• Resolved Chijo

    (@chijotakeda)


    Although I’m a long time Wordfence user, I have encountered an alert that I cannot figure out. During a scan on one of our sites, we were alerted to modifications to the following files:

    wp-admin/includes/update.php
    wp-admin/includes/class-wp-upgrader.php
    wp-admin/update-core.php

    When looking at the diffs, here’s one example:
    # cPanel override: Disable all core updates to prevent conflict with cPAddons.
    32 return false;

    Is this cause for worry about a compromised/hacked file(s)?

    Thanks

    https://wordpress.org/plugins/wordfence/

Viewing 13 replies - 1 through 13 (of 13 total)
  • Hi

    Looks like something your hosting provider may have added. This is, I am guessing, a one click install? I would contact the hosting provider and alert them that this is there, and ask if they put it there because its being flagged as a problem by Wordfence. If they confirm that, let me know which provider so I can note that. I would not be alarmed at this time but I would follow up and do what I mentioned.

    tim

    Thread Starter Chijo

    (@chijotakeda)

    Thanks for the reply.

    This is actually not a one click install but on our own server for our clients. We custom install all our client sites. My server engineer is supposed to be hands off on our site files but I suppose I’ll check in with him Monday. We have numerous sites and have not seen this before.

    I’m not familiar with that snippet of code. What file is that in? I’ll go check.

    tim

    Thread Starter Chijo

    (@chijotakeda)

    This one:

    # cPanel override: Disable all core updates to prevent conflict with cPAddons.
     	 	32	   return false;

    is here: wp-admin/includes/update.php. Line 31

    This one:
    return true; // Force this functionality to disabled because it is incompatible with cPAddons.

    is here: wp-admin/includes/class-wp-upgrader.php. Line 1808

    This one:

    # cPanel override: Do not display the current or the latest version, because we've disabled updates.
     	 	143	   return;

    is here: wp-admin/update-core.php. Line 142

    Ok. I searched a copy of 4.0 downloaded from wordpress.org for those lines and could not find them on the files you said. Where did you download your wordpress software from?

    tim

    Thread Starter Chijo

    (@chijotakeda)

    Yes, we’ve installed numerous WordPress installs and have not seen that before with Wordfence installed on all of our client sites.

    I only download from https://wordpress.org/download/. However, one of my developers “may” have gotten it elsewhere and I’ll check with them.

    The thing that gets me is that the code looks like something you would find from a one click installer. We shall see. Let me know.

    tim

    Thread Starter Chijo

    (@chijotakeda)

    I left those files alone.

    Today I noticed that WordPress is at 4.0. It’s not recognizing 4.01 nor the 4.1 version. I’m wondering if this code is literally preventing updates?

    Should I just delete that extra code? What do you think?

    I’d even consider doing a reinstall from the upgrade page. Then seeing if you get update notices. Or you could o it manually. I have a script I use that basically backs the files up, removes the wp-admin and wp-includes folders, and re-installs wordpress. I think it resets the permissions on .htaccess and wp-config.php as well and changes group and user ownership at the same time. You could probably do something like that to make sure you are getting everything back to the original versions.

    tim

    Thread Starter Chijo

    (@chijotakeda)

    I decided to manually update WordPress to 4.1 and now all is good.

    Thanks for your advice.

    That’s great news! Glad it’s sorted

    Tim

    Note, I get the exact same errors. I did a one click install of wordpress from “Site Software v0.9.8” on cpanel. It is actually part of a private VPS that I control so not exactly sure why this is happening. Seems that the wordpess installer program want’s to control updates instead of allowing wordpress to do it. Not quite sure why. I will look for a way to undo this as I would prefer to keep wordpress up to date.

    stupid WHm and cpanel that is second plugin that is screwing RAM on server
    Why toying with core file when not needed?
    Why trying to retail something you dont control?
    blocking update is the most stupid shit I have seen on cpanel
    same thing for cphulk, the most stupid code i have seen

Viewing 13 replies - 1 through 13 (of 13 total)
  • The topic ‘Core update files modified’ is closed to new replies.