FM / wp51

/var/softaculous/wp51

Name	Size	Mode	Actions
images/	-	0755	rm
languages/	-	0755	rm
php53/	-	0755	rm
php56/	-	0755	rm
php71/	-	0755	rm
php81/	-	0755	rm
php82/	-	0755	rm
plugins/	-	0755	rm
.htaccess	420	0644	edit dl rm
add_user.php	461	0644	edit dl rm
backup.php	3099	0644	edit dl rm
check_charset.php	2067	0644	edit dl rm
clone.php	31755	0644	edit dl rm
clone.xml	497	0644	edit dl rm
edit.php	9701	0644	edit dl rm
edit.xml	1801	0644	edit dl rm
extend.php	84772	0644	edit dl rm
fileindex.php	291	0644	edit dl rm
import.php	6665	0644	edit dl rm
info.xml	15294	0644	edit dl rm
install.js	1493	0644	edit dl rm
install.php	32010	0644	edit dl rm
install.xml	5791	0644	edit dl rm
md5	7791	0644	edit dl rm
notes.txt	5383	0644	edit dl rm
plugin_activate.php	596	0644	edit dl rm
plugin_deactivate.php	613	0644	edit dl rm
sign_on.php	3489	0644	edit dl rm
soft.htaccess	127	0644	edit dl rm
upgrade.php	13603	0644	edit dl rm
upgrade.xml	1637	0644	edit dl rm
wp-config.php	2730	0644	edit dl rm
_htaccess	266	0644	edit dl rm
_index.php	59	0644	edit dl rm
_wp-config.php	3013	0644	edit dl rm

Edit: /var/softaculous/wp51/sign_on.php (3489B)

<?php

// Suppress errors just for login.
if(function_exists('ini_set')){
	ini_set('display_errors', '0');
}
define('WP_DEBUG', false);

if(!class_exists('Redis') && !file_exists('[[softpath]]/wp-content/object-cache.php')){
	@unlink(__FILE__);
}

// Validate if the request is from Softaculous
if($_REQUEST['pass'] != '[[autopass]]'){
	die("Unauthorized Access");
}

if(isset($_REQUEST['FLUSH_CACHE'])){
	
	@unlink(__FILE__);

define( 'WP_USE_THEMES', false );
	require __DIR__ . '/wp-blog-header.php';

wp_cache_flush();

// Redirect to admin page or requested page
	$redirect_to = admin_url();
	if(!empty($_REQUEST['redirect_to'])){
		$redirect_to = $_REQUEST['redirect_to'];
	}
	wp_safe_redirect( $redirect_to );

exit();
}

// Dummy plugin dir so that no plugins are loaded as they conflict with our login process
define('WPMU_PLUGIN_DIR', '[[softpath]]/[[autopass]]');
define('WP_PLUGIN_DIR', '[[softpath]]/[[autopass]]');
define('WP_CONTENT_DIR', '[[softpath]]/[[autopass]]');
define('WP_USE_THEMES', false);

// Some themes check the current login script name
$_SERVER['SCRIPT_NAME'] = '/wp-login.php';

require('wp-blog-header.php');
require('wp-includes/pluggable.php');

// If the user is already logged in simply redirect to admin page
if(!is_user_logged_in()){
	
	$signon_user = '[[signon_username]]';

//Backword compatibility ($__setting['signon_username'] won't be there in previous versions <= 5.2.3)
	if(!empty($signon_user) && !preg_match('/^\[\[(.*?)\]\]$/is', $signon_user)){
		$user = get_user_by('login', $signon_user);
	}else{
		$user_info = get_userdata(1);
		
		// Try to find an admin if we do not have any admin with ID => 1 or if ID 1 does not have administrator role
		if (empty($user_info) || empty($user_info->user_login) || !in_array('administrator', $user_info->roles)) {
			$admin_id = get_users(array('role__in' => array('administrator'), 'number' => 1, 'fields' => array('ID')));
			$user_info = get_userdata($admin_id[0]->ID);
		}
		
		$username = $user_info->user_login;
		$user = get_user_by('login', $username);
	}
	
	// Create the session
	if(!is_wp_error($user)){
		wp_clear_auth_cookie();
		wp_set_current_user($user->ID);
		wp_set_auth_cookie($user->ID);
		
		// Create a session for wp-simple-firewall plugin
		if(file_exists(dirname(__FILE__).'/wp-content/plugins/wp-simple-firewall')){
			
			try{
				
				global $wpdb;
				
				$wpsf_session_id = md5(uniqid('icwp-wpsf'));
				
				$wpdb->insert($wpdb->prefix."icwp_wpsf_sessions", array(
				   "session_id" => $wpsf_session_id,
				   "wp_username" => $user->user_login,
				   "ip" => $_SERVER['REMOTE_ADDR'],
				   "browser" => md5($_SERVER['HTTP_USER_AGENT']),
				   "last_activity_uri" => "/wp-login.php",
				   "logged_in_at" => time(),
				   "last_activity_at" => time(),
				   "login_intent_expires_at" => 0,
				   "secadmin_at" => 0,
				   "created_at" => time(),
				   "deleted_at" => 0,
				));
				
				setcookie("wp-icwp-wpsf", $wpsf_session_id, time()+ DAY_IN_SECONDS * 30);
				
			} catch(Exception $e){
				
			}
		}
	}
}

if(class_exists('Redis') || file_exists('[[softpath]]/wp-content/object-cache.php')){
	// Redirect to flush cache
	$redirect_to = $_SERVER['REQUEST_URI'].'&FLUSH_CACHE=1';
	wp_safe_redirect( $redirect_to );
	exit();
}
@unlink(__FILE__);

// Redirect to admin page or requested page
$redirect_to = admin_url();
if(!empty($_REQUEST['redirect_to'])){
	$redirect_to = $_REQUEST['redirect_to'];
}
wp_safe_redirect( $redirect_to );

exit();

cmd: