Did scan and saying eval functions in W3 Total Cache PHP plugin code?
-
Hi there, I did a scan using Stop Spammers (latest Version 6.07) and it is saying there is eval functions in the W3 Total Cache PHP plugin code?
It said “These are warnings, only. Some content and plugins might not be malicious, but still contain one or more of these indicators. Please investigate all indications of problems. The plugin may err on the side of caution.
Although there are legitimate reasons for using the eval function, and javascript uses it frequently, finding eval in PHP code is in the very least bad practice, and the worst is used to hide malicious code. If eval() comes up in a scan, try to get rid of it.”
So if it’s bad practice to use it in PHP, could you find a way to recode the PHP please.
Here is what the scan found:
/home/site/domains/example.com/public_html/wp-content/../wp-content/plugins/w3-total-cache/inc/functions/multisite.php 18: $blog_ids = @eval($data); /home/site/domains/example.com/public_html/wp-content/../wp-content/plugins/w3-total-cache/inc/define.php 489: $blog_data = @eval($data); /home/site/domains/example.com/public_html/wp-content/../wp-content/plugins/w3-total-cache/lib/SNS/sdk.class.php 522: return new $self($key, $secret_key, $token); /home/site/domains/example.com/public_html/wp-content/../wp-content/plugins/w3-total-cache/lib/SNS/utilities/simplexml.class.php 98: return new $self($data, $options, $data_is_url, $ns, $is_prefix); /home/site/domains/example.com/public_html/wp-content/../wp-content/plugins/w3-total-cache/lib/Minify/FirePHP.php 1035: * Javascript, and can be directly eval()'ed with no further parsing /home/site/domains/example.com/public_html/wp-content/../wp-content/plugins/w3-total-cache/lib/Nusoap/class.soapclient.php 711: eval($evalStr); 713: eval("\$proxy = new nusoap_proxy_$r('');"); 713: eval("\$proxy = new nusoap_proxy_$r('');"); /home/site/domains/example.com/public_html/wp-content/../wp-content/plugins/w3-total-cache/lib/Nusoap/nusoap.php 4047: $this->debug('in invoke_method, calling function using eval()'); 4051: $this->debug('in invoke_method, calling class method using eval()'); 4054: $this->debug('in invoke_method, calling instance method using eval()'); 4073: @eval($funcCall); 7867: eval($evalStr); 7869: eval("\$proxy = new nusoap_proxy_$r('');"); 7869: eval("\$proxy = new nusoap_proxy_$r('');"); /home/site/domains/example.com/public_html/wp-content/../wp-content/plugins/w3-total-cache/lib/W3/ConfigData.php 135: $config = @eval(substr($content, 5)); /home/site/domains/example.com/public_html/wp-content/../wp-content/plugins/w3-total-cache/lib/W3/Config.php 148: $config = eval($data); /home/site/domains/example.com/public_html/wp-content/../wp-content/plugins/w3-total-cache/lib/W3/PgCache.php 1360: $result = eval($code);
Screenshot of scan here:
https://www.dropbox.com/s/dhclliwf3d2cdrl/Screen%20Shot%202015-03-10%20at%202.03.52%20pm.pngThanks for your time.
P.S. I changed the directory to example.com before creating to the screenshot for privacy reasons ??
- The topic ‘Did scan and saying eval functions in W3 Total Cache PHP plugin code?’ is closed to new replies.