Jeff-Lewis

I have seen the same issue. It’s related to hosting on Windows.

The code you posted is part of the problem, but also is how $itsec_globals are initialized on Windows.

Line 82 in class-itsec-core.php
‘plugin_dir’ => plugin_dir_path( $plugin_file ), //the path of the plugin directory

plugin_dir_path( $plugin_file ) will return something like this on Windows -> “C:\wwwroot\mysite\wp-content\plugins\better-wp-security/”

Notice difference in back and forward slashes.

So later in the get_module_path( $file ) function you posted, it’s trying to remove “C:\wwwroot\mysite\wp-content\plugins\better-wp-security/” from “C:\wwwroot\mysite\wp-content\plugins\better-wp-security\core” which never works because it doesn’t match.

Then we end up with the physical path in the script URL when it’s used here.

wp_enqueue_script( ‘itsec_file_change_warning_js’, $this->module_path . ‘js/admin-file-change-warning.js’, array( ‘jquery’ ), $itsec_globals[‘plugin_build’] );

Essentially exposing to the world the physical path of your files on the server’s disk. This is not helping security.

Yes, at least make .less files editable as text.