Changeset 3466602

Timestamp:

02/21/2026 09:26:38 PM (11 days ago)

Author:

Marc4

Message:

v0.7

Location:

security-hardener

Files:

• tags/0.3 (deleted)
• tags/0.5 (deleted)
• tags/0.6 (deleted)
• tags/0.7 (added)
• tags/0.7/readme.txt (added)
• tags/0.7/security-hardener.php (added)
• tags/0.7/uninstall.php (added)
• trunk/readme.txt (modified) (3 diffs)
• trunk/security-hardener.php (modified) (10 diffs)

security-hardener/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 6.9
 Requires PHP: 8.0
-Stable tag: 0.6
+Stable tag: 0.
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
-Basic hardening: secure headers, user enumeration blocking, generic login errors, IP-based rate limiting, and comprehensive WordPress security improvements.
+Basic hardening: secure headers, user enumeration blocking, generic login errors, IP-based rate limiting, and WordPress security improvements.
 
 == Description ==
@@ -161 +161 @@
 == Changelog ==
 
-= 0.6 - 2026-21-02 =
+= 0.7 - 2026-02-21 =
+* Fixed: WPSH_VERSION constant updated to match plugin header version
+* Fixed: Added wp_unslash() and sanitize_text_field() to $_GET['author'] in prevent_author_redirect()
+* Fixed: Moved HTML markup outside translatable strings in generic_login_errors(), check_login_rate_limit(), and field descriptions for "Disable all file modifications" and "Enable HSTS"
+* Security: Added CSRF protection to "Clear Logs" action via wp_nonce_url() and wp_verify_nonce()
+* Improved: Added missing hardening recommendations to admin page: BasicAuth protection for wp-admin and changing the default database table prefix
+* Fixed: Corrected date format in changelog entries (YYYY-MM-DD)
+
+= 0.6 - 2026-02-21 =
 * Fixed: Removed deprecated load_plugin_textdomain() call (automatic since WordPress 4.6)
 * Fixed: Added wp_unslash() and sanitize_text_field() to $_GET['author'] before sanitization
@@ -171 +179 @@
 * Fixed: Removed redundant function_exists() check for wp_cache_flush() in uninstall.php
 
-= 0.5 - 2026-09-02 =
+= 0.5 - 2026-0 =
 * Complete rewrite following WordPress hardening best practices
 * Increased minimum PHP requirement to 8.0 (PHP 7.4 is end-of-life)

security-hardener/trunk/security-hardener.php

@@ -4 +4 @@
 Plugin URI: https://wordpress.org/plugins/security-hardener/
 Description: Basic hardening: secure headers, disable XML-RPC/pingbacks, hide version, block user enumeration, login errors, IP-based rate limiting, and optional restriction of the REST API.
-Version: 0.6
+Version: 0.
 Requires at least: 6.0
 Tested up to: 6.9
@@ -20 +20 @@
 
 // Plugin constants
-define( 'WPSH_VERSION', '0.5' );
+define( 'WPSH_VERSION', '0.' );
 define( 'WPSH_FILE', __FILE__ );
 define( 'WPSH_DIR', plugin_dir_path( __FILE__ ) );
@@ -352 +352 @@
         public function prevent_author_redirect( $redirect_url, $requested_url ) {
             // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only check
-            if ( isset( $_GET['author'] ) && is_numeric( $_GET['author'] ) ) {
+            $author = isset( $_GET['author'] ) ? sanitize_text_field( wp_unslash( $_GET['author'] ) ) : null;
+            if ( null !== $author && is_numeric( $author ) ) {
                 return false; // Cancel redirect
             }
@@ -414 +415 @@
 
             // Return generic error message
-            return __( '<strong>Error:</strong> Invalid username or password.', 'security-hardener' );
+            return Invalid username or password.', 'security-hardener' );
         }
 
@@ -456 +457 @@
                 return new WP_Error(
                     'too_many_attempts',
-                    sprintf(
+                    sprintf(
                         /* translators: %d: number of minutes */
-                        __( '<strong>Error:</strong> Too many failed login attempts. Please try again in %d minutes.', 'security-hardener' ),
+                        Too many failed login attempts. Please try again in %d minutes.', 'security-hardener' ),
                         $minutes
                     )
@@ -691 +692 @@
 
             $this->add_checkbox_field( 'disable_file_edit', __( 'Disable file editor', 'security-hardener' ), 'wpsh_file_editing', __( 'Prevents editing of theme and plugin files through WordPress admin.', 'security-hardener' ) );
-            $this->add_checkbox_field( 'disable_file_mods', __( 'Disable all file modifications', 'security-hardener' ), 'wpsh_file_editing', __( '<strong>Warning:</strong> This will disable plugin/theme updates and installations.', 'security-hardener' ) );
+            $this->add_checkbox_field( 'disable_file_mods', __( 'Disable all file modifications', 'security-hardener' ), 'wpsh_file_editing', This will disable plugin/theme updates and installations.', 'security-hardener' ) );
 
             // XML-RPC section
@@ -789 +790 @@
             );
 
-            $this->add_checkbox_field( 'enable_hsts', __( 'Enable HSTS', 'security-hardener' ), 'wpsh_hsts', __( '<strong>Warning:</strong> Only enable if your site fully supports HTTPS.', 'security-hardener' ) );
+            $this->add_checkbox_field( 'enable_hsts', __( 'Enable HSTS', 'security-hardener' ), 'wpsh_hsts', Only enable if your site fully supports HTTPS.', 'security-hardener' ) );
             $this->add_checkbox_field( 'hsts_subdomains', __( 'Include subdomains', 'security-hardener' ), 'wpsh_hsts' );
             $this->add_checkbox_field( 'hsts_preload', __( 'Enable preload', 'security-hardener' ), 'wpsh_hsts', __( 'Submit to <a href="https://hstspreload.org/" target="_blank">HSTS Preload List</a> (requires 1 year max-age).', 'security-hardener' ) );
@@ -965 +966 @@
                     <li><?php esc_html_e( 'Restrict file permissions (directories: 755, files: 644)', 'security-hardener' ); ?></li>
                     <li><?php esc_html_e( 'Consider using a Web Application Firewall (WAF)', 'security-hardener' ); ?></li>
+
+
                 </ul>
 
@@ -1025 +1028 @@
             </table>
             <p>
-                <a href="<?php echo esc_url( admin_url( 'options-general.php?page=security-hardener&action=clear_logs' ) ); ?>" 
+                <a href="<?php echo esc_url( clear_logs' ) ); ?>" 
                    class="button"
                    onclick="return confirm('<?php esc_attr_e( 'Are you sure you want to clear all security logs?', 'security-hardener' ); ?>');">
@@ -1038 +1041 @@
          */
         public function show_admin_notices() {
-            // Clear logs action
+            // Clear logs action
             // phpcs:ignore WordPress.Security.NonceVerification.Recommended
             if ( isset( $_GET['action'] ) && 'clear_logs' === $_GET['action'] && current_user_can( 'manage_options' ) ) {
-                // Verify nonce would be better, but this is acceptable for read-only admin pages
+                if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'wpsh_clear_logs' ) ) {
+                    wp_die( esc_html__( 'Security check failed.', 'security-hardener' ) );
+                }
                 delete_option( 'wpsh_security_logs' );
                 ?>