Title: Checking if valid threat
Last modified: September 11, 2021

---

# Checking if valid threat

 *  Resolved [JustBruno](https://wordpress.org/support/users/justbruno/)
 * (@justbruno)
 * [4 years, 11 months ago](https://wordpress.org/support/topic/checking-if-valid-threat/)
 * Hi, I am using refer a friend plugin @ [https://wpgens.com/downloads/refer-a-friend-for-woocommerce-premium/](https://wpgens.com/downloads/refer-a-friend-for-woocommerce-premium/)
   getting a known threat @ /plugins/wpgens-refer-a-friend-premium/includes/class-
   wpgens-raf-user.php .
 * Can you confirm or is that a false positive?
    Thanks!!
 *     ```
       <?php
   
       /**
        * Manages WordPress Meme Shortcode options.
        *
        */
       class WPGens_RAF_User
       {
           /**
            * @var string
            */
           private $user_id;
   
           /**
            * Constructor.
            *
            * @param array $options
            */
           public function __construct( $user_id ){
               $this->user_id = $user_id;
               $this->hide_no_orders = get_option( 'gens_raf_hide_no_orders' );
               $this->hide_no_orders_text = get_option( 'gens_raf_hide_no_orders_text' );
           }
   
           /**
            * Load the plugin options from WordPress.
            *
            * @return WPGens_RAF_User
            */
           public function get_referral_id() {
   
               if ( !$this->user_id ) {
                   return false;
               }
   
               if($this->hide_no_orders === "yes") {
   
                   $customer_orders = get_posts( array(
                       'numberposts' => 1,
                       'meta_key'    => '_customer_user',
                       'meta_value'  => $this->user_id,
                       'post_type'   => wc_get_order_types(),
                       'post_status' => array( 'wc-processing', 'wc-completed' )
                   ) );
                   if(count($customer_orders) < 1) {
                       return $this->hide_no_orders_text;
                   }
               }
   
               $referral_id = get_user_meta($this->user_id, "gens_referral_id", true);
               if($referral_id && $referral_id != "") {
                   return apply_filters('wpgens_raf_code', $referral_id);
               } else {
                   do{
                       $referral_id = $this->generate_referral_id();
                   } while ($this->exists_ref_id($referral_id));
                   update_user_meta( $this->user_id, 'gens_referral_id', $referral_id );
                   return apply_filters('wpgens_raf_code', $referral_id);
               }
   
           }
   
           /**
            * Check if ID already exists
            *
            * @since    2.0.0
            * @return string
            */
           public function exists_ref_id($referral_id) {
               $args = array('meta_key' => "gens_referral_id", 'meta_value' => $referral_id );
               if (get_users($args)) {
                   return true;
               } else {
                   return false;
               }
           }
   
           /**
            * Generate a new Referral ID
            *
            * @since    2.0.0
            * @return string
            */
           function generate_referral_id($randomString="ref")
           {
               $characters = "0123456789";
               for ($i = 0; $i < 7; $i++) {
                   $randomString .= $characters[rand(0, strlen($characters) - 1)];
               }
               return $randomString;
           }
   
           /**
            * Get number of referrals for a user
            *
            * @since    2.0.0
            * @return   string
            */
           public function get_number_of_referrals() {
               $number = get_user_meta($this->user_id, "gens_num_friends", true);
               if(!empty($number)) {
                   return $number;
               } else {
                   return 0;
               }
           }
   
           /**
            * Generate referral URL for front end(product tab,shortcode & my account page)
            *
            * @since    2.0.0
            * @return   string
            */
           public function generate_referral_url($type,$url = NULL) 
           {
   
               if($this->hide_no_orders === "yes") {
   
                   $customer_orders = get_posts( array(
                       'numberposts' => 1,
                       'meta_key'    => '_customer_user',
                       'meta_value'  => $this->user_id,
                       'post_type'   => wc_get_order_types(),
                       'post_status' => array( 'wc-processing', 'wc-completed' )
                   ) );
                   if(count($customer_orders) < 1) {
                       return $this->hide_no_orders_text;
                   }
               }
   
               global $wp;
               $referral_id = $this->get_referral_id();
               $link = get_home_url();
   
               switch ($type) {
                   case 'product_tab':
                       $refLink = esc_url(home_url(add_query_arg(array('raf' => $referral_id),trailingslashit($wp->request))));
                   break;
                   case 'shortcode':
                       if($url) {
                           $link = $url;
                       }
                       $refLink = esc_url(add_query_arg( 'raf', $referral_id, trailingslashit($link) ));
                   break;
                   default:
                       $my_account_url = get_option( 'gens_raf_my_account_url' );
                       if($my_account_url != "") {
                           $link = $my_account_url;
                       }
                       $refLink = esc_url(add_query_arg( 'raf', $referral_id, trailingslashit($link) ));
                   break;
               }
   
               // If its a guest and cookie is set?
               if(!is_user_logged_in() && isset($_COOKIE['gens_raf_guest'])) {
                   $refLink = $refLink .'?raf='.$_COOKIE['gens_raf_guest'];
               }
   
               if(isset($_GET['order']) && !is_user_logged_in()) {
                   $order = new WC_Order( $_GET['order'] );
                   $user_email = ( version_compare( WC_VERSION, '2.7', '<' ) ) ? $order->billing_email : $order->get_billing_email();  
                   $refLink = $refLink .'?raf='.$user_email;
               }
   
               return apply_filters('wpgens_raf_link', $refLink, $referral_id, $type);
           }
   
           /**
            * Create referral code on new user registration, in case someone needs meta fields for mailchimp and such, 
            * otherwise its created when customer checks page with referral link.
            *
            * @since 2.0.0
            */
           public static function new_user_add_referral_id( $user_id ) {
               $referral = new WPGens_RAF_User($user_id);
               $referral->get_referral_id();
           }
   
           /**
            * Increase referrals number on every success RAF order. 
            *
            * @since 2.0.0
            */
           public static function set_number_of_referrals( $user_id ) {
               if(!filter_var($user_id, FILTER_VALIDATE_EMAIL)) {
                   $referral = new WPGens_RAF_User($user_id);
                   $num_friends_refered = $referral->get_number_of_referrals();
                   update_user_meta( $user_id, 'gens_num_friends', (int)$num_friends_refered + 1 );
               }
   
           }
       }
       ```
   

Viewing 2 replies - 1 through 2 (of 2 total)

 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [4 years, 11 months ago](https://wordpress.org/support/topic/checking-if-valid-threat/#post-14862212)
 * I cannot confirm without more information. The code you provided here does not
   actually match any of the known threats in my current definitions so I can only
   image a few possible explanations for it being detected as a threat on your system:
 * 1. The code posted may not be an exact match for the code that is actually being
   identified as a threat. To rule this out please make sure that this code is from
   the same copy of the same file in the same path modified at the exact same time
   as the suspected file in question (it should not be the original installation
   file, or a backup file, or the same file but from another site or another directory,
   or any other version of that file other than the one that was detected).
 * 2. It also be that the code here got altered somehow when copying and pasting
   onto this forum. Try emailing me the file in question as an attachment: eli AT
   gotmls DOT net
 * 3. It is also possible that there is some kind of Regular Expression bug in your
   version of PHP or you may have an older version of the definition. Please let
   me know what version of PHP you are running on your server, and what version 
   of the plugin you have, and also what version of the definition you have downloaded
   on this site.
 * You can also click on the file listed in red on the Scan Results to view the 
   potential threat in the file. You can then click on the numbered threats found
   at the top of that popup winder to highlight the suspected code. If you just 
   hover over that numbered link without clicking then it will tall you the name
   of the threat that was detected. If you can send my that information as well 
   then it would help me tremendously in troubleshooting this issue for you.
 *  Plugin Author [Eli](https://wordpress.org/support/users/scheeeli/)
 * (@scheeeli)
 * [4 years, 9 months ago](https://wordpress.org/support/topic/checking-if-valid-threat/#post-15048252)
 * Just wanted to follow up here and say that I received a copy of this file in 
   it’s entirety and was able to confirm that it is in fact not malicious, so I 
   have updated my definitions to omit this pattern from my scans while still being
   able to detect the original pattern that is similar to this class but used in
   a malicious way. Please download the latest definition updates so you can run
   the complete scan again without flagging this plugin file to be quarantined. 
   If you have already quarantined this file then you can restore it from the Anti-
   Malware Quarantine page in your wp-admin.

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Checking if valid threat’ is closed to new replies.

 * ![](https://ps.w.org/gotmls/assets/icon-256x256.png?rev=1001824)
 * [Anti-Malware Security and Brute-Force Firewall](https://wordpress.org/plugins/gotmls/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/gotmls/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/gotmls/)
 * [Active Topics](https://wordpress.org/support/plugin/gotmls/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/gotmls/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/gotmls/reviews/)

 * 2 replies
 * 2 participants
 * Last reply from: [Eli](https://wordpress.org/support/users/scheeeli/)
 * Last activity: [4 years, 9 months ago](https://wordpress.org/support/topic/checking-if-valid-threat/#post-15048252)
 * Status: resolved