swarnat

Everything is working. Many Thanks!

Hy,

When you are working on this topic:
I additionally figured our another part, where this is a problem:

The class “tab-content” is not really unusually. So in same file, line ~63, you have:

.tab-content {
   display: none;
 }

I think you understand the problem ??
I also limit this rule to the page of your plugin.

Best Regards,

Stefan

Hy,

Thanks for response.

Yes their solution works, but not on long term.
Their solution is to simple disable the Local File Inclusion protection, which can only be a short term solution.
Do you plugin really needs the absolute path to the linked file? Because I think this is the root cause.

The blocked URL is:
https://example.com/wp-content/uploads/2022/12/document.pdf?uamfiletype=attachment&uamgetfile=%2Fvar%2Fwww%2Fvhosts%2Fexample.com%2Fhttpdocs%2Fwp-content%2Fuploads%2F2022%2F12%2Fdocument.pdf

Would not a

https://example.com/wp-content/uploads/2022/12/document.pdf?uamfiletype=attachment&uamgetfile=2022%2F12%2Fdocument.pdf

also working, because the .htaccess File is placed within wp-content/uploads

But I’m honest, I don’t know if this is a limitation of the method over .htaccess, which is needed to have a secure access check before the files.

Best Regards,

Stefan

• This reply was modified 1 year, 11 months ago by swarnat.
• This reply was modified 1 year, 11 months ago by swarnat.

Thanks for your response.
But both unfortunately is not working.
To add every Attachment is really time intensive with 1000+ uploads and not realistic for End User to do himself.

About your second option:
Only whitelistedParams is supporting parts of string or regex and is only set by your rules.php
The user definable whitelistedURLParams is not supporting this.

(We tried this before writing this request in all possible options: https://img.redoo.click/u8j5/202210181441_ced4b252-4515-42c0-bfef-49c887fc359c.png)

Background, because we verified to not do any mistake:
The check in waf.php is simple don’t support regex or parts of string, because the combination of URL and Parameter is hard check against the URL in wordfence.

$whitelistKey = base64_encode($urlPath) . "|" . base64_encode($paramKey);
/* ... */
if (array_key_exists($whitelistKey, $whitelistedURLParams)) {... */ }

As request: To add regex in this place is really easy. Performance cannot be the reason, because you already check all your rules by using regex.

• This reply was modified 2 years, 1 month ago by swarnat.
• This reply was modified 2 years, 1 month ago by swarnat.

Hy,

That will be great. I found and fix some more issues with the implementation, but will wait and recheck them when you release the new plugin. I hope it’s not too far away.

Let me know, If I could help you in some point.
I could help you with external tests, because I’m also able to hunt and determine issues in code.

Regards,

Stefan

Hy Angelleye,
I got the same error and an empty log file.

03-19-2016 @ 14:07:25 -
03-19-2016 @ 14:07:33 -
03-19-2016 @ 14:09:02 -

Then I started to debug the code and get this:
error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure
I have no idea, why woocommerce don’t write this to the log file. Maybe because the string variable of exception is empty. but message is set.

I remember to read something about Paypal and SSLv3, which could not used anymore in 2016.
And correct: If I force CURL to use TLS1.2 it started to work.

A fast solution:
Add
curl_setopt($ch, CURLOPT_SSLVERSION,6);
in line 91 if file /wp-content/plugins/paypal-for-woocommerce/classes/lib/PayPal/Core/PayPalHttpConnection.php

Hy,
Same here.
But if you look into this file you see, I think Bjoern renamed the constants. You could modify this easily by your own. ??

Stefan

Hy,

Did you found a solution for this?
I run into the same issues and couldn’t specify the reason for this.

Only the NextGEN Gallery is used in my Shop, too.
I have deactivate this plugin, but this don’t solve the problem.

The only solution I found, is the deactivation of “Add to cart Ajax”. Without this option the customers could add products to Shopping cart in 3.5.

I have to rollback to 3.4, until the solution is found.

Stefan