← All changes | main/settings/security.php +7 -79 trunk → 2.0.4 View file →

		@@ -1,4 +1,4 @@
1	1	<?php
2	2
3	3	if(!defined('ABSPATH')){
4	4	die('Hacking Attempt!');
		@@ -13,9 +13,9 @@
13	13	wp_die('Sorry, but you do not have permissions to change settings.');
14	14	}
15	15
16	16	if(!loginizer_is_premium() && count($_POST) > 0){
17		- $lz_error['not_in_free'] = __('This feature is not available in the Free version.', 'loginizer').' <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>'.esc_html__('Upgrade to Pro', 'loginizer').'</b></a>';
	17	+ $lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
18	18	return loginizer_page_security_T();
19	19	}
20	20
21	21	/* Make sure post was from this page */
		@@ -268,14 +268,8 @@
268	268
269	269	$GLOBALS['lz_saved'] = true;
270	270	}
271	271
272		- if(isset($_POST['save_lz_user_enum'])){
273		- $user_enum = !empty($_POST['user_enum']) && is_array($_POST['user_enum']) ? map_deep($_POST['user_enum'], 'sanitize_text_field') : [];
274		- update_option('loginizer_user_enum', $user_enum);
275		- $GLOBALS['lz_saved'] = true;
276		- }
277		-
278	272	// Call theme
279	273	loginizer_page_security_T();
280	274
281	275	}
		@@ -354,9 +348,9 @@
354	348	?>
355	349	<tr>
356	350	<td scope="row" valign="top" style="width:200px !important">
357	351	<label><?php echo __('Access Secretly Only', 'loginizer'); ?></label><br>
358		- <span class="exp"><?php echo sprintf(__('If set, then all Login URL\'s will still point to %s and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'), esc_html($loginizer['login_basename'])); ?></span>
	352	+ <span class="exp"><?php echo __('If set, then all Login URL\'s will still point to '.$loginizer['login_basename'].' and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'); ?></span>
359	353	</td>
360	354	<td>
361	355	<input type="checkbox" value="1" name="rename_login_secret" <?php echo lz_POSTchecked('rename_login_secret', (empty($loginizer['rename_login_secret']) ? false : true)); ?> />
362	356	</td>
		@@ -476,12 +470,9 @@
476	470	return;
477	471	}
478	472
479	473	var htaccess = textarea.val();
480		- htaccess = htaccess.replace(
481		- /RewriteRule \^\(?([^\(\s]+)(?=\(-lzs|\()/g,
482		- (match, current_slug) => match.replace(current_slug, admin_name)
483		- );
	474	+ htaccess = htaccess.replace(/\^.+?\(/, '^' + admin_name + '(');
484	475	textarea.val(htaccess);
485	476
486	477	}
487	478
		@@ -583,9 +574,9 @@
583	574	?>
584	575	<tr>
585	576	<td scope="row" valign="top" style="width:200px !important">
586	577	<label><?php echo __('I have setup .htaccess', 'loginizer'); ?></label><br>
587		- <span class="exp"><?php echo sprintf(__('You need to confirm that you have configured .htaccess as per %sour guide%s so that we can safely enable this feature', 'loginizer'), '<a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">', '</a>'); ?></span>
	578	+ <span class="exp"><?php echo __('You need to confirm that you have configured .htaccess as per <a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">our guide</a> so that we can safely enable this feature', 'loginizer'); ?></span>
588	579	</td>
589	580	<td>
590	581	<input type="checkbox" value="1" name="lz_wp_admin_docs" />
591	582	<input type="button" onclick="lz_test_wp_admin()" class="button" style="background: #5cb85c; color:white; border:#5cb85c" value="<?php echo __('Test New WP-Admin Slug', 'loginizer'); ?>" />
		@@ -740,9 +731,9 @@
740	731	<input type="text" size="50" value="<?php echo lz_optpost('new_username', ''); ?>" name="new_username" id="new_username" />
741	732	</td>
742	733	</tr>
743	734	</table><br />
744		- <i><?php echo __('Note: Username can be changed only for administrator users.', 'loginizer'); ?></i>
	735	+ <i><?php echo __('Note: Username can be changed only for administrator users.'); ?></i>
745	736	<center><input name="save_lz_admin" class="button button-primary action" value="<?php echo __('Set the Username', 'loginizer'); ?>" type="submit" /></center>
746	737
747	738	</div>
748	739	</div>
		@@ -959,78 +950,16 @@
959	950	</table><br/>
960	951	<center><input name="save_lz_limit_session" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
961	952
962	953	</div>
963		- </div>
	954	+ </div>
964	955	</form>
965	956
966		-<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
967		- <div id="" class="postbox">
968		-
969		- <div class="postbox-header">
970		- <h2 class="hndle ui-sortable-handle">
971		- <span><?php echo __('Username Enumeration Protection', 'loginizer'); ?></span>
972		- </h2>
973		- </div>
974		-
975		- <div class="inside">
976		-
977		- <?php wp_nonce_field('loginizer-options'); ?>
978		- <table class="form-table">
979		- <tr>
980		- <td scope="row" valign="top" colspan="2">
981		- <i><?php echo __('WordPress can leak usernames through several channels such as the REST API, author archives, login form errors, lost password form, and oEmbed. Enable the relevant options below to prevent username enumeration via these channels.', 'loginizer'); ?></i>
982		- </td>
983		- </tr>
984		- <?php
985		- $lz_user_enum = get_option('loginizer_user_enum', []);
986		- $lz_enum_opts = [
987		- 'disable_rest_users' => [
988		- 'label' => __('Disable REST API Users endpoint', 'loginizer'),
989		- 'exp' => __('Blocks the /wp-json/wp/v2/users endpoint for visitors who are not logged in', 'loginizer')
990		- ],
991		- 'disable_author_enum' => [
992		- 'label' => __('Disable Author Archive enumeration', 'loginizer'),
993		- 'exp' => __('Shows a 404 for ?author=1 and ?author_name= URLs, which reveal usernames via the author archive', 'loginizer')
994		- ],
995		- 'hide_login_errors' => [
996		- 'label' => __('Hide Login form errors', 'loginizer'),
997		- 'exp' => __('Shows one generic error, so a valid username cannot be told apart from a wrong password', 'loginizer')
998		- ],
999		- 'hide_lostpass_errors' => [
1000		- 'label' => __('Hide Lost Password form errors', 'loginizer'),
1001		- 'exp' => __('Always shows the same message, so it does not confirm whether a username or email exists', 'loginizer')
1002		- ],
1003		- 'disable_oembed_author' => [
1004		- 'label' => __('Disable Author info in oEmbed', 'loginizer'),
1005		- 'exp' => __('Removes the author name and URL from the oEmbed data of your posts', 'loginizer')
1006		- ],
1007		- ];
1008		- foreach($lz_enum_opts as $enum_key => $enum_opt){
1009		- $enum_checked = !empty($_POST['user_enum'][$enum_key]) || (!empty($lz_user_enum[$enum_key]) && empty($_POST['save_lz_user_enum']));
1010		- ?>
1011		- <tr>
1012		- <td scope="row" valign="top" style="width:40% !important">
1013		- <label><?php echo esc_html($enum_opt['label']); ?></label><br>
1014		- <span class="exp"><?php echo esc_html($enum_opt['exp']); ?></span>
1015		- </td>
1016		- <td>
1017		- <input type="checkbox" value="1" name="user_enum[<?php echo esc_attr($enum_key); ?>]" <?php echo $enum_checked ? 'checked' : ''; ?> />
1018		- </td>
1019		- </tr>
1020		- <?php } ?>
1021		- </table><br/>
1022		- <center><input name="save_lz_user_enum" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
1023		-
1024		- </div>
1025		- </div>
1026		-</form>
1027		-
1028	957	<?php
1029	958
1030	959	}
1031	960
1032		- loginizer_page_footer();
	961	+ loginizer_page_footer();
1033	962
1034	963	}
1035	964
1036	965	// .htaccess UI options for wp-admin and CSRF
		@@ -1063,9 +992,8 @@
1063	992	$rule = '# BEGIN Loginizer' . "\n";
1064	993	$rule .= '<IfModule mod_rewrite.c>' . "\n";
1065	994	$rule .= 'RewriteEngine On' . "\n";
1066	995	$rule .= 'RewriteBase ' . $home_root . "\n\n";
1067		- $rule .= 'RewriteRule ^(' . $admin_slug . '(-lzs.{20})?)$ $1/ [R=301,L]' . "\n";
1068	996	$rule .= 'RewriteRule ^' . $admin_slug . '(-lzs.{20})?(/?)(.*) wp-admin/$3 [L]' . "\n";
1069	997	$rule .= '</IfModule>' . "\n";
1070	998	$rule .= '# END Loginizer' . "\n";
1071	999