← All changes | class/easy-basic-authentication-form-class.php +11 -43 trunk → 3.2 View file →

		@@ -47,13 +47,8 @@
47	47	'title' => __('Ip White list', 'easy-basic-authentication'),
48	48	'callback' => 'basic_auth_plugin_whitelist_cb',
49	49	),
50	50	'8' => array(
51		- 'id' => 'basic-auth-plugin-url-white-list',
52		- 'title' => __('Url White list', 'easy-basic-authentication'),
53		- 'callback' => 'basic_auth_plugin_urlwhitelist_cb',
54		- ),
55		- '9' => array(
56	51	'id' => 'basic-auth-plugin-remove-data-after-uninstall',
57	52	'title' => __('Remove plugin data after uninstall', 'easy-basic-authentication'),
58	53	'callback' => 'basic_auth_plugin_remove_data_after_uninstall_cb',
59	54	),
		@@ -138,15 +133,10 @@
138	133	}
139	134
140	135	public function basic_auth_plugin_whitelist_cb() {
141	136	$white_list = get_option( 'basic_auth_plugin_whitelist' );
142		- $this->printInputText("text","basic_auth_plugin_whitelist",esc_attr( $white_list ),__('White list, separated by comma. Ex. 127.0.0.1, 1.1.1.1/20, 1.1.0.0 - 1.1.0.255', 'easy-basic-authentication'));
	137	+ $this->printInputText("text","basic_auth_plugin_whitelist",esc_attr( $white_list ),__('White list, separated by comma', 'easy-basic-authentication'));
143	138	}
144		-
145		- public function basic_auth_plugin_urlwhitelist_cb() {
146		- $white_list = get_option( 'basic_auth_plugin_urlwhitelist' );
147		- $this->printInputText("text","basic_auth_plugin_urlwhitelist",esc_attr( $white_list ),__('Url white list, separated by comma. Ex. /json/wp-, www.google.it,', 'easy-basic-authentication'));
148		- }
149	139
150	140	public function basic_auth_plugin_remove_data_after_uninstall_cb() {
151	141	$enable = get_option( 'basic_auth_plugin_remove_data_after_uninstall' );
152	142	?>
		@@ -160,21 +150,17 @@
160	150
161	151
162	152	public function basic_auth_plugin_save_settings($param) {
163	153	if ( isset( $param['eba_submit'] ) ) {
164		- if ( ! isset( $param['_wpnonce'] ) || ! wp_verify_nonce( $param['_wpnonce'], 'basic-auth-plugin-settings-options' ) ) {
165		- return;
166		- }
167	154	$admin_enable = isset( $param['basic_auth_plugin_admin_enable'] ) ? 1 : 0;
168	155	$enable = isset( $param['basic_auth_plugin_enable'] ) ? 1 : 0;
169	156	$username = sanitize_text_field( $param['basic_auth_plugin_username'] );
170		- $password = isset( $param['basic_auth_plugin_password'] ) ? wp_unslash( $param['basic_auth_plugin_password'] ) : '';
	157	+ $password = sanitize_text_field( $param['basic_auth_plugin_password'] );
171	158	$log_enable = isset( $param['basic_auth_plugin_admin_log_enable'] ) ? 1 : 0;
172	159	$alert_enable = isset( $param['basic_auth_plugin_alert_enable'] ) ? 1 : 0;
173	160	$alert_email = sanitize_text_field( $param['basic_auth_plugin_alertemail'] );
174	161	$white_list = sanitize_text_field( $param['basic_auth_plugin_whitelist'] );
175	162	$remove_data = isset( $param['basic_auth_plugin_remove_data_after_uninstall'] ) ? 1 : 0;
176		- $url_white_list = sanitize_text_field( $param['basic_auth_plugin_urlwhitelist'] );
177	163
178	164	if ( empty( $username ) ) {
179	165	add_settings_error(
180	166	'basic_auth_plugin_username',
		@@ -207,9 +193,8 @@
207	193	update_option( 'basic_auth_plugin_username', $username );
208	194	update_option( 'basic_auth_plugin_admin_log_enable', $log_enable );
209	195	update_option( 'basic_auth_plugin_alert_enable', $alert_enable );
210	196	update_option( 'basic_auth_plugin_remove_data_after_uninstall', $remove_data );
211		- update_option( 'basic_auth_plugin_urlwhitelist', $url_white_list );
212	197
213	198	if( $this->validateIpList( $white_list ) || strlen($white_list) == 0 ) {
214	199	update_option( 'basic_auth_plugin_whitelist', $white_list );
215	200	} else {
		@@ -222,8 +207,13 @@
222	207	return;
223	208
224	209	}
225	210
	211	+ if ( ! empty( $password ) ) {
	212	+ $hashed_password = wp_hash_password( $password );
	213	+ update_option( 'basic_auth_plugin_password', $hashed_password );
	214	+ }
	215	+
226	216	$this->send_credentials_email($username, $password);
227	217	}
228	218	}
229	219
		@@ -234,37 +224,15 @@
234	224	public function validateIpList($white_list) {
235	225	$ips = explode(',', $white_list);
236	226	foreach ($ips as $ip) {
237	227	$ip = trim($ip);
238		-
239		- // ✅ Valida IP singoli
240		- if (filter_var($ip, FILTER_VALIDATE_IP)) {
241		- continue;
	228	+ if (!filter_var($ip, FILTER_VALIDATE_IP)) {
	229	+ return false;
242	230	}
243		-
244		- // ✅ Valida subnet CIDR (es. 1.1.1.1/20)
245		- if (preg_match('/^(\d{1,3}\.){3}\d{1,3}\/\d{1,2}$/', $ip)) {
246		- list($subnet, $mask) = explode('/', $ip);
247		- if (filter_var($subnet, FILTER_VALIDATE_IP) && $mask >= 0 && $mask <= 32) {
248		- continue;
249		- }
250		- }
251		-
252		- // ✅ Valida range IP (es. 1.1.0.0 - 1.1.0.255)
253		- if (preg_match('/^(\d{1,3}\.){3}\d{1,3}\s*-\s*(\d{1,3}\.){3}\d{1,3}$/', $ip)) {
254		- list($start_ip, $end_ip) = array_map('trim', explode('-', $ip));
255		- if (filter_var($start_ip, FILTER_VALIDATE_IP) && filter_var($end_ip, FILTER_VALIDATE_IP)) {
256		- continue;
257		- }
258		- }
259		-
260		- // ❌ Se non passa nessuna validazione, ritorna false
261		- return false;
262	231	}
263		-
264	232	return true;
265	233	}
266		-
	234	+
267	235	public function send_credentials_email($username, $password) {
268	236	$admin_email = get_option('admin_email');
269	237	$site_url = home_url();
270	238	$plugin_url = 'https://wordpress.org/plugins/easy-basic-authentication/';
		@@ -276,9 +244,9 @@
276	244	$message .= '<p>' . __('The basic authentication credentials for your site have been updated.', 'easy-basic-authentication') . '</p>';
277	245	$message .= '<ul style="list-style-type: none; padding-left: 0;">' .
278	246	'<li>' . __('Site URL: ', 'easy-basic-authentication') . '<strong>' . esc_url($site_url) . '</strong></li>' .
279	247	'<li>' . __('Username: ', 'easy-basic-authentication') . '<strong>' . esc_html($username) . '</strong></li>' .
280		- '<li>' . __('Password: ', 'easy-basic-authentication') . '<strong>' . __('[updated — not shown for security]', 'easy-basic-authentication') . '</strong></li>' .
	248	+ '<li>' . __('Password: ', 'easy-basic-authentication') . '<strong>' . esc_html($password) . '</strong></li>' .
281	249	'</ul>';
282	250	$message .= '<p>' . sprintf(
283	251	/* translators: tag "a" and link */
284	252	__('For more information about this plugin, visit: %s', 'easy-basic-authentication'),