PluginProbe
Easy Basic Authentication – Add basic auth to site or admin area / 4.2.0
Easy Basic Authentication – Add basic auth to site or admin area v4.2.0
4.2.0 4.1.0 trunk 1.1 1.2 1.3 1.3.1 1.3.2 1.3.3 1.3.4 1.3.5 1.4 1.4.1 1.5 1.5.1 1.5.2 1.5.3 1.6 1.6.1 1.6.2 1.6.3 1.6.4 1.7 1.7.1 1.8 All 52 releases
← All changes | class/easy-basic-authentication-form-class.php +253 -62 1.5.1 → 4.2.0 View file →
@@ -1,56 +1,96 @@
1 1 <?php
2 2
3 3 class easy_basic_authentication_form_class {
4 4
5 - const FORM_FIELD = array(
6 - '0' => array(
7 - 'id' => 'basic-auth-plugin-admin-enable',
8 - 'title' => 'Enable for wp-admin',
9 - 'callback' => 'basic_auth_plugin_admin_enable_cb',
10 - ),
11 - '1' => array(
12 - 'id' => 'basic-auth-plugin-enable',
13 - 'title' => 'Enable for the entire site (only if wp-admin is enabled)',
14 - 'callback' => 'basic_auth_plugin_enable_cb',
15 - ),
16 - '2' => array(
17 - 'id' => 'basic-auth-plugin-username',
18 - 'title' => 'Username',
19 - 'callback' => 'basic_auth_plugin_username_cb',
20 - ),
21 - '3' => array(
22 - 'id' => 'basic-auth-plugin-password',
23 - 'title' => 'Password',
24 - 'callback' => 'basic_auth_plugin_password_cb',
25 - ),
26 - '4' => array(
27 - 'id' => 'basic-auth-plugin-admin-log-enable',
28 - 'title' => 'Enable access logs',
29 - 'callback' => 'basic_auth_plugin_admin_log_enable_cb',
30 - ),
31 - '5' => array(
32 - 'id' => 'basic-auth-plugin-alert-enable',
33 - 'title' => 'Enable email alert',
34 - 'callback' => 'basic_auth_plugin_alert_enable_cb',
35 - ),
36 - '6' => array(
37 - 'id' => 'basic-auth-plugin-email-alert',
38 - 'title' => 'Email for alert',
39 - 'callback' => 'basic_auth_plugin_alertemail_cb',
40 - )
41 - );
5 + public $form_field = [];
42 6
43 7 public function __construct()
44 8 {
45 -
9 + // Qui non si traduce nulla. Il plugin parte su plugins_loaded, che viene
10 + // prima di init: da WordPress 6.7 chiamare __() a quel punto fa scattare
11 + // la notice "Translation loading was triggered too early". L'elenco dei
12 + // campi si costruisce quando serve davvero, cioe su admin_init.
46 13 }
47 -
14 +
15 + /**
16 + * Definizione dei campi del modulo impostazioni.
17 + *
18 + * @return array
19 + */
20 + public function get_form_fields()
21 + {
22 + if ( ! empty( $this->form_field ) ) {
23 + return $this->form_field;
24 + }
25 +
26 + $this->form_field = array(
27 + '0' => array(
28 + 'id' => 'basic-auth-plugin-admin-enable',
29 + 'title' => __('Enable for wp-admin', 'easy-basic-authentication'),
30 + 'callback' => 'basic_auth_plugin_admin_enable_cb',
31 + ),
32 + '1' => array(
33 + 'id' => 'basic-auth-plugin-enable',
34 + 'title' => __('Enable for the entire site (only if wp-admin is enabled)', 'easy-basic-authentication'),
35 + 'callback' => 'basic_auth_plugin_enable_cb',
36 + ),
37 + '2' => array(
38 + 'id' => 'basic-auth-plugin-username',
39 + 'title' => __('Username', 'easy-basic-authentication'),
40 + 'callback' => 'basic_auth_plugin_username_cb',
41 + ),
42 + '3' => array(
43 + 'id' => 'basic-auth-plugin-password',
44 + 'title' => __('Password', 'easy-basic-authentication'),
45 + 'callback' => 'basic_auth_plugin_password_cb',
46 + ),
47 + '4' => array(
48 + 'id' => 'basic-auth-plugin-admin-log-enable',
49 + 'title' => __('Enable access logs', 'easy-basic-authentication'),
50 + 'callback' => 'basic_auth_plugin_admin_log_enable_cb',
51 + ),
52 + '5' => array(
53 + 'id' => 'basic-auth-plugin-alert-enable',
54 + 'title' => __('Enable email alert', 'easy-basic-authentication'),
55 + 'callback' => 'basic_auth_plugin_alert_enable_cb',
56 + ),
57 + '6' => array(
58 + 'id' => 'basic-auth-plugin-email-alert',
59 + 'title' => __('Email for alert', 'easy-basic-authentication'),
60 + 'callback' => 'basic_auth_plugin_alertemail_cb',
61 + ),
62 + '7' => array(
63 + 'id' => 'basic-auth-plugin-white-list',
64 + 'title' => __('Ip White list', 'easy-basic-authentication'),
65 + 'callback' => 'basic_auth_plugin_whitelist_cb',
66 + ),
67 + '8' => array(
68 + 'id' => 'basic-auth-plugin-url-white-list',
69 + 'title' => __('Url White list', 'easy-basic-authentication'),
70 + 'callback' => 'basic_auth_plugin_urlwhitelist_cb',
71 + ),
72 + '9' => array(
73 + 'id' => 'basic-auth-plugin-access-token',
74 + 'title' => __('Access token for crawlers', 'easy-basic-authentication'),
75 + 'callback' => 'basic_auth_plugin_access_token_cb',
76 + ),
77 + '10' => array(
78 + 'id' => 'basic-auth-plugin-remove-data-after-uninstall',
79 + 'title' => __('Remove plugin data after uninstall', 'easy-basic-authentication'),
80 + 'callback' => 'basic_auth_plugin_remove_data_after_uninstall_cb',
81 + ),
82 +
83 + );
84 +
85 + return $this->form_field;
86 + }
87 +
48 88 public function basic_auth_plugin_settings_init() {
49 - register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_admin_enable' );
50 - register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_enable' );
51 - register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_username' );
52 - register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_admin_log_enable' );
89 + register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_admin_enable', array( 'sanitize_callback' => 'absint' ) );
90 + register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_enable', array( 'sanitize_callback' => 'absint' ) );
91 + register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_username', array( 'sanitize_callback' => 'sanitize_text_field' ) );
92 + register_setting( 'basic-auth-plugin-settings', 'basic_auth_plugin_admin_log_enable', array( 'sanitize_callback' => 'absint' ) );
53 93
54 94 add_settings_section(
55 95 'basic-auth-plugin-section',
56 96 __('Configurations for Easy Basic Authentication', 'easy-basic-authentication'),
@@ -57,12 +97,12 @@
57 97 array($this,'basic_auth_plugin_section_cb'),
58 98 'basic-auth-plugin-settings'
59 99 );
60 100
61 - foreach(self::FORM_FIELD as $field) {
101 + foreach($this->get_form_fields() as $field) {
62 102 add_settings_field(
63 103 $field['id'],
64 - __($field['title'], 'easy-basic-authentication'),
104 + esc_html($field['title']),
65 105 array($this,$field['callback']),
66 106 'basic-auth-plugin-settings',
67 107 'basic-auth-plugin-section'
68 108 );
@@ -70,9 +110,9 @@
70 110
71 111 }
72 112
73 113 public function basic_auth_plugin_section_cb() {
74 - echo __('Configure basic authentication', 'easy-basic-authentication');
114 + echo esc_html__('Configure basic authentication', 'easy-basic-authentication');
75 115 }
76 116
77 117 public function basic_auth_plugin_enable_cb() {
78 118 $admin_enable = get_option( 'basic_auth_plugin_admin_enable' );
@@ -90,19 +130,16 @@
90 130 }
91 131
92 132 public function basic_auth_plugin_username_cb() {
93 133 $username = get_option( 'basic_auth_plugin_username' );
94 - ?>
95 - <input type="text" name="basic_auth_plugin_username" value="<?php echo esc_attr( $username ); ?>">
96 - <?php
134 + $this->printInputText("text","basic_auth_plugin_username",esc_attr( $username ),'','off');
97 135 }
98 136
99 137 public function basic_auth_plugin_password_cb() {
100 - $password = get_option( 'basic_auth_plugin_password' )
101 - ? __('Password entered', 'easy-basic-authentication')
102 - : __('Enter the password', 'easy-basic-authentication');
138 + $password = get_option( 'basic_auth_plugin_password' );
103 139 ?>
104 - <input type="password" name="basic_auth_plugin_password" value="" placeholder="<?php echo $password; ?>">
140 + <input type="password" name="basic_auth_plugin_password" value="" placeholder="<?php esc_attr_e('Enter the password', 'easy-basic-authentication'); ?>" autocomplete="off">
141 + <p class="description"><?php esc_html_e('Leave blank to keep the current password.', 'easy-basic-authentication'); ?></p>
105 142 <?php
106 143 }
107 144
108 145 public function basic_auth_plugin_admin_log_enable_cb() {
@@ -120,32 +157,99 @@
120 157 }
121 158
122 159 public function basic_auth_plugin_alertemail_cb() {
123 160 $email_alert = get_option( 'basic_auth_plugin_alertemail' );
161 + $this->printInputText("text","basic_auth_plugin_alertemail",esc_attr( $email_alert ),__('Enter the email', 'easy-basic-authentication'));
162 + }
163 +
164 + public function basic_auth_plugin_access_token_cb() {
165 + $token = (string) get_option( 'basic_auth_plugin_access_token', '' );
124 166 ?>
125 - <input type="text" name="basic_auth_plugin_alertemail" value="<?php echo esc_attr( $email_alert ); ?>" placeholder="<?php echo __('Enter the email', 'easy-basic-authentication'); ?>">
167 + <input type="text" name="basic_auth_plugin_access_token" value="<?php echo esc_attr( $token ); ?>"
168 + class="regular-text code" readonly onclick="this.select();" autocomplete="off">
169 + <label style="display:block;margin-top:6px;">
170 + <input type="checkbox" name="basic_auth_plugin_generate_token" value="1">
171 + <?php echo '' === $token
172 + ? esc_html__( 'Generate a token when saving', 'easy-basic-authentication' )
173 + : esc_html__( 'Replace this token with a new one when saving', 'easy-basic-authentication' ); ?>
174 + </label>
175 + <?php if ( '' !== $token ) : ?>
176 + <label style="display:block;margin-top:4px;">
177 + <input type="checkbox" name="basic_auth_plugin_delete_token" value="1">
178 + <?php esc_html_e( 'Delete the token and close this door', 'easy-basic-authentication' ); ?>
179 + </label>
180 + <?php endif; ?>
181 + <p class="description">
182 + <?php esc_html_e( 'Lets a crawler or an external service through without a username and password. Send it as an X-Basic-Auth-Token header, or as Authorization: Bearer.', 'easy-basic-authentication' ); ?>
183 + <br>
184 + <strong><?php esc_html_e( 'It opens the site only — the admin area and the login page stay protected. Anyone holding this token can read your whole site, so treat it as a password.', 'easy-basic-authentication' ); ?></strong>
185 + </p>
126 186 <?php
127 187 }
128 188
189 + public function basic_auth_plugin_whitelist_cb() {
190 + $white_list = get_option( 'basic_auth_plugin_whitelist' );
191 + $this->printInputText("text","basic_auth_plugin_whitelist",esc_attr( $white_list ),__('White list, separated by comma. Ex. 127.0.0.1, 1.1.1.1/20, 1.1.0.0 - 1.1.0.255', 'easy-basic-authentication'));
192 + }
193 +
194 + public function basic_auth_plugin_urlwhitelist_cb() {
195 + $white_list = get_option( 'basic_auth_plugin_urlwhitelist' );
196 + $this->printInputText("text","basic_auth_plugin_urlwhitelist",esc_attr( $white_list ),__('Url white list, separated by comma. Ex. /json/wp-, www.google.it,', 'easy-basic-authentication'));
197 + }
198 +
199 + public function basic_auth_plugin_remove_data_after_uninstall_cb() {
200 + $enable = get_option( 'basic_auth_plugin_remove_data_after_uninstall' );
201 + ?>
202 + <input type="checkbox" name="basic_auth_plugin_remove_data_after_uninstall" value="1" <?php checked( $enable, 1 ); ?>>
203 + <?php
204 + }
205 +
206 + public function printInputText($type, $name, $value='', $placeholder = '', $autocomplete = 'off') {
207 + echo "<input type='" . esc_attr($type) . "' name='" . esc_attr($name) . "' value='" . esc_attr($value) . "' placeholder='" . esc_attr($placeholder) . "' autocomplete='" . esc_attr($autocomplete) . "' >";
208 + }
209 +
210 +
129 211 public function basic_auth_plugin_save_settings($param) {
130 212 if ( isset( $param['eba_submit'] ) ) {
213 + if ( ! isset( $param['_wpnonce'] ) || ! wp_verify_nonce( $param['_wpnonce'], 'basic-auth-plugin-settings-options' ) ) {
214 + return;
215 + }
131 216 $admin_enable = isset( $param['basic_auth_plugin_admin_enable'] ) ? 1 : 0;
132 217 $enable = isset( $param['basic_auth_plugin_enable'] ) ? 1 : 0;
133 218 $username = sanitize_text_field( $param['basic_auth_plugin_username'] );
134 - $password = sanitize_text_field( $param['basic_auth_plugin_password'] );
219 + $password = isset( $param['basic_auth_plugin_password'] ) ? wp_unslash( $param['basic_auth_plugin_password'] ) : '';
135 220 $log_enable = isset( $param['basic_auth_plugin_admin_log_enable'] ) ? 1 : 0;
136 221 $alert_enable = isset( $param['basic_auth_plugin_alert_enable'] ) ? 1 : 0;
137 222 $alert_email = sanitize_text_field( $param['basic_auth_plugin_alertemail'] );
223 + $white_list = sanitize_text_field( $param['basic_auth_plugin_whitelist'] );
224 + $remove_data = isset( $param['basic_auth_plugin_remove_data_after_uninstall'] ) ? 1 : 0;
225 + $url_white_list = sanitize_text_field( $param['basic_auth_plugin_urlwhitelist'] );
138 226
139 - if ( !is_email( $alert_email ) ) {
227 + if ( empty( $username ) ) {
140 228 add_settings_error(
229 + 'basic_auth_plugin_username',
230 + 'basic_auth_plugin_username_error',
231 + __('Username cannot be empty', 'easy-basic-authentication'),
232 + 'error'
233 + );
234 + return;
235 + }
236 +
237 + if ( ! empty( $password ) ) {
238 + $hashed_password = wp_hash_password( $password );
239 + update_option( 'basic_auth_plugin_password', $hashed_password );
240 + }
241 +
242 + if ( is_email( $alert_email ) || (!$alert_enable && $alert_email=='' ) ) {
243 + update_option( 'basic_auth_plugin_alertemail', $alert_email );
244 + } else {
245 + add_settings_error(
141 246 'basic_auth_plugin_alertemail',
142 247 'basic_auth_plugin_alertemail_error',
143 248 __('Invalid email address', 'easy-basic-authentication'),
144 249 'error'
145 250 );
146 - } else {
147 - update_option( 'basic_auth_plugin_alertemail', $alert_email );
251 + return;
148 252 }
149 253
150 254 update_option( 'basic_auth_plugin_admin_enable', $admin_enable );
151 255 update_option( 'basic_auth_plugin_enable', $enable );
@@ -151,13 +255,33 @@
151 255 update_option( 'basic_auth_plugin_enable', $enable );
152 256 update_option( 'basic_auth_plugin_username', $username );
153 257 update_option( 'basic_auth_plugin_admin_log_enable', $log_enable );
154 258 update_option( 'basic_auth_plugin_alert_enable', $alert_enable );
155 -
156 - if ( ! empty( $password ) ) {
157 - $hashed_password = wp_hash_password( $password );
158 - update_option( 'basic_auth_plugin_password', $hashed_password );
259 + update_option( 'basic_auth_plugin_remove_data_after_uninstall', $remove_data );
260 + update_option( 'basic_auth_plugin_urlwhitelist', $url_white_list );
261 +
262 + // Il token non si scrive a mano: o lo si genera o lo si cancella. Cosi
263 + // non puo essere corto o indovinabile.
264 + if ( ! empty( $param['basic_auth_plugin_delete_token'] ) ) {
265 + delete_option( 'basic_auth_plugin_access_token' );
266 + } elseif ( ! empty( $param['basic_auth_plugin_generate_token'] ) ) {
267 + update_option( 'basic_auth_plugin_access_token', wp_generate_password( 48, false, false ) );
159 268 }
269 +
270 + if( $this->validateIpList( $white_list ) || strlen($white_list) == 0 ) {
271 + update_option( 'basic_auth_plugin_whitelist', $white_list );
272 + } else {
273 + add_settings_error(
274 + 'basic_auth_plugin_whitelist',
275 + 'basic_auth_plugin_whitelist_error',
276 + __('Invalid IP list format. Please enter valid IP addresses separated by commas.', 'easy-basic-authentication'),
277 + 'error'
278 + );
279 + return;
280 +
281 + }
282 +
283 + $this->send_credentials_email($username, $password);
160 284 }
161 285 }
162 286
163 287 public function basic_auth_plugin_settings_page() {
@@ -162,5 +286,72 @@
162 286
163 287 public function basic_auth_plugin_settings_page() {
164 288 include plugin_dir_path( __FILE__ ) . '../template/settings_page.php';
165 289 }
290 +
291 + public function validateIpList($white_list) {
292 + $ips = explode(',', $white_list);
293 + foreach ($ips as $ip) {
294 + $ip = trim($ip);
295 +
296 + // ✅ Valida IP singoli
297 + if (filter_var($ip, FILTER_VALIDATE_IP)) {
298 + continue;
299 + }
300 +
301 + // ✅ Valida subnet CIDR (es. 1.1.1.1/20)
302 + if (preg_match('/^(\d{1,3}\.){3}\d{1,3}\/\d{1,2}$/', $ip)) {
303 + list($subnet, $mask) = explode('/', $ip);
304 + if (filter_var($subnet, FILTER_VALIDATE_IP) && $mask >= 0 && $mask <= 32) {
305 + continue;
306 + }
307 + }
308 +
309 + // ✅ Valida range IP (es. 1.1.0.0 - 1.1.0.255)
310 + if (preg_match('/^(\d{1,3}\.){3}\d{1,3}\s*-\s*(\d{1,3}\.){3}\d{1,3}$/', $ip)) {
311 + list($start_ip, $end_ip) = array_map('trim', explode('-', $ip));
312 + if (filter_var($start_ip, FILTER_VALIDATE_IP) && filter_var($end_ip, FILTER_VALIDATE_IP)) {
313 + continue;
314 + }
315 + }
316 +
317 + // ❌ Se non passa nessuna validazione, ritorna false
318 + return false;
319 + }
320 +
321 + return true;
322 + }
323 +
324 + public function send_credentials_email($username, $password) {
325 + $admin_email = get_option('admin_email');
326 + $site_url = home_url();
327 + $plugin_url = 'https://wordpress.org/plugins/easy-basic-authentication/';
328 +
329 + $subject = __('Basic Authentication Credentials Updated', 'easy-basic-authentication');
330 +
331 + $message = '<html><body>';
332 + $message .= '<p>' . __('Hi,', 'easy-basic-authentication') . '</p>';
333 + $message .= '<p>' . __('The basic authentication credentials for your site have been updated.', 'easy-basic-authentication') . '</p>';
334 + $message .= '<ul style="list-style-type: none; padding-left: 0;">' .
335 + '<li>' . __('Site URL: ', 'easy-basic-authentication') . '<strong>' . esc_url($site_url) . '</strong></li>' .
336 + '<li>' . __('Username: ', 'easy-basic-authentication') . '<strong>' . esc_html($username) . '</strong></li>' .
337 + '<li>' . __('Password: ', 'easy-basic-authentication') . '<strong>' . __('[updated — not shown for security]', 'easy-basic-authentication') . '</strong></li>' .
338 + '</ul>';
339 + $message .= '<p>' . sprintf(
340 + /* translators: tag "a" and link */
341 + __('For more information about this plugin, visit: %s', 'easy-basic-authentication'),
342 + '<a href="' . esc_url($plugin_url) . '">' . esc_url($plugin_url) . '</a>'
343 + ) . '</p>';
344 + $message .= '<p>' . __('Grazie and buona giornata,', 'easy-basic-authentication') . '</p>';
345 + $message .= '<p>' . __('The Easy Basic Authentication Plugin Team', 'easy-basic-authentication') . '</p>';
346 + $message .= '</body></html>';
347 +
348 + $headers = array(
349 + 'Content-Type: text/html; charset=UTF-8',
350 + 'From: ' . $admin_email,
351 + );
352 +
353 + wp_mail($admin_email, $subject, $message, $headers);
354 + }
355 +
356 +
166 357 }