[Plugin: Timthumb Vulnerability Scanner] Does not use latest timthumb.php to "fix" problem

Peter, ran into my first snag since using 1.42. I installed it on a site that’s never had the scanner before. Look at these weird results… shows I have two old versions, but it says they are “up to date”? Also, it says the latest version is ” ” — I am guessing that is the problem… it had some issue with fetching the latest version?

Scan Results

The latest version of the Timthumb script is . The oldest safe version is version . Last scan run 1 min ago.

Status Version Filename Full Path
Up to Date 1.12 thumbnail.php /home/exampleu/public_html/example.com/wp-content/themes/headway-166/library/resources/timthumb/thumbnail.php
Up to Date 1.09 timthumb.php /home/exampleu/public_html/example.com/wp-content/themes/comet.1.3.0/comet/scripts/timthumb.php

Hey Sneader –

First of all, thanks for all the help – it’s hugely appreciated.

As for your issue: THe plugin has to go out and check for the latest plugin version, and it looks like my error checking logic is less than stellar if something happens (i.e. for whatever reason, the request doesn’t work). I’ve got a fix in the works that should ensure you never end up in your situation (empty “latest version” and “safe version” values), but in the meantime, try deactivating and reactivating the plugin. That should clear your data and then request those values again (on reactivation) – so, assuming the reason the request didn’t work last time is not persistent, you should get good data.

I should have an update out that does a better job of handling this tomorrow sometime.

Thanks!

Bingo — you are right! Deactivate/Activate made it see that the latest version is 2.8.2! Thanks!!

Hi Peter. I am being offered the 1.4.3, but even after upgrading, when I scan on this one particular WP install, it still shows my two old Timthumb installs (v 1.12 and v1.09) as “Up to Date”. Thoughts?

This is a small, non-critical WP install — if it would help you to be able to log in and look for yourself, I’d be happy to let you in.

I deactivated 1.43, then reactivated, and it now sees that these are old and vulnerable.

Hey Sneader – On the site that had the problem most recently – did you upgrade to 1.42, have the problem, and then upgrade to 1.43, and continue seeing it until deactivating/reactivating?

Yes. I’m going to try some more, but I have a feeling it was a left-over issue from trying the various upgrades… I bet folks that start with 1.43 aren’t going to see this.

I’m guessing (hoping) that’s the case, as I’m running out of ideas for how that could happen. Still – keep me updated if you run into the issue (or any other issue) – it’s a big help to me.

Thanks!