Suspicious Code Newspaper v 8.8.2

Posted in: Newspaper
Post count: 8
mscgluk
#241350
Jun 28, 2018 at 10:34 pm

Vaultpress reports Suspicious Code

Unsanitized PHP global variables are being used to include or require other files.

wpeditor.php require_once( $_GET[‘wp_path’] . ‘/wp-load.php’ );

Vaultpress reacted on this within 5 min after upgrading to 8.8.2 !

Post count: 23312
Catalin
#241444
Jun 29, 2018 at 11:25 am

Hello mscgluk,

Thank you for your suggestion! I have added this to our list of improvements and fixes and we hope to solve it as soon as possible.

Thanks.

Post count: 23312
Catalin
#241499
Jun 29, 2018 at 3:28 pm

Hello mscgluk,

Regarding this topic, please notice there is no problem regarding on this code. Please keep in mind that we use the wpeditor.php to bring the TinyMCE editor from WordPress when you use the TD Composer in front-end editor. For achieving this functionality, we need to access the core file which opens this editor from WordPress and this file is wp-load.php. To access this file we have to create the right path which access this file from WordPress and which is different depending on the user. The $_GET[‘wp_path’] is used to create the file path and there is no suspicious code because of that link is sent by us.

Thanks for your understanding!

Post count: 8
mscgluk
#241581
Jun 29, 2018 at 11:32 pm

Thanks. It was the vaultpress security program for WordPress that reported it as suspicious code – so that was the reason for that I raised it. Thanks for the information.

Post count: 7
Wibbly
#241596
Jun 30, 2018 at 5:55 am

Vaultpress is the security framework provided as part of the Jetpack WordPress add-on service.

You will be receiving a lot more queries about this, as many people use this service!

Viewing 5 posts - 1 through 5 (of 5 total)
You must be logged in to reply to this topic.