Title: Francisco Torres's Replies | WordPress.org --- # Francisco Torres [ ](https://wordpress.org/support/users/frantorres/) * [Profile](https://wordpress.org/support/users/frantorres/) * [Topics Started](https://wordpress.org/support/users/frantorres/topics/) * [Replies Created](https://wordpress.org/support/users/frantorres/replies/) * [Reviews Written](https://wordpress.org/support/users/frantorres/reviews/) * [Topics Replied To](https://wordpress.org/support/users/frantorres/replied-to/) * [Engagements](https://wordpress.org/support/users/frantorres/engagements/) * [Favorites](https://wordpress.org/support/users/frantorres/favorites/) Search replies: ## Forum Replies Created Viewing 7 replies - 1 through 7 (of 7 total) * Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) In reply to: [It’s time to review the usefulness of Polyfill and others in Core.](https://wordpress.org/support/topic/its-time-to-review-the-usefulness-of-polyfill-and-others-in-core/) * Moderator [Francisco Torres](https://wordpress.org/support/users/frantorres/) * (@frantorres) * [2 years, 1 month ago](https://wordpress.org/support/topic/its-time-to-review-the-usefulness-of-polyfill-and-others-in-core/#post-17855473) * Hi, removing wp-polyfill dependencies is actually something that is happening, as for example [this ticket related to the next version of WordPress](https://core.trac.wordpress.org/ticket/60962). * In any case, this has to do with performance and dropping support for old browsers, not security issues like that one. * [Polyfill](https://en.wikipedia.org/wiki/Polyfill_(programming)) is a general term and there are different “polyfill” libraries, the one that WordPress loads comes from [@babel/polyfill](https://babeljs.io/docs/babel-polyfill/) which to my knowledge is not related to the mentioned library. * Besides, that security issue is related to the loading of a library using an external resource (their servers), which WordPress core does not do. * All included libraries in WordPress core are loaded from files included in your WordPress installation, not from external resources. In this case, this library is included in wp-includes/js/dist/vendor/wp-polyfill.js so a third party cannot modify it. * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce] Critical error after latest update](https://wordpress.org/support/topic/critical-error-after-latest-update-6/) * Moderator [Francisco Torres](https://wordpress.org/support/users/frantorres/) * (@frantorres) * [4 years, 2 months ago](https://wordpress.org/support/topic/critical-error-after-latest-update-6/#post-15705311) * I had the same issue. * The error pops-up at /wp-admin/update-core.php * I downloaded the source code version from [their github](https://github.com/wp-erp/wp-erp/releases/tag/v1.10.6), executed composer, replaced the rest of files with ones from the original compilation( looks like there is something that is not done by composer) and now it’s working fine for me. * This is a bit tricky so I hope they publish a new version soon. - This reply was modified 4 years, 2 months ago by [Francisco Torres](https://wordpress.org/support/users/frantorres/). Reason: Found errors * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Payment Gateway for Redsys & WooCommerce Lite] Formulario de la tarjeta no debe aparecer](https://wordpress.org/support/topic/formulario-de-la-tarjeta-no-debe-aparecer/) * Moderator [Francisco Torres](https://wordpress.org/support/users/frantorres/) * (@frantorres) * [4 years, 11 months ago](https://wordpress.org/support/topic/formulario-de-la-tarjeta-no-debe-aparecer/#post-14886605) * Muy buenas [@alandres](https://wordpress.org/support/users/alandres/) , * He estado revisando esto junto a [@jconti](https://wordpress.org/support/users/jconti/) y desgraciadamente hemos descubierto que, efectivamente se trata de un hackeo, que además debo decir que parece bastante sofisticado. * Si bien no hemos trazado todo el proceso, te informo de lo que hemos visto que sucede hasta el momento. 1. El origen del virus parece ser un JS, que carga desde la URL [https://cdn.crowstatic.com/mod/map.js](https://cdn.crowstatic.com/mod/map.js) que podría ser, a su vez, un sitio que se encuentre hackeado. Este script, cuando lo cargas directamente desde el navegador aparece un script que parece normal, pero cuando la llamada se hace desde el sitio web lo que envía realmente es el virus que hace todo esto. 2. La web hace la llamada a este script directamente en la cabecera, así que en principio podría estar en cualquier parte del código del sitio web. He visto que carga justo debajo de Google Tag Manager y el script de Google Tag Manager es distinto cuando carga el virus y cuando no carga, así que empezaría mirando por ahí. 3. Esto no carga siempre he probado varias configuraciones y lo ha hecho usando este User Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/ 604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1 4. El virus imita hasta cierto punto la estructura el pago Redsys InSite, de hecho carga los iconos oficiales directamente desde Redsys. Es decir, quién ha hecho esto ni es un novato ni lo ha hecho de casualidad, se ha enfocado específicamente en esto 5. Cuando escribes todos los datos de la tarjeta envía una petición POST a [https://cdn.crowstatic.com/u/](https://cdn.crowstatic.com/u/) que contiene información encriptada en tres variables: main, uniqueId, storedId. La variable main es bastante larga, así que se puede asumir que además de los datos de la tarjeta envía otros datos que quizás pueda usar para seguir con esto. El sitio responde con un número de 9 cifras, supongo que es un identificador. * Algo que puedes hacer a modo “urgente” para que la web siga funcionando, al menos parcialmente mientras solucionas esto es declarar lo siguiente en el htaccess * ``` Header set Content-Security-Policy "default-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'self';" ``` * Esto básicamente le dice al navegador que no cargue ningún script externo al sitio web ni haga acciones de formulario contra direcciones de fuera del sitio web. Si bien ten en cuenta que esto afecta a todo: No funcionarán las estadísticas de Google Analytics ni otros scripts externos que puedas incluir. * Saludos. - This reply was modified 4 years, 11 months ago by [Francisco Torres](https://wordpress.org/support/users/frantorres/). * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Jetpack - WP Security, Backup, Speed, & Growth] typo in widget-visibility module](https://wordpress.org/support/topic/typo-in-widget-visibility-module/) * Moderator [Francisco Torres](https://wordpress.org/support/users/frantorres/) * (@frantorres) * [11 years, 10 months ago](https://wordpress.org/support/topic/typo-in-widget-visibility-module/#post-5360422) * Thanks Jeremy, * Next time i will check the github repository, i didn’t know about it 😉 * Regards! * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Yoast SEO - Advanced SEO with real-time guidance and built-in AI] WPSEO_FRONT_URL XML sitemap](https://wordpress.org/support/topic/wpseo_front_url-xml-sitemap/) * Moderator [Francisco Torres](https://wordpress.org/support/users/frantorres/) * (@frantorres) * [12 years, 7 months ago](https://wordpress.org/support/topic/wpseo_front_url-xml-sitemap/#post-4456596) * This is a problem related with WPML Multilingual CMS i reproduced in version 3.0.1 over a Nginx server. * His filter for the WordPress SEO by Yoast sitemaps (plugins/sitepress-multilingual- cms/inc/wpseo-sitemaps-filter.php) takes a global variable (WPSEO_FRONT_URL) that doesn’t seems to work. * Because of this you can’t see the sitemap XML but it generates well. * Looks like a known problem in WPML [http://wpml.org/forums/topic/yoast-wordpress-seo-sitemap-xsl-error/](http://wpml.org/forums/topic/yoast-wordpress-seo-sitemap-xsl-error/) * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[CookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice)] WPML integration](https://wordpress.org/support/topic/wpml-integration-2/) * Moderator [Francisco Torres](https://wordpress.org/support/users/frantorres/) * (@frantorres) * [13 years ago](https://wordpress.org/support/topic/wpml-integration-2/#post-3597923) * Hi! * A fast-way to make the plugin compatible with WPML is adding a wpml-config.xml file in the plugin root directory containing: * ``` ``` * That just tell what arrays that this plugin store in the database should be translated, after that you can just edit those arrays via “WPML String Translation” plugin 😉 * Forum: [Plugins](https://wordpress.org/support/forum/plugins-and-hacks/) In reply to: [[Force Images Download] Security break](https://wordpress.org/support/topic/security-break/) * Moderator [Francisco Torres](https://wordpress.org/support/users/frantorres/) * (@frantorres) * [13 years, 5 months ago](https://wordpress.org/support/topic/security-break/#post-3510821) * Happily solved by the author in less than an hour 😀 * Big thanks to Aurelien for his fast response 🙂 Viewing 7 replies - 1 through 7 (of 7 total)