Česlav Przywara

Hi Joshua,

There’s no easy way to do it, but it can be done by removing an action that inserts JavaScript snippet that implements copy protection (note: $aio_wp_security is a variable in global scope):

remove_action('wp_footer', array($aio_wp_security, 'aiowps_footer_content'));

You have to run it after init action with priority 0, so for example in init action with priority above 0 or in wp_loaded (not in after_setup_theme):

function disable_copy_protection() {
  global $aio_wp_security;
  remove_action('wp_footer', array($aio_wp_security, 'aiowps_footer_content'));
}
add_action('wp_loaded', 'disable_copy_protection');

Of course, you want to run the this code conditionally, ie. only on your login page. Since I don’t know what’s your login page like, I cannot give you any specific advice here.

Cheers,
Česlav

• This reply was modified 9 years, 5 months ago by Česlav Przywara. Reason: typo: global, not globals

Yes and no. Yes, because it will solve the reported problem. No, because it’s still not 100% correct. You want something like this:

RewriteCond %{HTTP_REFERER} !^https?://(www\.)?mydomain\.tld [NC]

Hi @weblady1,

AIOWPS […] is apparently conflicting with another updated plug-in on just one domain.

Is this a plugin from plugins directory? If so, let us know and we’ll check, if anything can be done to avoid the conflict.

Hi,

Check this post.

Btw. could you let us know more about your problem? “I’m unable to log into the back end” – how do you know it’s because of AIOWPSF? I’m curious, because I’m running this plugin on PHP7 without any problems so far, but I might have a different setup.

Hi,

Yes, it is supposed to be there, there are legitimate ways to use this function (besides obfuscating malicious code):

• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-user-registration.php#L70
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-user-registration.php#L101
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-captcha.php#L86
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-general-init-tasks.php#L389
• https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-general-init-tasks.php#L438

Cheers,
Česlav

Hi Alex,

The anti-hotlinking firewall rule triggers when the HTTP(S) request comes with non-empty referrer that doesn’t match the domain of the website. We employ almost verbatim copy of the first example here: https://httpd.apache.org/docs/2.4/rewrite/access.html#blocked-inline-images

Perhaps the problem could be solved on your side by manipulating the referrer that your optimization API sends: either by removing it completely from request or setting it to root URL of the currently accessed website? I don’t know, if such solution has any “moral” implications for you, but I don’t see anything wrong in it – after all you are acting on behalf of your users (owners of the website).

Cheers,
Česlav

• This reply was modified 9 years, 5 months ago by Česlav Przywara.

You have probably omitted one opening or closing parenthesis. The whole line should read:

if (strtolower($post_pass) != strtolower($pass_val)) {