Changeset 3115542

Timestamp:

07/10/2024 11:18:49 AM (2 weeks ago)

Author:

johndarrel

Message:

Update the Security Check to Fix basic security issues

Location:

hide-my-wp/tags/5.2.04

Files:

• controllers/SecurityCheck.php (modified) (12 diffs)
• models/Settings.php (modified) (1 diff)
• view/SecurityCheck.php (modified) (2 diffs)

hide-my-wp/tags/5.2.04/controllers/SecurityCheck.php

@@ -227 +227 @@
                 'message' => __("Every good developer should turn on debugging before getting started on a new plugin or theme. In fact, the WordPress Codex 'highly recommends' that developers use WP_DEBUG. <br /><br />Unfortunately, many developers forget the debug mode, even when the website is live. Showing debug logs in the frontend will let hackers know a lot about your WordPress website.", 'hide-my-wp'),
                 'solution' => __("Disable WP_DEBUG for live websites in wp-config.php <code>define('WP_DEBUG', false);</code>", 'hide-my-wp'),
-                'javascript' => "pro",
+                'javascript' => "",
             ),
             'checkDBDebug' => array(
@@ -245 +245 @@
                 'message' => __("Every good developer should turn on debugging before getting started on a new plugin or theme. In fact, the WordPress Codex 'highly recommends' that developers use SCRIPT_DEBUG. Unfortunately, many developers forget the debug mode even when the website is live. Showing debug logs in the frontend will let hackers know a lot about your WordPress website.", 'hide-my-wp'),
                 'solution' => __("Disable SCRIPT_DEBUG for live websites in wp-config.php <code>define('SCRIPT_DEBUG', false);</code>", 'hide-my-wp'),
-                'javascript' => "pro",
+                'javascript' => "",
             ),
             'checkDisplayErrors' => array(
@@ -423 +423 @@
                 'message' => __( "The most common way to hack a website is by accessing the domain and adding harmful queries in order to reveal information from files and database.<br /> These attacks are made on any website, WordPress or not, and if a call succeeds … it will probably be too late to save the website.", 'hide-my-wp' ),
                 'solution' => sprintf( esc_html__( "Activate the firewall and select the firewall strength that works for your website %s %s > Change Paths > Firewall & Headers %s", 'hide-my-wp' ), '<a href="'.HMWP_Classes_Tools::getSettingsUrl('hmwp_permalinks#tab=firewall').'" >',  HMWP_Classes_Tools::getOption('hmwp_plugin_menu') , '</a>'),
-                'javascript' => "pro",
+                'javascript' => "",
             ),
             'checkVersionDisplayed' => array(
@@ -432 +432 @@
                 'message' => __("WordPress, plugins and themes add their version info to the source code, so anyone can see it. <br /><br />Hackers can easily find a website with vulnerable version plugins or themes, and target these with Zero-Day Exploits.", 'hide-my-wp'),
                 'solution' => sprintf(esc_html__("Switch on %s %s > Tweaks > %s %s", 'hide-my-wp'), '<a href="'.HMWP_Classes_Tools::getSettingsUrl('hmwp_tweaks#tab=hide').'" >', HMWP_Classes_Tools::getOption('hmwp_plugin_menu'),  esc_html__('Hide Versions from Images, CSS and JS', 'hide-my-wp'), '</a>'),
-                'javascript' => "pro",
+                'javascript' => "",
             ),
             'checkRegisterGlobals' => array(
@@ -473 +473 @@
                 'message' => __("The plugins and themes file editor is a very convenient tool because it enables you to make quick changes without the need to use FTP. <br /><br />Unfortunately, it's also a security issue because it not only shows the PHP source code, it also enables attackers to inject malicious code into your site if they manage to gain access to admin.", 'hide-my-wp'),
                 'solution' => __("Disable DISALLOW_FILE_EDIT for live websites in wp-config.php <code>define('DISALLOW_FILE_EDIT', true);</code>", 'hide-my-wp'),
-                'javascript' => "pro",
+                'javascript' => "",
             ),
             'checkUploadsBrowsable' => array(
@@ -491 +491 @@
                 'message' => esc_html__("If you're not using Windows Live Writer there's really no valid reason to have its link in the page header, because this tells the whole world you're using WordPress.", 'hide-my-wp'),
                 'solution' => sprintf(esc_html__("Switch on %s %s > Tweaks > Hide WLW Manifest scripts%s", 'hide-my-wp'), '<a href="'.HMWP_Classes_Tools::getSettingsUrl('hmwp_tweaks#tab=hide').'" >', HMWP_Classes_Tools::getOption('hmwp_plugin_menu'), '</a>'),
-                'javascript' => "pro",
+                'javascript' => "",
             ),
             'checkXmlrpc' => array(
@@ -500 +500 @@
                 'message' => __("WordPress XML-RPC is a specification that aims to standardize communications between different systems. It uses HTTP as the transport mechanism and XML as encoding mechanism to enable a wide range of data to be transmitted. <br /><br />The two biggest assets of the API are its extendibility and its security. XML-RPC authenticates using basic authentication. It sends the username and password with each request, which is a big no-no in security circles.", 'hide-my-wp'),
                 'solution' => sprintf(esc_html__("Switch on %s %s > Change Paths > Disable XML-RPC access%s", 'hide-my-wp'), '<a href="'.HMWP_Classes_Tools::getSettingsUrl('hmwp_permalinks#tab=api').'" >', HMWP_Classes_Tools::getOption('hmwp_plugin_menu'), '</a>'),
-                'javascript' => "pro",
+                'javascript' => "",
             ),
             'checkRDS' => array(
@@ -509 +509 @@
                 'message' => __("If you're not using any Really Simple Discovery services such as pingbacks, there's no need to advertise that endpoint (link) in the header. Please note that for most sites this is not a security issue because they \"want to be discovered\", but if you want to hide the fact that you're using WP, this is the way to go.", 'hide-my-wp'),
                 'solution' => sprintf(esc_html__("Switch on %s %s > Change Paths > Hide RSD Endpoint%s", 'hide-my-wp'), '<a href="'.HMWP_Classes_Tools::getSettingsUrl('hmwp_permalinks#tab=api').'" >', HMWP_Classes_Tools::getOption('hmwp_plugin_menu'), '</a>'),
-                'javascript' => "pro",
+                'javascript' => "",
             ),
 //            'checkMysqlPermissions' => array(
@@ -526 +526 @@
                 'message' => __("Usernames (unlike passwords) are not secret. By knowing someone's username, you can't log in to their account. You also need the password. <br /><br />However, by knowing the username, you are one step closer to logging in using the username to brute-force the password, or to gain access in a similar way. <br /><br />That's why it's advisable to keep the list of usernames private, at least to some degree. By default, by accessing siteurl.com/?author={id} and looping through IDs from 1 you can get a list of usernames, because WP will redirect you to siteurl.com/author/user/ if the ID exists in the system.", 'hide-my-wp'),
                 'solution' => sprintf(esc_html__("Switch on %s %s > Change Paths > Hide Author ID URL%s", 'hide-my-wp'), '<a href="'.HMWP_Classes_Tools::getSettingsUrl('hmwp_permalinks#tab=author').'" >', HMWP_Classes_Tools::getOption('hmwp_plugin_menu'), '</a>'),
-                'javascript' => "pro",
+                'javascript' => "",
             ),
             'checkBlogDescription' => array(
@@ -670 +670 @@
                     $message[] = esc_html__('Great! The new paths are loading correctly.', 'hide-my-wp');
                     if(HMWP_Classes_Tools::getOption('prevent_slow_loading')){
-                        $message[] = '<a href="' . esc_url(HMWP_Classes_Tools::getSettingsUrl('hmwp_advanced#tab=rollback', true) ) . '" target="_blank" style="word-break: break-word;line-height: 35px;font-weight: 700;">' . sprintf(esc_html__("You can now turn off '%s' option.", 'hide-my-wp'), __('Prevent Broken Website Layout', 'hide-my-wp')) . '</a>';
+                        $message[] =  '<form id="hmwp_fixsettings_form" method="POST">
+                                         '.wp_nonce_field('hmwp_fixsettings', 'hmwp_nonce', false, false).'
+                                         <input type="hidden" name="action" value="hmwp_fixsettings"/>
+                                         
+                                         <div class="col-sm-12 p-0 my-2 switch switch-xxs" style="font-size: 0.9rem;">
+                                            <input type="checkbox" id="prevent_slow_loading" name="prevent_slow_loading" onChange="jQuery(this).hmwp_fixSettings(\'prevent_slow_loading\',0);" class="switch" '. (HMWP_Classes_Tools::getOption('prevent_slow_loading') ? 'checked="checked"' : '') .' value="1"/>
+                                            <label for="prevent_slow_loading">'.sprintf(esc_html__("You can now turn off '%s' option.", 'hide-my-wp'), __('Prevent Broken Website Layout', 'hide-my-wp')).'</label>
+                                         </div>
+                                       </form>';
                     }
                     wp_send_json_success(join('<br />', $message));
@@ -678 +686 @@
 
             case 'hmwp_fixsettings':
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
             case 'hmwp_fixconfig':
 
-                wp_send_json_error(esc_html__('Could not fix it. You need to change it manually.', 'hide-my-wp'));
+                $name = HMWP_Classes_Tools::getValue('name');
+                $value = HMWP_Classes_Tools::getValue('value', null);
+
+                if (!in_array($name, array('WP_DEBUG', 'SCRIPT_DEBUG', 'DISALLOW_FILE_EDIT')) || !in_array($value, array('true', 'false')) ) {
+
+                    if(HMWP_Classes_Tools::isAjax()) {
+                        wp_send_json_error(esc_html__('Could not fix it. You need to change it manually.', 'hide-my-wp'));
+                    }
                     break;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
             case 'hmwp_securityexclude':
@@ -860 +951 @@
                 return array(
                     'value' => $wp_version,
-                    'valid' => version_compare($wp_version, $wp_lastversion, '=='),
+                    'valid' => version_compare($wp_version, $wp_lastversion, '='),
                     'version' => $wp_lastversion,
                 );

hide-my-wp/tags/5.2.04/models/Settings.php

@@ -277 +277 @@
             return;
         }
-
 
         //INSERT SEURITY RULES

hide-my-wp/tags/5.2.04/view/SecurityCheck.php

@@ -134 +134 @@
                                                 <button class="btn btn-default rounded-0 px-3 float-right m-1" type="button" onclick="jQuery('#hmwp_securitydetail<?php echo esc_attr($index) ?>').modal('show');" ><?php echo esc_html__('Info', 'hide-my-wp') ?></button>
                                                 <?php
-                                                if (!$row['valid'] && isset($row['javascript']) && $row['javascript'] <> '' ){
-                                                    ?> <button type="button" class="btn btn-warning mx-0 my-1 rounded-0 float-right  m-1" onclick="jQuery('#hmwp_ghost_mode_modal').modal('show')"><?php echo esc_html__('PRO', 'hide-my-wp') ?></button> <?php
+                                                if (!$row['valid'] && isset($row['javascript'])){
+                                                    if($row['javascript'] <> 'pro'){
+                                                        ?> <button type="button" id="fix<?php echo esc_attr($index) ?>" class="btn btn-success mx-0 my-1 rounded-0 float-right  m-1" onclick="<?php echo esc_attr($row['javascript']) ?>"><?php echo esc_html__('Fix it', 'hide-my-wp') ?></button> <?php
+                                                    }else{
+                                                        ?> <button type="button" class="btn btn-warning mx-0 my-1 rounded-0 float-right  m-1" onclick="jQuery('#hmwp_ghost_mode_modal').modal('show')"><?php echo esc_html__('PRO', 'hide-my-wp') ?></button> <?php
+                                                    }
                                                 }
                                                 ?>
@@ -156 +160 @@
                             <?php } ?>
                         </div>
+
+
+
+
+
+
+
+
                         <div class="col-sm-12 text-right">
                             <form id="hmwp_resetexclude" method="POST">