| @@ -2,9 +2,9 @@ | ||
| 2 | 2 | /** |
| 3 | 3 | * Plugin Name: Vigilant - 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… |
| 4 | 4 | * Plugin URI: https://servicios.ayudawp.com |
| 5 | 5 | * Description: Complete security solution for WordPress. Firewall, 2FA, security headers, login protection, file integrity monitoring, activity logging and more. |
| 6 | - * Version: 3.0.0 | |
| 6 | + * Version: 3.0.4 | |
| 7 | 7 | * Author: Fernando Tellado |
| 8 | 8 | * Author URI: https://ayudawp.com |
| 9 | 9 | * Text Domain: vigilante |
| 10 | 10 | * Requires at least: 6.2 |
| @@ -23,9 +23,9 @@ | ||
| 23 | 23 | |
| 24 | 24 | /** |
| 25 | 25 | * Plugin constants |
| 26 | 26 | */ |
| 27 | -define( 'VIGILANTE_VERSION', '3.0.0' ); | |
| 27 | +define( 'VIGILANTE_VERSION', '3.0.4' ); | |
| 28 | 28 | define( 'VIGILANTE_PLUGIN_FILE', __FILE__ ); |
| 29 | 29 | define( 'VIGILANTE_PLUGIN_DIR', plugin_dir_path( __FILE__ ) ); |
| 30 | 30 | define( 'VIGILANTE_PLUGIN_URL', plugin_dir_url( __FILE__ ) ); |
| 31 | 31 | define( 'VIGILANTE_PLUGIN_BASENAME', plugin_basename( __FILE__ ) ); |
| @@ -282,8 +282,65 @@ | ||
| 282 | 282 | // Once (2.11.6): the copies of wp-config.php, .htaccess and robots.txt |
| 283 | 283 | // that earlier versions kept in the options table, on this site and, on |
| 284 | 284 | // a network, on every site of it. |
| 285 | 285 | Vigilante_Backup_Manager::maybe_purge_stored_copies(); |
| 286 | + | |
| 287 | + /* | |
| 288 | + * One-time (3.0.1): put back the lists that every version up to 3.0.0 | |
| 289 | + * blanked without being asked. | |
| 290 | + * | |
| 291 | + * Saving any tab wrote array() over every list of that section whose key | |
| 292 | + * the submitted form did not carry, and four of those lists have no | |
| 293 | + * field on any screen, so their key could never be carried. Pressing | |
| 294 | + * Save on the Firewall tab emptied allowed_http_methods; pressing it on | |
| 295 | + * Users emptied insecure_usernames and the roles of registration | |
| 296 | + * approval. Nothing showed, because reading the settings merged the | |
| 297 | + * shipped values over the top of whatever was stored. | |
| 298 | + * | |
| 299 | + * 3.0.1 stops doing that: an empty stored list now means empty, which is | |
| 300 | + * what makes unticking every role work. On a site that had been saved, | |
| 301 | + * an empty allowed_http_methods would make the firewall answer 403 to | |
| 302 | + * every method, the front page included. | |
| 303 | + * | |
| 304 | + * So the key is removed, not filled in: with no key the setting takes | |
| 305 | + * its shipped value again, which is exactly what it was worth before, | |
| 306 | + * and it follows the shipped value if that ever changes. Only these | |
| 307 | + * four, and only when empty. Every other list has a field on screen, so | |
| 308 | + * an empty one was emptied by somebody who meant it, and it is left | |
| 309 | + * alone. Runs once per site, tracked by an option and not a transient. | |
| 310 | + */ | |
| 311 | + if ( ! get_option( 'vigilante_blank_lists_restored' ) ) { | |
| 312 | + $vig_stored = get_option( Vigilante_Settings::OPTION_NAME, array() ); | |
| 313 | + $vig_changed = false; | |
| 314 | + | |
| 315 | + if ( is_array( $vig_stored ) ) { | |
| 316 | + $vig_blanked = array( | |
| 317 | + array( 'firewall', 'allowed_http_methods' ), | |
| 318 | + array( 'user_security', 'insecure_usernames' ), | |
| 319 | + array( 'rest_api_security', 'allowed_public_endpoints' ), | |
| 320 | + array( 'user_security', 'registration_approval', 'affected_roles' ), | |
| 321 | + ); | |
| 322 | + | |
| 323 | + foreach ( $vig_blanked as $vig_path ) { | |
| 324 | + if ( 2 === count( $vig_path ) ) { | |
| 325 | + if ( isset( $vig_stored[ $vig_path[0] ][ $vig_path[1] ] ) && array() === $vig_stored[ $vig_path[0] ][ $vig_path[1] ] ) { | |
| 326 | + unset( $vig_stored[ $vig_path[0] ][ $vig_path[1] ] ); | |
| 327 | + $vig_changed = true; | |
| 328 | + } | |
| 329 | + } elseif ( isset( $vig_stored[ $vig_path[0] ][ $vig_path[1] ][ $vig_path[2] ] ) && array() === $vig_stored[ $vig_path[0] ][ $vig_path[1] ][ $vig_path[2] ] ) { | |
| 330 | + unset( $vig_stored[ $vig_path[0] ][ $vig_path[1] ][ $vig_path[2] ] ); | |
| 331 | + $vig_changed = true; | |
| 332 | + } | |
| 333 | + } | |
| 334 | + } | |
| 335 | + | |
| 336 | + if ( $vig_changed ) { | |
| 337 | + update_option( Vigilante_Settings::OPTION_NAME, $vig_stored ); | |
| 338 | + $this->settings->clear_cache(); | |
| 339 | + } | |
| 340 | + | |
| 341 | + update_option( 'vigilante_blank_lists_restored', 1, false ); | |
| 342 | + } | |
| 286 | 343 | |
| 287 | 344 | // One-time migration (2.9.0): add '.css' to File Integrity's excluded |
| 288 | 345 | // extensions on existing installs. Stylesheets are rewritten so often by |
| 289 | 346 | // themes and optimizer plugins that they were the main post-update false |
