function GOTMLS_init() { global $GOTMLS_onLoad, $wp_version, $wpdb, $GOTMLS_threats_found, $GOTMLS_file_contents; if (GOTMLS_user_can()) { if (!isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_what"])) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_what"] = 2; } if (!isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_depth"])) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_depth"] = -1; } if (isset($_REQUEST["scan_type"]) && $_REQUEST["scan_type"] == "Quick Scan") { if (!isset($_REQUEST["scan_what"])) { $_REQUEST["scan_what"] = 2; } if (!isset($_REQUEST["scan_depth"])) { $_REQUEST["scan_depth"] = 2; } if (!(isset($_POST["scan_only"]) && is_array($_POST["scan_only"]))) { $_POST["scan_only"] = array("", "wp-content/plugins", "wp-content/themes"); } } //$GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check_custom"] = stripslashes($_POST["check_custom"]); if (!isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check_custom"])) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check_custom"] = ""; } if (isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_level"]) && is_numeric($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_level"])) { $scan_level = intval($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_level"]); } else { $scan_level = count(explode('/', trailingslashit(get_option("siteurl")))) - 1; } if (isset($_REQUEST["dont_check"]) && is_array($_REQUEST["dont_check"]) && count($_REQUEST["dont_check"])) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["dont_check"] = $_REQUEST["dont_check"]; } elseif (isset($_POST["scan_type"]) || !(isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["dont_check"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["dont_check"]))) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["dont_check"] = array(); } if ($array = get_option('GOTMLS_definitions_array')) { if (is_array($array)) { $GLOBALS["GOTMLS"]["tmp"]["definitions_array"] = $array; } } else { $wpdb->query("DELETE FROM {$wpdb->options} WHERE `option_name` LIKE 'GOTMLS_known_%' OR `option_name` LIKE 'GOTMLS_definitions_array_%'"); array_walk($GLOBALS["GOTMLS"]["tmp"]["settings_array"], "GOTMLS_reset_settings"); } $GOTMLS_definitions_versions = array(); foreach ($GLOBALS["GOTMLS"]["tmp"]["definitions_array"] as $threat_level => $definition_names) { foreach ($definition_names as $definition_name => $definition_version) { if (is_array($definition_version) && isset($definition_version[0]) && strlen($definition_version[0]) == 5) { if (!isset($GOTMLS_definitions_versions[$threat_level]) || $definition_version[0] > $GOTMLS_definitions_versions[$threat_level]) { $GOTMLS_definitions_versions[$threat_level] = $definition_version[0]; } } } } if (isset($_POST["UPDATE_definitions_array"]) && strlen($_POST["UPDATE_definitions_array"])) { if (strlen($_POST["UPDATE_definitions_array"]) > 1) { $GOTnew_definitions = maybe_unserialize(GOTMLS_decode($_POST["UPDATE_definitions_array"])); if (is_array($GOTnew_definitions)) { $GOTMLS_onLoad .= "updates_complete('Downloaded Definitions');"; } } elseif (($DEF = GOTMLS_get_URL(GOTMLS_update_home . 'definitions.php?ver=' . GOTMLS_Version . '&wp=' . $wp_version . '&ts=' . date("YmdHis") . '&d=' . ur1encode(GOTMLS_siteurl))) && ($GOT_definitions = GOTMLS_decode($DEF)) != serialize($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]) && is_array($GOTnew_definitions = maybe_unserialize($GOT_definitions)) && count($GOTnew_definitions)) { if (!(isset($_REQUEST["check"]) && is_array($_REQUEST["check"]))) { $_REQUEST["check"] = array(); } foreach ($GOTnew_definitions as $threat_level => $definition_names) { if (!isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["{$threat_level}"]) && !(is_array($GLOBALS["GOTMLS"]["tmp"]["settings"]["check"]) && in_array("{$threat_level}", $GLOBALS["GOTMLS"]["tmp"]["settings"]["check"])) && !in_array("{$threat_level}", $_REQUEST["check"])) { $_REQUEST["check"][] = "{$threat_level}"; } } $GLOBALS["GOTMLS"]["tmp"]["definitions_array"] = $GOTnew_definitions; $GOTnew_definitions = array(); $GOTMLS_onLoad .= "updates_complete('New Definitions Automatically Installed :-)');"; } else { $GOTnew_definitions = ""; } } //elseif (file_exists(GOTMLS_plugin_path.'definitions_update.txt')) $GOTnew_definitions = maybe_unserialize(GOTMLS_decode(file_get_contents(GOTMLS_plugin_path.'definitions_update.txt'))); if (isset($GOTnew_definitions) && is_array($GOTnew_definitions)) { $GLOBALS["GOTMLS"]["tmp"]["definitions_array"] = GOTMLS_array_replace_recursive($GLOBALS["GOTMLS"]["tmp"]["definitions_array"], $GOTnew_definitions); if (file_exists(GOTMLS_plugin_path . 'definitions_update.txt')) { @unlink(GOTMLS_plugin_path . 'definitions_update.txt'); } if (isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check"])) { unset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check"]); } update_option('GOTMLS_definitions_array', $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]); foreach ($GLOBALS["GOTMLS"]["tmp"]["definitions_array"] as $threat_level => $definition_names) { foreach ($definition_names as $definition_name => $definition_version) { if (is_array($definition_version) && isset($definition_version[0]) && strlen($definition_version[0]) == 5) { if (!isset($GOTMLS_definitions_versions[$threat_level]) || $definition_version[0] > $GOTMLS_definitions_versions[$threat_level]) { $GOTMLS_definitions_versions[$threat_level] = $definition_version[0]; } } } } } asort($GOTMLS_definitions_versions); $GLOBALS["GOTMLS"]["tmp"]["Definition"]["Updates"] = '?div=Definition_Updates'; foreach ($GOTMLS_definitions_versions as $definition_name => $GLOBALS["GOTMLS"]["tmp"]["Definition"]["Latest"]) { $GLOBALS["GOTMLS"]["tmp"]["Definition"]["Updates"] .= "&ver[{$definition_name}]=" . $GLOBALS["GOTMLS"]["tmp"]["Definition"]["Latest"]; } if (isset($_REQUEST["check"]) && is_array($_REQUEST["check"])) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check"] = $_REQUEST["check"]; } /* $threat_names = array_keys($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["known"]); foreach ($threat_names as $threat_name) { if (isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["known"][$threat_name]) && is_array($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["known"][$threat_name]) && count($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["known"][$threat_name]) > 1) { if ($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["known"][$threat_name][0] > $GOTMLS_definitions_version) $GOTMLS_definitions_version = $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["known"][$threat_name][0]; if (!(count($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["dont_check"]) && in_array($threat_name, $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["dont_check"]))) { $GLOBALS["GOTMLS"]["tmp"]["threat_levels"][$threat_name] = count($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["known"][$threat_name]); if (!isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check"]) && $GLOBALS["GOTMLS"]["tmp"]["threat_levels"][$threat_name] > 2) $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check"] = "known"; } } }*/ if (!isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check"])) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["check"] = $GLOBALS["GOTMLS"]["tmp"]["threat_levels"]; update_option("GOTMLS_settings_array", $GLOBALS["GOTMLS"]["tmp"]["settings_array"]); } if (isset($_POST["GOTMLS_fix"]) && !is_array($_POST["GOTMLS_fix"])) { $_POST["GOTMLS_fix"] = array($_POST["GOTMLS_fix"]); } GOTMLS_update_scan_log(array("settings" => $GLOBALS["GOTMLS"]["tmp"]["settings_array"])); if (isset($_POST['GOTMLS_whitelist']) && isset($_POST['GOTMLS_chksum'])) { $file = GOTMLS_decode($_POST['GOTMLS_whitelist']); $chksum = explode("O", $_POST['GOTMLS_chksum'] . "O"); if (strlen($chksum[0]) == 32 && strlen($chksum[1]) == 32 && is_file($file) && md5(@file_get_contents($file)) == $chksum[0]) { $filesize = @filesize($file); if (true) { if (!isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["whitelist"][$file][0])) { $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["whitelist"][$file][0] = "A0002"; } $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["whitelist"][$file][$chksum[0] . 'O' . $filesize] = "A0002"; } else { unset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["whitelist"][$file]); } update_option("GOTMLS_definitions_array", $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]); die(GOTMLS_html_tags(array("html" => array("body" => "Added {$file} to Whitelist!<br />\n<iframe style='width: 90%; height: 350px;' src='" . GOTMLS_plugin_home . "whitelist.html?whitelist=" . $_POST['GOTMLS_whitelist'] . "&hash={$chksum['0']}&size={$filesize}&key={$chksum['1']}'></iframe>")))); } else { echo "<li>Invalid Data!</li>"; } } elseif (isset($_GET["GOTMLS_scan"])) { $file = GOTMLS_decode($_GET["GOTMLS_scan"]); if (is_dir($file)) { @error_reporting(0); @header("Content-type: text/javascript"); if (isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"])) { $GLOBALS["GOTMLS"]["tmp"]["skip_ext"] = $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"]; } @ob_start(); echo GOTMLS_scandir($file); if (@ob_get_level()) { GOTMLS_flush(); @ob_end_flush(); } die('//END OF JavaScript'); } else { if (!file_exists($file)) { die(sprintf(__("The file %s does not exist.", 'gotmls'), $file) . "<br />\n" . (file_exists(GOTMLS_quarantine($file)) ? sprintf(__("You could <a %s>try viewing the quarantined backup file</a>.", 'gotmls'), 'target="GOTMLS_iFrame" href="' . GOTMLS_script_URI . '&GOTMLS_scan=' . GOTMLS_encode(GOTMLS_quarantine($file)) . '"') : __("The file must have already been delete.", 'gotmls')) . "<script type=\"text/javascript\">\nwindow.parent.showhide('GOTMLS_iFrame', true);\n</script>"); } else { $clean_file = $file; if (GOTMLS_get_ext($file) == 'gotmls' && dirname($file) == dirname(GOTMLS_quarantine($file))) { $clean_file = 'Quarantined: ' . GOTMLS_decode(array_pop(explode(".", '.' . substr($file, strlen(dirname($file)) + 1, -7)))); $_GET["eli"] = "quarantine"; } GOTMLS_scanfile($file); $fa = ""; $function = 'GOTMLS_decode'; $decode_list = array("Base64" => '/base64_decode\\([\'"]([0-9\\+\\/\\=a-z]+)[\'"]\\)/', "Hex" => '/(\\\\x[0-9a-f]{2})/'); if (isset($_GET[$function]) && is_array($_GET[$function])) { foreach ($_GET[$function] as $decode) { if (isset($decode_list[$decode])) { $GOTMLS_file_contents = preg_replace($decode_list[$decode] . substr($GLOBALS["GOTMLS"]["tmp"]["default_ext"], 0, 2), $function . $decode . '("\\1")', $GOTMLS_file_contents); $fa .= " {$decode} decoded"; } else { $fa .= " NO-{$decode}"; } } } elseif (isset($GOTMLS_threats_found) && is_array($GOTMLS_threats_found) && count($GOTMLS_threats_found)) { $f = 1; foreach ($GOTMLS_threats_found as $threats_found => $threats_name) { $fpos = 0; $flen = 0; $potential_threat = str_replace("\r", "", $threats_found); while (($fpos = strpos(str_replace("\r", "", $GOTMLS_file_contents), $potential_threat, $flen + $fpos)) !== false) { $flen = strlen($potential_threat); $fa .= ' <a title="' . htmlspecialchars($threats_name) . '" href="javascript:select_text_range(\'ta_file\', ' . $fpos . ', ' . ($fpos + $flen) . ');">[' . $f++ . ']</a>'; } if (0 == $flen) { $fa = 'ERROR[' . $f++ . ']: Threat_size{' . strlen($potential_threat) . '} } Content_size{' . strlen(str_replace("\r", "", $GOTMLS_file_contents)) . '}'; } } } else { $fa = " No Threats Found"; } foreach ($decode_list as $decode => $regex) { if (preg_match($regex . substr($GLOBALS["GOTMLS"]["tmp"]["default_ext"], 0, 1), $GOTMLS_file_contents)) { $fa .= ' <a href="' . GOTMLS_script_URI . '&' . $function . '[]=' . $decode . '">decode[' . $decode . ']</a>'; } } die("\n" . '<script type="text/javascript"> function select_text_range(ta_id, start, end) { ta_element = document.getElementById(ta_id); ta_element.focus(); if(ta_element.setSelectionRange) ta_element.setSelectionRange(start, end); else { var r = ta_element.createTextRange(); r.collapse(true); r.moveEnd(\'character\', end); r.moveStart(\'character\', start); r.select(); } } window.parent.showhide("GOTMLS_iFrame", true); </script><table style="top: 0px; left: 0px; width: 100%; height: 100%; position: absolute;"><tr><td style="width: 100%"><form style="margin: 0;" method="post"' . (is_file($clean_file) ? ' onsubmit="return confirm(\'' . __("Are you sure this file is not infected and you want to ignore it in future scans?", 'gotmls') . '\');"><input type="hidden" name="GOTMLS_whitelist" value="' . GOTMLS_encode($clean_file) . '"><input type="hidden" name="GOTMLS_chksum" value="' . md5($GOTMLS_file_contents) . 'O' . GOTMLS_installation_key . '"><input type="submit" value="Whitelist this file" style="float: right;">' : (is_file(GOTMLS_quarantine($clean_file)) ? ' >' : '>')) . '</form><div id="fileperms" class="shadowed-box rounded-corners" style="display: none; position: absolute; left: 8px; top: 29px; background-color: #ccc; border: medium solid #C00; box-shadow: -3px 3px 3px #666; border-radius: 10px; padding: 10px;"><b>File Details</b><br />encoding: ' . mb_detect_encoding($GOTMLS_file_contents) . '<br />size: ' . strlen($GOTMLS_file_contents) . ' (' . filesize($file) . 'bytes)<br />permissions: ' . GOTMLS_fileperms($file) . '<br />modified:' . date(" Y-m-d H:i:s ", filemtime($file)) . '<br />changed:' . date(" Y-m-d H:i:s ", filectime($file)) . '</div><div style="overflow: auto;"><span onmouseover="document.getElementById(\'fileperms\').style.display=\'block\';" onmouseout="document.getElementById(\'fileperms\').style.display=\'none\';">' . __("Potential threats in file:", 'gotmls') . '</span> (' . $fa . ' )</div></td></tr><tr><td style="height: 100%"><textarea id="ta_file" style="width: 100%; height: 100%">' . htmlentities(str_replace("\r", "", $GOTMLS_file_contents)) . '</textarea></td></tr></table>'); } } } elseif (isset($_REQUEST["GOTMLS_fix"]) && is_array($_REQUEST["GOTMLS_fix"]) && isset($_REQUEST["GOTMLS_fixing"]) && $_REQUEST["GOTMLS_fixing"]) { $callAlert = "clearTimeout(callAlert);\ncallAlert=setTimeout('alert_repaired(1)', 30000);"; $li_js = "\n<script type=\"text/javascript\">\nvar callAlert;\nfunction alert_repaired(failed) {\nclearTimeout(callAlert);\nif (failed)\nfilesFailed='the rest, try again to change more.';\nwindow.parent.check_for_donation('Changed '+filesFixed+' files, failed to change '+filesFailed);\n}\n{$callAlert}\nwindow.parent.showhide('GOTMLS_iFrame', true);\nfilesFixed=0;\nfilesFailed=0;\nfunction fixedFile(file) {\n filesFixed++;\nwindow.parent.document.getElementById('list_'+file).className='GOTMLS_plugin';\nwindow.parent.document.getElementById('check_'+file).checked=false;\n }\nfunction DeletedFile(file) {\n filesFixed++;\nwindow.parent.document.getElementById('list_'+file).style.display='none';\nwindow.parent.document.getElementById('check_'+file).checked=false;\n }\nfunction failedFile(file) {\n filesFailed++;\nwindow.parent.document.getElementById('check_'+file).checked=false; \n}\n</script>\n<script type=\"text/javascript\">\n/*<!--*" . "/"; @set_time_limit($GLOBALS["GOTMLS"]["tmp"]['execution_time'] * 2); foreach ($_REQUEST["GOTMLS_fix"] as $clean_file) { $path = realpath(GOTMLS_decode($clean_file)); if (is_file($path)) { if ($_REQUEST["GOTMLS_fixing"] > 1) { echo "<li>Deleting {$path} ... "; if (GOTMLS_trailingslashit($GLOBALS["GOTMLS"]["tmp"]["quarantine_dir"]) == substr($path, 0, strlen(GOTMLS_trailingslashit($GLOBALS["GOTMLS"]["tmp"]["quarantine_dir"]))) && @unlink($path)) { echo __("Deleted!", 'gotmls'); $li_js .= "/*-->*" . "/\nDeletedFile('{$clean_file}');\n/*<!--*" . "/"; } elseif (GOTMLS_trailingslashit($GLOBALS["GOTMLS"]["tmp"]["quarantine_dir"]) == substr($path, 0, strlen(GOTMLS_trailingslashit($GLOBALS["GOTMLS"]["tmp"]["quarantine_dir"]))) && is_file(dirname($path) . "/index.php") && ($GOTMLS_file_contents = @file_get_contents(dirname($path) . "/index.php")) && strlen($GOTMLS_file_contents) > 0 && GOTMLS_file_put_contents($path, $GOTMLS_file_contents) && (@rename($path, dirname($path) . "/index.php") || GOTMLS_file_put_contents($path, "") !== false)) { echo __("Removed file contents!", 'gotmls'); $li_js .= "/*-->*" . "/\nfixedFile('{$clean_file}');\n/*<!--*" . "/"; } else { echo __("Failed to delete!", 'gotmls'); $li_js .= "/*-->*" . "/\nfailedFile('{$clean_file}');\n/*<!--*" . "/"; } } else { echo "<li>Fixing {$path} ... "; $li_js .= GOTMLS_scanfile($path); } echo "</li>\n{$li_js}/*-->*" . "/\n{$callAlert}\n</script>\n"; $li_js = "<script type=\"text/javascript\">\n/*<!--*" . "/"; } else { echo "<li>" . __("File " . htmlentities($path) . " not found!", 'gotmls') . "</li>"; } } die('<div id="check_site_warning" style="background-color: #F00;">' . sprintf(__("Because some threats were automatically fixed we need to check to make sure the removal did not break your site. If this stays Red and the frame below does not load please <a %s>revert the changes</a> made during the automated fix process.", 'gotmls'), 'target="test_frame" href="admin.php?page=GOTMLS-View-Quarantine"') . ' <span style="color: #F00;">' . __("Never mind, it worked!", 'gotmls') . '</span></div><br /><iframe id="test_frame" name="test_frame" src="' . GOTMLS_script_URI . '&check_site=1" style="width: 100%; height: 200px"></iframe>' . $li_js . "/*-->*" . "/\nalert_repaired(0);\n</script>\n"); } elseif (isset($_REQUEST["GOTMLS_fixing"])) { die("<script type=\"text/javascript\">\nwindow.parent.showhide('GOTMLS_iFrame', true);\nalert('" . __("Nothing Selected to be Changed!", 'gotmls') . "');\n</script>" . __("Done!", 'gotmls')); } if (isset($_POST["scan_level"]) && is_numeric($_POST["scan_level"])) { $scan_level = intval($_POST["scan_level"]); } if (isset($scan_level) && is_numeric($scan_level)) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_level"] = intval($scan_level); } else { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["scan_level"] = count(explode('/', trailingslashit(get_option("siteurl")))) - 1; } $GLOBALS["GOTMLS_msg"] = __("Default position", 'gotmls'); $properties = array("body" => 'style="margin: 0; padding: 0;"'); if (isset($_GET["GOTMLS_msg"]) && $_GET["GOTMLS_msg"] == $GLOBALS["GOTMLS_msg"]) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"] = $GLOBALS["GOTMLS"]["tmp"]["default"]["msg_position"]; $gl = '><'; $properties["html"] = $gl . 'head' . $gl . 'script type="text/javascript"> if (curDiv = window.parent.document.getElementById("div_file")) { curDiv.style.left = "' . $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"][0] . '"; curDiv.style.top = "' . $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"][1] . '"; curDiv.style.height = "' . $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"][2] . '"; curDiv.style.width = "' . $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"][3] . '"; } </script' . $gl . '/head'; } elseif (isset($_GET["GOTMLS_x"]) || isset($_GET["GOTMLS_y"]) || isset($_GET["GOTMLS_h"]) || isset($_GET["GOTMLS_w"])) { if (isset($_GET["GOTMLS_x"])) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"][0] = $_GET["GOTMLS_x"]; } if (isset($_GET["GOTMLS_y"])) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"][1] = $_GET["GOTMLS_y"]; } if (isset($_GET["GOTMLS_h"])) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"][2] = $_GET["GOTMLS_h"]; } if (isset($_GET["GOTMLS_w"])) { $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"][3] = $_GET["GOTMLS_w"]; } $_GET["GOTMLS_msg"] = __("New position", 'gotmls'); } update_option("GOTMLS_settings_array", $GLOBALS["GOTMLS"]["tmp"]["settings_array"]); if (isset($_GET["GOTMLS_msg"])) { die(GOTMLS_html_tags(array("html" => array("body" => htmlentities($_GET["GOTMLS_msg"]) . ' ' . __("saved.", 'gotmls') . (implode($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["msg_position"]) == implode($GLOBALS["GOTMLS"]["tmp"]["default"]["msg_position"]) ? "" : ' <a href="' . GOTMLS_script_URI . '&GOTMLS_msg=' . urlencode($GLOBALS["GOTMLS_msg"]) . '">[' . $GLOBALS["GOTMLS_msg"] . ']</a>'))), $properties)); } } }
function GOTMLS_scandir($dir) { echo "/*<!--*" . "/" . GOTMLS_update_status(sprintf(__("Scanning %s", 'gotmls'), str_replace(dirname($GLOBALS["GOTMLS"]["log"]["scan"]["dir"]), "...", $dir))); GOTMLS_flush(); $li_js = "/*-->*" . "/\nscanNextDir(-1);\n/*<!--*" . "/"; if (isset($_GET["GOTMLS_skip_dir"]) && $dir == GOTMLS_decode($_GET["GOTMLS_skip_dir"])) { if (isset($_GET["GOTMLS_only_file"]) && strlen($_GET["GOTMLS_only_file"])) { echo GOTMLS_return_threat("errors", "blocked", GOTMLS_trailingslashit($dir) . GOTMLS_decode($_GET["GOTMLS_only_file"]), GOTMLS_error_link("Failed to read this file!" . GOTMLS_read_error(GOTMLS_trailingslashit($dir) . GOTMLS_decode($_GET["GOTMLS_only_file"])), GOTMLS_trailingslashit($dir) . GOTMLS_decode($_GET["GOTMLS_only_file"]))); } else { echo GOTMLS_return_threat("errors", "blocked", $dir, GOTMLS_error_link(__("Failed to read directory!", 'gotmls')) . GOTMLS_read_error($dir)); } } else { $files = GOTMLS_getfiles($dir); if (is_array($files)) { if (isset($_GET["GOTMLS_only_file"])) { if (strlen($_GET["GOTMLS_only_file"])) { $path = GOTMLS_trailingslashit($dir) . GOTMLS_decode($_GET["GOTMLS_only_file"]); if (is_file($path)) { GOTMLS_check_file($path); echo GOTMLS_return_threat("dir", "checked", $path); } } else { foreach ($files as $file) { $path = GOTMLS_trailingslashit($dir) . $file; if (is_file($path)) { $file_ext = GOTMLS_get_ext($file); $filesize = @filesize($path); if (in_array($file_ext, $GLOBALS["GOTMLS"]["tmp"]["skip_ext"]) && !preg_match('/social[0-9]*\\.png$/i', $file) || $filesize == 0 || $filesize > (isset($_GET["eli"]) && is_numeric($_GET["eli"]) ? $_GET["eli"] : 1234567)) { echo GOTMLS_return_threat("skipped", "blocked", $path, GOTMLS_error_link(sprintf(__('Skipped because of file size (%1$s bytes) or file extention (%2$s)!', 'gotmls'), $filesize, $file_ext), $file, "potential")); } else { echo "/*-->*" . "/\nscanfilesArKeys.push('" . GOTMLS_encode($dir) . "&GOTMLS_only_file=" . GOTMLS_encode($file) . "');\nscanfilesArNames.push('Re-Checking " . GOTMLS_strip4java($path) . "');\n/*<!--*" . "/" . GOTMLS_return_threat("dirs", "wait", $path); } } } echo GOTMLS_return_threat("dir", "question", $dir); } } else { foreach ($files as $file) { $path = GOTMLS_trailingslashit($dir) . $file; if (is_file($path)) { if (isset($_GET["GOTMLS_skip_file"]) && is_array($_GET["GOTMLS_skip_file"]) && in_array($path, $_GET["GOTMLS_skip_file"])) { $li_js .= "/*-->*" . "/\n//skipped {$path};\n/*<!--*" . "/"; if ($path == $_GET["GOTMLS_skip_file"][count($_GET["GOTMLS_skip_file"]) - 1]) { echo GOTMLS_return_threat("errors", "blocked", $path, GOTMLS_error_link(__("Failed to read file!", 'gotmls'), $path)); } } else { GOTMLS_check_file($path); } } } echo GOTMLS_return_threat("dir", "checked", $dir); } } else { echo GOTMLS_return_threat("errors", "blocked", $dir, GOTMLS_error_link(GOTMLS_Failed_to_list_LANGUAGE . ' scandir:' . ($files === false ? ' (FALSE)' : $files))); } } echo GOTMLS_update_status(sprintf(__("Scanned %s", 'gotmls'), str_replace(dirname($GLOBALS["GOTMLS"]["log"]["scan"]["dir"]), "...", $dir))); GOTMLS_update_scan_log(array("scan" => array("finish" => time()))); return $li_js; }
function GOTMLS_ajax_scan() { if (GOTMLS_get_nonce()) { @error_reporting(0); if (isset($_GET["GOTMLS_scan"])) { @set_time_limit($GLOBALS["GOTMLS"]["tmp"]['execution_time'] - 5); $decode_list = array("Base64" => '/base64_decode\\([\'"]([0-9\\+\\/\\=a-z]+)[\'"]\\)/', "Hex" => '/(\\\\(x[0-9a-f]{2}|[0-9]{1,3}))/'); if (is_numeric($_GET["GOTMLS_scan"])) { if (($Q_post = GOTMLS_get_quarantine($_GET["GOTMLS_scan"])) && isset($Q_post["post_type"]) && $Q_post["post_type"] == "GOTMLS_quarantine" && isset($Q_post["post_status"]) && $Q_post["post_status"] == "private") { $clean_file = $Q_post["post_title"]; $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = GOTMLS_decode($Q_post["post_content"]); $fa = ""; $function = 'GOTMLS_decode'; if (isset($_GET[$function]) && is_array($_GET[$function])) { foreach ($_GET[$function] as $decode) { if (isset($decode_list[$decode])) { $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = preg_replace($decode_list[$decode] . substr($GLOBALS["GOTMLS"]["tmp"]["default_ext"], 0, 2), $function . $decode . '("\\1")', $GLOBALS["GOTMLS"]["tmp"]["file_contents"]); $fa .= " {$decode} decoded"; } else { $fa .= " NO-{$decode}"; } } } elseif (isset($Q_post["post_excerpt"]) && strlen($Q_post["post_excerpt"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["threats_found"] = @maybe_unserialize(GOTMLS_decode($Q_post["post_excerpt"])))) { $f = 1; //print_r(array("excerpt:"=>$GLOBALS["GOTMLS"]["tmp"]["threats_found"])); foreach ($GLOBALS["GOTMLS"]["tmp"]["threats_found"] as $threats_found => $threats_name) { list($start, $end, $junk) = explode("-", "{$threats_found}--", 3); if (strlen($end) > 0 && is_numeric($start) && is_numeric($end)) { if ($start < $end) { $fa .= ' <a title="' . htmlspecialchars($threats_name) . '" href="javascript:select_text_range(\'ta_file\', ' . $start . ', ' . $end . ');">[' . $f++ . ']</a>'; } else { $fa .= ' <a title="' . htmlspecialchars($threats_name) . '" href="javascript:select_text_range(\'ta_file\', ' . $end . ', ' . $start . ');">[' . $f++ . ']</a>'; } } else { if (is_numeric($threats_found)) { $threats_found = $threats_name; $threats_name = $f; } $fpos = 0; $flen = 0; $potential_threat = str_replace("\r", "", $threats_found); while (($fpos = strpos(str_replace("\r", "", $GLOBALS["GOTMLS"]["tmp"]["file_contents"]), $potential_threat, $flen + $fpos)) !== false) { $flen = strlen($potential_threat); $fa .= ' <a title="' . htmlspecialchars($threats_name) . '" href="javascript:select_text_range(\'ta_file\', ' . $fpos . ', ' . ($fpos + $flen) . ');">[' . $f++ . ']</a>'; } } } } //else echo "excerpt:".$Q_post["post_excerpt"]; foreach ($decode_list as $decode => $regex) { if (preg_match($regex . substr($GLOBALS["GOTMLS"]["tmp"]["default_ext"], 0, 1), $GLOBALS["GOTMLS"]["tmp"]["file_contents"])) { $fa .= ' <a href="' . GOTMLS_script_URI . '&' . $function . '[]=' . $decode . '">decode[' . $decode . ']</a>'; } } die("\n" . '<script type="text/javascript"> function select_text_range(ta_id, start, end) { ta_element = document.getElementById(ta_id); ta_element.focus(); if(ta_element.setSelectionRange) ta_element.setSelectionRange(start, end); else { var r = ta_element.createTextRange(); r.collapse(true); r.moveEnd(\'character\', end); r.moveStart(\'character\', start); r.select(); } } window.parent.showhide("GOTMLS_iFrame", true); </script><table style="top: 0px; left: 0px; width: 100%; height: 100%; position: absolute;"><tr><td style="width: 100%"><form style="margin: 0;" method="post" action="' . admin_url('admin-ajax.php?' . GOTMLS_set_nonce(__FUNCTION__ . "1522")) . '" onsubmit="return confirm(\'' . __("Are you sure you want to delete this file from the quarantine?", 'gotmls') . '\');"><input type="hidden" name="GOTMLS_fix[]" value="' . $Q_post["ID"] . '"><input type="hidden" name="GOTMLS_fixing" value="2"><input type="hidden" name="action" value="GOTMLS_fix"><input type="submit" value="DELETE from Quarantine" style="background-color: #C00; float: right;"></form><div id="fileperms" class="shadowed-box rounded-corners" style="display: none; position: absolute; left: 8px; top: 29px; background-color: #ccc; border: medium solid #C00; box-shadow: -3px 3px 3px #666; border-radius: 10px; padding: 10px;"><b>File Details</b><br />encoding: ' . (function_exists("mb_detect_encoding") ? mb_detect_encoding($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) : "Unknown") . '<br />size: ' . strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) . ' bytes<br />infected:' . $Q_post["post_modified_gmt"] . '<br />quarantined:' . $Q_post["post_date_gmt"] . '</div><div style="overflow: auto;"><span onmouseover="document.getElementById(\'fileperms\').style.display=\'block\';" onmouseout="document.getElementById(\'fileperms\').style.display=\'none\';">' . __("File Details:", 'gotmls') . '</span> (' . $fa . ' )</div></td></tr><tr><td style="height: 100%"><textarea id="ta_file" style="width: 100%; height: 100%">' . htmlentities(str_replace("\r", "", $GLOBALS["GOTMLS"]["tmp"]["file_contents"])) . '</textarea></td></tr></table>'); } else { die(GOTMLS_html_tags(array("html" => array("body" => __("This file no longer exists in the quarantine.", 'gotmls') . "<br />\n<script type=\"text/javascript\">\nwindow.parent.showhide('GOTMLS_iFrame', true);\n</script>")))); } } else { $file = GOTMLS_decode($_GET["GOTMLS_scan"]); if (is_dir($file)) { @error_reporting(0); @header("Content-type: text/javascript"); if (isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"])) { $GLOBALS["GOTMLS"]["tmp"]["skip_ext"] = $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"]; } @ob_start(); echo GOTMLS_scandir($file); if (@ob_get_level()) { GOTMLS_flush(); @ob_end_flush(); } die('//END OF JavaScript'); } else { if (!file_exists($file)) { die(GOTMLS_html_tags(array("html" => array("body" => sprintf(__("The file %s does not exist, it must have already been deleted.", 'gotmls'), $file) . "<script type=\"text/javascript\">\nwindow.parent.showhide('GOTMLS_iFrame', true);\n</script>")))); } else { GOTMLS_scanfile($file); $fa = ""; $function = 'GOTMLS_decode'; if (isset($_GET[$function]) && is_array($_GET[$function])) { foreach ($_GET[$function] as $decode) { if (isset($decode_list[$decode])) { $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = preg_replace($decode_list[$decode] . substr($GLOBALS["GOTMLS"]["tmp"]["default_ext"], 0, 2), $function . $decode . '("\\1")', $GLOBALS["GOTMLS"]["tmp"]["file_contents"]); $fa .= " {$decode} decoded"; } else { $fa .= " NO-{$decode}"; } } } elseif (isset($GLOBALS["GOTMLS"]["tmp"]["threats_found"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["threats_found"]) && count($GLOBALS["GOTMLS"]["tmp"]["threats_found"])) { $f = 1; foreach ($GLOBALS["GOTMLS"]["tmp"]["threats_found"] as $threats_found => $threats_name) { list($start, $end, $junk) = explode("-", "{$threats_found}--", 3); if ($start > $end) { $fa .= 'ERROR[' . $f++ . ']: Threat_size{' . $threats_found . '} Content_size{' . strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) . '}'; } else { $fa .= ' <a title="' . htmlspecialchars($threats_name) . '" href="javascript:select_text_range(\'ta_file\', ' . $start . ', ' . $end . ');">[' . $f++ . ']</a>'; } } } else { $fa = " No Threats Found"; } foreach ($decode_list as $decode => $regex) { if (preg_match($regex . substr($GLOBALS["GOTMLS"]["tmp"]["default_ext"], 0, 1), $GLOBALS["GOTMLS"]["tmp"]["file_contents"])) { $fa .= ' <a href="' . GOTMLS_script_URI . '&' . $function . '[]=' . $decode . '">decode[' . $decode . ']</a>'; } } die("\n" . '<script type="text/javascript"> function select_text_range(ta_id, start, end) { ta_element = document.getElementById(ta_id); ta_element.focus(); if(ta_element.setSelectionRange) ta_element.setSelectionRange(start, end); else { var r = ta_element.createTextRange(); r.collapse(true); r.moveEnd(\'character\', end); r.moveStart(\'character\', start); r.select(); } } window.parent.showhide("GOTMLS_iFrame", true); </script><table style="top: 0px; left: 0px; width: 100%; height: 100%; position: absolute;"><tr><td style="width: 100%"><form style="margin: 0;" method="post" action="' . admin_url('admin-ajax.php?' . GOTMLS_set_nonce(__FUNCTION__ . "1583")) . '" onsubmit="return confirm(\'' . __("Are you sure this file is not infected and you want to ignore it in future scans?", 'gotmls') . '\');"><input type="hidden" name="GOTMLS_whitelist" value="' . GOTMLS_encode($file) . '"><input type="hidden" name="action" value="GOTMLS_whitelist"><input type="hidden" name="GOTMLS_chksum" value="' . md5($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) . 'O' . GOTMLS_installation_key . '"><input type="submit" value="Whitelist this file" style="float: right;"></form><div id="fileperms" class="shadowed-box rounded-corners" style="display: none; position: absolute; left: 8px; top: 29px; background-color: #ccc; border: medium solid #C00; box-shadow: -3px 3px 3px #666; border-radius: 10px; padding: 10px;"><b>File Details</b><br />encoding: ' . (function_exists("mb_detect_encoding") ? mb_detect_encoding($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) : "Unknown") . '<br />size: ' . strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) . ' (' . filesize($file) . 'bytes)<br />permissions: ' . GOTMLS_fileperms($file) . '<br />modified:' . date(" Y-m-d H:i:s ", filemtime($file)) . '<br />changed:' . date(" Y-m-d H:i:s ", filectime($file)) . '</div><div style="overflow: auto;"><span onmouseover="document.getElementById(\'fileperms\').style.display=\'block\';" onmouseout="document.getElementById(\'fileperms\').style.display=\'none\';">' . __("Potential threats in file:", 'gotmls') . '</span> (' . $fa . ' )</div></td></tr><tr><td style="height: 100%"><textarea id="ta_file" style="width: 100%; height: 100%">' . htmlentities(str_replace("\r", "", $GLOBALS["GOTMLS"]["tmp"]["file_contents"])) . '</textarea></td></tr></table>'); } } } } else { die("\n//Directory Error: Nothing to scan!\n"); } } else { if (isset($_GET["GOTMLS_scan"]) && is_dir(GOTMLS_decode($_GET["GOTMLS_scan"]))) { @header("Content-type: text/javascript"); } die(GOTMLS_Invalid_Nonce("\n//Ajax Scan Error: ") . "\n"); } }