| @@ -199,8 +199,26 @@ | ||
| 199 | 199 | /** |
| 200 | 200 | * Run database migrations based on stored version |
| 201 | 201 | */ |
| 202 | 202 | public function run_migrations() { |
| 203 | + /* | |
| 204 | + * admin-ajax.php fires admin_init before it decides who is asking | |
| 205 | + * (wp-admin/admin-ajax.php:45), so until 2.11.10 an anonymous POST to | |
| 206 | + * admin-ajax.php with any action ran every pending migration. That is | |
| 207 | + * not a read: the migrations rewrite wp-config.php through | |
| 208 | + * apply_security_constants(), rewrite the root .htaccess, move user meta | |
| 209 | + * of the whole network and can rebuild the file integrity baseline, | |
| 210 | + * taking whatever is on disk as approved. Reproduced on 12 sep 2026 with | |
| 211 | + * curl and no cookies, and found by the file-by-file review of 2.11.10. | |
| 212 | + * | |
| 213 | + * Migrations are maintenance for whoever administers the site, so they | |
| 214 | + * wait for an administrator to load a screen. Nothing is lost by | |
| 215 | + * waiting: every migration is idempotent and version gated. | |
| 216 | + */ | |
| 217 | + if ( ! is_user_logged_in() || ! current_user_can( 'manage_options' ) ) { | |
| 218 | + return; | |
| 219 | + } | |
| 220 | + | |
| 203 | 221 | $db_version = get_option( 'vigilante_db_version', '0' ); |
| 204 | 222 | |
| 205 | 223 | // 1.2.3: Fix IP lists corrupted by sanitize_text_field stripping newlines |
| 206 | 224 | if ( version_compare( $db_version, '1.2.3', '<' ) ) { |
| @@ -464,11 +482,153 @@ | ||
| 464 | 482 | $this->database->purge_for_2_11_0(); |
| 465 | 483 | |
| 466 | 484 | update_option( 'vigilante_db_version', '2.11.0' ); |
| 467 | 485 | } |
| 486 | + | |
| 487 | + /* | |
| 488 | + * 2.11.9: clear the raw .htaccess copies that older versions left in | |
| 489 | + * options, on the first admin load after the update. Uninstall already | |
| 490 | + * removes them, but that only fires when the plugin is deleted, so a | |
| 491 | + * site that keeps the plugin carried them until now. Three stores, each | |
| 492 | + * a copy of a file that can hold secrets (a SetEnv token, an | |
| 493 | + * Authorization header): the same exposure the wp.org review flagged as | |
| 494 | + * 4.4, on the paths its fix did not reach. | |
| 495 | + * | |
| 496 | + * - vigilante_htaccess_history: up to five raw copies, by design, until | |
| 497 | + * 2.11.8. The writer is gone, nothing reads it, so it is deleted. | |
| 498 | + * - vigilante_htaccess_backup: the single rollback buffer, normally | |
| 499 | + * cleared in the finally of each write; a copy only lingers if a write | |
| 500 | + * crashed mid-operation. Nothing outside one write reads it, so a | |
| 501 | + * leftover is deleted. | |
| 502 | + * - vigilante_htaccess_pre_migration: still read by the header recovery, | |
| 503 | + * but older versions stored the whole file where only our own block is | |
| 504 | + * ever used. Truncated to that block, so the feature keeps working and | |
| 505 | + * nothing outside our markers stays in the option. | |
| 506 | + */ | |
| 507 | + if ( version_compare( $db_version, '2.11.9', '<' ) ) { | |
| 508 | + delete_option( 'vigilante_htaccess_history' ); | |
| 509 | + delete_option( 'vigilante_htaccess_backup' ); | |
| 510 | + | |
| 511 | + $snapshot = get_option( 'vigilante_htaccess_pre_migration' ); | |
| 512 | + if ( is_array( $snapshot ) && isset( $snapshot['content'] ) && '' !== (string) $snapshot['content'] ) { | |
| 513 | + require_once VIGILANTE_INCLUDES_DIR . 'class-htaccess-recovery.php'; | |
| 514 | + $block = Vigilante_Htaccess_Recovery::get_raw_block(); | |
| 515 | + | |
| 516 | + if ( '' === $block ) { | |
| 517 | + delete_option( 'vigilante_htaccess_pre_migration' ); | |
| 518 | + } elseif ( $block !== $snapshot['content'] ) { | |
| 519 | + $snapshot['content'] = $block; | |
| 520 | + update_option( 'vigilante_htaccess_pre_migration', $snapshot, false ); | |
| 521 | + } | |
| 522 | + } | |
| 523 | + | |
| 524 | + update_option( 'vigilante_db_version', '2.11.9' ); | |
| 525 | + } | |
| 526 | + | |
| 527 | + /* | |
| 528 | + * 2.11.10: the pending-approval flag becomes one per site on a network. | |
| 529 | + * Until 2.11.9 it was a single global user meta, so the queue was shared | |
| 530 | + * across the whole network. Moving the key is not enough: the accounts | |
| 531 | + * already waiting carry the old key, and reading only the new one would | |
| 532 | + * let them log in. So they are moved here, each to the site it belongs | |
| 533 | + * to, and the old key is removed only once the new one is written. | |
| 534 | + */ | |
| 535 | + if ( version_compare( $db_version, '2.11.10', '<' ) ) { | |
| 536 | + $this->migrate_pending_approval_per_site(); | |
| 537 | + | |
| 538 | + update_option( 'vigilante_db_version', '2.11.10' ); | |
| 539 | + } | |
| 468 | 540 | } |
| 469 | 541 | |
| 470 | 542 | /** |
| 543 | + * Move the pending-approval flag of a network to a key per site | |
| 544 | + * | |
| 545 | + * Runs once for the whole network, not once per site: the data it moves is | |
| 546 | + * global, so the guard is a network option and any site may be the one that | |
| 547 | + * does it. On a single site the key does not change and there is nothing to | |
| 548 | + * do. | |
| 549 | + * | |
| 550 | + * Each waiting account goes to its primary site, or to the only site it | |
| 551 | + * belongs to; one that belongs to none goes to the main site rather than | |
| 552 | + * nowhere, because losing the flag would silently approve it. | |
| 553 | + * | |
| 554 | + * @since 2.11.10 | |
| 555 | + */ | |
| 556 | + private function migrate_pending_approval_per_site() { | |
| 557 | + global $wpdb; | |
| 558 | + | |
| 559 | + if ( ! is_multisite() ) { | |
| 560 | + return; | |
| 561 | + } | |
| 562 | + | |
| 563 | + if ( get_site_option( 'vigilante_pending_per_site_done' ) ) { | |
| 564 | + return; | |
| 565 | + } | |
| 566 | + | |
| 567 | + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- One-off migration of the plugin's own user meta; the meta API has no "list every user with this key". | |
| 568 | + $user_ids = $wpdb->get_col( | |
| 569 | + $wpdb->prepare( "SELECT DISTINCT user_id FROM {$wpdb->usermeta} WHERE meta_key = %s", 'vigilante_pending_approval' ) | |
| 570 | + ); | |
| 571 | + | |
| 572 | + foreach ( (array) $user_ids as $user_id ) { | |
| 573 | + $user_id = (int) $user_id; | |
| 574 | + if ( ! $user_id ) { | |
| 575 | + continue; | |
| 576 | + } | |
| 577 | + | |
| 578 | + $pending = get_user_meta( $user_id, 'vigilante_pending_approval', true ); | |
| 579 | + $since = get_user_meta( $user_id, 'vigilante_pending_since', true ); | |
| 580 | + | |
| 581 | + /* | |
| 582 | + * Every site the account belongs to, not its primary one. The global | |
| 583 | + * flag does not say where the registration happened, and the first | |
| 584 | + * version of this guessed the primary blog: an account that | |
| 585 | + * registered on B while its primary was A came out pending on A and | |
| 586 | + * free to log in on B, which is the very site it had never been | |
| 587 | + * approved on. Found by the cross review of 2.11.10. | |
| 588 | + * | |
| 589 | + * Marking every site it belongs to fails closed instead: the account | |
| 590 | + * stays blocked wherever it can log in, and shows up in the queue of | |
| 591 | + * each of those sites so somebody can actually act on it. An account | |
| 592 | + * that belongs to no site goes to the main one rather than nowhere, | |
| 593 | + * because losing the flag would silently approve it. | |
| 594 | + */ | |
| 595 | + /* | |
| 596 | + * With $all true, because the default leaves out archived, spam and | |
| 597 | + * deleted sites (wp-includes/user.php:1113-1117): a site archived on | |
| 598 | + * the day this runs would lose the flag, and the account would walk | |
| 599 | + * in unapproved the moment it was brought back. Found by the second | |
| 600 | + * cross review of 2.11.10. | |
| 601 | + */ | |
| 602 | + $blog_ids = array(); | |
| 603 | + | |
| 604 | + foreach ( get_blogs_of_user( $user_id, true ) as $blog ) { | |
| 605 | + if ( ! empty( $blog->userblog_id ) ) { | |
| 606 | + $blog_ids[] = (int) $blog->userblog_id; | |
| 607 | + } | |
| 608 | + } | |
| 609 | + | |
| 610 | + if ( empty( $blog_ids ) ) { | |
| 611 | + $blog_ids[] = (int) get_main_site_id(); | |
| 612 | + } | |
| 613 | + | |
| 614 | + foreach ( array_unique( $blog_ids ) as $blog_id ) { | |
| 615 | + $prefix = $wpdb->get_blog_prefix( $blog_id ); | |
| 616 | + | |
| 617 | + update_user_meta( $user_id, $prefix . 'vigilante_pending_approval', $pending ); | |
| 618 | + if ( '' !== $since && false !== $since ) { | |
| 619 | + update_user_meta( $user_id, $prefix . 'vigilante_pending_since', $since ); | |
| 620 | + } | |
| 621 | + } | |
| 622 | + | |
| 623 | + delete_user_meta( $user_id, 'vigilante_pending_approval' ); | |
| 624 | + delete_user_meta( $user_id, 'vigilante_pending_since' ); | |
| 625 | + } | |
| 626 | + | |
| 627 | + update_site_option( 'vigilante_pending_per_site_done', 1 ); | |
| 628 | + } | |
| 629 | + | |
| 630 | + /** | |
| 471 | 631 | * Migration: Remove orphaned email fields from saved options |
| 472 | 632 | * |
| 473 | 633 | * v1.10.0 centralized notification recipients into email section. |
| 474 | 634 | * Old per-module notify_email fields and dead email section fields |
| @@ -736,23 +896,32 @@ | ||
| 736 | 896 | if ( ! did_action( 'plugins_loaded' ) ) { |
| 737 | 897 | return 0; |
| 738 | 898 | } |
| 739 | 899 | |
| 740 | - $registration_approval = $this->settings->get_section( 'user_security' ); | |
| 741 | - $approval_settings = $registration_approval['registration_approval'] ?? array(); | |
| 742 | - | |
| 743 | - if ( empty( $approval_settings['enabled'] ) ) { | |
| 744 | - return 0; | |
| 745 | - } | |
| 900 | + /* | |
| 901 | + * Counted whether the feature is on or off. An account already waiting | |
| 902 | + * stays blocked when it is switched off (see init_enforcement_hooks()), | |
| 903 | + * so reporting zero there hid people who cannot log in and whom nobody | |
| 904 | + * could see to approve. Found by the cross review of 2.11.10. | |
| 905 | + */ | |
| 746 | 906 | |
| 747 | 907 | // phpcs:disable WordPress.DB.SlowDBQuery.slow_db_query_meta_key, WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- Limited results in admin context. |
| 748 | - $pending_users = get_users( array( | |
| 749 | - 'meta_key' => 'vigilante_pending_approval', | |
| 908 | + $args = array( | |
| 909 | + 'meta_key' => Vigilante_User_Security::site_user_meta_key( 'vigilante_pending_approval' ), | |
| 750 | 910 | 'meta_value' => '1', |
| 751 | 911 | 'fields' => 'ID', |
| 752 | - ) ); | |
| 912 | + ); | |
| 753 | 913 | // phpcs:enable WordPress.DB.SlowDBQuery.slow_db_query_meta_key, WordPress.DB.SlowDBQuery.slow_db_query_meta_value |
| 754 | 914 | |
| 915 | + // Same query as Vigilante_User_Security::get_pending_users(), and for the | |
| 916 | + // same reason: the meta key already scopes this to the site, and adding | |
| 917 | + // core's membership filter on top hid the accounts that have no role yet. | |
| 918 | + if ( is_multisite() ) { | |
| 919 | + $args['blog_id'] = 0; | |
| 920 | + } | |
| 921 | + | |
| 922 | + $pending_users = get_users( $args ); | |
| 923 | + | |
| 755 | 924 | return count( $pending_users ); |
| 756 | 925 | } |
| 757 | 926 | |
| 758 | 927 | /** |
| @@ -1545,8 +1714,11 @@ | ||
| 1545 | 1714 | 'reviewChanges' => __( 'Review changes', 'vigilante' ), |
| 1546 | 1715 | 'hideChanges' => __( 'Hide changes', 'vigilante' ), |
| 1547 | 1716 | 'changes' => __( 'Changes', 'vigilante' ), |
| 1548 | 1717 | 'diffUnavailable' => __( 'Diff not available for this file (baseline was created before diff tracking was added). Approve to enable diff on future changes.', 'vigilante' ), |
| 1718 | + 'diffNetwork' => __( 'This file belongs to the whole network, so its line changes are only shown to network administrators, on the main site.', 'vigilante' ), | |
| 1719 | + 'diffRescan' => __( 'Run a new scan to see the line changes of this file.', 'vigilante' ), | |
| 1720 | + 'diffRedaction' => __( 'The line changes of this file are not shown because a value in it could not be hidden safely. The change itself is still detected.', 'vigilante' ), | |
| 1549 | 1721 | 'diffEmpty' => __( 'No line-level changes detected (may be whitespace or reordering).', 'vigilante' ), |
| 1550 | 1722 | 'diffLines' => __( 'lines', 'vigilante' ), |
| 1551 | 1723 | // Under Attack mode strings |
| 1552 | 1724 | 'underAttackConfirmActivate' => __( 'Activate Under Attack mode? All visitors will see a verification page for the next 4 hours.', 'vigilante' ), |
| @@ -2115,10 +2287,46 @@ | ||
| 2115 | 2287 | * |
| 2116 | 2288 | * @since 2.10.4 |
| 2117 | 2289 | * @return bool |
| 2118 | 2290 | */ |
| 2291 | + private function forwarded_chain_readings() { | |
| 2292 | + // Shown, not decided on: the firewall resolves the address elsewhere. | |
| 2293 | + $chain = Vigilante_IP_Utils::trusted_forwarded_for(); | |
| 2294 | + | |
| 2295 | + if ( '' === $chain ) { | |
| 2296 | + return array(); | |
| 2297 | + } | |
| 2298 | + | |
| 2299 | + $public = array(); | |
| 2300 | + | |
| 2301 | + foreach ( explode( ',', $chain ) as $entry ) { | |
| 2302 | + $address = Vigilante_IP_Utils::unmap_ipv4( trim( $entry ) ); | |
| 2303 | + | |
| 2304 | + if ( filter_var( $address, FILTER_VALIDATE_IP ) && ! Vigilante_IP_Utils::is_own_network( $address ) ) { | |
| 2305 | + $public[] = $address; | |
| 2306 | + } | |
| 2307 | + } | |
| 2308 | + | |
| 2309 | + if ( count( $public ) < 2 ) { | |
| 2310 | + return array(); | |
| 2311 | + } | |
| 2312 | + | |
| 2313 | + return array( | |
| 2314 | + 'now' => Vigilante_IP_Utils::client_from_chain( $chain ), | |
| 2315 | + 'before' => $public[0], | |
| 2316 | + ); | |
| 2317 | + } | |
| 2318 | + | |
| 2319 | + /** | |
| 2320 | + * Whether the user tools of this screen are out of reach for this user | |
| 2321 | + * | |
| 2322 | + * @return bool | |
| 2323 | + */ | |
| 2119 | 2324 | private function user_actions_locked() { |
| 2120 | - return is_multisite() && ! current_user_can( 'manage_network_users' ); | |
| 2325 | + // On a single site edit_user maps to edit_users, which a custom role with | |
| 2326 | + // manage_options may lack: since 2.11.8 approving and rejecting a pending | |
| 2327 | + // registration ask for it, so the buttons have to say so there too. | |
| 2328 | + return is_multisite() ? ! current_user_can( 'manage_network_users' ) : ! current_user_can( 'edit_users' ); | |
| 2121 | 2329 | } |
| 2122 | 2330 | |
| 2123 | 2331 | /** |
| 2124 | 2332 | * Print the notice for user tools that cannot be used from this site |
| @@ -2130,9 +2338,13 @@ | ||
| 2130 | 2338 | return; |
| 2131 | 2339 | } |
| 2132 | 2340 | ?> |
| 2133 | 2341 | <div class="notice notice-info inline" style="margin:10px 0 16px;padding:8px 12px;"> |
| 2342 | + <?php if ( is_multisite() ) : ?> | |
| 2134 | 2343 | <p style="margin:0;"><?php esc_html_e( 'These tools act on user accounts, which on a network belong to the whole network rather than to one site. WordPress reserves that to network administrators, so they are managed from the network admin.', 'vigilante' ); ?></p> |
| 2344 | + <?php else : ?> | |
| 2345 | + <p style="margin:0;"><?php esc_html_e( 'These tools act on other user accounts, and your role cannot edit users, so they are not available to you.', 'vigilante' ); ?></p> | |
| 2346 | + <?php endif; ?> | |
| 2135 | 2347 | </div> |
| 2136 | 2348 | <?php |
| 2137 | 2349 | } |
| 2138 | 2350 | |
| @@ -3307,8 +3519,29 @@ | ||
| 3307 | 3519 | </table> |
| 3308 | 3520 | </div> |
| 3309 | 3521 | <?php endif; ?> |
| 3310 | 3522 | |
| 3523 | + <?php | |
| 3524 | + // Since 2.11.8 X-Forwarded-For is read from its end, where the proxy | |
| 3525 | + // writes. The administrator's own request shows whether that end is | |
| 3526 | + // a CDN or a balancer for everybody here. Cross review of 2.11.8. | |
| 3527 | + $xff_readings = $this->forwarded_chain_readings(); | |
| 3528 | + if ( $xff_readings ) : | |
| 3529 | + ?> | |
| 3530 | + <div id="vigilante-xff-chain-notice" class="notice notice-warning inline" style="margin:10px 0 16px;padding:8px 12px;"> | |
| 3531 | + <p style="margin:0;"> | |
| 3532 | + <?php | |
| 3533 | + printf( | |
| 3534 | + /* translators: 1: last address in the header, the one Vigilant reads, 2: first address in the header, which a visitor can write */ | |
| 3535 | + esc_html__( 'Your own request reaches the site with more than one public address in X-Forwarded-For. Vigilant reads the last one, %1$s, which is the one your proxy added, and not the first one, %2$s, which a visitor can write. If %1$s belongs to a CDN or a load balancer rather than to you, every visitor shares it for rate limiting, login lockouts and the IP lists: choose the header of that CDN in Visitor IP detection, such as CF-Connecting-IP for Cloudflare.', 'vigilante' ), | |
| 3536 | + esc_html( $xff_readings['now'] ), | |
| 3537 | + esc_html( $xff_readings['before'] ) | |
| 3538 | + ); | |
| 3539 | + ?> | |
| 3540 | + </p> | |
| 3541 | + </div> | |
| 3542 | + <?php endif; ?> | |
| 3543 | + | |
| 3311 | 3544 | <h3><?php esc_html_e( 'IP Lists', 'vigilante' ); ?></h3> |
| 3312 | 3545 | <p class="description"> |
| 3313 | 3546 | <?php |
| 3314 | 3547 | printf( |
| @@ -3334,8 +3567,20 @@ | ||
| 3334 | 3567 | </p> |
| 3335 | 3568 | </td> |
| 3336 | 3569 | </tr> |
| 3337 | 3570 | <tr> |
| 3571 | + <th scope="row"><label for="vigilante-f-firewall-trusted-proxies"><?php esc_html_e( 'Trusted proxy IPs', 'vigilante' ); ?></label></th> | |
| 3572 | + <td> | |
| 3573 | + <textarea id="vigilante-f-firewall-trusted-proxies" name="firewall[trusted_proxies]" rows="3" class="large-text code" placeholder="10.0.0.0/8 192.168.1.1" <?php disabled( $vg_main_locked ); ?>><?php echo esc_textarea( implode( "\n", $options['trusted_proxies'] ?? array() ) ); ?></textarea> | |
| 3574 | + <p class="description"> | |
| 3575 | + <?php esc_html_e( 'Only used with a forwarded header selected above. One IP or CIDR range per line: the addresses your proxy or load balancer connects from. The forwarded header is accepted only from these. Left empty, Vigilant accepts it from your own private network, and for Cloudflare from Cloudflare\'s own ranges automatically.', 'vigilante' ); ?> | |
| 3576 | + <?php if ( in_array( $proxy_header, array( 'x-forwarded-for', 'x-real-ip' ), true ) && empty( $options['trusted_proxies'] ) ) : ?> | |
| 3577 | + <br><strong><?php esc_html_e( 'The header above is trusted but no proxy IPs are set. If your proxy or load balancer connects from a public address, add it here, or the header is ignored for safety and every visitor is seen as that proxy.', 'vigilante' ); ?></strong> | |
| 3578 | + <?php endif; ?> | |
| 3579 | + </p> | |
| 3580 | + </td> | |
| 3581 | + </tr> | |
| 3582 | + <tr> | |
| 3338 | 3583 | <th scope="row"><label for="vigilante-f-firewall-ip-whitelist"><?php esc_html_e( 'IP Whitelist', 'vigilante' ); ?></label></th> |
| 3339 | 3584 | <td> |
| 3340 | 3585 | <textarea id="vigilante-f-firewall-ip-whitelist" name="firewall[ip_whitelist]" <?php disabled( $vg_main_locked ); ?> rows="4" class="large-text code" placeholder="192.168.1.50 192.168.1.0/24 192.168.1.*"><?php echo esc_textarea( implode( "\n", $options['ip_whitelist'] ?? array() ) ); ?></textarea> |
| 3341 | 3586 | <p class="description"> |
| @@ -4088,9 +4333,9 @@ | ||
| 4088 | 4333 | ?> |
| 4089 | 4334 | <div class="vigilante-settings-section" id="vigilante-headers-recovery"> |
| 4090 | 4335 | <h2><?php esc_html_e( 'Recover your previous header settings', 'vigilante' ); ?></h2> |
| 4091 | 4336 | <p> |
| 4092 | - <?php esc_html_e( 'Updating to 2.9.8 reset this tab to factory values: the migration replaced the whole section instead of merging into it. Your server kept sending the right headers, because the .htaccess had not been rewritten yet, so Vigilant saved a copy of that file before touching it. These are the settings it found in that copy.', 'vigilante' ); ?> | |
| 4337 | + <?php esc_html_e( 'An earlier update reset this tab to factory values: the migration replaced the whole section instead of merging into it. Your server kept sending the right headers, because the .htaccess had not been rewritten yet, so Vigilant saved a copy of that file before touching it. These are the settings it found in that copy.', 'vigilante' ); ?> | |
| 4093 | 4338 | </p> |
| 4094 | 4339 | <?php if ( $taken ) : ?> |
| 4095 | 4340 | <p class="description"> |
| 4096 | 4341 | <?php |
| @@ -4699,8 +4944,16 @@ | ||
| 4699 | 4944 | <span class="vigilante-method-badge php"><?php esc_html_e( 'PHP', 'vigilante' ); ?></span> |
| 4700 | 4945 | </h2> |
| 4701 | 4946 | <p><?php esc_html_e( 'Limit the number of simultaneous sessions per user.', 'vigilante' ); ?></p> |
| 4702 | 4947 | |
| 4948 | + <?php if ( Vigilante_User_Security::session_limit_is_network_wide() ) : ?> | |
| 4949 | + <div class="notice notice-warning inline"> | |
| 4950 | + <p> | |
| 4951 | + <?php esc_html_e( 'This limit does not apply on a network. WordPress keeps the sessions of an account for the whole network, not per site, so a limit set here would count and close the sessions that person opened on other sites, including an administrator session elsewhere. A network-wide session policy is planned; until then these settings are saved but not enforced.', 'vigilante' ); ?> | |
| 4952 | + </p> | |
| 4953 | + </div> | |
| 4954 | + <?php endif; ?> | |
| 4955 | + | |
| 4703 | 4956 | <table class="form-table"> |
| 4704 | 4957 | <tr> |
| 4705 | 4958 | <th scope="row"><?php esc_html_e( 'Enable Session Limits', 'vigilante' ); ?></th> |
| 4706 | 4959 | <td> |
| @@ -5040,9 +5293,17 @@ | ||
| 5040 | 5293 | </div> |
| 5041 | 5294 | |
| 5042 | 5295 | <!-- Pending Registrations --> |
| 5043 | 5296 | <?php |
| 5044 | - $user_security = new Vigilante_User_Security( $this->settings, $this->activity_log ); | |
| 5297 | + // Enforcement-only: this instance exists to read the queue, and the | |
| 5298 | + // flag keeps it from registering the module's own hooks a second | |
| 5299 | + // time. It is not inert, and saying it was would be a false comment: | |
| 5300 | + // init_enforcement_hooks() does add its three filters again, on top | |
| 5301 | + // of the ones already registered. They are idempotent (the same | |
| 5302 | + // methods of an equivalent instance, deciding on the same user meta), | |
| 5303 | + // so running them twice in an admin request changes nothing, which is | |
| 5304 | + // why this is accepted rather than worked around. | |
| 5305 | + $user_security = new Vigilante_User_Security( $this->settings, $this->activity_log, true ); | |
| 5045 | 5306 | $pending_users = $user_security->get_pending_users(); |
| 5046 | 5307 | ?> |
| 5047 | 5308 | <div id="vigilante-section-users-pending" class="vigilante-tool-box vigilante-pending-users-section"> |
| 5048 | 5309 | <h3> |
| @@ -5051,9 +5312,20 @@ | ||
| 5051 | 5312 | <span class="vigilante-badge vigilante-badge-warning"><?php echo esc_html( count( $pending_users ) ); ?></span> |
| 5052 | 5313 | <?php endif; ?> |
| 5053 | 5314 | </h3> |
| 5054 | 5315 | |
| 5055 | - <?php if ( empty( $registration['enabled'] ) ) : ?> | |
| 5316 | + <?php | |
| 5317 | + /* | |
| 5318 | + * The queue is shown whenever there is somebody in it, even with | |
| 5319 | + * the feature off. Since 2.11.10 an account already waiting stays | |
| 5320 | + * blocked when the feature is switched off, which is the point: | |
| 5321 | + * turning a setting off must not quietly let in people an | |
| 5322 | + * administrator decided not to approve. But hiding the table then | |
| 5323 | + * left them locked out with no button anywhere to approve or | |
| 5324 | + * reject them. Found by the cross review of 2.11.10. | |
| 5325 | + */ | |
| 5326 | + ?> | |
| 5327 | + <?php if ( empty( $registration['enabled'] ) && empty( $pending_users ) ) : ?> | |
| 5056 | 5328 | <p class="description"> |
| 5057 | 5329 | <span class="dashicons dashicons-info" style="color: #72aee6;"></span> |
| 5058 | 5330 | <?php esc_html_e( 'Registration approval is disabled. Enable it in the settings above to require manual approval for new users.', 'vigilante' ); ?> |
| 5059 | 5331 | </p> |
| @@ -5062,8 +5334,9 @@ | ||
| 5062 | 5334 | <span class="dashicons dashicons-yes-alt"></span> |
| 5063 | 5335 | <p><?php esc_html_e( 'No pending registrations.', 'vigilante' ); ?></p> |
| 5064 | 5336 | </div> |
| 5065 | 5337 | <?php else : ?> |
| 5338 | + <?php $this->render_user_actions_notice(); ?> | |
| 5066 | 5339 | <table class="wp-list-table widefat fixed striped vigilante-pending-users-table"> |
| 5067 | 5340 | <thead> |
| 5068 | 5341 | <tr> |
| 5069 | 5342 | <th><?php esc_html_e( 'User', 'vigilante' ); ?></th> |
| @@ -5073,9 +5346,9 @@ | ||
| 5073 | 5346 | </tr> |
| 5074 | 5347 | </thead> |
| 5075 | 5348 | <tbody> |
| 5076 | 5349 | <?php foreach ( $pending_users as $pending_user ) : |
| 5077 | - $pending_since = get_user_meta( $pending_user->ID, 'vigilante_pending_since', true ); | |
| 5350 | + $pending_since = get_user_meta( $pending_user->ID, Vigilante_User_Security::site_user_meta_key( 'vigilante_pending_since' ), true ); | |
| 5078 | 5351 | ?> |
| 5079 | 5352 | <tr data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>"> |
| 5080 | 5353 | <td> |
| 5081 | 5354 | <?php echo get_avatar( $pending_user->ID, 32 ); ?> |
| @@ -5092,12 +5365,12 @@ | ||
| 5092 | 5365 | } |
| 5093 | 5366 | ?> |
| 5094 | 5367 | </td> |
| 5095 | 5368 | <td> |
| 5096 | - <button type="button" class="button button-small vigilante-approve-user" data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>"> | |
| 5369 | + <button type="button" class="button button-small vigilante-approve-user" data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>" <?php disabled( $this->user_actions_locked() ); ?>> | |
| 5097 | 5370 | <?php esc_html_e( 'Approve', 'vigilante' ); ?> |
| 5098 | 5371 | </button> |
| 5099 | - <button type="button" class="button button-small vigilante-reject-user" data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>" style="color: #d63638;"> | |
| 5372 | + <button type="button" class="button button-small vigilante-reject-user" data-user-id="<?php echo esc_attr( $pending_user->ID ); ?>" style="color: #d63638;" <?php disabled( $this->user_actions_locked() ); ?>> | |
| 5100 | 5373 | <?php esc_html_e( 'Reject', 'vigilante' ); ?> |
| 5101 | 5374 | </button> |
| 5102 | 5375 | </td> |
| 5103 | 5376 | </tr> |
| @@ -5991,8 +6264,13 @@ | ||
| 5991 | 6264 | */ |
| 5992 | 6265 | private function render_tab_file_integrity() { |
| 5993 | 6266 | $is_disabled = $this->render_module_disabled_notice( 'file_integrity' ); |
| 5994 | 6267 | $options = $this->settings->get_section( 'file_integrity' ); |
| 6268 | + // On the main site of a network the critical-file scan is the network's | |
| 6269 | + // canary for a change to wp-config.php or the root .htaccess, so a | |
| 6270 | + // main-site admin without network rights cannot turn it off. Since | |
| 6271 | + // 2.11.8; see Vigilante_Settings::get_main_site_file_settings(). | |
| 6272 | + $vg_main_locked = $this->main_site_files_locked(); | |
| 5995 | 6273 | $last_scan = get_option( 'vigilante_last_integrity_scan' ); |
| 5996 | 6274 | $last_results = get_option( 'vigilante_last_integrity_results' ); |
| 5997 | 6275 | $ignored_files = get_option( 'vigilante_ignored_files', array() ); |
| 5998 | 6276 | |
| @@ -6118,10 +6396,13 @@ | ||
| 6118 | 6396 | <?php esc_html_e( 'Uploads directory (detect PHP files, double extensions, .htaccess)', 'vigilante' ); ?> |
| 6119 | 6397 | </label> |
| 6120 | 6398 | <br> |
| 6121 | 6399 | <label> |
| 6122 | - <input type="checkbox" name="file_integrity[scan_critical_config]" value="1" <?php checked( $options['scan_critical_config'] ?? true ); ?>> | |
| 6400 | + <input type="checkbox" name="file_integrity[scan_critical_config]" value="1" <?php disabled( $vg_main_locked ); ?> <?php checked( $options['scan_critical_config'] ?? true ); ?>> | |
| 6123 | 6401 | <?php esc_html_e( 'Critical config files (wp-config.php, .htaccess baseline monitoring)', 'vigilante' ); ?> |
| 6402 | + <?php if ( $vg_main_locked ) : ?> | |
| 6403 | + <span class="description" style="display:block;margin-left:24px;"><?php echo esc_html( Vigilante_Settings::get_shared_files_notice() ); ?></span> | |
| 6404 | + <?php endif; ?> | |
| 6124 | 6405 | </label> |
| 6125 | 6406 | <br> |
| 6126 | 6407 | <label> |
| 6127 | 6408 | <input type="checkbox" name="file_integrity[check_closed_plugins]" value="1" <?php checked( $options['check_closed_plugins'] ?? true ); ?>> |
| @@ -6400,9 +6681,15 @@ | ||
| 6400 | 6681 | $crit_diff = $crit_item['diff'] ?? array(); |
| 6401 | 6682 | $crit_id = sanitize_html_class( $crit_file ); |
| 6402 | 6683 | $added_count = is_array( $crit_diff ) ? count( $crit_diff['added'] ?? array() ) : 0; |
| 6403 | 6684 | $removed_count = is_array( $crit_diff ) ? count( $crit_diff['removed'] ?? array() ) : 0; |
| 6404 | - $diff_unavailable = is_array( $crit_diff ) && ! empty( $crit_diff['unavailable'] ); | |
| 6685 | + // The lines of a shared file are for whoever approves it. Results | |
| 6686 | + // stored before 2.11.8 on the main site still carry them, so the | |
| 6687 | + // screen asks too, not only the scan that wrote them. | |
| 6688 | + $diff_network = ( is_array( $crit_diff ) && ! empty( $crit_diff['network'] ) ) || $this->critical_approval_locked(); | |
| 6689 | + $diff_rescan = is_array( $crit_diff ) && ! empty( $crit_diff['rescan'] ); | |
| 6690 | + $diff_redaction = is_array( $crit_diff ) && ! empty( $crit_diff['redaction'] ); | |
| 6691 | + $diff_unavailable = $diff_network || ( is_array( $crit_diff ) && ! empty( $crit_diff['unavailable'] ) ); | |
| 6405 | 6692 | ?> |
| 6406 | 6693 | <tr> |
| 6407 | 6694 | <td><code style="color: #e36210;"><?php echo esc_html( $crit_file ); ?></code></td> |
| 6408 | 6695 | <td> |
| @@ -6439,10 +6726,22 @@ | ||
| 6439 | 6726 | </tr> |
| 6440 | 6727 | <tr id="vigilante-critical-content-<?php echo esc_attr( $crit_id ); ?>" class="vigilante-critical-content-row" style="display:none;"> |
| 6441 | 6728 | <td colspan="3" style="padding: 0;"> |
| 6442 | 6729 | <div class="vigilante-critical-content" style="max-height: 400px; overflow: auto; background: #fff; padding: 10px; font-size: 12px; line-height: 1.5; font-family: Consolas, Monaco, monospace; border-top: 1px solid #c3c4c7;"> |
| 6443 | - <?php if ( $diff_unavailable ) : ?> | |
| 6730 | + <?php if ( $diff_network ) : ?> | |
| 6444 | 6731 | <p style="color: #50575e; font-style: italic; margin: 0;"> |
| 6732 | + <?php esc_html_e( 'This file belongs to the whole network, so its line changes are only shown to network administrators, on the main site.', 'vigilante' ); ?> | |
| 6733 | + </p> | |
| 6734 | + <?php elseif ( $diff_rescan ) : ?> | |
| 6735 | + <p style="color: #50575e; font-style: italic; margin: 0;"> | |
| 6736 | + <?php esc_html_e( 'Run a new scan to see the line changes of this file.', 'vigilante' ); ?> | |
| 6737 | + </p> | |
| 6738 | + <?php elseif ( $diff_redaction ) : ?> | |
| 6739 | + <p style="color: #50575e; font-style: italic; margin: 0;"> | |
| 6740 | + <?php esc_html_e( 'The line changes of this file are not shown because a value in it could not be hidden safely. The change itself is still detected.', 'vigilante' ); ?> | |
| 6741 | + </p> | |
| 6742 | + <?php elseif ( $diff_unavailable ) : ?> | |
| 6743 | + <p style="color: #50575e; font-style: italic; margin: 0;"> | |
| 6445 | 6744 | <?php esc_html_e( 'Diff not available for this file (baseline was created before diff tracking was added). Approve to enable diff on future changes.', 'vigilante' ); ?> |
| 6446 | 6745 | </p> |
| 6447 | 6746 | <?php elseif ( empty( $crit_diff['added'] ) && empty( $crit_diff['removed'] ) ) : ?> |
| 6448 | 6747 | <p style="color: #50575e; font-style: italic; margin: 0;"> |
| @@ -6797,9 +7096,10 @@ | ||
| 6797 | 7096 | } |
| 6798 | 7097 | } |
| 6799 | 7098 | } |
| 6800 | 7099 | |
| 6801 | - $rejected_ips = array(); | |
| 7100 | + $rejected_ips = array(); | |
| 7101 | + $rejected_proxies = array(); | |
| 6802 | 7102 | |
| 6803 | 7103 | // Handle modules |
| 6804 | 7104 | if ( 'modules' === $section && isset( $data['modules'] ) ) { |
| 6805 | 7105 | if ( ! isset( $saved_options['modules'] ) ) { |
| @@ -6824,9 +7124,9 @@ | ||
| 6824 | 7124 | // went straight into the option. An entry the matcher can never |
| 6825 | 7125 | // match still sits in a security list looking like protection, |
| 6826 | 7126 | // so the ones that cannot match are dropped and reported back |
| 6827 | 7127 | // instead of being stored in silence. |
| 6828 | - $rejected_ips = $this->filter_ip_lists( $section, $processed ); | |
| 7128 | + $rejected_ips = $this->filter_ip_lists( $section, $processed, $rejected_proxies ); | |
| 6829 | 7129 | |
| 6830 | 7130 | // Save the processed section |
| 6831 | 7131 | $saved_options[ $section ] = $processed; |
| 6832 | 7132 | |
| @@ -6902,8 +7202,21 @@ | ||
| 6902 | 7202 | implode( ', ', array_map( 'esc_html', $rejected_ips ) ) |
| 6903 | 7203 | ); |
| 6904 | 7204 | } |
| 6905 | 7205 | |
| 7206 | + if ( ! empty( $rejected_proxies ) ) { | |
| 7207 | + $message .= ' ' . sprintf( | |
| 7208 | + /* translators: %s: comma separated list of the trusted proxy entries that were not saved. */ | |
| 7209 | + _n( | |
| 7210 | + 'A trusted proxy must be an exact IP or a CIDR range, not a wildcard, so this entry was not saved: %s', | |
| 7211 | + 'A trusted proxy must be an exact IP or a CIDR range, not a wildcard, so these entries were not saved: %s', | |
| 7212 | + count( $rejected_proxies ), | |
| 7213 | + 'vigilante' | |
| 7214 | + ), | |
| 7215 | + implode( ', ', array_map( 'esc_html', $rejected_proxies ) ) | |
| 7216 | + ); | |
| 7217 | + } | |
| 7218 | + | |
| 6906 | 7219 | wp_send_json_success( $message ); |
| 6907 | 7220 | } |
| 6908 | 7221 | |
| 6909 | 7222 | /** |
| @@ -6914,9 +7227,21 @@ | ||
| 6914 | 7227 | * @param string $section Section being saved. |
| 6915 | 7228 | * @param array $processed Section data, edited in place. |
| 6916 | 7229 | * @return array Entries that were dropped, for the message back to the user. |
| 6917 | 7230 | */ |
| 6918 | - private function filter_ip_lists( $section, &$processed ) { | |
| 7231 | + private function filter_ip_lists( $section, &$processed, &$rejected_proxies = array() ) { | |
| 7232 | + $rejected_proxies = array(); | |
| 7233 | + | |
| 7234 | + // Trusted proxies feed an identity decision, so only exact addresses and | |
| 7235 | + // CIDR ranges belong there: a wildcard is stripped with its own message, | |
| 7236 | + // never stored looking effective. The matcher ignores it anyway (see | |
| 7237 | + // Vigilante_IP_Utils::in_list_ip_or_cidr), this stops it persisting. | |
| 7238 | + if ( 'firewall' === $section && isset( $processed['trusted_proxies'] ) && is_array( $processed['trusted_proxies'] ) ) { | |
| 7239 | + $split = Vigilante_IP_Utils::split_list_ip_or_cidr( $processed['trusted_proxies'] ); | |
| 7240 | + $processed['trusted_proxies'] = $split['valid']; | |
| 7241 | + $rejected_proxies = $split['rejected']; | |
| 7242 | + } | |
| 7243 | + | |
| 6919 | 7244 | $lists = array( |
| 6920 | 7245 | 'firewall' => array( 'ip_whitelist', 'ip_blacklist' ), |
| 6921 | 7246 | 'login_security' => array( 'ip_whitelist' ), |
| 6922 | 7247 | ); |
| @@ -7594,8 +7919,19 @@ | ||
| 7594 | 7919 | // Save new results |
| 7595 | 7920 | update_option( 'vigilante_last_integrity_scan', time() ); |
| 7596 | 7921 | update_option( 'vigilante_last_integrity_results', $results ); |
| 7597 | 7922 | |
| 7923 | + // On the main site the scan does compute the lines of wp-config.php and | |
| 7924 | + // .htaccess, for the network administrator. Somebody without network | |
| 7925 | + // rights gets the change and its sizes, not the lines. | |
| 7926 | + if ( $this->critical_approval_locked() && ! empty( $results['modified'] ) && is_array( $results['modified'] ) ) { | |
| 7927 | + foreach ( $results['modified'] as $index => $item ) { | |
| 7928 | + if ( is_array( $item ) && 'critical_config' === ( $item['type'] ?? '' ) ) { | |
| 7929 | + $results['modified'][ $index ]['diff'] = Vigilante_File_Integrity::network_only_diff(); | |
| 7930 | + } | |
| 7931 | + } | |
| 7932 | + } | |
| 7933 | + | |
| 7598 | 7934 | wp_send_json_success( array( |
| 7599 | 7935 | 'message' => __( 'Scan completed.', 'vigilante' ), |
| 7600 | 7936 | 'results' => $results, |
| 7601 | 7937 | 'ignored_count' => count( get_option( 'vigilante_ignored_files', array() ) ), |
| @@ -7629,11 +7965,41 @@ | ||
| 7629 | 7965 | if ( ! current_user_can( 'manage_options' ) ) { |
| 7630 | 7966 | wp_send_json_error( __( 'Permission denied.', 'vigilante' ) ); |
| 7631 | 7967 | } |
| 7632 | 7968 | |
| 7969 | + $results = get_option( 'vigilante_last_integrity_results' ); | |
| 7970 | + $scanned_at = get_option( 'vigilante_last_integrity_scan' ); | |
| 7971 | + | |
| 7633 | 7972 | delete_option( 'vigilante_last_integrity_results' ); |
| 7634 | 7973 | delete_option( 'vigilante_last_integrity_scan' ); |
| 7635 | 7974 | |
| 7975 | + /* | |
| 7976 | + * A pending change to wp-config.php or the root .htaccess is closed by | |
| 7977 | + * approving it, which takes the network. Clearing the results was one | |
| 7978 | + * more way to close it without, until the next scan: the ignore list was | |
| 7979 | + * shut in 2.11.8 and this button was left open, found by the cross | |
| 7980 | + * review of 2.11.8. So for somebody who cannot approve, those entries | |
| 7981 | + * stay and everything else goes. | |
| 7982 | + */ | |
| 7983 | + if ( $this->critical_approval_locked() && is_array( $results ) && ! empty( $results['modified'] ) && is_array( $results['modified'] ) ) { | |
| 7984 | + $critical = array_values( | |
| 7985 | + array_filter( | |
| 7986 | + $results['modified'], | |
| 7987 | + function ( $item ) { | |
| 7988 | + return is_array( $item ) && 'critical_config' === ( $item['type'] ?? '' ); | |
| 7989 | + } | |
| 7990 | + ) | |
| 7991 | + ); | |
| 7992 | + | |
| 7993 | + if ( $critical ) { | |
| 7994 | + $results['modified'] = $critical; | |
| 7995 | + $results['suspicious'] = array(); | |
| 7996 | + $results['extra'] = array(); | |
| 7997 | + update_option( 'vigilante_last_integrity_results', $results ); | |
| 7998 | + update_option( 'vigilante_last_integrity_scan', $scanned_at ? $scanned_at : time() ); | |
| 7999 | + } | |
| 8000 | + } | |
| 8001 | + | |
| 7636 | 8002 | if ( $this->database ) { |
| 7637 | 8003 | $this->database->clear_file_hashes(); |
| 7638 | 8004 | } |
| 7639 | 8005 | |
| @@ -7659,8 +8025,14 @@ | ||
| 7659 | 8025 | if ( empty( $file ) ) { |
| 7660 | 8026 | wp_send_json_error( __( 'No file specified.', 'vigilante' ) ); |
| 7661 | 8027 | } |
| 7662 | 8028 | |
| 8029 | + // A change to a shared file is closed by approving it, and approving it | |
| 8030 | + // takes the network. Ignoring it would close the same warning without. | |
| 8031 | + if ( $this->critical_approval_locked() && in_array( $file, array( 'wp-config.php', '.htaccess' ), true ) ) { | |
| 8032 | + wp_send_json_error( $this->critical_approval_notice() ); | |
| 8033 | + } | |
| 8034 | + | |
| 7663 | 8035 | $file_integrity = new Vigilante_File_Integrity( $this->settings, $this->database ); |
| 7664 | 8036 | $file_integrity->ignore_file( $file ); |
| 7665 | 8037 | |
| 7666 | 8038 | // Also remove the file from stored scan results so UI updates |
| @@ -7724,12 +8096,14 @@ | ||
| 7724 | 8096 | if ( ! is_array( $raw_files ) ) { |
| 7725 | 8097 | wp_send_json_error( __( 'Invalid request.', 'vigilante' ) ); |
| 7726 | 8098 | } |
| 7727 | 8099 | |
| 7728 | - $files = array(); | |
| 8100 | + $files = array(); | |
| 8101 | + $shared = $this->critical_approval_locked() ? array( 'wp-config.php', '.htaccess' ) : array(); | |
| 7729 | 8102 | foreach ( $raw_files as $f ) { |
| 7730 | 8103 | $clean = sanitize_text_field( $f ); |
| 7731 | - if ( '' !== $clean ) { | |
| 8104 | + // Same rule as ajax_ignore_file() for the two shared files. | |
| 8105 | + if ( '' !== $clean && ! in_array( $clean, $shared, true ) ) { | |
| 7732 | 8106 | $files[] = $clean; |
| 7733 | 8107 | } |
| 7734 | 8108 | } |
| 7735 | 8109 | |
