← All changes | includes/class-firewall.php +107 -20 2.11.1 → 3.0.0 View file →

		@@ -93,12 +93,27 @@
93	93	if ( $this->is_ip_whitelisted() ) {
94	94	return;
95	95	}
96	96
97		- // Skip for whitelisted User-Agents (ManageWP, MainWP, etc.)
98		- if ( $this->is_ua_whitelisted() ) {
99		- return;
100		- }
	97	+ /*
	98	+ * The User-Agent whitelist no longer skips the firewall.
	99	+ *
	100	+ * Until 2.11.1 a matching User-Agent returned here, before the IP
	101	+ * blacklist and every request check, so anyone who guessed a
	102	+ * configured substring ("ManageWP", "MainWP") walked past the SQL
	103	+ * injection, script injection, file inclusion, traversal, bot and
	104	+ * HTTP method rules by setting a header they control. A header a
	105	+ * client chooses cannot stand in for an identity. Reported by the
	106	+ * automated security review of wp.org on 9 sep 2026 and fixed in
	107	+ * 2.11.2.
	108	+ *
	109	+ * What the option is actually for is keeping a remote manager from
	110	+ * being turned away as a bot, so that is all it does now: it exempts
	111	+ * the User-Agent rules, resolved further down, and nothing else. The
	112	+ * list is empty by default, so only sites that had configured one were
	113	+ * ever exposed.
	114	+ */
	115	+ $ua_whitelisted = $this->is_ua_whitelisted();
101	116
102	117	// Gather request data first: a block is logged with the address it
103	118	// turned away, and until 2.11.1 the blacklist ran before this, so the
104	119	// entry for a blacklisted IP recorded no address at all.
		@@ -108,10 +123,12 @@
108	123	if ( $this->is_ip_blacklisted() ) {
109	124	$this->block_request( 'ip_blacklisted', __( 'IP address is blacklisted', 'vigilante' ) );
110	125	}
111	126
112		- // Check if User-Agent is blacklisted (after gathering request data)
113		- if ( $this->is_ua_blacklisted() ) {
	127	+ // Check if User-Agent is blacklisted (after gathering request data).
	128	+ // An explicitly whitelisted agent still wins over the blacklist, which
	129	+ // is what an administrator who wrote it there expects.
	130	+ if ( ! $ua_whitelisted && $this->is_ua_blacklisted() ) {
114	131	$this->block_request( 'ua_blacklisted', __( 'User-Agent is blacklisted', 'vigilante' ) );
115	132	}
116	133
117	134	// Run security checks
		@@ -128,9 +145,16 @@
128	145	'block_bad_bots' => 'check_bad_bots',
129	146	'block_empty_user_agent' => 'check_empty_user_agent',
130	147	);
131	148
	149	+ // The rules a whitelisted User-Agent is exempt from, and only these.
	150	+ $ua_rules = array( 'block_bad_bots', 'block_empty_user_agent' );
	151	+
132	152	foreach ( $checks as $option => $method ) {
	153	+ if ( $ua_whitelisted && in_array( $option, $ua_rules, true ) ) {
	154	+ continue;
	155	+ }
	156	+
133	157	if ( ! empty( $this->options[ $option ] ) && method_exists( $this, $method ) ) {
134	158	$result = $this->$method();
135	159	if ( is_string( $result ) ) {
136	160	$this->block_request( $option, $result );
		@@ -991,10 +1015,49 @@
991	1015	return false;
992	1016	}
993	1017
994	1018	/**
	1019	+ * Whether the request is addressed to the REST API itself
	1020	+ *
	1021	+ * The method filter lets the REST API through, and until 2.11.8 it asked
	1022	+ * whether "/wp-json/" appeared anywhere in the address, query string
	1023	+ * included: TRACE /?x=/wp-json/ skipped the filter and reached a page that
	1024	+ * is not the REST API at all. Found by the audit of the firewall for
	1025	+ * 2.11.8. Core routes the pretty REST URLs from the start of the home
	1026	+ * path, directly or through index.php, so the path has to start there.
	1027	+ * The ?rest_route= form never matched the old test and still does not:
	1028	+ * widening the exemption was not the point.
	1029	+ *
	1030	+ * @since 2.11.8
	1031	+ *
	1032	+ * @return bool
	1033	+ */
	1034	+ private function is_rest_api_request() {
	1035	+ /*
	1036	+ * The path is cut by hand, not with wp_parse_url(): with two leading
	1037	+ * slashes that reads "//wp-json/..." as a host, and WordPress still routes
	1038	+ * it to the REST API. And both the home path and the root are accepted,
	1039	+ * for the language folders some multilingual plugins add to home_url().
	1040	+ * Both from the cross review of 2.11.8.
	1041	+ */
	1042	+ $path = preg_replace( '#/{2,}#', '/', (string) preg_replace( '/[?#].*$/s', '', (string) ( $this->request_data['uri_raw'] ?? '' ) ) );
	1043	+ $home = trailingslashit( (string) wp_parse_url( home_url( '/' ), PHP_URL_PATH ) );
	1044	+ $prefix = trim( rest_get_url_prefix(), '/' );
	1045	+
	1046	+ foreach ( array_unique( array( $home, '/' ) ) as $root ) {
	1047	+ foreach ( array( $root . $prefix, $root . 'index.php/' . $prefix ) as $base ) {
	1048	+ if ( $path === $base || 0 === strpos( (string) $path, $base . '/' ) ) {
	1049	+ return true;
	1050	+ }
	1051	+ }
	1052	+ }
	1053	+
	1054	+ return false;
	1055	+ }
	1056	+
	1057	+ /**
995	1058	* Check HTTP method
996		- *
	1059	+ *
997	1060	* Logged-in users with edit capabilities are excluded to ensure
998	1061	* Gutenberg, REST API, and page builders work correctly.
999	1062	*/
1000	1063	private function check_http_method() {
		@@ -1006,10 +1069,9 @@
1006	1069
1007	1070	// Skip for WordPress REST API requests
1008	1071	// The REST API uses PUT, DELETE, PATCH for legitimate operations and has its own
1009	1072	// authentication and authorization layer — no need to filter methods here
1010		- $rest_prefix = rest_get_url_prefix(); // Typically 'wp-json'
1011		- if ( false !== strpos( $this->request_data['uri'], '/' . $rest_prefix . '/' ) ) {
	1073	+ if ( $this->is_rest_api_request() ) {
1012	1074	return;
1013	1075	}
1014	1076
1015	1077	$method = strtoupper( $this->request_data['method'] );
		@@ -1095,11 +1157,12 @@
1095	1157	if ( is_user_logged_in() && current_user_can( 'manage_options' ) ) {
1096	1158	return;
1097	1159	}
1098	1160
1099		- // Allow other modules to opt out — Under Attack mode uses this so that
1100		- // visitors who already passed the JS challenge don't burn the
1101		- // aggressive 30 req/min cap loading a normal page's assets.
	1161	+ // Allow other code to opt out. Under Attack mode used this until 2.11.8
	1162	+ // to exempt visitors who had passed the JS challenge, which exempted a
	1163	+ // bot that solved it once, too; it now raises their limit instead,
	1164	+ // through vigilante_rate_limit_requests below.
1102	1165	if ( apply_filters( 'vigilante_skip_rate_limit', false ) ) {
1103	1166	return;
1104	1167	}
1105	1168
		@@ -1105,8 +1168,21 @@
1105	1168
1106	1169	$ip = $this->get_client_ip();
1107	1170	$rate_limit = $this->options['rate_limiting'];
1108	1171
	1172	+ /*
	1173	+ * What the count and the block are kept under: the address, unless a
	1174	+ * filter narrows it. Under Attack mode gives visitors who passed its
	1175	+ * challenge a count of their own, because counting them with everybody
	1176	+ * else at their address let one unverified client behind the same NAT
	1177	+ * lock them out for fifteen minutes with its own block. Found by the
	1178	+ * cross review of 2.11.8, the same shape as the challenge nonce the
	1179	+ * automated review reported on 2.11.7.
	1180	+ */
	1181	+ $key = (string) apply_filters( 'vigilante_rate_limit_key', $ip );
	1182	+ $key = '' !== $key ? $key : $ip;
	1183	+ $hash = md5( $key );
	1184	+
1109	1185	// Check if already blocked (fast path). The active block lives in a
1110	1186	// transient keyed by IP, so this path, which runs on every
1111	1187	// unauthenticated request, reads one row and not the whole index of
1112	1188	// blocked addresses. Until 2.11.0 it loaded vigilante_firewall_blocks
		@@ -1112,9 +1188,9 @@
1112	1188	// blocked addresses. Until 2.11.0 it loaded vigilante_firewall_blocks
1113	1189	// entire, an array with no upper bound that a distributed attack grew
1114	1190	// by one entry per new address, so the firewall amplified the attack it
1115	1191	// was blocking (S6). The transient expires with the block itself.
1116		- $block = get_transient( 'vigilante_rate_block_' . md5( $ip ) );
	1192	+ $block = get_transient( 'vigilante_rate_block_' . $hash );
1117	1193	if ( is_array( $block ) && isset( $block['expires'] ) && time() < (int) $block['expires'] ) {
1118	1194	if ( ! headers_sent() ) {
1119	1195	status_header( 429 );
1120	1196	nocache_headers();
		@@ -1140,9 +1216,9 @@
1140	1216	// silence". A logged-in editor publishing several posts in a row could
1141	1217	// pile up 150+ requests while never exceeding 60 in any single minute,
1142	1218	// and got a 429. Storing the window start makes the reset explicit
1143	1219	// instead of relying on the transient expiring.
1144		- $transient_key = 'vigilante_rate_' . md5( $ip );
	1220	+ $transient_key = 'vigilante_rate_' . $hash;
1145	1221	$window = get_transient( $transient_key );
1146	1222	$now = time();
1147	1223
1148	1224	// Counts stored before 2.9.5 were a bare integer with no window start.
		@@ -1176,9 +1252,9 @@
1176	1252	$strikes = 1;
1177	1253
1178	1254	// Progressive blocking: double duration on each repeat offense
1179	1255	if ( ! empty( $rate_limit['progressive'] ) ) {
1180		- $strikes_key = 'vigilante_strikes_' . md5( $ip );
	1256	+ $strikes_key = 'vigilante_strikes_' . $hash;
1181	1257	$strikes = absint( get_transient( $strikes_key ) ) + 1;
1182	1258
1183	1259	$max_duration = absint( $rate_limit['max_block_duration'] ?? 86400 );
1184	1260	$duration = min(
		@@ -1195,12 +1271,13 @@
1195	1271	'blocked_at' => time(),
1196	1272	'duration' => $duration,
1197	1273	'reason' => 'rate_limit',
1198	1274	'strikes' => $strikes,
	1275	+ 'key' => $key,
1199	1276	);
1200	1277
1201	1278	// The block itself, read by the fast path above on every request.
1202		- set_transient( 'vigilante_rate_block_' . md5( $ip ), $block, $duration );
	1279	+ set_transient( 'vigilante_rate_block_' . $hash, $block, $duration );
1203	1280
1204	1281	// The bounded index the admin screen lists.
1205	1282	self::index_block( $ip, $block );
1206	1283
		@@ -1453,16 +1530,26 @@
1453	1530	if ( ! isset( $blocks[ $ip ] ) ) {
1454	1531	return false;
1455	1532	}
1456	1533
	1534	+ // The address, and the narrower key the block was kept under, if any
	1535	+ // (a verified visitor of Under Attack mode, since 2.11.8).
	1536	+ $keys = array( $ip );
	1537	+
	1538	+ if ( is_array( $blocks[ $ip ] ) && ! empty( $blocks[ $ip ]['key'] ) && is_string( $blocks[ $ip ]['key'] ) ) {
	1539	+ $keys[] = $blocks[ $ip ]['key'];
	1540	+ }
	1541	+
1457	1542	unset( $blocks[ $ip ] );
1458	1543	update_option( 'vigilante_firewall_blocks', $blocks, false );
1459	1544
1460	1545	// Clean related transients
1461		- $hash = md5( $ip );
1462		- delete_transient( 'vigilante_rate_block_' . $hash );
1463		- delete_transient( 'vigilante_rate_' . $hash );
1464		- delete_transient( 'vigilante_strikes_' . $hash );
	1546	+ foreach ( array_unique( $keys ) as $key ) {
	1547	+ $hash = md5( $key );
	1548	+ delete_transient( 'vigilante_rate_block_' . $hash );
	1549	+ delete_transient( 'vigilante_rate_' . $hash );
	1550	+ delete_transient( 'vigilante_strikes_' . $hash );
	1551	+ }
1465	1552
1466	1553	return true;
1467	1554	}
1468	1555	}