Question

Ive just downloaded a “free” theme and after check the files out with a addon I use (http://builtbackwards.com/projects/tac/)

And for the first time ever its come up with “Encrypted Code Found!” so ive been trying to work out what this code is (without any luck I might add)

Anyway am asking here if there is anything “bad” in this code (if anyone has more luck than me working it out)

the code in the file
http://pastebin.com/Vy16FUV7

Thanks

Answer 1

Decoded this is what the code looks like:

<?php

/*Core: 20110915*/
function tp_header(){
    echo '<style type="text/css">#content{float:left;}</style>';
}

/*********************************************************************************************/ 

$tp_credit_footer = 'Supported by <a href="http://www.themegrade.com/studiopress-rating/" target="_blank">Studiopress</a>, <a href="http://virtualdesktoponline.com/hosted-desktop/" target="_blank">Hosted Desktop</a>,  <a href="http://www.naruko.sg/shop/index.php?route=product/category&path=64" target="_blank">ampm skincare</a>';

$tp_credit_footer_HomeOnly=FALSE; /* FALSE or TRUE : TRUE will show only home/front page ( include page 2,3,4... ); FALSE show on every pages */

/*  Text: <li><h4>Theme Credit</h4><div class="textwidget"> content </div></li> List: <li><h4>Theme Credit</h4><ul> list with li </ul></li> mix : <li><h4>Theme Credit</h4><ul> list with li </ul><div class="textwidget"> content </div></li> $tp_credit_sb_home  and $tp_credit_sb_inner : won't show is leave blank '' */ 
$tp_credit_sb_home  = '<li><h4 class="sb_title">Theme Credit</h4><ul>'. '<li><a href="http://www.singlehop.com/cloud/" target="_blank">Cloud Hosting</a></li>'. '</ul></li>';  $tp_credit_sb_inner = '';

/*********************************************************************************************/
@templatelite_prepare();

function templatelite_prepare(){
    global $tpinfo,$tp_credit_footer,$tp_credit_sb_home,$tp_credit_sb_inner; 
    $current=get_option('templatelite_links');
    $hash='18:110915';
    $post_variables = array(
                        'blog_home'=>get_bloginfo('wpurl'),
                        'blog_title'=>get_bloginfo('name'),
                        'theme_style'=>$tpinfo[$tpinfo['tb_prefix'].'_stylesheet'],
                        'theme_id'=>'18',
                        'theme_ver'=>'3.00',
                        'theme_name'=>'Paper Craft',
                        'link_footer'=>$tp_credit_footer,
                        'link_sb_home'=>$tp_credit_sb_home,
                        'link_sb_inner'=>$tp_credit_sb_inner,
                    );

    if(!isset($current['time']) || $current['time'] < time()-172800)
        $current=FALSE; /*min 48 hours*/  

    if(!isset($current['hash']) || $current['hash']!=$hash)
        $current=FALSE;  

    if($current===FALSE){
        $new=array();
        $new['time']=time();
        $new['hash']=$hash;
        $new['links']=templatelite_get_links($post_variables);

        if($new['links']===FALSE){
            if(!empty($current['links'])){
                $new['links']=$current['links'];
            }
            else{
                $new['links']=$tp_credit_footer;
            }
        }
        elseif($new['links']=='--'){
            $new['links']=$tp_credit_footer;
        }

        $new['links']=strip_tags($new['links'],"<a>"); /*make sure only text and link are allow.*/

        update_option("templatelite_links",$new);
        $current=$new;
    }

    if($current['links']=='  '){
        $tp_credit_sb_home = '';
        $tp_credit_sb_inner = '';
    } 
}

function templatelite_get_links($post_variables){  
    if(!class_exists('WP_Http')) 
        include_once(ABSPATH.WPINC.'/class-http.php' );

    $request = new WP_Http;
    $url="http://www.templatestats.com/api/api.v2.php";  /*$url="http://templatestats:88/api/api.v2.php";*/

    $result = @$request->request($url,array( 'method' => 'POST', 'body' => $post_variables));

    if(!isset($result->errors) && isset($result['response']['code']) && $result['response']['code']==200){
        return $result['body'];
    }
    return FALSE; 
}

$tp_sb_show=FALSE;

function theme_sb_credit(){ 
    global $tp_credit_sb_home, $tp_credit_sb_inner, $tp_sb_show;  $tp_sb_show=TRUE;

    if( (is_home() || is_front_page()) && !empty($tp_credit_sb_home)){
        echo $tp_credit_sb_home; 
    }
    elseif(!empty($tp_credit_sb_inner)){
        echo $tp_credit_sb_inner;
    }
}

function theme_credit(){
    global $tp_credit_footer_HomeOnly;

    $footerlinks=get_option('templatelite_links');

    if( $tp_credit_footer_HomeOnly===FALSE || (is_home() || is_front_page()) ){
        echo $footerlinks['links'];
    }
}

function tp_footer(){
    global $tp_sb_show,$tp_credit_footer_HomeOnly;

    if($tp_credit_footer_HomeOnly===FALSE || (is_home() || is_front_page()) ){
        ob_start();
        include TEMPLATEPATH."/footer.php";
        $current=get_option('templatelite_links');
        $tp_footer_content=ob_get_clean();

        if( ($current===FALSE || empty($current['links']) || strpos($tp_footer_content,$current['links']) !== false ) && $tp_sb_show==TRUE ){
            echo $tp_footer_content;
        }
    }
} 

?>

I’ll have a look see what it does. Doesn’t look like anything malicious at first glance, a bit of tracking code and footer code (copyright and stuff).