[Plugin: WordPress Firewall2] How to whitelist a parameter on a page

This seems to be due to a bug which produces an email link missing parts of the address. It misses out wordpress-firewall-2/ from the url e.g. it produces –

https://your-site.com/wp-admin/options-general.php?page=wordpress-firewall-2.php&set_whitelist_variable=option_page

instead of –

https://your-site.com/wp-admin/options-general.php?page=wordpress-firewall-2/wordpress-firewall-2.php&set_whitelist_variable=option_page

something to do with basename(__FILE__) in its code not firing up properly.

In the meantime just add the missing bit to the url to get it to work. It should then automatically add the exception to the whitelist if you look down the page.

I can vouch that this does fix the problem, thanks for posting.

Just wondering when we can expect a fix for this. Thanks for a great plugin.

I just tried it as I was receiving the same message, and I can vouch the solution offered by maduro-blanco WORKS.

I did this and initially got an error message* in the ‘white listed pages’ box on WordPress Firewall settings page.

When I left that page to upgrade the plugin (Slick Social Share Buttons) which was the one flagging a (false) Attack in the first place I now can, and no longer get a warning, also the error message on WF setting page has disappeared, so in that sense it works.

Would be great if the developer could release an upgrade to WF so we don’t need to do this manual workaround in the future.

*I would’ve pasted it here, but I lost it; remember it mentioned line 606/7 though

@goldtop

I think what you meant is:

Warning: unserialize() expects parameter 1 to be string, array given in /home/xxxxxxx/public_html/xxxxxxx.com/wp-content/plugins/wordpress-firewall-2/wordpress-firewall-2.php on line 606

Warning: unserialize() expects parameter 1 to be string, array given in /home/xxxxxxx/public_html/xxxxxxx.com/wp-content/plugins/wordpress-firewall-2/wordpress-firewall-2.php on line 607

I’m getting the same error when trying to whitelist a variable. Would be great if that would get fixed.

For now I have to vote plug-in “not working”

This isn’t working for me. It just sends me to my login page. How do I whitelist false positives? Thank you!

The developer, Pavy, reported eight months ago:

I understand everyone’s frustration with this issue. Please understand that my full-time job must come before this, as well as many other things.

I do fully intend to update WordPress Firewall 2 as soon as possible. I’ve had some fixes and a few new features already done, literally for months now. I know I said it would be much, much sooner; I know a lot of time has gone by. Regardless of how much I can get done in the next 1-2 weeks, I will release an update, so you all can see at least some progress.

Please continue to report issues – I do check this forum, I am aware of the most annoying problems, and I do intend to have at least the serialize/unserialize issue fixed in this update.

A final note, the serialize/unserialize errors are not fatal errors. WF2 will continue to operate, even when encountering these errors. If you have WF2 installed, even if you get these errors, the plugin is still protecting your site.

@stonecoldcnc

To fix the warning you can modify the wordpress-firewall-2.php and replace unserialize() with maybe_unserialize(). I recently fixed this issue.

Refer the below link for more details.
https://core.trac.www.ads-software.com/ticket/12930