← All changes
|
src/component/security-tweaks/class-prevent-enum-users.php
+97
-11
5.7.2
→
6.3.0
View file →
| @@ -8,8 +8,9 @@ | ||
| 8 | 8 | |
| 9 | 9 | namespace WP_Defender\Component\Security_Tweaks; |
| 10 | 10 | |
| 11 | 11 | use WP_Error; |
| 12 | +use WP_REST_Response; | |
| 12 | 13 | use WP_Sitemaps_Provider; |
| 13 | 14 | use WP_Defender\Traits\Security_Tweaks_Option; |
| 14 | 15 | |
| 15 | 16 | /** |
| @@ -82,11 +83,13 @@ | ||
| 82 | 83 | add_filter( 'oembed_response_data', array( $this, 'oembed_author_filter' ), 99 ); |
| 83 | 84 | add_filter( 'wp_sitemaps_users_pre_url_list', array( $this, 'block_user_url_sitemap' ), 99, 0 ); |
| 84 | 85 | add_filter( 'wp_sitemaps_add_provider', array( $this, 'block_user_provider_sitemap' ), 99, 2 ); |
| 85 | 86 | add_filter( 'rest_authentication_errors', array( $this, 'block_rest_api_user_endpoint' ) ); |
| 87 | + add_filter( 'rest_endpoints', array( $this, 'block_rest_api_user_endpoints' ), 99 ); | |
| 88 | + add_action( 'rest_api_init', array( $this, 'register_dynamic_post_type_filters' ) ); | |
| 86 | 89 | |
| 87 | 90 | $query = defender_get_data_from_request( 'QUERY_STRING', 's' ); |
| 88 | - if ( empty( $query ) ) { | |
| 91 | + if ( ! is_string( $query ) || '' === $query ) { | |
| 89 | 92 | return; |
| 90 | 93 | } |
| 91 | 94 | |
| 92 | 95 | $this->maybe_block( $query ); |
| @@ -136,9 +139,14 @@ | ||
| 136 | 139 | * |
| 137 | 140 | * @return string |
| 138 | 141 | */ |
| 139 | 142 | public function get_error_reason(): string { |
| 140 | - return esc_html__( 'User enumeration is currently allowed.', 'defender-security' ); | |
| 143 | + return wp_kses( | |
| 144 | + __( '<strong>User enumeration is currently allowed</strong> and may expose your site.', 'defender-security' ), | |
| 145 | + array( | |
| 146 | + 'strong' => array(), | |
| 147 | + ) | |
| 148 | + ); | |
| 141 | 149 | } |
| 142 | 150 | |
| 143 | 151 | /** |
| 144 | 152 | * Return a summary data of this tweak. |
| @@ -145,19 +153,32 @@ | ||
| 145 | 153 | * |
| 146 | 154 | * @return array |
| 147 | 155 | */ |
| 148 | 156 | public function to_array(): array { |
| 157 | + $enabled = $this->get_enabled_user_enums(); | |
| 158 | + $stop_rest = in_array( 'enum-rest', $enabled, true ); | |
| 159 | + $hide_user = in_array( 'enum-oembed', $enabled, true ); | |
| 160 | + $disable_maps = in_array( 'enum-sitemap', $enabled, true ); | |
| 161 | + $all_enabled = $stop_rest && $hide_user && $disable_maps; | |
| 162 | + | |
| 163 | + $success_reason = $all_enabled | |
| 164 | + ? wp_strip_all_tags( __( 'All recommendation settings are turned on.', 'defender-security' ) ) | |
| 165 | + : wp_strip_all_tags( __( 'Custom recommendation settings are turned on.', 'defender-security' ) ); | |
| 166 | + | |
| 149 | 167 | return array( |
| 150 | 168 | 'slug' => $this->slug, |
| 151 | 169 | 'title' => $this->get_label(), |
| 152 | 170 | 'errorReason' => $this->get_error_reason(), |
| 153 | - 'successReason' => esc_html__( 'User enumeration is currently blocked, nice work!', 'defender-security' ), | |
| 154 | - 'misc' => array(), | |
| 155 | - 'bulk_description' => esc_html__( | |
| 156 | - 'To brute force your login, hackers and bots can simply type the query string ?author=1, ?author=2 and so on, which will redirect the page to /author/username/ - bam, the bot now has your usernames to begin brute force attacks with. We can add a .htaccess file to your site to prevent the redirection.', | |
| 157 | - 'defender-security' | |
| 171 | + 'successReason' => $success_reason, | |
| 172 | + 'misc' => array( | |
| 173 | + 'show_revert_button' => true, | |
| 174 | + 'show_action_button' => true, | |
| 175 | + 'stop_rest_api' => $stop_rest, | |
| 176 | + 'hide_user_id' => $hide_user, | |
| 177 | + 'disable_author_sitemap' => $disable_maps, | |
| 158 | 178 | ), |
| 159 | - 'bulk_title' => $this->get_label(), | |
| 179 | + 'bulk_description' => wp_strip_all_tags( __( 'Author redirects can make usernames easier for bots to find. Prevent user enumeration to protect your login area and reduce brute force risk.', 'defender-security' ) ), | |
| 180 | + 'bulk_title' => wp_strip_all_tags( __( 'Prevent user enumeration', 'defender-security' ) ), | |
| 160 | 181 | ); |
| 161 | 182 | } |
| 162 | 183 | |
| 163 | 184 | /** |
| @@ -182,9 +203,9 @@ | ||
| 182 | 203 | * |
| 183 | 204 | * @return bool Return true if value updated, otherwise false. |
| 184 | 205 | */ |
| 185 | 206 | public function set_enabled_user_enums( $value ): bool { |
| 186 | - $this->enabled_user_enums = (array) $value; | |
| 207 | + $this->enabled_user_enums = ! is_array( $value ) ? (array) $value : $value; | |
| 187 | 208 | |
| 188 | 209 | return $this->update_option( |
| 189 | 210 | 'enabled_user_enums', |
| 190 | 211 | $this->enabled_user_enums |
| @@ -216,11 +237,11 @@ | ||
| 216 | 237 | /** |
| 217 | 238 | * Blocks user url generation in sitemap. |
| 218 | 239 | * Consider the URL: http://example.com/wp-sitemap-users-1.xml will not return user URL XML. |
| 219 | 240 | * |
| 220 | - * @return bool|void If option sitemap enumeration enabled then return false else null/void will return. | |
| 241 | + * @return bool|null If option sitemap enumeration enabled then return false else null/void will return. | |
| 221 | 242 | */ |
| 222 | - public function block_user_url_sitemap() { | |
| 243 | + public function block_user_url_sitemap(): ?bool { | |
| 223 | 244 | if ( |
| 224 | 245 | in_array( |
| 225 | 246 | 'enum-sitemap', |
| 226 | 247 | $this->get_enabled_user_enums(), |
| @@ -228,8 +249,10 @@ | ||
| 228 | 249 | ) |
| 229 | 250 | ) { |
| 230 | 251 | return false; |
| 231 | 252 | } |
| 253 | + | |
| 254 | + return null; | |
| 232 | 255 | } |
| 233 | 256 | |
| 234 | 257 | /** |
| 235 | 258 | * Blocks the user provider sitemap before it is added from wp-sitemap.xml. |
| @@ -287,6 +310,69 @@ | ||
| 287 | 310 | ); |
| 288 | 311 | } |
| 289 | 312 | |
| 290 | 313 | return $errors; |
| 314 | + } | |
| 315 | + | |
| 316 | + /** | |
| 317 | + * Block REST user endpoints for not logged-in access. | |
| 318 | + * | |
| 319 | + * @param array $endpoints The available endpoints. | |
| 320 | + * | |
| 321 | + * @return array | |
| 322 | + */ | |
| 323 | + public function block_rest_api_user_endpoints( $endpoints ) { | |
| 324 | + if ( is_user_logged_in() ) { | |
| 325 | + return $endpoints; | |
| 326 | + } | |
| 327 | + if ( ! in_array( 'enum-rest', $this->get_enabled_user_enums(), true ) ) { | |
| 328 | + return $endpoints; | |
| 329 | + } | |
| 330 | + | |
| 331 | + $endpoints_to_remove = array( | |
| 332 | + '/wp/v2/users', | |
| 333 | + '/wp/v2/users/(?P<id>[\d]+)', | |
| 334 | + ); | |
| 335 | + | |
| 336 | + foreach ( $endpoints_to_remove as $route ) { | |
| 337 | + if ( isset( $endpoints[ $route ] ) ) { | |
| 338 | + unset( $endpoints[ $route ] ); | |
| 339 | + } | |
| 340 | + } | |
| 341 | + | |
| 342 | + return $endpoints; | |
| 343 | + } | |
| 344 | + | |
| 345 | + /** | |
| 346 | + * Dynamically register rest_prepare_{$post_type} filters for all REST-exposed post types. | |
| 347 | + * | |
| 348 | + * @return void | |
| 349 | + */ | |
| 350 | + public function register_dynamic_post_type_filters() { | |
| 351 | + // Optimization: If REST API protection is disabled in the settings, we don't log anything at all. | |
| 352 | + if ( ! in_array( 'enum-rest', $this->get_enabled_user_enums(), true ) ) { | |
| 353 | + return; | |
| 354 | + } | |
| 355 | + | |
| 356 | + $post_types = get_post_types( array( 'show_in_rest' => true ) ); | |
| 357 | + | |
| 358 | + foreach ( $post_types as $post_type ) { | |
| 359 | + add_filter( "rest_prepare_{$post_type}", array( $this, 'strip_author_link' ), 10, 1 ); | |
| 360 | + } | |
| 361 | + } | |
| 362 | + | |
| 363 | + /** | |
| 364 | + * Remove the 'author' relationship link from REST API responses for not logged-in access. | |
| 365 | + * | |
| 366 | + * @param WP_REST_Response $response The response object. | |
| 367 | + * | |
| 368 | + * @return WP_REST_Response | |
| 369 | + */ | |
| 370 | + public function strip_author_link( $response ) { | |
| 371 | + // This is a mandatory check because it is triggered at the moment of data transfer and knows for sure whether the user who sent the request is authorized. | |
| 372 | + if ( ! is_user_logged_in() ) { | |
| 373 | + $response->remove_link( 'author' ); | |
| 374 | + } | |
| 375 | + | |
| 376 | + return $response; | |
| 291 | 377 | } |
| 292 | 378 | } |