Skip to content

Commit cdc7820

Browse files
JulioPotierJulioPotier
committed
v2.3.3
1 parent 6b96319 commit cdc7820

27 files changed

+335
-148
lines changed

‎assets/admin/css/secupress-common.css

-3
Original file line numberDiff line numberDiff line change
@@ -1102,9 +1102,6 @@ label.secupress-setting-row-title {
11021102
.fieldtype-radios p {
11031103
line-height: 2.3em;
11041104
}
1105-
.secupress-setting-row em {
1106-
padding-left: 5px;
1107-
}
11081105

11091106
/**
11101107
* === Existing

‎assets/admin/css/secupress-common.min.css

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎assets/admin/css/secupress-scanner.css

+2-2
Original file line numberDiff line numberDiff line change
@@ -358,8 +358,8 @@ li.secupress-current:nth-last-child(1) .secupress-step-name {
358358
}
359359

360360
.secupress-button#secupress-button-scan-speed{
361-
height: 38px;
362-
left: -3px;
361+
height: 39px;
362+
left: -4px;
363363
padding: 0;
364364
top: 0px;
365365
width: 23px;

‎assets/admin/css/secupress-scanner.min.css

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎assets/admin/js/secupress-scanner.js

+48-19
Original file line numberDiff line numberDiff line change
@@ -175,12 +175,28 @@ jQuery( document ).ready( function( $ ) {
175175
};
176176

177177
// Check all checkboxes.
178+
$( '.secupress-sgh-actions .secupress-toggle-check' ).on( 'click', function( e ) {
179+
var $group = $( '#secupress-tests' ),
180+
allChecked = 0 === $group.find( '.secupress-toggle-check' ).filter( ':visible:enabled' ).not( ':checked' ).not( '#secupress-toggle-check-all' ).length;
181+
// Toggle global "check all" checkbox.
182+
var el = $( '#secupress-toggle-check-all' );
183+
if ( el.length )
184+
$( '#secupress-toggle-check-all' ).prop( 'checked', allChecked );
185+
} );
186+
187+
178188
$( '.secupress-sg-content .secupress-row-check' ).on( 'click', function( e ) {
179189
var $group = $( this ).closest( '.secupress-scans-group' ),
180190
allChecked = 0 === $group.find( '.secupress-row-check' ).filter( ':visible:enabled' ).not( ':checked' ).length;
181191

182192
// Toggle "check all" checkboxes.
183193
$group.find( '.secupress-toggle-check' ).prop( 'checked', allChecked );
194+
var $group2 = $( '#secupress-tests' ),
195+
allChecked2 = 0 === $group2.find( '.secupress-toggle-check' ).filter( ':visible:enabled' ).not( ':checked' ).not( '#secupress-toggle-check-all' ).length;
196+
// Toggle global "check all" checkbox.
197+
var el = $( '#secupress-toggle-check-all' );
198+
if ( el.length )
199+
$( '#secupress-toggle-check-all' ).prop( 'checked', allChecked2 );
184200
} )
185201
// If nothing is checked, change the "Fix all checked issues" button into "Ignore this step".
186202
.on( 'change.secupress', function( e ) {
@@ -210,6 +226,14 @@ jQuery( document ).ready( function( $ ) {
210226
$buttons.addClass( 'hidden' );
211227
$buttons.next().removeClass( 'hidden' );
212228
}
229+
var $group = $( '#secupress-tests' ),
230+
allChecked = 0 === $group.find( '.secupress-toggle-check' ).filter( ':visible:enabled' ).not( ':checked' ).not( '#secupress-toggle-check-all' ).length;
231+
// Toggle global "check all" checkbox.
232+
var el = $( '#secupress-toggle-check-all' );
233+
if ( el.length )
234+
$( '#secupress-toggle-check-all' ).prop( 'checked', allChecked );
235+
236+
213237
} )
214238
.first().trigger( 'change.secupress' );
215239

@@ -218,30 +242,35 @@ jQuery( document ).ready( function( $ ) {
218242
$wrap = $this.closest( '.secupress-scans-group' ),
219243
controlChecked = $this.prop( 'checked' ),
220244
toggle = e.shiftKey || $this.data( 'wp-toggle' );
245+
246+
if ( 'secupress-toggle-check-all' === $this.attr('id') ) {
247+
$('[id^="secupress-toggle-check-"]:not(#secupress-toggle-check-all)')
248+
.trigger('click');
249+
} else {
250+
$wrap.children( '.secupress-sg-header' ).find( '.secupress-toggle-check' )
251+
.prop( 'checked', function() {
252+
var $this = $( this );
221253

222-
$wrap.children( '.secupress-sg-header' ).find( '.secupress-toggle-check' )
223-
.prop( 'checked', function() {
224-
var $this = $( this );
225-
226-
if ( $this.is( ':hidden,:disabled' ) ) {
227-
return false;
228-
}
254+
if ( $this.is( ':hidden,:disabled' ) ) {
255+
return false;
256+
}
229257

230-
if ( toggle ) {
231-
return ! $this.prop( 'checked' );
232-
}
258+
if ( toggle ) {
259+
return ! $this.prop( 'checked' );
260+
}
233261

234-
return controlChecked;
235-
} );
262+
return controlChecked;
263+
} );
236264

237-
$wrap.children( '.secupress-sg-content' ).find( '.secupress-row-check' )
238-
.prop( 'checked', function() {
239-
if ( toggle ) {
240-
return false;
241-
}
265+
$wrap.children( '.secupress-sg-content' ).find( '.secupress-row-check' )
266+
.prop( 'checked', function() {
267+
if ( toggle ) {
268+
return false;
269+
}
242270

243-
return controlChecked;
244-
} );
271+
return controlChecked;
272+
} );
273+
}
245274
} );
246275

247276
} )(window, document, $);

‎assets/admin/js/secupress-scanner.min.js

+88-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎defines.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
defined( 'ABSPATH' ) or die( 'Something went wrong.' );
33

4-
define( 'SECUPRESS_VERSION' , '2.3.1' );
4+
define( 'SECUPRESS_VERSION' , '2.3.3' );
55
define( 'SECUPRESS_MAJOR_VERSION' , '2.3' );
66
define( 'SECUPRESS_UPDATE_API_KEY' , 'aHR0cHM6Ly9zZWN1cHJlc3MubWUv' );
77
define( 'SECUPRESS_PATH' , realpath( dirname( SECUPRESS_FILE ) ) . DIRECTORY_SEPARATOR );

‎free/admin/scanner-step-2.php

+19
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,26 @@
117117
</div>
118118

119119
<div id="secupress-tests" class="secupress-tests">
120+
<?php if ( secupress_is_pro() ) { ?>
121+
<div class="secupress-scans-group secupress-group-all">
122+
<div class="secupress-sg-header secupress-flex secupress-flex-spaced">
123+
124+
<div class="secupress-sgh-name">
125+
<i class="secupress-icon-gear" aria-hidden="true"></i>
126+
<p class="secupress-sgh-title">&nbsp;</p>
127+
</div>
128+
129+
<div class="secupress-sgh-actions secupress-flex">
130+
<label class="text hide-if-no-js" for="secupress-toggle-check-all">
131+
<span class="label-before-text"><?php _e( 'Toggle check all', 'secupress' ); ?></span>
132+
<input type="checkbox" id="secupress-toggle-check-all" class="secupress-checkbox secupress-toggle-check" checked="checked"/>
133+
<span class="label-text"></span>
134+
</label>
135+
</div>
136+
</div>
137+
</div>
120138
<?php
139+
}
121140
$modules = secupress_get_modules();
122141

123142
foreach ( $secupress_tests as $module_name => $class_name_parts ) {

‎free/admin/scanner-step-3.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -285,7 +285,7 @@
285285
</span>
286286
<span class="text"><?php _e( 'I did the job, continue', 'secupress' ); ?></span>
287287
</a>
288-
<?php } elseif ( ! $needs_pro ) { ?>
288+
<?php } elseif ( $needs_pro ) { ?>
289289
<a href="<?php echo esc_url( secupress_admin_url( 'get-pro' ) ); ?>" class="secupress-button secupress-button-tertiary secupress-button-getpro shadow" target="_blank" title="<?php esc_attr_e( 'Open in a new window.', 'secupress' ); ?>">
290290
<span class="icon">
291291
<i class="secupress-icon-secupress-simple bold" aria-hidden="true"></i>

‎free/classes/admin/class-secupress-admin-wp-async-request.php

+4-3
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,8 @@
44
*
55
* @package WP-Background-Processing
66
*/
7-
if ( class_exists( 'WP_Async_Request' ) ) {
8-
return;
9-
}
7+
if ( ! class_exists( 'WP_Async_Request' ) ) :
8+
109
/**
1110
* Abstract WP_Async_Request class.
1211
*
@@ -202,3 +201,5 @@ protected function maybe_wp_die( $return = null ) {
202201
*/
203202
abstract protected function handle();
204203
}
204+
205+
endif;

‎free/classes/admin/class-secupress-admin-wp-background-process.php

+4-3
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,8 @@
44
*
55
* @package WP-Background-Processing
66
*/
7-
if ( class_exists( 'WP_Background_Process' ) ) {
8-
return;
9-
}
7+
if ( ! class_exists( 'WP_Background_Process' ) ) :
8+
109
/**
1110
* Abstract WP_Background_Process class.
1211
*
@@ -998,3 +997,5 @@ private function get_chain_id_arg_name() {
998997
return $chain_id_arg_name;
999998
}
1000999
}
1000+
1001+
endif;

‎free/classes/scanners/class-secupress-scan-bad-old-themes.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ public static function get_messages( $message_id = null ) {
7575
103 => _n_noop( 'Sorry, the following theme could not be deleted: %s.', 'Sorry, the following themes could not be deleted: %s.', 'secupress' ),
7676
/** Translators: %s is the theme name. */
7777
104 => sprintf( __( 'You have a big network, %s must work on some data before being able to perform this scan.', 'secupress' ), '<strong>' . SECUPRESS_PLUGIN_NAME . '</strong>' ),
78-
110 => __( 'Your installation may contain old or closed plugins. The PRO version will be more accurate.', 'secupress' ),
78+
110 => sprintf( __( 'Your installation may contain old or closed plugins. The %sPRO version%s will be more accurate.', 'secupress' ), '<a href="' . secupress_admin_url( 'get-pro' ) . '">', '</a>' ),
7979
// "bad"
8080
/** Translators: 1 is a number, 2 is a theme name (or a list of theme names). */
8181
200 => _n_noop( '<strong>%1$d theme</strong> is no longer in the WordPress repository: %2$s.', '<strong>%1$d themes</strong> are no longer in the WordPress repository: %2$s.', 'secupress' ),

‎free/classes/scanners/class-secupress-scan-bad-vuln-plugins.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ public static function get_messages( $message_id = null ) {
8686
104 => __( 'No plugins selected for deactivation.', 'secupress' ),
8787
105 => _n_noop( 'Selected plugin has been deactivated (but some are still there).', 'All selected plugins have been deactivated (but some are still there).', 'secupress' ),
8888
106 => _n_noop( 'Sorry, the following plugin could not be deactivated: %s.', 'Sorry, the following plugins could not be deactivated: %s.', 'secupress' ),
89-
107 => __( 'Your installation may contain vulnerable plugins. The PRO version will be more accurate.', 'secupress' ),
89+
107 => sprintf( __( 'Your installation may contain vulnerable plugins. The %sPRO version%s will be more accurate.', 'secupress' ), '<a href="' . secupress_admin_url( 'get-pro' ) . '">', '</a>' ),
9090
// "bad"
9191
/** Translators: 1 is a number, 2 is a plugin name (or a list of plugin names). */
9292
200 => _n_noop( '<strong>%1$d plugin</strong> is known to be vulnerable: %2$s.', '<strong>%1$d plugins</strong> are known to be vulnerable: %2$s.', 'secupress' ),

‎free/classes/scanners/class-secupress-scan-login-errors-disclose.php

+6-1
Original file line numberDiff line numberDiff line change
@@ -103,8 +103,13 @@ public function scan() {
103103

104104
$messages = secupress_login_errors_disclose_get_messages( false );
105105
$messages = ' ' . implode( "<br />\n ", $messages ) . "<br />\n";
106+
$wp_error = new WP_Error();
107+
$wp_error->add( 'invalid_username', $messages );
106108
/** This filter is documented in wp-login.php */
107-
$messages = apply_filters( 'login_errors', $messages );
109+
$messages = reset( apply_filters( 'login_errors', $wp_error ) );
110+
while ( ! is_string( $messages ) ) {
111+
$messages = reset( $messages );
112+
}
108113

109114
$pattern = secupress_login_errors_disclose_get_messages();
110115
$pattern = '@\s(' . implode( '|', $pattern ) . ')<br />\n@';

‎free/data/bad_url_contents.data

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
AND\%201\=,information\_schema,UNION\%20SELECT,UNION\%20ALL\%20SELECT,ev\'\.\/\*\*\/\'al(,wp\-config\.php,\%\%30\%30,GLOBALS\[,\.ini,REQUEST\[,etc\/passwd,base64\_,javascript\:,\.\.\/,127\.0\.0\.1,input_file,temp00,70bex,configbak,dompdf,filenetworks,jahat,kcrew,keywordspy,mobiquo,nessus,racrew,locus7,bitrix,msoffice,child_terminate,concat,allow_url_fopen,allow_url_include,auto_prepend_file,blexbot,browsersploit,c99,disable_function,document_root,elastix,encodeuricom,fclose,fgets,fputs,fread,fsbuff,fsockopen,gethostbyname,grablogin,hmei7,open_basedir,passthru,popen,proc_open,quickbrute,safe_mode,shell_exec,sux0r,xertive,<script,fopen,.php.inc,mosconfig,mkdir,rmdir,chdir,ckfinder,fullclick,fckeditor,timthumb,absolute_dir,absolute_path,root_dir,root_path,basedir,basepath,loopback,\%00,0x00,\%0d\%0a
1+
AND\%201\=,information\_schema,UNION\%20SELECT,UNION\%20ALL\%20SELECT,ev\'\.\/\*\*\/\'al(,wp\-config\.php,\%\%30\%30,GLOBALS\[,\.ini,REQUEST\[,etc\/passwd,base64\_,javascript\:,\.\.\/,127\.0\.0\.1,input_file,temp00,70bex,configbak,dompdf,filenetworks,jahat,kcrew,keywordspy,mobiquo,nessus,racrew,locus7,bitrix,msoffice,child_terminate,concat,allow_url_fopen,allow_url_include,auto_prepend_file,blexbot,browsersploit,disable_function,document_root,elastix,encodeuricom,fclose,fgets,fputs,fread,fsbuff,fsockopen,gethostbyname,grablogin,hmei7,open_basedir,passthru,popen,proc_open,quickbrute,safe_mode,shell_exec,sux0r,xertive,<script,fopen,.php.inc,mosconfig,mkdir,rmdir,chdir,ckfinder,fullclick,fckeditor,timthumb,absolute_dir,absolute_path,root_dir,root_path,basedir,basepath,loopback,\%00,0x00,\%0d\%0a

‎free/functions/common.php

+1
Original file line numberDiff line numberDiff line change
@@ -1279,6 +1279,7 @@ function secupress_feature_is_pro( $feature ) {
12791279
'bbq-headers_bad-referer-list' => 1,
12801280
'bbq-headers_block-ai' => 1,
12811281
'blacklist-logins_user-creation-protection' => 1,
1282+
'blacklist-logins_bad-email-domains' => 1,
12821283
'bbq-url-content_block-functions' => 1,
12831284
];
12841285

‎free/modules/antispam/settings/antiphishing.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
$this->add_field( array(
99
'title' => __( 'Anti-Phishing User Protection', 'secupress' ),
10-
'description' => __( 'Adds a unique digit code to the user‘s profile, which is included in every email from this website, ensuring authenticity and safeguarding against phishing.', 'secupress' ),
10+
'description' => __( 'Adds a digit code to the user‘s profile, which is included in every email from this website, ensuring authenticity and safeguarding against phishing.', 'secupress' ),
1111
'label' => __( 'Yes, users can set a anti-phishing code in their profile', 'secupress' ),
1212
'name' => $this->get_field_name( 'activated' ),
1313
'type' => 'checkbox',

‎free/modules/discloses/plugins/login-errors-disclose.php

+1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
add_filter( 'authenticate', 'secupress_replace_login_errors_disclose', 21 );
1313
add_filter( 'registration_errors', 'secupress_replace_login_errors_disclose', 1 );
1414
add_filter( 'user_profile_update_errors', 'secupress_replace_login_errors_disclose', 1 );
15+
add_filter( 'login_errors', 'secupress_replace_login_errors_disclose', 1 );
1516
/**
1617
* Replace all login errors with a more generic message.
1718
*

‎free/modules/sensitive-data/plugins/blackhole.php

+2-3
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ function secupress_blackhole_activate_write_robotstxt() {
2121
$filesystem = secupress_get_filesystem();
2222
$filename = ABSPATH . 'robots.txt';
2323

24-
if ( ! file_exists( $filename ) ) { // We do not create it, the hook it enough
24+
if ( ! file_exists( $filename ) ) { // We do not create it, the hook is enough
2525
return;
2626
}
2727
$contents = $filesystem->get_contents( $filename );
@@ -45,11 +45,10 @@ function secupress_blackhole_deactivate_write_robotstxt() {
4545
return;
4646
}
4747
$contents = $filesystem->get_contents( $filename );
48-
$contents = secupress_blackhole_robotstxt_content( $contents, true );
4948
$dirname = secupress_get_hashed_folder_name( basename( __FILE__, '.php' ) );
5049

5150
if ( false !== strpos( $contents, "User-agent: *\nDisallow: $dirname\n" ) ) {
52-
$contents = str_replace( "User-agent: *\nDisallow: $dirname\n", "User-agent: *\n", $output );
51+
$contents = str_replace( "User-agent: *\nDisallow: $dirname\n", "User-agent: *\n", $contents );
5352
$filesystem->put_contents( $filename, $contents );
5453
}
5554
}

‎free/modules/users-login/callbacks.php

+1
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,7 @@ function secupress_logins_blacklist_settings_callback( $modulenow, $settings, $a
175175
// (De)Activation.
176176
if ( false !== $activate ) {
177177
$settings['blacklist-logins_admin'] = (int) ! empty( $settings['blacklist-logins_admin'] );
178+
$settings['blacklist-logins_lexicomatisation'] = (int) ! empty( $settings['blacklist-logins_lexicomatisation'] );
178179
secupress_manage_submodule( $modulenow, 'blacklist-logins', ! empty( $activate['blacklist-logins_activated'] ) );
179180
}
180181
return $settings;

‎free/modules/users-login/plugins/blacklist-logins.php

+4-1
Original file line numberDiff line numberDiff line change
@@ -524,13 +524,16 @@ function secupress_usernames_security_name_filter( $name ) {
524524
global $secupress_new_login;
525525
static $_name;
526526

527+
if ( ! secupress_get_module_option( 'blacklist-logins_lexicomatisation', 0, 'users-login' ) ) {
528+
return $name;
529+
}
527530
$user_test = get_user_by( 'login', $name );
528531
if ( $secupress_new_login || is_a( $user_test, 'WP_User' ) ) {
529532
if ( ! $_name ) {
530533
$_name = secupress_usernames_lexicomatisation();
531534
}
532535
$name = $_name;
533-
if ( 'pre_user_nicename' == current_filter() && $secupress_new_login ) {
536+
if ( 'pre_user_nicename' === current_filter() && $secupress_new_login ) {
534537
$name = sanitize_key( $name );
535538
}
536539
}

‎free/modules/users-login/settings/blacklist-logins.php

+14
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@
8080
'label_for' => $this->get_field_name( 'bad-email-domains' ),
8181
'description' => __( 'Domain that does not exist, does not really send emails (MX Record), known to be a temporary/trash service or email addresses used by hackers will be blocked.', 'secupress' ),
8282
'plugin_activation' => true,
83+
'disabled' => ! secupress_is_pro(),
8384
'type' => 'checkbox',
8485
'value' => (int) secupress_is_submodule_active( 'users-login', 'bad-email-domains' ),
8586
'label' => __( 'Yes, prevent users to be created with a bad email domain', 'secupress' ),
@@ -123,6 +124,19 @@
123124
]
124125
) );
125126

127+
$this->add_field( array(
128+
'title' => sprintf( __( 'Rename the users nickname', 'secupress' ), 'admin' ),
129+
'description' => __( 'Any new user or updated user who has their nickname as the same as their login will be renamed', 'secupress' ),
130+
'label_for' => $this->get_field_name( 'lexicomatisation' ),
131+
'type' => 'checkbox',
132+
'depends' => $this->get_field_name( 'activated' ),
133+
'default' => false,
134+
'label' => sprintf( __( 'Yes, prevent user‘s login to be the same as their display name', 'secupress' ), secupress_tag_me( 'admin', 'strong' ) ),
135+
'helpers' => [
136+
[ 'type' => 'description', 'description' => sprintf( __( 'New nickname will look like this: "%s"', 'secupress' ), secupress_tag_me( secupress_usernames_lexicomatisation(), 'em' ) ), ],
137+
]
138+
) );
139+
126140
$woomobileurl = __( 'https://woocommerce.com/mobile/', 'secupress' );
127141
$this->add_field( array(
128142
'title' => __( 'Forbid User Enumeration', 'secupress' ),

‎languages/secupress-fr_FR.mo

411 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)