Wordpress Wordpress jQuery1.12.4 Vulnerability

missing the submodule for wp-jquery-manager/inc/plugin-update-checker directory/files

---

For forked version at centminmod/wp-jquery-manager would be

Code (Text):

cd /svr-setup
git clone -b centminmod https://github.com/centminmod/wp-jquery-manager
cd wp-jquery-manager
git submodule update --init
# verify submodule update
ls -lah inc/plugin-update-checker

example output

Code (Text):

git clone -b centminmod https://github.com/centminmod/wp-jquery-manager
Cloning into 'wp-jquery-manager'...
remote: Enumerating objects: 85, done.
remote: Counting objects: 100% (85/85), done.
remote: Compressing objects:  25% (20/80)  
remote: Compressing objects: 100% (80/80), done.
remote: Total 4218 (delta 21), reused 63 (delta 5), pack-reused 4133
Receiving objects: 100% (4218/4218), 4.55 MiB | 18.13 MiB/s, done.
Resolving deltas: 100% (1660/1660), done.

cd wp-jquery-manager

git submodule update --init
Submodule 'inc/plugin-update-checker' (https://github.com/YahnisElsts/plugin-update-checker.git) registered for path 'inc/plugin-update-checker'
Cloning into '/svr-setup/wp-jquery-manager/inc/plugin-update-checker'...
Submodule path 'inc/plugin-update-checker': checked out '9d087b7d9c4e040087b14aaba2c171aa81d34603'

ls -lah inc/plugin-update-checker                
total 68K
drwxr-xr-x 8 root root 4.0K May  9 03:10 .
drwxr-xr-x 3 root root 4.0K May  9 03:10 ..
-rw-r--r-- 1 root root  707 May  9 03:10 composer.json
drwxr-xr-x 2 root root 4.0K May  9 03:10 css
-rw-r--r-- 1 root root  271 May  9 03:10 .editorconfig
drwxr-xr-x 2 root root 4.0K May  9 03:10 examples
-rw-r--r-- 1 root root   53 May  9 03:10 .git
drwxr-xr-x 2 root root 4.0K May  9 03:10 js
drwxr-xr-x 2 root root 4.0K May  9 03:10 languages
-rw-r--r-- 1 root root 1.1K May  9 03:10 license.txt
-rw-r--r-- 1 root root 1.1K May  9 03:10 plugin-update-checker.php
drwxr-xr-x 4 root root 4.0K May  9 03:10 Puc
-rw-r--r-- 1 root root  16K May  9 03:10 README.md
drwxr-xr-x 2 root root 4.0K May  9 03:10 vendor

Then you can copy/move/zip up /svr-setup/wp-jquery-manager for use

 

okay might want to give it a few hours to try again, I'll have more updates to this fork

 

I created a zip package release 1.7.2-cmm for centminmod branch fork at centminmod/wp-jquery-manager you can try with the submodules added - download the 1.7.2-cmm linked named one not the source ones listed in assets section as they don't include submodules.

 

Example of my forked wp-jquery-manager jquery files with patched versions from DanielRuf/snyk-js-jquery-174006 for CVE-2019-11358 - prototype pollution vulnerability fixes in jquery 1.12.4, 2.2.4, 3.3.1 and also fully fixed jquery 3.4.1 on Wordpress 5.2 which was just released. Installed Wordpress 5.2 via centmin.sh menu option 22 wordpress auto installer with test code for php-fpm fastcgi_cache full page wordpress caching

I created a wp-jquery-manager 1.7.2-cmm release tag (and 1.7.6-cmm release tagged and 1.7.8-cmm release tagged) which bundles the submodules required as well. So SSH installation for Centmin Mod 123.09beta01 and newer version of centmin.sh menu option 22 would install Wordpress 5.2 into directory at /home/nginx/domains/yourdomain.com/public where yourdomain.com is your wordpress site's domain name.

Change vhostname=yourdomain.com to assign your domain name to vhostname variable and run these commands after installing Wordpress via centmin.sh menu option 22. I use wp-cli to activate the plugin and check it's status.

Code (Text):

vhostname=yourdomain.com
cd /svr-setup
wget https://github.com/centminmod/wp-jquery-manager/releases/download/1.7.8-cmm/1.7.8-cmm.zip
unzip 1.7.8-cmm.zip -d /home/nginx/domains/$vhostname/public/wp-content/plugins/wp-query-manager
chown -R nginx:nginx /home/nginx/domains/$vhostname/public/wp-content/plugins/wp-query-manager
ls -lah /home/nginx/domains/$vhostname/public/wp-content/plugins/wp-query-manager
cd /home/nginx/domains/$vhostname/public
wp plugin activate wp-query-manager --allow-root
wp plugin status wp-query-manager --allow-root

Code (Text):

wp plugin activate wp-query-manager --allow-root
Plugin 'wp-query-manager' activated.
Success: Activated 1 of 1 plugins.

wp plugin status wp-query-manager --allow-root
Plugin wp-query-manager details:
   Name: jQuery Manager for WordPress
   Status: Active
   Version: 1.7.6-cmm
   Author: Remzi Cavdar
   Description: Manage jQuery and jQuery Migrate on a WordPress website, select a specific jQuery and/or jQuery Migrate version. The ultimate jQuery debugging tool for WordPress. This plugin is a open source project, made possible by your contribution (code). Development is done on GitHub.

Now seeing jquery 3.4.1 and jquery-migrate 3.0.1 in action on default Wordpress 5.2 theme, Twenty Nineteen.



wp-jquery-manager, only updates jquery 3.4.1 and jquery-migrate 3.0.1 on frontend of wordpress. The admin backend can use default included jquery 1.12.4 and jquery-migrate 1.4.1 for best compatibility without breaking the admin backend



As Autoptimize Wordpress plugin is installed, I temporarily disable JS optimisations so I can see jquery and jquery-migrate's individual files and version query strings load to verify that correct versions are loaded.



And centmin.sh menu option tested php-fpm fastcgi_cache full page Wordpress caching in action for cache miss/bypass versus cache hit. Centmin Mod will create a include file at /usr/local/nginx/conf/wpfastcgi_cache_map.conf loaded in /usr/local/nginx/conf/nginx.conf which has a debug nginx map to whitelist your IP addresses so only those whitelisted IPs will be able to see the additional php-fpm fastcgi_cache status/stats related headers.

Code (Text):

map $remote_addr $fastcgi_debug {
  default 0;
  include /usr/local/nginx/conf/wpfastcgi_cache_map_debug.conf;
  # YOUR_ISP_IP_ADDR 1;
}

If you prefer for all visitors to view the additional headers without using whitelisted IPs, just change default 0 to default 1 as below and restart nginx service.

Code (Text):

map $remote_addr $fastcgi_debug {
  default 1;
  include /usr/local/nginx/conf/wpfastcgi_cache_map_debug.conf;
  # YOUR_ISP_IP_ADDR 1;
}

FYI, x-fpmcache-skip header actually tells you the class/rule (cookies, POST, querystrings, XMLHttprequest, specific URIs etc) which caused the fastcgi_cache to bypass the cache. In this case it was due to multiple -Cookie which append to each other, so in this case 2x wordpress logged in cookies caused a cache bypass.

 

Let me know how it goes in the real world in production/testing for you

 

only available for centmin.sh menu option 22 fastcgi_cache method installs and that is internal private beta tested right now so not available by default - yet

 

Yeah there is another persistent config variable to enable centmin.sh menu option 22's fastcgi_cache full page cache method - just the routine isn't for configuration and setup isn't perfected yet so needs more time

FYI, ngx_pagespeed won't work properly with any of the full page wordpress caching methods - keycdn cache enabler, redis nginx level cache, wordpress super cache or fastcgi_cache caching. Reason is ngx_pagespeed requires the document/html page to use nocache headers out of the box so it can monitor and learn what page assets and page render/flow happens to be able to do ngx_pagespeed's page speed optimizations. With nocache header in place, all those full page cache methods will only ever return a cache miss/bypass for full page wordpress caching. Also ngx_pagespeed will do it's own compression taking priority from Centmin Mod Nginx and any gzip/brotli precompressed assets AFAIK.

So basically with wordpress full page caching in place, you need to disable ngx_pagespeed.

 

when you disable ngx_pagespeed via pscontrol off command, it should set pagespeed unplugged in global
/usr/local/nginx/conf/pagespeed.conf include file so no need to set in your vhost.

Also for testing use Chrome private incognito browsing sessions so you sure you're not testing with browser cache. Also test with 3rd party curl test or curl command line header checks to ensure you see all headers as sometimes not all headers shown in browser dev tool network tab's response header fields HTTP Header Check with an online CURL tool

 

that is due to the wpsecure custom whitelisted wp plugin location syntax canceling out staticfiles.conf include file's expire cache headers - ngx_pagespeed only optimizes the missing expire headers which can still do without ngx_pagespeed


so change in https://community.centminmod.com/threads/autoprotect-is-driving-me-crazy.17324/#post-73475 from

Code (Text):

  location ~ ^/wp-content/plugins/sitepress-multilingual-cms/(.+/)?(.+)\.(css|js)$ { allow all; }
  location ~ ^/wp-content/plugins/sitepress-multilingual-cms/(.+/)?(.+)\.(png|gif)$ { allow all; }
  location ~* /wp-content/plugins/sitepress-multilingual-cms/.*\.php$ {
   include /usr/local/nginx/conf/php.conf;
   allow 127.0.0.1;
   deny all;
  }

to add expires 30d directive and restart nginx

Code (Text):

  location ~ ^/wp-content/plugins/sitepress-multilingual-cms/(.+/)?(.+)\.(css|js)$ { allow all; expires 30d;}
  location ~ ^/wp-content/plugins/sitepress-multilingual-cms/(.+/)?(.+)\.(png|gif)$ { allow all; expires 30d;}
  location ~* /wp-content/plugins/sitepress-multilingual-cms/.*\.php$ {
   include /usr/local/nginx/conf/php.conf;
   allow 127.0.0.1;
   deny all;
  }

 

yeah indeed that is correct way to do it for single vhost - but it's just knowledge you need to know for ngx_pagespeed.

Yeah probably need to add it to https://centminmod.com/nginx_ngx_pagespeed.html as well.