FM / wp66

/var/softaculous/wp66

Name	Size	Mode	Actions
images/	-	0755	rm
languages/	-	0755	rm
php53/	-	0755	rm
php56/	-	0755	rm
php71/	-	0755	rm
php81/	-	0755	rm
php82/	-	0755	rm
plugins/	-	0755	rm
.htaccess	482	0644	edit dl rm
add_user.php	461	0644	edit dl rm
backup.php	3111	0644	edit dl rm
check_charset.php	2067	0644	edit dl rm
clone.php	32995	0644	edit dl rm
clone.xml	497	0644	edit dl rm
edit.php	9709	0644	edit dl rm
edit.xml	1801	0644	edit dl rm
extend.php	95957	0644	edit dl rm
fileindex.php	291	0644	edit dl rm
import.php	6677	0644	edit dl rm
info.xml	15266	0644	edit dl rm
install.js	925	0644	edit dl rm
install.php	31447	0644	edit dl rm
install.xml	9949	0644	edit dl rm
md5	5195	0644	edit dl rm
notes.txt	6250	0644	edit dl rm
plugin_activate.php	596	0644	edit dl rm
plugin_deactivate.php	613	0644	edit dl rm
sign_on.php	3489	0644	edit dl rm
soft.htaccess	127	0644	edit dl rm
upgrade.php	14394	0644	edit dl rm
upgrade.xml	1665	0644	edit dl rm
wp-config.php	2883	0644	edit dl rm
_htaccess	553	0644	edit dl rm
_index.php	59	0644	edit dl rm
_wp-config.php	3176	0644	edit dl rm

Edit: /var/softaculous/wp66/sign_on.php (3489B)

<?php

// Suppress errors just for login.
if(function_exists('ini_set')){
	ini_set('display_errors', '0');
}
define('WP_DEBUG', false);

if(!class_exists('Redis') && !file_exists('[[softpath]]/wp-content/object-cache.php')){
	@unlink(__FILE__);
}

// Validate if the request is from Softaculous
if($_REQUEST['pass'] != '[[autopass]]'){
	die("Unauthorized Access");
}

if(isset($_REQUEST['FLUSH_CACHE'])){
	
	@unlink(__FILE__);

define( 'WP_USE_THEMES', false );
	require __DIR__ . '/wp-blog-header.php';

wp_cache_flush();

// Redirect to admin page or requested page
	$redirect_to = admin_url();
	if(!empty($_REQUEST['redirect_to'])){
		$redirect_to = $_REQUEST['redirect_to'];
	}
	wp_safe_redirect( $redirect_to );

exit();
}

// Dummy plugin dir so that no plugins are loaded as they conflict with our login process
define('WPMU_PLUGIN_DIR', '[[softpath]]/[[autopass]]');
define('WP_PLUGIN_DIR', '[[softpath]]/[[autopass]]');
define('WP_CONTENT_DIR', '[[softpath]]/[[autopass]]');
define('WP_USE_THEMES', false);

// Some themes check the current login script name
$_SERVER['SCRIPT_NAME'] = '/wp-login.php';

require('wp-blog-header.php');
require('wp-includes/pluggable.php');

// If the user is already logged in simply redirect to admin page
if(!is_user_logged_in()){
	
	$signon_user = '[[signon_username]]';

//Backword compatibility ($__setting['signon_username'] won't be there in previous versions <= 5.2.3)
	if(!empty($signon_user) && !preg_match('/^\[\[(.*?)\]\]$/is', $signon_user)){
		$user = get_user_by('login', $signon_user);
	}else{
		$user_info = get_userdata(1);
		
		// Try to find an admin if we do not have any admin with ID => 1 or if ID 1 does not have administrator role
		if (empty($user_info) || empty($user_info->user_login) || !in_array('administrator', $user_info->roles)) {
			$admin_id = get_users(array('role__in' => array('administrator'), 'number' => 1, 'fields' => array('ID')));
			$user_info = get_userdata($admin_id[0]->ID);
		}
		
		$username = $user_info->user_login;
		$user = get_user_by('login', $username);
	}
	
	// Create the session
	if(!is_wp_error($user)){
		wp_clear_auth_cookie();
		wp_set_current_user($user->ID);
		wp_set_auth_cookie($user->ID);
		
		// Create a session for wp-simple-firewall plugin
		if(file_exists(dirname(__FILE__).'/wp-content/plugins/wp-simple-firewall')){
			
			try{
				
				global $wpdb;
				
				$wpsf_session_id = md5(uniqid('icwp-wpsf'));
				
				$wpdb->insert($wpdb->prefix."icwp_wpsf_sessions", array(
				   "session_id" => $wpsf_session_id,
				   "wp_username" => $user->user_login,
				   "ip" => $_SERVER['REMOTE_ADDR'],
				   "browser" => md5($_SERVER['HTTP_USER_AGENT']),
				   "last_activity_uri" => "/wp-login.php",
				   "logged_in_at" => time(),
				   "last_activity_at" => time(),
				   "login_intent_expires_at" => 0,
				   "secadmin_at" => 0,
				   "created_at" => time(),
				   "deleted_at" => 0,
				));
				
				setcookie("wp-icwp-wpsf", $wpsf_session_id, time()+ DAY_IN_SECONDS * 30);
				
			} catch(Exception $e){
				
			}
		}
	}
}

if(class_exists('Redis') || file_exists('[[softpath]]/wp-content/object-cache.php')){
	// Redirect to flush cache
	$redirect_to = $_SERVER['REQUEST_URI'].'&FLUSH_CACHE=1';
	wp_safe_redirect( $redirect_to );
	exit();
}
@unlink(__FILE__);

// Redirect to admin page or requested page
$redirect_to = admin_url();
if(!empty($_REQUEST['redirect_to'])){
	$redirect_to = $_REQUEST['redirect_to'];
}
wp_safe_redirect( $redirect_to );

exit();

1 or if ID 1 does not have administrator role if (empty($user_info) || empty($user_info->user_login) || !in_array('administrator', $user_info->roles)) { $admin_id = get_users(array('role__in' => array('administrator'), 'number' => 1, 'fields' => array('ID'))); $user_info = get_userdata($admin_id[0]->ID); } $username = $user_info->user_login; $user = get_user_by('login', $username); } // Create the session if(!is_wp_error($user)){ wp_clear_auth_cookie(); wp_set_current_user($user->ID); wp_set_auth_cookie($user->ID); // Create a session for wp-simple-firewall plugin if(file_exists(dirname(__FILE__).'/wp-content/plugins/wp-simple-firewall')){ try{ global $wpdb; $wpsf_session_id = md5(uniqid('icwp-wpsf')); $wpdb->insert($wpdb->prefix."icwp_wpsf_sessions", array( "session_id" => $wpsf_session_id, "wp_username" => $user->user_login, "ip" => $_SERVER['REMOTE_ADDR'], "browser" => md5($_SERVER['HTTP_USER_AGENT']), "last_activity_uri" => "/wp-login.php", "logged_in_at" => time(), "last_activity_at" => time(), "login_intent_expires_at" => 0, "secadmin_at" => 0, "created_at" => time(), "deleted_at" => 0, )); setcookie("wp-icwp-wpsf", $wpsf_session_id, time()+ DAY_IN_SECONDS * 30); } catch(Exception $e){ } } } } if(class_exists('Redis') || file_exists('[[softpath]]/wp-content/object-cache.php')){ // Redirect to flush cache $redirect_to = $_SERVER['REQUEST_URI'].'&FLUSH_CACHE=1'; wp_safe_redirect( $redirect_to ); exit(); } @unlink(__FILE__); // Redirect to admin page or requested page $redirect_to = admin_url(); if(!empty($_REQUEST['redirect_to'])){ $redirect_to = $_REQUEST['redirect_to']; } wp_safe_redirect( $redirect_to ); exit();