Critical Bugs: ReactDataDTO type mismatch & hostnames DB error

Hi CleanTalk Support Team,

I am writing to report two issues found in the latest release of the Security & Malware Scan plugin (security-malware-firewall), along with the specific causes and fixes, so your engineering team can patch them in an upcoming release.

Issue 1: Fatal Error – ReactDataDTO Type Mismatch on scannerAutoStartManualTimezone

Error Log:

PHP Fatal error: Uncaught Exception: CleantalkSP\SpbctWP\DTO\ReactDataDTO: Property values type mismatch on key scannerAutoStartManualTimezone, got double, expected string in /wp-content/plugins/security-malware-firewall/lib/CleantalkSP/SpbctWP/DTO/ReactDataDTO.php:38

• Cause: In lib/CleantalkSP/SpbctWP/Settings/SettingsGeneralReact.php, scannerAutoStartManualTimezone calls get_option('gmt_offset'). WordPress core returns an integer/float (e.g., 0 or 5.5) for gmt_offset, but ReactDataDTO strictly enforces a string type.
• Fix Required: Explicitly cast the option to a string in SettingsGeneralReact.php:PHP'scannerAutoStartManualTimezone' => (string) get_option('gmt_offset'),

Issue 2: Database Error – Duplicate Entry ‘0’ on wp_spbc_security_log_hostnames

Error Log:

WordPress database error Duplicate entry '0' for key 'wp_spbc_security_log_hostnames.PRIMARY' for query INSERT INTO wp_spbc_security_log_hostnames (network, hostname) VALUES ... (0, ''), (0, '') made by do_action('wp_ajax_spbc_get_hostnames_by_ips')

• Cause: The table wp_spbc_security_log_hostnames defines network as the PRIMARY KEY. When multiple IP lookups fail or return 0, the bulk INSERT query attempts to insert multiple (0, '') rows, triggering a MySQL duplicate key error.
• Fix Required: network should not be defined as the PRIMARY KEY (or an AUTO_INCREMENT primary ID column should be used instead), since network = 0 can occur multiple times during log processing.

I have temporarily patched these issues on my instance, but please pass this along to your development team so a permanent fix can be included in the next update.

Best regards,

Mark

wsodl.com