PageRenderTime 288ms CodeModel.GetById 21ms RepoModel.GetById 1ms app.codeStats 1ms

/wp-content/plugins/bulletproof-security/admin/options.php

https://bitbucket.org/crypticrod/sr_wp_code
PHP | 2318 lines | 2024 code | 150 blank | 144 comment | 274 complexity | a2bd079aa25cc7afa3ded71f8a352628 MD5 | raw file
Possible License(s): AGPL-1.0, GPL-2.0, LGPL-2.1, GPL-3.0, LGPL-2.0, AGPL-3.0

Large files files are truncated, but you can click here to view the full file

    

  1. <?php

    2. 

  2. // Direct calls to this file are Forbidden when core files are not present

    3. 

  3. if ( !function_exists('add_action') ){

    4. 

  4. 		header('Status: 403 Forbidden');

    5. 

  5. 		header('HTTP/1.1 403 Forbidden');

    6. 

  6. 		exit();

    7. 

  7. }

    8. 

  8.  

    9. 

  9. if ( !current_user_can('manage_options') ){ 

    10. 

  10. 		header('Status: 403 Forbidden');

    11. 

  11. 		header('HTTP/1.1 403 Forbidden');

    12. 

  12. 		exit();

    13. 

  13. }

    14. 

  14. ?>

    15. 

  15. 

    16. 

  16. <div id="message" class="updated" style="border:1px solid #999999; margin-left:70px; margin-top:9px;">

    17. 

  17. <?php

    18. 

  18. // HUD - Heads Up Display - Warnings and Error messages

    19. 

  19. echo bps_check_php_version_error();

    20. 

  20. echo bps_check_permalinks_error();

    21. 

  21. echo bps_check_iis_supports_permalinks();

    22. 

  22. echo bps_hud_check_bpsbackup();

    23. 

  23. echo bps_check_safemode();

    24. 

  24. echo @bps_w3tc_htaccess_check($plugin_var);

    25. 

  25. echo @bps_wpsc_htaccess_check($plugin_var);

    26. 

  26. 

    27. 

  27. // Form - copy and rename htaccess file to root folder

    28. 

  28. // BulletProof Security and Default Mode

    29. 

  29. $bpsecureroot = 'unchecked';

    30. 

  30. $bpdefaultroot = 'unchecked';

    31. 

  31. if (isset($_POST['submit12']) && current_user_can('manage_options')) {

    32. 

  32. 	check_admin_referer( 'bulletproof_security_root_copy' );

    33. 

  33. 	

    34. 

  34. 	$old = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/default.htaccess';

    35. 

  35. 	$new = ABSPATH . '/.htaccess';

    36. 

  36. 	$old1 = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/secure.htaccess';

    37. 

  37. 	$new1 = ABSPATH . '/.htaccess';

    38. 

  38. 	

    39. 

  39. 	$selected_radio = $_POST['selection12'];

    40. 

  40. 	if ($selected_radio == 'bpsecureroot') {

    41. 

  41. 	$bpsecureroot = 'checked';

    42. 

  42. 		@copy($old1, $new1);

    43. 

  43. 		chmod($new1, 0644);

    44. 

  44. 		if (!copy($old1, $new1)) {

    45. 

  45. 	_e('<font color="red"><strong>Failed to Activate BulletProof Security Root Folder Protection! Your Website is NOT protected with BulletProof Security!</strong></font><br>');

    46. 

  46.    	} else {

    47. 

  47. 	_e('<font color="green"><strong>BulletProof Security Root Folder Protection Activated. Your website Root folder is now protected with BulletProof Security.</strong></font><br><font color="red"><strong>IMPORTANT!</strong></font><strong> BulletProof Mode for the wp-admin folder MUST also be activated when you have BulletProof Mode activated for the Root folder.</strong><br>');

    48. 

  48.     }

    49. 

  49. 	}

    50. 

  50. 	elseif ($selected_radio == 'bpdefaultroot') {

    51. 

  51. 	$bpdefaultroot = 'checked';

    52. 

  52. 		copy($old, $new);

    53. 

  53. 		chmod($new, 0644);

    54. 

  54. 		if (!copy($old, $new)) {

    55. 

  55. 	_e('<font color="red"><strong>Failed to Activate Default .htaccess Mode!</strong></font><br>');

    56. 

  56.    	} else {

    57. 

  57. 	_e('<font color="red"><strong>Warning: Default .htaccess Mode Is Activated In Your Website Root Folder. Your Website Is Not Protected With BulletProof Security.</strong></font>');

    58. 

  58. 	}

    59. 

  59. 	}

    60. 

  60. }

    61. 

  61. 

    62. 

  62. // Form - copy and rename htaccess file to wp-admin folder

    63. 

  63. // BulletProof Security wp-admin

    64. 

  64. $bpsecurewpadmin = 'unchecked';

    65. 

  65. $Removebpsecurewpadmin = 'unchecked';

    66. 

  66. if (isset($_POST['submit13']) && current_user_can('manage_options')) {

    67. 

  67. 	check_admin_referer( 'bulletproof_security_wpadmin_copy' );

    68. 

  68. 	

    69. 

  69. 	$oldadmin1 = ABSPATH . 'wp-content/plugins/bulletproof-security/admin/htaccess/wpadmin-secure.htaccess';

    70. 

  70. 	$newadmin1 = ABSPATH . 'wp-admin/.htaccess';

    71. 

  71. 	$deleteWpadminHtaccess = ABSPATH . 'wp-admin/.htaccess';

    72. 

  72. 	

    73. 

  73. 	$selected_radio = $_POST['selection13'];

    74. 

  74. 	if ($selected_radio == 'bpsecurewpadmin') {

    75. 

  75. 	$bpsecurewpadmin = 'checked';

    76. 

  76. 		copy($oldadmin1, $newadmin1);

    77. 

  77. 		chmod($newadmin1, 0644);

    78. 

  78. 		if (!copy($oldadmin1, $newadmin1)) {

    79. 

  79. 	_e('<font color="red"><strong>Failed to Activate BulletProof Security wp-admin Folder Protection! Your wp-admin folder is NOT protected with BulletProof Security!</strong></font><br>');

    80. 

  80.    	} else {

    81. 

  81. 	_e('<font color="green"><strong>BulletProof Security wp-admin Folder Protection Activated. Your wp-admin folder is now protected with BulletProof Security.</strong></font>');

    82. 

  82. 	}

    83. 

  83. 	}

    84. 

  84. 	elseif ($selected_radio == 'Removebpsecurewpadmin') {

    85. 

  85. 	$Removebpsecurewpadmin = 'checked';

    86. 

  86. 	$fh = fopen($deleteWpadminHtaccess, 'a');

    87. 

  87. 	fwrite($fh, 'delete');

    88. 

  88. 	fclose($fh);

    89. 

  89. 	unlink($deleteWpadminHtaccess);

    90. 

  90. 	if (file_exists($deleteWpadminHtaccess)) {

    91. 

  91. 	_e('<font color="red"><strong>Failed to Delete the wp-admin .htaccess file! The file does not exist. It may have been deleted or renamed already.</strong></font><br>');

    92. 

  92.    	} else {

    93. 

  93. 	_e('<font color="green"><strong>The wp-admin .htaccess file has been Deleted. </strong></font><font color="red"><strong>Your wp-admin folder is no longer .htaccess protected.</strong></font> If you are testing then be sure to reactivate BulletProof Mode for your wp-admin folder when you are done testing. If you are removing BPS from your website then be sure to also Activate Default Mode for your Root folder. The Root and wp-admin BulletProof Modes must be activated together or removed togeher.</strong></font><br>');

    94. 

  94. 	}

    95. 

  95. 	}

    96. 

  96. }

    97. 

  97. 

    98. 

  98. // Form rename Deny All htaccess file to .htaccess for the BPS Master htaccess folder

    99. 

  99. $bps_rename_htaccess_files = 'unchecked';

    100. 

  100. if (isset($_POST['submit8']) && current_user_can('manage_options')) {

    101. 

  101. 	check_admin_referer( 'bulletproof_security_denyall_master' );

    102. 

  102. 	

    103. 

  103. 	$bps_rename_htaccess = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/deny-all.htaccess';

    104. 

  104. 	$bps_rename_htaccess_renamed = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/.htaccess';

    105. 

  105. 	

    106. 

  106. 	$selected_radio = $_POST['selection8'];

    107. 

  107. 	if ($selected_radio == 'bps_rename_htaccess_files') {

    108. 

  108. 	$bps_rename_htaccess_files = 'checked';

    109. 

  109. 		copy($bps_rename_htaccess, $bps_rename_htaccess_renamed);

    110. 

  110. 		if (!copy($bps_rename_htaccess, $bps_rename_htaccess_renamed)) {

    111. 

  111. 	_e('<font color="red"><strong>Failed to Activate BulletProof Security Deny All Folder Protection! Your BPS Master htaccess folder is NOT Protected with Deny All htaccess folder protection!</strong></font><br>');

    112. 

  112.    	} else {

    113. 

  113. 	_e('BulletProof Security Deny All Folder Protection <font color="green"><strong>Activated.</strong></font> Your BPS Master htaccess folder is Now Protected with Deny All htaccess folder protection.');

    114. 

  114. 	}

    115. 

  115. }

    116. 

  116. }

    117. 

  117. 

    118. 

  118. // Form copy and rename the Deny All htaccess file to the BPS backup folder

    119. 

  119. // /wp-content/bps-backup

    120. 

  120. $bps_rename_htaccess_files_backup = 'unchecked';

    121. 

  121. if (isset($_POST['submit14']) && current_user_can('manage_options')) {

    122. 

  122. 	check_admin_referer( 'bulletproof_security_denyall_bpsbackup' );

    123. 

  123. 	

    124. 

  124. 	$bps_rename_htaccess_backup = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/deny-all.htaccess';

    125. 

  125. 	$bps_rename_htaccess_backup_online = ABSPATH . '/wp-content/bps-backup/.htaccess';

    126. 

  126. 	

    127. 

  127. 	$selected_radio = $_POST['selection14'];

    128. 

  128. 	if ($selected_radio == 'bps_rename_htaccess_files_backup') {

    129. 

  129. 	$bps_rename_htaccess_files_backup = 'checked';

    130. 

  130. 		copy($bps_rename_htaccess_backup, $bps_rename_htaccess_backup_online);

    131. 

  131. 		if (!copy($bps_rename_htaccess_backup, $bps_rename_htaccess_backup_online)) {

    132. 

  132. 	_e('<font color="red"><strong>Failed to Activate BulletProof Security Deny All Folder Protection! Your BPS /wp-content/bps-backup folder is NOT Protected with Deny All htaccess folder protection!</strong></font><br>');

    133. 

  133.    	} else {

    134. 

  134. 	_e('BulletProof Security Deny All Folder Protection <font color="green"><strong>Activated.</strong></font> Your BPS /wp-content/bps-backup folder is Now Protected with Deny All htaccess folder protection.');

    135. 

  135. 	}

    136. 

  136. 	}

    137. 

  137. }

    138. 

  138. 

    139. 

  139. // Form - Backup and rename existing and / or currently active htaccess files from 

    140. 

  140. // the root and wpadmin folders to /wp-content/bps-backup

    141. 

  141. $backup_htaccess = 'unchecked';

    142. 

  142. if (isset($_POST['submit9']) && current_user_can('manage_options')) {

    143. 

  143. 	check_admin_referer( 'bulletproof_security_backup_active_htaccess_files' );

    144. 

  144. 	

    145. 

  145. 	$old_backroot = ABSPATH . '/.htaccess';

    146. 

  146. 	$new_backroot = ABSPATH . '/wp-content/bps-backup/root.htaccess';

    147. 

  147. 	$old_backwpadmin = ABSPATH . '/wp-admin/.htaccess';

    148. 

  148. 	$new_backwpadmin = ABSPATH . '/wp-content/bps-backup/wpadmin.htaccess';

    149. 

  149. 	

    150. 

  150. 	$selected_radio = $_POST['selection9'];

    151. 

  151. 	if ($selected_radio == 'backup_htaccess') {

    152. 

  152. 	$backup_htaccess = 'checked';

    153. 

  153. 	if ( !file_exists($old_backroot)) { 

    154. 

  154. 	_e('<font color="red"><strong>You do not currently have an .htaccess file in your Root folder to backup.</strong></font><br>');

    155. 

  155. 	} else {	

    156. 

  156. 	if (file_exists($old_backroot)) { 

    157. 

  157.  		copy($old_backroot, $new_backroot);

    158. 

  158. 		if (!copy($old_backroot, $new_backroot)) {

    159. 

  159. 	_e('<font color="red"><strong>Failed to Backup Your Root .htaccess File! File copy function failed. Check the folder permissions for the /wp-content/bps-backup folder. Folder permissions should be set to 755.</strong></font><br><br>');

    160. 

  160. 	} else {

    161. 

  161. 	_e('<font color="green"><strong>Your currently active Root .htaccess file has been backed up successfully!</strong></font><br>Use the Restore feature to restore your .htaccess files if you run into a problem at any time. If you make additional changes or install a plugin that writes to the htaccess files then back them up again. This will overwrite the currently backed up htaccess files. Please read the <font color="red"><strong>CAUTION:</strong></font> Read Me ToolTip on the Backup & Restore Page for more detailed information.<br><br>');

    162. 

  162. 	

    163. 

  163. 	if ( !file_exists($old_backwpadmin)) { 

    164. 

  164. 	_e('<font color="red"><strong>You do not currently have an .htaccess file in your wp-admin folder to backup.</strong></font><br>');

    165. 

  165. 	} else {

    166. 

  166. 	if (file_exists($old_backwpadmin)) { 	

    167. 

  167. 		copy($old_backwpadmin, $new_backwpadmin);

    168. 

  168. 		if (!copy($old_backwpadmin, $new_backwpadmin)) {

    169. 

  169. 	_e('<font color="red"><strong>Failed to Backup Your wp-admin .htaccess File! File copy function failed. Check the folder permissions for the /wp-content/bps-backup folder. Folder permissions should be set to 755.</strong></font><br>');

    170. 

  170. 	} else {

    171. 

  171. 	_e('<font color="green"><strong>Your currently active wp-admin .htaccess file has been backed up successfully!</strong></font><br>');

    172. 

  172. 	}

    173. 

  173. }}}}}}}

    174. 

  174. 

    175. 

  175. // Form - Restore backed up htaccess files

    176. 

  176. $restore_htaccess = 'unchecked';

    177. 

  177. if (isset($_POST['submit10']) && current_user_can('manage_options')) {

    178. 

  178. 	check_admin_referer( 'bulletproof_security_restore_active_htaccess_files' );

    179. 

  179. 	

    180. 

  180. 	$old_restoreroot = ABSPATH . '/wp-content/bps-backup/root.htaccess';

    181. 

  181. 	$new_restoreroot = ABSPATH . '/.htaccess';

    182. 

  182. 	$old_restorewpadmin = ABSPATH . '/wp-content/bps-backup/wpadmin.htaccess';

    183. 

  183. 	$new_restorewpadmin = ABSPATH . '/wp-admin/.htaccess';

    184. 

  184. 	

    185. 

  185. 	$selected_radio = $_POST['selection10'];

    186. 

  186. 	if ($selected_radio == 'restore_htaccess') {

    187. 

  187. 		$restore_htaccess = 'checked';

    188. 

  188. 	if (file_exists($old_restoreroot)) { 

    189. 

  189.  		copy($old_restoreroot, $new_restoreroot);

    190. 

  190. 		if (!copy($old_restoreroot, $new_restoreroot)) {

    191. 

  191. 	_e('<font color="red"><strong>Failed to Restore Your Root .htaccess File! This is most likely because you DO NOT currently have a Backed up Root .htaccess file.</strong></font><br>');

    192. 

  192.    	} else {

    193. 

  193. 	_e('<font color="green"><strong>Your Root .htaccess file has been Restored successfully!</strong></font><br>');

    194. 

  194. 	if (file_exists($old_restorewpadmin)) { 	

    195. 

  195. 		copy($old_restorewpadmin, $new_restorewpadmin);

    196. 

  196. 		if (!copy($old_restorewpadmin, $new_restorewpadmin)) {

    197. 

  197. 	_e('<font color="red"><strong>Failed to Restore Your wp-admin .htaccess File! This is most likely because you DO NOT currently have a Backed up wp-admin .htaccess file.</strong></font><br>');

    198. 

  198.    	} else {

    199. 

  199. 	_e('<font color="green"><strong>Your wp-admin .htaccess file has been Restored successfully!</strong></font><br>');

    200. 

  200. 	}

    201. 

  201. }}}}}

    202. 

  202. 

    203. 

  203. // Form - Backup the BPS Master Files to /wp-content/bps-backup/master-backups

    204. 

  204. $backup_master_htaccess_files = 'unchecked';

    205. 

  205. if (isset($_POST['submit11']) && current_user_can('manage_options')) {

    206. 

  206. 	check_admin_referer( 'bulletproof_security_backup_master_htaccess_files' );

    207. 

  207. 	

    208. 

  208. $default_master = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/default.htaccess';

    209. 

  209. $default_master_backup = ABSPATH . '/wp-content/bps-backup/master-backups/backup_default.htaccess';

    210. 

  210. $secure_master = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/secure.htaccess';

    211. 

  211. $secure_master_backup = ABSPATH . '/wp-content/bps-backup/master-backups/backup_secure.htaccess';

    212. 

  212. $wpadmin_master = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/wpadmin-secure.htaccess';

    213. 

  213. $wpadmin_master_backup = ABSPATH . '/wp-content/bps-backup/master-backups/backup_wpadmin-secure.htaccess';

    214. 

  214. $maintenance_master = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/maintenance.htaccess';

    215. 

  215. $maintenance_master_backup = ABSPATH . '/wp-content/bps-backup/master-backups/backup_maintenance.htaccess';

    216. 

  216. $bp_maintenance_master = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/bp-maintenance.php';

    217. 

  217. $bp_maintenance_master_backup = ABSPATH . '/wp-content/bps-backup/master-backups/backup_bp-maintenance.php';

    218. 

  218. $bps_maintenance_values = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/bps-maintenance-values.php';

    219. 

  219. $bps_maintenance_values_backup = ABSPATH . '/wp-content/bps-backup/master-backups/backup_bps-maintenance-values.php';

    220. 

  220. 

    221. 

  221. 	$selected_radio = $_POST['selection11'];

    222. 

  222. 	if ($selected_radio == 'backup_master_htaccess_files') {

    223. 

  223. 		$backup_master_htaccess_files = 'checked';

    224. 

  224. 	if (file_exists($default_master)) { 

    225. 

  225.  		copy($default_master, $default_master_backup);

    226. 

  226. 		if (!copy($default_master, $default_master_backup)) {

    227. 

  227. 	_e('<font color="red"><strong>Failed to Backup Your default.htaccess File!</strong></font><br>');

    228. 

  228.    	} else {

    229. 

  229. 	_e('<font color="green"><strong>The default.htaccess file has been backed up successfully!</strong></font><br>');

    230. 

  230. 	}

    231. 

  231. 	if (file_exists($secure_master)) { 	

    232. 

  232. 		copy($secure_master, $secure_master_backup);

    233. 

  233. 		if (!copy($secure_master, $secure_master_backup)) {

    234. 

  234. 	_e('<font color="red"><strong>Failed to Backup Your secure.htaccess File!</strong></font><br>');

    235. 

  235.    	} else {

    236. 

  236. 	_e('<font color="green"><strong>The secure.htaccess file has been backed up successfully!</strong></font><br>');

    237. 

  237. 	}

    238. 

  238. 	if (file_exists($wpadmin_master)) { 	

    239. 

  239. 		copy($wpadmin_master, $wpadmin_master_backup);

    240. 

  240. 		if (!copy($wpadmin_master, $wpadmin_master_backup)) {

    241. 

  241. 	_e('<font color="red"><strong>Failed to Backup Your wpadmin-secure.htaccess File!</strong></font><br>');

    242. 

  242.    	} else {

    243. 

  243. 	_e('<font color="green"><strong>The wpadmin-secure.htaccess file has been backed up successfully!</strong></font><br>');

    244. 

  244. 	}

    245. 

  245. 	if (file_exists($maintenance_master)) { 	

    246. 

  246. 		copy($maintenance_master, $maintenance_master_backup);

    247. 

  247. 		if (!copy($maintenance_master, $maintenance_master_backup)) {

    248. 

  248. 	_e('<font color="red"><strong>Failed to Backup Your maintenance.htaccess File!</strong></font><br>');

    249. 

  249.    	} else {

    250. 

  250. 	_e('<font color="green"><strong>The maintenance.htaccess file has been backed up successfully!</strong></font><br>');

    251. 

  251. 	}

    252. 

  252. 	if (file_exists($bp_maintenance_master)) { 	

    253. 

  253. 		copy($bp_maintenance_master, $bp_maintenance_master_backup);

    254. 

  254. 		if (!copy($bp_maintenance_master, $bp_maintenance_master_backup)) {

    255. 

  255. 	_e('<font color="red"><strong>Failed to Backup Your bp-maintenance.php File!</strong></font><br>');

    256. 

  256.    	} else {

    257. 

  257. 	_e('<font color="green"><strong>The bp-maintenance.php file has been backed up successfully!</strong></font><br>');

    258. 

  258. 	}

    259. 

  259. 	if (file_exists($bps_maintenance_values)) { 	

    260. 

  260. 		copy($bps_maintenance_values, $bps_maintenance_values_backup);

    261. 

  261. 		if (!copy($bps_maintenance_values, $bps_maintenance_values_backup)) {

    262. 

  262. 	_e('<font color="red"><strong>Failed to Backup Your bps-maintenance-values.php File!</strong></font><br>');

    263. 

  263.    	} else {

    264. 

  264. 	_e('<font color="green"><strong>The bps-maintenance-values.php file has been backed up successfully!</strong></font><br>');

    265. 

  265. 	}

    266. 

  266. }}}}}}}}

    267. 

  267. 	

    268. 

  268. // Form - Activate Maintenance Mode copy and rename maintenance htaccess, bp-maintenance.php and bps-maintenance-values.php to root

    269. 

  269. $bpmaintenance = 'unchecked';

    270. 

  270. if (isset($_POST['submit15']) && current_user_can('manage_options')) {

    271. 

  271. 	check_admin_referer( 'bulletproof_security_maintenance_copy' );

    272. 

  272. 

    273. 

  273. $oldmaint = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/maintenance.htaccess';

    274. 

  274. $newmaint = ABSPATH . '/.htaccess';

    275. 

  275. $oldmaint1 = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/bp-maintenance.php';

    276. 

  276. $newmaint1 = ABSPATH . '/bp-maintenance.php';

    277. 

  277. $oldmaint_values = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/bps-maintenance-values.php';

    278. 

  278. $newmaint_values = ABSPATH . '/bps-maintenance-values.php';

    279. 

  279. 

    280. 

  280. 	$selected_radio = $_POST['selection15'];

    281. 

  281. 	if ($selected_radio == 'bpmaintenance') {

    282. 

  282. 	$bpmaintenance = 'checked';

    283. 

  283. 		copy($oldmaint, $newmaint);

    284. 

  284. 		copy($oldmaint1, $newmaint1);

    285. 

  285. 		copy($oldmaint_values, $newmaint_values);

    286. 

  286. 		if (!copy($oldmaint, $newmaint)) {

    287. 

  287. 	_e('<p><font color="red"><strong>Failed to Activate Maintenance Mode! Your Website is NOT in Maintenance Mode!<br>If your Root .htaccess file is locked you must unlock it first before activating Maintenance Mode.</strong></font></p>');

    288. 

  288.    	} else {

    289. 

  289. 	_e('<font color="red"><strong>Warning: </strong></font>Maintenance Mode Is Activated. Your website is now displaying the Website Under Maintenance page to everyone except you. To switch out of Maintenance mode activate BulletProof Security Mode. You can log in and out of your Dashboard / WordPress website in Maintenance Mode as long as your current IP address does not change. If your current IP address changes you will have to FTP to your website and delete the .htaccess file in your website root folder (or download the .htaccess file and add your new IP address and upload it back to your root website folder) to be able to log back into your WordPress Dashboard. Your ISP provides your current Public IP address. If you reboot your computer or disconnect from the Internet there is a good chance that you will get a new Public IP address from your ISP.');

    290. 

  290. 	}

    291. 

  291. 	}

    292. 

  292. }	

    293. 

  293. 

    294. 

  294. // Create maintenance htaccess file

    295. 

  295. if (isset($_POST['bps-auto-write-maint']) && current_user_can('manage_options')) {

    296. 

  296. 	check_admin_referer( 'bulletproof_security_auto_write_maint' );

    297. 

  297. 	

    298. 

  298. $bps_string_replace_maint = array(".");

    299. 

  299. $bps_get_IP_maint = str_replace($bps_string_replace_maint, "\.", $_SERVER['REMOTE_ADDR']) . "$";

    300. 

  300. $bps_get_wp_root_maint = bps_wp_get_root_folder();

    301. 

  301. $bps_auto_write_maint_file = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/maintenance.htaccess';

    302. 

  302. $bps_maint_content = "#   BULLETPROOF .46.6 MAINTENANCE  .HTACCESS     \n    

    303. 

  303. RewriteEngine On

    304. 

  304. RewriteBase $bps_get_wp_root_maint\n

    305. 

  305. RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK|DEBUG) [NC]

    306. 

  306. RewriteRule ^(.*)$ - [F,L]\n

    307. 

  307. # ALLOW THUMBNAILER SCRIPTS TO DISPLAY IMAGES

    308. 

  308. RewriteCond %{REQUEST_FILENAME} thumb.php [NC,OR]

    309. 

  309. RewriteCond %{REQUEST_FILENAME} thumbs.php [NC,OR]

    310. 

  310. RewriteCond %{REQUEST_FILENAME} timthumb.php [NC,OR]

    311. 

  311. RewriteCond %{REQUEST_FILENAME} phpthumb.php [NC]

    312. 

  312. RewriteRule . - [F,L]\n

    313. 

  313. # BPSQSE BPS QUERY STRING EXPLOITS

    314. 

  314. RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]

    315. 

  315. RewriteCond %{HTTP_USER_AGENT} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]

    316. 

  316. RewriteCond %{HTTP_USER_AGENT} (;|<|>|'|".'"'."|\)|\(|%0A|%0D|%22|%27|%28|%3C|%3E|%00).*(libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]

    317. 

  317. RewriteCond %{THE_REQUEST} \?\ HTTP/ [NC,OR]

    318. 

  318. RewriteCond %{THE_REQUEST} \/\*\ HTTP/ [NC,OR]

    319. 

  319. RewriteCond %{THE_REQUEST} etc/passwd [NC,OR]

    320. 

  320. RewriteCond %{THE_REQUEST} cgi-bin [NC,OR]

    321. 

  321. RewriteCond %{THE_REQUEST} (\\r|\\n|%0A|%0D) [NC,OR]

    322. 

  322. RewriteCond %{REQUEST_URI} owssvr\.dll [NC,OR]

    323. 

  323. RewriteCond %{HTTP_REFERER} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]

    324. 

  324. RewriteCond %{HTTP_REFERER} \.opendirviewer\. [NC,OR]

    325. 

  325. RewriteCond %{HTTP_REFERER} users\.skynet\.be.* [NC,OR]

    326. 

  326. RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]

    327. 

  327. RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]

    328. 

  328. RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]

    329. 

  329. RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC,OR]

    330. 

  330. RewriteCond %{QUERY_STRING} \.\./\.\. [OR]

    331. 

  331. RewriteCond %{QUERY_STRING} ftp\: [NC,OR]

    332. 

  332. RewriteCond %{QUERY_STRING} http\: [NC,OR] 

    333. 

  333. RewriteCond %{QUERY_STRING} https\: [NC,OR]

    334. 

  334. RewriteCond %{QUERY_STRING} \=\|w\| [NC,OR]

    335. 

  335. RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]

    336. 

  336. RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR]

    337. 

  337. RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]

    338. 

  338. RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]

    339. 

  339. RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]

    340. 

  340. RewriteCond %{QUERY_STRING} (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR] 

    341. 

  341. RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]

    342. 

  342. RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]

    343. 

  343. RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]

    344. 

  344. RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]

    345. 

  345. RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>).* [NC,OR]

    346. 

  346. RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [OR]

    347. 

  347. RewriteCond %{QUERY_STRING} (\./|\../|\.../)+(motd|etc|bin) [NC,OR]

    348. 

  348. RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]

    349. 

  349. RewriteCond %{QUERY_STRING} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]

    350. 

  350. RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]

    351. 

  351. RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]

    352. 

  352. RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]

    353. 

  353. RewriteCond %{QUERY_STRING} (;|<|>|'|".'"'."|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]

    354. 

  354. RewriteCond %{QUERY_STRING} (sp_executesql) [NC]

    355. 

  355. RewriteRule ^(.*)$ - [F,L]\n

    356. 

  356. RewriteCond %{REMOTE_ADDR} !^$bps_get_IP_maint

    357. 

  357. RewriteCond %{REQUEST_URI} !^$bps_get_wp_root_maint"."bp-maintenance\.php$

    358. 

  358. RewriteCond %{REQUEST_URI} !^$bps_get_wp_root_maint"."wp-content/plugins/bulletproof-security/abstract-blue-bg\.png$

    359. 

  359. RewriteRule ^(.*)$ $bps_get_wp_root_maint"."bp-maintenance.php [L]

    360. 

  360. RewriteCond %{REQUEST_FILENAME} !-f

    361. 

  361. RewriteCond %{REQUEST_FILENAME} !-d

    362. 

  362. RewriteRule . $bps_get_wp_root_maint"."index.php [L]";

    363. 

  363. 	if (is_writable($bps_auto_write_maint_file)) {

    364. 

  364. 	if (!$handle = fopen($bps_auto_write_maint_file, 'w+b')) {

    365. 

  365.          _e('<font color="red"><strong>Cannot open file' . "$bps_auto_write_maint_file" . '</strong></font>');

    366. 

  366.          exit;

    367. 

  367.     }

    368. 

  368.     if (fwrite($handle, $bps_maint_content) === FALSE) {

    369. 

  369.         _e('<font color="red"><strong>Cannot write to file' . "$bps_auto_write_maint_file" . '</strong></font>');

    370. 

  370.         exit;

    371. 

  371.     }

    372. 

  372.     _e('<font color="green"><strong>Success! Your Maintenance Mode htaccess file was created successfully! Select the Maintenance Mode radio button and click Activate to put your website in Maintenance Mode.</strong></font>');

    373. 

  373.     fclose($handle);

    374. 

  374. 	} else {

    375. 

  375.     _e('<font color="red"><strong>The file ' . "$bps_auto_write_maint_file" . ' is not writable or does not exist.</strong></font><br><strong>Check that the file is named maintenance.htaccess and that the file exists in the /bulletproof-security/admin/htaccess master folder. If this is not the problem click <a href="http://www.ait-pro.com/aitpro-blog/2566/bulletproof-security-plugin-support/bulletproof-security-error-messages" target="_blank">here</a> for more help info.</strong><br>');

    376. 

  376. 	}

    377. 

  377. }

    378. 

  378. 

    379. 

  379. // default.htaccess and secure.htaccess fwrite content for all WP site types

    380. 

  380. $bps_get_wp_root_default = bps_wp_get_root_folder();

    381. 

  381. $bps_auto_write_default_file = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/default.htaccess';

    382. 

  382. 

    383. 

  383. $bpsSuccessMessageDef = '<font color="green"><strong>Success! Your Default Mode Master htaccess file was created successfully!</strong></font><br><font color="red"><strong>CAUTION: Default Mode should only be activated for testing or troubleshooting purposes. Default Mode does not protect your website with any security protection.</strong></font><br><font color="black"><strong>To activate Default Mode select the Default Mode radio button and click Activate to put your website in Default Mode.</strong></font>';

    384. 

  384. 

    385. 

  385. $bpsFailMessageDef = '<font color="red"><strong>The file ' . "$bps_auto_write_default_file" . ' is not writable or does not exist.</strong></font><br><strong>Check that the file is named default.htaccess and that the file exists in the /bulletproof-security/admin/htaccess master folder. If this is not the problem click <a href="http://www.ait-pro.com/aitpro-blog/2566/bulletproof-security-plugin-support/bulletproof-security-error-messages" target="_blank">here</a> for more help info.</strong><br>';

    386. 

  386. 

    387. 

  387. $bpsTopMU = "\nRewriteEngine On

    388. 

  388. RewriteBase $bps_get_wp_root_default

    389. 

  389. RewriteRule ^index\.php$ - [L]\n\n";

    390. 

  390. 

    391. 

  391. $bps_default_content_top = "#   BULLETPROOF .46.D >>>>>>> DEFAULT .HTACCESS     \n

    392. 

  392. # If you edit the line of code above you will see error messages on the BPS status page

    393. 

  393. # WARNING!!! THE default.htaccess FILE DOES NOT PROTECT YOUR WEBSITE AGAINST HACKERS

    394. 

  394. # This is a standard generic htaccess file that does NOT provide any website security

    395. 

  395. # The DEFAULT .HTACCESS file should be used for testing and troubleshooting purposes only\n

    396. 

  396. # BEGIN WordPress";

    397. 

  397. 

    398. 

  398. $bps_default_content_bottom = "\n<IfModule mod_rewrite.c>

    399. 

  399. RewriteEngine On

    400. 

  400. RewriteBase $bps_get_wp_root_default

    401. 

  401. RewriteRule ^index\.php$ - [L]

    402. 

  402. RewriteCond %{REQUEST_FILENAME} !-f

    403. 

  403. RewriteCond %{REQUEST_FILENAME} !-d

    404. 

  404. RewriteRule . $bps_get_wp_root_default"."index.php [L]

    405. 

  405. </IfModule>\n

    406. 

  406. # END WordPress";

    407. 

  407. 

    408. 

  408. $bpsMUEndWP = "# END WordPress";

    409. 

  409. 

    410. 

  410. $bpsMUSDirTop = "# uploaded files

    411. 

  411. RewriteRule ^([_0-9a-zA-Z-]+/)?files/(.+) wp-includes/ms-files.php?file=$2 [L]\n

    412. 

  412. # add a trailing slash to /wp-admin

    413. 

  413. RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]\n\n";

    414. 

  414. 

    415. 

  415. $bpsMUSDomTop = "# uploaded files

    416. 

  416. RewriteRule ^files/(.+) wp-includes/ms-files.php?file=$1 [L]\n\n";

    417. 

  417. 

    418. 

  418. $bpsMUSDirBottom = "RewriteCond %{REQUEST_FILENAME} -f [OR]

    419. 

  419. RewriteCond %{REQUEST_FILENAME} -d

    420. 

  420. RewriteRule ^ - [L]

    421. 

  421. RewriteRule  ^[_0-9a-zA-Z-]+/(wp-(content|admin|includes).*) $1 [L]

    422. 

  422. RewriteRule  ^[_0-9a-zA-Z-]+/(.*\.php)$ $1 [L]

    423. 

  423. RewriteRule . index.php [L]\n\n";

    424. 

  424. 

    425. 

  425. $bpsMUSDomBottom = "RewriteCond %{REQUEST_FILENAME} -f [OR]

    426. 

  426. RewriteCond %{REQUEST_FILENAME} -d

    427. 

  427. RewriteRule ^ - [L]

    428. 

  428. RewriteRule . index.php [L]\n\n";

    429. 

  429. 

    430. 

  430. // Create Default htaccess file - Single Site

    431. 

  431. if (isset($_POST['bps-auto-write-default']) && current_user_can('manage_options')) {

    432. 

  432. 	check_admin_referer( 'bulletproof_security_auto_write_default' );

    433. 

  433. 

    434. 

  434. 	if (is_writable($bps_auto_write_default_file)) {

    435. 

  435. 	if (!$handle = fopen($bps_auto_write_default_file, 'w+b')) {

    436. 

  436.          _e('<font color="red"><strong>Cannot open file' . "$bps_auto_write_default_file" . '</strong></font>');

    437. 

  437.          exit;

    438. 

  438.     }

    439. 

  439.     if (fwrite($handle, $bps_default_content_top.$bps_default_content_bottom) === FALSE) {

    440. 

  440.     	_e('<font color="red"><strong>Cannot write to file' . "$bps_auto_write_default_file" . '</strong></font>');

    441. 

  441.         exit;

    442. 

  442.     }

    443. 

  443.     _e($bpsSuccessMessageDef);

    444. 

  444.     fclose($handle);

    445. 

  445. 	} else {

    446. 

  446.     _e($bpsFailMessageDef);

    447. 

  447. 	}

    448. 

  448. }

    449. 

  449. 

    450. 

  450. // Create Default htaccess file - MU Subdirectory

    451. 

  451. if (isset($_POST['bps-auto-write-default-MUSDir']) && current_user_can('manage_options')) {

    452. 

  452. 	check_admin_referer( 'bulletproof_security_auto_write_default_MUSDir' );

    453. 

  453. 

    454. 

  454. 	if (is_writable($bps_auto_write_default_file)) {

    455. 

  455. 	if (!$handle = fopen($bps_auto_write_default_file, 'w+b')) {

    456. 

  456.          _e('<font color="red"><strong>Cannot open file' . "$bps_auto_write_default_file" . '</strong></font>');

    457. 

  457.          exit;

    458. 

  458.     }

    459. 

  459.     if (fwrite($handle, $bps_default_content_top.$bpsTopMU.$bpsMUSDirTop.$bpsMUSDirBottom.$bpsMUEndWP) === FALSE) {

    460. 

  460.     	_e('<font color="red"><strong>Cannot write to file' . "$bps_auto_write_default_file" . '</strong></font>');

    461. 

  461.         exit;

    462. 

  462.     }

    463. 

  463.     _e($bpsSuccessMessageDef);

    464. 

  464.     fclose($handle);

    465. 

  465. 	} else {

    466. 

  466.     _e($bpsFailMessageDef);

    467. 

  467. 	}

    468. 

  468. }

    469. 

  469. 

    470. 

  470. // Create Default htaccess file - MU Subdomain

    471. 

  471. if (isset($_POST['bps-auto-write-default-MUSDom']) && current_user_can('manage_options')) {

    472. 

  472. 	check_admin_referer( 'bulletproof_security_auto_write_default_MUSDom' );

    473. 

  473. 

    474. 

  474. 	if (is_writable($bps_auto_write_default_file)) {

    475. 

  475. 	if (!$handle = fopen($bps_auto_write_default_file, 'w+b')) {

    476. 

  476.          _e('<font color="red"><strong>Cannot open file' . "$bps_auto_write_default_file" . '</strong></font>');

    477. 

  477.          exit;

    478. 

  478.     }

    479. 

  479.     if (fwrite($handle, $bps_default_content_top.$bpsTopMU.$bpsMUSDomTop.$bpsMUSDomBottom.$bpsMUEndWP) === FALSE) {

    480. 

  480.     	_e('<font color="red"><strong>Cannot write to file' . "$bps_auto_write_default_file" . '</strong></font>');

    481. 

  481.         exit;

    482. 

  482.     }

    483. 

  483.     _e($bpsSuccessMessageDef);

    484. 

  484.     fclose($handle);

    485. 

  485. 	} else {

    486. 

  486.     _e($bpsFailMessageDef);

    487. 

  487. 	}

    488. 

  488. }

    489. 

  489. 

    490. 

  490. // secure.htaccess fwrite content for all WP site types

    491. 

  491. $bps_get_wp_root_secure = bps_wp_get_root_folder();

    492. 

  492. $bps_auto_write_secure_file = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/secure.htaccess';

    493. 

  493. 

    494. 

  494. $bpsSuccessMessageSec = '<font color="green"><strong>Success! Your BulletProof Security Root Master htaccess file was created successfully!</strong></font><br><font color="black"><strong>You can now Activate BulletProof Mode for your Root folder. Select the BulletProof Mode radio button and click Activate to put your website in BulletProof Mode.</strong></font>';

    495. 

  495. 

    496. 

  496. $bpsFailMessageSec = '<font color="red"><strong>The file ' . "$bps_auto_write_secure_file" . ' is not writable or does not exist.</strong></font><br><strong>Check that the file is named secure.htaccess and that the file exists in the /bulletproof-security/admin/htaccess master folder. If this is not the problem click <a href="http://www.ait-pro.com/aitpro-blog/2566/bulletproof-security-plugin-support/bulletproof-security-error-messages" target="_blank">here</a> for more help info.</strong><br>';

    497. 

  497. 

    498. 

  498. $bps_secure_content_top = "#   BULLETPROOF .46.6 >>>>>>> SECURE .HTACCESS     \n

    499. 

  499. # If you edit the  BULLETPROOF .46.6 >>>>>>> SECURE .HTACCESS text above

    500. 

  500. # you will see error messages on the BPS status page

    501. 

  501. # BPS is reading the version number in the htaccess file to validate checks

    502. 

  502. # If you would like to change what is displayed above you

    503. 

  503. # will need to edit the BPS /includes/functions.php file to match your changes

    504. 

  504. # If you update your WordPress Permalinks the code between BEGIN WordPress and

    505. 

  505. # END WordPress is replaced by WP htaccess code.

    506. 

  506. # This removes all of the BPS security code and replaces it with just the default WP htaccess code

    507. 

  507. # To restore this file use BPS Restore or activate BulletProof Mode for your Root folder again.\n

    508. 

  508. # BEGIN WordPress

    509. 

  509. # IMPORTANT!!! DO NOT DELETE!!! - BEGIN Wordpress above or END WordPress - text in this file

    510. 

  510. # They are reference points for WP, BPS and other plugins to write to this htaccess file.

    511. 

  511. # IMPORTANT!!! DO NOT DELETE!!! - BPSQSE BPS QUERY STRING EXPLOITS - text

    512. 

  512. # BPS needs to find the - BPSQSE - text string in this file to validate that your security filters exist\n

    513. 

  513. # TURN OFF YOUR SERVER SIGNATURE

    514. 

  514. ServerSignature Off\n

    515. 

  515. # ADD PHP HANDLER - Add your hosts php Handler below if you are using a php handler

    516. 

  516. # Example GoDaddy PHP 5.2.x php handler is shown commented out directly below 

    517. 

  517. #AddHandler x-httpd-php5 .php\n

    518. 

  518. # CUSTOM PHP.INI FILES - handlers and mod_suphp htaccess code for Web Hosts

    519. 

  519. # If you are using either a BPS Pro custom php.ini file or one that you created yourself

    520. 

  520. # If your host is GoDaddy and you have a custom php.ini file

    521. 

  521. # uncomment the 1 line of code directly below

    522. 

  522. #AddHandler x-httpd-php5 .php 

    523. 

  523. # If your host is BlueHost, HostMonster FastDomain and you have a custom php.ini file

    524. 

  524. # uncomment the 1 line of code directly below 

    525. 

  525. #AddHandler application/x-httpd-php5s .php

    526. 

  526. # If your host is HostGator and you have a custom php.ini file

    527. 

  527. # uncomment the 3 lines of code below and replace xxxxx with your account/username 

    528. 

  528. #<IfModule mod_suphp.c>

    529. 

  529. #suPHP_ConfigPath /home/xxxxx/public_html/php.ini

    530. 

  530. #</IfModule>\n

    531. 

  531. # DO NOT SHOW DIRECTORY LISTING

    532. 

  532. # If you are getting 500 Errors when activating BPS then comment out Options -Indexes 

    533. 

  533. # by adding a # sign in front of it. If there is a typo anywhere in this file you will also see 500 errors.

    534. 

  534. Options -Indexes\n

    535. 

  535. # DIRECTORY INDEX FORCE INDEX.PHP

    536. 

  536. # Use index.php as default directory index file

    537. 

  537. # index.html will be ignored will not load.

    538. 

  538. DirectoryIndex index.php index.html /index.php\n

    539. 

  539. # BPS PRO ERROR LOGGING AND TRACKING - Available in BPS Pro only

    540. 

  540. # BPS Pro has premade 403 Forbidden, 400 Bad Request and 404 Not Found files that are used 

    541. 

  541. # to track and log 403, 400 and 404 errors that occur on your website. When a hacker attempts to

    542. 

  542. # hack your website the hackers IP address, Host name, Request Method, Referering link, the file name or

    543. 

  543. # requested resource, the user agent of the hacker and the query string used in the hack attempt are logged.

    544. 

  544. # BPS Pro Log files are added to the P-Security All Purpose File Manager to view them.

    545. 

  545. # All BPS Pro log files are htaccess protected so that only you can view them. 

    546. 

  546. # The 400.php, 403.php and 404.php files are located in /wp-content/plugins/bulletproof-security/

    547. 

  547. # The 400 and 403 Error logging files are already set up and will automatically start logging errors

    548. 

  548. # after you install BPS Pro and have activated BulletProof Mode for your Root folder.

    549. 

  549. # If you would like to log 404 errors you will need to copy the logging code in the BPS Pro 404.php file

    550. 

  550. # to your Theme's 404.php template file. Simple instructions are included in the BPS Pro 404.php file.

    551. 

  551. # You can open the BPS Pro 404.php file using the WP Plugins Editor or by using the BPS Pro File Manager.

    552. 

  552. # NOTE: By default WordPress automatically looks in your Theme's folder for a 404.php template file.\n

    553. 

  553. #ErrorDocument 400 $bps_get_wp_root_secure"."wp-content/plugins/bulletproof-security/400.php

    554. 

  554. #ErrorDocument 403 $bps_get_wp_root_secure"."wp-content/plugins/bulletproof-security/403.php

    555. 

  555. ErrorDocument 404 $bps_get_wp_root_secure"."404.php\n

    556. 

  556. # DENY ACCESS TO PROTECTED SERVER FILES - .htaccess, .htpasswd and all file names starting with dot

    557. 

  557. RedirectMatch 403 /\..*$\n

    558. 

  558. RewriteEngine On

    559. 

  559. RewriteBase $bps_get_wp_root_secure

    560. 

  560. RewriteRule ^wp-admin/includes/ - [F,L]

    561. 

  561. RewriteRule !^wp-includes/ - [S=3]

    562. 

  562. RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]

    563. 

  563. RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]

    564. 

  564. RewriteRule ^wp-includes/theme-compat/ - [F,L]\n

    565. 

  565. RewriteEngine On

    566. 

  566. RewriteBase $bps_get_wp_root_secure

    567. 

  567. RewriteRule ^index\.php$ - [L]\n\n";

    568. 

  568. 

    569. 

  569. $bps_secure_content_mid_top = "# REQUEST METHODS FILTERED

    570. 

  570. # This filter is for blocking junk bots and spam bots from making a HEAD request, but may also block some

    571. 

  571. # HEAD request from bots that you want to allow in certains cases. This is not a security filter and is just

    572. 

  572. # a nuisance filter. This filter will not block any important bots like the google bot. If you want to allow

    573. 

  573. # all bots to make a HEAD request then remove HEAD from the Request Method filter.

    574. 

  574. # The TRACE, DELETE, TRACK and DEBUG request methods should never be allowed against your website.

    575. 

  575. RewriteEngine On

    576. 

  576. RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK|DEBUG) [NC]

    577. 

  577. RewriteRule ^(.*)$ - [F,L]\n

    578. 

  578. # PLUGINS AND VARIOUS EXPLOIT FILTER SKIP RULES

    579. 

  579. # IMPORTANT!!! If you add or remove a skip rule you must change S= to the new skip number

    580. 

  580. # Example: If RewriteRule S=5 is deleted than change S=6 to S=5, S=7 to S=6, etc.

    581. 

  581. # Adminer MySQL management tool data populate

    582. 

  582. RewriteCond %{REQUEST_URI} ^$bps_get_wp_root_secure"."wp-content/plugins/adminer/ [NC]

    583. 

  583. RewriteRule . - [S=11]

    584. 

  584. # Comment Spam Pack MU Plugin - CAPTCHA images not displaying 

    585. 

  585. RewriteCond %{REQUEST_URI} ^$bps_get_wp_root_secure"."wp-content/mu-plugins/custom-anti-spam/ [NC]

    586. 

  586. RewriteRule . - [S=10]

    587. 

  587. # Peters Custom Anti-Spam display CAPTCHA Image

    588. 

  588. RewriteCond %{REQUEST_URI} ^$bps_get_wp_root_secure"."wp-content/plugins/peters-custom-anti-spam-image/ [NC] 

    589. 

  589. RewriteRule . - [S=9]

    590. 

  590. # Status Updater plugin fb connect

    591. 

  591. RewriteCond %{REQUEST_URI} ^$bps_get_wp_root_secure"."wp-content/plugins/fb-status-updater/ [NC] 

    592. 

  592. RewriteRule . - [S=8]

    593. 

  593. # Stream Video Player - Adding FLV Videos Blocked

    594. 

  594. RewriteCond %{REQUEST_URI} ^$bps_get_wp_root_secure"."wp-content/plugins/stream-video-player/ [NC]

    595. 

  595. RewriteRule . - [S=7]

    596. 

  596. # XCloner 404 or 403 error when updating settings

    597. 

  597. RewriteCond %{REQUEST_URI} ^$bps_get_wp_root_secure"."wp-content/plugins/xcloner-backup-and-restore/ [NC]

    598. 

  598. RewriteRule . - [S=6]

    599. 

  599. # BuddyPress Logout Redirect

    600. 

  600. RewriteCond %{QUERY_STRING} action=logout&redirect_to=http%3A%2F%2F(.*) [NC]

    601. 

  601. RewriteRule . - [S=5]

    602. 

  602. # redirect_to=

    603. 

  603. RewriteCond %{QUERY_STRING} redirect_to=(.*) [NC]

    604. 

  604. RewriteRule . - [S=4]

    605. 

  605. # Login Plugins Password Reset And Redirect 1

    606. 

  606. RewriteCond %{QUERY_STRING} action=resetpass&key=(.*) [NC]

    607. 

  607. RewriteRule . - [S=3]

    608. 

  608. # Login Plugins Password Reset And Redirect 2

    609. 

  609. RewriteCond %{QUERY_STRING} action=rp&key=(.*) [NC]

    610. 

  610. RewriteRule . - [S=2]\n

    611. 

  611. # ALLOW THUMBNAILER SCRIPTS TO DISPLAY IMAGES

    612. 

  612. # By default BPS is forbidding allowing these thumbnailer scripts filename requests

    613. 

  613. # This will Log lots of hacking attempts on your website in your BPS Pro Error Log

    614. 

  614. # If you are using one of these thumbnailer scripts on your website and you want to allow

    615. 

  615. # your thumbnailer script images to display then change [F,L] to [S=1]

    616. 

  616. # Make sure that you have a security patched version or recent versions of these scripts

    617. 

  617. # before changing [F,L] to [S=1] and allowing these files to be requested on your website

    618. 

  618. # If you delete or remove the RewriteRule below you will need to change the above skip rules

    619. 

  619. # Example: RewriteRule S=2 above will need to be changed to S=1, change S=3 to S=2, etc.

    620. 

  620. RewriteCond %{REQUEST_FILENAME} thumb.php [NC,OR]

    621. 

  621. RewriteCond %{REQUEST_FILENAME} thumbs.php [NC,OR]

    622. 

  622. RewriteCond %{REQUEST_FILENAME} timthumb.php [NC,OR]

    623. 

  623. RewriteCond %{REQUEST_FILENAME} phpthumb.php [NC]

    624. 

  624. RewriteRule . - [F,L]\n

    625. 

  625. # BPSQSE BPS QUERY STRING EXPLOITS

    626. 

  626. # The libwww-perl User Agent is forbidden - Many bad bots use libwww-perl modules, but some good bots use it too.

    627. 

  627. # Good sites such as W3C use it for their W3C-LinkChecker. 

    628. 

  628. # Add or remove user agents temporarily or permanently from the first User Agent filter below.

    629. 

  629. # If you want a list of bad bots / User Agents to block then scroll to the end of this file.

    630. 

  630. RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]

    631. 

  631. RewriteCond %{HTTP_USER_AGENT} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]

    632. 

  632. RewriteCond %{HTTP_USER_AGENT} (;|<|>|'|".'"'."|\)|\(|%0A|%0D|%22|%27|%28|%3C|%3E|%00).*(libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]

    633. 

  633. RewriteCond %{THE_REQUEST} \?\ HTTP/ [NC,OR]

    634. 

  634. RewriteCond %{THE_REQUEST} \/\*\ HTTP/ [NC,OR]

    635. 

  635. RewriteCond %{THE_REQUEST} etc/passwd [NC,OR]

    636. 

  636. RewriteCond %{THE_REQUEST} cgi-bin [NC,OR]

    637. 

  637. RewriteCond %{THE_REQUEST} (\\r|\\n|%0A|%0D) [NC,OR]

    638. 

  638. RewriteCond %{REQUEST_URI} owssvr\.dll [NC,OR]

    639. 

  639. RewriteCond %{HTTP_REFERER} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]

    640. 

  640. RewriteCond %{HTTP_REFERER} \.opendirviewer\. [NC,OR]

    641. 

  641. RewriteCond %{HTTP_REFERER} users\.skynet\.be.* [NC,OR]

    642. 

  642. RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]

    643. 

  643. RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]

    644. 

  644. RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]

    645. 

  645. RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC,OR]

    646. 

  646. RewriteCond %{QUERY_STRING} \.\./\.\. [OR]

    647. 

  647. RewriteCond %{QUERY_STRING} ftp\: [NC,OR]

    648. 

  648. RewriteCond %{QUERY_STRING} http\: [NC,OR] 

    649. 

  649. RewriteCond %{QUERY_STRING} https\: [NC,OR]

    650. 

  650. RewriteCond %{QUERY_STRING} \=\|w\| [NC,OR]

    651. 

  651. RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]

    652. 

  652. RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR]

    653. 

  653. RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]

    654. 

  654. RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]

    655. 

  655. RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]

    656. 

  656. RewriteCond %{QUERY_STRING} (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR] 

    657. 

  657. RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]

    658. 

  658. RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]

    659. 

  659. RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]

    660. 

  660. RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]

    661. 

  661. RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>).* [NC,OR]

    662. 

  662. RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [OR]

    663. 

  663. RewriteCond %{QUERY_STRING} (\./|\../|\.../)+(motd|etc|bin) [NC,OR]

    664. 

  664. RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]

    665. 

  665. RewriteCond %{QUERY_STRING} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]

    666. 

  666. RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]

    667. 

  667. RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]

    668. 

  668. RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]

    669. 

  669. RewriteCond %{QUERY_STRING} (;|<|>|'|".'"'."|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]

    670. 

  670. RewriteCond %{QUERY_STRING} (sp_executesql) [NC]

    671. 

  671. RewriteRule ^(.*)$ - [F,L]\n";

    672. 

  672. 

    673. 

  673. $bps_secure_content_mid_bottom = "RewriteCond %{REQUEST_FILENAME} !-f

    674. 

  674. RewriteCond %{REQUEST_FILENAME} !-d

    675. 

  675. RewriteRule . $bps_get_wp_root_secure"."index.php [L]\n\n";

    676. 

  676. 

    677. 

  677. $bps_secure_content_bottom = "# DENY BROWSER ACCESS TO THESE FILES 

    678. 

  678. # wp-config.php, bb-config.php, php.ini, php5.ini, readme.html

    679. 

  679. # Replace Allow from 88.77.66.55 with your current IP address and remove the  

    680. 

  680. # pound sign # from in front of the Allow from line of code below to access these

    681. 

  681. # files directly from your browser.\n

    682. 

  682. <FilesMatch ".'"'."^(wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)".'"'.">

    683. 

  683. Order allow,deny

    684. 

  684. Deny from all

    685. 

  685. #Allow from 88.77.66.55

    686. 

  686. </FilesMatch>\n

    687. 

  687. # IMPORTANT!!! DO NOT DELETE!!! the END WordPress text below

    688. 

  688. # END WordPress\n

    689. 

  689. # BLOCK HOTLINKING TO IMAGES

    690. 

  690. # To Test that your Hotlinking protection is working visit http://altlab.com/htaccess_tutorial.html

    691. 

  691. #RewriteEngine On

    692. 

  692. #RewriteCond %{HTTP_REFERER} !^https?://(www\.)?add-your-domain-here\.com [NC]

    693. 

  693. #RewriteCond %{HTTP_REFERER} !^$

    694. 

  694. #RewriteRule .*\.(jpeg|jpg|gif|bmp|png)$ - [F]\n

    695. 

  695. # BLOCK MORE BAD BOTS RIPPERS AND OFFLINE BROWSERS

    696. 

  696. # If you would like to block more bad bots you can get a blacklist from

    697. 

  697. # http://perishablepress.com/press/2007/06/28/ultimate-htaccess-blacklist/

    698. 

  698. # You should monitor your site very closely for at least a week if you add a bad bots list

    699. 

  699. # to see if any website traffic problems or other problems occur.

    700. 

  700. # Copy and paste your bad bots user agent code list directly below.";

    701. 

  701. 

    702. 

  702. // Create Secure htaccess master Root file - Single Site

    703. 

  703. if (isset($_POST['bps-auto-write-secure-root']) && current_user_can('manage_options')) {

    704. 

  704. 	check_admin_referer( 'bulletproof_security_auto_write_secure_root' );

    705. 

  705. 

    706. 

  706. 	if (is_writable($bps_auto_write_secure_file)) {

    707. 

  707. 	if (!$handle = fopen($bps_auto_write_secure_file, 'w+b')) {

    708. 

  708.          _e('<font color="red"><strong>Cannot open file' . "$bps_auto_write_secure_file" . '</strong></font>');

    709. 

  709.          exit;

    710. 

  710.     }

    711. 

  711.     if (fwrite($handle, $bps_secure_content_top.$bps_secure_content_mid_top.$bps_secure_content_mid_bottom.$bps_secure_content_bottom) === FALSE) {

    712. 

  712.         _e('<font color="red"><strong>Cannot write to file' . "$bps_auto_write_secure_file" . '</strong></font>');

    713. 

  713.         exit;

    714. 

  714.     }

    715. 

  715.     _e($bpsSuccessMessageSec);

    716. 

  716.     fclose($handle);

    717. 

  717. 	} else {

    718. 

  718.     _e($bpsFailMessageSec);

    719. 

  719. 	}

    720. 

  720. }

    721. 

  721. 

    722. 

  722. // Create Secure htaccess master Root file - MU Subdirectory

    723. 

  723. if (isset($_POST['bps-auto-write-secure-root-MUSDir']) && current_user_can('manage_options')) {

    724. 

  724. 	check_admin_referer( 'bulletproof_security_auto_write_secure_root_MUSDir' );

    725. 

  725. 

    726. 

  726. 	if (is_writable($bps_auto_write_secure_file)) {

    727. 

  727. 	if (!$handle = fopen($bps_auto_write_secure_file, 'w+b')) {

    728. 

  728.          _e('<font color="red"><strong>Cannot open file' . "$bps_auto_write_secure_file" . '</strong></font>');

    729. 

  729.          exit;

    730. 

  730.     }

    731. 

  731.     if (fwrite($handle, $bps_secure_content_top.$bpsMUSDirTop.$bps_secure_content_mid_top.$bpsMUSDirBottom.$bps_secure_content_bottom) === FALSE) {

    732. 

  732.         _e('<font color="red"><strong>Cannot write to file' . "$bps_auto_write_secure_file" . '</strong></font>');

    733. 

  733.         exit;

    734. 

  734.     }

    735. 

  735.     _e($bpsSuccessMessageSec);

    736. 

  736.     fclose($handle);

    737. 

  737. 	} else {

    738. 

  738.     _e($bpsFailMessageSec);

    739. 

  739. 	}

    740. 

  740. }

    741. 

  741. 

    742. 

  742. // Create Secure htaccess master Root file - MU Subdomain

    743. 

  743. if (isset($_POST['bps-auto-write-secure-root-MUSDom']) && current_user_can('manage_options')) {

    744. 

  744. 	check_admin_referer( 'bulletproof_security_auto_write_secure_MUSDom' );

    745. 

  745. 

    746. 

  746. 	if (is_writable($bps_auto_write_secure_file)) {

    747. 

  747. 	if (!$handle = fopen($bps_auto_write_secure_file, 'w+b')) {

    748. 

  748.          _e('<font color="red"><strong>Cannot open file' . "$bps_auto_write_secure_file" . '</strong></font>');

    749. 

  749.          exit;

    750. 

  750.     }

    751. 

  751.     if (fwrite($handle, $bps_secure_content_top.$bpsMUSDomTop.$bps_secure_content_mid_top.$bpsMUSDomBottom.$bps_secure_content_bottom) === FALSE) {

    752. 

  752.         _e('<font color="red"><strong>Cannot write to file' . "$bps_auto_write_secure_file" . '</strong></font>');

    753. 

  753.         exit;

    754. 

  754.     }

    755. 

  755.     _e($bpsSuccessMessageSec);

    756. 

  756.     fclose($handle);

    757. 

  757. 	} else {

    758. 

  758.     _e($bpsFailMessageSec);

    759. 

  759. 	}

    760. 

  760. }

    761. 

  761. 

    762. 

  762. // Create the Maintenance Mode Settings Values Form File - values from DB

    763. 

  763. if (isset($_POST['bps-maintenance-create-values_submit']) && current_user_can('manage_options')) {

    764. 

  764. 	check_admin_referer( 'bulletproof_security_create_values_form' );

    765. 

  765. 	

    766. 

  766. 	$options = get_option('bulletproof_security_options_maint');

    767. 

  767. 	$bps_retry_after_write = $options['bps-retry-after'];

    768. 

  768. 	$bps_site_title_write = $options['bps-site-title'];

    769. 

  769. 	$bps_message1_write = $options['bps-message-1'];

    770. 

  770. 	$bps_message2_write = $options['bps-message-2'];

    771. 

  771. 	$bps_body_background_image_write = $options['bps-background-image'];

    772. 

  772. 	$bps_auto_write_maint_file_form = ABSPATH . 'wp-content/plugins/bulletproof-security/admin/htaccess/bps-maintenance-values.php';

    773. 

  773. $bps_maint_content_form = "<?php".'

    774. 

  774. $bps_retry_after'." = '$bps_retry_after_write';\n"

    775. 

  775. .'$bps_site_title'." = '$bps_site_title_write';\n"

    776. 

  776. .'$bps_message1'." = '$bps_message1_write';\n"

    777. 

  777. .'$bps_message2'." = '$bps_message2_write';\n"

    778. 

  778. .'$bps_body_background_image'." = '$bps_body_background_image_write';

    779. 

  779. ?>";

    780. 

  780. 	if (is_writable($bps_auto_write_maint_file_form)) {

    781. 

  781. 	if (!$handle = fopen($bps_auto_write_maint_file_form, 'w+b')) {

    782. 

  782.          _e('<font color="red"><strong>Cannot open file' . "$bps_auto_write_maint_file_form" . '</strong></font>');

    783. 

  783.          exit;

    784. 

  784.     }

    785. 

  785.     if (fwrite($handle, $bps_maint_content_form) === FALSE) {

    786. 

  786.         _e('<font color="red"><strong>Cannot write to file' . "$bps_auto_write_maint_file_form" . '</strong></font>');

    787. 

  787.         exit;

    788. 

  788.     }

    789. 

  789.     _e('<font color="green"><strong>Success! Your Maintenance Mode Form has been created successfully! Click the Preview button to preview your Website Under Maintenance page.</strong></font>');

    790. 

  790.     fclose($handle);

    791. 

  791. 	} else {

    792. 

  792.     _e('<font color="red"><strong>The file ' . "$bps_auto_write_maint_file_form" . ' is not writable or does not exist.</strong></font><br><strong>Check that the bps-maintenance-values.php file exists in the /bulletproof-security/admin/htaccess master folder. If this is not the problem click <a href="http://www.ait-pro.com/aitpro-blog/2566/bulletproof-security-plugin-support/bulletproof-security-error-messages" target="_blank">here</a> for more help info.</strong><br>');

    793. 

  793. 	}

    794. 

  794. }

    795. 

  795. 

    796. 

  796. // Simple Secure Old School PHP file upload

    797. 

  797. if (isset($_POST['submit-bps-upload']) && current_user_can('manage_options')) {

    798. 

  798. 	check_admin_referer( 'bulletproof_security_upload' );

    799. 

  799. 	

    800. 

  800. 	$tmp_file = $_FILES['bps_file_upload']['tmp_name'];

    801. 

  801. 	$folder_path = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/';

    802. 

  802. 	$bps_uploaded_file =  str_replace('//','/',$folder_path) . $_FILES['bps_file_upload']['name'];

    803. 

  803. 	if (!empty($_FILES)) {

    804. 

  804. 	move_uploaded_file($tmp_file,$bps_uploaded_file);

    805. 

  805. 		_e('<font color="black"><strong>File Upload Path and File Name: </strong></font><br>');

    806. 

  806. 		echo "$bps_uploaded_file";

    807. 

  807. 	} else {

    808. 

  808. 		_e('<font color="red"><strong>File upload error. File was not successfully uploaded.</strong></font><br>');

    809. 

  809. 	}

    810. 

  810. }

    811. 

  811. 

    812. 

  812. // Enable File Downloading for Master Files - writes a new denyall htaccess file with the current IP address

    813. 

  813. if (isset($_POST['bps-enable-download']) && current_user_can('manage_options')) {

    814. 

  814. 	check_admin_referer( 'bulletproof_security_enable_download' );

    815. 

  815. 	

    816. 

  816. 	$bps_get_IP = $_SERVER['REMOTE_ADDR'];

    817. 

  817. 	$denyall_htaccess_file = ABSPATH . '/wp-content/plugins/bulletproof-security/admin/htaccess/.htaccess';

    818. 

  818. 	$bps_denyall_content = "order deny,allow\ndeny from all\nallow from $bps_get_IP";

    819. 

  819. 	

    820. 

  820. 	if (is_writable($denyall_htaccess_file)) {

    821. 

  821. 	if (!$handle = fopen($denyall_htaccess_file, 'w+b')) {

    822. 

  822.          _e('<font color="red"><strong>Cannot open file' . "$denyall_htaccess_file" . '</strong></font>');

    823. 

  823.          exit;

    824. 

  824.     }

    825. 

  825.     if (fwrite($handle, $bps_denyall_content) === FALSE) {

    826. 

  826.         _e('<font color="red"><strong>Cannot write to file' . "$denyall_htaccess_file" . '</strong></font>');

    827. 

  827.         exit;

    828. 

  828.     }

    829. 

  829.     _e('<font color="green"><strong>Success! File open, preview and downloading for your BPS Master Files is enabled for your IP address only ===' . "$bps_get_IP." .'</strong></font>');

    830. 

  830.     fclose($handle);

    831. 

  831. 	} else {

    832. 

  832.     _e('<font color="red"><strong>The file ' . "$denyall_htaccess_file" . ' is not writable or does not exist yet.</strong></font><br><strong>Check the BPS Status page to see if Deny All protection has been activated. Activate Deny All htaccess Folder Protection For The BPS Master htaccess Folder on the BPS Security Modes page. If this is not the problem click <a href="http://www.ait-pro.com/aitpro-blog/2566/bulletproof-security-plugin-support/bulletproof-security-error-messages" target="_blank">here</a> for more help info.</strong><br>');

    833. 

  833. 	}

    834. 

  834. }

    835. 

  835. 

    836. 

  836. // Enable File Downloading for BPS Backup Folder - writes a new denyall htaccess file with the current IP address

    837. 

  837. if (isset($_POST['bps-enable-download-backup']) && current_user_can('manage_options')) {

    838. 

  838. 	check_admin_referer( 'bulletproof_security_enable_download-backup' );

    839. 

  839. 	

    840. 

  840. 	$bps_get_IP2 = $_SERVER['REMOTE_ADDR'];

    841. 

  841. 	$denyall_htaccess_file_backup = ABSPATH . '/wp-content/b…
    842.

Large files files are truncated, but you can click here to view the full file