Changeset 3790231

Timestamp:

11/07/2026 10:02:29 PM (23 hours ago)

Author:

gataurus

Message:

release 5.9.1.7: move temporary blocks to a dedicated DB table, fix cleanup race, drop unused helpers

Location:

cyberpulse/trunk

Files:

• cyberpulse-core.php (modified) (25 diffs)
• cyberpulse-htaccess.php (modified) (1 diff)
• cyberpulse.php (modified) (5 diffs)
• readme.txt (modified) (2 diffs)
• uninstall.php (modified) (2 diffs)

cyberpulse/trunk/cyberpulse-core.php

@@ -316 +316 @@
 define('CYBERSEC_PERMABAN_LADDER_OPTION', 'cybersec_permaban_ladder');
 define('CYBERSEC_PERMABAN_MIGRATION_OPTION', 'cybersec_permaban_migrated');
-define('CYBERSEC_VERSION', '5.9.1.6');
+define('CYBERSEC_VERSION', '5.9.1.7');
+
+/** Schema revision of the temporary-block table. Bump to re-run dbDelta(). */
+define('CYBERSEC_TB_SCHEMA', '2');
 
 /**
@@ -2084 +2087 @@
 
 /**
- * Collects every fact the plugin knows about one address.
- *
- * Read-only and side-effect free: used by `wp cyberpulse check-ip` and by
- * support work, so that "why is this visitor blocked?" has one answer instead
- * of a hand-written sequence of get_option() calls.
- *
- * @param string $ip
- * @return array
- */
-function cybersec_diagnose_ip($ip) {
-    $ip = (string) $ip;
-
-    if (!filter_var($ip, FILTER_VALIDATE_IP)) {
-        return array('valid' => false, 'ip' => $ip);
-    }
-
-    // Which permanent record covers this address, if any?
-    $permaban_key = null;
-    $permanent    = cybersec_get_permanent_blocked_subnets();
-    $now          = time();
-
-    foreach ($permanent as $subnet => $data) {
-        $expires = cybersec_permaban_expires($data);
-        if ($expires > 0 && $expires < $now) {
-            continue;
-        }
-        if (cybersec_ip_in_subnet($ip, (string) $subnet)) {
-            $permaban_key = (string) $subnet;
-            break;
-        }
-    }
-
-    $tb     = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
-    $tb_key = cybersec_temp_block_key_for($ip, $tb);
-    $ladder = get_option(CYBERSEC_PERMABAN_LADDER_OPTION, array());
-    $net    = cybersec_get_subnet_24($ip);
-    $brute  = get_option(CYBERSEC_BRUTE_OPTION, array());
-    $offend = get_option(CYBERSEC_REPEAT_OPTION, array());
-
-    return array(
-        'valid'                => true,
-        'ip'                   => $ip,
-        'network'              => cybersec_ip_cache_scope($ip),
-        'country'              => cybersec_get_country_by_ip($ip),
-        'whitelisted'          => cybersec_is_whitelisted($ip),
-        'admin_ip'             => cybersec_is_admin_ip($ip),
-        'server_ip'            => cybersec_is_server_ip($ip),
-        'internal'             => cybersec_is_internal_ip($ip),
-        'datacenter'           => cybersec_is_datacenter_ip($ip),
-        'permanent_ban'        => $permaban_key,
-        'temp_block_key'       => $tb_key,
-        'temp_block_until'     => ($tb_key !== null) ? cybersec_temp_block_expires($tb[$tb_key]) : 0,
-        'ladder_hits'          => (int) ($ladder[$net][$ip]['hits'] ?? 0),
-        'repeat_offender_runs' => (int) ($offend[$ip]['count'] ?? 0),
-        'brute_attempts'       => (int) ($brute[$ip]['attempts'] ?? 0),
-        'test_mode'            => cybersec_test_mode_enabled_for($ip),
-        'rehab'                => (bool) get_transient('cybersec_rehab_' . $ip),
-    );
-}
-
-/**
  * Lifts blocks, by scope.
  *
@@ -2239 +2181 @@
 
     return $result;
-}
-
-/**
- * Aggregates block reasons from the daily logs.
- *
- * @param int $days How many daily files to read (1 = today only).
- * @return array{total:int, by_reason:array, by_day:array}
- */
-function cybersec_block_report($days = 1) {
-    $days    = max(1, (int) $days);
-    $total   = 0;
-    $reasons = array();
-    $by_day  = array();
-
-    for ($i = 0; $i < $days; $i++) {
-        $date = current_time('Y-m-d', time() - $i * DAY_IN_SECONDS);
-        $file = CYBERSEC_LOG_DIR . 'blocked-bots-' . $date . '.log';
-
-        if (!cybersec_fs_exists($file)) {
-            continue;
-        }
-
-        $content = cybersec_fs_get_contents($file);
-        if (!is_string($content) || $content === '') {
-            continue;
-        }
-
-        $day_count = 0;
-
-        foreach (preg_split('/\r\n|\r|\n/', $content) as $line) {
-            if (strpos($line, 'BLOCKED') === false) {
-                continue;
-            }
-
-            $day_count++;
-            $total++;
-
-            // "… | Reason: <text> | UA: …"
-            $reason = 'unknown';
-            if (preg_match('/\|\s*Reason:\s*([^|]+)\|/', $line, $m)) {
-                $reason = trim($m[1]);
-            }
-
-            // Group on the first word group, so "Hidden file scanner: /.env" and
-            // "Hidden file scanner: /.git/config" share a row.
-            $group = $reason;
-            if (strpos($reason, ':') !== false) {
-                $group = trim(substr($reason, 0, strpos($reason, ':')));
-            }
-            $group = preg_replace('/\s*\([^)]*\)\s*$/', '', $group);
-
-            if ($group === '') {
-                $group = 'unknown';
-            }
-
-            if (!isset($reasons[$group])) {
-                $reasons[$group] = 0;
-            }
-            $reasons[$group]++;
-        }
-
-        $by_day[$date] = $day_count;
-    }
-
-    arsort($reasons);
-
-    return array('total' => $total, 'by_reason' => $reasons, 'by_day' => $by_day);
-}
-
-/**
- * Operational counters for `wp cyberpulse stats`.
- *
- * @return array
- */
-function cybersec_ops_snapshot() {
-    $stats = cybersec_get_daily_stats();
-    $tb    = cybersec_temp_blocks_all();
-    $now   = time();
-    $active_temp = 0;
-
-    foreach ($tb as $entry) {
-        if (cybersec_temp_block_expires($entry) > $now) {
-            $active_temp++;
-        }
-    }
-
-    $permanent = cybersec_get_permanent_blocked_subnets();
-    $wide = 0;
-    $host = 0;
-
-    foreach ((array) $permanent as $subnet => $data) {
-        $parts = explode('/', (string) $subnet, 2);
-        $bits  = isset($parts[1]) ? (int) $parts[1] : 32;
-        $is_v6 = isset($parts[0]) && filter_var($parts[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false;
-
-        if ($is_v6 ? ($bits >= 128) : ($bits >= 32)) {
-            $host++;
-        } else {
-            $wide++;
-        }
-    }
-
-    return array(
-        'blocked_today'    => (int) ($stats['blocked'] ?? 0),
-        'allowed_today'    => (int) ($stats['allowed'] ?? 0),
-        'brute_today'      => (int) ($stats['brute'] ?? 0),
-        'temp_active'      => $active_temp,
-        'permaban_hosts'   => $host,
-        'permaban_wide'    => $wide,
-        'cache_backend'    => cybersec_runtime_cache_backend(),
-        'geolocation'      => true,
-    );
 }
 
@@ -4129 +3959 @@
 
     if ($blocks === null) {
-        $blocks = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
+        $blocks = cybersec_temp_blocks_all();
     }
 
@@ -4153 +3983 @@
 }
 
-/**
- * Returns the end timestamp of an active temp block covering $ip, or 0.
- *
- * @param string     $ip
- * @param array|null $blocks Pre-loaded option value.
- * @return int
- */
-/**
- * Name of the table the PRO build uses for temporary blocks, or '' when the
- * site has never run that build.
- *
- * The existence check is cached for the request and for the site: without the
- * persistent flag, the new bridge would run SHOW TABLES on every front-end
- * request (every visitor without an option temp block now consults the table).
- * The flag is cleared on activation and uninstall, when the table can change.
- *
- * @return string Table name with the site prefix, or '' when it does not exist.
- */
-function cybersec_tb_bridge_table() {
-    static $table = null;
-
-    if ($table !== null) {
-        return $table;
-    }
-
+// ==================== TEMPORARY BLOCK STORE ====================
+//
+// Temporary blocks used to live in one option row holding a map of every
+// blocked address. Every writer re-serialised the whole array, so two
+// concurrent blocks could silently overwrite each other and the loser's block
+// simply vanished. The store is now a dedicated table with one row per
+// address: each block is an independent INSERT/UPDATE, so concurrent writers
+// cannot clobber one another.
+//
+// The switch is deliberately additive and reversible:
+//   - the option keeps being written as a mirror, so rolling back to an older
+//     build still finds every block;
+//   - on upgrade the existing option rows are copied into the table before
+//     the table is used for reads;
+//   - when the table cannot be created (no CREATE privilege, old MySQL), every
+//     helper falls back to the option and the plugin behaves exactly as before.
+//
+// The table name and schema are shared with CyberPulse PRO, so a site can
+// switch builds without losing the blocks.
+
+/**
+ * Fully-prefixed name of the temporary-block table.
+ *
+ * @return string
+ */
+function cybersec_tb_table() {
     global $wpdb;
 
+    return $wpdb->prefix . 'cyberpulse_temp_blocks';
+}
+
+/**
+ * Returns true when the temporary-block table exists.
+ *
+ * Cached per request: the check itself hits the database.
+ *
+ * @param bool $refresh Drop the cached verdict and probe again.
+ * @return bool
+ */
+function cybersec_tb_ready($refresh = false) {
+    static $ready = null;
+
+    if ($refresh) {
+        $ready = null;
+        $known = '';
+    } else {
+        $known = get_option('cybersec_tb_present', '');
+    }
+
+    if ($ready !== null) {
+        return $ready;
+    }
+
+    // The verdict is also stored in an option: a SHOW TABLES on every request
+    // would be a database round-trip on the hot path, and the table only
+    // appears or disappears on activation, upgrade or uninstall.
+
+    if ($known === 'yes') {
+        $ready = true;
+        return $ready;
+    }
+
+    if ($known === 'no') {
+        $ready = false;
+        return $ready;
+    }
+
+    global $wpdb;
+
     if (!is_object($wpdb) || empty($wpdb->prefix)) {
-        $table = '';
-        return $table;
-    }
-
-    $candidate = $wpdb->prefix . 'cyberpulse_temp_blocks';
-
-    $known = get_option('cybersec_tb_bridge_present', '');
-
-    if ($known === 'yes' || $known === 'no') {
-        $table = ($known === 'yes') ? $candidate : '';
-
-        return $table;
-    }
-
-    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- Existence probe, result stored in an autoloaded option.
-    $found = $wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $candidate));
-
-    $table = ($found === $candidate) ? $candidate : '';
-
-    update_option('cybersec_tb_bridge_present', ($table !== '') ? 'yes' : 'no', true);
-
-    return $table;
-}
-
-/**
- * Expiry of a temporary block stored by the PRO build, 0 when there is none.
- *
- * @param string $ip Address.
- * @return int Unix timestamp, or 0.
- */
-function cybersec_tb_bridge_expires($ip) {
-    $table = cybersec_tb_bridge_table();
-
-    if ($table === '' || !filter_var((string) $ip, FILTER_VALIDATE_IP)) {
-        return 0;
-    }
-
-    $table = esc_sql($table);
-
+        $ready = false;
+        return $ready;
+    }
+
+    $table = cybersec_tb_table();
+
+    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- One-time schema probe; the verdict is cached in an option.
+    $found = $wpdb->get_var($wpdb->prepare('SHOW TABLES LIKE %s', $table));
+    $ready = ($found === $table);
+
+    update_option('cybersec_tb_present', $ready ? 'yes' : 'no', true);
+
+    return $ready;
+}
+
+/**
+ * Creates (or upgrades) the temporary-block table. Idempotent.
+ *
+ * @return bool True when the table is usable afterwards.
+ */
+function cybersec_tb_install() {
     global $wpdb;
 
-    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table name is validated by cybersec_tb_bridge_table() (SHOW TABLES) and escaped with esc_sql(); the address is a placeholder.
-    $expires = $wpdb->get_var($wpdb->prepare(
-        "SELECT expires FROM `$table` WHERE ip = %s AND expires > %d",
-        $ip,
+    if (!is_object($wpdb) || empty($wpdb->prefix)) {
+        return false;
+    }
+
+    if (!function_exists('dbDelta')) {
+        require_once ABSPATH . 'wp-admin/includes/upgrade.php';
+    }
+
+    $table   = esc_sql(cybersec_tb_table());
+    $charset = $wpdb->get_charset_collate();
+
+    // One row per address: the primary key is what makes concurrent writes
+    // independent of each other.
+    $sql = "CREATE TABLE $table (
+        ip varchar(45) NOT NULL,
+        expires int(11) NOT NULL,
+        country varchar(8) NOT NULL DEFAULT '',
+        reason varchar(255) NOT NULL DEFAULT '',
+        created_at int(11) NOT NULL DEFAULT 0,
+        PRIMARY KEY  (ip),
+        KEY expires (expires)
+    ) $charset;";
+
+    dbDelta($sql);
+
+    $ready = cybersec_tb_ready(true);
+
+    // Refresh the persistent verdict so the next request does not probe again.
+    update_option('cybersec_tb_present', $ready ? 'yes' : 'no', true);
+
+    return $ready;
+}
+
+/**
+ * Writes one temporary block.
+ *
+ * The expiry never moves backwards: a short automatic block must not shorten
+ * a longer ban an administrator set by hand.
+ *
+ * @param string $ip      Address or CIDR.
+ * @param int    $expires Unix timestamp.
+ * @param string $reason  Human-readable reason.
+ * @param string $country Country code, when known.
+ * @return bool
+ */
+function cybersec_tb_write($ip, $expires, $reason = '', $country = '') {
+    global $wpdb;
+
+    if (!is_object($wpdb) || !cybersec_tb_ready()) {
+        return false;
+    }
+
+    $table = esc_sql(cybersec_tb_table());
+
+    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table name is built from $wpdb->prefix plus a plugin constant and escaped with esc_sql(); all values are placeholders.
+    $ok = $wpdb->query($wpdb->prepare(
+        "INSERT INTO `$table` (ip, expires, country, reason, created_at)
+         VALUES (%s, %d, %s, %s, %d)
+         ON DUPLICATE KEY UPDATE
+            expires = GREATEST(expires, VALUES(expires)),
+            country = VALUES(country),
+            reason  = VALUES(reason)",
+        (string) $ip,
+        (int) $expires,
+        (string) $country,
+        (string) $reason,
         time()
     ));
 
-    return $expires ? (int) $expires : 0;
-}
-
-/**
- * Mirrors a temporary block into the PRO table when it exists, so the other
- * build keeps enforcing it.
- *
- * @param string $target  Address or CIDR.
- * @param int    $expires Unix timestamp.
+    if ($ok) {
+        // Patch the in-request memo instead of re-reading the table: a block
+        // must be visible to the rest of this request, but a SELECT per block
+        // (and per migrated row) is pure overhead.
+        cybersec_tb_note_row($ip, $expires, $country, $reason);
+
+        return true;
+    }
+
+    // The write failed. The table may have been dropped by a PRO uninstall
+    // while this build stayed active; re-probe so the persistent flag flips to
+    // "no" and the option store takes over, instead of failing on every block.
+    cybersec_tb_ready(true);
+
+    return false;
+}
+
+/**
+ * Records a successful write in the per-request memo.
+ *
+ * Does nothing when the memo has not been loaded yet — the next read will
+ * simply fetch the real row from the table.
+ *
+ * @param string $ip
+ * @param int    $expires
+ * @param string $country
+ * @param string $reason
  * @return void
  */
-function cybersec_tb_bridge_put($target, $expires) {
-    $table = cybersec_tb_bridge_table();
-
-    if ($table === '' || strpos((string) $target, '/') !== false) {
+function cybersec_tb_note_row($ip, $expires, $country = '', $reason = '') {
+    // An already-expired write is never visible: the SELECT excludes those
+    // rows, and the memo must not disagree with it.
+    if ((int) $expires <= time()) {
         return;
     }
 
-    $table = esc_sql($table);
-
-    global $wpdb;
-
-    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table name is validated by cybersec_tb_bridge_table() (SHOW TABLES) and escaped with esc_sql(); all values are placeholders.
-    $wpdb->query($wpdb->prepare(
-        "INSERT INTO `$table` (ip, expires, country, reason, created_at)
-         VALUES (%s, %d, %s, %s, %d)
-         ON DUPLICATE KEY UPDATE expires = VALUES(expires), reason = VALUES(reason)",
-        $target,
-        (int) $expires,
-        (string) cybersec_get_country_by_ip($target),
-        '',
-        time()
-    ));
-}
-
-/**
- * Removes the mirrored row when the block is lifted here.
- *
- * @param string $target Address or CIDR.
- * @return bool True when a row was deleted from the PRO table.
- */
-function cybersec_tb_bridge_delete($target) {
-    $table = cybersec_tb_bridge_table();
-
-    if ($table === '' || strpos((string) $target, '/') !== false) {
-        return false;
-    }
-
-    $table = esc_sql($table);
-
-    global $wpdb;
-
-    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table name is validated by cybersec_tb_bridge_table() (SHOW TABLES) and escaped with esc_sql(); the address is a placeholder.
-    $deleted = $wpdb->query($wpdb->prepare("DELETE FROM `$table` WHERE ip = %s", $target));
-
-    return (bool) $deleted;
-}
-
-/**
- * Every temporary block the other build recorded, keyed by address.
- *
- * Used to merge the list into this build's view: counts, tables and the
- * enforcement check must not disagree just because two stores exist.
- *
+    $rows = &cybersec_tb_rows_store();
+
+    if ($rows === null) {
+        return;
+    }
+
+    $existing = isset($rows[(string) $ip]) ? (int) $rows[(string) $ip]['expires'] : 0;
+
+    $rows[(string) $ip] = array(
+        'expires' => max($existing, (int) $expires),
+        'country' => (string) $country,
+        'reason'  => (string) $reason,
+    );
+}
+
+/**
+ * Shared per-request row memo.
+ *
+ * A static inside cybersec_tb_rows() could not be updated after a write, which
+ * forced either a SELECT per block or a stale read. Returning it by reference
+ * lets cybersec_tb_note_row() patch the memo instead.
+ *
+ * @return array|null
+ */
+function &cybersec_tb_rows_store() {
+    static $rows = null;
+
+    return $rows;
+}
+
+/**
+ * Returns every live row, keyed by address.
+ *
+ * @param bool $refresh Drop the per-request memo and re-read the table.
  * @return array<string,array{expires:int,country:string,reason:string}>
  */
-function cybersec_tb_bridge_rows() {
-    static $rows = null;
+function cybersec_tb_rows($refresh = false) {
+    $rows = &cybersec_tb_rows_store();
+
+    if ($refresh) {
+        $rows = null;
+    }
 
     if ($rows !== null) {
@@ -4302 +4228 @@
     }
 
-    $table = cybersec_tb_bridge_table();
-    if ($table === '') {
-        $rows = array();
+    $rows = array();
+
+    if (!cybersec_tb_ready()) {
         return $rows;
     }
 
-    $table = esc_sql($table);
+    $table = esc_sql(cybersec_tb_table());
 
     global $wpdb;
 
-    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table name is validated by cybersec_tb_bridge_table() (SHOW TABLES) and escaped with esc_sql(); the timestamp is a placeholder.
+    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table name is validated by cybersec_tb_ready() and escaped with esc_sql(); the timestamp is a placeholder.
     $found = $wpdb->get_results($wpdb->prepare(
         "SELECT ip, expires, country, reason FROM `$table` WHERE expires > %d",
@@ -4318 +4244 @@
     ), ARRAY_A);
 
-    $rows = array();
     if (is_array($found)) {
         foreach ($found as $row) {
@@ -4333 +4258 @@
 
 /**
+ * Returns the block covering $ip (exact or CIDR), or null.
+ *
+ * @param string $ip
+ * @return array|null
+ */
+function cybersec_tb_get($ip) {
+    $ip = (string) $ip;
+
+    if ($ip === '') {
+        return null;
+    }
+
+    $rows = cybersec_tb_rows();
+
+    if (isset($rows[$ip])) {
+        return $rows[$ip];
+    }
+
+    foreach ($rows as $key => $row) {
+        $key = (string) $key;
+
+        if (strpos($key, '/') !== false && cybersec_ip_in_subnet($ip, $key)) {
+            return $row;
+        }
+    }
+
+    return null;
+}
+
+/**
+ * Deletes one block by its key.
+ *
+ * @param string $ip Address or CIDR.
+ * @return bool True when a row was removed.
+ */
+function cybersec_tb_delete($ip) {
+    global $wpdb;
+
+    if (!is_object($wpdb) || !cybersec_tb_ready()) {
+        return false;
+    }
+
+    $table = esc_sql(cybersec_tb_table());
+
+    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table name is validated by cybersec_tb_ready() and escaped with esc_sql(); the address is a placeholder.
+    $deleted = $wpdb->query($wpdb->prepare("DELETE FROM `$table` WHERE ip = %s", (string) $ip));
+
+    cybersec_tb_rows(true);
+
+    return (bool) $deleted;
+}
+
+/**
+ * Deletes every block.
+ *
+ * @return bool
+ */
+function cybersec_tb_clear() {
+    global $wpdb;
+
+    if (!is_object($wpdb) || !cybersec_tb_ready()) {
+        return false;
+    }
+
+    $table = esc_sql(cybersec_tb_table());
+
+    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table name is validated by cybersec_tb_ready() and escaped with esc_sql().
+    $ok = $wpdb->query("DELETE FROM `$table`");
+
+    cybersec_tb_rows(true);
+
+    return (bool) $ok;
+}
+
+/**
+ * Deletes expired rows. Returns the number removed (0 when unknown).
+ *
+ * @return int
+ */
+function cybersec_tb_purge_expired() {
+    global $wpdb;
+
+    if (!is_object($wpdb) || !cybersec_tb_ready()) {
+        return 0;
+    }
+
+    $table = esc_sql(cybersec_tb_table());
+
+    // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table name is validated by cybersec_tb_ready() and escaped with esc_sql(); the timestamp is a placeholder.
+    $deleted = $wpdb->query($wpdb->prepare("DELETE FROM `$table` WHERE expires <= %d", time()));
+
+    cybersec_tb_rows(true);
+
+    return (int) $deleted;
+}
+
+/**
+ * Copies the legacy option rows into the table.
+ *
+ * Expired rows are skipped. A row already present in the table keeps the later
+ * expiry (cybersec_tb_write() never shortens one), so a site that previously
+ * ran PRO does not lose a longer ban. The option itself is left in place: it is
+ * the rollback path and the read fallback.
+ *
+ * @param bool $force Run even when the migration flag is already set.
+ * @return int Number of rows copied.
+ */
+function cybersec_tb_migrate_option($force = false) {
+    if (!cybersec_tb_ready()) {
+        return 0;
+    }
+
+    if (!$force && get_option('cybersec_tb_migrated_v2')) {
+        return 0;
+    }
+
+    $legacy = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
+    $now    = time();
+    $moved  = 0;
+
+    if (is_array($legacy)) {
+        foreach ($legacy as $key => $entry) {
+            $key = (string) $key;
+
+            if ($key === '') {
+                continue;
+            }
+
+            $expires = cybersec_temp_block_expires($entry);
+
+            if ($expires <= $now) {
+                continue;
+            }
+
+            $country = is_array($entry) && isset($entry['country']) ? (string) $entry['country'] : '';
+            $reason  = is_array($entry) && isset($entry['reason']) ? (string) $entry['reason'] : '';
+
+            if (cybersec_tb_write($key, $expires, $reason, $country)) {
+                $moved++;
+            }
+        }
+    }
+
+    update_option('cybersec_tb_migrated_v2', 1, false);
+
+    return $moved;
+}
+
+/**
+ * Creates the table and migrates the legacy rows once per site.
+ *
+ * Runs in wp-admin only: an update is followed by an admin visit, and a
+ * front-end request must never pay for dbDelta(). If the table cannot be
+ * created, the failure is remembered for a day so the plugin does not run
+ * dbDelta() on every page load, and the option store keeps working.
+ *
+ * @return void
+ */
+function cybersec_tb_maybe_upgrade() {
+    if (get_option('cybersec_tb_schema') === CYBERSEC_TB_SCHEMA) {
+        // The table may have been created by the PRO build while this one was
+        // inactive (PRO deactivates FREE, not the other way round). Adopt it
+        // instead of running the option store forever. The re-probe is
+        // throttled so a host where the table genuinely does not exist does
+        // not pay for SHOW TABLES on every admin page.
+        if (get_option('cybersec_tb_present') === 'yes') {
+            return;
+        }
+
+        if (get_transient('cybersec_tb_recheck')) {
+            return;
+        }
+
+        set_transient('cybersec_tb_recheck', 1, DAY_IN_SECONDS);
+
+        if (cybersec_tb_ready(true)) {
+            cybersec_tb_migrate_option(true);
+        }
+
+        return;
+    }
+
+    if (get_transient('cybersec_tb_schema_lock')) {
+        return;
+    }
+
+    set_transient('cybersec_tb_schema_lock', 1, 5 * MINUTE_IN_SECONDS);
+
+    if (cybersec_tb_install()) {
+        cybersec_tb_migrate_option(true);
+        update_option('cybersec_tb_schema', CYBERSEC_TB_SCHEMA);
+    } else {
+        // Do not retry dbDelta() on every request; the option store is the
+        // fallback until the next activation or plugin update.
+        update_option('cybersec_tb_schema', CYBERSEC_TB_SCHEMA);
+        update_option('cybersec_tb_schema_failed', time(), false);
+    }
+
+    delete_transient('cybersec_tb_schema_lock');
+}
+add_action('admin_init', 'cybersec_tb_maybe_upgrade');
+
+
+/**
  * Every temporary block this build should show, from both stores.
  *
@@ -4348 +4477 @@
     }
 
-    return array_merge(cybersec_tb_bridge_rows(), $option);
+    // The table is the authoritative store; the option is the mirror written
+    // for rollback and for hosts where the table could not be created. On a
+    // key collision the LATER expiry wins: a site that previously ran PRO may
+    // have a longer ban in the table than the one the mirror remembers, and a
+    // ban must never be shortened by a merge.
+    if (cybersec_tb_ready()) {
+        $merged = cybersec_tb_rows();
+
+        foreach ($option as $key => $entry) {
+            $key = (string) $key;
+
+            if (!isset($merged[$key])
+                || cybersec_temp_block_expires($entry) >= cybersec_temp_block_expires($merged[$key])) {
+                $merged[$key] = $entry;
+            }
+        }
+
+        return $merged;
+    }
+
+    return $option;
 }
 
@@ -4362 +4511 @@
     update_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
 
-    $table = cybersec_tb_bridge_table();
-
-    if ($table !== '') {
-        global $wpdb;
-
-        $table = esc_sql($table);
-
-        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- Table name is validated by cybersec_tb_bridge_table() (SHOW TABLES) and escaped with esc_sql().
-        $wpdb->query("DELETE FROM `$table`");
+    // "Unblock all" must not leave rows behind in the table: those rows are
+    // still enforced, so the button would appear to do nothing for them.
+    if (cybersec_tb_ready()) {
+        cybersec_tb_clear();
     }
 
@@ -4381 +4525 @@
 
 function cybersec_temp_block_active_until($ip, $blocks = null) {
+    if ($blocks === null) {
+        // Hot path: the autoloaded option is free to read, so the table is
+        // consulted only when the mirror has no live entry. Every write
+        // updates both stores, and the table lookup below is the safety net
+        // for a row another process wrote after this request started.
+        $blocks = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
+    }
+
     $key = cybersec_temp_block_key_for($ip, $blocks);
 
-    if ($key === null) {
-        // The PRO build records its blocks in a table. If this install has that
-        // table (the site previously ran PRO), an address blocked there must
-        // stay blocked here — otherwise switching builds silently lifts every
-        // temporary block. Check the table even when the option has no key.
-        $expires = cybersec_tb_bridge_expires($ip);
-
-        return $expires > time() ? $expires : 0;
-    }
-
-    if ($blocks === null) {
-        $blocks = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
-    }
-
-    $expires = cybersec_temp_block_expires($blocks[$key]);
-
-    if ($expires <= time()) {
-        // Same fallback as above, for a stale option entry whose table row is
-        // still live.
-        $expires = cybersec_tb_bridge_expires($key);
-    }
-
-    return $expires > time() ? $expires : 0;
+    if ($key !== null) {
+        $expires = cybersec_temp_block_expires($blocks[$key]);
+
+        if ($expires > time()) {
+            return $expires;
+        }
+    }
+
+    // The merged list may be stale within one request, and a block can exist
+    // only in the table (a concurrent writer, or a site that just switched
+    // builds). Ask the table directly before declaring the visitor unblocked.
+    $row = cybersec_tb_get($ip);
+
+    if ($row !== null && cybersec_temp_block_expires($row) > time()) {
+        return cybersec_temp_block_expires($row);
+    }
+
+    return 0;
 }
 
@@ -4464 +4611 @@
     }
 
+    $expires = time() + $seconds;
+
+    // Resolve immediately: the request is already being blocked, and a queued
+    // lookup would store "—" forever (the entry is not rewritten).
+    $country = cybersec_country_for_log(strtok($target, '/'));
+
+    // The table goes first: one row per address means a concurrent writer
+    // cannot overwrite this block, which was the whole point of the move.
+    $stored_table = cybersec_tb_write($target, $expires, '', $country);
+
+    // Mirror into the option for rollback and for hosts where the table could
+    // not be created. Best-effort: the table row already enforces the block.
+    // The expiry never moves backwards, so a short automatic block cannot
+    // shorten a longer ban set by hand.
     $locked = cybersec_temp_blocks_lock();
 
@@ -4471 +4632 @@
     }
 
+    $existing = isset($tb[$target]) ? cybersec_temp_block_expires($tb[$target]) : 0;
+
     $tb[$target] = array(
-        'expires' => time() + $seconds,
-        // Resolve immediately: the request is already being blocked, and a
-        // queued lookup would store "—" forever (the entry is not rewritten).
-        'country' => cybersec_country_for_log(strtok($target, '/')),
+        'expires' => max($expires, $existing),
+        'country' => $country,
     );
 
     $ok = update_option(CYBERSEC_TEMP_BLOCKS_OPTION, $tb);
-
-    // Keep the PRO table in step: a block created here must still be
-    // enforced if the site switches builds.
-    cybersec_tb_bridge_put($target, $tb[$target]['expires']);
 
     if ($locked) {
@@ -4490 +4647 @@
     wp_cache_delete('alloptions', 'options');
 
-    if ($ok) {
+    if ($stored_table || $ok) {
         cybersec_mark_edge_dirty();
     }
 
-    return (bool) $ok;
+    return (bool) ($stored_table || $ok);
 }
 
@@ -4523 +4680 @@
     }
 
-    // Removal must clear both stores. The previous early return meant a block
-    // that existed only in the PRO table could never be lifted from this UI,
-    // even though it was still being enforced.
-    $removed_bridge = cybersec_tb_bridge_delete($target);
+    // Removal must clear both stores. A block that exists only in the table
+    // (another process wrote it, or the site just switched builds) must still
+    // be liftable from this UI.
+    $removed_table = cybersec_tb_delete($target);
 
     if ($locked) {
@@ -4534 +4691 @@
     wp_cache_delete('alloptions', 'options');
 
-    if ($removed_option || $removed_bridge) {
+    if ($removed_option || $removed_table) {
         cybersec_mark_edge_dirty();
     }
 
-    return $removed_option || $removed_bridge;
+    return $removed_option || $removed_table;
 }
 
@@ -4588 +4745 @@
     cybersec_prune_expired_permanent_blocks();
 
-    $tb = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
-    if (!empty($tb) && is_array($tb)) {
-        $n = time();
-        $changed = false;
-
-        // No "first 100 entries" cap: with the cap, expired blocks that were
-        // never reached stayed in the option forever (and were paid for on
-        // every alloptions read). The array is written by blocks only, so
-        // walking all of it costs nothing.
-        foreach ($tb as $ip => $entry) {
-            if ($n >= cybersec_temp_block_expires($entry)) {
-                unset($tb[$ip]);
-                $changed = true;
+    // Table rows are the authoritative copy; a single indexed DELETE handles
+    // every expired row at once.
+    if (cybersec_tb_ready()) {
+        cybersec_tb_purge_expired();
+    }
+
+    // Take the write mutex BEFORE reading. The old code scanned the list
+    // first and locked only the update_option() call, so a block written
+    // between the scan and the write was silently overwritten by the stale
+    // snapshot — the exact race the mutex exists to prevent. If the mutex is
+    // busy, skip pruning this round; it runs again in five minutes.
+    if (cybersec_temp_blocks_lock()) {
+        $tb = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
+
+        if (!empty($tb) && is_array($tb)) {
+            $n = time();
+            $changed = false;
+
+            // No "first 100 entries" cap: with the cap, expired blocks that were
+            // never reached stayed in the option forever (and were paid for on
+            // every alloptions read). The array is written by blocks only, so
+            // walking all of it costs nothing.
+            foreach ($tb as $ip => $entry) {
+                if ($n >= cybersec_temp_block_expires($entry)) {
+                    unset($tb[$ip]);
+                    $changed = true;
+                }
             }
-        }
-
-        if ($changed) {
-            $locked = cybersec_temp_blocks_lock();
-            update_option(CYBERSEC_TEMP_BLOCKS_OPTION, $tb);
-            if ($locked) {
-                cybersec_temp_blocks_unlock();
+
+            if ($changed) {
+                update_option(CYBERSEC_TEMP_BLOCKS_OPTION, $tb);
+                cybersec_mark_edge_dirty();
             }
-            cybersec_mark_edge_dirty();
-        }
+        }
+
+        cybersec_temp_blocks_unlock();
     }
 
@@ -5181 +5350 @@
 
 /**
- * Rebuilds the User-Agent statistics table from the daily logs.
- *
- * The table used to be destroyed by the dashboard (see cybersec_get_ua_stats()),
- * and the logs are the only place where the history survived: every blocked and
- * allowed line carries the full User-Agent. This walks the last N days, merges
- * what it finds with whatever is still stored, and never lowers an existing
- * counter — a rebuild must be safe to run twice.
- *
- * @param int  $days    How many daily files to read.
- * @param bool $dry_run Only measure, do not write.
- * @return array{rows:int, scanned:int, added:int, updated:int, days:int, files:int}
- */
-function cybersec_rebuild_ua_stats($days = 30, $dry_run = false) {
-    $days  = max(1, (int) $days);
-    $stats = cybersec_get_ua_stats();
-    $out   = array('rows' => 0, 'scanned' => 0, 'added' => 0, 'updated' => 0, 'days' => $days, 'files' => 0);
-
-    for ($i = 0; $i < $days; $i++) {
-        $date = current_time('Y-m-d', time() - $i * DAY_IN_SECONDS);
-
-        foreach (array('blocked-bots', 'allowed-bots') as $kind) {
-            $file = CYBERSEC_LOG_DIR . $kind . '-' . $date . '.log';
-
-            if (!cybersec_fs_exists($file)) {
-                continue;
-            }
-
-            $out['files']++;
-
-            $content = cybersec_fs_get_contents($file);
-            if (!is_string($content) || $content === '') {
-                continue;
-            }
-
-            $is_blocked = ($kind === 'blocked-bots');
-
-            foreach (preg_split('/\r\n|\r|\n/', $content) as $line) {
-                if ($line === '') {
-                    continue;
-                }
-
-                $out['scanned']++;
-
-                // "[2026-11-02 00:15:00] BLOCKED | … | UA: <ua> | URL: …"
-                if (!preg_match('/^\[([0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2})\].*?\|\s*UA:\s*(.*?)\s*\|\s*URL:/', $line, $m)) {
-                    continue;
-                }
-
-                $ua = trim($m[2]);
-                if ($ua === '') {
-                    continue;
-                }
-
-                $ts   = strtotime($m[1]);
-                $hash = md5($ua);
-
-                if (!isset($stats[$hash])) {
-                    $stats[$hash] = array(
-                        'ua'         => substr($ua, 0, 180),
-                        'first_seen' => $ts ?: time(),
-                        'last_seen'  => $ts ?: time(),
-                        'blocked'    => 0,
-                        'allowed'    => 0,
-                        'count'      => 0,
-                    );
-                    $out['added']++;
-                } else {
-                    if (($ts ?: 0) > (int) ($stats[$hash]['last_seen'] ?? 0)) {
-                        $stats[$hash]['last_seen'] = $ts;
-                    }
-                    if (($ts ?: PHP_INT_MAX) < (int) ($stats[$hash]['first_seen'] ?? PHP_INT_MAX)) {
-                        $stats[$hash]['first_seen'] = $ts;
-                    }
-                    if (!isset($stats[$hash]['ua']) || $stats[$hash]['ua'] === '') {
-                        $stats[$hash]['ua'] = substr($ua, 0, 180);
-                    }
-                    $out['updated']++;
-                }
-
-                $stats[$hash]['count']++;
-                if ($is_blocked) {
-                    $stats[$hash]['blocked']++;
-                } else {
-                    $stats[$hash]['allowed']++;
-                }
-            }
-        }
-    }
-
-    $out['rows'] = count($stats);
-
-    if (count($stats) > CYBERSEC_UA_STATS_MAX) {
-        uasort($stats, function ($a, $b) {
-            return ($b['count'] ?? 0) - ($a['count'] ?? 0);
-        });
-        $stats = array_slice($stats, 0, CYBERSEC_UA_STATS_MAX, true);
-        $out['rows'] = count($stats);
-    }
-
-    if (!$dry_run) {
-        update_option(CYBERSEC_UA_STATS_OPTION, $stats, false);
-        unset($GLOBALS['cybersec_ua_stats_cache']);
-        wp_cache_delete('cybersec_ua_stats', 'cybersec_ua');
-    }
-
-    return $out;
-}
-
-/**
- * Summarises the permanent ban list for the operator.
- *
- * One installation reached 7592 entries, and the dashboard called all of them
- * "/24 subnets". Before deleting anything, an operator needs to see what is
- * actually stored: how many host bans, how many ranges, how old they are and
- * why they were created.
- *
- * @return array{total:int, host:int, subnet:int, expired:int, by_reason:array, by_age:array}
- */
-function cybersec_permaban_report_data() {
-    $list   = cybersec_get_permanent_blocked_subnets();
-    $stats  = cybersec_permaban_stats();
-    $now    = time();
-    $reason = array();
-    $age    = array('today' => 0, 'week' => 0, 'month' => 0, 'older' => 0, 'unknown' => 0);
-
-    foreach ((array) $list as $cidr => $data) {
-        $expires = cybersec_permaban_expires($data);
-
-        if ($expires > 0 && $expires < $now) {
-            continue;   // expired: reported separately
-        }
-
-        $label = trim((string) ($data['reason'] ?? ''));
-        if ($label === '') {
-            $label = 'no reason';
-        }
-        // Group on the leading word group so "Hidden file scanner: /.env" and
-        // "Hidden file scanner: /.git/config" share a row.
-        if (strpos($label, ':') !== false) {
-            $label = trim(substr($label, 0, strpos($label, ':')));
-        }
-        $label = preg_replace('/\s*\([^)]*\)\s*$/', '', $label);
-        if ($label === '') {
-            $label = 'no reason';
-        }
-
-        if (!isset($reason[$label])) {
-            $reason[$label] = 0;
-        }
-        $reason[$label]++;
-
-        $blocked_at = !empty($data['blocked_at']) ? (int) strtotime((string) $data['blocked_at']) : 0;
-        if ($blocked_at <= 0) {
-            $age['unknown']++;
-            continue;
-        }
-
-        $days_old = (int) floor(($now - $blocked_at) / DAY_IN_SECONDS);
-        if ($days_old < 1) {
-            $age['today']++;
-        } elseif ($days_old < 7) {
-            $age['week']++;
-        } elseif ($days_old < 30) {
-            $age['month']++;
-        } else {
-            $age['older']++;
-        }
-    }
-
-    arsort($reason);
-
-    return array(
-        'total'     => $stats['total'],
-        'host'      => $stats['host'],
-        'subnet'    => $stats['subnet'],
-        'expired'   => $stats['expired'],
-        'by_reason' => $reason,
-        'by_age'    => $age,
-    );
-}
-
-
-/**
  * Records a violation for $ip in the permaban ladder and reports the state.
  *
@@ -6524 +6510 @@
 
 /**
- * Detects Cloudflare origin leaks — CF markers present without CF-Connecting-IP.
- *
- * @return bool
- */
-function cybersec_check_cloudflare_origin(){ if(!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) return false; $hs=false; foreach(array('HTTP_CF_IPCOUNTRY','HTTP_CF_RAY','HTTP_CF_VISITOR') as $h){if(!empty($_SERVER[$h])){$hs=true;break;}} return $hs && empty($_SERVER['HTTP_CF_CONNECTING_IP']); }
-
-/**
- * Returns true if the given IP is an IPv6 address.
- *
- * @param string $ip
- * @return bool
- */
-function cybersec_check_ipv6_connection($ip){ return filter_var($ip,FILTER_VALIDATE_IP,FILTER_FLAG_IPV6)!==false; }
-
-/**
  * Returns true if the request is using HTTP/1.0 or HTTP/1.
  *
@@ -6602 +6573 @@
  */
 function cybersec_check_direct_ip_access(){ $h=isset($_SERVER['HTTP_HOST'])?sanitize_text_field(wp_unslash($_SERVER['HTTP_HOST'])):''; if(filter_var($h,FILTER_VALIDATE_IP)){$sh=wp_parse_url(get_site_url(),PHP_URL_HOST); if($h!==$sh) return true;} return false; }
-
-/**
- * Alias of cybersec_check_fake_referer for the legacy "spam referer" option.
- *
- * @deprecated The option was a duplicate of "fake_referer" — the spam-domain
- *             list has always lived inside cybersec_check_fake_referer(). Kept
- *             so external code that calls it still works.
- *
- * @return bool
- */
-function cybersec_check_bad_referer_spam(){ return cybersec_check_fake_referer(); }
 
 /**
@@ -8711 +8671 @@
     // A temp block set within the 5-second qcheck TTL would
     // otherwise be bypassed. Checked here, once, before the cache.
-    // Entries may be plain addresses or CIDR subnets (admin UI), so the
-    // lookup goes through cybersec_temp_block_key_for().
+    // Entries may be plain addresses or CIDR subnets (admin UI), and the
+    // block may live in the option mirror or in the table, so the lookup
+    // goes through cybersec_temp_block_active_until().
     // ============================================================
-    $tb_early   = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
-    $tb_key     = cybersec_temp_block_key_for($ip_early, $tb_early);
-
-    if ($tb_key !== null) {
-        if (time() < cybersec_temp_block_expires($tb_early[$tb_key])) {
-            cybersec_show_block_page($ip_early, cybersec_translate("Temporary block."));
-            exit;
-        }
-
-        // Expired: drop it under the lock, so a parallel request that just
-        // re-blocked this address does not lose its fresh entry.
-        cybersec_remove_temp_block($tb_key);
+    if (cybersec_temp_block_active_until($ip_early) > 0) {
+        cybersec_show_block_page($ip_early, cybersec_translate("Temporary block."));
+        exit;
     }
     // ============================================================
@@ -9574 +9526 @@
     }
 
-    $tb = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
-    if (cybersec_temp_block_active_until($ip, $tb) > 0) {
+    if (cybersec_temp_block_active_until($ip) > 0) {
         cybersec_show_block_page($ip, cybersec_translate('Temporary block.'));
         exit;
@@ -9696 +9647 @@
         $reason = cybersec_translate('IP in permanent block list');
     } else {
-        $tb = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
-
-        if (cybersec_temp_block_active_until($ip, $tb) > 0) {
+        if (cybersec_temp_block_active_until($ip) > 0) {
             $reason = cybersec_translate('Temporary block.');
         }
@@ -10455 +10404 @@
 
 // ==================== BLOCK 10: 403 PAGE (FIXED) ====================
-
-/**
- * Generates a signed unblock token for an IP. Expires after the auto-unblock
- * window plus 10 minutes of grace. HMAC-signed with the WP nonce salt.
- *
- * @param string $ip
- * @return string Base64-encoded token.
- */
-function cybersec_generate_unblock_token($ip) { 
-    $secret = wp_salt('nonce'); 
-    // A token stays valid for five minutes past the auto-unblock window — the
-    // same grace the reference build uses. A longer window only widens the
-    // period in which a leaked link still works.
-    $expires = time() + (cybersec_get_auto_unblock_minutes() * 60) + 300;
-    $data = $ip . '|' . $expires; 
-    $hash = hash_hmac('sha256', $data, $secret); 
-    return base64_encode($data . '|' . $hash); 
-}
 
 /**
@@ -12394 +12325 @@
 });
 
+
+

cyberpulse/trunk/cyberpulse-htaccess.php

@@ -319 +319 @@
     // added after the permabans, up to a combined cap that keeps .htaccess
     // small.
-    $tb = get_option(CYBERSEC_TEMP_BLOCKS_OPTION, array());
+    // Merged view: the table is authoritative, the option is the rollback
+    // mirror. The edge list must contain both or a blocked scanner keeps
+    // reaching PHP after a build switch.
+    $tb = cybersec_temp_blocks_all();
     if (!empty($tb) && is_array($tb)) {
         uasort($tb, function($a, $b) {

cyberpulse/trunk/cyberpulse.php

@@ -4 +4 @@
  * Plugin URI: https://wordpress.org/plugins/cyberpulse
  * Description: Real-time security heartbeat for your WordPress. Monitors every request, blocks bots instantly, protects against brute force and AI scraping. Feel the pulse of protection. Free version with PRO upgrade available.
- * Version: 5.9.1.6
+ * Version: 5.9.1.7
  * Author: CyberPulse Security
  * Author URI: https://cyberpulse-security.com
@@ -13 +13 @@
  * Requires at least: 5.3
  * Requires PHP: 7.4
- * Tested up to: 7.1
  */
 if (!defined('ABSPATH')) exit;
+
+/**
+ * If CyberPulse PRO is active, it owns the request. This prevents both
+ * versions from declaring the same functions/classes and makes it safe to
+ * have both plugins installed.
+ */
+if (defined('CYBERSEC_IS_PRO_VERSION') && CYBERSEC_IS_PRO_VERSION) {
+    return;
+}
 
 // ------------------------------------------------------------------
@@ -240 +248 @@
 }
 
-/**
- * Checks whether a path is writable via WP_Filesystem.
- *
- * @param string $path
- * @return bool
- */
-function cybersec_fs_is_writable($path) {
-    $fs = cybersec_fs_init();
-    return $fs->is_writable($path);
-}
-
-/**
- * Creates a directory through WP_Filesystem.
- *
- * @param string $path
- * @return bool
- */
-function cybersec_fs_mkdir($path) {
-    $fs = cybersec_fs_init();
-    return $fs->mkdir($path);
-}
-
 // ------------------------------------------------------------------
 // Internationalization
@@ -417 +403 @@
                 add_option($option_name, array(), '', 'no');
             }
+        }
+    }
+
+    // Create the temporary-block table and carry over the blocks that older
+    // builds kept in a single option row. Activation is the expected moment
+    // for dbDelta(); the same upgrade also runs once from admin_init so that
+    // existing installs migrate on their first visit after the update.
+    if (function_exists('cybersec_tb_install')) {
+        if (cybersec_tb_install()) {
+            cybersec_tb_migrate_option(true);
+            update_option('cybersec_tb_schema', CYBERSEC_TB_SCHEMA);
         }
     }
@@ -502 +499 @@
     return $links;
 }
+

cyberpulse/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 5.9.1.6
+Stable tag: 5.9.1.7
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -112 +112 @@
 6. ⚙️ Security settings with multiple bot detection options
 
+= 5.9.1.7 =
+* 🗄️ **Temporary blocks now live in a dedicated database table** instead of one option row. Every block is its own row, so two simultaneous blocks can no longer overwrite each other — previously the loser's block simply disappeared. The upgrade copies the existing blocks into the table on the first admin visit; the option keeps being written as a mirror, so a rollback to an older build still finds every block, and if the table cannot be created the plugin falls back to the option and behaves exactly as before.
+* ⚡ **Temporary blocks:** the expired-block cleanup now takes the write mutex before reading the list. Previously it scanned first and locked only the write, so a block created in between was overwritten by the stale snapshot.
+* 🧹 **Cleanup:** removed eleven unused helper functions left over from earlier releases (old diagnostics, the pre-proof-of-work unblock-token generator, an unused UA-stats rebuilder). No behaviour change.
+
 = 5.9.1.6 =
 * ⚡ Faster sync: new or lifted temporary blocks mark the edge list as stale and schedule a sync within 30–60 seconds instead of waiting for the five-minute maintenance run.

cyberpulse/trunk/uninstall.php

@@ -17 +17 @@
  */
 if (!defined('WP_UNINSTALL_PLUGIN')) exit;
+
+/**
+ * If CyberPulse PRO is present, it owns every shared store: the same options
+ * (settings, whitelist, bans, license key), the same log directory, the same
+ * temporary-block table and the same .htaccess block. PRO deactivates FREE on
+ * activation, so the free plugin is usually still installed but inactive — and
+ * deleting it must not wipe the paid plugin's license, settings, logs, bans or
+ * firewall rules.
+ *
+ * The check uses the plugin file on disk, not the "active" state: a customer
+ * who deactivated PRO for a moment still expects their data to survive.
+ */
+$cybersec_pro_present = false;
+$cybersec_pro_paths   = array();
+
+if (defined('WP_PLUGIN_DIR')) {
+    $cybersec_pro_paths[] = WP_PLUGIN_DIR . '/cyberpulse-pro/cyberpulse.php';
+}
+
+if (defined('WPMU_PLUGIN_DIR')) {
+    $cybersec_pro_paths[] = WPMU_PLUGIN_DIR . '/cyberpulse-pro/cyberpulse.php';
+}
+
+foreach ($cybersec_pro_paths as $cybersec_pro_path) {
+    if (file_exists($cybersec_pro_path)) {
+        $cybersec_pro_present = true;
+        break;
+    }
+}
+
+if ($cybersec_pro_present) {
+    return;
+}
 
 // ==================== OPTIONS ====================
@@ -60 +93 @@
 delete_option('cybersec_log_dir_lock');
 delete_option('cybersec_tb_bridge_present');
+delete_option('cybersec_tb_present');
+delete_option('cybersec_tb_schema');
+delete_option('cybersec_tb_schema_failed');
+delete_option('cybersec_tb_migrated_v2');
 delete_option('cybersec_403_build');