| @@ -1,4 +1,4 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | if(!defined('ABSPATH')){ |
| 4 | 4 | die('Hacking Attempt!'); |
| @@ -268,8 +268,14 @@ | ||
| 268 | 268 | |
| 269 | 269 | $GLOBALS['lz_saved'] = true; |
| 270 | 270 | } |
| 271 | 271 | |
| 272 | + if(isset($_POST['save_lz_user_enum'])){ | |
| 273 | + $user_enum = !empty($_POST['user_enum']) && is_array($_POST['user_enum']) ? map_deep($_POST['user_enum'], 'sanitize_text_field') : []; | |
| 274 | + update_option('loginizer_user_enum', $user_enum); | |
| 275 | + $GLOBALS['lz_saved'] = true; | |
| 276 | + } | |
| 277 | + | |
| 272 | 278 | // Call theme |
| 273 | 279 | loginizer_page_security_T(); |
| 274 | 280 | |
| 275 | 281 | } |
| @@ -953,16 +959,78 @@ | ||
| 953 | 959 | </table><br/> |
| 954 | 960 | <center><input name="save_lz_limit_session" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center> |
| 955 | 961 | |
| 956 | 962 | </div> |
| 957 | - </div> | |
| 963 | + </div> | |
| 958 | 964 | </form> |
| 959 | 965 | |
| 966 | +<form action="" method="post" enctype="multipart/form-data" loginizer-premium-only="1"> | |
| 967 | + <div id="" class="postbox"> | |
| 968 | + | |
| 969 | + <div class="postbox-header"> | |
| 970 | + <h2 class="hndle ui-sortable-handle"> | |
| 971 | + <span><?php echo __('Username Enumeration Protection', 'loginizer'); ?></span> | |
| 972 | + </h2> | |
| 973 | + </div> | |
| 974 | + | |
| 975 | + <div class="inside"> | |
| 976 | + | |
| 977 | + <?php wp_nonce_field('loginizer-options'); ?> | |
| 978 | + <table class="form-table"> | |
| 979 | + <tr> | |
| 980 | + <td scope="row" valign="top" colspan="2"> | |
| 981 | + <i><?php echo __('WordPress can leak usernames through several channels such as the REST API, author archives, login form errors, lost password form, and oEmbed. Enable the relevant options below to prevent username enumeration via these channels.', 'loginizer'); ?></i> | |
| 982 | + </td> | |
| 983 | + </tr> | |
| 984 | + <?php | |
| 985 | + $lz_user_enum = get_option('loginizer_user_enum', []); | |
| 986 | + $lz_enum_opts = [ | |
| 987 | + 'disable_rest_users' => [ | |
| 988 | + 'label' => __('Disable REST API Users endpoint', 'loginizer'), | |
| 989 | + 'exp' => __('Blocks the /wp-json/wp/v2/users endpoint for visitors who are not logged in', 'loginizer') | |
| 990 | + ], | |
| 991 | + 'disable_author_enum' => [ | |
| 992 | + 'label' => __('Disable Author Archive enumeration', 'loginizer'), | |
| 993 | + 'exp' => __('Shows a 404 for ?author=1 and ?author_name= URLs, which reveal usernames via the author archive', 'loginizer') | |
| 994 | + ], | |
| 995 | + 'hide_login_errors' => [ | |
| 996 | + 'label' => __('Hide Login form errors', 'loginizer'), | |
| 997 | + 'exp' => __('Shows one generic error, so a valid username cannot be told apart from a wrong password', 'loginizer') | |
| 998 | + ], | |
| 999 | + 'hide_lostpass_errors' => [ | |
| 1000 | + 'label' => __('Hide Lost Password form errors', 'loginizer'), | |
| 1001 | + 'exp' => __('Always shows the same message, so it does not confirm whether a username or email exists', 'loginizer') | |
| 1002 | + ], | |
| 1003 | + 'disable_oembed_author' => [ | |
| 1004 | + 'label' => __('Disable Author info in oEmbed', 'loginizer'), | |
| 1005 | + 'exp' => __('Removes the author name and URL from the oEmbed data of your posts', 'loginizer') | |
| 1006 | + ], | |
| 1007 | + ]; | |
| 1008 | + foreach($lz_enum_opts as $enum_key => $enum_opt){ | |
| 1009 | + $enum_checked = !empty($_POST['user_enum'][$enum_key]) || (!empty($lz_user_enum[$enum_key]) && empty($_POST['save_lz_user_enum'])); | |
| 1010 | + ?> | |
| 1011 | + <tr> | |
| 1012 | + <td scope="row" valign="top" style="width:40% !important"> | |
| 1013 | + <label><?php echo esc_html($enum_opt['label']); ?></label><br> | |
| 1014 | + <span class="exp"><?php echo esc_html($enum_opt['exp']); ?></span> | |
| 1015 | + </td> | |
| 1016 | + <td> | |
| 1017 | + <input type="checkbox" value="1" name="user_enum[<?php echo esc_attr($enum_key); ?>]" <?php echo $enum_checked ? 'checked' : ''; ?> /> | |
| 1018 | + </td> | |
| 1019 | + </tr> | |
| 1020 | + <?php } ?> | |
| 1021 | + </table><br/> | |
| 1022 | + <center><input name="save_lz_user_enum" class="button button-primary action" value="<?php echo __('Save Settings', 'loginizer'); ?>" type="submit" /></center> | |
| 1023 | + | |
| 1024 | + </div> | |
| 1025 | + </div> | |
| 1026 | +</form> | |
| 1027 | + | |
| 960 | 1028 | <?php |
| 961 | 1029 | |
| 962 | 1030 | } |
| 963 | 1031 | |
| 964 | - loginizer_page_footer(); | |
| 1032 | + loginizer_page_footer(); | |
| 965 | 1033 | |
| 966 | 1034 | } |
| 967 | 1035 | |
| 968 | 1036 | // .htaccess UI options for wp-admin and CSRF |
