Get WordPress

Plugin Directory

Changeset 3057544

Timestamp:
03/24/2024 05:10:54 AM (4 months ago)
Author:
enamulwp
Message:

Fix: Using exec()/shell_exec() in PHP is considered dangerous inside includes/class-mvsp-export-db.php.
Fix: Using cURL instead of HTTP API in includes/class-deployment-script.php.
Fix: Using cURL instead of HTTP API in includes/class-mvsp-encryption.php.

Location:
safe-ai-malware-protection-for-wp/trunk
Files:
1 deleted
8 edited

Legend:

Unmodified
Added
Removed

  • safe-ai-malware-protection-for-wp/trunk/README.txt

    r3057167 r3057544  
    44Requires at least: 5.0
    55Tested up to: 6.4.3
    6 Stable tag: 1.0.2
     6Stable tag: 1.0.
    77Requires PHP: 7.4
    88License: GPLv2 or later
    … …  
    7070= 1.0.2 =
    7171Update the version of the plugin for testing WordPress.org review team
     72
     73
     74
     75
     76
     77

  • safe-ai-malware-protection-for-wp/trunk/changelog.txt

    r3057167 r3057544  
    66= 1.0.2 =
    77Update the version of the plugin for testing WordPress.org review team
     8
     9
     10
     11
     12

  • safe-ai-malware-protection-for-wp/trunk/includes/class-deployment-script.php

    r3055224 r3057544  
    2525        fclose($file);
    2626    }
    27 
    28     public function move_folder_contents($sourceFolder, $destinationFolder)
    29     {
    30         // Get the list of files and directories in the source folder
    31         $items = scandir($sourceFolder);
    32 
    33         // Loop through each item
    34         foreach ($items as $item) {
    35             // Skip special directories (current and parent)
    36             if ($item == '.' || $item == '..') {
    37                 continue;
    38             }
    39 
    40             // Build the full paths for the source and destination
    41             $sourcePath = $sourceFolder . '/' . $item;
    42             $destinationPath = $destinationFolder . '/' . $item;
    43 
    44             // Check if the item is a file or a directory
    45             if (is_file($sourcePath)) {
    46                 // If it's a file, move it to the destination folder
    47                 rename($sourcePath, $destinationPath);
    48             } elseif (is_dir($sourcePath)) {
    49                 // If it's a directory, create the directory in the destination folder
    50                 mkdir($destinationPath);
    51 
    52                 // Recursively move the contents of the subfolder
    53                 $this->move_folder_contents($sourcePath, $destinationPath);
    54 
    55                 // Remove the empty source directory
    56                 rmdir($sourcePath);
    57             }
    58         }
    59     }
    6027}

  • safe-ai-malware-protection-for-wp/trunk/includes/class-malware-virus-scanner-plugin.php

    r3057167 r3057544  
    7474            $this->version = MVSP_PLUGIN_VERSION;
    7575        } else {
    76             $this->version = '1.0.2';
     76            $this->version = '1.0.';
    7777        }
    7878        $this->plugin_name = 'malware-virus-scanner-plugin';

  • safe-ai-malware-protection-for-wp/trunk/includes/class-mvsp-export-db.php

    r3055224 r3057544  
    99    {
    1010        require_once ABSPATH . 'wp-load.php';
    11        
    1211        global $wpdb;
    13    
     12
     13        // Output file name and path
    1414        $exported_db_filename = get_option('mvsp_auth_token');
    15    
    16         // Use $wpdb to get database connection details
    17         $db_user = $wpdb->dbuser;
    18         $db_pass = $wpdb->dbpassword;
    19         $db_name = $wpdb->dbname;
    20         $db_host = $wpdb->dbhost;
    21    
    22         // Use $wpdb to establish database connection
    23         $wpdb->dbh = new mysqli($db_host, $db_user, $db_pass, $db_name);
    24    
    25         // Check for connection error using $wpdb
    26         if ($wpdb->dbh->connect_error) {
    27             die(esc_html__('Connection failed: ', 'malware-virus-scanner-plugin') . esc_html($wpdb->dbh->connect_error));
     15        $output_file = $exported_db_filename.'.txt';
     16
     17        // Open the output file for writing
     18        $file = fopen($output_file, 'w');
     19
     20        // Write the SQL dump header
     21        fwrite($file, "-- phpMyAdmin SQL Dump\n");
     22        fwrite($file, "-- version 5.2.0\n");
     23        fwrite($file, "-- https://www.phpmyadmin.net/\n");
     24        fwrite($file, "--\n");
     25        fwrite($file, "-- Host: " . DB_HOST . "\n");
     26        fwrite($file, "-- Generation Time: " . date("M d, Y \a\\t H:i A") . "\n");
     27        fwrite($file, "-- Server version: " . $wpdb->db_version . "\n");
     28        fwrite($file, "-- PHP Version: " . phpversion() . "\n\n");
     29
     30        // Set SQL mode and start transaction
     31        fwrite($file, "SET SQL_MODE = \"NO_AUTO_VALUE_ON_ZERO\";\n");
     32        fwrite($file, "START TRANSACTION;\n");
     33        fwrite($file, "SET time_zone = \"+00:00\";\n\n");
     34
     35        // Set character set settings
     36        fwrite($file, "/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;\n");
     37        fwrite($file, "/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;\n");
     38        fwrite($file, "/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;\n");
     39        fwrite($file, "/*!40101 SET NAMES utf8mb4 */;\n\n");
     40
     41        // Write database information
     42        fwrite($file, "--\n-- Database: `" . DB_NAME . "`\n--\n\n");
     43
     44        // Iterate through each table and export structure and data
     45        $tables = $wpdb->get_results("SHOW TABLES", ARRAY_N);
     46        foreach ($tables as $table_row) {
     47            $table = $table_row[0];
     48
     49            // Export table structure
     50            $table_structure = $wpdb->get_var("SHOW CREATE TABLE $table");
     51            fwrite($file, "$table_structure;\n\n");
     52
     53            // Export table data
     54            $data_rows = $wpdb->get_results("SELECT * FROM $table", ARRAY_A);
     55            foreach ($data_rows as $data_row) {
     56                $prepared_values = array_map(array($wpdb, 'prepare'), array_fill(0, count($data_row), "%s"), $data_row);
     57                $insert_query = $wpdb->prepare("INSERT INTO $table VALUES (" . implode(', ', $prepared_values) . ")", $prepared_values);
     58                fwrite($file, $insert_query . ";\n");
     59            }
     60
     61            fwrite($file, "\n");
    2862        }
    29    
    30         $dumpFilePath = $exported_db_filename . '.sql';
    31         $command = "mysqldump --host=$db_host --user=$db_user --password=$db_pass --databases $db_name > $dumpFilePath";
    32         exec($command);
    33        
    34         // Close the database connection
    35         $wpdb->dbh->close();
    36        
    37         return $dumpFilePath;
     63
     64        // Close the output file
     65        fclose($file);
     66
     67        return $output_file;
    3868    }   
    3969

  • safe-ai-malware-protection-for-wp/trunk/includes/class-mvsp-wp-info.php

    r3055224 r3057544  
    101101        return $outputFile;
    102102    }
    103 
    104     // Function to send the encrypted file to another API
    105     public static function send_encrypted_file($encryptedFile, $apiEndpoint)
    106     {
    107         // Create a Guzzle HTTP client
    108         $client = new \GuzzleHttp\Client();
    109 
    110         try {
    111             // Send a POST request with the encrypted file
    112             $response = $client->post($apiEndpoint, [
    113                 'multipart' => [
    114                     [
    115                         'name' => 'encrypted_file',
    116                         'contents' => fopen($encryptedFile, 'r'),
    117                         'filename' => basename($encryptedFile),
    118                     ],
    119                 ],
    120             ]);
    121 
    122             // Print the response from the API
    123             echo esc_html( $response->getBody() );
    124         } catch (\Exception $e) {
    125             // Handle exceptions
    126             echo 'Error: ' . esc_html( $e->getMessage() );
    127         }
    128     }
    129103}

  • safe-ai-malware-protection-for-wp/trunk/includes/class-store-authorized-token.php

    r3055224 r3057544  
    88    public static function store_token(string $string)
    99    {
     10
     11
     12
     13
    1014        $token = get_option('mvsp_auth_token');
    1115        if (!$token) {
    12             add_option('mvsp_auth_token', $string);
     16            // If not, add the token
     17            add_option('mvsp_auth_token', $sanitized_string);
    1318        }
    14 
     19   
     20        // Always return the stored token
    1521        return get_option('mvsp_auth_token');
    1622    }
    17 
    18     public static function set_autorized()
     23   
     24    public static function set_autorized()
    1925    {
     26
    2027        $token = get_option('mvsp_auth_token');
    21         if ($token) {
     28   
     29        // Check if the token exists and is not empty
     30        if ($token && !empty($token)) {
     31            // Add the authorized flag
    2232            add_option('mvsp_site_connected', true);
    2333        }

  • safe-ai-malware-protection-for-wp/trunk/malware-virus-scanner-plugin.php

    r3057167 r3057544  
    1717 * Plugin URI:        https://wpsafe.ai/
    1818 * Description:       WP Safe AI - Stress-Free WordPress Malware Cleaner.
    19  * Version:           1.0.2
     19 * Version:           1.0.
    2020 * Author:            BoomDevs
    2121 * Author URI:        https://boomdevs.com/
    … …  
    3434 * Rename this for your plugin and update it as you release new versions.
    3535 */
    36 define('MVSP_PLUGIN_VERSION', '1.0.2');
     36define('MVSP_PLUGIN_VERSION', '1.0.');
    3737
    3838/**
Note: See TracChangeset for help on using the changeset viewer.