← All changes | main/settings/security.php +75 -3 2.0.6 → trunk View file →

		@@ -1,4 +1,4 @@
1	1	<?php
2	2
3	3	if(!defined('ABSPATH')){
4	4	die('Hacking Attempt!');
		@@ -268,8 +268,14 @@
268	268
269	269	$GLOBALS['lz_saved'] = true;
270	270	}
271	271
	272	+ if(isset($_POST['save_lz_user_enum'])){
	273	+ $user_enum = !empty($_POST['user_enum']) && is_array($_POST['user_enum']) ? map_deep($_POST['user_enum'], 'sanitize_text_field') : [];
	274	+ update_option('loginizer_user_enum', $user_enum);
	275	+ $GLOBALS['lz_saved'] = true;
	276	+ }
	277	+
272	278	// Call theme
273	279	loginizer_page_security_T();
274	280
275	281	}
		@@ -470,9 +476,12 @@
470	476	return;
471	477	}
472	478
473	479	var htaccess = textarea.val();
474		- htaccess = htaccess.replace(/\^.+?\(/, '^' + admin_name + '(');
	480	+ htaccess = htaccess.replace(
	481	+ /RewriteRule \^\(?([^\(\s]+)(?=\(-lzs|\()/g,
	482	+ (match, current_slug) => match.replace(current_slug, admin_name)
	483	+ );
475	484	textarea.val(htaccess);
476	485
477	486	}
478	487
		@@ -950,16 +959,78 @@
950	959	</table><br/>
951	960	<center><input name="save_lz_limit_session" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
952	961
953	962	</div>
954		- </div>
	963	+ </div>
955	964	</form>
956	965
	966	+<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1">
	967	+ <div id="" class="postbox">
	968	+
	969	+ <div class="postbox-header">
	970	+ <h2 class="hndle ui-sortable-handle">
	971	+ <span><?php echo __('Username Enumeration Protection', 'loginizer'); ?></span>
	972	+ </h2>
	973	+ </div>
	974	+
	975	+ <div class="inside">
	976	+
	977	+ <?php wp_nonce_field('loginizer-options'); ?>
	978	+ <table class="form-table">
	979	+ <tr>
	980	+ <td scope="row" valign="top" colspan="2">
	981	+ <i><?php echo __('WordPress can leak usernames through several channels such as the REST API, author archives, login form errors, lost password form, and oEmbed. Enable the relevant options below to prevent username enumeration via these channels.', 'loginizer'); ?></i>
	982	+ </td>
	983	+ </tr>
	984	+ <?php
	985	+ $lz_user_enum = get_option('loginizer_user_enum', []);
	986	+ $lz_enum_opts = [
	987	+ 'disable_rest_users' => [
	988	+ 'label' => __('Disable REST API Users endpoint', 'loginizer'),
	989	+ 'exp' => __('Blocks the /wp-json/wp/v2/users endpoint for visitors who are not logged in', 'loginizer')
	990	+ ],
	991	+ 'disable_author_enum' => [
	992	+ 'label' => __('Disable Author Archive enumeration', 'loginizer'),
	993	+ 'exp' => __('Shows a 404 for ?author=1 and ?author_name= URLs, which reveal usernames via the author archive', 'loginizer')
	994	+ ],
	995	+ 'hide_login_errors' => [
	996	+ 'label' => __('Hide Login form errors', 'loginizer'),
	997	+ 'exp' => __('Shows one generic error, so a valid username cannot be told apart from a wrong password', 'loginizer')
	998	+ ],
	999	+ 'hide_lostpass_errors' => [
	1000	+ 'label' => __('Hide Lost Password form errors', 'loginizer'),
	1001	+ 'exp' => __('Always shows the same message, so it does not confirm whether a username or email exists', 'loginizer')
	1002	+ ],
	1003	+ 'disable_oembed_author' => [
	1004	+ 'label' => __('Disable Author info in oEmbed', 'loginizer'),
	1005	+ 'exp' => __('Removes the author name and URL from the oEmbed data of your posts', 'loginizer')
	1006	+ ],
	1007	+ ];
	1008	+ foreach($lz_enum_opts as $enum_key => $enum_opt){
	1009	+ $enum_checked = !empty($_POST['user_enum'][$enum_key]) || (!empty($lz_user_enum[$enum_key]) && empty($_POST['save_lz_user_enum']));
	1010	+ ?>
	1011	+ <tr>
	1012	+ <td scope="row" valign="top" style="width:40% !important">
	1013	+ <label><?php echo esc_html($enum_opt['label']); ?></label><br>
	1014	+ <span class="exp"><?php echo esc_html($enum_opt['exp']); ?></span>
	1015	+ </td>
	1016	+ <td>
	1017	+ <input type="checkbox" value="1" name="user_enum[<?php echo esc_attr($enum_key); ?>]" <?php echo $enum_checked ? 'checked' : ''; ?> />
	1018	+ </td>
	1019	+ </tr>
	1020	+ <?php } ?>
	1021	+ </table><br/>
	1022	+ <center><input name="save_lz_user_enum" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center>
	1023	+
	1024	+ </div>
	1025	+ </div>
	1026	+</form>
	1027	+
957	1028	<?php
958	1029
959	1030	}
960	1031
961		- loginizer_page_footer();
	1032	+ loginizer_page_footer();
962	1033
963	1034	}
964	1035
965	1036	// .htaccess UI options for wp-admin and CSRF
		@@ -992,8 +1063,9 @@
992	1063	$rule = '# BEGIN Loginizer' . "\n";
993	1064	$rule .= '<IfModule mod_rewrite.c>' . "\n";
994	1065	$rule .= 'RewriteEngine On' . "\n";
995	1066	$rule .= 'RewriteBase ' . $home_root . "\n\n";
	1067	+ $rule .= 'RewriteRule ^(' . $admin_slug . '(-lzs.{20})?)$ $1/ [R=301,L]' . "\n";
996	1068	$rule .= 'RewriteRule ^' . $admin_slug . '(-lzs.{20})?(/?)(.*) wp-admin/$3 [L]' . "\n";
997	1069	$rule .= '</IfModule>' . "\n";
998	1070	$rule .= '# END Loginizer' . "\n";
999	1071