root_files() {
1584	3579	// Before reading anything: the scan is the only thing that reaches
1585	3580	// every site of a network on its own, through wp-cron and front-end
1586	3581	// traffic. Hooking the cleanup to admin_init alone left every subsite
		@@ -1587,17 +3582,20 @@
1587	3582	// whose dashboard nobody opens with its old copy of wp-config.php,
1588	3583	// credentials included, for as long as nobody visited it.
1589	3584	$this->maybe_redact_stored_baseline();
1590	3585
	3586	+ // And claim the blocks already on disk before anything is compared,
	3587	+ // so the first scan after updating uses the rule that will stay.
	3588	+ $this->maybe_claim_owned_blocks();
	3589	+
1591	3590	$modified = array();
1592	3591	$baseline = $this->get_critical_files_baseline();
1593	3592	$baseline_changed = false;
1594		- $root_path = untrailingslashit( ABSPATH );
1595	3593
1596	3594	foreach ( $this->critical_root_files as $filename ) {
1597		- $full_path = $root_path . '/' . $filename;
	3595	+ $full_path = $this->critical_file_path( $filename );
1598	3596
1599		- if ( ! file_exists( $full_path ) ) {
	3597	+ if ( false === $full_path ) {
1600	3598	continue;
1601	3599	}
1602	3600
1603	3601	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -1659,14 +3657,34 @@
1659	3657	*
1660	3658	* Both sides go through the same redaction, or every credential
1661	3659	* line would read as a change nobody made.
1662	3660	*/
1663		- $baseline_content = $baseline[ $filename ]['content'] ?? '';
1664		- $current_content = $this->baseline_content( $filename, $normalized );
1665		- $diff = ( '' !== $baseline_content && '' !== $current_content )
1666		- ? $this->compute_simple_diff( $baseline_content, $current_content )
1667		- : array( 'added' => array(), 'removed' => array(), 'unavailable' => true );
	3661	+ /*
	3662	+ * Where the shared files do not belong to this site, the lines are
	3663	+ * not computed at all. The diff is shown to whoever can open this
	3664	+ * site's screen, the administrator of a subsite included, and it
	3665	+ * was stored in the options of every subsite with the module on.
	3666	+ * Found by the audit of the admin surface for 2.11.8. The change is
	3667	+ * still reported, with both sizes, and the lines are read on the
	3668	+ * main site, where the change is approved.
	3669	+ */
	3670	+ if ( ! Vigilante_Settings::owns_shared_files() ) {
	3671	+ $diff = self::network_only_diff();
	3672	+ } else {
	3673	+ $baseline_content = $baseline[ $filename ]['content'] ?? '';
	3674	+ $current_content = $this->baseline_content( $filename, $normalized );
	3675	+ $diff = ( '' !== $baseline_content && '' !== $current_content )
	3676	+ ? $this->compute_simple_diff( $baseline_content, $current_content )
	3677	+ : array( 'added' => array(), 'removed' => array(), 'unavailable' => true );
1668	3678
	3679	+ // Say why there are no lines when today's copy could not be
	3680	+ // made safe, which approving does not change: the generic
	3681	+ // message talks about an old baseline. Cross review of 2.11.8.
	3682	+ if ( '' === $current_content && 'wp-config.php' === $filename ) {
	3683	+ $diff['redaction'] = true;
	3684	+ }
	3685	+ }
	3686	+
1669	3687	$modified[] = array(
1670	3688	'file' => $filename,
1671	3689	'type' => 'critical_config',
1672	3690	'expected_hash' => $baseline[ $filename ]['hash'],
		@@ -1751,30 +3769,49 @@
1751	3769	* @param string $filename File name (e.g. 'wp-config.php').
1752	3770	* @param string $content Raw file content.
1753	3771	* @return string Normalized content for hashing.
1754	3772	*/
1755		- private function normalize_critical_file( $filename, $content ) {
	3773	+ private function normalize_critical_file( $filename, $content, $drop_all_original = false ) {
1756	3774	// Normalize line endings first (CRLF and CR to LF)
1757	3775	$content = str_replace( array( "\r\n", "\r" ), "\n", $content );
1758	3776
	3777	+ /*
	3778	+ * Vigilant's own blocks are left out of the hash, so rewriting them is
	3779	+ * not reported as somebody else's change. Until 2.11.5 that covered
	3780	+ * everything between the markers, and every line carrying the
	3781	+ * [VIGILANTE_ORIGINAL] marker, whatever they contained. From 2.11.5 a
	3782	+ * block is left out only if it is exactly a block Vigilant wrote (see
	3783	+ * remember_owned_block()), and a marked line only while uncommenting it
	3784	+ * would still give a harmless define() (see is_vigilant_original_line()).
	3785	+ *
	3786	+ * Until the blocks already on disk have been claimed, the old rule
	3787	+ * applies unchanged. That is what keeps an update from changing the
	3788	+ * hash of a file nobody touched.
	3789	+ */
	3790	+ $claimed = $this->owned_blocks_claimed();
	3791	+
1759	3792	if ( 'wp-config.php' === $filename ) {
1760		- // Remove Vigilante constants blocks (current and legacy)
	3793	+ // Vigilante constants blocks (current and legacy)
1761	3794	foreach ( $this->wpconfig_markers as $markers ) {
1762		- $pattern = '/' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . '\s*/s';
1763		- $content = preg_replace( $pattern, '', $content );
	3795	+ $content = $this->strip_vigilant_blocks( $filename, $content, $markers, $claimed );
1764	3796	}
1765	3797
1766		- // Remove lines commented out by Vigilante (original constants)
1767		- $content = preg_replace(
	3798	+ // Lines commented out by Vigilante (original constants)
	3799	+ $content = preg_replace_callback(
1768	3800	'/^.*' . preg_quote( $this->wpconfig_original_marker, '/' ) . '.*$/m',
1769		- '',
	3801	+ function ( $line ) use ( $claimed, $drop_all_original ) {
	3802	+ // $drop_all_original reproduce la regla anterior a la 2.11.5 (quitar
	3803	+ // toda linea marcada) sobre los bloques de la regla nueva. Solo lo usa
	3804	+ // el re-base de la transicion, para decidir si la unica diferencia con
	3805	+ // el registro aprobado son estas lineas. Ver rebase_original_line_shift().
	3806	+ return ( ! $claimed || $drop_all_original || $this->is_vigilant_original_line( $line[0] ) ) ? '' : $line[0];
	3807	+ },
1770	3808	$content
1771	3809	);
1772	3810	} elseif ( '.htaccess' === $filename ) {
1773		- // Remove Vigilante htaccess blocks (firewall + security headers)
	3811	+ // Vigilante htaccess blocks (firewall + security headers)
1774	3812	foreach ( $this->htaccess_markers as $markers ) {
1775		- $pattern = '/' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . '\s*/s';
1776		- $content = preg_replace( $pattern, '', $content );
	3813	+ $content = $this->strip_vigilant_blocks( $filename, $content, $markers, $claimed );
1777	3814	}
1778	3815	}
1779	3816
1780	3817	// Collapse multiple blank lines into one (blocks removal leaves gaps)
		@@ -1783,8 +3820,639 @@
1783	3820	return trim( $content );
1784	3821	}
1785	3822
1786	3823	/**
	3824	+ * Leave Vigilant's blocks for one pair of markers out of the content
	3825	+ *
	3826	+ * Before the claim, every block, as it always was. After it, only the blocks
	3827	+ * whose fingerprint was recorded when Vigilant wrote them. A block that does
	3828	+ * not match, edited or planted, stays in the content: it counts in the hash
	3829	+ * and shows up in the diff.
	3830	+ *
	3831	+ * The match runs from marker to marker and the removal also takes the
	3832	+ * whitespace after the block, exactly as before, so a file whose blocks are
	3833	+ * all Vigilant's normalizes to the same text under both rules.
	3834	+ *
	3835	+ * @since 2.11.5
	3836	+ *
	3837	+ * @param string $filename 'wp-config.php' or '.htaccess'.
	3838	+ * @param string $content Content with normalized line endings.
	3839	+ * @param array $markers Start and end marker.
	3840	+ * @param bool $claimed Whether the claim has run.
	3841	+ * @return string
	3842	+ */
	3843	+ private function strip_vigilant_blocks( $filename, $content, $markers, $claimed ) {
	3844	+ $pattern = '/(' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . ')\s*/s';
	3845	+
	3846	+ if ( ! $claimed ) {
	3847	+ return preg_replace( $pattern, '', $content );
	3848	+ }
	3849	+
	3850	+ return preg_replace_callback(
	3851	+ $pattern,
	3852	+ function ( $match ) use ( $filename ) {
	3853	+ return self::is_owned_block( $filename, $match[1] ) ? '' : $match[0];
	3854	+ },
	3855	+ $content
	3856	+ );
	3857	+ }
	3858	+
	3859	+ /**
	3860	+ * Whether a line carrying the original-constant marker is one Vigilant wrote
	3861	+ *
	3862	+ * comment_existing_constants() puts the marker in front of a define() of a
	3863	+ * constant it manages, and uncomment_original_constants() takes it away
	3864	+ * again whenever the constants are applied or removed, so whatever follows
	3865	+ * the marker gets to run some day. The line is left out of the hash only
	3866	+ * when there is nothing but indentation before the marker, nothing after it
	3867	+ * but a harmless define() and at most a line comment, and no PHP tag
	3868	+ * anywhere on it. That keeps it a comment today and harmless once
	3869	+ * uncommented. Anything else counts, and shows up in the diff.
	3870	+ *
	3871	+ * @since 2.11.5
	3872	+ *
	3873	+ * @param string $line One line of wp-config.php.
	3874	+ * @return bool
	3875	+ */
	3876	+ /**
	3877	+ * Whether every marked line of a file can run nothing at all
	3878	+ *
	3879	+ * The question the re-base has to answer before adopting a file is whether
	3880	+ * the lines that carry the marker are only comments. Asking a stricter one
	3881	+ * was wrong in both directions: the first version of the guard used
	3882	+ * is_vigilant_original_line(), which also requires the commented define to
	3883	+ * match a known harmless shape, so it refused to re-base a perfectly inert
	3884	+ * line carrying an unusual define, which is exactly the case the re-base
	3885	+ * exists for, leaving the function unable to act at all. Found by the cross
	3886	+ * review of 2.11.10.
	3887	+ *
	3888	+ * The second version read one line at a time and reasoned that the marker
	3889	+ * begins with //, so a line with nothing but whitespace before it is wholly
	3890	+ * a comment. That is true only where PHP is already reading code, and the
	3891	+ * second cross review of 2.11.10 built three files where it is not, all of
	3892	+ * them valid PHP, all of them passing that test and all of them running or
	3893	+ * printing something:
	3894	+ *
	3895	+ * - the marked line placed BEFORE the opening <?php, so it is inline HTML
	3896	+ * that the server prints verbatim to the browser;
	3897	+ * - the same after a ?> that the file already had;
	3898	+ * - the marked line ending a block comment opened on an earlier line and
	3899	+ * opening another one at its end, with a statement in between, which
	3900	+ * runs like any other statement.
	3901	+ *
	3902	+ * So the file is read the way PHP reads it, not the way the line looks. A
	3903	+ * marked line is inert when every token touching it is a comment or
	3904	+ * whitespace, which answers the three at once: inline HTML is not a comment,
	3905	+ * and neither is a statement. The shape the guard was written for, code
	3906	+ * BEFORE the marker, is the same question from the other side.
	3907	+ *
	3908	+ * The three shapes are in the harness as cells X2, X3 and X4 of
	3909	+ * matriz-escondite-marcadores.sh, written out in full there. They are not
	3910	+ * written out here on purpose: a literal payload in a shipped file is
	3911	+ * signature surface for the scanners this plugin is read by, and a comment
	3912	+ * is a bad place to pay for it.
	3913	+ *
	3914	+ * @since 2.11.10
	3915	+ *
	3916	+ * @param string $content Whole file content.
	3917	+ * @return bool True when no marked line can run or print anything.
	3918	+ */
	3919	+ /**
	3920	+ * The lines of a file that carry the original-value marker
	3921	+ *
	3922	+ * @since 2.11.10
	3923	+ *
	3924	+ * @param string $content Whole file content, newlines already normalised.
	3925	+ * @return string[]
	3926	+ */
	3927	+ private function marked_lines_of( $content ) {
	3928	+ $out = array();
	3929	+
	3930	+ foreach ( explode( "\n", $content ) as $text ) {
	3931	+ if ( false !== strpos( $text, $this->wpconfig_original_marker ) ) {
	3932	+ $out[] = $text;
	3933	+ }
	3934	+ }
	3935	+
	3936	+ return $out;
	3937	+ }
	3938	+
	3939	+ /**
	3940	+ * Whether what a marked line carries would still be harmless uncommented
	3941	+ *
	3942	+ * Only the part after the marker matters: what comes before it is answered by
	3943	+ * the token pass, which refuses anything that is not comment or whitespace.
	3944	+ * Here the question is what comes BACK when uncomment_original_constants()
	3945	+ * removes the marker, so the body has to be a single define() and nothing
	3946	+ * else, with at most a trailing line comment. Deliberately says nothing about
	3947	+ * WHICH constant it is: asking that was the first version of this guard, and
	3948	+ * it refused every define it did not recognise, which is exactly the case the
	3949	+ * re-base exists for.
	3950	+ *
	3951	+ * @since 2.11.10
	3952	+ *
	3953	+ * @param string $line One line carrying the marker.
	3954	+ * @return bool
	3955	+ */
	3956	+ private function marked_line_body_is_harmless( $line ) {
	3957	+ $at = strpos( $line, $this->wpconfig_original_marker );
	3958	+
	3959	+ if ( false === $at ) {
	3960	+ return true;
	3961	+ }
	3962	+
	3963	+ $body = trim( substr( $line, $at + strlen( $this->wpconfig_original_marker ) ) );
	3964	+
	3965	+ if ( '' === $body ) {
	3966	+ return true;
	3967	+ }
	3968	+
	3969	+ // Tokenised as PHP so the trailing comment, the strings and the nesting
	3970	+ // are read the way PHP reads them and not with a regular expression.
	3971	+ $tokens = @token_get_all( '<?php ' . $body ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- A marked line can carry anything; a warning here must not be printed, and an unreadable body is refused below.
	3972	+
	3973	+ if ( empty( $tokens ) ) {
	3974	+ return false;
	3975	+ }
	3976	+
	3977	+ $statements = 0;
	3978	+ $depth = 0;
	3979	+
	3980	+ foreach ( $tokens as $token ) {
	3981	+ $type = is_array( $token ) ? $token[0] : $token;
	3982	+
	3983	+ if ( in_array( $type, array( T_OPEN_TAG, T_WHITESPACE, T_COMMENT, T_DOC_COMMENT ), true ) ) {
	3984	+ continue;
	3985	+ }
	3986	+
	3987	+ if ( '(' === $type ) {
	3988	+ $depth++;
	3989	+ continue;
	3990	+ }
	3991	+
	3992	+ if ( ')' === $type ) {
	3993	+ $depth--;
	3994	+ continue;
	3995	+ }
	3996	+
	3997	+ // A semicolon at the top level closes a statement. More than one, or
	3998	+ // anything after the first, means the line carries something else.
	3999	+ if ( ';' === $type && 0 === $depth ) {
	4000	+ $statements++;
	4001	+ continue;
	4002	+ }
	4003	+
	4004	+ if ( $statements > 0 ) {
	4005	+ return false;
	4006	+ }
	4007	+ }
	4008	+
	4009	+ return ( $statements <= 1 );
	4010	+ }
	4011	+
	4012	+ private function marked_lines_are_inert( $content ) {
	4013	+ $content = str_replace( "\r\n", "\n", (string) $content );
	4014	+ $marker = $this->wpconfig_original_marker;
	4015	+
	4016	+ if ( '' === $content || false === strpos( $content, $marker ) ) {
	4017	+ return true;
	4018	+ }
	4019	+
	4020	+ $marked = array();
	4021	+
	4022	+ foreach ( explode( "\n", $content ) as $index => $text ) {
	4023	+ if ( false !== strpos( $text, $marker ) ) {
	4024	+ $marked[ $index + 1 ] = true;
	4025	+ }
	4026	+ }
	4027	+
	4028	+ // Lenient on purpose (no TOKEN_PARSE): a tampered file still has to be
	4029	+ // read, and a file that cannot be tokenised is never adopted.
	4030	+ // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- The file read here may have been tampered with, which is the whole point, and PHP 8 emits a warning when it cannot tokenise: printing it would put a parse error on whatever page ran the scan. An unreadable file is refused four lines below.
	4031	+ $tokens = @token_get_all( $content );
	4032	+
	4033	+ if ( empty( $tokens ) ) {
	4034	+ return false;
	4035	+ }
	4036	+
	4037	+ /*
	4038	+ * And the other half of the question, which the first token version left
	4039	+ * out: a marked line is a COMMENTED OUT value, and uncommenting it is what
	4040	+ * the feature exists for, so "runs nothing today" is not enough. Anything
	4041	+ * sharing the line after the define comes back with it. The shape is real
	4042	+ * and needs no attacker: comment_existing_constants() takes a define and
	4043	+ * everything on its line, so
	4044	+ * define( 'WP_DEBUG', false ); @ini_set( 'display_errors', 0 );
	4045	+ * is commented whole, and re-basing it would adopt as approved something
	4046	+ * that runs the moment the value is restored. The old rule refused this
	4047	+ * too, but along with every define whose NAME it did not recognise, which
	4048	+ * is what left the function unable to act at all. Found by the third cross
	4049	+ * review of 2.11.10.
	4050	+ */
	4051	+ foreach ( $this->marked_lines_of( $content ) as $text ) {
	4052	+ if ( ! $this->marked_line_body_is_harmless( $text ) ) {
	4053	+ return false;
	4054	+ }
	4055	+ }
	4056	+
	4057	+ $inocuos = array( T_COMMENT, T_DOC_COMMENT, T_WHITESPACE );
	4058	+ $linea = 1;
	4059	+
	4060	+ foreach ( $tokens as $token ) {
	4061	+ $texto = is_array( $token ) ? $token[1] : $token;
	4062	+ $tipo = is_array( $token ) ? $token[0] : null;
	4063	+ $saltos = substr_count( $texto, "\n" );
	4064	+ $desde = $linea;
	4065	+ $hasta = $linea + $saltos;
	4066	+
	4067	+ /*
	4068	+ * A token whose text ends in a newline puts nothing on the line that
	4069	+ * newline opens. Counting it would make the "<?php\n" of every file
	4070	+ * touch line 2 and refuse the legitimate case, which is what the
	4071	+ * first version of this did.
	4072	+ */
	4073	+ $ultima = ( $saltos > 0 && "\n" === substr( $texto, -1 ) ) ? $hasta - 1 : $hasta;
	4074	+ $linea = $hasta;
	4075	+
	4076	+ if ( null !== $tipo && in_array( $tipo, $inocuos, true ) ) {
	4077	+ continue;
	4078	+ }
	4079	+
	4080	+ for ( $l = $desde; $l <= $ultima; $l++ ) {
	4081	+ if ( isset( $marked[ $l ] ) ) {
	4082	+ return false;
	4083	+ }
	4084	+ }
	4085	+ }
	4086	+
	4087	+ return true;
	4088	+ }
	4089	+
	4090	+ private function is_vigilant_original_line( $line ) {
	4091	+ if ( false !== strpos( $line, '<?' ) || false !== strpos( $line, '?>' ) ) {
	4092	+ return false;
	4093	+ }
	4094	+
	4095	+ return 1 === preg_match(
	4096	+ '/^[ \t]*' . preg_quote( $this->wpconfig_original_marker, '/' ) . self::harmless_define_pattern() . '[ \t]*(?:(?:\/\/|#(?!\[)).*)?$/',
	4097	+ $line
	4098	+ );
	4099	+ }
	4100	+
	4101	+ /**
	4102	+ * A define() that runs nothing but itself, as a regular expression fragment
	4103	+ *
	4104	+ * The name is one of the constants Vigilant has managed in any version. The
	4105	+ * value is made only of literals (true, false, null, a number, a quoted
	4106	+ * string with nothing to interpolate) and of ABSPATH, WP_CONTENT_DIR and
	4107	+ * __DIR__, which is what a debug log path is usually built from, joined
	4108	+ * with dots. No call, no variable, no backtick, no include.
	4109	+ *
	4110	+ * @since 2.11.5
	4111	+ *
	4112	+ * @return string Pattern without delimiters.
	4113	+ */
	4114	+ private static function harmless_define_pattern() {
	4115	+ $names = 'DISALLOW_FILE_EDIT|DISALLOW_FILE_MODS|FORCE_SSL_ADMIN|FORCE_SSL_LOGIN|WP_DEBUG|WP_DEBUG_LOG|WP_DEBUG_DISPLAY|SCRIPT_DEBUG|DISABLE_WP_CRON'
	4116	+ . '|WP_POST_REVISIONS|AUTOSAVE_INTERVAL|EMPTY_TRASH_DAYS|WP_MEMORY_LIMIT|WP_MAX_MEMORY_LIMIT|WP_AUTO_UPDATE_CORE|CONCATENATE_SCRIPTS';
	4117	+
	4118	+ $value = '(?:(?i:true|false|null)|-?\d+|\'(?:[^\'\\\\]|\\\\.)*\'|"[^"\\\\$]*"|ABSPATH|WP_CONTENT_DIR|__DIR__)';
	4119	+
	4120	+ return 'define\s*\(\s*[\'"](?:' . $names . ')[\'"]\s*,\s*' . $value . '(?:\s*\.\s*' . $value . ')*\s*\)\s*;';
	4121	+ }
	4122	+
	4123	+ /**
	4124	+ * Whether a wp-config.php constants block can only be one Vigilant wrote
	4125	+ *
	4126	+ * Every version of generate_constants() has written the start marker on its
	4127	+ * own line, then comments, blank lines and define() calls, bare or wrapped
	4128	+ * in if ( ! defined() ), then the end marker on its own line. A block made
	4129	+ * only of those lines runs nothing but the defines, whatever version wrote
	4130	+ * it and whatever settings it was written with. One line of anything else,
	4131	+ * or a PHP tag on any line, and the block is not taken.
	4132	+ *
	4133	+ * @since 2.11.5
	4134	+ *
	4135	+ * @param string $block Block from start marker to end marker, inclusive.
	4136	+ * @param array $markers Start and end marker.
	4137	+ * @return bool
	4138	+ */
	4139	+ private static function is_harmless_constants_block( $block, $markers ) {
	4140	+ $lines = explode( "\n", str_replace( array( "\r\n", "\r" ), "\n", (string) $block ) );
	4141	+
	4142	+ if ( count( $lines ) < 2
	4143	+ || rtrim( array_shift( $lines ), " \t" ) !== $markers[0]
	4144	+ || ltrim( array_pop( $lines ), " \t" ) !== $markers[1]
	4145	+ ) {
	4146	+ return false;
	4147	+ }
	4148	+
	4149	+ $define = self::harmless_define_pattern();
	4150	+ $guarded = '/^if\s*\(\s*!\s*defined\s*\(\s*[\'"][A-Z_]+[\'"]\s*\)\s*\)\s*\{\s*' . $define . '\s*\}$/';
	4151	+
	4152	+ foreach ( $lines as $line ) {
	4153	+ $line = trim( $line, " \t" );
	4154	+
	4155	+ if ( false !== strpos( $line, '<?' ) || false !== strpos( $line, '?>' ) ) {
	4156	+ return false;
	4157	+ }
	4158	+
	4159	+ if ( '' === $line
	4160	+ || 0 === strpos( $line, '//' )
	4161	+ || preg_match( '/^' . $define . '$/', $line )
	4162	+ || preg_match( $guarded, $line )
	4163	+ ) {
	4164	+ continue;
	4165	+ }
	4166	+
	4167	+ return false;
	4168	+ }
	4169	+
	4170	+ return true;
	4171	+ }
	4172	+
	4173	+ /**
	4174	+ * Take ownership of the blocks already on disk, once
	4175	+ *
	4176	+ * Fingerprints are recorded when Vigilant writes a block, which leaves every
	4177	+ * block written before 2.11.5 without one. This records the blocks that can
	4178	+ * be recognised as Vigilant's without having seen them written:
	4179	+ *
	4180	+ * - A .htaccess block, when it is exactly what Vigilant would write today
	4181	+ * with the settings it has, the timestamp and the version apart. After an
	4182	+ * update, maybe_sync_server_files() rewrites those blocks on the next
	4183	+ * request, so the claim waits for it. Unless it has already failed: a
	4184	+ * block Vigilant cannot rewrite is not going to start matching, and
	4185	+ * waiting for it would keep the old rule for good.
	4186	+ * - A wp-config.php constants block, when every line in it is a comment, a
	4187	+ * blank line or a harmless define(). Nothing rewrites that block on an
	4188	+ * update and its format has changed five times, so comparing it with
	4189	+ * today's output would report every site that has not saved those
	4190	+ * settings since. A line that could run anything is never accepted.
	4191	+ *
	4192	+ * A block that is not recognised stays in the hash and is reported as a
	4193	+ * change, so the owner gets to look at it, and the activity log says why.
	4194	+ * Nothing in the stored baseline is rewritten.
	4195	+ *
	4196	+ * Only where the shared files belong, a single site or the main site of a
	4197	+ * network, because the expected blocks come from that site's settings. Until
	4198	+ * it has run, normalize_critical_file() keeps the old rule on every site.
	4199	+ *
	4200	+ * @since 2.11.5
	4201	+ */
	4202	+ /**
	4203	+ * The admin_init entry point of the claim, which does ask for an administrator
	4204	+ *
	4205	+ * admin-ajax.php fires admin_init before it decides who is asking
	4206	+ * (wp-admin/admin-ajax.php:45), so without this an anonymous request chose
	4207	+ * the moment the claim runs. Unlike its two neighbours in
	4208	+ * init_cleanup_hooks(), which only drop the plugin's own copy out of the
	4209	+ * database, the claim writes two network options, changes for the whole
	4210	+ * network the rule normalize_critical_file() applies, and re-bases the
	4211	+ * approved baseline.
	4212	+ *
	4213	+ * The gate lives here and not inside maybe_claim_owned_blocks() because the
	4214	+ * scan calls that one directly and the scan runs from wp-cron, with no user:
	4215	+ * putting the capability check inside left the claim unable to complete on
	4216	+ * any site whose dashboard nobody opens, and until it completes the older,
	4217	+ * permissive rule is the one in force, which is the hiding place 2.11.5 was
	4218	+ * written to close. Found by the cross review of 2.11.10.
	4219	+ *
	4220	+ * @since 2.11.10
	4221	+ */
	4222	+ public function maybe_claim_owned_blocks_on_admin() {
	4223	+ if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) {
	4224	+ return;
	4225	+ }
	4226	+
	4227	+ $this->maybe_claim_owned_blocks();
	4228	+ }
	4229	+
	4230	+ public function maybe_claim_owned_blocks() {
	4231	+ if ( $this->owned_blocks_claimed() || ! Vigilante_Settings::owns_shared_files() ) {
	4232	+ return;
	4233	+ }
	4234	+
	4235	+ $sync_due = get_option( 'vigilante_server_files_pending' )
	4236	+ || VIGILANTE_VERSION !== get_option( 'vigilante_server_files_version' );
	4237	+
	4238	+ if ( $sync_due && ! get_option( 'vigilante_server_files_retry_after' ) ) {
	4239	+ return;
	4240	+ }
	4241	+
	4242	+ $expected = null;
	4243	+ $unclaimed = array();
	4244	+
	4245	+ foreach ( $this->critical_root_files as $filename ) {
	4246	+ $full_path = $this->critical_file_path( $filename );
	4247	+
	4248	+ if ( false === $full_path ) {
	4249	+ continue;
	4250	+ }
	4251	+
	4252	+ $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
	4253	+
	4254	+ if ( false === $content ) {
	4255	+ // Unreadable right now: leave the claim open and try again later.
	4256	+ return;
	4257	+ }
	4258	+
	4259	+ $content = str_replace( array( "\r\n", "\r" ), "\n", $content );
	4260	+ $is_config = 'wp-config.php' === $filename;
	4261	+
	4262	+ foreach ( ( $is_config ? $this->wpconfig_markers : $this->htaccess_markers ) as $markers ) {
	4263	+ $pattern = '/' . preg_quote( $markers[0], '/' ) . '.*?' . preg_quote( $markers[1], '/' ) . '/s';
	4264	+
	4265	+ if ( ! preg_match_all( $pattern, $content, $found ) ) {
	4266	+ continue;
	4267	+ }
	4268	+
	4269	+ foreach ( $found[0] as $block ) {
	4270	+ if ( $is_config ) {
	4271	+ $ours = self::is_harmless_constants_block( $block, $markers );
	4272	+ } else {
	4273	+ $expected = null === $expected ? $this->expected_htaccess_blocks() : $expected;
	4274	+ $ours = isset( $expected[ $markers[0] ] )
	4275	+ && self::comparable_block( $block ) === self::comparable_block( $expected[ $markers[0] ] );
	4276	+ }
	4277	+
	4278	+ if ( $ours ) {
	4279	+ self::remember_owned_block( $filename, $markers[0], $block, false );
	4280	+ } else {
	4281	+ $unclaimed[ $filename ] = $filename;
	4282	+ }
	4283	+ }
	4284	+ }
	4285	+
	4286	+ // The commented-out originals are judged line by line at scan time.
	4287	+ // Looking at them here only keeps the log entry below complete.
	4288	+ if ( $is_config && preg_match_all( '/^.*' . preg_quote( $this->wpconfig_original_marker, '/' ) . '.*$/m', $content, $marked ) ) {
	4289	+ foreach ( $marked[0] as $line ) {
	4290	+ if ( ! $this->is_vigilant_original_line( $line ) ) {
	4291	+ $unclaimed[ $filename ] = $filename;
	4292	+ }
	4293	+ }
	4294	+ }
	4295	+ }
	4296	+
	4297	+ update_site_option( self::OWNED_BLOCKS_CLAIM_OPTION, self::OWNED_BLOCKS_CLAIMED );
	4298	+
	4299	+ // With the claim in place normalize uses the new rule, so a file nobody
	4300	+ // touched whose only difference is an original line the old rule dropped
	4301	+ // would read as changed. Re-base those, and only those, once.
	4302	+ $this->rebase_original_line_shift();
	4303	+
	4304	+ if ( $unclaimed && $this->activity_log ) {
	4305	+ $this->activity_log->log(
	4306	+ 'file',
	4307	+ 'critical_file_unrecognized_block',
	4308	+ sprintf(
	4309	+ /* translators: %s: comma-separated file names, such as wp-config.php or .htaccess. */
	4310	+ __( 'Content marked as written by Vigilant in %s does not match what Vigilant writes. From now on it is checked like the rest of the file, so the file integrity scan reports it as a change for you to review.', 'vigilante' ),
	4311	+ implode( ', ', $unclaimed )
	4312	+ ),
	4313	+ array( 'files' => array_values( $unclaimed ) ),
	4314	+ 'warning'
	4315	+ );
	4316	+ }
	4317	+ }
	4318	+
	4319	+ /**
	4320	+ * Re-base the critical files whose only change is a newly kept original line
	4321	+ *
	4322	+ * Until 2.11.5 the hash left out every [VIGILANTE_ORIGINAL] line; from 2.11.5
	4323	+ * it keeps the ones whose value is not a plain constant define, which is the
	4324	+ * right thing for the hash but moves it on a file nobody edited: the stored
	4325	+ * baseline was taken under the old rule, and nothing re-bases wp-config.php on
	4326	+ * an update (maybe_sync_server_files() only rewrites the .htaccess). So the
	4327	+ * first scan after updating would report wp-config.php as changed.
	4328	+ *
	4329	+ * This runs once, in the same pass that claims the blocks. For each file it
	4330	+ * re-bases to the new hash only when the baseline still matches the file with
	4331	+ * every original line dropped, which means the blocks are exactly the approved
	4332	+ * ones and the sole difference is those lines, the user's own commented-out
	4333	+ * defines. A block that was edited or planted does not match with the lines
	4334	+ * dropped, so it is left to be reported: this closes the false positive
	4335	+ * without adopting anything that was hidden before.
	4336	+ *
	4337	+ * @since 2.11.5
	4338	+ */
	4339	+ private function rebase_original_line_shift() {
	4340	+ $baseline = $this->get_critical_files_baseline();
	4341	+ $changed = false;
	4342	+
	4343	+ foreach ( $this->critical_root_files as $filename ) {
	4344	+ $full_path = $this->critical_file_path( $filename );
	4345	+
	4346	+ if ( false === $full_path || empty( $baseline[ $filename ]['hash'] ) ) {
	4347	+ continue;
	4348	+ }
	4349	+
	4350	+ $content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
	4351	+
	4352	+ if ( false === $content ) {
	4353	+ continue;
	4354	+ }
	4355	+
	4356	+ /*
	4357	+ * Never re-base a file that carries a marked line which is not
	4358	+ * wholly a comment. The test below only establishes that the
	4359	+ * difference lies in lines carrying the marker, and the old rule
	4360	+ * dropped the WHOLE line, so a line with a statement in front of the
	4361	+ * marker satisfies it (cell X1 of matriz-escondite-marcadores.sh,
	4362	+ * where the shape is written out): re-basing would write that line
	4363	+ * into the approved baseline and rewrite the stored content, so the
	4364	+ * diff would stop showing it. Adopting as approved what the previous rule
	4365	+ * hid is the one thing an integrity scanner must never do, and the
	4366	+ * log entry of maybe_claim_owned_blocks() already promises the
	4367	+ * opposite ("the scan reports it as a change for you to review").
	4368	+ * Those files are left to be reported. Found by the file-by-file
	4369	+ * review of 2.11.10.
	4370	+ *
	4371	+ * What counts as "wholly a comment" is decided by reading the file
	4372	+ * as PHP reads it, not by the shape of the line: see
	4373	+ * marked_lines_are_inert(). A line that is not recognised is not the
	4374	+ * same thing as a line that can run something, and the first
	4375	+ * wording of this guard confused the two.
	4376	+ */
	4377	+ if ( ! $this->marked_lines_are_inert( $content ) ) {
	4378	+ continue;
	4379	+ }
	4380	+
	4381	+ $current = md5( $this->normalize_critical_file( $filename, $content ) );
	4382	+
	4383	+ // Already in step, or a real change to something other than the
	4384	+ // original lines: nothing to re-base here.
	4385	+ if ( $baseline[ $filename ]['hash'] === $current
	4386	+ || $baseline[ $filename ]['hash'] !== md5( $this->normalize_critical_file( $filename, $content, true ) )
	4387	+ ) {
	4388	+ continue;
	4389	+ }
	4390	+
	4391	+ $normalized = $this->normalize_critical_file( $filename, $content );
	4392	+ $baseline[ $filename ]['hash'] = $current;
	4393	+ $baseline[ $filename ]['size'] = strlen( $content );
	4394	+ $baseline[ $filename ]['content'] = $this->baseline_content( $filename, $normalized );
	4395	+ $baseline[ $filename ]['updated'] = time();
	4396	+ $changed = true;
	4397	+ }
	4398	+
	4399	+ if ( $changed ) {
	4400	+ $this->write_baseline( $baseline );
	4401	+ }
	4402	+ }
	4403	+
	4404	+ /**
	4405	+ * The .htaccess blocks Vigilant would write today, keyed by start marker
	4406	+ *
	4407	+ * @since 2.11.5
	4408	+ *
	4409	+ * @return array
	4410	+ */
	4411	+ private function expected_htaccess_blocks() {
	4412	+ $settings = $this->settings ? $this->settings : new Vigilante_Settings();
	4413	+
	4414	+ $classes = array(
	4415	+ 'Vigilante_Htaccess_Protection' => 'class-htaccess-protection.php',
	4416	+ 'Vigilante_Security_Headers' => 'class-security-headers.php',
	4417	+ );
	4418	+
	4419	+ foreach ( $classes as $class => $file ) {
	4420	+ if ( ! class_exists( $class ) ) {
	4421	+ require_once VIGILANTE_INCLUDES_DIR . $file;
	4422	+ }
	4423	+ }
	4424	+
	4425	+ $headers = new Vigilante_Security_Headers( $settings );
	4426	+
	4427	+ return array(
	4428	+ Vigilante_Htaccess_Protection::MARKER_START => ( new Vigilante_Htaccess_Protection( $settings ) )->generate_rules(),
	4429	+ Vigilante_Security_Headers::MARKER_START => Vigilante_Security_Headers::MARKER_START . "\n" . $headers->generate_rules_content() . "\n" . Vigilante_Security_Headers::MARKER_END,
	4430	+ );
	4431	+ }
	4432	+
	4433	+ /**
	4434	+ * A .htaccess block with the parts that change on every write evened out
	4435	+ *
	4436	+ * Two blocks Vigilant wrote with the same settings differ only in the time
	4437	+ * they were generated and, across an update, in the version the firewall
	4438	+ * block names. Everything else has to be identical for the claim to take
	4439	+ * the block.
	4440	+ *
	4441	+ * @since 2.11.5
	4442	+ *
	4443	+ * @param string $block Block from start marker to end marker, inclusive.
	4444	+ * @return string
	4445	+ */
	4446	+ private static function comparable_block( $block ) {
	4447	+ $block = str_replace( array( "\r\n", "\r" ), "\n", (string) $block );
	4448	+ $block = preg_replace( '/^# Generated: \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} UTC$/m', '# Generated:', $block );
	4449	+ $block = preg_replace( '/^# Vigilante for WordPress - Firewall v[0-9][0-9A-Za-z.\-]*$/m', '# Vigilante for WordPress - Firewall v', $block );
	4450	+
	4451	+ return rtrim( $block, "\n" );
	4452	+ }
	4453	+
	4454	+ /**
1787	4455	* Get stored baseline hashes for critical files
1788	4456	*
1789	4457	* @return array Associative array keyed by filename.
1790	4458	*/
		@@ -1801,11 +4469,11 @@
1801	4469	* @param string $filename File name relative to ABSPATH (e.g. 'wp-config.php').
1802	4470	* @return bool True on success.
1803	4471	*/
1804	4472	public function update_critical_file_baseline( $filename ) {
1805		- $full_path = untrailingslashit( ABSPATH ) . '/' . $filename;
	4473	+ $full_path = $this->critical_file_path( $filename );
1806	4474
1807		- if ( ! file_exists( $full_path ) ) {
	4475	+ if ( false === $full_path ) {
1808	4476	return false;
1809	4477	}
1810	4478
1811	4479	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -1862,14 +4530,13 @@
1862	4530	* @return array Updated baseline data.
1863	4531	*/
1864	4532	public function regenerate_all_baselines() {
1865	4533	$baseline = array();
1866		- $root_path = untrailingslashit( ABSPATH );
1867	4534
1868	4535	foreach ( $this->critical_root_files as $filename ) {
1869		- $full_path = $root_path . '/' . $filename;
	4536	+ $full_path = $this->critical_file_path( $filename );
1870	4537
1871		- if ( ! file_exists( $full_path ) ) {
	4538	+ if ( false === $full_path ) {
1872	4539	continue;
1873	4540	}
1874	4541
1875	4542	$content = file_get_contents( $full_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
		@@ -1896,10 +4563,10 @@
1896	4563	*
1897	4564	* @param bool $force_refresh Skip the cached copy and ask wp.org again.
1898	4565	* @return array|WP_Error Checksums or error.
1899	4566	*/
1900		- private function get_core_checksums( $force_refresh = false ) {
1901		- $locale = get_locale();
	4567	+ private function get_core_checksums( $force_refresh = false, $locale = null, $english_fallback = true ) {
	4568	+ $locale = null === $locale ? get_locale() : $locale;
1902	4569	$version = $this->wp_version;
1903	4570
1904	4571	// Check cache first
1905	4572	$cache_key = 'vigilante_core_checksums_' . md5( $version . $locale );
		@@ -1928,8 +4595,26 @@
1928	4595
1929	4596	$body = json_decode( wp_remote_retrieve_body( $response ), true );
1930	4597
1931	4598	if ( empty( $body['checksums'] ) ) {
	4599	+ /*
	4600	+ * WordPress.org has no list for this version in this language. That
	4601	+ * is the normal state of every site that is not in English for the
	4602	+ * hours or days after a release, until the package of its language
	4603	+ * is built, and of the languages that never get one. Until now the
	4604	+ * core was then not compared at all. Those sites run the English
	4605	+ * files, so the English list is the one to compare with. It is not
	4606	+ * kept under this language, so the next scan asks again.
	4607	+ */
	4608	+ if ( 'en_US' !== $locale && $english_fallback ) {
	4609	+ $english = $this->get_core_checksums( $force_refresh, 'en_US' );
	4610	+
	4611	+ if ( is_array( $english ) ) {
	4612	+ $this->core_checksums_are_english = true;
	4613	+ return $english;
	4614	+ }
	4615	+ }
	4616	+
1932	4617	return new WP_Error( 'no_checksums', __( 'Could not retrieve WordPress core checksums', 'vigilante' ) );
1933	4618	}
1934	4619
1935	4620	$checksums = $body['checksums'];
		@@ -1945,8 +4630,52 @@
1945	4630	return $checksums;
1946	4631	}
1947	4632
1948	4633	/**
	4634	+ * Whether a core file is the official copy of another language
	4635	+ *
	4636	+ * The checksums are asked for in the language of the site, and a site does
	4637	+ * not always run the package of its language: one installed in English and
	4638	+ * switched to Spanish afterwards keeps the English files, so its
	4639	+ * version.php and its wp-config-sample.php do not match the Spanish list.
	4640	+ * That is why version.php used to be left out of the comparison altogether,
	4641	+ * which left a file WordPress loads on every request unchecked. A file that
	4642	+ * matches the official copy of the same version in English, or in the
	4643	+ * language its own package declares, is an official file. The language
	4644	+ * only chooses which official list to look at: a file that was tampered
	4645	+ * with matches none of them.
	4646	+ *
	4647	+ * @param string $file Path relative to the WordPress root.
	4648	+ * @param string $actual_hash md5 of the file on disk.
	4649	+ * @return bool
	4650	+ */
	4651	+ private function matches_core_of_other_locale( $file, $actual_hash ) {
	4652	+ $current = get_locale();
	4653	+ $others = array( 'en_US' );
	4654	+
	4655	+ if ( ! empty( $GLOBALS['wp_local_package'] ) && is_string( $GLOBALS['wp_local_package'] ) ) {
	4656	+ $others[] = $GLOBALS['wp_local_package'];
	4657	+ }
	4658	+
	4659	+ foreach ( array_unique( $others ) as $locale ) {
	4660	+ if ( $locale === $current || ! preg_match( '/^[A-Za-z0-9_]{2,24}$/', $locale ) ) {
	4661	+ continue;
	4662	+ }
	4663	+
	4664	+ // Without the English list in its place: asking about another
	4665	+ // language must not leave the scan believing that the list of the
	4666	+ // site itself was missing.
	4667	+ $checksums = $this->get_core_checksums( false, $locale, false );
	4668	+
	4669	+ if ( is_array( $checksums ) && isset( $checksums[ $file ] ) && $checksums[ $file ] === $actual_hash ) {
	4670	+ return true;
	4671	+ }
	4672	+ }
	4673	+
	4674	+ return false;
	4675	+ }
	4676	+
	4677	+ /**
1949	4678	* Scan plugins for modifications
1950	4679	*
1951	4680	* @return array Scan results.
1952	4681	*/
		@@ -1964,9 +4693,10 @@
1964	4693	if ( ! function_exists( 'get_plugins' ) ) {
1965	4694	require_once ABSPATH . 'wp-admin/includes/plugin.php';
1966	4695	}
1967	4696
1968		- $plugins = get_plugins();
	4697	+ $plugins = get_plugins();
	4698	+ $finished = array();
1969	4699
1970	4700	foreach ( $plugins as $plugin_file => $plugin_data ) {
1971	4701	// Check time limit
1972	4702	if ( $this->is_time_exceeded() ) {
		@@ -1974,21 +4704,12 @@
1974	4704	}
1975	4705
1976	4706	$plugin_slug = dirname( $plugin_file );
1977	4707
1978		- // Skip single-file plugins
1979		- if ( '.' === $plugin_slug ) {
	4708	+ if ( ! $this->plugin_has_turn( $plugin_slug ) ) {
1980	4709	continue;
1981	4710	}
1982	4711
1983		- // Skip slugs in their post-update grace window: wp.org may still be
1984		- // publishing the new version's checksums, so a scheduled scan here
1985		- // would raise benign "modified/extra" noise. The dedicated post-update
1986		- // verifier (vigilante_fi_postupdate_verify) handles these instead.
1987		- if ( $this->in_post_update_grace( 'plugin', $plugin_slug ) ) {
1988		- continue;
1989		- }
1990		-
1991	4712	// Get checksums from WordPress.org
1992	4713	$version = $plugin_data['Version'] ?? '';
1993	4714	$checksums = $this->get_plugin_checksums( $plugin_slug, $version );
1994	4715
		@@ -1993,8 +4714,22 @@
1993	4714	$checksums = $this->get_plugin_checksums( $plugin_slug, $version );
1994	4715
1995	4716	$has_checksums = ! is_wp_error( $checksums ) && 'not_found' !== $checksums;
1996	4717
	4718	+ // Say which plugins could not be compared, and why. A plugin that
	4719	+ // is not on WordPress.org is named as such; a failed request is an
	4720	+ // error of this scan, not a plugin without an official copy.
	4721	+ if ( is_wp_error( $checksums ) ) {
	4722	+ $results['errors'][] = sprintf(
	4723	+ /* translators: 1: Plugin name, 2: What went wrong */
	4724	+ __( 'The plugin %1$s could not be compared with its copy on WordPress.org: %2$s', 'vigilante' ),
	4725	+ $plugin_data['Name'] ?? $plugin_slug,
	4726	+ $checksums->get_error_message()
	4727	+ );
	4728	+ } elseif ( ! $has_checksums ) {
	4729	+ $results['unverified'][] = $plugin_data['Name'] ?? $plugin_slug;
	4730	+ }
	4731	+
1997	4732	$plugin_dir = WP_PLUGIN_DIR . '/' . $plugin_slug;
1998	4733
1999	4734	// Check known files against checksums (only if available)
2000	4735	if ( $has_checksums ) {
		@@ -2023,9 +4758,17 @@
2023	4758
2024	4759	$results['scanned']++;
2025	4760
2026	4761	if ( ! file_exists( $file_path ) ) {
2027		- continue; // Some files might not be installed
	4762	+ // Reported, and not just skipped: a file that is in the
	4763	+ // published copy and not on the server is part of what
	4764	+ // the scan found.
	4765	+ $results['missing'][] = array(
	4766	+ 'file' => 'plugins/' . $plugin_slug . '/' . $file,
	4767	+ 'type' => 'plugin',
	4768	+ 'plugin' => $plugin_data['Name'] ?? $plugin_slug,
	4769	+ );
	4770	+ continue;
2028	4771	}
2029	4772
2030	4773	if ( ! $this->hash_matches_published( $file_path, $expected_hash ) ) {
2031	4774	$results['modified'][] = array(
		@@ -2049,15 +4792,84 @@
2049	4792	$suspicious_only = ! $has_checksums; // Without checksums, only report files with suspicious code
2050	4793	$extra_results = $this->detect_extra_files( $plugin_dir, $known_files, 'plugin', $plugin_data['Name'], $suspicious_only );
2051	4794	$results['extra'] = array_merge( $results['extra'] ?? array(), $extra_results['extra'] );
2052	4795	$results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $extra_results['suspicious'] );
	4796	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $extra_results['errors'] ?? array() );
2053	4797	}
	4798	+
	4799	+ // The plugin had its whole turn. The one the time runs out on
	4800	+ // does not get here with time left, and is named with the ones
	4801	+ // behind it.
	4802	+ if ( ! $this->is_time_exceeded() ) {
	4803	+ $finished[ $plugin_file ] = true;
	4804	+
	4805	+ // Its folder, as a line for Excluded Paths: what a partial
	4806	+ // scan offers so that the next one spends its time on the
	4807	+ // rest. One that is already excluded was not looked at.
	4808	+ if ( ! $this->is_path_excluded( $plugin_dir . '/.' ) ) {
	4809	+ $results['checked'][] = $this->relative_path( $plugin_dir );
	4810	+ }
	4811	+ }
2054	4812	}
2055	4813
	4814	+ // The plugins the time did not reach, by name.
	4815	+ $results['not_checked'] = array();
	4816	+
	4817	+ foreach ( $plugins as $plugin_file => $plugin_data ) {
	4818	+ if ( isset( $finished[ $plugin_file ] ) || ! $this->plugin_has_turn( dirname( $plugin_file ) ) ) {
	4819	+ continue;
	4820	+ }
	4821	+
	4822	+ $results['not_checked'][] = (string) ( $plugin_data['Name'] ?? dirname( $plugin_file ) );
	4823	+ }
	4824	+
	4825	+ // Must-use plugins, drop-ins and loose PHP files, which have no
	4826	+ // official copy and no entry in the list above.
	4827	+ $results['unlisted_checked'] = false;
	4828	+
	4829	+ if ( ! $this->is_time_exceeded() ) {
	4830	+ $unlisted = $this->scan_unlisted_code();
	4831	+
	4832	+ $results['extra'] = array_merge( $results['extra'] ?? array(), $unlisted['extra'] );
	4833	+ $results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $unlisted['suspicious'] );
	4834	+ $results['unverified'] = array_merge( $results['unverified'] ?? array(), $unlisted['unverified'] );
	4835	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $unlisted['errors'] );
	4836	+
	4837	+ $results['unlisted_checked'] = ! $this->is_time_exceeded();
	4838	+ }
	4839	+
2056	4840	return $results;
2057	4841	}
2058	4842
2059	4843	/**
	4844	+ * Whether a plugin gets a turn of its own in scan_plugins()
	4845	+ *
	4846	+ * @param string $plugin_slug Folder of the plugin, or "." for a single file.
	4847	+ * @return bool
	4848	+ */
	4849	+ private function plugin_has_turn( $plugin_slug ) {
	4850	+ // Single-file plugins are loose PHP files: scan_unlisted_code().
	4851	+ if ( '.' === $plugin_slug ) {
	4852	+ return false;
	4853	+ }
	4854	+
	4855	+ // With the self-check on, Vigilant itself is verified by the
	4856	+ // sha256 triple-anchor block at the start of run_scan(): scanning
	4857	+ // it here again would duplicate findings and the md5 fetch. With
	4858	+ // the check off by filter, Vigilant is a regular plugin (legacy
	4859	+ // behaviour).
	4860	+ if ( dirname( VIGILANTE_PLUGIN_BASENAME ) === $plugin_slug && Vigilante_Self_Integrity::is_on() ) {
	4861	+ return false;
	4862	+ }
	4863	+
	4864	+ // Skip slugs in their post-update grace window: wp.org may still be
	4865	+ // publishing the new version's checksums, so a scheduled scan here
	4866	+ // would raise benign "modified/extra" noise. The dedicated post-update
	4867	+ // verifier (vigilante_fi_postupdate_verify) handles these instead.
	4868	+ return ! $this->in_post_update_grace( 'plugin', $plugin_slug );
	4869	+ }
	4870	+
	4871	+ /**
2060	4872	* Whether a file on disk matches a hash WordPress.org publishes for it.
2061	4873	*
2062	4874	* The wp.org checksums JSON gives, per file, an md5 (and usually a sha256)
2063	4875	* that may be a single string OR an array of strings: a file whose content
		@@ -2187,9 +4999,9 @@
2187	4999	return $response;
2188	5000	}
2189	5001
2190	5002	$status = wp_remote_retrieve_response_code( $response );
2191		- if ( 200 !== $status ) {
	5003	+ if ( 404 === (int) $status ) {
2192	5004	// Cache "not found" to avoid repeated requests (never during grace).
2193	5005	if ( ! $grace ) {
2194	5006	set_transient( $cache_key, 'not_found', HOUR_IN_SECONDS );
2195	5007	}
		@@ -2195,8 +5007,19 @@
2195	5007	}
2196	5008	return 'not_found';
2197	5009	}
2198	5010
	5011	+ if ( 200 !== (int) $status ) {
	5012	+ // WordPress.org answered, but not with the checksums. An outage is
	5013	+ // not a plugin with no published copy, and until now it passed
	5014	+ // for one: the plugin was quietly left uncompared.
	5015	+ return new WP_Error(
	5016	+ 'http_error',
	5017	+ /* translators: %d: HTTP status code */
	5018	+ sprintf( __( 'WordPress.org answered with status %d', 'vigilante' ), (int) $status )
	5019	+ );
	5020	+ }
	5021	+
2199	5022	$body = json_decode( wp_remote_retrieve_body( $response ), true );
2200	5023
2201	5024	if ( empty( $body['files'] ) ) {
2202	5025	return new WP_Error( 'no_checksums', __( 'No checksums found', 'vigilante' ) );
		@@ -2235,9 +5058,10 @@
2235	5058	'extra' => array(),
2236	5059	'errors' => array(),
2237	5060	);
2238	5061
2239		- $themes = wp_get_themes();
	5062	+ $themes = wp_get_themes();
	5063	+ $finished = array();
2240	5064
2241	5065	foreach ( $themes as $theme_slug => $theme ) {
2242	5066	// Check time limit
2243	5067	if ( $this->is_time_exceeded() ) {
		@@ -2253,8 +5077,20 @@
2253	5077	$checksums = $this->get_theme_checksums( $theme_slug, $version );
2254	5078
2255	5079	$has_checksums = ! is_wp_error( $checksums ) && 'not_found' !== $checksums;
2256	5080
	5081	+ // Same as for plugins: name what could not be compared, and why.
	5082	+ if ( is_wp_error( $checksums ) && 'not_found' !== $checksums->get_error_code() ) {
	5083	+ $results['errors'][] = sprintf(
	5084	+ /* translators: 1: Theme name, 2: What went wrong */
	5085	+ __( 'The theme %1$s could not be compared with its copy on WordPress.org: %2$s', 'vigilante' ),
	5086	+ $theme->get( 'Name' ),
	5087	+ $checksums->get_error_message()
	5088	+ );
	5089	+ } elseif ( ! $has_checksums ) {
	5090	+ $results['unverified'][] = $theme->get( 'Name' );
	5091	+ }
	5092	+
2257	5093	$theme_dir = $theme->get_stylesheet_directory();
2258	5094
2259	5095	// Check known files against checksums (only if available)
2260	5096	if ( $has_checksums ) {
		@@ -2283,8 +5119,13 @@
2283	5119
2284	5120	$results['scanned']++;
2285	5121
2286	5122	if ( ! file_exists( $file_path ) ) {
	5123	+ $results['missing'][] = array(
	5124	+ 'file' => 'themes/' . $theme_slug . '/' . $file,
	5125	+ 'type' => 'theme',
	5126	+ 'theme' => $theme->get( 'Name' ),
	5127	+ );
2287	5128	continue;
2288	5129	}
2289	5130
2290	5131	if ( ! $this->hash_matches_published( $file_path, $expected_hash ) ) {
		@@ -2307,11 +5148,32 @@
2307	5148	$suspicious_only = ! $has_checksums;
2308	5149	$extra_results = $this->detect_extra_files( $theme_dir, $known_files, 'theme', $theme->get( 'Name' ), $suspicious_only );
2309	5150	$results['extra'] = array_merge( $results['extra'] ?? array(), $extra_results['extra'] );
2310	5151	$results['suspicious'] = array_merge( $results['suspicious'] ?? array(), $extra_results['suspicious'] );
	5152	+ $results['errors'] = array_merge( $results['errors'] ?? array(), $extra_results['errors'] ?? array() );
2311	5153	}
	5154	+
	5155	+ // Same as for plugins: a whole turn, with time left.
	5156	+ if ( ! $this->is_time_exceeded() ) {
	5157	+ $finished[ $theme_slug ] = true;
	5158	+
	5159	+ if ( ! $this->is_path_excluded( $theme_dir . '/.' ) ) {
	5160	+ $results['checked'][] = $this->relative_path( $theme_dir );
	5161	+ }
	5162	+ }
2312	5163	}
2313	5164
	5165	+ // The themes the time did not reach, by name.
	5166	+ $results['not_checked'] = array();
	5167	+
	5168	+ foreach ( $themes as $theme_slug => $theme ) {
	5169	+ if ( isset( $finished[ $theme_slug ] ) || $this->in_post_update_grace( 'theme', $theme_slug ) ) {
	5170	+ continue;
	5171	+ }
	5172	+
	5173	+ $results['not_checked'][] = (string) $theme->get( 'Name' );
	5174	+ }
	5175	+
2314	5176	return $results;
2315	5177	}
2316	5178
2317	5179	/**
		@@ -2321,9 +5183,9 @@
2321	5183	* @param string $version Theme version.
2322	5184	* @return array|WP_Error
2323	5185	*/
2324	5186	private function get_theme_checksums( $slug, $version ) {
2325		- $cache_key = 'vigilante_theme_checksums_' . md5( $slug . $version );
	5187	+ $cache_key = 'vigilante_theme_package_' . md5( $slug . $version );
2326	5188
2327	5189	// Bypass the cache during the post-update grace window (see plugin path).
2328	5190	$grace = $this->in_post_update_grace( 'theme', $slug );
2329	5191
		@@ -2333,48 +5195,103 @@
2333	5195	return $cached;
2334	5196	}
2335	5197	}
2336	5198
2337		- $url = sprintf(
2338		- 'https://downloads.wordpress.org/theme-checksums/%s/%s.json',
2339		- $slug,
2340		- $version
2341		- );
	5199	+ /*
	5200	+ * WordPress.org publishes checksums for plugins and for core, and none
	5201	+ * for themes: the address this method asked until now answers 404 for
	5202	+ * every theme, so no theme was ever compared with anything and they
	5203	+ * were all treated as themes from elsewhere. What WordPress.org does
	5204	+ * publish is the package of each version, so the checksums are taken
	5205	+ * from there: the package is downloaded once per version, each file in
	5206	+ * it is hashed straight from the archive, nothing is unpacked to disk,
	5207	+ * and the result is kept for a month.
	5208	+ */
	5209	+ if ( '' === (string) $version || ! preg_match( '/^[A-Za-z0-9._-]+$/', (string) $slug ) ) {
	5210	+ return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
	5211	+ }
2342	5212
2343		- $response = wp_remote_get( $url, array( 'timeout' => 10 ) );
	5213	+ if ( ! class_exists( 'ZipArchive' ) ) {
	5214	+ return new WP_Error( 'no_zip', __( 'the zip extension of PHP is missing on this server', 'vigilante' ) );
	5215	+ }
2344	5216
2345		- if ( is_wp_error( $response ) ) {
2346		- return $response;
	5217	+ if ( ! function_exists( 'download_url' ) ) {
	5218	+ require_once ABSPATH . 'wp-admin/includes/file.php';
2347	5219	}
2348	5220
2349		- $status = wp_remote_retrieve_response_code( $response );
2350		- if ( 200 !== $status ) {
2351		- // Cache "not found" to avoid repeated requests (never during grace).
2352		- if ( ! $grace ) {
2353		- set_transient( $cache_key, 'not_found', HOUR_IN_SECONDS );
	5221	+ $package = download_url(
	5222	+ sprintf( 'https://downloads.wordpress.org/theme/%s.%s.zip', rawurlencode( $slug ), rawurlencode( (string) $version ) ),
	5223	+ 30
	5224	+ );
	5225	+
	5226	+ if ( is_wp_error( $package ) ) {
	5227	+ $data = $package->get_error_data();
	5228	+
	5229	+ // WordPress.org has no such theme or no such version: a theme from
	5230	+ // somewhere else. Anything other than a 404 is a failed download,
	5231	+ // and is reported as that instead of passing for a theme with no
	5232	+ // official copy.
	5233	+ if ( is_array( $data ) && isset( $data['code'] ) && 404 === (int) $data['code'] ) {
	5234	+ if ( ! $grace ) {
	5235	+ set_transient( $cache_key, 'not_found', 12 * HOUR_IN_SECONDS );
	5236	+ }
	5237	+ return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
2354	5238	}
2355		- return new WP_Error( 'not_found', __( 'Checksums not available', 'vigilante' ) );
	5239	+
	5240	+ return $package;
2356	5241	}
2357	5242
2358		- $body = json_decode( wp_remote_retrieve_body( $response ), true );
	5243	+ $checksums = array();
	5244	+ $archive = new ZipArchive();
2359	5245
2360		- if ( empty( $body['files'] ) ) {
2361		- return new WP_Error( 'no_checksums', __( 'No checksums found', 'vigilante' ) );
	5246	+ if ( true === $archive->open( $package ) ) {
	5247	+ $prefix = $slug . '/';
	5248	+ $max_entry = 16 * MB_IN_BYTES;
	5249	+
	5250	+ for ( $i = 0; $i < $archive->numFiles; $i++ ) {
	5251	+ $entry = $archive->statIndex( $i );
	5252	+ $name = is_array( $entry ) ? (string) $entry['name'] : '';
	5253	+
	5254	+ // Everything in the package lives under the folder of the theme.
	5255	+ // Folders, anything outside it and any path with a ".."
	5256	+ // segment are not files of the theme.
	5257	+ if ( '' === $name || '/' === substr( $name, -1 ) || 0 !== strpos( $name, $prefix ) || preg_match( '#(?:^|/)\.\.(?:/|$)#', $name ) ) {
	5258	+ continue;
	5259	+ }
	5260	+
	5261	+ // Read up to a limit: an entry larger than this is not code,
	5262	+ // and is left out of the comparison instead of being loaded
	5263	+ // whole into memory.
	5264	+ $content = $archive->getFromIndex( $i, $max_entry + 1 );
	5265	+
	5266	+ if ( false === $content ) {
	5267	+ $checksums = array();
	5268	+ break;
	5269	+ }
	5270	+
	5271	+ if ( strlen( $content ) > $max_entry ) {
	5272	+ continue;
	5273	+ }
	5274	+
	5275	+ $checksums[ substr( $name, strlen( $prefix ) ) ] = array(
	5276	+ 'md5' => md5( $content ),
	5277	+ 'sha256' => hash( 'sha256', $content ),
	5278	+ );
	5279	+ }
	5280	+
	5281	+ $archive->close();
2362	5282	}
2363	5283
2364		- // Store the full per-file record (md5 + sha256), either of which may be a
2365		- // string or an array; hash_matches_published() handles both shapes.
2366		- $checksums = array();
2367		- foreach ( $body['files'] as $file => $data ) {
2368		- $checksums[ $file ] = array(
2369		- 'md5' => isset( $data['md5'] ) ? $data['md5'] : null,
2370		- 'sha256' => isset( $data['sha256'] ) ? $data['sha256'] : null,
2371		- );
	5284	+ wp_delete_file( $package );
	5285	+
	5286	+ if ( empty( $checksums ) ) {
	5287	+ return new WP_Error( 'no_checksums', __( 'the package from WordPress.org could not be read', 'vigilante' ) );
2372	5288	}
2373	5289
2374		- // Cache for 24 hours (never during grace).
	5290	+ // The package of a published version does not change, so it is kept
	5291	+ // for a month (never during grace).
2375	5292	if ( ! $grace ) {
2376		- set_transient( $cache_key, $checksums, DAY_IN_SECONDS );
	5293	+ set_transient( $cache_key, $checksums, MONTH_IN_SECONDS );
2377	5294	}
2378	5295
2379	5296	return $checksums;
2380	5297	}
		@@ -2387,36 +5304,56 @@
2387	5304	private function scan_uploads() {
2388	5305	$found = array(
2389	5306	'suspicious' => array(),
2390	5307	'extra' => array(),
	5308	+ 'errors' => array(),
2391	5309	);
2392	5310	$upload_dir = wp_upload_dir();
2393	5311	$base_dir = $upload_dir['basedir'];
2394		- $max_files = 10000; // Increased limit for thorough scanning
2395	5312	$files_checked = 0;
2396	5313
	5314	+ // The walk used to stop after 10,000 files without saying so, and a
	5315	+ // media library passes that with a few thousand images. Now it goes on
	5316	+ // for as long as its share of the scan time lasts, and says so when it
	5317	+ // is cut short. The share keeps a huge library from leaving the core
	5318	+ // and the plugins without their turn.
	5319	+ $deadline = $this->scan_start_time > 0 ? $this->scan_start_time + ( 0.4 * $this->max_scan_time ) : 0;
	5320	+
2397	5321	// Executable extensions that should never be in uploads
2398		- $dangerous_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar', 'phps' );
	5322	+ $dangerous_extensions = self::php_extensions();
2399	5323
	5324	+ // Files that change how PHP runs in the folder they are in.
	5325	+ $php_config_files = array( '.user.ini', 'php.ini' );
	5326	+
	5327	+ // Scripts a server can be told to run through CGI.
	5328	+ $script_extensions = array( 'cgi', 'pl', 'py', 'sh', 'shtml' );
	5329	+
2400	5330	if ( ! is_dir( $base_dir ) ) {
2401	5331	return $found;
2402	5332	}
2403	5333
2404	5334	try {
2405		- $iterator = new RecursiveIteratorIterator(
2406		- new RecursiveDirectoryIterator( $base_dir, RecursiveDirectoryIterator::SKIP_DOTS ),
2407		- RecursiveIteratorIterator::LEAVES_ONLY
2408		- );
2409		-
2410		- foreach ( $iterator as $file ) {
	5335	+ foreach ( self::walk_folder( $base_dir ) as $file ) {
2411	5336	// Check global time limit
2412	5337	if ( $this->is_time_exceeded() ) {
2413	5338	break;
2414	5339	}
2415	5340
2416		- // Check file limit
	5341	+ if ( $file->isDir() ) {
	5342	+ if ( ! $file->isReadable() ) {
	5343	+ $found['errors'][] = self::unreadable_folder_error( $file->getPathname() );
	5344	+ }
	5345	+ continue;
	5346	+ }
	5347	+
	5348	+ // Check the share of the scan time (every 500 files)
2417	5349	$files_checked++;
2418		- if ( $files_checked > $max_files ) {
	5350	+ if ( $deadline > 0 && 0 === $files_checked % 500 && microtime( true ) > $deadline ) {
	5351	+ $found['errors'][] = sprintf(
	5352	+ /* translators: %s: Number of files */
	5353	+ __( 'The uploads folder was not checked completely: the time for it ran out after %s files.', 'vigilante' ),
	5354	+ number_format_i18n( $files_checked )
	5355	+ );
2419	5356	break;
2420	5357	}
2421	5358
2422	5359	$file_path = $file->getPathname();
		@@ -2441,15 +5378,12 @@
2441	5378
2442	5379	$reason = __( 'PHP file found in uploads directory', 'vigilante' );
2443	5380
2444	5381	// Scan content for specific suspicious patterns
2445		- if ( $file->getSize() < 512000 ) { // Only scan files < 500KB
2446		- $content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
2447		- $pattern = $this->detect_suspicious_pattern( $content );
2448		- if ( $pattern ) {
2449		- /* translators: %s: Suspicious pattern found */
2450		- $reason = sprintf( __( 'PHP in uploads with suspicious code: %s', 'vigilante' ), $pattern );
2451		- }
	5382	+ $pattern = $this->search_file( $file_path );
	5383	+ if ( $pattern ) {
	5384	+ /* translators: %s: Suspicious pattern found */
	5385	+ $reason = sprintf( __( 'PHP in uploads with suspicious code: %s', 'vigilante' ), $pattern );
2452	5386	}
2453	5387
2454	5388	$found['suspicious'][] = array(
2455	5389	'file' => $relative,
		@@ -2459,9 +5393,12 @@
2459	5393	continue;
2460	5394	}
2461	5395
2462	5396	// 2. Check for double extensions (image.php.jpg, file.phtml.png)
2463		- if ( preg_match( '/\.(' . implode( '|', $dangerous_extensions ) . ')\.[a-z]{2,4}$/i', $basename ) ) {
	5397	+ // The second extension can be anything: a script renamed by a
	5398	+ // malware cleaner (shell.php.suspected) or numbered (shell.php.1)
	5399	+ // is as much of a finding as one dressed up as an image.
	5400	+ if ( preg_match( '/\.(' . implode( '|', $dangerous_extensions ) . ')\.[a-z0-9_~-]{1,16}$/i', $basename ) ) {
2464	5401	$found['suspicious'][] = array(
2465	5402	'file' => $relative,
2466	5403	'type' => 'double_extension',
2467	5404	'reason' => __( 'Double extension detected (possible disguised executable)', 'vigilante' ),
		@@ -2468,17 +5405,41 @@
2468	5405	);
2469	5406	continue;
2470	5407	}
2471	5408
	5409	+ // 2b. Files that change how PHP runs in this folder
	5410	+ if ( in_array( strtolower( $basename ), $php_config_files, true ) ) {
	5411	+ $found['suspicious'][] = array(
	5412	+ 'file' => $relative,
	5413	+ 'type' => 'php_config_in_uploads',
	5414	+ 'reason' => __( 'PHP configuration file in uploads', 'vigilante' ),
	5415	+ );
	5416	+ continue;
	5417	+ }
	5418	+
	5419	+ // 2c. Scripts in other languages
	5420	+ if ( in_array( $extension, $script_extensions, true ) ) {
	5421	+ $found['extra'][] = array(
	5422	+ 'file' => $relative,
	5423	+ 'type' => 'script_in_uploads',
	5424	+ 'reason' => __( 'Script file in uploads', 'vigilante' ),
	5425	+ );
	5426	+ continue;
	5427	+ }
	5428	+
2472	5429	// 3. Check for .htaccess files in uploads
2473		- // Read content to classify: dangerous rules = suspicious, protective rules = extra
	5430	+ // Read content to classify (see classify_htaccess_in_uploads())
2474	5431	if ( '.htaccess' === $basename ) {
2475	5432	$htaccess_result = $this->classify_htaccess_in_uploads( $file_path, $relative );
2476		- $found[ $htaccess_result['category'] ][] = $htaccess_result['item'];
	5433	+
	5434	+ // One that only denies access, or does nothing, is not a finding.
	5435	+ if ( 'none' !== $htaccess_result['category'] ) {
	5436	+ $found[ $htaccess_result['category'] ][] = $htaccess_result['item'];
	5437	+ }
2477	5438	}
2478	5439	}
2479	5440	} catch ( Exception $e ) {
2480		- // Ignore iterator errors
	5441	+ $found['errors'][] = self::unreadable_folder_error( $base_dir );
2481	5442	}
2482	5443
2483	5444	return $found;
2484	5445	}
		@@ -2485,94 +5446,515 @@
2485	5446
2486	5447	/**
2487	5448	* Classify a .htaccess file found in uploads directory
2488	5449	*
2489		- * Reads the file content to determine if it contains dangerous rules
2490		- * (enabling PHP execution, rewriting to executables) or protective rules
2491		- * (deny access, disable indexes). Dangerous = suspicious, protective = extra.
	5450	+ * The file is read the way Apache reads it: continued lines are joined,
	5451	+ * comments are dropped and each directive is looked at on its own. That
	5452	+ * replaces a handful of expressions run over the whole text, which took a
	5453	+ * commented line for a live one and the rule that forbids PHP for one that
	5454	+ * runs it, and let through the directives that turn CGI on.
2492	5455	*
	5456	+ * - Something that makes the server run code: suspicious.
	5457	+ * - Only directives that deny or switch something off: not reported.
	5458	+ * - Rewrite rules of its own and nothing that denies PHP: extra, because in
	5459	+ * that folder they replace the rules of the site root, the one that
	5460	+ * blocks PHP in uploads included (measured on Apache, 3 Oct 2026).
	5461	+ * - Anything else: extra, with what it contains.
	5462	+ *
2493	5463	* @param string $file_path Absolute file path.
2494	5464	* @param string $relative Relative file path for display.
2495		- * @return array Array with 'category' ('suspicious' or 'extra') and 'item' data.
	5465	+ * @return array Array with 'category' ('suspicious', 'extra' or 'none') and 'item' data.
2496	5466	*/
2497	5467	private function classify_htaccess_in_uploads( $file_path, $relative ) {
2498		- $content = '';
	5468	+ $content = false;
2499	5469
2500	5470	if ( filesize( $file_path ) < 65536 ) { // Only read files < 64KB
2501	5471	$content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
2502	5472	}
2503	5473
2504		- // If we can't read it or it's empty, treat as suspicious (unknown)
2505		- if ( empty( trim( $content ) ) ) {
	5474	+ $item = array(
	5475	+ 'file' => $relative,
	5476	+ 'type' => 'htaccess_in_uploads',
	5477	+ );
	5478	+
	5479	+ // A file that cannot be read cannot be vouched for.
	5480	+ if ( false === $content ) {
	5481	+ $item['reason'] = __( '.htaccess file in uploads directory that could not be read', 'vigilante' );
	5482	+
2506	5483	return array(
2507	5484	'category' => 'suspicious',
2508		- 'item' => array(
2509		- 'file' => $relative,
2510		- 'type' => 'htaccess_in_uploads',
2511		- 'reason' => __( '.htaccess file in uploads directory (empty or unreadable)', 'vigilante' ),
2512		- ),
	5485	+ 'item' => $item,
2513	5486	);
2514	5487	}
2515	5488
2516		- // Dangerous patterns: rules that enable code execution or rewrite to executables
2517		- $dangerous_patterns = array(
2518		- '/AddHandler\s+.*(php|cgi|pl|py)/i' => 'AddHandler enabling script execution',
2519		- '/AddType\s+application\/x-httpd-php/i' => 'AddType enabling PHP execution',
2520		- '/SetHandler\s+.*(php|cgi)/i' => 'SetHandler enabling script execution',
2521		- '/php_flag\s+engine\s+on/i' => 'PHP engine enabled',
2522		- '/php_admin_flag\s+engine\s+on/i' => 'PHP admin engine enabled',
2523		- '/RewriteRule\s+.*\.(php|phtml|phar)/i' => 'Rewrite rule targeting PHP files',
2524		- '/auto_prepend_file/i' => 'auto_prepend_file directive',
2525		- '/auto_append_file/i' => 'auto_append_file directive',
	5489	+ $facts = self::read_htaccess_rules( $content );
	5490	+
	5491	+ if ( ! empty( $facts['runs'] ) ) {
	5492	+ $item['reason'] = self::htaccess_run_reason( $facts );
	5493	+
	5494	+ return array(
	5495	+ 'category' => 'suspicious',
	5496	+ 'item' => $item,
	5497	+ );
	5498	+ }
	5499	+
	5500	+ if ( $facts['rewrite'] && ! $facts['denies_php'] ) {
	5501	+ $item['reason'] = __( '.htaccess in uploads with rewrite rules of its own: in this folder they replace the ones of the site root, the rule that blocks PHP in uploads included', 'vigilante' );
	5502	+
	5503	+ return array(
	5504	+ 'category' => 'extra',
	5505	+ 'item' => $item,
	5506	+ );
	5507	+ }
	5508	+
	5509	+ // Empty, or nothing in it that does not deny or switch something off:
	5510	+ // it protects the folder, or does nothing, and is not a finding.
	5511	+ if ( empty( $facts['other'] ) ) {
	5512	+ return array(
	5513	+ 'category' => 'none',
	5514	+ 'item' => null,
	5515	+ );
	5516	+ }
	5517	+
	5518	+ $kinds = array(
	5519	+ 'access' => __( 'access rules', 'vigilante' ),
	5520	+ 'rewrite' => __( 'rewrite rules', 'vigilante' ),
	5521	+ 'headers' => __( 'cache or header rules', 'vigilante' ),
	5522	+ 'other' => __( 'other rules', 'vigilante' ),
2526	5523	);
2527	5524
2528		- foreach ( $dangerous_patterns as $pattern => $label ) {
2529		- if ( preg_match( $pattern, $content ) ) {
2530		- return array(
2531		- 'category' => 'suspicious',
2532		- 'item' => array(
2533		- 'file' => $relative,
2534		- 'type' => 'htaccess_in_uploads',
2535		- /* translators: %s: Dangerous rule description */
2536		- 'reason' => sprintf( __( '.htaccess with dangerous rule: %s', 'vigilante' ), $label ),
2537		- ),
2538		- );
	5525	+ /* translators: %s: Summary of rules found in the .htaccess file */
	5526	+ $item['reason'] = sprintf( __( '.htaccess in uploads (likely from plugin). Contains: %s', 'vigilante' ), implode( ', ', array_intersect_key( $kinds, $facts['other'] ) ) );
	5527	+
	5528	+ return array(
	5529	+ 'category' => 'extra',
	5530	+ 'item' => $item,
	5531	+ );
	5532	+ }
	5533	+
	5534	+ /**
	5535	+ * The reason shown for a .htaccess that makes the server run code
	5536	+ *
	5537	+ * @param array $facts What read_htaccess_rules() found.
	5538	+ * @return string
	5539	+ */
	5540	+ private static function htaccess_run_reason( $facts ) {
	5541	+ $labels = array(
	5542	+ 'run' => __( 'makes the server run files of this folder as code', 'vigilante' ),
	5543	+ 'load' => __( 'loads a file on every PHP request', 'vigilante' ),
	5544	+ 'rewrite' => __( 'sends requests to a PHP file', 'vigilante' ),
	5545	+ 'cgi' => __( 'turns on CGI or server-side includes', 'vigilante' ),
	5546	+ );
	5547	+
	5548	+ /* translators: %s: What the rule does */
	5549	+ return sprintf( __( '.htaccess with a rule that affects how code runs: %s', 'vigilante' ), implode( '; ', array_intersect_key( $labels, $facts['runs'] ) ) );
	5550	+ }
	5551	+
	5552	+ /**
	5553	+ * What a section of a .htaccess says about the directives inside it
	5554	+ *
	5555	+ * @param string $name Section name, in lower case.
	5556	+ * @param string $args What follows the name, as written.
	5557	+ * @return string '' when it changes nothing (<RequireAll>), 'rewrite' for
	5558	+ * <IfModule mod_rewrite.c>, 'maybe' for any other test of
	5559	+ * what the server has, 'files-php' for a <Files> or
	5560	+ * <FilesMatch> that names PHP files, 'files' for one that
	5561	+ * names other files, and 'condition' for the rest (<Limit>,
	5562	+ * <If>, <RequireAny>...), which apply to some requests only.
	5563	+ */
	5564	+ private static function htaccess_section_kind( $name, $args ) {
	5565	+ $args = trim( rtrim( trim( $args ), '>' ) );
	5566	+
	5567	+ if ( 'requireall' === $name ) {
	5568	+ return '';
	5569	+ }
	5570	+
	5571	+ if ( 'ifmodule' === $name ) {
	5572	+ return in_array( strtolower( trim( $args, '"\' ' ) ), array( 'mod_rewrite.c', 'rewrite_module' ), true ) ? 'rewrite' : 'maybe';
	5573	+ }
	5574	+
	5575	+ if ( in_array( $name, array( 'ifdefine', 'ifversion' ), true ) ) {
	5576	+ return 'maybe';
	5577	+ }
	5578	+
	5579	+ if ( 'files' === $name || 'filesmatch' === $name ) {
	5580	+ $regex = 'filesmatch' === $name;
	5581	+
	5582	+ if ( ! $regex && '~' === substr( $args, 0, 1 ) ) {
	5583	+ $regex = true;
	5584	+ $args = trim( substr( $args, 1 ) );
2539	5585	}
	5586	+
	5587	+ return true === self::extension_pattern_names_php( trim( $args, '"\'' ), $regex, false ) ? 'files-php' : 'files';
2540	5588	}
2541	5589
2542		- // Identify what protective/benign rules it contains for informational display
2543		- $found_rules = array();
	5590	+ return 'condition';
	5591	+ }
2544	5592
2545		- $benign_patterns = array(
2546		- '/Deny\s+from\s+all/i' => 'Deny from all',
2547		- '/Require\s+all\s+denied/i' => 'Require all denied',
2548		- '/Options\s+.*-Indexes/i' => 'Options -Indexes',
2549		- '/Header\s+set/i' => 'Header rules',
2550		- '/ExpiresActive/i' => 'Expires/cache rules',
2551		- '/RewriteEngine/i' => 'Rewrite rules',
2552		- '/FilesMatch/i' => 'FilesMatch rules',
2553		- '/ForceType\s+application\/octet/i' => 'ForceType (force download)',
	5593	+ /**
	5594	+ * Whether a pattern that goes only by the extension of a file names the PHP ones
	5595	+ *
	5596	+ * "Every PHP file" cannot be asked of a sample name. A sample is public,
	5597	+ * so a section can be written for it and nothing else, and an expression
	5598	+ * can name every file but one ("all but shell.php") in more ways than can
	5599	+ * be tried. So the pattern has to be of a kind that cannot tell one name
	5600	+ * from another: any name, a dot and a list of extensions, to the end. In
	5601	+ * that kind there is nothing to make an exception with, and whether .php
	5602	+ * is on the list is then a fair question for a sample. Anything else is
	5603	+ * not taken for a denial of PHP, which only means the .htaccess is listed.
	5604	+ *
	5605	+ * @param string $pattern Pattern, without its quotes.
	5606	+ * @param bool $regex Whether it is an expression (FilesMatch, "Files ~",
	5607	+ * RewriteRule) or a wildcard (Files).
	5608	+ * @param bool $nocase Whether it ignores case.
	5609	+ * @return bool|null True when it names every .php file, false when it goes
	5610	+ * by the extension and .php is not one of them, null
	5611	+ * when it is not of that kind.
	5612	+ */
	5613	+ private static function extension_pattern_names_php( $pattern, $regex, $nocase ) {
	5614	+ if ( ! $regex ) {
	5615	+ if ( 1 !== preg_match( '/^\*\.[a-z0-9*?]+$/i', $pattern ) ) {
	5616	+ return null;
	5617	+ }
	5618	+
	5619	+ return function_exists( 'fnmatch' ) ? fnmatch( $pattern, 'x.php' ) : '*.php' === $pattern;
	5620	+ }
	5621	+
	5622	+ $rest = $pattern;
	5623	+
	5624	+ if ( 0 === stripos( $rest, '(?i)' ) ) {
	5625	+ $rest = substr( $rest, 4 );
	5626	+ $nocase = true;
	5627	+ }
	5628	+
	5629	+ // "Any name" in front, written out or left out, and then a dot, the
	5630	+ // extensions and the end, written out or left out too. The extensions
	5631	+ // are letters, digits, groups, alternatives and classes of letters and
	5632	+ // digits: no dot, no "any character", nothing negated and nothing
	5633	+ // that looks around.
	5634	+ $rest = preg_replace( '/^\^?\.[*+]/', '', $rest, 1 );
	5635	+
	5636	+ if ( 1 !== preg_match( '/^\\\\\.(?:[a-z0-9|?*+)]|\\\\d|\[[a-z0-9-]+\]|\((?:\?i?:)?)+\$?$/i', (string) $rest ) ) {
	5637	+ return null;
	5638	+ }
	5639	+
	5640	+ // The dot has to be there: with "?" or "*" after it, what follows
	5641	+ // would be looked for anywhere in the name. And an alternative
	5642	+ // outside a group is a second pattern with no dot in front of it,
	5643	+ // which goes by the name again.
	5644	+ if ( 1 === preg_match( '/^\\\\\.[?*+]/', $rest ) ) {
	5645	+ return null;
	5646	+ }
	5647	+
	5648	+ $depth = 0;
	5649	+
	5650	+ for ( $i = 0, $length = strlen( $rest ); $i < $length; $i++ ) {
	5651	+ if ( '(' === $rest[ $i ] ) {
	5652	+ $depth++;
	5653	+ } elseif ( ')' === $rest[ $i ] ) {
	5654	+ $depth--;
	5655	+ }
	5656	+
	5657	+ if ( $depth < 0 || ( 0 === $depth && '|' === $rest[ $i ] ) ) {
	5658	+ return null;
	5659	+ }
	5660	+ }
	5661	+
	5662	+ if ( 0 !== $depth ) {
	5663	+ return null;
	5664	+ }
	5665	+
	5666	+ $expression = '~' . str_replace( '~', '\\~', $pattern ) . '~' . ( $nocase ? 'i' : '' );
	5667	+
	5668	+ foreach ( array( 'x.php', 'a/b/x.php' ) as $sample ) {
	5669	+ $matched = @preg_match( $expression, $sample ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- A pattern Apache would refuse names nothing.
	5670	+
	5671	+ if ( false === $matched ) {
	5672	+ return null;
	5673	+ }
	5674	+
	5675	+ if ( 0 === $matched ) {
	5676	+ return false;
	5677	+ }
	5678	+ }
	5679	+
	5680	+ return true;
	5681	+ }
	5682	+
	5683	+ /**
	5684	+ * Whether a RewriteRule that refuses requests refuses every PHP file
	5685	+ *
	5686	+ * A pattern with a "!" in front refuses what it does not match, so it
	5687	+ * refuses PHP when it goes by the extension and .php is not one of them
	5688	+ * ("!\.(jpe?g|png)$": everything but the images).
	5689	+ *
	5690	+ * @param string $pattern Pattern of the rule.
	5691	+ * @param string $flags Flags of the rule, in lower case.
	5692	+ * @return bool
	5693	+ */
	5694	+ private static function rewrite_rule_refuses_php( $pattern, $flags ) {
	5695	+ $pattern = trim( $pattern, '"\'' );
	5696	+ $negated = '' !== $pattern && '!' === $pattern[0];
	5697	+
	5698	+ if ( $negated ) {
	5699	+ $pattern = substr( $pattern, 1 );
	5700	+ }
	5701	+
	5702	+ if ( '' === $pattern ) {
	5703	+ return false;
	5704	+ }
	5705	+
	5706	+ $names = self::extension_pattern_names_php( $pattern, true, (bool) preg_match( '/[\[,]\s*(?:nc|nocase)\s*[,\]]/', $flags ) );
	5707	+
	5708	+ return $negated ? false === $names : true === $names;
	5709	+ }
	5710	+
	5711	+ /**
	5712	+ * What the directives of a .htaccess do, as far as running code goes
	5713	+ *
	5714	+ * @param string $content Content of the file.
	5715	+ * @return array {
	5716	+ * @type array $runs Ways it makes the server run code, as keys:
	5717	+ * 'run', 'load', 'rewrite', 'cgi'.
	5718	+ * @type array $other Kinds of directive that neither run code nor
	5719	+ * only deny, as keys: 'access', 'rewrite',
	5720	+ * 'headers', 'other'.
	5721	+ * @type bool $rewrite Whether it has rewrite directives of its own.
	5722	+ * @type bool $denies_php Whether it denies access to every PHP file
	5723	+ * itself, for every request and whatever the
	5724	+ * server has loaded.
	5725	+ * }
	5726	+ */
	5727	+ private static function read_htaccess_rules( $content ) {
	5728	+ $facts = array(
	5729	+ 'runs' => array(),
	5730	+ 'other' => array(),
	5731	+ 'rewrite' => false,
	5732	+ 'denies_php' => false,
2554	5733	);
2555	5734
2556		- foreach ( $benign_patterns as $pattern => $label ) {
2557		- if ( preg_match( $pattern, $content ) ) {
2558		- $found_rules[] = $label;
	5735	+ // A line that ends in a backslash goes on in the next one, and Apache
	5736	+ // joins the two before it looks at anything else, comments included.
	5737	+ $content = str_replace( array( "\r\n", "\r" ), "\n", (string) $content );
	5738	+ $content = preg_replace( '/(?<!\\\\)\\\\\n/', '', $content );
	5739	+
	5740	+ // "script" as a word of its own: cgi-script and php-script are
	5741	+ // handlers that run code, application/javascript is a kind of file.
	5742	+ $scripts = '/php|cgi|(?<![a-z])script|lsapi|server-parsed|proxy:|python-program/';
	5743	+ $php_target = '/\.(?:ph(?:p\d*|tml|t|ar|ps)|inc)(?![a-z0-9])/';
	5744	+ $containers = array();
	5745	+ $cgi_handler = false;
	5746	+ $execcgi_on = false;
	5747	+ $execcgi_off = false;
	5748	+
	5749	+ foreach ( explode( "\n", (string) $content ) as $line ) {
	5750	+ $line = trim( $line );
	5751	+
	5752	+ if ( '' === $line || '#' === $line[0] ) {
	5753	+ continue;
2559	5754	}
	5755	+
	5756	+ // Sections are remembered, to know what a directive inside them
	5757	+ // applies to (see htaccess_section_kind()).
	5758	+ if ( '<' === $line[0] ) {
	5759	+ if ( preg_match( '/^<\s*\//', $line ) ) {
	5760	+ array_pop( $containers );
	5761	+ } elseif ( preg_match( '/^<\s*([A-Za-z]+)\b(.*)$/', $line, $section ) ) {
	5762	+ $containers[] = self::htaccess_section_kind( strtolower( $section[1] ), $section[2] );
	5763	+ }
	5764	+ continue;
	5765	+ }
	5766	+
	5767	+ if ( ! preg_match( '/^([A-Za-z_]+)\s*(.*)$/', $line, $parts ) ) {
	5768	+ $facts['other']['other'] = true;
	5769	+ continue;
	5770	+ }
	5771	+
	5772	+ $name = strtolower( $parts[1] );
	5773	+ $args = trim( $parts[2] );
	5774	+ $low = strtolower( $args );
	5775	+ $words = preg_split( '/\s+/', $low, -1, PREG_SPLIT_NO_EMPTY );
	5776	+ $first = isset( $words[0] ) ? trim( $words[0], '"\'' ) : '';
	5777	+
	5778	+ // The sections around this line that put a condition on it.
	5779	+ $inside = array_values( array_diff( $containers, array( '' ) ) );
	5780	+
	5781	+ switch ( $name ) {
	5782	+ case 'sethandler':
	5783	+ case 'addhandler':
	5784	+ case 'addtype':
	5785	+ case 'forcetype':
	5786	+ if ( preg_match( $scripts, $first ) ) {
	5787	+ // "AddHandler cgi-script" next to "Options -ExecCGI" is
	5788	+ // the old recipe that hands every script to CGI and
	5789	+ // forbids CGI. Which of the two it is gets decided
	5790	+ // once the whole file has been read.
	5791	+ if ( 'addhandler' === $name && false !== strpos( $first, 'cgi' ) ) {
	5792	+ $cgi_handler = true;
	5793	+ } else {
	5794	+ $facts['runs']['run'] = true;
	5795	+ }
	5796	+ } elseif ( ! in_array( $first, array( 'none', 'default-handler', 'text/plain', 'application/octet-stream' ), true ) ) {
	5797	+ $facts['other']['other'] = true;
	5798	+ }
	5799	+ break;
	5800	+
	5801	+ case 'php_flag':
	5802	+ case 'php_admin_flag':
	5803	+ case 'php_value':
	5804	+ case 'php_admin_value':
	5805	+ $value = isset( $words[1] ) ? trim( $words[1], '"\'' ) : '';
	5806	+
	5807	+ if ( 'engine' === $first ) {
	5808	+ if ( ! in_array( $value, array( 'off', '0', 'false', 'no' ), true ) ) {
	5809	+ $facts['runs']['run'] = true;
	5810	+ }
	5811	+ } elseif ( in_array( $first, array( 'auto_prepend_file', 'auto_append_file' ), true ) ) {
	5812	+ if ( '' !== $value && 'none' !== $value ) {
	5813	+ $facts['runs']['load'] = true;
	5814	+ }
	5815	+ } else {
	5816	+ $facts['other']['other'] = true;
	5817	+ }
	5818	+ break;
	5819	+
	5820	+ case 'options':
	5821	+ foreach ( $words as $option ) {
	5822	+ // Only a ban on CGI that holds for everybody counts as one.
	5823	+ if ( '-execcgi' === $option && empty( $inside ) ) {
	5824	+ $execcgi_off = true;
	5825	+ }
	5826	+
	5827	+ if ( '-' === $option[0] || 'none' === $option ) {
	5828	+ continue;
	5829	+ }
	5830	+
	5831	+ $option = ltrim( $option, '+' );
	5832	+
	5833	+ if ( in_array( $option, array( 'execcgi', 'includes', 'all' ), true ) ) {
	5834	+ $facts['runs']['cgi'] = true;
	5835	+ $execcgi_on = true;
	5836	+ } else {
	5837	+ $facts['other']['other'] = true;
	5838	+ }
	5839	+ }
	5840	+ break;
	5841	+
	5842	+ case 'addoutputfilter':
	5843	+ case 'setoutputfilter':
	5844	+ case 'addoutputfilterbytype':
	5845	+ if ( false !== strpos( $low, 'includes' ) ) {
	5846	+ $facts['runs']['cgi'] = true;
	5847	+ } else {
	5848	+ $facts['other']['other'] = true;
	5849	+ }
	5850	+ break;
	5851	+
	5852	+ case 'action':
	5853	+ $facts['runs']['cgi'] = true;
	5854	+ break;
	5855	+
	5856	+ case 'xbithack':
	5857	+ // Server-side includes for every file with the execute bit.
	5858	+ if ( 'off' !== $first ) {
	5859	+ $facts['runs']['cgi'] = true;
	5860	+ }
	5861	+ break;
	5862	+
	5863	+ case 'deny':
	5864	+ case 'require':
	5865	+ $denies = 'deny' === $name ? ( 'from' === $first && isset( $words[1] ) && 'all' === $words[1] ) : ( 'all' === $first && isset( $words[1] ) && 'denied' === $words[1] );
	5866	+
	5867	+ if ( ! $denies || in_array( 'condition', $inside, true ) ) {
	5868	+ $facts['other']['access'] = true;
	5869	+ } elseif ( ! array_diff( $inside, array( 'rewrite', 'files-php' ) ) ) {
	5870	+ // For every request, on any server, and for every file
	5871	+ // or for the PHP ones. A denial that depends on a
	5872	+ // module being there, or that names other files, still
	5873	+ // protects, but it does not make up for rewrite rules
	5874	+ // that switch off the ones of the site root.
	5875	+ $facts['denies_php'] = true;
	5876	+ }
	5877	+ break;
	5878	+
	5879	+ case 'order':
	5880	+ case 'indexignore':
	5881	+ break;
	5882	+
	5883	+ case 'allow':
	5884	+ case 'satisfy':
	5885	+ case 'authtype':
	5886	+ case 'authname':
	5887	+ case 'authuserfile':
	5888	+ case 'authgroupfile':
	5889	+ $facts['other']['access'] = true;
	5890	+ break;
	5891	+
	5892	+ case 'rewriteengine':
	5893	+ case 'rewritebase':
	5894	+ case 'rewriteoptions':
	5895	+ $facts['rewrite'] = true;
	5896	+ break;
	5897	+
	5898	+ case 'rewritecond':
	5899	+ // A condition makes the rule after it apply to some
	5900	+ // requests and not to others, a denial included.
	5901	+ $facts['rewrite'] = true;
	5902	+ $facts['other']['rewrite'] = true;
	5903	+ break;
	5904	+
	5905	+ case 'rewriterule':
	5906	+ $facts['rewrite'] = true;
	5907	+
	5908	+ $rule = preg_split( '/\s+/', $args, 3 );
	5909	+ $pattern = isset( $rule[0] ) ? $rule[0] : '';
	5910	+ $target = isset( $rule[1] ) ? strtolower( trim( $rule[1], '"\'' ) ) : '';
	5911	+ $flags = isset( $rule[2] ) ? strtolower( $rule[2] ) : '';
	5912	+
	5913	+ if ( preg_match( '/[\[,]\s*h=/', $flags ) || preg_match( '/[\[,]\s*t=[^,\]]*(?:php|cgi|(?<![a-z])script)/', $flags ) ) {
	5914	+ // A handler or a type forced from the rule itself.
	5915	+ $facts['runs']['run'] = true;
	5916	+ } elseif ( '-' === $target && preg_match( '/[\[,]\s*(?:f|forbidden|g|gone)\s*[,\]]/', $flags ) ) {
	5917	+ // Rewrites nothing and refuses the request. It stands
	5918	+ // for the rule of the site root only when it refuses
	5919	+ // every PHP file, for every request.
	5920	+ if ( ! array_diff( $inside, array( 'rewrite' ) ) && self::rewrite_rule_refuses_php( $pattern, $flags ) ) {
	5921	+ $facts['denies_php'] = true;
	5922	+ } else {
	5923	+ $facts['other']['rewrite'] = true;
	5924	+ }
	5925	+ } elseif ( '-' === $target ) {
	5926	+ // Rewrites nothing and lets the request through, which
	5927	+ // can be the way to keep one file out of the denial
	5928	+ // that follows: it is not part of a file that only
	5929	+ // protects.
	5930	+ $facts['other']['rewrite'] = true;
	5931	+ } elseif ( preg_match( $php_target, $target ) && '/index.php' !== $target ) {
	5932	+ $facts['runs']['rewrite'] = true;
	5933	+ } else {
	5934	+ $facts['other']['rewrite'] = true;
	5935	+ }
	5936	+ break;
	5937	+
	5938	+ case 'header':
	5939	+ case 'requestheader':
	5940	+ case 'expiresactive':
	5941	+ case 'expiresbytype':
	5942	+ case 'expiresdefault':
	5943	+ case 'fileetag':
	5944	+ $facts['other']['headers'] = true;
	5945	+ break;
	5946	+
	5947	+ default:
	5948	+ $facts['other']['other'] = true;
	5949	+ }
2560	5950	}
2561	5951
2562		- $rules_summary = ! empty( $found_rules )
2563		- ? implode( ', ', $found_rules )
2564		- : __( 'Custom rules', 'vigilante' );
	5952	+ if ( $cgi_handler && ( $execcgi_on || ! $execcgi_off ) ) {
	5953	+ $facts['runs']['cgi'] = true;
	5954	+ }
2565	5955
2566		- return array(
2567		- 'category' => 'extra',
2568		- 'item' => array(
2569		- 'file' => $relative,
2570		- 'type' => 'htaccess_in_uploads',
2571		- /* translators: %s: Summary of rules found in the .htaccess file */
2572		- 'reason' => sprintf( __( '.htaccess in uploads (likely from plugin). Contains: %s', 'vigilante' ), $rules_summary ),
2573		- ),
2574		- );
	5956	+ return $facts;
2575	5957	}
2576	5958
2577	5959	/**
2578	5960	* Check content for suspicious patterns
		@@ -2616,25 +5998,45 @@
2616	5998	foreach ( $patterns_data['standard_patterns'] as $encoded_needle => $label ) {
2617	5999	// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- Decoding pattern definitions, not user input.
2618	6000	$needle = base64_decode( $encoded_needle );
2619	6001	if ( $this->needle_present( $content, $needle ) ) {
2620		- return $label;
	6002	+ // The labels live in the pattern file, in English: "$_GET access"
	6003	+ // becomes "$_GET", which needs no translation.
	6004	+ return preg_replace( '/ access$/', '', (string) $label );
2621	6005	}
2622	6006	}
2623	6007
2624		- // Check for preg_replace with /e modifier (code execution)
2625		- if ( preg_match( '/preg_replace\s*\(\s*[\'"].*\/e[\'"]/i', $content ) ) {
2626		- return 'preg_replace /e modifier';
	6008	+ return $this->detect_common_pattern( $content );
	6009	+ }
	6010	+
	6011	+ /**
	6012	+ * The three checks both levels of the search share
	6013	+ *
	6014	+ * @param string $content File content.
	6015	+ * @return string|false The pattern found, or false.
	6016	+ */
	6017	+ private function detect_common_pattern( $content ) {
	6018	+ // preg_replace with the /e modifier (arbitrary code execution,
	6019	+ // deprecated). The modifier is looked for on the same line and within
	6020	+ // 300 characters of the opening quote. With ".*" every preg_replace of
	6021	+ // a long line cost a pass over the whole line: 88 seconds for a file
	6022	+ // of 500 KB made for it, measured without the PCRE compiler.
	6023	+ if ( $this->found( '/preg_replace\s*+\(\s*+[\'"][^\n]{0,300}?\/e[\'"]/i', $content ) ) {
	6024	+ return __( 'preg_replace with the /e modifier, which runs code', 'vigilante' );
2627	6025	}
2628	6026
2629		- // Check for long hex-encoded strings (obfuscated payloads)
2630		- if ( preg_match( '/\\\\x[0-9a-f]{2}(\\\\x[0-9a-f]{2}){10,}/i', $content ) ) {
2631		- return 'hex-encoded string';
	6027	+ // Long hex-encoded strings (obfuscated payloads). Eleven escapes in a
	6028	+ // row and not "ten or more after the first": asked to take them all,
	6029	+ // PCRE gave up on a run of some 12,000, and a search that gave up
	6030	+ // read as "nothing found". The longer the payload, the less it was
	6031	+ // found.
	6032	+ if ( $this->found( '/(?:\\\\x[0-9a-f]{2}){11}/i', $content ) ) {
	6033	+ return __( 'a long string written in hexadecimal', 'vigilante' );
2632	6034	}
2633	6035
2634		- // Check for heavily concatenated chr() calls (char-by-char obfuscation)
2635		- if ( preg_match( '/chr\s*\(\s*\d+\s*\)\s*\.\s*chr\s*\(\s*\d+\s*\)\s*\.\s*chr/i', $content ) ) {
2636		- return 'chr() concatenation obfuscation';
	6036	+ // Heavily concatenated chr() calls (char-by-char obfuscation)
	6037	+ if ( $this->found( '/chr\s*+\(\s*+\d++\s*+\)\s*+\.\s*+chr\s*+\(\s*+\d++\s*+\)\s*+\.\s*+chr/i', $content ) ) {
	6038	+ return __( 'text built character by character with chr()', 'vigilante' );
2637	6039	}
2638	6040
2639	6041	return false;
2640	6042	}
		@@ -2671,29 +6073,94 @@
2671	6073	$as = $fragments['as'] ?? '';
2672	6074	$ss = $fragments['ss'] ?? '';
2673	6075	$cf = $fragments['cf'] ?? '';
2674	6076
2675		- // Obfuscation combos: dangerous function wrapping decoded content
	6077	+ // Obfuscation combos: dangerous function wrapping decoded content.
	6078	+ // The labels name the two functions side by side and not one inside
	6079	+ // the other. Written the way the code is written, a label was itself
	6080	+ // a match: the results of a scan, kept in a cache that stores options
	6081	+ // as PHP files under wp-content, would have been the next finding.
	6082	+ // The possessive quantifiers ("*+") change nothing in what matches,
	6083	+ // because what follows each run of spaces is never a space. They keep
	6084	+ // PCRE from walking a long run back one space at a time, which is
	6085	+ // where it gives up when it runs without its compiler.
2676	6086	$obfuscation_combos = array(
2677		- '/' . $ev . '\s*\(\s*' . $b6 . '\s*\(/i' => $ev . '(' . $b6 . '())',
2678		- '/' . $ev . '\s*\(\s*' . $gz . '\s*\(/i' => $ev . '(' . $gz . '())',
2679		- '/' . $ev . '\s*\(\s*' . $gu . '\s*\(/i' => $ev . '(' . $gu . '())',
2680		- '/' . $ev . '\s*\(\s*' . $sr . '\s*\(/i' => $ev . '(' . $sr . '())',
2681		- '/' . $ev . '\s*\(\s*' . $hb . '\s*\(/i' => $ev . '(' . $hb . '())',
2682		- '/' . $as . '\s*\(\s*' . $b6 . '\s*\(/i' => $as . '(' . $b6 . '())',
2683		- '/' . $ev . '\s*\(\s*\$[a-z_]+\s*\(/i' => $ev . '($variable())',
2684		- '/' . $ev . '\s*\(\s*' . $ss . '\s*\(/i' => $ev . '(' . $ss . '())',
	6087	+ '/' . $ev . '\s*+\(\s*+' . $b6 . '\s*+\(/i' => $ev . '() + ' . $b6 . '()',
	6088	+ '/' . $ev . '\s*+\(\s*+' . $gz . '\s*+\(/i' => $ev . '() + ' . $gz . '()',
	6089	+ '/' . $ev . '\s*+\(\s*+' . $gu . '\s*+\(/i' => $ev . '() + ' . $gu . '()',
	6090	+ '/' . $ev . '\s*+\(\s*+' . $sr . '\s*+\(/i' => $ev . '() + ' . $sr . '()',
	6091	+ '/' . $ev . '\s*+\(\s*+' . $hb . '\s*+\(/i' => $ev . '() + ' . $hb . '()',
	6092	+ '/' . $as . '\s*+\(\s*+' . $b6 . '\s*+\(/i' => $as . '() + ' . $b6 . '()',
	6093	+ '/' . $ev . '\s*+\(\s*+\$[a-z_]++\s*+\(/i' => $ev . '() + $variable()',
	6094	+ '/' . $ev . '\s*+\(\s*+' . $ss . '\s*+\(/i' => $ev . '() + ' . $ss . '()',
2685	6095	);
2686	6096
2687	6097	foreach ( $obfuscation_combos as $regex => $label ) {
2688		- if ( preg_match( $regex, $content ) ) {
	6098	+ if ( $this->found( $regex, $content ) ) {
2689	6099	return $label;
2690	6100	}
2691	6101	}
2692	6102
	6103	+ // The plain backdoor, with nothing to hide: data from the request
	6104	+ // handed straight to code or to the system, a function the request
	6105	+ // chooses, or a file included from another server. The names come
	6106	+ // from the list the concatenation check below uses, minus the decoders,
	6107	+ // so they are not written here either. That list is decoded once, for both.
	6108	+ $dangerous_names = array();
	6109	+ if ( ! empty( $patterns_data['dangerous_names'] ) ) {
	6110	+ foreach ( $patterns_data['dangerous_names'] as $encoded_name ) {
	6111	+ // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
	6112	+ $dangerous_names[] = base64_decode( $encoded_name );
	6113	+ }
	6114	+ }
	6115	+
	6116	+ $runners = array_merge( array_filter( array( $ev, $as ) ), array_diff( $dangerous_names, array( $b6, $gz, $gu, $sr, $hb ) ) );
	6117	+
	6118	+ // These three read as code what PHP reads as code, so they are
	6119	+ // searched with the comments of the file turned into blank space
	6120	+ // (blank_comments()). A comment that quotes one of them ("never do
	6121	+ // this: ...") is then not a finding, and a comment slipped between a
	6122	+ // name and its parenthesis hides nothing. The first two cannot match
	6123	+ // without a superglobal of the request, so only the files that name
	6124	+ // one are prepared that way, about one in twenty. The third is looked
	6125	+ // for in the file as it is and checked again that way when it matches.
	6126	+ $code = null;
	6127	+
	6128	+ if ( $this->found( '/\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b/', $content ) ) {
	6129	+ $code = $this->blank_comments( $content );
	6130	+
	6131	+ // When PHP cannot be asked what is a comment, the file is
	6132	+ // searched as it is: a comment may then be reported, and nothing
	6133	+ // that runs is left out.
	6134	+ $subject = false === $code ? $content : $code;
	6135	+
	6136	+ if ( ! empty( $runners ) ) {
	6137	+ $names = implode( '|', array_map( 'preg_quote', $runners ) );
	6138	+ // What the visitor sends, when it is not just being asked about
	6139	+ // with isset() or empty(). The path of an uploaded file is not in
	6140	+ // the list: handing it to a command is how images get processed.
	6141	+ $from_request = '(?<!isset\()(?<!isset\( )(?<!empty\()(?<!empty\( )(?:\$_(?:GET|POST|REQUEST|COOKIE)\b|\$_SERVER\s*\[\s*[\'"]HTTP_)';
	6142	+
	6143	+ // The possessive quantifiers keep a file made of spaces from
	6144	+ // costing a try per space.
	6145	+ if ( $this->found( '/(?<![a-z0-9_>:$])(?:' . $names . ')\s*+\(\s*+[^;\n]{0,80}?' . $from_request . '/i', $subject ) ) {
	6146	+ return __( 'data from the request is run as code or as a command', 'vigilante' );
	6147	+ }
	6148	+ }
	6149	+
	6150	+ if ( $this->found( '/\$_(?:GET|POST|REQUEST|COOKIE)\s*+\[[^\]\n]{1,60}\]\s*+\(/', $subject ) ) {
	6151	+ return __( 'a function chosen by the request is called', 'vigilante' );
	6152	+ }
	6153	+ }
	6154	+
	6155	+ if ( $this->found_in_code( '/(?<![a-z0-9_>$])(?:include|require)(?:_once)?\s*+(?:\(\s*+)?[\'"]https?:\/\//i', $content, $code ) ) {
	6156	+ return __( 'a file from another server is included', 'vigilante' );
	6157	+ }
	6158	+
2693	6159	// Deprecated dynamic function constructor, nearly always malicious in modern code
2694	6160	if ( ! empty( $cf ) && $this->needle_present( $content, $cf ) ) {
2695		- return $cf . ')';
	6161	+ // The name alone, for the same reason as the labels above.
	6162	+ return rtrim( $cf, '(' );
2696	6163	}
2697	6164
2698	6165	// Remote fetch piped into unserialize: a PHP object-injection / supply-chain
2699	6166	// vector seen in trojanized or nulled plugins (download a payload from a
		@@ -2703,11 +6170,21 @@
2703	6170	// checked that both strings appeared somewhere in the file, which
2704	6171	// false-positived on legitimate code using both in unrelated methods
2705	6172	// (e.g. a theme reading a transient with maybe_unserialize() while
2706	6173	// fetching its public IP with wp_remote_get()).
2707		- $us = $fragments['us'] ?? '';
2708		- if ( '' !== $us ) {
2709		- $us_regex = '/(?<![a-z0-9_])' . preg_quote( $us, '/' ) . '\s*\(/i';
	6174	+ //
	6175	+ // The search runs on a copy of the file in lower case, with
	6176	+ // expressions that tell the case apart, and only when the file names
	6177	+ // the function at all. PCRE without its compiler looks ahead for the
	6178	+ // first letter of an expression in both cases before each try, and
	6179	+ // when one of the two is not in the file that look runs to the end of
	6180	+ // it. pattern_near() asks once per match, so a file with thousands of
	6181	+ // them cost thousands of passes (26 seconds for 8 MB, measured). With
	6182	+ // one case to look for, each look stops at the next candidate.
	6183	+ $us = self::lower_ascii( $fragments['us'] ?? '' );
	6184	+ if ( '' !== $us && false !== stripos( $content, $us ) ) {
	6185	+ $lower = self::lower_ascii( $content );
	6186	+ $us_regex = '/(?<![a-z0-9_])' . preg_quote( $us, '/' ) . '\s*+\(/';
2710	6187	$remote_fetchers = array(
2711	6188	$fragments['wr'] ?? '', // wp_remote_get
2712	6189	$fragments['rb'] ?? '', // wp_remote_retrieve_body
2713	6190	$fragments['ce'] ?? '', // curl_exec
		@@ -2715,11 +6192,12 @@
2715	6192	foreach ( $remote_fetchers as $rf ) {
2716	6193	if ( '' === $rf ) {
2717	6194	continue;
2718	6195	}
2719		- $rf_regex = '/(?<![a-z0-9_])' . preg_quote( $rf, '/' ) . '\s*\(/i';
2720		- if ( $this->pattern_near( $content, $us_regex, $rf_regex, 600 ) ) {
2721		- return $rf . '() + ' . $us . '() remote deserialization';
	6196	+ $rf_regex = '/(?<![a-z0-9_])' . preg_quote( self::lower_ascii( $rf ), '/' ) . '\s*+\(/';
	6197	+ if ( $this->pattern_near( $lower, $us_regex, $rf_regex, 600 ) ) {
	6198	+ /* translators: 1: Function that downloads, 2: Function that unserializes */
	6199	+ return sprintf( __( 'data downloaded from another server is unserialized (%1$s and %2$s)', 'vigilante' ), $rf, $us );
2722	6200	}
2723	6201	}
2724	6202
2725	6203	// file_get_contents() is treated separately from the fetchers
		@@ -2732,51 +6210,106 @@
2732	6210	// argument is a URL, so the combo additionally requires a
2733	6211	// remote-scheme literal near the call before it fires.
2734	6212	$fg = $fragments['fg'] ?? '';
2735	6213	if ( '' !== $fg ) {
2736		- $fg_regex = '/(?<![a-z0-9_])' . preg_quote( $fg, '/' ) . '\s*\(/i';
2737		- $scheme_regex = '/(?:https?|ftps?):\/\/|php:\/\/input/i';
	6214	+ $fg_regex = '/(?<![a-z0-9_])' . preg_quote( self::lower_ascii( $fg ), '/' ) . '\s*+\(/';
	6215	+ $scheme_regex = '/(?:https?|ftps?):\/\/|php:\/\/input/';
2738	6216
2739		- if ( $this->pattern_near( $content, $us_regex, $fg_regex, 600 )
2740		- && $this->pattern_near( $content, $fg_regex, $scheme_regex, 600 ) ) {
2741		- return $fg . '() + ' . $us . '() remote deserialization';
	6217	+ if ( $this->pattern_near( $lower, $us_regex, $fg_regex, 600 )
	6218	+ && $this->pattern_near( $lower, $fg_regex, $scheme_regex, 600 ) ) {
	6219	+ /* translators: 1: Function that downloads, 2: Function that unserializes */
	6220	+ return sprintf( __( 'data downloaded from another server is unserialized (%1$s and %2$s)', 'vigilante' ), $fg, $us );
2742	6221	}
2743	6222	}
2744	6223	}
2745	6224
2746		- // preg_replace with /e modifier (arbitrary code execution, deprecated)
2747		- if ( preg_match( '/preg_replace\s*\(\s*[\'"].*\/e[\'"]/i', $content ) ) {
2748		- return 'preg_replace /e modifier';
	6225	+ $common = $this->detect_common_pattern( $content );
	6226	+ if ( $common ) {
	6227	+ return $common;
2749	6228	}
2750	6229
2751		- // Long hex-encoded strings (obfuscated payloads)
2752		- if ( preg_match( '/\\\\x[0-9a-f]{2}(\\\\x[0-9a-f]{2}){10,}/i', $content ) ) {
2753		- return 'hex-encoded string';
	6230	+ // Dangerous function names built from string concatenation: a variable
	6231	+ // given a name in pieces and then called. The assignments are taken
	6232	+ // one at a time and the calls are looked up in one pass. Collecting
	6233	+ // every assignment of the file first, and then searching the whole
	6234	+ // file again for each one, took memory and time that grew with the
	6235	+ // square of the file.
	6236	+ $split = array();
	6237	+ $capped = false;
	6238	+ $offset = 0;
	6239	+
	6240	+ while ( true ) {
	6241	+ // A variable, "=" and a quoted piece followed by a dot: where a
	6242	+ // string put together from pieces starts.
	6243	+ $start = $this->next_match( '/\$([a-z_]\w*)\s*+=\s*+(?=["\'][a-z0-9_]*+["\']\s*+\.)/i', $content, $offset );
	6244	+
	6245	+ if ( null === $start ) {
	6246	+ break;
	6247	+ }
	6248	+
	6249	+ // The pieces are taken one by one, however many there are: a name
	6250	+ // can be padded with as many empty ones as its author likes, and
	6251	+ // asking PCRE for the whole chain at once is what made it give up.
	6252	+ $position = $start[0][1] + strlen( $start[0][0] );
	6253	+ $combined = '';
	6254	+ $closed = false;
	6255	+
	6256	+ while ( true ) {
	6257	+ $piece = $this->next_match( '/\G["\']([a-z0-9_]*+)["\']\s*+(\.\s*+|;)?+/i', $content, $position );
	6258	+
	6259	+ if ( null === $piece ) {
	6260	+ break;
	6261	+ }
	6262	+
	6263	+ // No name on the list is this long: past it, the letters are
	6264	+ // not kept, and the chain is still walked to its end.
	6265	+ if ( strlen( $combined ) <= 64 ) {
	6266	+ $combined .= self::lower_ascii( $piece[1][0] );
	6267	+ }
	6268	+
	6269	+ $position = $piece[0][1] + strlen( $piece[0][0] );
	6270	+ $after = isset( $piece[2] ) && $piece[2][1] >= 0 ? $piece[2][0] : '';
	6271	+
	6272	+ if ( '' === $after || ';' === $after ) {
	6273	+ $closed = ';' === $after;
	6274	+ break;
	6275	+ }
	6276	+ }
	6277	+
	6278	+ $offset = max( $position, $start[0][1] + 1 );
	6279	+
	6280	+ if ( $closed && in_array( $combined, $dangerous_names, true ) && ! isset( $split[ $start[1][0] ] ) ) {
	6281	+ $split[ $start[1][0] ] = $combined;
	6282	+
	6283	+ if ( count( $split ) >= 500 ) {
	6284	+ $capped = true;
	6285	+ break;
	6286	+ }
	6287	+ }
2754	6288	}
2755	6289
2756		- // Heavily concatenated chr() calls (char-by-char obfuscation)
2757		- if ( preg_match( '/chr\s*\(\s*\d+\s*\)\s*\.\s*chr\s*\(\s*\d+\s*\)\s*\.\s*chr/i', $content ) ) {
2758		- return 'chr() concatenation obfuscation';
2759		- }
	6290	+ if ( ! empty( $split ) ) {
	6291	+ $offset = 0;
2760	6292
2761		- // Detect dangerous function names built from string concatenation
2762		- if ( preg_match_all( '/\$([a-z_]\w*)\s*=\s*((?:["\'][a-z0-9_]*["\']\s*\.\s*)+["\'][a-z0-9_]*["\'])\s*;/i', $content, $matches, PREG_SET_ORDER ) ) {
2763		- $dangerous_names = array();
2764		- if ( ! empty( $patterns_data['dangerous_names'] ) ) {
2765		- foreach ( $patterns_data['dangerous_names'] as $encoded_name ) {
2766		- // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
2767		- $dangerous_names[] = base64_decode( $encoded_name );
	6293	+ while ( true ) {
	6294	+ $call = $this->next_match( '/\$([a-z_]\w*)\s*+\(/i', $content, $offset );
	6295	+
	6296	+ if ( null === $call ) {
	6297	+ break;
2768	6298	}
	6299	+
	6300	+ if ( isset( $split[ $call[1][0] ] ) ) {
	6301	+ /* translators: %s: Function name */
	6302	+ return sprintf( __( 'call to %s() with its name split in pieces', 'vigilante' ), $split[ $call[1][0] ] );
	6303	+ }
	6304	+
	6305	+ $offset = $call[0][1] + strlen( $call[0][0] );
2769	6306	}
2770	6307
2771		- foreach ( $matches as $match ) {
2772		- $combined = strtolower( preg_replace( '/["\'\s\.]/', '', $match[2] ) );
2773		- if ( in_array( $combined, $dangerous_names, true ) ) {
2774		- $var_pattern = '/\$' . preg_quote( $match[1], '/' ) . '\s*\(/';
2775		- if ( preg_match( $var_pattern, $content ) ) {
2776		- return 'obfuscated ' . $combined . '() call';
2777		- }
2778		- }
	6308	+ // More names in pieces than a file has any reason to hold, and
	6309	+ // not every one was followed: not searched, rather than clean.
	6310	+ if ( $capped ) {
	6311	+ $this->search_failed = true;
2779	6312	}
2780	6313	}
2781	6314
2782	6315	return false;
		@@ -2802,9 +6335,9 @@
2802	6335	return false;
2803	6336	}
2804	6337	if ( preg_match( '/^[a-z_][a-z0-9_]*\($/i', $needle ) ) {
2805	6338	$fn = rtrim( $needle, '(' );
2806		- return (bool) preg_match( '/(?<![a-z0-9_])' . preg_quote( $fn, '/' ) . '\s*\(/i', $content );
	6339	+ return $this->found( '/(?<![a-z0-9_])' . preg_quote( $fn, '/' ) . '\s*+\(/i', $content );
2807	6340	}
2808	6341	return stripos( $content, $needle ) !== false;
2809	6342	}
2810	6343
		@@ -2822,25 +6355,266 @@
2822	6355	* @param int $window Maximum byte distance between a match of each.
2823	6356	* @return bool
2824	6357	*/
2825	6358	private function pattern_near( $content, $regex_a, $regex_b, $window ) {
2826		- if ( ! preg_match_all( $regex_a, $content, $m_a, PREG_OFFSET_CAPTURE ) ) {
	6359	+ // Both lists come in order, so they are walked together: the match
	6360	+ // that is behind moves on, and no pair is compared twice. Every match
	6361	+ // of one used to be compared with every match of the other.
	6362	+ $a = $this->next_match( $regex_a, $content, 0 );
	6363	+ $b = $this->next_match( $regex_b, $content, 0 );
	6364	+
	6365	+ while ( null !== $a && null !== $b ) {
	6366	+ if ( abs( $a[0][1] - $b[0][1] ) <= $window ) {
	6367	+ return true;
	6368	+ }
	6369	+
	6370	+ if ( $a[0][1] < $b[0][1] ) {
	6371	+ $a = $this->next_match( $regex_a, $content, $a[0][1] + 1 );
	6372	+ } else {
	6373	+ $b = $this->next_match( $regex_b, $content, $b[0][1] + 1 );
	6374	+ }
	6375	+ }
	6376	+
	6377	+ return false;
	6378	+ }
	6379	+
	6380	+ /**
	6381	+ * A text with its capital letters from A to Z in lower case, and nothing else
	6382	+ *
	6383	+ * strtolower() follows the language of the server until PHP 8.2, and in
	6384	+ * Turkish a capital I does not become an i: a function name written in
	6385	+ * capitals would not be found there.
	6386	+ *
	6387	+ * @param string $text Text.
	6388	+ * @return string
	6389	+ */
	6390	+ private static function lower_ascii( $text ) {
	6391	+ return strtr( (string) $text, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz' );
	6392	+ }
	6393	+
	6394	+ /**
	6395	+ * Whether an expression matches, without taking a search that gave up for a "no"
	6396	+ *
	6397	+ * preg_match() answers false, and not 0, when PCRE stops before the end
	6398	+ * because a long run used up the stack of its compiler or its
	6399	+ * backtracking limit. Read as "nothing found", that is a file that passes
	6400	+ * as clean without having been searched. Measured on what was published
	6401	+ * until now: a hexadecimal string of some 12,000 characters made the
	6402	+ * expression that looks for hexadecimal strings give up. Every expression
	6403	+ * of the search goes through here or through next_match(), and a file on
	6404	+ * which one of them gave up is reported as not searched (search_file()).
	6405	+ *
	6406	+ * @param string $regex Expression, with delimiters and flags.
	6407	+ * @param string $content Text to search.
	6408	+ * @return bool
	6409	+ */
	6410	+ private function found( $regex, $content ) {
	6411	+ $result = preg_match( $regex, $content );
	6412	+
	6413	+ if ( false === $result ) {
	6414	+ $this->search_failed = true;
	6415	+ }
	6416	+
	6417	+ return 1 === $result;
	6418	+ }
	6419	+
	6420	+ /**
	6421	+ * The next match of an expression from a position on
	6422	+ *
	6423	+ * For the checks that walk every match. Asked for one at a time they take
	6424	+ * no memory to speak of, where preg_match_all() held every match of the
	6425	+ * file at once.
	6426	+ *
	6427	+ * @param string $regex Expression, with delimiters and flags.
	6428	+ * @param string $content Text to search.
	6429	+ * @param int $offset Where to start.
	6430	+ * @return array|null The match as PREG_OFFSET_CAPTURE gives it, or null.
	6431	+ */
	6432	+ private function next_match( $regex, $content, $offset ) {
	6433	+ $match = array();
	6434	+ $result = preg_match( $regex, $content, $match, PREG_OFFSET_CAPTURE, $offset );
	6435	+
	6436	+ if ( false === $result ) {
	6437	+ $this->search_failed = true;
	6438	+ }
	6439	+
	6440	+ return 1 === $result ? $match : null;
	6441	+ }
	6442	+
	6443	+ /**
	6444	+ * Whether an expression matches in the code of a file and not only in its comments
	6445	+ *
	6446	+ * @param string $regex Expression, with delimiters and flags.
	6447	+ * @param string $content File content.
	6448	+ * @param string|false|null $code The content with its comments blanked. Worked
	6449	+ * out here the first time it is needed and kept
	6450	+ * by the caller; false when it cannot be.
	6451	+ * @return bool
	6452	+ */
	6453	+ private function found_in_code( $regex, $content, &$code ) {
	6454	+ if ( ! $this->found( $regex, $content ) ) {
2827	6455	return false;
2828	6456	}
2829		- if ( ! preg_match_all( $regex_b, $content, $m_b, PREG_OFFSET_CAPTURE ) ) {
	6457	+
	6458	+ if ( null === $code ) {
	6459	+ $code = $this->blank_comments( $content );
	6460	+ }
	6461	+
	6462	+ // When PHP cannot be asked what is a comment, the match stands.
	6463	+ return false === $code || $this->found( $regex, $code );
	6464	+ }
	6465	+
	6466	+ /**
	6467	+ * The content of a PHP file with its comments turned into blank space
	6468	+ *
	6469	+ * PHP itself says what is a comment (token_get_all()), so nothing that
	6470	+ * runs can be taken for one: a "//" comment ends at "?>", a string that
	6471	+ * holds "/*" opens nothing, and so on, without a second reader of the
	6472	+ * language here to get any of it wrong. Each comment is replaced by as
	6473	+ * many spaces as it had characters, line breaks kept, so the result is as
	6474	+ * long as the original and what was on one line stays on one line.
	6475	+ *
	6476	+ * Three cases are left as they are, and then the match stands:
	6477	+ *
	6478	+ * - A file with a "<?" that is not "<?php" or "<?=". Whether PHP reads
	6479	+ * that as an opening tag depends on short_open_tag, which may not be
	6480	+ * set the same for the PHP that runs this scan as for the one that
	6481	+ * serves the site, and with it changes where the code starts and so
	6482	+ * what is a comment.
	6483	+ * - A comment that starts with "#[". PHP 8 reads that as an attribute and
	6484	+ * runs what follows it on the line; PHP 7 reads the whole line as a
	6485	+ * comment.
	6486	+ * - A file whose tokens would not fit in the memory that is left, or
	6487	+ * would take more than 64 MB. PHP returns one array per token, up to
	6488	+ * 450 bytes each, and a file can be written so that every byte is one:
	6489	+ * 400 KB of that took 180 MB with PHP 7.4 (measured). How many tokens
	6490	+ * there can be is counted first, without making them.
	6491	+ * - Any file, when PHP is set to read its source in another encoding
	6492	+ * (zend.multibyte). In Shift JIS, Big5 or GBK the second byte of a
	6493	+ * character can be a backslash, so where a string ends is not where
	6494	+ * it ends for a reader that goes byte by byte.
	6495	+ *
	6496	+ * @param string $content File content.
	6497	+ * @return string|false The content without its comments, or false when it
	6498	+ * cannot be told what is a comment.
	6499	+ */
	6500	+ private function blank_comments( $content ) {
	6501	+ if ( ! function_exists( 'token_get_all' ) || ini_get( 'zend.multibyte' ) || preg_match( '/<\?(?!php[ \t\r\n]|=)/i', $content ) ) {
2830	6502	return false;
2831	6503	}
2832		- foreach ( $m_a[0] as $a ) {
2833		- foreach ( $m_b[0] as $b ) {
2834		- if ( abs( $a[1] - $b[1] ) <= $window ) {
2835		- return true;
2836		- }
	6504	+
	6505	+ // No more tokens than this: each character that is not part of a
	6506	+ // word can be one, and so can each run of digits and each word.
	6507	+ $words = 0;
	6508	+ $others = preg_replace( '/[a-z_\x80-\xff][a-z0-9_\x80-\xff]*+|[0-9]++/i', '', $content, -1, $words );
	6509	+
	6510	+ if ( null === $others ) {
	6511	+ return false;
	6512	+ }
	6513	+
	6514	+ $needed = 450 * ( strlen( $others ) + $words + 2 ) + strlen( $content );
	6515	+ $limit = wp_convert_hr_to_bytes( ini_get( 'memory_limit' ) );
	6516	+ unset( $others );
	6517	+
	6518	+ if ( $needed > 64 * MB_IN_BYTES || ( $limit > 0 && ( $limit - memory_get_usage() ) < $needed ) ) {
	6519	+ return false;
	6520	+ }
	6521	+
	6522	+ $tokens = @token_get_all( $content ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- PHP 7 warns about what it cannot read in the file being scanned, such as a comment left open; the warning says nothing about this code.
	6523	+ $code = '';
	6524	+ $length = 0;
	6525	+
	6526	+ foreach ( $tokens as $token ) {
	6527	+ $text = is_array( $token ) ? $token[1] : $token;
	6528	+ $length += strlen( $text );
	6529	+
	6530	+ if ( is_array( $token ) && ( T_COMMENT === $token[0] || T_DOC_COMMENT === $token[0] ) && 0 !== strpos( $text, '#[' ) ) {
	6531	+ $text = preg_replace( '/[^\n]/', ' ', $text );
2837	6532	}
	6533	+
	6534	+ $code .= $text;
2838	6535	}
2839		- return false;
	6536	+
	6537	+ // The pieces have to add up to the file. If they do not, the
	6538	+ // positions cannot be trusted and neither can the result.
	6539	+ if ( strlen( $content ) !== $length || strlen( $code ) !== $length ) {
	6540	+ return false;
	6541	+ }
	6542	+
	6543	+ return $code;
2840	6544	}
2841	6545
2842	6546	/**
	6547	+ * Search one file for hidden code
	6548	+ *
	6549	+ * The one place where a file is read for that. Each scan used to read it
	6550	+ * by itself, and only when it was under 512,000 bytes: a larger file was
	6551	+ * not opened, and where the file was not going to be listed anyway (a
	6552	+ * plugin or a theme with no official copy) that was the same as calling
	6553	+ * it clean. Padding a file was enough to keep it out of the results.
	6554	+ *
	6555	+ * @param string $file_path Absolute path.
	6556	+ * @param bool $strict Use strict mode (see detect_suspicious_pattern()).
	6557	+ * @return string|false|null The pattern found, false when the file was
	6558	+ * searched and has none, or null when it could
	6559	+ * not be searched: it is larger than
	6560	+ * MAX_SEARCHED_BYTES, it cannot be read, or an
	6561	+ * expression gave up on it. The caller reports
	6562	+ * that instead of taking it for clean.
	6563	+ */
	6564	+ private function search_file( $file_path, $strict = false ) {
	6565	+ if ( ! is_file( $file_path ) || ! is_readable( $file_path ) ) {
	6566	+ return null;
	6567	+ }
	6568	+
	6569	+ $size = filesize( $file_path );
	6570	+
	6571	+ if ( false === $size || $size > self::MAX_SEARCHED_BYTES ) {
	6572	+ return null;
	6573	+ }
	6574	+
	6575	+ // One byte past the cap and no more, whatever the size said: a file
	6576	+ // that grew since it was measured is not read whole.
	6577	+ $content = file_get_contents( $file_path, false, null, 0, self::MAX_SEARCHED_BYTES + 1 ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Reads a local file to look for hidden code; nothing is written.
	6578	+
	6579	+ if ( false === $content || strlen( $content ) > self::MAX_SEARCHED_BYTES ) {
	6580	+ return null;
	6581	+ }
	6582	+
	6583	+ $this->search_failed = false;
	6584	+ $pattern = $this->detect_suspicious_pattern( $content, $strict );
	6585	+
	6586	+ if ( $pattern ) {
	6587	+ return $pattern;
	6588	+ }
	6589	+
	6590	+ return $this->search_failed ? null : false;
	6591	+ }
	6592	+
	6593	+ /**
	6594	+ * The finding for a PHP file with no official copy that could not be searched
	6595	+ *
	6596	+ * @param string $file_path Absolute path.
	6597	+ * @param string $relative Path for display.
	6598	+ * @return array
	6599	+ */
	6600	+ private function not_searched_item( $file_path, $relative ) {
	6601	+ $size = is_file( $file_path ) ? filesize( $file_path ) : false;
	6602	+ $reason = __( 'PHP file that could not be searched for hidden code', 'vigilante' );
	6603	+
	6604	+ if ( false !== $size && $size > self::MAX_SEARCHED_BYTES ) {
	6605	+ /* translators: %s: File size, such as 12 MB */
	6606	+ $reason = sprintf( __( 'PHP file of %s, too large to be searched for hidden code', 'vigilante' ), size_format( $size ) );
	6607	+ }
	6608	+
	6609	+ return array(
	6610	+ 'file' => $relative,
	6611	+ 'type' => 'not_searched',
	6612	+ 'reason' => $reason,
	6613	+ );
	6614	+ }
	6615	+
	6616	+ /**
2843	6617	* Whether a file is a text file worth normalizing before the fallback hash
2844	6618	* comparison in hash_matches_published().
2845	6619	*
2846	6620	* @param string $file_path Absolute path.
		@@ -2924,14 +6698,22 @@
2924	6698	private function detect_extra_files( $directory, $checksums, $type, $name, $suspicious_only = false ) {
2925	6699	$found = array(
2926	6700	'suspicious' => array(),
2927	6701	'extra' => array(),
	6702	+ 'errors' => array(),
	6703	+ 'php_files' => 0,
2928	6704	);
2929		- $max_extra = 50; // Limit to prevent timeout on large plugins
2930		- $count = 0;
	6705	+ // Every PHP file is examined. Until now the walk stopped after 50, which
	6706	+ // in a plugin or theme with no official copy meant the first 50 files
	6707	+ // of the folder and nothing else. Only the list of plain extra files is
	6708	+ // bounded, so a folder full of generated PHP cannot fill the results;
	6709	+ // hidden code is reported wherever it is.
	6710	+ $max_listed = 500;
	6711	+ $listed = 0;
	6712	+ $truncated = false;
2931	6713
2932	6714	// Only check PHP files for performance
2933		- $php_extensions = array( 'php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'phar' );
	6715	+ $php_extensions = self::php_extensions();
2934	6716
2935	6717	// Pre-normalize the checksum keys once so path-shape differences
2936	6718	// (Windows backslashes, a leading "./", doubled slashes) don't make a
2937	6719	// known file look "extra" and get scanned or flagged. Case is preserved.
		@@ -2940,21 +6722,39 @@
2940	6722	$known_normalized[ $this->normalize_rel_path( $known_file ) ] = true;
2941	6723	}
2942	6724
2943	6725	try {
2944		- $iterator = new RecursiveIteratorIterator(
2945		- new RecursiveDirectoryIterator( $directory, RecursiveDirectoryIterator::SKIP_DOTS ),
2946		- RecursiveIteratorIterator::LEAVES_ONLY
2947		- );
2948		-
2949		- foreach ( $iterator as $file ) {
2950		- if ( $this->is_time_exceeded() || $count >= $max_extra ) {
	6726	+ foreach ( self::walk_folder( $directory ) as $file ) {
	6727	+ if ( $this->is_time_exceeded() ) {
2951	6728	break;
2952	6729	}
2953	6730
2954	6731	$file_path = $file->getPathname();
	6732	+
	6733	+ if ( $file->isDir() ) {
	6734	+ if ( ! $file->isReadable() ) {
	6735	+ $found['errors'][] = self::unreadable_folder_error( $file_path );
	6736	+ }
	6737	+ continue;
	6738	+ }
	6739	+
2955	6740	$extension = strtolower( pathinfo( $file_path, PATHINFO_EXTENSION ) );
2956	6741
	6742	+ // A .htaccess, .user.ini or php.ini that is not part of the
	6743	+ // published copy is looked at for what it makes the server do.
	6744	+ if ( in_array( strtolower( basename( $file_path ) ), array( '.htaccess', '.user.ini', 'php.ini' ), true ) ) {
	6745	+ $config_path = $this->normalize_rel_path( str_replace( str_replace( '\\', '/', $directory ) . '/', '', str_replace( '\\', '/', $file_path ) ) );
	6746	+
	6747	+ if ( ! isset( $known_normalized[ $config_path ] ) && ! $this->is_path_excluded( $file_path ) ) {
	6748	+ $config = self::server_config_finding( $file_path, str_replace( ABSPATH, '', $file_path ) );
	6749	+
	6750	+ if ( $config ) {
	6751	+ $found[ $config['category'] ][] = $config['item'];
	6752	+ }
	6753	+ }
	6754	+ continue;
	6755	+ }
	6756	+
2957	6757	// Only check PHP files
2958	6758	if ( ! in_array( $extension, $php_extensions, true ) ) {
2959	6759	continue;
2960	6760	}
		@@ -2982,18 +6782,15 @@
2982	6782	if ( $this->is_silence_golden_file( $file_path ) ) {
2983	6783	continue;
2984	6784	}
2985	6785
2986		- $count++;
	6786	+ $found['php_files']++;
	6787	+
2987	6788	$relative = str_replace( ABSPATH, '', $file_path );
2988		- $pattern = false;
2989	6789
2990	6790	// Check for suspicious content in extra files
2991	6791	// Use strict mode for plugins without checksums to avoid false positives
2992		- if ( $file->getSize() < 512000 ) { // Only scan files < 500KB
2993		- $content = file_get_contents( $file_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
2994		- $pattern = $this->detect_suspicious_pattern( $content, $suspicious_only );
2995		- }
	6792	+ $pattern = $this->search_file( $file_path, $suspicious_only );
2996	6793
2997	6794	$item = array(
2998	6795	'file' => $relative,
2999	6796	$type => $name,
		@@ -3001,21 +6798,49 @@
3001	6798
3002	6799	if ( $pattern ) {
3003	6800	// Suspicious content: promote to suspicious category
3004	6801	$item['type'] = 'suspicious_' . $type;
3005		- /* translators: 1: Plugin or theme name, 2: Suspicious pattern found */
3006		- $item['reason'] = sprintf( __( 'Injected file in %1$s with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6802	+
	6803	+ // With an official copy to compare with, the file is known
	6804	+ // not to belong to it. Without one it may well be the
	6805	+ // plugin's own, so it is not called injected.
	6806	+ if ( $suspicious_only ) {
	6807	+ /* translators: 1: Plugin or theme name, or the folder the file is in, 2: Suspicious pattern found */
	6808	+ $item['reason'] = sprintf( __( 'File in %1$s with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6809	+ } else {
	6810	+ /* translators: 1: Plugin or theme name, 2: Suspicious pattern found */
	6811	+ $item['reason'] = sprintf( __( 'File that is not part of %1$s, with suspicious code: %2$s', 'vigilante' ), $name, $pattern );
	6812	+ }
	6813	+
3007	6814	$found['suspicious'][] = $item;
3008	6815	} elseif ( ! $suspicious_only ) {
3009	6816	// No suspicious patterns and checksums available: report as extra
3010	6817	// Skipped in suspicious_only mode (no checksums) to avoid noise
	6818	+ if ( $listed >= $max_listed ) {
	6819	+ if ( ! $truncated ) {
	6820	+ $truncated = true;
	6821	+ $found['errors'][] = sprintf(
	6822	+ /* translators: 1: Plugin or theme name, 2: Number of files */
	6823	+ __( '%1$s has more extra files than can be listed: only the first %2$d are shown.', 'vigilante' ),
	6824	+ $name,
	6825	+ $max_listed
	6826	+ );
	6827	+ }
	6828	+ continue;
	6829	+ }
	6830	+
	6831	+ $listed++;
3011	6832	$item['type'] = 'extra_' . $type;
3012	6833	$item['reason'] = __( 'PHP file not present in original distribution', 'vigilante' );
3013	6834	$found['extra'][] = $item;
	6835	+ } elseif ( null === $pattern ) {
	6836	+ // No official copy to compare with, and the search could
	6837	+ // not look inside either: said, not passed over.
	6838	+ $found['extra'][] = $this->not_searched_item( $file_path, $relative );
3014	6839	}
3015	6840	}
3016	6841	} catch ( Exception $e ) {
3017		- // Ignore iterator errors
	6842	+ $found['errors'][] = self::unreadable_folder_error( $directory );
3018	6843	}
3019	6844
3020	6845	return $found;
3021	6846	}
		@@ -3048,9 +6873,14 @@
3048	6873	if ( false === $content ) {
3049	6874	return false;
3050	6875	}
3051	6876
3052		- $normalized = strtolower( trim( str_replace( array( "\r\n", "\r" ), "\n", $content ) ) );
	6877	+ // Every run of whitespace counts as one space, so the placeholder
	6878	+ // WordPress itself ships (the opening tag, a line break and the comment)
	6879	+ // matches the same entries as the one-line form. The comparison is
	6880	+ // still against the whole file: nothing can follow these few words, and
	6881	+ // no arrangement of them on several lines is code that runs.
	6882	+ $normalized = strtolower( trim( preg_replace( '/\s+/', ' ', $content ) ) );
3053	6883
3054	6884	$known = array(
3055	6885	'',
3056	6886	'<?php',
		@@ -3063,8 +6893,391 @@
3063	6893	return in_array( $normalized, $known, true );
3064	6894	}
3065	6895
3066	6896	/**
	6897	+ * Folders of the installation that hold plugins or themes
	6898	+ *
	6899	+ * @return array Relative path => true, for the plugins folder and every
	6900	+ * theme root that lies inside the WordPress directory.
	6901	+ */
	6902	+ private function code_roots() {
	6903	+ global $wp_theme_directories;
	6904	+
	6905	+ $roots = array();
	6906	+
	6907	+ foreach ( array_merge( array( WP_PLUGIN_DIR, get_theme_root() ), is_array( $wp_theme_directories ) ? $wp_theme_directories : array() ) as $root ) {
	6908	+ $root = untrailingslashit( str_replace( '\\', '/', (string) $root ) );
	6909	+
	6910	+ if ( '' !== $root && 0 === strpos( $root . '/', str_replace( '\\', '/', ABSPATH ) ) ) {
	6911	+ $roots[ $this->relative_path( $root ) ] = true;
	6912	+ }
	6913	+ }
	6914	+
	6915	+ return $roots;
	6916	+ }
	6917	+
	6918	+ /**
	6919	+ * What a partial scan offers to exclude, so that the next one reaches the rest
	6920	+ *
	6921	+ * The folders of the plugins and themes the scan did check, as lines for
	6922	+ * Excluded Paths, less the ones that are excluded by now. A scan starts
	6923	+ * from the beginning every time, so with these out of the way a scan
	6924	+ * run by hand spends its time on what the last one never got to. They
	6925	+ * have to come out of the list afterwards, and the tab says so for as
	6926	+ * long as they are there (see excluded_code_folders()).
	6927	+ *
	6928	+ * The list comes from stored results, and whoever reads it is told to
	6929	+ * paste it into the exclusions, so only what can be the folder of a
	6930	+ * plugin or of a theme is let through: one line with anything else in it
	6931	+ * would exclude far more than it says.
	6932	+ *
	6933	+ * @param mixed $results Scan results, as run_scan() returns them.
	6934	+ * @return array Relative paths, one per folder.
	6935	+ */
	6936	+ public function folders_to_exclude( $results ) {
	6937	+ $stored = is_array( $results ) && isset( $results['checked_folders'] ) && is_array( $results['checked_folders'] ) ? $results['checked_folders'] : array();
	6938	+ $roots = $this->code_roots();
	6939	+ $lines = array();
	6940	+
	6941	+ foreach ( $stored as $folder ) {
	6942	+ if ( ! is_string( $folder ) || 1 === preg_match( '/[\\x00-\\x1f\\x7f]/', $folder ) ) {
	6943	+ continue;
	6944	+ }
	6945	+
	6946	+ $folder = trim( str_replace( '\\', '/', $folder ), '/' );
	6947	+ $name = basename( $folder );
	6948	+
	6949	+ if ( '' === $name || '.' === $name || '..' === $name || ! isset( $roots[ dirname( $folder ) ] ) ) {
	6950	+ continue;
	6951	+ }
	6952	+
	6953	+ if ( ! is_dir( ABSPATH . $folder ) || $this->is_path_excluded( ABSPATH . $folder . '/.' ) ) {
	6954	+ continue;
	6955	+ }
	6956	+
	6957	+ $lines[ $folder ] = true;
	6958	+ }
	6959	+
	6960	+ return array_keys( $lines );
	6961	+ }
	6962	+
	6963	+ /**
	6964	+ * Whole folders of code, or the uploads folder, that Excluded Paths keeps out of every scan
	6965	+ *
	6966	+ * A subfolder of uploads or of a plugin is an ordinary exclusion (a cache
	6967	+ * of compiled templates, say). A whole plugin, a whole theme, the
	6968	+ * must-use plugins or all of uploads is something else: the scan comes
	6969	+ * out complete and clean without having looked there. The tab and
	6970	+ * Security Check go by this list, so that nobody is left thinking those
	6971	+ * folders are being watched.
	6972	+ *
	6973	+ * @return array Relative paths. A folder that holds others (the plugins
	6974	+ * folder, a theme root) stands for all of them.
	6975	+ */
	6976	+ public function excluded_code_folders() {
	6977	+ if ( empty( $this->options['excluded_paths'] ) || ! is_array( $this->options['excluded_paths'] ) ) {
	6978	+ return array();
	6979	+ }
	6980	+
	6981	+ if ( ! function_exists( 'get_plugins' ) ) {
	6982	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	6983	+ }
	6984	+
	6985	+ $found = array();
	6986	+ $roots = array_keys( $this->code_roots() );
	6987	+
	6988	+ foreach ( $roots as $root ) {
	6989	+ if ( $this->is_path_excluded( ABSPATH . $root . '/.' ) ) {
	6990	+ $found[ $root ] = true;
	6991	+ }
	6992	+ }
	6993	+
	6994	+ $plugins_root = $this->relative_path( WP_PLUGIN_DIR );
	6995	+
	6996	+ if ( ! isset( $found[ $plugins_root ] ) ) {
	6997	+ foreach ( array_keys( get_plugins() ) as $plugin_file ) {
	6998	+ $slug = dirname( $plugin_file );
	6999	+
	7000	+ if ( '.' !== $slug && $this->is_path_excluded( WP_PLUGIN_DIR . '/' . $slug . '/.' ) ) {
	7001	+ $found[ $this->relative_path( WP_PLUGIN_DIR . '/' . $slug ) ] = true;
	7002	+ }
	7003	+ }
	7004	+ }
	7005	+
	7006	+ foreach ( wp_get_themes() as $theme ) {
	7007	+ $dir = $theme->get_stylesheet_directory();
	7008	+
	7009	+ if ( ! isset( $found[ $this->relative_path( dirname( $dir ) ) ] ) && $this->is_path_excluded( $dir . '/.' ) ) {
	7010	+ $found[ $this->relative_path( $dir ) ] = true;
	7011	+ }
	7012	+ }
	7013	+
	7014	+ if ( defined( 'WPMU_PLUGIN_DIR' ) && is_dir( WPMU_PLUGIN_DIR ) && $this->is_path_excluded( WPMU_PLUGIN_DIR . '/.' ) ) {
	7015	+ $found[ $this->relative_path( WPMU_PLUGIN_DIR ) ] = true;
	7016	+ }
	7017	+
	7018	+ $uploads = wp_get_upload_dir();
	7019	+
	7020	+ if ( ! empty( $uploads['basedir'] ) && $this->is_path_excluded( $uploads['basedir'] . '/.' ) ) {
	7021	+ $found[ $this->relative_path( $uploads['basedir'] ) ] = true;
	7022	+ }
	7023	+
	7024	+ return array_keys( $found );
	7025	+ }
	7026	+
	7027	+ /**
	7028	+ * Whether a scan checked less than it was asked to
	7029	+ *
	7030	+ * Either it ran out of time, or something could not be read or compared
	7031	+ * (a folder, a plugin whose copy on WordPress.org could not be fetched).
	7032	+ * The tab, the scan email and Security Check go by this, so none of them
	7033	+ * calls clean a result that covers only part of the site.
	7034	+ *
	7035	+ * @param mixed $results Scan results, as run_scan() returns them.
	7036	+ * @return bool
	7037	+ */
	7038	+ public static function is_partial( $results ) {
	7039	+ return is_array( $results ) && ( ! empty( $results['incomplete'] ) || ! empty( $results['errors'] ) );
	7040	+ }
	7041	+
	7042	+ /**
	7043	+ * What a scan did not get to, one line per thing
	7044	+ *
	7045	+ * The one source of that text, for the tab, the scan email and anything
	7046	+ * else that shows the result of a scan. In the order of the scan.
	7047	+ *
	7048	+ * @param mixed $results Scan results, as run_scan() returns them.
	7049	+ * @return array Lines ready to show, not escaped. Empty when nothing was
	7050	+ * left out.
	7051	+ */
	7052	+ public static function not_checked_lines( $results ) {
	7053	+ $left = is_array( $results ) && isset( $results['not_checked'] ) && is_array( $results['not_checked'] ) ? $results['not_checked'] : array();
	7054	+
	7055	+ $areas = isset( $left['areas'] ) && is_array( $left['areas'] ) ? $left['areas'] : array();
	7056	+ $plugins = isset( $left['plugins'] ) && is_array( $left['plugins'] ) ? array_filter( array_map( 'strval', $left['plugins'] ), 'strlen' ) : array();
	7057	+ $themes = isset( $left['themes'] ) && is_array( $left['themes'] ) ? array_filter( array_map( 'strval', $left['themes'] ), 'strlen' ) : array();
	7058	+ $lines = array();
	7059	+
	7060	+ if ( in_array( 'uploads', $areas, true ) ) {
	7061	+ $lines[] = __( 'The uploads folder was not checked.', 'vigilante' );
	7062	+ }
	7063	+
	7064	+ if ( in_array( 'core', $areas, true ) ) {
	7065	+ $lines[] = __( 'The WordPress files were not checked completely.', 'vigilante' );
	7066	+ }
	7067	+
	7068	+ if ( in_array( 'config', $areas, true ) ) {
	7069	+ $lines[] = __( 'wp-config.php and .htaccess were not compared.', 'vigilante' );
	7070	+ }
	7071	+
	7072	+ if ( in_array( 'content', $areas, true ) ) {
	7073	+ $lines[] = __( 'The other folders of wp-content were not checked.', 'vigilante' );
	7074	+ }
	7075	+
	7076	+ if ( in_array( 'plugins', $areas, true ) ) {
	7077	+ $lines[] = __( 'No plugin was checked.', 'vigilante' );
	7078	+ } elseif ( ! empty( $plugins ) ) {
	7079	+ /* translators: %s: Comma separated list of plugin names */
	7080	+ $lines[] = sprintf( __( 'Plugins not checked: %s.', 'vigilante' ), implode( ', ', $plugins ) );
	7081	+ }
	7082	+
	7083	+ if ( in_array( 'unlisted', $areas, true ) ) {
	7084	+ $lines[] = __( 'Must-use plugins, drop-ins and loose PHP files were not checked.', 'vigilante' );
	7085	+ }
	7086	+
	7087	+ if ( in_array( 'themes', $areas, true ) ) {
	7088	+ $lines[] = __( 'No theme was checked.', 'vigilante' );
	7089	+ } elseif ( ! empty( $themes ) ) {
	7090	+ /* translators: %s: Comma separated list of theme names */
	7091	+ $lines[] = sprintf( __( 'Themes not checked: %s.', 'vigilante' ), implode( ', ', $themes ) );
	7092	+ }
	7093	+
	7094	+ return $lines;
	7095	+ }
	7096	+
	7097	+ /**
	7098	+ * Whether the scheduled scan has not finished for longer than it should
	7099	+ *
	7100	+ * A scan that PHP or the server stops halfway stores nothing, so the date
	7101	+ * of the last one that finished is the only sign left. Twice the interval
	7102	+ * and one day more, because WP-Cron only runs when the site has a visit.
	7103	+ *
	7104	+ * @param int $last_scan Time of the last stored scan, 0 for none.
	7105	+ * @param string $frequency 'daily' or 'weekly'.
	7106	+ * @return bool
	7107	+ */
	7108	+ public static function is_scan_overdue( $last_scan, $frequency ) {
	7109	+ $last_scan = (int) $last_scan;
	7110	+
	7111	+ if ( $last_scan <= 0 ) {
	7112	+ return false;
	7113	+ }
	7114	+
	7115	+ $every = 'weekly' === $frequency ? WEEK_IN_SECONDS : DAY_IN_SECONDS;
	7116	+
	7117	+ return ( time() - $last_scan ) > ( 2 * $every + DAY_IN_SECONDS );
	7118	+ }
	7119	+
	7120	+ /**
	7121	+ * What a kind of finding usually is, and what to do about it
	7122	+ *
	7123	+ * The one source of the text shown next to the findings of a scan, so the
	7124	+ * File Integrity tab and anything else that explains them say the same.
	7125	+ * Vigilant's own files have their own source,
	7126	+ * Vigilante_Self_Integrity_Guidance.
	7127	+ *
	7128	+ * @param string $type Finding type as stored in the scan results.
	7129	+ * @return array {
	7130	+ * @type string $label Name of the kind of finding, for a table cell.
	7131	+ * @type string $advice What it usually is and what to do. Empty for a
	7132	+ * type this method does not know.
	7133	+ * }
	7134	+ */
	7135	+ public static function finding_guidance( $type ) {
	7136	+ switch ( $type ) {
	7137	+ case 'php_in_uploads':
	7138	+ return array(
	7139	+ 'label' => __( 'PHP in uploads', 'vigilante' ),
	7140	+ 'advice' => __( 'Uploads is meant for media, not for code. It is normal only when a plugin you use writes PHP there, such as compiled templates or cache files: ignore the file, or add its folder to Excluded Paths if new ones keep appearing. If nothing you use explains it, treat it as malware.', 'vigilante' ),
	7141	+ );
	7142	+
	7143	+ case 'double_extension':
	7144	+ return array(
	7145	+ 'label' => __( 'Double extension', 'vigilante' ),
	7146	+ 'advice' => __( 'A name such as photo.php.jpg is a common way to pass a script off as an image. Delete it unless you know who or what uploaded it.', 'vigilante' ),
	7147	+ );
	7148	+
	7149	+ case 'htaccess_in_uploads':
	7150	+ return array(
	7151	+ 'label' => __( '.htaccess in uploads', 'vigilante' ),
	7152	+ 'advice' => __( 'A .htaccess here changes how the server treats this folder. One that only denies access is not listed. If it makes files run as code (AddHandler, SetHandler, php_value, Options ExecCGI) and you did not put it there, it is a sign of infection. If it only has rewrite rules, it usually belongs to an image or cache plugin, and it switches off for this folder the rule that blocks PHP in uploads.', 'vigilante' ),
	7153	+ );
	7154	+
	7155	+ case 'php_in_root':
	7156	+ return array(
	7157	+ 'label' => __( 'PHP in the site root', 'vigilante' ),
	7158	+ 'advice' => __( 'A PHP file next to wp-config.php that WordPress does not ship. Hosting tools, firewalls and verification scripts put files here, and so do attackers. Ignore it if you know where it comes from; if you do not, look at what it contains before anything else.', 'vigilante' ),
	7159	+ );
	7160	+
	7161	+ case 'extra_root':
	7162	+ return array(
	7163	+ 'label' => __( 'Extra file in the site root', 'vigilante' ),
	7164	+ 'advice' => __( 'WordPress does not ship this file. Verification files and the like are harmless. A copy of wp-config.php, a database dump or a backup archive here can be downloaded by anyone who guesses its name: move it out of the web root.', 'vigilante' ),
	7165	+ );
	7166	+
	7167	+ case 'legacy_core':
	7168	+ return array(
	7169	+ 'label' => __( 'Old core file', 'vigilante' ),
	7170	+ 'advice' => __( 'Left behind by an earlier version of WordPress. Nothing uses it any more and it can be deleted.', 'vigilante' ),
	7171	+ );
	7172	+
	7173	+ case 'suspicious_plugin':
	7174	+ case 'suspicious_theme':
	7175	+ return array(
	7176	+ 'label' => 'suspicious_theme' === $type ? __( 'Hidden code in a theme', 'vigilante' ) : __( 'Hidden code in a plugin', 'vigilante' ),
	7177	+ 'advice' => __( 'The file contains code written the way malware hides itself, and it is not part of the published copy, or there is no published copy to compare with. Some commercial plugins and themes obfuscate their own code and end up here. If you cannot tell, replace the plugin or theme with a clean copy from its author.', 'vigilante' ),
	7178	+ );
	7179	+
	7180	+ case 'extra_plugin':
	7181	+ case 'extra_theme':
	7182	+ return array(
	7183	+ 'label' => 'extra_theme' === $type ? __( 'Extra file in a theme', 'vigilante' ) : __( 'Extra file in a plugin', 'vigilante' ),
	7184	+ 'advice' => __( 'A PHP file that is not in the copy WordPress.org publishes for the installed version. Some plugins and themes create files after they are installed, and a manual fix adds them too. If you cannot explain it, reinstall the plugin or theme: that removes everything that does not belong to it.', 'vigilante' ),
	7185	+ );
	7186	+
	7187	+ case 'php_in_core':
	7188	+ return array(
	7189	+ 'label' => __( 'PHP in a WordPress folder', 'vigilante' ),
	7190	+ 'advice' => __( 'A PHP file in wp-admin or wp-includes that the installed version of WordPress does not ship. It is either left over from an older version or put there by someone: compare it with a clean copy of WordPress and delete it if it is not in it.', 'vigilante' ),
	7191	+ );
	7192	+
	7193	+ case 'config_in_core':
	7194	+ return array(
	7195	+ 'label' => __( 'Configuration file in a WordPress folder', 'vigilante' ),
	7196	+ 'advice' => __( 'A .htaccess, .user.ini or php.ini in wp-admin or wp-includes. A .htaccess that asks for a password in wp-admin is a common protection, and some hosts leave a php.ini there. A line with auto_prepend_file or auto_append_file loads a file on every request: make sure you know which one.', 'vigilante' ),
	7197	+ );
	7198	+
	7199	+ case 'php_config_in_uploads':
	7200	+ return array(
	7201	+ 'label' => __( 'PHP configuration in uploads', 'vigilante' ),
	7202	+ 'advice' => __( 'A .user.ini or php.ini here changes how PHP runs for this folder, and can make it load another file on every request. Nothing in uploads needs one: delete it unless you put it there.', 'vigilante' ),
	7203	+ );
	7204	+
	7205	+ case 'script_in_uploads':
	7206	+ return array(
	7207	+ 'label' => __( 'Script in uploads', 'vigilante' ),
	7208	+ 'advice' => __( 'A script in another language (shell, Perl, Python, CGI). It only runs if the server is told to run it, which a .htaccess in the same folder can do. Delete it unless you know why it is there.', 'vigilante' ),
	7209	+ );
	7210	+
	7211	+ case 'php_config_in_root':
	7212	+ return array(
	7213	+ 'label' => __( 'PHP configuration in the site root', 'vigilante' ),
	7214	+ 'advice' => __( 'This file makes PHP load another file before every request. Firewalls such as Wordfence set it up for themselves, and so do some hosts: check that the file it names is theirs. If nothing you installed needs it, that file runs before WordPress on every visit: treat it as a backdoor.', 'vigilante' ),
	7215	+ );
	7216	+
	7217	+ case 'backup_in_root':
	7218	+ return array(
	7219	+ 'label' => __( 'Backup in the site root', 'vigilante' ),
	7220	+ 'advice' => __( 'A copy of wp-config.php, a database dump or an archive next to WordPress can be downloaded by anyone who guesses its name, and it holds passwords or the whole site. Move it out of the web root or delete it.', 'vigilante' ),
	7221	+ );
	7222	+
	7223	+ case 'php_in_content':
	7224	+ return array(
	7225	+ 'label' => __( 'Loose PHP in wp-content', 'vigilante' ),
	7226	+ 'advice' => __( 'A PHP file, or a folder with PHP files, in wp-content or among the plugins or the themes, that WordPress does not list as a plugin, a theme or a drop-in. It does not show on the Plugins screen, and it can still be reached by its address. Some plugins keep a settings file there, WP Super Cache for one. If nothing you use explains it, look at what it contains.', 'vigilante' ),
	7227	+ );
	7228	+
	7229	+ case 'suspicious_content':
	7230	+ return array(
	7231	+ 'label' => __( 'Hidden code in wp-content', 'vigilante' ),
	7232	+ 'advice' => __( 'The file contains code written the way malware hides itself, in a folder of wp-content that belongs to no plugin and no theme. Cache, backup and security plugins keep files in folders like these, and what they store can look like this. Find out which one the folder belongs to. If nothing you use explains the file, treat it as malware.', 'vigilante' ),
	7233	+ );
	7234	+
	7235	+ case 'translation_with_code':
	7236	+ return array(
	7237	+ 'label' => __( 'Translation file with code', 'vigilante' ),
	7238	+ 'advice' => __( 'WordPress loads the translation files of the site language on every request, and a translation file holds text and nothing else. This one holds something more. Delete it and get the translations again from Dashboard > Updates. If it comes back, something on the site is writing it.', 'vigilante' ),
	7239	+ );
	7240	+
	7241	+ case 'not_searched':
	7242	+ return array(
	7243	+ 'label' => __( 'File not searched', 'vigilante' ),
	7244	+ 'advice' => __( 'The search for hidden code could not look inside this file, nearly always because it is very large, and there is no official copy to compare it with. A PHP file of that size is unusual. Check that it belongs to the plugin, the theme or the folder it is in, and ignore it if it does.', 'vigilante' ),
	7245	+ );
	7246	+
	7247	+ case 'server_config':
	7248	+ return array(
	7249	+ 'label' => __( 'Server configuration file', 'vigilante' ),
	7250	+ 'advice' => __( 'A .htaccess, .user.ini or php.ini outside uploads that makes the server run files as code or load a file on every request. Plugins rarely need one. If you cannot tell which one put it there, treat it as a sign of infection.', 'vigilante' ),
	7251	+ );
	7252	+
	7253	+ case 'core':
	7254	+ return array(
	7255	+ 'label' => __( 'WordPress core', 'vigilante' ),
	7256	+ 'advice' => __( 'Does not match the copy WordPress.org publishes for your version and language. For a file in wp-admin, wp-includes or the site root, reinstall WordPress from Dashboard > Updates and scan again. A file of a bundled theme or of Akismet, under wp-content, appears here after that theme or plugin updates on its own, which is normal.', 'vigilante' ),
	7257	+ );
	7258	+
	7259	+ case 'plugin':
	7260	+ case 'theme':
	7261	+ return array(
	7262	+ 'label' => 'theme' === $type ? __( 'Theme', 'vigilante' ) : __( 'Plugin', 'vigilante' ),
	7263	+ 'advice' => __( 'Does not match the copy WordPress.org publishes for the installed version. The usual causes are an update that did not finish, a release replaced on WordPress.org without a new version number, or a manual edit. Reinstall it; if the file changes again by itself, investigate.', 'vigilante' ),
	7264	+ );
	7265	+
	7266	+ case 'critical_config':
	7267	+ return array(
	7268	+ 'label' => __( 'Configuration file', 'vigilante' ),
	7269	+ 'advice' => __( 'Changed since you last approved it. Cache, security and redirection plugins rewrite their own blocks in these files, often on every update, and that shows up here too. Review the changes and approve them if they belong to something you use. Lines you cannot explain, above all the ones that load a file or send requests to one, need a closer look.', 'vigilante' ),
	7270	+ );
	7271	+ }
	7272	+
	7273	+ return array(
	7274	+ 'label' => (string) $type,
	7275	+ 'advice' => '',
	7276	+ );
	7277	+ }
	7278	+
	7279	+ /**
3067	7280	* Check if a path is excluded from scanning
3068	7281	*
3069	7282	* @param string $path File path.
3070	7283	* @return bool
		@@ -3214,8 +7427,39 @@
3214	7427	return array_values(
3215	7428	array_filter(
3216	7429	$items,
3217	7430	function ( $item ) {
	7431	+ /*
	7432	+ * On a network, wp-config.php and the root .htaccess are not a
	7433	+ * site's to silence: a change to them is closed by approving it,
	7434	+ * and approving takes a network administrator since 2.11.3. The
	7435	+ * ignore list is an option of each site, so until 2.11.8 the
	7436	+ * administrator of the main site without network rights hid a
	7437	+ * pending change from the network administrator's own screen by
	7438	+ * posting the file name to the ignore handler.
	7439	+ */
	7440	+ if ( is_multisite() && is_array( $item ) && 'critical_config' === ( $item['type'] ?? '' ) ) {
	7441	+ return true;
	7442	+ }
	7443	+
	7444	+ // Findings about the manifest and the version of Vigilant
	7445	+ // itself are not about one file, so no entry of the list may
	7446	+ // hide them, on a single site either: ignoring the row of
	7447	+ // MANIFEST.sha256 took a replaced manifest out of the email.
	7448	+ // Vigilante_Self_Integrity::filter_ignored_findings() keeps
	7449	+ // them the same way.
	7450	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) && in_array( $item['self_finding'] ?? '', array( 'manifest_replaced', 'manifest_unverified', 'manifest_missing', 'manifest_invalid', 'self_downgraded' ), true ) ) {
	7451	+ return true;
	7452	+ }
	7453	+ // Nor the findings of the walk of Vigilant's folder (a folder
	7454	+ // that cannot be listed, the folder that could not be walked):
	7455	+ // their path ends in a slash, and ignoring that row left the
	7456	+ // scan with no row and no email while the self-protection
	7457	+ // status stayed critical.
	7458	+ if ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) && '/' === substr( (string) ( $item['file'] ?? '' ), -1 ) ) {
	7459	+ return true;
	7460	+ }
	7461	+
3218	7462	$file = is_array( $item ) && isset( $item['file'] ) ? $item['file'] : '';
3219	7463	return ! in_array( $file, $this->ignored_files, true );
3220	7464	}
3221	7465	)
		@@ -3236,32 +7480,25 @@
3236	7480	*/
3237	7481	private function maybe_send_notification( $results ) {
3238	7482	$options = is_array( $this->options ) ? $this->options : array();
3239	7483
3240		- // Count critical_config separately from regular modified so we can treat it
3241		- // as "serious" for notification level purposes (same tier as suspicious/extra).
3242		- $has_critical_config = false;
3243		- foreach ( $results['modified'] ?? array() as $item ) {
3244		- if ( is_array( $item ) && isset( $item['type'] ) && 'critical_config' === $item['type'] ) {
3245		- $has_critical_config = true;
3246		- break;
3247		- }
3248		- }
3249		-
3250		- // Collect closed/removed plugins (excluding ignored slugs). These count
3251		- // as "serious" for notification purposes: a closed plugin in wp.org is
3252		- // a security-critical finding, same tier as a suspicious file.
	7484	+ // Closed/removed plugins (excluding ignored slugs) travel in this
	7485	+ // email, in the same tier as a suspicious file.
3253	7486	$closed_plugins = $this->collect_closed_plugins_for_email();
3254		- $has_closed = ! empty( $closed_plugins );
3255	7487
3256		- $has_suspicious = ! empty( $results['suspicious'] ) || ! empty( $results['extra'] ) || $has_critical_config || $has_closed;
3257		- $has_modified = ! empty( $results['modified'] );
	7488	+ /*
	7489	+ * Self-protection is not part of this decision. Its alert is its own
	7490	+ * and no setting switches it off, so this email is about the files of
	7491	+ * the site: core, plugins, themes, uploads and the two shared
	7492	+ * configuration files. Missing files do not send it on their own: it
	7493	+ * has no section to list them in.
	7494	+ */
3258	7495
3259		- // Instant alert: send for suspicious, extra, critical_config, modified
3260		- // files, or closed plugins.
3261		- $instant_alert = ! empty( $options['instant_alert'] );
3262		- if ( $instant_alert && ( $has_suspicious || $has_modified ) ) {
3263		- $this->send_notification( $results, 'all', $closed_plugins );
	7496	+ // Instant alert: every finding travels, modified files included,
	7497	+ // whatever the level below says. A scan with nothing to report goes
	7498	+ // through as well, so that what was reported is forgotten.
	7499	+ if ( ! empty( $options['instant_alert'] ) ) {
	7500	+ $this->send_new_findings( $results, 'all', $closed_plugins );
3264	7501	return;
3265	7502	}
3266	7503
3267	7504	// Determine notify level with backward compatibility
		@@ -3276,22 +7513,142 @@
3276	7513	}
3277	7514	}
3278	7515
3279	7516	if ( 'disabled' === $notify_level ) {
	7517	+ // Nothing is sent, and nothing stays on record as reported:
	7518	+ // whoever switches the email back on is told about everything
	7519	+ // that is pending then.
	7520	+ delete_option( self::NOTIFIED_OPTION );
3280	7521	return;
3281	7522	}
3282	7523
3283	7524	// 'suspicious_only' treats suspicious/extra, critical_config AND closed
3284		- // plugins as serious.
3285		- if ( 'suspicious_only' === $notify_level && ! $has_suspicious ) {
	7525	+ // plugins as serious. A scan with nothing to send at this level still
	7526	+ // goes through send_new_findings(), which then forgets what it had
	7527	+ // reported, so a finding that goes away and comes back is new again.
	7528	+ $this->send_new_findings( $results, $notify_level, $closed_plugins );
	7529	+ }
	7530	+
	7531	+ /**
	7532	+ * What the scan email has already reported to the recipients
	7533	+ */
	7534	+ const NOTIFIED_OPTION = 'vigilante_integrity_notified';
	7535	+
	7536	+ /**
	7537	+ * Send the scan email only when the scan found something new
	7538	+ *
	7539	+ * Until now the email went out after every scan for as long as a finding
	7540	+ * was still listed, so a plugin that rewrote its block in .htaccess meant
	7541	+ * the same alert every day until somebody approved the change. Now every
	7542	+ * finding is reported once: the email goes out when a scan finds something
	7543	+ * the recipients have not been told about, and it lists everything that is
	7544	+ * pending, old and new.
	7545	+ *
	7546	+ * A finding is the file, its kind and its content (by its hash), so a
	7547	+ * file that changes again under the same name is new, also when the
	7548	+ * change keeps its size and its date. What goes away is forgotten, so it
	7549	+ * is new again if it comes back. Nothing is recorded when the email could
	7550	+ * not be sent, and the next scan tries again.
	7551	+ *
	7552	+ * @param array $results Scan results.
	7553	+ * @param string $notify_level 'all' or 'suspicious_only'.
	7554	+ * @param array $closed_plugins Closed plugins, keyed by slug.
	7555	+ */
	7556	+ private function send_new_findings( $results, $notify_level, $closed_plugins ) {
	7557	+ $keys = $this->notification_keys( $results, $closed_plugins, 'all' === $notify_level );
	7558	+ $told = get_option( self::NOTIFIED_OPTION, array() );
	7559	+ $told = is_array( $told ) ? $told : array();
	7560	+
	7561	+ // A partial scan cannot tell whether what it did not reach is still
	7562	+ // there, so it forgets nothing: with the findings of an unchecked
	7563	+ // plugin forgotten, the next scan that reached it would report them
	7564	+ // again as new, and on a site whose scans are always partial that
	7565	+ // is the same email over and over.
	7566	+ $known = self::is_partial( $results ) ? array_values( array_unique( array_merge( $keys, $told ) ) ) : $keys;
	7567	+
	7568	+ // The record is bounded, and the comparison is not: what does not fit
	7569	+ // in the record is reported again, never left out. The keys come in
	7570	+ // order of importance, so what does not fit is the least of it.
	7571	+ $record = array_slice( $known, 0, 5000 );
	7572	+
	7573	+ if ( empty( array_diff( $keys, $told ) ) ) {
	7574	+ if ( count( $record ) !== count( $told ) ) {
	7575	+ update_option( self::NOTIFIED_OPTION, $record, false );
	7576	+ }
3286	7577	return;
3287	7578	}
3288	7579
3289		- if ( ! $has_suspicious && ! $has_modified ) {
3290		- return;
	7580	+ if ( $this->send_notification( $results, $notify_level, $closed_plugins ) ) {
	7581	+ update_option( self::NOTIFIED_OPTION, $record, false );
3291	7582	}
	7583	+ }
3292	7584
3293		- $this->send_notification( $results, $notify_level, $closed_plugins );
	7585	+ /**
	7586	+ * One key per finding the scan email would carry at this level
	7587	+ *
	7588	+ * @param array $results Scan results.
	7589	+ * @param array $closed_plugins Closed plugins, keyed by slug.
	7590	+ * @param bool $with_modified Whether files that are only modified travel
	7591	+ * in the email at this level.
	7592	+ * @return array
	7593	+ */
	7594	+ private function notification_keys( $results, $closed_plugins, $with_modified ) {
	7595	+ $keys = array(
	7596	+ 'config' => array(),
	7597	+ 'closed' => array(),
	7598	+ 'suspicious' => array(),
	7599	+ 'modified' => array(),
	7600	+ 'extra' => array(),
	7601	+ );
	7602	+
	7603	+ foreach ( (array) ( $results['modified'] ?? array() ) as $item ) {
	7604	+ if ( ! is_array( $item ) ) {
	7605	+ continue;
	7606	+ }
	7607	+
	7608	+ $type = (string) ( $item['type'] ?? '' );
	7609	+ $config = 'critical_config' === $type;
	7610	+
	7611	+ // Vigilant's own files have their own alert.
	7612	+ if ( 'vigilante_self' === $type || ( ! $config && ! $with_modified ) ) {
	7613	+ continue;
	7614	+ }
	7615	+
	7616	+ $keys[ $config ? 'config' : 'modified' ][] = md5( 'modified|' . $type . '|' . (string) ( $item['file'] ?? '' ) . '|' . (string) ( $item['actual_hash'] ?? '' ) );
	7617	+ }
	7618	+
	7619	+ foreach ( (array) $closed_plugins as $slug => $info ) {
	7620	+ $keys['closed'][] = md5( 'closed|' . $slug . '|' . ( is_array( $info ) ? (string) ( $info['state'] ?? '' ) : '' ) );
	7621	+ }
	7622	+
	7623	+ foreach ( array( 'suspicious', 'extra' ) as $bucket ) {
	7624	+ foreach ( (array) ( $results[ $bucket ] ?? array() ) as $item ) {
	7625	+ $type = is_array( $item ) ? (string) ( $item['type'] ?? '' ) : '';
	7626	+
	7627	+ if ( 'vigilante_self' === $type ) {
	7628	+ continue;
	7629	+ }
	7630	+
	7631	+ $file = is_array( $item ) ? (string) ( $item['file'] ?? '' ) : (string) $item;
	7632	+ $state = '';
	7633	+ $path = ABSPATH . ltrim( $file, '/' );
	7634	+
	7635	+ // By content, so a file rewritten with the same size and the
	7636	+ // same date is still a different file. The ones too large to
	7637	+ // hash on every scan go by size, date and the time of their
	7638	+ // last change of any kind, which writing to a file moves and
	7639	+ // which cannot be set back the way the date can.
	7640	+ if ( '' !== $file && is_file( $path ) ) {
	7641	+ $state = filesize( $path ) <= MB_IN_BYTES ? (string) md5_file( $path ) : filesize( $path ) . ':' . filemtime( $path ) . ':' . filectime( $path );
	7642	+ }
	7643	+
	7644	+ $keys[ $bucket ][] = md5( $bucket . '|' . $type . '|' . $file . '|' . $state );
	7645	+ }
	7646	+ }
	7647	+
	7648	+ // In order of importance: only the first 5,000 are remembered, and
	7649	+ // what is not remembered is reported again.
	7650	+ return array_values( array_unique( array_merge( $keys['config'], $keys['closed'], $keys['suspicious'], $keys['modified'], $keys['extra'] ) ) );
3294	7651	}
3295	7652
3296	7653	/**
3297	7654	* Collect the closed/removed plugins (excluding ignored slugs) so they can
		@@ -3326,8 +7683,10 @@
3326	7683	'suspicious' => array_merge( $results1['suspicious'] ?? array(), $results2['suspicious'] ?? array() ),
3327	7684	'extra' => array_merge( $results1['extra'] ?? array(), $results2['extra'] ?? array() ),
3328	7685	'new' => $results1['new'] ?? array(),
3329	7686	'errors' => array_merge( $results1['errors'] ?? array(), $results2['errors'] ?? array() ),
	7687	+ // Plugins and themes with no official copy to compare with.
	7688	+ 'unverified' => array_merge( $results1['unverified'] ?? array(), $results2['unverified'] ?? array() ),
3330	7689	'scan_time' => $results1['scan_time'] ?? 0,
3331	7690	'incomplete' => $results1['incomplete'] ?? false,
3332	7691	);
3333	7692	}
		@@ -3373,8 +7732,37 @@
3373	7732	$regular_modified[] = $item;
3374	7733	}
3375	7734	}
3376	7735
	7736	+ /*
	7737	+ * Self-protection does not travel in this email any more: it has its own
	7738	+ * alert, which no setting switches off (Vigilante_Self_Integrity::
	7739	+ * maybe_send_self_alert()). Older stored results can still carry its
	7740	+ * rows, so they are dropped here instead of being listed as ordinary
	7741	+ * files.
	7742	+ */
	7743	+ foreach ( array( 'suspicious', 'extra', 'missing' ) as $self_bucket ) {
	7744	+ if ( empty( $results[ $self_bucket ] ) || ! is_array( $results[ $self_bucket ] ) ) {
	7745	+ continue;
	7746	+ }
	7747	+ $results[ $self_bucket ] = array_values(
	7748	+ array_filter(
	7749	+ $results[ $self_bucket ],
	7750	+ function ( $item ) {
	7751	+ return ! ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) );
	7752	+ }
	7753	+ )
	7754	+ );
	7755	+ }
	7756	+ $regular_modified = array_values(
	7757	+ array_filter(
	7758	+ $regular_modified,
	7759	+ function ( $item ) {
	7760	+ return ! ( is_array( $item ) && 'vigilante_self' === ( $item['type'] ?? '' ) );
	7761	+ }
	7762	+ )
	7763	+ );
	7764	+
3377	7765	$suspicious_count = count( $results['suspicious'] ?? array() );
3378	7766	$extra_count = count( $results['extra'] ?? array() );
3379	7767	$critical_config_count = count( $critical_config );
3380	7768	$modified_count = count( $regular_modified );
		@@ -3379,16 +7767,31 @@
3379	7767	$critical_config_count = count( $critical_config );
3380	7768	$modified_count = count( $regular_modified );
3381	7769	$closed_count = count( $closed_plugins );
3382	7770
3383		- // Use more urgent subject when suspicious files, critical config changes
3384		- // or closed plugins are found (all three are security-critical).
3385		- if ( $suspicious_count > 0 || $critical_config_count > 0 || $closed_count > 0 ) {
	7771	+ // The subject says what was found. Suspicious files and closed plugins
	7772	+ // keep the alert wording. A change in wp-config.php or .htaccess with
	7773	+ // nothing else next to it names the files instead: most of the time it
	7774	+ // is a plugin rewriting its own block, and "SECURITY ALERT" on every
	7775	+ // one of those taught people to read the subject as "I was hacked".
	7776	+ if ( $suspicious_count > 0 || $closed_count > 0 ) {
3386	7777	$subject = sprintf(
3387	7778	/* translators: %s: Site name */
3388	7779	__( '[%s] SECURITY ALERT: File integrity issues detected', 'vigilante' ),
3389	7780	$site_name
3390	7781	);
	7782	+ } elseif ( $critical_config_count > 0 ) {
	7783	+ $changed = array();
	7784	+ foreach ( $critical_config as $item ) {
	7785	+ $changed[] = (string) ( $item['file'] ?? '' );
	7786	+ }
	7787	+
	7788	+ $subject = sprintf(
	7789	+ /* translators: 1: Site name, 2: The file that changed, or both of them, such as "wp-config.php, .htaccess" */
	7790	+ __( '[%1$s] %2$s changed: review needed', 'vigilante' ),
	7791	+ $site_name,
	7792	+ implode( ', ', array_unique( array_filter( $changed ) ) )
	7793	+ );
3391	7794	} else {
3392	7795	$subject = sprintf(
3393	7796	/* translators: %s: Site name */
3394	7797	__( '[%s] File integrity issues detected', 'vigilante' ),
		@@ -3423,9 +7826,9 @@
3423	7826	// Suspicious files section
3424	7827	if ( ! empty( $results['suspicious'] ) ) {
3425	7828	$inner .= $this->get_section_html(
3426	7829	__( 'Suspicious files', 'vigilante' ),
3427		- __( 'These files may contain malicious code. Review immediately.', 'vigilante' ),
	7830	+ __( 'Files that can run code where none is expected, or that contain code written the way malware hides itself. Some are harmless, such as cache files a plugin generates or a .htaccess that protects a folder: check the path and the reason before acting.', 'vigilante' ),
3428	7831	$results['suspicious'],
3429	7832	'#d63638',
3430	7833	'#fef1f1',
3431	7834	20,
		@@ -3436,9 +7839,9 @@
3436	7839	// Extra files section
3437	7840	if ( ! empty( $results['extra'] ) ) {
3438	7841	$inner .= $this->get_section_html(
3439	7842	__( 'Extra files', 'vigilante' ),
3440		- __( 'PHP files not in the original WordPress.org distribution.', 'vigilante' ),
	7843	+ __( 'Files that are not part of WordPress, or of the plugin or theme they sit in. Many are legitimate. A copy of wp-config.php or a database dump in the site root should be moved out of it.', 'vigilante' ),
3441	7844	$results['extra'],
3442	7845	'#b32d2e',
3443	7846	'#fdf6f4',
3444	7847	20,
		@@ -3449,9 +7852,9 @@
3449	7852	// Critical config files section (wp-config.php, .htaccess modified outside Vigilante)
3450	7853	if ( ! empty( $critical_config ) ) {
3451	7854	$inner .= $this->get_section_html(
3452	7855	__( 'Critical config files modified', 'vigilante' ),
3453		- __( 'These files are common targets for code injection. Review the changes and approve if they are legitimate.', 'vigilante' ),
	7856	+ __( 'Changed since you last approved them. Cache, security and redirection plugins rewrite their own blocks in these files, often on every update, and attackers write to them too. Review the changes and approve them if they belong to something you use.', 'vigilante' ),
3454	7857	$critical_config,
3455	7858	'#e36210',
3456	7859	'#fdf2e6',
3457	7860	10,
		@@ -3462,9 +7865,9 @@
3462	7865	// Modified files section (only if notify_level is 'all')
3463	7866	if ( 'all' === $notify_level && ! empty( $regular_modified ) ) {
3464	7867	$inner .= $this->get_section_html(
3465	7868	__( 'Modified files', 'vigilante' ),
3466		- __( 'Checksum mismatch with WordPress.org originals.', 'vigilante' ),
	7869	+ __( 'These files do not match the copy WordPress.org publishes for the installed version. Reinstalling the plugin, the theme or WordPress brings the original back.', 'vigilante' ),
3467	7870	$regular_modified,
3468	7871	'#dba617',
3469	7872	'#fdf8e8',
3470	7873	15,
		@@ -3479,8 +7882,31 @@
3479	7882	if ( $closed_count > 0 ) {
3480	7883	$inner .= $this->build_closed_plugins_email_section( $closed_plugins );
3481	7884	}
3482	7885
	7886	+ // A partial scan says so and names what it did not get to. With no
	7887	+ // finding in a plugin that was never looked at, silence here read as
	7888	+ // "that plugin is fine".
	7889	+ if ( self::is_partial( $results ) ) {
	7890	+ $partial_lines = array_merge(
	7891	+ array_slice( array_map( 'strval', (array) ( $results['errors'] ?? array() ) ), 0, 10 ),
	7892	+ self::not_checked_lines( $results )
	7893	+ );
	7894	+
	7895	+ $inner .= '<p style="margin:0 0 8px;font-size:13px;color:#1d2327;"><strong>' . esc_html__( 'The last scan could not check everything, so its result is partial.', 'vigilante' ) . '</strong></p>';
	7896	+ $inner .= '<ul style="margin:0 0 16px 18px;padding:0;font-size:13px;color:#50575e;">';
	7897	+
	7898	+ foreach ( $partial_lines as $partial_line ) {
	7899	+ $inner .= '<li>' . esc_html( $partial_line ) . '</li>';
	7900	+ }
	7901	+
	7902	+ $inner .= '</ul>';
	7903	+ }
	7904	+
	7905	+ // Where the explanation is. The email stays a list; what each kind of
	7906	+ // finding usually is and what to do about it lives next to the results.
	7907	+ $inner .= '<p style="margin:0 0 16px;font-size:12px;color:#50575e;">' . esc_html__( 'File Integrity explains what each kind of finding usually is and what to do about it. A finding stays listed until you approve it, ignore it or fix it.', 'vigilante' ) . '</p>';
	7908	+
3483	7909	// CTA button
3484	7910	$inner .= Vigilante_Email_Template::button(
3485	7911	admin_url( 'admin.php?page=vigilante&tab=file-integrity#vigilante-section-fi-last-scan' ),
3486	7912	__( 'Review in Vigilant', 'vigilante' )
		@@ -3486,13 +7912,20 @@
3486	7912	__( 'Review in Vigilant', 'vigilante' )
3487	7913	);
3488	7914
3489	7915	$is_alert = ( $suspicious_count > 0 || $critical_config_count > 0 || $closed_count > 0 );
3490		- $title = $is_alert
3491		- ? __( 'Security alert', 'vigilante' )
3492		- : __( 'File integrity report', 'vigilante' );
3493	7916
3494		- Vigilante_Email_Template::send( $to, $subject, $title, $inner, $is_alert );
	7917	+ // Same three cases as the subject.
	7918	+ if ( $suspicious_count > 0 || $closed_count > 0 ) {
	7919	+ $title = __( 'Security alert', 'vigilante' );
	7920	+ } elseif ( $critical_config_count > 0 ) {
	7921	+ $title = __( 'Configuration file changed', 'vigilante' );
	7922	+ } else {
	7923	+ $title = __( 'File integrity report', 'vigilante' );
	7924	+ }
	7925	+
	7926	+ // The caller records what was reported only when the email went out.
	7927	+ return (bool) Vigilante_Email_Template::send( $to, $subject, $title, $inner, $is_alert );
3495	7928	}
3496	7929
3497	7930	/**
3498	7931	* Build the closed + removed plugins block for the scan email.
		@@ -3617,16 +8050,32 @@
3617	8050
3618	8051	/**
3619	8052	* Add a file to the ignored list
3620	8053	*
	8054	+ * The path is stored exactly as it comes: the callers are the AJAX
	8055	+ * handlers, which have already read it and checked it against the shared
	8056	+ * files and Vigilant's own, and the scan compares the stored strings with
	8057	+ * the paths it finds one by one (in_array(), strict). This used to run
	8058	+ * sanitize_text_field() over it, which deletes every %XX octet and collapses
	8059	+ * repeated spaces, so the entry never matched the file it was made for
	8060	+ * (measured on 1 oct 2026 against 3.0.1). Anything that is not a plain
	8061	+ * string, is empty or carries tags is not a path and is refused. That guards
	8062	+ * a direct caller: the AJAX handlers read the path with wp_strip_all_tags()
	8063	+ * first, which shortens a name with a stray < instead of handing it over
	8064	+ * intact (see ajax_ignore_file()).
	8065	+ *
3621	8066	* @param string $file_path Relative file path to ignore.
3622	8067	* @return bool
3623	8068	*/
3624	8069	public function ignore_file( $file_path ) {
	8070	+ if ( ! is_string( $file_path ) || '' === $file_path || wp_strip_all_tags( $file_path ) !== $file_path ) {
	8071	+ return false;
	8072	+ }
	8073	+
3625	8074	$ignored = get_option( 'vigilante_ignored_files', array() );
3626	8075
3627	8076	if ( ! in_array( $file_path, $ignored, true ) ) {
3628		- $ignored[] = sanitize_text_field( $file_path );
	8077	+ $ignored[] = $file_path;
3629	8078	return update_option( 'vigilante_ignored_files', $ignored );
3630	8079	}
3631	8080
3632	8081	return true;