be83910651
auto-patch 280-dev-dev01-2024-01-19T16_41_58 * auto-patch 280-dev-dev01-2024-01-19T16_41_58
16 lines
6.0 KiB
JavaScript
16 lines
6.0 KiB
JavaScript
/*!
|
|
* Project: WP-ZEP - Zero-day exploit Prevention for wp-admin
|
|
* Copyright (c) 2013-2019 tokkonopapa (tokkonopapa@yahoo.com)
|
|
* This software is released under the MIT License.
|
|
*/
|
|
!function(e,t,n){var r=IP_GEO_BLOCK_AUTH,o={init:!1,regexp:new RegExp(r.key+"(?:=|%3D)\\w+")},a=new RegExp("^(?:"+(r.home||"")+r.admin+"|"+(r.home||"")+r.plugins+"|"+(r.home||"")+r.themes+"|"+r.admin+")(?:.*\\.php|.*\\/)?$"),i=function(e){for(var t=e.length,n="request%5Bbrowse%5D="+r.key;t-- >0;)if(-1!==e[t].indexOf(n)){e[t]="request%5Bbrowse%5D=featured";break}return e},h={"upload.php":function(e){for(var t=e.length,n="query%5B"+r.key+"%5D=";t-- >0;)if(-1!==e[t].indexOf(n)){delete e[t];break}return e},"theme-install.php":i,"network/theme-install.php":i};function s(e){var t=(e=e?e.toString():"").match(/^(?:([^:\/?#]+):)?(\/\/([^\/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?/);return{scheme:t[1]||"",relative:t[2]||"",authority:t[3]||"",path:t[4]||"",query:t[5]||"",fragment:t[6]||""}}var c,p=function(){var e=null;try{new URL("/","http://example.com/")}catch(t){try{e=(new DOMParser).parseFromString("<html><head></head><body></body></html>","text/html")}catch(t){e=n.implementation.createHTMLDocument("")}}return function(r,o){var a,i,h,s=n;if(r=void 0!==r?r:t.location.href,null===e){void 0===o&&(o=t.location.href);try{h=new URL(r,o)}catch(e){h=new URL(r,t.location.href)}}else{if(void 0!==o){for(s=e;s.head.firstChild;)s.head.removeChild(s.head.firstChild);(a=s.createElement("base")).setAttribute("href",o),s.head.appendChild(a)}(i=s.createElement("a")).setAttribute("href",r),i.setAttribute("href",i.href),"http:"===(h={protocol:i.protocol,host:i.host,hostname:i.hostname,port:i.port,pathname:i.pathname,search:i.search,hash:i.hash,href:i.href,username:"",password:"",origin:i.origin||null}).protocol&&"80"===h.port?(h.port="",h.host=h.host.replace(/:80$/,"")):"https:"===h.protocol&&"443"===h.port&&(h.port="",h.host=h.host.replace(/:443$/,"")),"http:"!==h.protocol&&"https:"!==h.protocol||(h.pathname&&"/"!==h.pathname.charAt(0)&&(h.pathname="/"+h.pathname),h.origin||(h.origin=h.protocol+"//"+h.hostname+(h.port?":"+h.port:"")))}if(h.username||h.password)throw new URIError(h.username+":"+h.password);return h}}();function l(e,n){"object"!=typeof e&&(e=s(e||t.location.href));for(var o=e.query?e.query.split("&"):[],a=o.length,i=r.key+"=";a-- >0;)if(0===o[a].indexOf(i)){o.splice(a,1);break}return o.push(r.key+"="+encodeURIComponent(n)),e.query=o.join("&"),function(e){return(e.scheme?e.scheme+":":"")+(e.relative+e.path)+(e.query?"?"+e.query:"")+(e.fragment?"#"+e.fragment:"")}(e)}function f(e){return(!e.scheme||/^https?$/.test(e.scheme))&&(e.path||e.query)}function u(e){try{e=e||t.location.pathname||""}catch(t){e=""}var n=s(e.toLowerCase());if(f(n)){if((n=p(e)).origin!==t.location.origin)return-1;if((e=a.exec(n.pathname))&&(0<=e[0].indexOf(r.admin+"admin-")||0<=e[0].indexOf(r.admin)||0<=e[0].indexOf(r.plugins)||0<=e[0].indexOf(r.themes)))return 1}return 0}function m(e){return/\/$/.test(e.path)}function d(e){return-1!==(e.attr("rel")||"").indexOf("nofollow")}
|
|
/*
|
|
* jQuery.bind-first library v0.2.3 (jquery >= 1.7)
|
|
* Copyright (c) 2013 Vladimir Zhuravlev
|
|
*
|
|
* Released under MIT License
|
|
* @license https://github.com/private-face/jquery.bind-first
|
|
*
|
|
* Date: Thu Feb 6 10:13:59 ICT 2014
|
|
*/
|
|
function v(t,n,r){var o=e._data(t[0]).events[n],a=r?o.splice(o.delegateCount-1,1)[0]:o.pop();o.splice(r?0:o.delegateCount||0,0,a)}function g(t,n,r){var o=n.split(/\s+/);t.each(function(t){for(t=0;t<o.length;++t){var n=e.trim(o[t]).match(/[^\.]+/i)[0];v(e(this),n,r)}})}function y(){if(!o.init){if(o.init=!0,e("img").each(function(){var t=e(this).attr("src");1===u(t)&&e(this).attr("src",l(t,r.nonce))}),void 0!==t._wpRevisionsSettings){var n,a=t._wpRevisionsSettings.revisionData,i=a.length;for(n=0;n<i;++n)o.regexp.test(a[n].restoreUrl)||(t._wpRevisionsSettings.revisionData[n].restoreUrl=l(a[n].restoreUrl,r.nonce))}e("#toplevel_page_ip-geo-block li.wp-first-item").each(function(){var t=e(this);t.css("display","IP Geo Block"===t.children("a").text()?"none":"block")})}}e.ajaxPrefilter(function(e){if(1===u(e.url)&&!e.url.match(/async-upload\.php$/))if(void 0!==t.FormData&&e.data instanceof FormData)e.data.append(r.key,r.nonce);else{var n,o,a=s(e.url);void 0===e.data||a.query?e.url=l(a,r.nonce):(n=e.data?e.data.split("&"):[],i=(i=t.location.pathname).replace(r.home+r.admin,""),(o=h.hasOwnProperty(i)?h[i]:null)&&(n=o(n)),n.push(r.key+"="+encodeURIComponent(r.nonce)),e.data=n.join("&"))}var i}),void 0===e.fn.onFirst&&(e.fn.onFirst=function(t,n){var r,o=e(this),a="string"==typeof n;if(e.fn.on.apply(o,arguments),"object"==typeof t)for(r in t)t.hasOwnProperty(r)&&g(o,r,a);else"string"==typeof t&&g(o,t,a);return o}),e(t).on("error",function(){y()}),e(function(){y()}),(c=e(n)).onFirst("click contextmenu","a",function(a){var i,h,c=0,p=e(this),v=p.attr("href")||"",g=s(v);if(f(g)&&(c=u(v)),"click"===a.type)if(1===c)p.attr("href",m(g)?v:l(v,d(p)?"nofollow":r.nonce));else if(-1===c&&(1===u(t.location.pathname)||o.regexp(t.location.search)))if("_self"===p.attr("target")||function(e){var t,n,o=r.sites.length;for(t=0;t<o;++t)if(0<=(n=e.indexOf(r.sites[t]+"/"))&&n<=6)return!0;return!1}(v))p.attr("href",m(g)?v:l(v,d(p)?"nofollow":r.nonce));else if(!this.hasAttribute("onClick"))return v=v.split(";",2).shift(),i=decodeURIComponent(this.href),(h=n.createElement("div")).appendChild(n.createTextNode(i)),i=h.innerHTML.replace(/["']/g,function(e){return{'"':""","'":"'"}[e]}),h="",v=i,(c=t.open()).document.write('<!DOCTYPE html><html><head><meta name="referrer" content="never" /><meta name="referrer" content="no-referrer" /><meta http-equiv="refresh" content="0; url='+v+'" />'+(e("body").hasClass("webview")?'<script>window.location.replace("'+v+'")<\/script>':"")+"</head></html>"),c.document.close(),a.stopImmediatePropagation(),!1}),c.onFirst("submit","form",function(){var t=e(this),n=t.attr("action");1===u(n)&&("post"===(t.attr("method")||"").toLowerCase()?t.attr("action",l(n,r.nonce)):t.append('<input type="hidden" name="'+r.key+'" value="'+r.nonce+'">'))})}(jQuery,window,document); |