Bulletproof Security breaks WangGuard admin

Wanguard installation & Testing environment and site types:
XAMPP:
Single/Standard WordPress installation:
Network/Multisite – plugin was Network Activated:
Network/Multisite Permalink Structure: /blog/%postname%/
NOTE: Testing was done on XAMPP and not a Live Hosted site.

There is no iframe on a single/standard WordPress installation/site.
There is an iframe on a Network/Multisite WordPress installation/site.

Wanguard only loads in the Network Admin panel/console and not the Primary or Subsites.

Clicking the iframe link from the Network Admin console to display subsites works fine on a Network/Multisite site – no errors/the iframe displays the subsite correctly.

Testing Summary:
It appears that out of the box there are no conflicts or issues between BPS and Wanguard on Single/Standard and Network/Multisite sites.

Suggestions for troubleshooting:
– Please ensure that the user is using a valid custom permalink structure and not some sort of permalink hack such as .html.
– Please ensure that the user has clicked the AutoMagic buttons before activating BulletProof Modes.
– Please deactivate all other plugins for testing and test only BPS and Wanguard together.

BPS Troubleshooting Steps
https://forum.ait-pro.com/forums/topic/read-me-first-free/#bps-free-general-troubleshooting

Other very common problems:
cPanel HotLink Protection Tool Problem
https://forum.ait-pro.com/forums/topic/read-me-first-free/#cpanel-hotlink-protection

WordPress flush_rewrite_rules function problem
https://forum.ait-pro.com/forums/topic/read-me-first-free/#flush-rewrite-rules

Wanguard php errors unrelated to BPS that occurred on plugin activation:

PHP Errors on Wanguard plugin Activation
PHP Errors on a Single/Standard WordPress installation

[13-Jun-2014 19:27:33 UTC] PHP Warning:  Missing argument 2 for add_site_option(), called in C:\xampp2\htdocs16\demo9\wp-content\plugins\wangguard\wangguard-core.php on line 63 and defined in C:\xampp2\htdocs16\demo9\wp-includes\option.php on line 1010

[13-Jun-2014 19:27:34 UTC] WordPress database error Table 'demo9.odkh36_wangguardoptions' doesn't exist for query INSERT INTO <code>odkh36_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard_stats'  ,  '' ) made by do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

[13-Jun-2014 19:27:34 UTC] WordPress database error Table 'demo9.odkh36_wangguardoptions' doesn't exist for query INSERT INTO <code>odkh36_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard-enable-bp-report-btn'  ,  '' ) made by do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

[13-Jun-2014 19:27:34 UTC] WordPress database error Table 'demo9.odkh36_wangguardoptions' doesn't exist for query INSERT INTO <code>odkh36_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard-report-posts'  ,  '' ) made by do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

[13-Jun-2014 19:27:34 UTC] WordPress database error Table 'demo9.odkh36_wangguardoptions' doesn't exist for query INSERT INTO <code>odkh36_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard-expertmode'  ,  '' ) made by do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

[13-Jun-2014 19:27:34 UTC] WordPress database error Table 'demo9.odkh36_wangguardoptions' doesn't exist for query INSERT INTO <code>odkh36_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard-enable-bp-report-btn'  ,  '' ) made by do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

[13-Jun-2014 19:27:34 UTC] WordPress database error Table 'demo9.odkh36_wangguardoptions' doesn't exist for query INSERT INTO <code>odkh36_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard-enable-bp-report-blog'  ,  '' ) made by do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

PHP Errors on a Network/Multisite WordPress installation

[13-Jun-2014 19:34:50 UTC] PHP Warning:  Missing argument 2 for add_site_option(), called in C:\xampp2\htdocs6\multi-3-4-2\wp-content\plugins\wangguard\wangguard-core.php on line 63 and defined in C:\xampp2\htdocs6\multi-3-4-2\wp-includes\option.php on line 1010

[13-Jun-2014 19:34:51 UTC] WordPress database error Table 'multi-3-4-2.v3imx4_wangguardoptions' doesn't exist for query INSERT INTO <code>v3imx4_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard_stats'  ,  '' ) made by require_once('C:\xampp2\htdocs6\multi-3-4-2\wp-admin\admin.php'), do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

[13-Jun-2014 19:34:51 UTC] WordPress database error Table 'multi-3-4-2.v3imx4_wangguardoptions' doesn't exist for query INSERT INTO <code>v3imx4_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard-enable-bp-report-btn'  ,  '' ) made by require_once('C:\xampp2\htdocs6\multi-3-4-2\wp-admin\admin.php'), do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

[13-Jun-2014 19:34:51 UTC] WordPress database error Table 'multi-3-4-2.v3imx4_wangguardoptions' doesn't exist for query INSERT INTO <code>v3imx4_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard-report-posts'  ,  '' ) made by require_once('C:\xampp2\htdocs6\multi-3-4-2\wp-admin\admin.php'), do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

[13-Jun-2014 19:34:51 UTC] WordPress database error Table 'multi-3-4-2.v3imx4_wangguardoptions' doesn't exist for query INSERT INTO <code>v3imx4_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard-expertmode'  ,  '' ) made by require_once('C:\xampp2\htdocs6\multi-3-4-2\wp-admin\admin.php'), do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

[13-Jun-2014 19:34:51 UTC] WordPress database error Table 'multi-3-4-2.v3imx4_wangguardoptions' doesn't exist for query INSERT INTO <code>v3imx4_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard-enable-bp-report-btn'  ,  '' ) made by require_once('C:\xampp2\htdocs6\multi-3-4-2\wp-admin\admin.php'), do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

[13-Jun-2014 19:34:51 UTC] WordPress database error Table 'multi-3-4-2.v3imx4_wangguardoptions' doesn't exist for query INSERT INTO <code>v3imx4_wangguardoptions</code> (<code>option_name</code>, <code>option_value</code>) VALUES ( 'wangguard-enable-bp-report-blog'  ,  '' ) made by require_once('C:\xampp2\htdocs6\multi-3-4-2\wp-admin\admin.php'), do_action('admin_init'), call_user_func_array, wangguard_admin_init, wangguard_install, wangguard_update_option

Ok thank you,

The errors on activation is because the wangguard options database doesn’t exist in WGG 1.6. I forgot to remove something in the activation hook, I will take a look,

Thanks a lot.

Yep, they are not significant php errors. I was just letting you know about them.

What is the status on the iframe 500 error?

No response so assuming the problem is resolved.

No, I’m sorry but I haven’t time for testing.

I suppose that in 24-48h I will take a look.

Thank you and I’m sorry for no early response.

Ok no problem. Also we just got BPS Pro 9.0 released today so I have some free time to test wanguard on a Live testing site. Sometimes iframe issues and other issues do not happen on XAMPP and do happen on Live Hosted sites. Will post the results of Live Hosted testing…

Ok thank you.

I do see a 403/500 error on a Live Hosted site. Will post a solution in a minute.

How ironic and timely. The root .htaccess code that we changed in BPS Pro 9.0 and pending for .50.2 fixes the problem. .50.2 should be released anywhere between 4 to 15 days from now.

These old root .htaccess security rules were very problematic.

RewriteCond %{THE_REQUEST} \?\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} \/\*\ HTTP/ [NC,OR]

and have been changed to these new root .htaccess security rules.

RewriteCond %{THE_REQUEST} \?+(%20{1,}|[^\s])+HTTP+(:/|/) [NC,OR]
RewriteCond %{THE_REQUEST} \/+(\*|%2a)+(%20|\s){1,}+HTTP+(:/|/) [NC,OR]

Ok thanks a lot ??

One question, when BPS is updated, all .htaccess are updated or the user have to force the update?

BPS upgrades are completely automated – the old root .htaccess security filters will be automatically replaced with the new root .htaccess security filters. Users do not have to do anything manually.

Just wanted to let you know that we changed the security filters and it looks like we need to make another change/correction. We will release another BPS version as soon as possible.

Incorrect

RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\s+|%20+\s+|\s+%20+|\s+%20+\s+)HTTP(:/|/) [NC,OR]

Correct

RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\s+|%20+\\s+|\\s+%20+|\\s+%20+\\s+)HTTP(:/|/) [NC,OR]

The new filters have been added to BPS .50.4 so this issue is resolved permanently now. Sorry for the delay – These filters gave us fits.

Thanks a lot ??