← All changes | main/settings/security.php +79 -7 2.0.1 → trunk View file →

		@@ -1,4 +1,4 @@
1	1	<?php
2	2
3	3	if(!defined('ABSPATH')){
4	4	die('Hacking Attempt!');
		@@ -13,9 +13,9 @@
13	13	wp_die('Sorry, but you do not have permissions to change settings.');
14	14	}
15	15
16	16	if(!loginizer_is_premium() && count($_POST) > 0){
17		- $lz_error['not_in_free'] = __('This feature is not available in the Free version. <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>Upgrade to Pro</b></a>', 'loginizer');
	17	+ $lz_error['not_in_free'] = __('This feature is not available in the Free version.', 'loginizer').' <a href="'.LOGINIZER_PRICING_URL.'" target="_blank" style="text-decoration:none; color:green;"><b>'.esc_html__('Upgrade to Pro', 'loginizer').'</b></a>';
18	18	return loginizer_page_security_T();
19	19	}
20	20
21	21	/* Make sure post was from this page */
		@@ -268,8 +268,14 @@
268	268
269	269	$GLOBALS['lz_saved'] = true;
270	270	}
271	271
	272	+ if(isset($_POST['save_lz_user_enum'])){
	273	+ $user_enum = !empty($_POST['user_enum']) && is_array($_POST['user_enum']) ? map_deep($_POST['user_enum'], 'sanitize_text_field') : [];
	274	+ update_option('loginizer_user_enum', $user_enum);
	275	+ $GLOBALS['lz_saved'] = true;
	276	+ }
	277	+
272	278	// Call theme
273	279	loginizer_page_security_T();
274	280
275	281	}
		@@ -348,9 +354,9 @@
348	354	?>
349	355	<tr>
350	356	<td scope="row" valign="top" style="width:200px !important">
351	357	<label><?php echo __('Access Secretly Only', 'loginizer'); ?></label><br>
352		- <span class="exp"><?php echo __('If set, then all Login URL\'s will still point to '.$loginizer['login_basename'].' and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'); ?></span>
	358	+ <span class="exp"><?php echo sprintf(__('If set, then all Login URL\'s will still point to %s and users will have to access the New Login Slug by typing it in the browser.', 'loginizer'), esc_html($loginizer['login_basename'])); ?></span>
353	359	</td>
354	360	<td>
355	361	<input type="checkbox" value="1" name="rename_login_secret" <?php echo lz_POSTchecked('rename_login_secret', (empty($loginizer['rename_login_secret']) ? false : true)); ?> />
356	362	</td>
		@@ -470,9 +476,12 @@
470	476	return;
471	477	}
472	478
473	479	var htaccess = textarea.val();
474		- htaccess = htaccess.replace(/\^.+?\(/, '^' + admin_name + '(');
	480	+ htaccess = htaccess.replace(
	481	+ /RewriteRule \^\(?([^\(\s]+)(?=\(-lzs|\()/g,
	482	+ (match, current_slug) => match.replace(current_slug, admin_name)
	483	+ );
475	484	textarea.val(htaccess);
476	485
477	486	}
478	487
		@@ -574,9 +583,9 @@
574	583	?>
575	584	<tr>
576	585	<td scope="row" valign="top" style="width:200px !important">
577	586	<label><?php echo __('I have setup .htaccess', 'loginizer'); ?></label><br>
578		- <span class="exp"><?php echo __('You need to confirm that you have configured .htaccess as per <a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">our guide</a> so that we can safely enable this feature', 'loginizer'); ?></span>
	587	+ <span class="exp"><?php echo sprintf(__('You need to confirm that you have configured .htaccess as per %sour guide%s so that we can safely enable this feature', 'loginizer'), '<a href="'.LOGINIZER_DOCS.'Renaming_the_WP-Admin_Area" target="_blank">', '</a>'); ?></span>
579	588	</td>
580	589	<td>
581	590	<input type="checkbox" value="1" name="lz_wp_admin_docs" />
582	591	<input type="button" onclick="lz_test_wp_admin()" class="button" style="background: #5cb85c; color:white; border:#5cb85c" value="<?php echo __('Test New WP-Admin Slug', 'loginizer'); ?>" />
		@@ -731,9 +740,9 @@
731	740	<input type="text" size="50" value="<?php echo lz_optpost('new_username', ''); ?>" name="new_username" id="new_username" />
732	741	</td>
733	742	</tr>
734	743	</table><br />
735		- <i><?php echo __('Note: Username can be changed only for administrator users.'); ?></i>
	744	+ <i><?php echo __('Note: Username can be changed only for administrator users.', 'loginizer'); ?></i>
736	745	<center><input name="save_lz_admin" class="button button-primary action" value="<?php echo __('Set the Username', 'loginizer'); ?>" type="submit" /></center>
737	746
738	747	</div>
739	748	</div>
		@@ -950,16 +959,78 @@
950	959	</table><br/>
951	960	<center><input name="save_lz_limit_session" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
952	961
953	962	</div>
954		- </div>
	963	+ </div>
955	964	</form>
956	965
	966	+<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
	967	+ <div id="" class="postbox">
	968	+
	969	+ <div class="postbox-header">
	970	+ <h2 class="hndle ui-sortable-handle">
	971	+ <span><?php echo __('Username Enumeration Protection', 'loginizer'); ?></span>
	972	+ </h2>
	973	+ </div>
	974	+
	975	+ <div class="inside">
	976	+
	977	+ <?php wp_nonce_field('loginizer-options'); ?>
	978	+ <table class="form-table">
	979	+ <tr>
	980	+ <td scope="row" valign="top" colspan="2">
	981	+ <i><?php echo __('WordPress can leak usernames through several channels such as the REST API, author archives, login form errors, lost password form, and oEmbed. Enable the relevant options below to prevent username enumeration via these channels.', 'loginizer'); ?></i>
	982	+ </td>
	983	+ </tr>
	984	+ <?php
	985	+ $lz_user_enum = get_option('loginizer_user_enum', []);
	986	+ $lz_enum_opts = [
	987	+ 'disable_rest_users' => [
	988	+ 'label' => __('Disable REST API Users endpoint', 'loginizer'),
	989	+ 'exp' => __('Blocks the /wp-json/wp/v2/users endpoint for visitors who are not logged in', 'loginizer')
	990	+ ],
	991	+ 'disable_author_enum' => [
	992	+ 'label' => __('Disable Author Archive enumeration', 'loginizer'),
	993	+ 'exp' => __('Shows a 404 for ?author=1 and ?author_name= URLs, which reveal usernames via the author archive', 'loginizer')
	994	+ ],
	995	+ 'hide_login_errors' => [
	996	+ 'label' => __('Hide Login form errors', 'loginizer'),
	997	+ 'exp' => __('Shows one generic error, so a valid username cannot be told apart from a wrong password', 'loginizer')
	998	+ ],
	999	+ 'hide_lostpass_errors' => [
	1000	+ 'label' => __('Hide Lost Password form errors', 'loginizer'),
	1001	+ 'exp' => __('Always shows the same message, so it does not confirm whether a username or email exists', 'loginizer')
	1002	+ ],
	1003	+ 'disable_oembed_author' => [
	1004	+ 'label' => __('Disable Author info in oEmbed', 'loginizer'),
	1005	+ 'exp' => __('Removes the author name and URL from the oEmbed data of your posts', 'loginizer')
	1006	+ ],
	1007	+ ];
	1008	+ foreach($lz_enum_opts as $enum_key => $enum_opt){
	1009	+ $enum_checked = !empty($_POST['user_enum'][$enum_key]) || (!empty($lz_user_enum[$enum_key]) && empty($_POST['save_lz_user_enum']));
	1010	+ ?>
	1011	+ <tr>
	1012	+ <td scope="row" valign="top" style="width:40% !important">
	1013	+ <label><?php echo esc_html($enum_opt['label']); ?></label><br>
	1014	+ <span class="exp"><?php echo esc_html($enum_opt['exp']); ?></span>
	1015	+ </td>
	1016	+ <td>
	1017	+ <input type="checkbox" value="1" name="user_enum[<?php echo esc_attr($enum_key); ?>]" <?php echo $enum_checked ? 'checked' : ''; ?> />
	1018	+ </td>
	1019	+ </tr>
	1020	+ <?php } ?>
	1021	+ </table><br/>
	1022	+ <center><input name="save_lz_user_enum" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
	1023	+
	1024	+ </div>
	1025	+ </div>
	1026	+</form>
	1027	+
957	1028	<?php
958	1029
959	1030	}
960	1031
961		- loginizer_page_footer();
	1032	+ loginizer_page_footer();
962	1033
963	1034	}
964	1035
965	1036	// .htaccess UI options for wp-admin and CSRF
		@@ -992,8 +1063,9 @@
992	1063	$rule = '# BEGIN Loginizer' . "\n";
993	1064	$rule .= '<IfModule mod_rewrite.c>' . "\n";
994	1065	$rule .= 'RewriteEngine On' . "\n";
995	1066	$rule .= 'RewriteBase ' . $home_root . "\n\n";
	1067	+ $rule .= 'RewriteRule ^(' . $admin_slug . '(-lzs.{20})?)$ $1/ [R=301,L]' . "\n";
996	1068	$rule .= 'RewriteRule ^' . $admin_slug . '(-lzs.{20})?(/?)(.*) wp-admin/$3 [L]' . "\n";
997	1069	$rule .= '</IfModule>' . "\n";
998	1070	$rule .= '# END Loginizer' . "\n";
999	1071