netsensai-shield / includes / disable_default_admin.php

disable_default_admin.php in NETSENSAI Shield 1.3, at includes/disable_default_admin.php

122 lines 5.0 KB

Raw Download Zip

1	<?php
2	// Exit if accessed directly.
3	if ( ! defined( 'ABSPATH' ) ) {
4	exit;
5	}
6
7	/**
8	* Display the "Disable Default Admin" toggle along with a text field to change the admin login.
9	*
10	* This function generates the settings UI for the administrator to disable the default "admin" login
11	* and specify a new admin username.
12	*
13	* @return void
14	*/
15	function ns_shield_disable_default_admin() {
16	// Odczytujemy wartość opcji (0 lub 1) – musi być zapisana przy użyciu absint.
17	$status = get_option( 'ns_shield_default_admin', 0 );
18	$admin_login = get_option( 'ns_shield_new_admin_login', '' );
19	?>
20	<div class="disable-admin-container">
21	<label class="switch">
22	<input type="checkbox" name="ns_shield_default_admin" id="ns_shield_default_admin" value="1" <?php checked( 1, $status, true ); ?>>
23	<span class="slider round"></span>
24	</label>
25	<div class="tooltip" id="tooltip-disable-admin">
26	<?php echo esc_html__( 'The default "admin" username is a prime target for attackers. Changing this makes it significantly harder for attackers to exploit common login details. Leaving the default admin username active increases vulnerability to brute force attacks.', 'netsensai-shield' ); ?>
27	</div>
28	<!-- Kontener z inline style – widoczność zależy od opcji -->
29	<div id="admin_login_field" style="display:<?php echo $status ? 'block' : 'none'; ?>;">
30	<input type="text"
31	name="ns_shield_new_admin_login"
32	id="ns_shield_new_admin_login"
33	value="<?php echo esc_attr( $admin_login ); ?>"
34	placeholder="<?php echo esc_attr__( 'Enter new admin login', 'netsensai-shield' ); ?>"
35	class="login-url-input">
36	</div>
37	</div>
38	<?php
39	}
40
41	/**
42	* Updates the admin username.
43	*
44	* This function changes the "admin" username to a new value or restores it if the feature is disabled.
45	*
46	* @global WPDB $wpdb
47	* @return void
48	*/
49	function ns_shield_update_admin_username() {
50	global $wpdb;
51
52	if ( get_option( 'ns_shield_default_admin' ) ) {
53	$admin_user = get_user_by( 'login', 'admin' );
54	if ( $admin_user ) {
55	$new_admin_login = get_option( 'ns_shield_new_admin_login', '' );
56	if ( ! empty( $new_admin_login ) ) {
57	if ( wp_get_current_user()->user_login === 'admin' ) {
58	update_option( 'ns_shield_admin_login_change_pending', $new_admin_login );
59	} else {
60	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
61	$wpdb->update(
62	$wpdb->users,
63	array( 'user_login' => sanitize_user( $new_admin_login ) ),
64	array( 'ID' => $admin_user->ID )
65	);
66	clean_user_cache( $admin_user->ID );
67	}
68	}
69	}
70	} else {
71	$custom_admin_login = get_option( 'ns_shield_new_admin_login', '' );
72	if ( ! empty( $custom_admin_login ) ) {
73	$custom_user = get_user_by( 'login', $custom_admin_login );
74	if ( $custom_user ) {
75	if ( wp_get_current_user()->user_login === $custom_admin_login ) {
76	update_option( 'ns_shield_admin_login_change_pending', 'admin' );
77	} else {
78	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
79	$wpdb->update(
80	$wpdb->users,
81	array( 'user_login' => 'admin' ),
82	array( 'ID' => $custom_user->ID )
83	);
84	clean_user_cache( $custom_user->ID );
85	}
86	}
87	}
88	}
89	}
90	add_action( 'init', 'ns_shield_update_admin_username' );
91
92	/**
93	* Changes the admin username after logout if there's a pending change.
94	*
95	* This function checks if there is a pending admin username change and updates it accordingly.
96	*
97	* @global WPDB $wpdb
98	* @return void
99	*/
100	function ns_shield_change_admin_username_after_logout() {
101	global $wpdb;
102	$pending_login_change = get_option( 'ns_shield_admin_login_change_pending', '' );
103
104	if ( ! empty( $pending_login_change ) ) {
105	$target_login = ( $pending_login_change === 'admin' )
106	? get_option( 'ns_shield_new_admin_login', '' )
107	: 'admin';
108	$admin_user = get_user_by( 'login', $target_login );
109	if ( $admin_user ) {
110	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
111	$wpdb->update(
112	$wpdb->users,
113	array( 'user_login' => sanitize_user( $pending_login_change ) ),
114	array( 'ID' => $admin_user->ID )
115	);
116	clean_user_cache( $admin_user->ID );
117	delete_option( 'ns_shield_admin_login_change_pending' );
118	}
119	}
120	}
121	add_action( 'wp_logout', 'ns_shield_change_admin_username_after_logout' );
122