Skip to content

Commit 9a57bee

Browse files
JulioPotierJulioPotier
committed
v2.2.5.2
1 parent 50d0368 commit 9a57bee

File tree

10 files changed

+320
-262
lines changed

10 files changed

+320
-262
lines changed

‎defines.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
defined( 'ABSPATH' ) or die( 'Something went wrong.' );
33

4-
define( 'SECUPRESS_VERSION' , '2.2.5.1' );
4+
define( 'SECUPRESS_VERSION' , '2.2.5.2' );
55
define( 'SECUPRESS_MAJOR_VERSION' , '2.2' );
66
define( 'SECUPRESS_PATH' , realpath( dirname( SECUPRESS_FILE ) ) . DIRECTORY_SEPARATOR );
77
define( 'SECUPRESS_INC_PATH' , SECUPRESS_PATH . 'free' . DIRECTORY_SEPARATOR );

‎free/functions/common.php

+8-6
Original file line numberDiff line numberDiff line change
@@ -1216,17 +1216,19 @@ function secupress_is_affected_role( $module, $submodule, $user ) {
12161216
/**
12171217
* This will be used with the filter hook 'nonce_user_logged_out' to create nonces for disconnected users.
12181218
*
1219+
* @since 2.2.5.2 hash( 'crc32b' )
1220+
* @author Julio Potier
1221+
*
12191222
* @since 1.0
1220-
*
1223+
* @author Grégory Viguier
1224+
*
12211225
* @param (int) $uid A userID.
1226+
* @param (string) $action The action.
12221227
*
12231228
* @return (int)
12241229
*/
1225-
function secupress_modify_userid_for_nonces( $uid ) {
1226-
if ( $uid ) {
1227-
return $uid;
1228-
}
1229-
return isset( $_GET['userid'] ) ? (int) $_GET['userid'] : 0;
1230+
function secupress_modify_userid_for_nonces( $uid = 0, $action = '' ) {
1231+
return hash( 'crc32b', $uid . $action . secupress_get_ip() );
12301232
}
12311233

12321234

‎free/modules/sensitive-data/plugins/blackhole.php

+30-25
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,11 @@
99

1010
defined( 'SECUPRESS_VERSION' ) or die( 'Something went wrong.' );
1111

12-
1312
add_filter( 'robots_txt', 'secupress_blackhole_robots_txt' );
1413
/**
1514
* Add forbidden URI in `robots.txt` file.
1615
*
16+
* @author Grégory Viguier
1717
* @since 1.0
1818
*
1919
* @param (string) $output File content.
@@ -41,7 +41,11 @@ function secupress_blackhole_robots_txt( $output ) {
4141
/**
4242
* Use a custom template for our trap.
4343
*
44+
* @since 2.2.5.2 Manage the ban from here with a nonce now
45+
* @author Julio Potier
46+
*
4447
* @since 1.0
48+
* @author Grégory Viguier
4549
*
4650
* @param (string) $template Template path.
4751
*
@@ -55,48 +59,49 @@ function secupress_blackhole_please_click_me( $template ) {
5559
$url = trailingslashit( secupress_get_current_url() );
5660
$dirname = secupress_get_hashed_folder_name( 'blackhole' );
5761

62+
if ( isset( $_GET['token'] ) && wp_verify_nonce( $_GET['token'], 'ban_me_please-' . date( 'ymdhi' ) ) ) {
63+
$ip = secupress_get_ip();
64+
$ban_ips = get_site_option( SECUPRESS_BAN_IP );
65+
66+
if ( ! is_array( $ban_ips ) ) {
67+
$ban_ips = array();
68+
}
69+
70+
$ban_ips[ $ip ] = time() + MONTH_IN_SECONDS;
71+
72+
update_site_option( SECUPRESS_BAN_IP, $ban_ips );
73+
74+
/* This hook is documented in /inc/functions/admin.php */
75+
do_action( 'secupress.ban.ip_banned', $ip, $ban_ips );
76+
77+
secupress_log_attack( 'bad_robots' );
78+
79+
wp_die( 'Something went wrong.' ); // Do not use secupress_die() here.
80+
}
81+
82+
add_filter( 'nonce_user_logged_out', 'secupress_modify_userid_for_nonces', 10, 2 );
83+
5884
if ( substr( $url, - strlen( $dirname ) ) === $dirname ) {
5985
return dirname( __FILE__ ) . '/inc/php/blackhole/warning-template.php';
6086
}
6187

6288
return $template;
6389
}
6490

65-
66-
add_action( 'admin_post_nopriv_secupress-ban-me-please', 'secupress_blackhole_ban_ip' );
6791
/**
68-
* Ban an IP address and die.
69-
*
92+
* @since 2.2.5.2 Deprecated
7093
* @since 2.0 use REMOTE_ADDR + do not print anything
71-
* @author Julio Potier
7294
* @since 1.0
7395
*/
7496
function secupress_blackhole_ban_ip() {
75-
if ( secupress_blackhole_is_whitelisted() ) {
76-
return;
77-
}
78-
79-
$ip = secupress_get_ip( 'REMOTE_ADDR' );
80-
$ban_ips = get_site_option( SECUPRESS_BAN_IP );
81-
82-
if ( ! is_array( $ban_ips ) ) {
83-
$ban_ips = array();
84-
}
85-
86-
$ban_ips[ $ip ] = time() + MONTH_IN_SECONDS;
87-
88-
update_site_option( SECUPRESS_BAN_IP, $ban_ips );
89-
90-
/* This hook is documented in /inc/functions/admin.php */
91-
do_action( 'secupress.ban.ip_banned', $ip, $ban_ips );
92-
93-
die();
97+
_deprecated_function( __FUNCTION__, '2.2.5.2' );
9498
}
9599

96100

97101
/**
98102
* Tell if the current user is whitelisted.
99103
*
104+
* @author Grégory Viguier
100105
* @since 1.0
101106
*
102107
* @return (bool) True if whitelisted, false otherwize.

‎free/modules/sensitive-data/plugins/inc/php/blackhole/warning-template.php

+61-7
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,77 @@
11
<?php
2+
/**
3+
* SecuPress Template Name: Warning Template
4+
*
5+
* @since 2.2.5.2 Julio Potier
6+
* @since 1.0 Grégory Viguier
7+
*
8+
* @see secupress_blackhole_please_click_me()
9+
*/
210
defined( 'SECUPRESS_VERSION' ) or die( 'Something went wrong.' );
311

12+
define( 'DONOTCACHEPAGE', true );
13+
14+
$title = __( 'Warning - Deceptive content', 'secupress' );
15+
416
?><!DOCTYPE html>
517
<html <?php language_attributes(); ?>>
618
<head>
719
<meta charset="<?php echo esc_attr( strtolower( get_bloginfo( 'charset' ) ) ); ?>" />
8-
<title><?php esc_html_e( 'STOP', 'secupress' ); ?></title>
20+
<title><?php echo $title; ?></title>
921
<meta content="noindex,nofollow" name="robots" />
1022
<meta content="initial-scale=1.0" name="viewport" />
11-
</head>
12-
<body>
23+
<style>
24+
body {
25+
margin: 0;
26+
padding: 0;
27+
font-family: sans-serif;
28+
background-color: #C44;
29+
display: flex;
30+
justify-content: center;
31+
align-items: center;
32+
height: 50vh;
33+
}
34+
35+
.warning {
36+
text-align: center;
37+
background-color: #fee;
38+
padding: 40px;
39+
border-radius: 12px;
40+
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.4);
41+
}
42+
43+
.warning h1 {
44+
color: #db4437;
45+
margin-bottom: 10px;
46+
}
47+
48+
.warning p {
49+
color: #333;
50+
font-size: 16px;
51+
margin-top: 10px;
52+
line-height: 2em;
53+
}
54+
55+
blink {
56+
animation: blinker-two 1s linear infinite;
57+
}
58+
@keyframes blinker-two {
59+
100% { opacity: 0; }
60+
}
61+
</style>
62+
</head>
63+
<body>
64+
<div class="warning">
65+
<h1><blink><?php echo $title; ?></blink></h1>
1366
<p><?php
1467
printf(
1568
/** Translators: 1 is a file name, 2 is a "click here" link. */
16-
__( 'The aim of this page is to catch robots that don’t respect the rules set in the %1$s file. <strong>Don’t %2$s or you will be banned from this site.</strong>', 'secupress' ),
69+
__( 'The purpose of this page is to detect robots that do not adhere to the rules outlined in the %1$s file.<br><strong>%2$s, or you will be banned from this site.</strong>', 'secupress' ),
1770
'<code>robots.txt</code>',
18-
'<a href="' . esc_url( admin_url( 'admin-post.php?action=secupress-ban-me-please' ) ) . '">' . __( 'click this link', 'secupress' ) . '</a>'
71+
'<a href="' . esc_url( wp_nonce_url( '', 'ban_me_please-' . date( 'ymdhi' ), 'token' ) ) . '">' . __( 'DO NOT CLICK THIS LINK', 'secupress' ) . '</a>'
1972
);
2073
?></p>
21-
</body>
74+
</div>
75+
</body>
2276
</html><?php
23-
die();
77+
die();

‎languages/secupress-de_DE.mo

108 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)