[Bug Report] Double slash in Notifications link

  • Resolved SevenKeyboard Ltd.

    (@sevenkeyboard)


    1 year, 1 month ago

    Hello, and thank you for the great plugin.
    I’m a happy Wordfence user.
    Before I explain the issue, here is my environment:

    • WordPress version: 6.8.1
    • Site type: Multisite
    • Wordfence version: 8.0.5 (latest)
    • Wordfence activation: Network-activated

    While viewing Dashboard > Notifications in the Wordfence panel, I clicked on the message:

    3 issues found in most recent scan

    At that moment, I was redirected to the login screen, and no matter how many times I logged in, I was sent back there again — a login loop.

    I inspected the link in developer tools and found the following structure (note: domain changed to example.com for clarity):

    <a href="https://example.com//wp-admin/network/admin.php?page=WordfenceScan">3 issues found in most recent scan</a>

    As you can see, there are two slashes (//) before wp-admin.
    In my environment, this combination with reauth=1 results in a login loop.

    Here’s the redirected URL I’m seeing:

    https://example.com/wp-login.php?redirect_to=https%3A%2F%2Fexample.com%2F%2Fwp-admin%2Fnetwork%2Fadmin.php%3Fpage%3DWordfenceScan&reauth=1

    The Scan tab in the sidebar does not have this issue, so it seems that only the Notifications section generates a double-slash URL.
    (If I manually replace the double slash with a single slash, the page loads without any issues.)

    Since the link is malformed, I believe this is something that needs to be addressed within Wordfence.
    While double slashes are usually tolerated on single-site setups, they can cause login issues in multisite environments with stricter authentication, like reauth=1.

    I would appreciate it if this could be corrected in a future update, so the double slash doesn’t occur.
    Thank you for reading. 😊

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support wfphil

    (@wfphil)

    1 year, 1 month ago

    Hi @sevenkeyboard

    Do you use the WPML plugin and any addon plugins for WPML as that has been related to this before?

    Please send your Wordfence diagnostics report.

    Update to the latest version of Wordfence if you haven’t already done so.

    Go to the top of the “Diagnostics” tab on the Wordfence “Tools” page. There will be a “SEND REPORT BY EMAIL” button to send the diagnostics report. Enter wftest [at] wordfence [dot] com as the email and sevenkeyboard as the forum username please.

    Once you have emailed me the diagnostics report can you reply here to let me know that it has been sent. This is important in the unlikely event that your installation of WordPress is having an issue with sending mail

    Thread Starter SevenKeyboard Ltd.

    (@sevenkeyboard)

    1 year, 1 month ago

    I initially intended to submit the diagnostic report via email as requested, but I’ve decided not to proceed due to concerns about exposing my server’s IP address and internal structure or paths.

    I fully understand that such information could help diagnose the issue, and I even considered masking sensitive details before sending. However, since the double slash issue I’m reporting (regardless of its root cause) does not appear to be a critical bug, I’ve chosen to leave it as-is for now.
    I apologize for not being able to provide further assistance.

    As you mentioned, I do use the WPML plugin.
    Before posting this report, I reviewed this related topic and also tested with the plugin temporarily disabled, but the issue persisted.
    If you’re still suspecting a conflict with WPML, I’m afraid there’s not much more I can do on my end to further investigate.
    (As far as I’ve observed, the double slash issue only appears in the Wordfence notification area in my environment, though I may have missed some other cases.)

    In the end, I’ve decided to apply the following workaround by modifying my .htaccess file:


    RewriteEngine On

    # Remove leading double slashes from the request URI
    RewriteCond %{REQUEST_URI} ^//(.+)
    RewriteRule ^ /%1 [R=301,L]

    Thank you again for your support.
    I’m sorry I couldn’t contribute more to resolving this issue.

    Plugin Support wfphil

    (@wfphil)

    1 year, 1 month ago

    Hi @sevenkeyboard

    Thank you for the update.

    We don’t have this problem on a site with WPML, even when the scan is triggered by an alternate domain. We cache the URL during admin pages so that sites with multiple domains will remember which one is used by the admin(s), and it does seem to have solved the issues most users were having in the past with WPML, but we still get these from time to time with the double forward slashes.

    The reason it doesn’t stop occurring when disabling WPML is that the link is generated and saved during the scan, so WPML would need to be disabled during the next scan for the link to be generated again.

    Thread Starter SevenKeyboard Ltd.

    (@sevenkeyboard)

    1 year, 1 month ago

    Hello,

    Thank you for your response! 😁
    Thanks to your explanation, I understood that a conflict with WPML causes this issue.
    Would you be willing to modify the link generation logic in Wordfence to replace a double slash (//) with a single slash (/) only when WPML is installed?

    For now, I’ve implemented a workaround by appropriately modifying the .htaccess file as shown below, and since it’s not a major issue, I completely understand if this request is declined.
    I just thought I’d bring it to your attention if it helps.

    RewriteEngine On

    # Remove leading double slashes from the path segment after the domain
    RewriteCond %{THE_REQUEST} \s/{2,}([^\s?]+) [OR]
    RewriteCond %{REQUEST_URI} ^/{2,}(.+)
    RewriteRule ^ /%1 [R=301,L]

    As I am not a programmer, please forgive me if anything I’ve said is inappropriate.
    Once again, thank you for developing such an excellent security plugin.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘[Bug Report] Double slash in Notifications link’ is closed to new replies.