Пример #1
0
function GOTMLS_ajax_scan()
{
    if (GOTMLS_get_nonce()) {
        @error_reporting(0);
        if (isset($_GET["GOTMLS_scan"])) {
            @set_time_limit($GLOBALS["GOTMLS"]["tmp"]['execution_time'] - 5);
            $decode_list = array("Base64" => '/base64_decode\\([\'"]([0-9\\+\\/\\=a-z]+)[\'"]\\)/', "Hex" => '/(\\\\(x[0-9a-f]{2}|[0-9]{1,3}))/');
            if (is_numeric($_GET["GOTMLS_scan"])) {
                if (($Q_post = GOTMLS_get_quarantine($_GET["GOTMLS_scan"])) && isset($Q_post["post_type"]) && $Q_post["post_type"] == "GOTMLS_quarantine" && isset($Q_post["post_status"]) && $Q_post["post_status"] == "private") {
                    $clean_file = $Q_post["post_title"];
                    $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = GOTMLS_decode($Q_post["post_content"]);
                    $fa = "";
                    $function = 'GOTMLS_decode';
                    if (isset($_GET[$function]) && is_array($_GET[$function])) {
                        foreach ($_GET[$function] as $decode) {
                            if (isset($decode_list[$decode])) {
                                $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = preg_replace($decode_list[$decode] . substr($GLOBALS["GOTMLS"]["tmp"]["default_ext"], 0, 2), $function . $decode . '("\\1")', $GLOBALS["GOTMLS"]["tmp"]["file_contents"]);
                                $fa .= " {$decode} decoded";
                            } else {
                                $fa .= " NO-{$decode}";
                            }
                        }
                    } elseif (isset($Q_post["post_excerpt"]) && strlen($Q_post["post_excerpt"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["threats_found"] = @maybe_unserialize(GOTMLS_decode($Q_post["post_excerpt"])))) {
                        $f = 1;
                        //print_r(array("excerpt:"=>$GLOBALS["GOTMLS"]["tmp"]["threats_found"]));
                        foreach ($GLOBALS["GOTMLS"]["tmp"]["threats_found"] as $threats_found => $threats_name) {
                            list($start, $end, $junk) = explode("-", "{$threats_found}--", 3);
                            if (strlen($end) > 0 && is_numeric($start) && is_numeric($end)) {
                                if ($start < $end) {
                                    $fa .= ' <a title="' . htmlspecialchars($threats_name) . '" href="javascript:select_text_range(\'ta_file\', ' . $start . ', ' . $end . ');">[' . $f++ . ']</a>';
                                } else {
                                    $fa .= ' <a title="' . htmlspecialchars($threats_name) . '" href="javascript:select_text_range(\'ta_file\', ' . $end . ', ' . $start . ');">[' . $f++ . ']</a>';
                                }
                            } else {
                                if (is_numeric($threats_found)) {
                                    $threats_found = $threats_name;
                                    $threats_name = $f;
                                }
                                $fpos = 0;
                                $flen = 0;
                                $potential_threat = str_replace("\r", "", $threats_found);
                                while (($fpos = strpos(str_replace("\r", "", $GLOBALS["GOTMLS"]["tmp"]["file_contents"]), $potential_threat, $flen + $fpos)) !== false) {
                                    $flen = strlen($potential_threat);
                                    $fa .= ' <a title="' . htmlspecialchars($threats_name) . '" href="javascript:select_text_range(\'ta_file\', ' . $fpos . ', ' . ($fpos + $flen) . ');">[' . $f++ . ']</a>';
                                }
                            }
                        }
                    }
                    //else echo "excerpt:".$Q_post["post_excerpt"];
                    foreach ($decode_list as $decode => $regex) {
                        if (preg_match($regex . substr($GLOBALS["GOTMLS"]["tmp"]["default_ext"], 0, 1), $GLOBALS["GOTMLS"]["tmp"]["file_contents"])) {
                            $fa .= ' <a href="' . GOTMLS_script_URI . '&' . $function . '[]=' . $decode . '">decode[' . $decode . ']</a>';
                        }
                    }
                    die("\n" . '<script type="text/javascript">
		function select_text_range(ta_id, start, end) {
		ta_element = document.getElementById(ta_id);
		ta_element.focus();
		if(ta_element.setSelectionRange)
		   ta_element.setSelectionRange(start, end);
		else {
		   var r = ta_element.createTextRange();
		   r.collapse(true);
		   r.moveEnd(\'character\', end);
		   r.moveStart(\'character\', start);
		   r.select();   
		}
		}
		window.parent.showhide("GOTMLS_iFrame", true);
		</script><table style="top: 0px; left: 0px; width: 100%; height: 100%; position: absolute;"><tr><td style="width: 100%"><form style="margin: 0;" method="post" action="' . admin_url('admin-ajax.php?' . GOTMLS_set_nonce(__FUNCTION__ . "1522")) . '" onsubmit="return confirm(\'' . __("Are you sure you want to delete this file from the quarantine?", 'gotmls') . '\');"><input type="hidden" name="GOTMLS_fix[]" value="' . $Q_post["ID"] . '"><input type="hidden" name="GOTMLS_fixing" value="2"><input type="hidden" name="action" value="GOTMLS_fix"><input type="submit" value="DELETE from Quarantine" style="background-color: #C00; float: right;"></form><div id="fileperms" class="shadowed-box rounded-corners" style="display: none; position: absolute; left: 8px; top: 29px; background-color: #ccc; border: medium solid #C00; box-shadow: -3px 3px 3px #666; border-radius: 10px; padding: 10px;"><b>File Details</b><br />encoding: ' . (function_exists("mb_detect_encoding") ? mb_detect_encoding($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) : "Unknown") . '<br />size: ' . strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) . ' bytes<br />infected:' . $Q_post["post_modified_gmt"] . '<br />quarantined:' . $Q_post["post_date_gmt"] . '</div><div style="overflow: auto;"><span onmouseover="document.getElementById(\'fileperms\').style.display=\'block\';" onmouseout="document.getElementById(\'fileperms\').style.display=\'none\';">' . __("File Details:", 'gotmls') . '</span> (' . $fa . ' )</div></td></tr><tr><td style="height: 100%"><textarea id="ta_file" style="width: 100%; height: 100%">' . htmlentities(str_replace("\r", "", $GLOBALS["GOTMLS"]["tmp"]["file_contents"])) . '</textarea></td></tr></table>');
                } else {
                    die(GOTMLS_html_tags(array("html" => array("body" => __("This file no longer exists in the quarantine.", 'gotmls') . "<br />\n<script type=\"text/javascript\">\nwindow.parent.showhide('GOTMLS_iFrame', true);\n</script>"))));
                }
            } else {
                $file = GOTMLS_decode($_GET["GOTMLS_scan"]);
                if (is_dir($file)) {
                    @error_reporting(0);
                    @header("Content-type: text/javascript");
                    if (isset($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"])) {
                        $GLOBALS["GOTMLS"]["tmp"]["skip_ext"] = $GLOBALS["GOTMLS"]["tmp"]["settings_array"]["exclude_ext"];
                    }
                    @ob_start();
                    echo GOTMLS_scandir($file);
                    if (@ob_get_level()) {
                        GOTMLS_flush();
                        @ob_end_flush();
                    }
                    die('//END OF JavaScript');
                } else {
                    if (!file_exists($file)) {
                        die(GOTMLS_html_tags(array("html" => array("body" => sprintf(__("The file %s does not exist, it must have already been deleted.", 'gotmls'), $file) . "<script type=\"text/javascript\">\nwindow.parent.showhide('GOTMLS_iFrame', true);\n</script>"))));
                    } else {
                        GOTMLS_scanfile($file);
                        $fa = "";
                        $function = 'GOTMLS_decode';
                        if (isset($_GET[$function]) && is_array($_GET[$function])) {
                            foreach ($_GET[$function] as $decode) {
                                if (isset($decode_list[$decode])) {
                                    $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = preg_replace($decode_list[$decode] . substr($GLOBALS["GOTMLS"]["tmp"]["default_ext"], 0, 2), $function . $decode . '("\\1")', $GLOBALS["GOTMLS"]["tmp"]["file_contents"]);
                                    $fa .= " {$decode} decoded";
                                } else {
                                    $fa .= " NO-{$decode}";
                                }
                            }
                        } elseif (isset($GLOBALS["GOTMLS"]["tmp"]["threats_found"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["threats_found"]) && count($GLOBALS["GOTMLS"]["tmp"]["threats_found"])) {
                            $f = 1;
                            foreach ($GLOBALS["GOTMLS"]["tmp"]["threats_found"] as $threats_found => $threats_name) {
                                list($start, $end, $junk) = explode("-", "{$threats_found}--", 3);
                                if ($start > $end) {
                                    $fa .= 'ERROR[' . $f++ . ']: Threat_size{' . $threats_found . '} Content_size{' . strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) . '}';
                                } else {
                                    $fa .= ' <a title="' . htmlspecialchars($threats_name) . '" href="javascript:select_text_range(\'ta_file\', ' . $start . ', ' . $end . ');">[' . $f++ . ']</a>';
                                }
                            }
                        } else {
                            $fa = " No Threats Found";
                        }
                        foreach ($decode_list as $decode => $regex) {
                            if (preg_match($regex . substr($GLOBALS["GOTMLS"]["tmp"]["default_ext"], 0, 1), $GLOBALS["GOTMLS"]["tmp"]["file_contents"])) {
                                $fa .= ' <a href="' . GOTMLS_script_URI . '&' . $function . '[]=' . $decode . '">decode[' . $decode . ']</a>';
                            }
                        }
                        die("\n" . '<script type="text/javascript">
		function select_text_range(ta_id, start, end) {
			ta_element = document.getElementById(ta_id);
			ta_element.focus();
			if(ta_element.setSelectionRange)
			   ta_element.setSelectionRange(start, end);
			else {
			   var r = ta_element.createTextRange();
			   r.collapse(true);
			   r.moveEnd(\'character\', end);
			   r.moveStart(\'character\', start);
			   r.select();   
			}
		}
		window.parent.showhide("GOTMLS_iFrame", true);
		</script><table style="top: 0px; left: 0px; width: 100%; height: 100%; position: absolute;"><tr><td style="width: 100%"><form style="margin: 0;" method="post" action="' . admin_url('admin-ajax.php?' . GOTMLS_set_nonce(__FUNCTION__ . "1583")) . '" onsubmit="return confirm(\'' . __("Are you sure this file is not infected and you want to ignore it in future scans?", 'gotmls') . '\');"><input type="hidden" name="GOTMLS_whitelist" value="' . GOTMLS_encode($file) . '"><input type="hidden" name="action" value="GOTMLS_whitelist"><input type="hidden" name="GOTMLS_chksum" value="' . md5($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) . 'O' . GOTMLS_installation_key . '"><input type="submit" value="Whitelist this file" style="float: right;"></form><div id="fileperms" class="shadowed-box rounded-corners" style="display: none; position: absolute; left: 8px; top: 29px; background-color: #ccc; border: medium solid #C00; box-shadow: -3px 3px 3px #666; border-radius: 10px; padding: 10px;"><b>File Details</b><br />encoding: ' . (function_exists("mb_detect_encoding") ? mb_detect_encoding($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) : "Unknown") . '<br />size: ' . strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) . ' (' . filesize($file) . 'bytes)<br />permissions: ' . GOTMLS_fileperms($file) . '<br />modified:' . date(" Y-m-d H:i:s ", filemtime($file)) . '<br />changed:' . date(" Y-m-d H:i:s ", filectime($file)) . '</div><div style="overflow: auto;"><span onmouseover="document.getElementById(\'fileperms\').style.display=\'block\';" onmouseout="document.getElementById(\'fileperms\').style.display=\'none\';">' . __("Potential threats in file:", 'gotmls') . '</span> (' . $fa . ' )</div></td></tr><tr><td style="height: 100%"><textarea id="ta_file" style="width: 100%; height: 100%">' . htmlentities(str_replace("\r", "", $GLOBALS["GOTMLS"]["tmp"]["file_contents"])) . '</textarea></td></tr></table>');
                    }
                }
            }
        } else {
            die("\n//Directory Error: Nothing to scan!\n");
        }
    } else {
        if (isset($_GET["GOTMLS_scan"]) && is_dir(GOTMLS_decode($_GET["GOTMLS_scan"]))) {
            @header("Content-type: text/javascript");
        }
        die(GOTMLS_Invalid_Nonce("\n//Ajax Scan Error: ") . "\n");
    }
}
Пример #2
0
function GOTMLS_scanfile($file)
{
    global $wp_version, $wpdb, $GOTMLS_chmod_file, $GOTMLS_chmod_dir;
    $GLOBALS["GOTMLS"]["tmp"]["threats_found"] = array();
    $gt = ">";
    $lt = "<";
    $found = false;
    $threat_link = "";
    $className = "scanned";
    $clean_file = GOTMLS_encode($file);
    $file_name = GOTMLS_explode_dir($file);
    $file_parts = explode(".", "." . array_pop($file_name));
    if (is_file($file) && ($filesize = filesize($file)) && ($GLOBALS["GOTMLS"]["tmp"]["file_contents"] = @file_get_contents($file))) {
        if (isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"]["{$wp_version}"]) && is_array($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"]["{$wp_version}"])) {
            $whitelist = array_flip($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"]["{$wp_version}"]);
        } else {
            $whitelist = array();
        }
        foreach ($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["whitelist"] as $whitelist_file => $non_threats) {
            if (is_array($non_threats) && count($non_threats) > 1) {
                if (isset($non_threats[0])) {
                    unset($non_threats[0]);
                }
                $whitelist = array_merge($whitelist, $non_threats);
            }
        }
        if (isset($whitelist[md5($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) . 'O' . $filesize])) {
            return GOTMLS_return_threat($className, "checked.gif?{$className}", $file, $threat_link);
        }
        $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = $GLOBALS["GOTMLS"]["tmp"]["file_contents"];
        if (isset($GLOBALS["GOTMLS"]["log"]["settings"]["check_custom"]) && strlen($GLOBALS["GOTMLS"]["log"]["settings"]["check_custom"]) && isset($_GET['eli']) && substr($GLOBALS["GOTMLS"]["log"]["settings"]["check_custom"], 0, 1) == '/' && ($found = GOTMLS_check_threat($GLOBALS["GOTMLS"]["log"]["settings"]["check_custom"]))) {
            $className = "known";
        } else {
            $path = str_replace("//", "/", "/" . str_replace("\\", "/", substr($file, strlen(ABSPATH))));
            if (isset($_SESSION["GOTMLS_debug"])) {
                $_SESSION["GOTMLS_debug"]["file"] = $file;
                $_SESSION["GOTMLS_debug"]["last"]["total"] = microtime(true);
            }
            foreach ($GLOBALS["GOTMLS"]["tmp"]["threat_levels"] as $threat_level) {
                if (isset($_SESSION["GOTMLS_debug"])) {
                    $_SESSION["GOTMLS_debug"]["threat_level"] = $threat_level;
                    $_SESSION["GOTMLS_debug"]["last"]["threat_level"] = microtime(true);
                }
                if (in_array($threat_level, $GLOBALS["GOTMLS"]["log"]["settings"]["check"]) && !$found && isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"][$threat_level]) && ($threat_level != "wp_core" || substr($file, 0, strlen(ABSPATH)) == ABSPATH && isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"]["{$wp_version}"]["{$path}"])) && (!array_key_exists($threat_level, $GLOBALS["GOTMLS"]["tmp"]["threat_files"]) || substr($file . "e", -1 * strlen($GLOBALS["GOTMLS"]["tmp"]["threat_files"][$threat_level] . "e")) == $GLOBALS["GOTMLS"]["tmp"]["threat_files"][$threat_level] . "e") && ($found = GOTMLS_check_threat($GLOBALS["GOTMLS"]["tmp"]["definitions_array"][$threat_level], $file))) {
                    $className = $threat_level;
                }
            }
            if (isset($_SESSION["GOTMLS_debug"])) {
                $file_time = round(microtime(true) - $_SESSION["GOTMLS_debug"]["last"]["total"], 5);
                if (isset($_SESSION["GOTMLS_debug"]["total"]["total"])) {
                    $_SESSION["GOTMLS_debug"]["total"]["total"] += $file_time;
                } else {
                    $_SESSION["GOTMLS_debug"]["total"]["total"] = $file_time;
                }
                if (isset($_SESSION["GOTMLS_debug"]["total"]["count"])) {
                    $_SESSION["GOTMLS_debug"]["total"]["count"]++;
                } else {
                    $_SESSION["GOTMLS_debug"]["total"]["count"] = 1;
                }
                if (!isset($_SESSION["GOTMLS_debug"]["total"]["least"]) || $file_time < $_SESSION["GOTMLS_debug"]["total"]["least"]) {
                    $_SESSION["GOTMLS_debug"]["total"]["least"] = $file_time;
                }
                if (!isset($_SESSION["GOTMLS_debug"]["total"]["most"]) || $file_time > $_SESSION["GOTMLS_debug"]["total"]["most"]) {
                    $_SESSION["GOTMLS_debug"]["total"]["most"] = $file_time;
                }
            }
        }
    } else {
        $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = is_file($file) ? is_readable($file) ? filesize($file) ? __("Failed to read file contents!", 'gotmls') : __("Empty file!", 'gotmls') : (isset($_GET["eli"]) ? @chmod($file, $GOTMLS_chmod_file) ? __("Fixed file permissions! (try again)", 'gotmls') : __("File permissions read-only!", 'gotmls') : __("File not readable!", 'gotmls')) : __("File does not exist!", 'gotmls');
        //		$threat_link = GOTMLS_error_link($GLOBALS["GOTMLS"]["tmp"]["file_contents"], $file);
        $className = "errors";
    }
    if (count($GLOBALS["GOTMLS"]["tmp"]["threats_found"])) {
        $threat_link = $lt . 'a target="GOTMLS_iFrame" href="' . admin_url('admin-ajax.php?action=GOTMLS_scan&' . GOTMLS_set_nonce(__FUNCTION__ . "431") . '&mt=' . $GLOBALS["GOTMLS"]["tmp"]["mt"] . '&GOTMLS_scan=' . $clean_file . preg_replace('/\\&(GOTMLS_scan|mt|GOTMLS_mt|action)=/', '&last_\\1=', isset($_SERVER["QUERY_STRING"]) && strlen($_SERVER["QUERY_STRING"]) ? "&" . $_SERVER["QUERY_STRING"] : "")) . '" id="list_' . $clean_file . '" onclick="loadIframe(\'' . str_replace("\"", "&quot;", $lt . 'div style="float: left; white-space: nowrap;"' . $gt . __("Examine File", 'gotmls') . ' ... ' . $lt . '/div' . $gt . $lt . 'div style="overflow: hidden; position: relative; height: 20px;"' . $gt . $lt . 'div style="position: absolute; right: 0px; text-align: right; width: 9000px;"' . $gt . htmlspecialchars(GOTMLS_strip4java($file), ENT_NOQUOTES)) . $lt . '/div' . $gt . $lt . '/div' . $gt . '\');" class="GOTMLS_plugin"' . $gt;
        if ($className == "errors") {
            $threat_link = GOTMLS_error_link($GLOBALS["GOTMLS"]["tmp"]["file_contents"], $file);
            $imageFile = "/blocked";
        } elseif ($className != "potential") {
            if (isset($_POST["GOTMLS_fix"]) && is_array($_POST["GOTMLS_fix"]) && in_array($clean_file, $_POST["GOTMLS_fix"])) {
                if (GOTMLS_get_nonce()) {
                    if ($className == "timthumb") {
                        if (($source = GOTMLS_get_URL("http://{$className}.googlecode.com/svn/trunk/{$className}.php")) && strlen($source) > 500) {
                            $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = $source;
                        } else {
                            $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = "";
                        }
                    } elseif ($className == 'wp_core') {
                        $path = str_replace("//", "/", "/" . str_replace("\\", "/", substr($file, strlen(ABSPATH))));
                        if (substr($file, 0, strlen(ABSPATH)) == ABSPATH && isset($GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"]["{$wp_version}"]["{$path}"]) && $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"]["{$wp_version}"]["{$path}"] != md5($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) . "O" . strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) && ($source = GOTMLS_get_URL("http://core.svn.wordpress.org/tags/{$wp_version}{$path}")) && $GLOBALS["GOTMLS"]["tmp"]["definitions_array"]["wp_core"]["{$wp_version}"]["{$path}"] == md5($source) . "O" . strlen($source)) {
                            $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = $source;
                        } else {
                            $GLOBALS["GOTMLS"]["tmp"]["file_contents"] = "";
                        }
                    } else {
                        $GOTMLS_no_contents = trim(preg_replace('/\\/\\*.*?\\*\\/\\s*/s', "", $GLOBALS["GOTMLS"]["tmp"]["new_contents"]));
                        $GOTMLS_no_contents = trim(preg_replace('/\\n\\s*\\/\\/.*/', "", $GOTMLS_no_contents));
                        $GOTMLS_no_contents = trim(preg_replace('/' . $lt . '\\?(php)?\\s*(\\?' . $gt . '|$)/is', "", $GOTMLS_no_contents));
                        if (strlen($GOTMLS_no_contents)) {
                            $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = trim(preg_replace('/' . $lt . '\\?(php)?\\s*(\\?' . $gt . '|$)/is', "", $GLOBALS["GOTMLS"]["tmp"]["new_contents"]));
                        } else {
                            $GLOBALS["GOTMLS"]["tmp"]["new_contents"] = "";
                        }
                    }
                    if (strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) > 0 && ($Q_post = GOTMLS_write_quarantine($file, $className)) !== false && (strlen($GLOBALS["GOTMLS"]["tmp"]["new_contents"]) == 0 && isset($_GET["eli"]) && @unlink($file) || ($Write_File = GOTMLS_file_put_contents($file, $GLOBALS["GOTMLS"]["tmp"]["new_contents"])) !== false)) {
                        echo __("Success!", 'gotmls');
                        return "/*--{$gt}*" . "/\nfixedFile('{$clean_file}');\n/*{$lt}!--*" . "/";
                    } else {
                        echo __("Failed:", 'gotmls') . ' ' . (strlen($GLOBALS["GOTMLS"]["tmp"]["file_contents"]) ? is_writable(dirname($file)) && is_writable($file) ? $Q_post === false ? __("failed to quarantine!", 'gotmls') . " (" . $wpdb->last_error . ")" : (isset($Write_File) && $Write_File ? "Q={$Q_post}: " . __("reason unknown!", 'gotmls') : "Q={$Q_post}: " . __("failed to write!", 'gotmls')) : __("file not writable!", 'gotmls') : __("no file contents!", 'gotmls'));
                        if (isset($_GET["eli"])) {
                            echo 'uid=' . getmyuid() . '(' . get_current_user() . '),gid=' . getmygid() . ($lt . 'br' . $gt . $lt . 'pre' . $gt . 'file_stat' . print_r(stat($file), true));
                        }
                        return "/*--{$gt}*" . "/\nfailedFile('{$clean_file}');\n/*{$lt}!--*" . "/";
                    }
                } else {
                    echo GOTMLS_Invalid_Nonce(__("Failed: ", 'gotmls'));
                    return "/*--{$gt}*" . "/\nfailedFile('{$clean_file}');\n/*{$lt}!--*" . "/";
                }
            }
            $threat_link = $lt . 'input type="checkbox" name="GOTMLS_fix[]" value="' . $clean_file . '" id="check_' . $clean_file . ($className != "wp_core" ? '" checked="' . $className : '') . '" /' . $gt . $threat_link;
            $imageFile = "threat";
        } elseif (isset($_POST["GOTMLS_fix"]) && is_array($_POST["GOTMLS_fix"]) && in_array($clean_file, $_POST["GOTMLS_fix"])) {
            echo __("Already Fixed!", 'gotmls');
            return "/*-->*" . "/\nfixedFile('{$clean_file}');\n/*<!--*" . "/";
        } else {
            $imageFile = "question";
        }
        return GOTMLS_return_threat($className, $imageFile, $file, str_replace("GOTMLS_plugin", "GOTMLS_plugin {$className}", $threat_link));
    } elseif (isset($_POST["GOTMLS_fix"]) && is_array($_POST["GOTMLS_fix"]) && in_array($clean_file, $_POST["GOTMLS_fix"])) {
        echo __("Already Fixed!", 'gotmls');
        return "/*--{$gt}*" . "/\nfixedFile('{$clean_file}');\n/*{$lt}!--*" . "/";
    } else {
        return GOTMLS_return_threat($className, ($className == "scanned" ? "checked" : "blocked") . ".gif?{$className}", $file, $threat_link);
    }
}