Wordfence is blocking
-
Hy,
Since some weeks, wordfence is blocking all downloads, which are secured by User Access Management, because of Local File Inclusion in Parameter “uamgetfile”.
And I can understand why this happens, because the server path is set into this parameter. (Why?)I just created a request within wordfence plugin to add this parameter to their whitelist, but I’m not sure if this have success.
https://wordpress.org/support/topic/whitelist-user-access-manager/Is their already an option to disable this behaviour? Because for processing I think this is not really needed to have absolute path in parameter.
Regards,
Stefan
-
Hy,
Thanks for response.
Yes their solution works, but not on long term.
Their solution is to simple disable the Local File Inclusion protection, which can only be a short term solution.
Do you plugin really needs the absolute path to the linked file? Because I think this is the root cause.Would not a
also working, because the .htaccess File is placed within wp-content/uploads
But I’m honest, I don’t know if this is a limitation of the method over .htaccess, which is needed to have a secure access check before the files.
Best Regards,
Stefan
Hi,
https://example.com/wp-content/uploads/2022/12/document.pdf?uamfiletype=attachment&uamgetfile=2022%2F12%2Fdocument.pdf should work as well. The only thing you need to do is adjust your htaccess file.
Instead of
RewriteRule ^([^?]*)$ /index.php?uamfiletype=attachment&uamgetfile=$1 [QSA,L]you must use something like
RewriteRule ^https:\/\/example\.com\/wp-content\/uploads\/([^?]*)$ /index.php?uamfiletype=attachment&uamgetfile=$1 [QSA,L]Regards,
Alex
- The topic ‘Wordfence is blocking’ is closed to new replies.
