Bug in disabling auto-update

Hello,

There is a rather annoying bug in wordfence’s autoupdate in multi-site environments.

Your method of disabling the automatic update scheduler only happens on blog id 1, however the scheduled event to run the automatic updates happens on every single blog. Since wfConfig::autoUpdate does not actually check to see if the autoupdate is enabled or not, the automatic updates happen even if we selected the option in the admin to disable it.

Furthermore to be more compatible with the development community at large, wordfence should not override wordpress’ defines for automatic updating.

I therefore propose adding the following to the top of the wfConfig::autoUpdate method in order to make sure this does not keep happening.

if(wfConfig::get('autoUpdate') != '1'){
	wp_clear_scheduled_hook('wordfence_daily_autoUpdate');
	return;
}
if (defined('AUTOMATIC_UPDATER_DISABLED') && AUTOMATIC_UPDATER_DISABLED == true) {
	return;
}

This will make sure not to run the rest of the method (and clear the scheduled hook if it is) if the autoUpdate flag is not set, and will make sure to also not run the code (but not clear the scheduled hook) if the wordpress define to disable the automatic updater is set.

Please set this soon, it is very annoying that wordfence keeps automatically updating itself. We have customized the locked out message as the default one confuses our users considerably, and it is very frustrating that the message keeps reverting itself even though we have toggled every single toggle and define possible to disable automatic updates.

https://wordpress.org/plugins/wordfence/