Answers.Body: <p>No, this is a false positive.</p>
  
  <p>The line flagging this is:</p>
  
  <blockquote>
    <p>$from .= " $side JOIN civicrm_option_value recent_activity_medium ON
    (case_activity.medium_id = recent_activity_medium.value AND
    option_group_activity_<strong>medium.id</strong> =
    recent_activity_medium.option_group_id ) ";</p>
  </blockquote>
  
  <p>Suggested courses of action:
  1. Get rid of Wordfence.
  2. Tell Wordfence about this false positive and request they fix it.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-02T19:33:01.147Z
Answers.Text: Wordfence is a pretty decent and widely-used plugin for WordPress. A gentler course of action to suggest for George would have been to click "I have fixed this issue" link, and dismiss the notice.
Answers.UserDisplayName: Christian Wach
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-02T21:02:08.003Z
Answers.Text: Or that :) - Stack Exchange doesn't just let me type "Or that :)"
Answers.UserDisplayName: JohnFF
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-12T21:55:35.357Z
Answers.Text: The false positives cleared themselves up with no action on my part.  Maybe the first scan had a glitch and the later scan ran OK.
Answers.UserDisplayName: George Lozier
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-02T17:21:51.110Z
Answers.LastActivityDate: 2016-03-02T17:21:51.110Z
Answers.UserDisplayName: JohnFF
Body: <p>I'm testing Wordfence a WordPress security plug-in on our site.  It reports that /civicrm/civicrm/CRM/Case/BAO/Query.php contains suspected malware.  Is this true? We are running CiviCRM 4.7.2.</p>
  
  <p>Here's the Wordfence message:</p>
  
  <p><a href="https://i.sstatic.net/Dozb3.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Dozb3.png" alt="Wordfence Scan Result"></a></p>
  
Tags: <civicase><security>
Title: /civicrm/civicrm/CRM/Case/BAO/Query.php Reported to Contain Malware by Wordfence
ThreadText: # /civicrm/civicrm/CRM/Case/BAO/Query.php Reported to Contain Malware by Wordfence
  
  (Asked by: username_0 on 2016-03-02)
  
  I'm testing Wordfence a WordPress security plug-in on our site. It reports that /civicrm/civicrm/CRM/Case/BAO/Query.php contains suspected malware. Is this true? We are running CiviCRM 4.7.2.
  
  Here's the Wordfence message:
  
  [![Wordfence Scan Result](https://i.sstatic.net/Dozb3.png)](https://i.sstatic.net/Dozb3.png)
  
  **Tags:** civicase, security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2016-03-02. Score: 1
  
  No, this is a false positive.
  
  The line flagging this is:
  
  > $from .= " $side JOIN civicrm\_option\_value recent\_activity\_medium ON
  > (case\_activity.medium\_id = recent\_activity\_medium.value AND
  > option\_group\_activity\_**medium.id** =
  > recent\_activity\_medium.option\_group\_id ) ";
  
  Suggested courses of action:
  1. Get rid of Wordfence.
  2. Tell Wordfence about this false positive and request they fix it.
  
  > **Comments:**
  > **username_2**: Wordfence is a pretty decent and widely-used plugin for WordPress. A gentler course of action to suggest for username_0 would have been to click "I have fixed this issue" link, and dismiss the notice.  
  > **username_1**: Or that :) - Stack Exchange doesn't just let me type "Or that :)"  
  > **username_0**: The false positives cleared themselves up with no action on my part.  Maybe the first scan had a glitch and the later scan ran OK.  
  
  ---
  
  