← All changes | main/settings/security.php +80 -11 1.9.9 → trunk View file →

		@@ -1,4 +1,4 @@
1	1	<?php
2	2
3	3	if(!defined('ABSPATH')){
4	4	die('Hacking Attempt!');
		@@ -13,9 +13,9 @@
13	13	wp_die('Sorry, but you do not have permissions to change settings.');
14	14	}
15	15
16	16	if(!loginizer_is_premium() && count($_POST) > 0){
17		- $lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
	17	+ $lz_error['not_in_free'] = __('This feature is not available in the Free version.', 'loginizer').' <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>'.esc_html__('Upgrade to Pro', 'loginizer').'</b></a>';
18	18	return loginizer_page_security_T();
19	19	}
20	20
21	21	/* Make sure post was from this page */
		@@ -268,8 +268,14 @@
268	268
269	269	$GLOBALS['lz_saved'] = true;
270	270	}
271	271
	272	+ if(isset($_POST['save_lz_user_enum'])){
	273	+ $user_enum = !empty($_POST['user_enum']) && is_array($_POST['user_enum']) ? map_deep($_POST['user_enum'], 'sanitize_text_field') : [];
	274	+ update_option('loginizer_user_enum', $user_enum);
	275	+ $GLOBALS['lz_saved'] = true;
	276	+ }
	277	+
272	278	// Call theme
273	279	loginizer_page_security_T();
274	280
275	281	}
		@@ -348,9 +354,9 @@
348	354	?>
349	355	<tr>
350	356	<td scope="row" valign="top" style="width:200px !important">
351	357	<label><?php echo __('Access Secretly Only', 'loginizer'); ?></label><br>
352		- <span class="exp"><?php echo __('If set, then all Login URL\'s will still point to '.$loginizer['login_basename'].' and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'); ?></span>
	358	+ <span class="exp"><?php echo sprintf(__('If set, then all Login URL\'s will still point to %s and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'), esc_html($loginizer['login_basename'])); ?></span>
353	359	</td>
354	360	<td>
355	361	<input type="checkbox" value="1" name="rename_login_secret" <?php echo lz_POSTchecked('rename_login_secret', (empty($loginizer['rename_login_secret']) ? false : true)); ?> />
356	362	</td>
		@@ -470,9 +476,12 @@
470	476	return;
471	477	}
472	478
473	479	var htaccess = textarea.val();
474		- htaccess = htaccess.replace(/\^.+?\(/, '^' + admin_name + '(');
	480	+ htaccess = htaccess.replace(
	481	+ /RewriteRule \^\(?([^\(\s]+)(?=\(-lzs|\()/g,
	482	+ (match, current_slug) => match.replace(current_slug, admin_name)
	483	+ );
475	484	textarea.val(htaccess);
476	485
477	486	}
478	487
		@@ -574,9 +583,9 @@
574	583	?>
575	584	<tr>
576	585	<td scope="row" valign="top" style="width:200px !important">
577	586	<label><?php echo __('I have setup .htaccess', 'loginizer'); ?></label><br>
578		- <span class="exp"><?php echo __('You need to confirm that you have configured .htaccess as per <a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">our guide</a> so that we can safely enable this feature', 'loginizer'); ?></span>
	587	+ <span class="exp"><?php echo sprintf(__('You need to confirm that you have configured .htaccess as per %sour guide%s so that we can safely enable this feature', 'loginizer'), '<a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">', '</a>'); ?></span>
579	588	</td>
580	589	<td>
581	590	<input type="checkbox" value="1" name="lz_wp_admin_docs" />
582	591	<input type="button" onclick="lz_test_wp_admin()" class="button" style="background: #5cb85c; color:white; border:#5cb85c" value="<?php echo __('Test New WP-Admin Slug', 'loginizer'); ?>" />
		@@ -731,9 +740,9 @@
731	740	<input type="text" size="50" value="<?php echo lz_optpost('new_username', ''); ?>" name="new_username" id="new_username" />
732	741	</td>
733	742	</tr>
734	743	</table><br />
735		- <i><?php echo __('Note: Username can be changed only for administrator users.'); ?></i>
	744	+ <i><?php echo __('Note: Username can be changed only for administrator users.', 'loginizer'); ?></i>
736	745	<center><input name="save_lz_admin" class="button button-primary action" value="<?php echo __('Set the Username', 'loginizer'); ?>" type="submit" /></center>
737	746
738	747	</div>
739	748	</div>
		@@ -878,12 +887,9 @@
878	887	<div id="" class="postbox">
879	888
880	889	<div class="postbox-header">
881	890	<h2 class="hndle ui-sortable-handle">
882		- <span><?php echo __('Limit Concurrent Sessions', 'loginizer');
883		- if(time() < strtotime('30 July 2023')){
884		- echo ' <span style="color:red;">New</span></span>';
885		- } ?>
	891	+ <span><?php echo __('Limit Concurrent Sessions', 'loginizer'); ?>
886	892	</h2>
887	893	</div>
888	894
889	895	<div class="inside">
		@@ -953,16 +959,78 @@
953	959	</table><br/>
954	960	<center><input name="save_lz_limit_session" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
955	961
956	962	</div>
957		- </div>
	963	+ </div>
958	964	</form>
959	965
	966	+<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
	967	+ <div id="" class="postbox">
	968	+
	969	+ <div class="postbox-header">
	970	+ <h2 class="hndle ui-sortable-handle">
	971	+ <span><?php echo __('Username Enumeration Protection', 'loginizer'); ?></span>
	972	+ </h2>
	973	+ </div>
	974	+
	975	+ <div class="inside">
	976	+
	977	+ <?php wp_nonce_field('loginizer-options'); ?>
	978	+ <table class="form-table">
	979	+ <tr>
	980	+ <td scope="row" valign="top" colspan="2">
	981	+ <i><?php echo __('WordPress can leak usernames through several channels such as the REST API, author archives, login form errors, lost password form, and oEmbed. Enable the relevant options below to prevent username enumeration via these channels.', 'loginizer'); ?></i>
	982	+ </td>
	983	+ </tr>
	984	+ <?php
	985	+ $lz_user_enum = get_option('loginizer_user_enum', []);
	986	+ $lz_enum_opts = [
	987	+ 'disable_rest_users' => [
	988	+ 'label' => __('Disable REST API Users endpoint', 'loginizer'),
	989	+ 'exp' => __('Blocks the /wp-json/wp/v2/users endpoint for visitors who are not logged in', 'loginizer')
	990	+ ],
	991	+ 'disable_author_enum' => [
	992	+ 'label' => __('Disable Author Archive enumeration', 'loginizer'),
	993	+ 'exp' => __('Shows a 404 for ?author=1 and ?author_name= URLs, which reveal usernames via the author archive', 'loginizer')
	994	+ ],
	995	+ 'hide_login_errors' => [
	996	+ 'label' => __('Hide Login form errors', 'loginizer'),
	997	+ 'exp' => __('Shows one generic error, so a valid username cannot be told apart from a wrong password', 'loginizer')
	998	+ ],
	999	+ 'hide_lostpass_errors' => [
	1000	+ 'label' => __('Hide Lost Password form errors', 'loginizer'),
	1001	+ 'exp' => __('Always shows the same message, so it does not confirm whether a username or email exists', 'loginizer')
	1002	+ ],
	1003	+ 'disable_oembed_author' => [
	1004	+ 'label' => __('Disable Author info in oEmbed', 'loginizer'),
	1005	+ 'exp' => __('Removes the author name and URL from the oEmbed data of your posts', 'loginizer')
	1006	+ ],
	1007	+ ];
	1008	+ foreach($lz_enum_opts as $enum_key => $enum_opt){
	1009	+ $enum_checked = !empty($_POST['user_enum'][$enum_key]) || (!empty($lz_user_enum[$enum_key]) && empty($_POST['save_lz_user_enum']));
	1010	+ ?>
	1011	+ <tr>
	1012	+ <td scope="row" valign="top" style="width:40% !important">
	1013	+ <label><?php echo esc_html($enum_opt['label']); ?></label><br>
	1014	+ <span class="exp"><?php echo esc_html($enum_opt['exp']); ?></span>
	1015	+ </td>
	1016	+ <td>
	1017	+ <input type="checkbox" value="1" name="user_enum[<?php echo esc_attr($enum_key); ?>]" <?php echo $enum_checked ? 'checked' : ''; ?> />
	1018	+ </td>
	1019	+ </tr>
	1020	+ <?php } ?>
	1021	+ </table><br/>
	1022	+ <center><input name="save_lz_user_enum" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
	1023	+
	1024	+ </div>
	1025	+ </div>
	1026	+</form>
	1027	+
960	1028	<?php
961	1029
962	1030	}
963	1031
964		- loginizer_page_footer();
	1032	+ loginizer_page_footer();
965	1033
966	1034	}
967	1035
968	1036	// .htaccess UI options for wp-admin and CSRF
		@@ -995,8 +1063,9 @@
995	1063	$rule = '# BEGIN Loginizer' . "\n";
996	1064	$rule .= '<IfModule mod_rewrite.c>' . "\n";
997	1065	$rule .= 'RewriteEngine On' . "\n";
998	1066	$rule .= 'RewriteBase ' . $home_root . "\n\n";
	1067	+ $rule .= 'RewriteRule ^(' . $admin_slug . '(-lzs.{20})?)$ $1/ [R=301,L]' . "\n";
999	1068	$rule .= 'RewriteRule ^' . $admin_slug . '(-lzs.{20})?(/?)(.*) wp-admin/$3 [L]' . "\n";
1000	1069	$rule .= '</IfModule>' . "\n";
1001	1070	$rule .= '# END Loginizer' . "\n";
1002	1071