WordPress.org
Get WordPress

Plugin Directory

Changeset 3287271


Ignore:
Timestamp:
05/04/2025 06:06:02 PM (10 months ago)
Author:
fullworks
Message:

Adding version 1.7.2

Location:
stop-user-enumeration
Files:
12 edited
1 copied

Legend:

Unmodified
Added
Removed

  • stop-user-enumeration/tags/1.7.2/changelog.txt

    r3282442 r3287271  
    11== Changelog ==
     2= 1.7.2 =
     3* Fix ability to by-pass the WP REST API protection functionality, props Bob @ WpScan
     4
    25= 1.7.1 =
    36* add developer hooks and filters for extending plugin functionality

  • stop-user-enumeration/tags/1.7.2/frontend/class-frontend.php

    r3282442 r3287271  
    109109        // Get the IP address of the request
    110110        $ip = $this->get_ip();
    111        
     111
    112112        // Allow filtering of the IP address for integration with external services
    113113        $ip = apply_filters( 'stop_user_enumeration_ip', $ip );
    … …  
    131131                error_log( "Attempted user enumeration from " . esc_html( $ip ) );
    132132            }
    133            
     133
    134134            // Action hook for add-ons to process enumeration attempts (limit login, blocklists, etc.)
    135135            do_action( 'stop_user_enumeration_attempt', $ip );
    … …  
    188188        if ( 'on' === Core::sue_get_option( 'stop_rest_user', 'off' ) ) {
    189189            // phpcs:ignore WordPress.Security.NonceVerification  -- not saved just checking the request
    190             $request_uri = ( isset( $_SERVER['REQUEST_URI'] ) ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
     190            $request_uri = ( isset( $_SERVER['REQUEST_URI'] ) ) ? sanitize_text_field( wp_unslash( rawurldecode( $_SERVER['REQUEST_URI'] ) ) ) : '';
    191191            // phpcs:ignore WordPress.Security.NonceVerification  -- not saved just checking the request
    192             $rest_route = ( isset( $_REQUEST['rest_route'] ) ) ? sanitize_text_field( wp_unslash( $_REQUEST['rest_route'] ) ) : '';
     192            $rest_route = ( isset( $_REQUEST['rest_route'] ) ) ? sanitize_text_field( wp_unslash( rawurldecode( $_REQUEST['rest_route'] ) ) ) : '';
    193193            $pattern    = apply_filters( 'stop_user_enumeration_rest_stop_match', '/users/i' );
    194194            if ( ( preg_match( $pattern, $request_uri ) !== 0 ) || ( preg_match( $pattern, $rest_route ) !== 0 ) ) {
    … …  
    198198                        return $access; // check not exception
    199199                    }
    200                    
     200
    201201                    // Get IP address for logging and filtering
    202202                    $ip = $this->get_ip();
    203                    
     203
    204204                    // Filter to allow extensions to determine if blocking should occur
    205205                    $should_block = apply_filters( 'stop_user_enumeration_should_block', true, $ip );
    206                    
     206
    207207                    if ( $should_block ) {
    208208                        $this->sue_log();
     209
    209210                        return new WP_Error( 'rest_cannot_access', esc_html__( 'Only authenticated users can access the User endpoint REST API.', 'stop-user-enumeration' ), array( 'status' => rest_authorization_required_code() ) );
    210211                    }

  • stop-user-enumeration/tags/1.7.2/includes/vendor/composer/installed.php

    r3282442 r3287271  
    44        'pretty_version' => 'dev-main',
    55        'version' => 'dev-main',
    6         'reference' => 'df3c3d40306aa96fb00e8506f9aeba9ba9a477a1',
     6        'reference' => '1956095bc022fb1bd97264975c077e311373472c',
    77        'type' => 'wordpress-plugin',
    88        'install_path' => __DIR__ . '/../../../',
    … …  
    3232            'pretty_version' => 'dev-main',
    3333            'version' => 'dev-main',
    34             'reference' => 'df3c3d40306aa96fb00e8506f9aeba9ba9a477a1',
     34            'reference' => '1956095bc022fb1bd97264975c077e311373472c',
    3535            'type' => 'wordpress-plugin',
    3636            'install_path' => __DIR__ . '/../../../',

  • stop-user-enumeration/tags/1.7.2/languages/stop-user-enumeration.pot

    r3282442 r3287271  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Stop User Enumeration 1.7.1\n"
     5"Project-Id-Version: Stop User Enumeration 1.7.2\n"
    66"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/stop-user-enumeration\n"
    77"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2025-04-26T15:20:35+00:00\n"
     12"POT-Creation-Date: 2025-05-04T18:03:23+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.10.0\n"
    … …  
    136136msgstr ""
    137137
    138 #: frontend/class-frontend.php:209
     138#: frontend/class-frontend.php:210
    139139msgid "Only authenticated users can access the User endpoint REST API."
    140140msgstr ""

  • stop-user-enumeration/tags/1.7.2/readme.txt

    r3282442 r3287271  
    66Tested up to: 6.8
    77Requires PHP: 7.4
    8 Stable tag: 1.7.1
     8Stable tag: 1.7.2
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html

  • stop-user-enumeration/tags/1.7.2/stop-user-enumeration.php

    r3282442 r3287271  
    44Plugin URI: https://fullworksplugins.com/products/stop-user-enumeration/
    55Description: Helps secure your site against hacking attacks through detecting  User Enumeration
    6 Version: 1.7.1
     6Version: 1.7.2
    77Author: Fullworks
    88Requires at least: 6.3

  • stop-user-enumeration/trunk/changelog.txt

    r3282442 r3287271  
    11== Changelog ==
     2= 1.7.2 =
     3* Fix ability to by-pass the WP REST API protection functionality, props Bob @ WpScan
     4
    25= 1.7.1 =
    36* add developer hooks and filters for extending plugin functionality

  • stop-user-enumeration/trunk/frontend/class-frontend.php

    r3282442 r3287271  
    109109        // Get the IP address of the request
    110110        $ip = $this->get_ip();
    111        
     111
    112112        // Allow filtering of the IP address for integration with external services
    113113        $ip = apply_filters( 'stop_user_enumeration_ip', $ip );
    … …  
    131131                error_log( "Attempted user enumeration from " . esc_html( $ip ) );
    132132            }
    133            
     133
    134134            // Action hook for add-ons to process enumeration attempts (limit login, blocklists, etc.)
    135135            do_action( 'stop_user_enumeration_attempt', $ip );
    … …  
    188188        if ( 'on' === Core::sue_get_option( 'stop_rest_user', 'off' ) ) {
    189189            // phpcs:ignore WordPress.Security.NonceVerification  -- not saved just checking the request
    190             $request_uri = ( isset( $_SERVER['REQUEST_URI'] ) ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
     190            $request_uri = ( isset( $_SERVER['REQUEST_URI'] ) ) ? sanitize_text_field( wp_unslash( rawurldecode( $_SERVER['REQUEST_URI'] ) ) ) : '';
    191191            // phpcs:ignore WordPress.Security.NonceVerification  -- not saved just checking the request
    192             $rest_route = ( isset( $_REQUEST['rest_route'] ) ) ? sanitize_text_field( wp_unslash( $_REQUEST['rest_route'] ) ) : '';
     192            $rest_route = ( isset( $_REQUEST['rest_route'] ) ) ? sanitize_text_field( wp_unslash( rawurldecode( $_REQUEST['rest_route'] ) ) ) : '';
    193193            $pattern    = apply_filters( 'stop_user_enumeration_rest_stop_match', '/users/i' );
    194194            if ( ( preg_match( $pattern, $request_uri ) !== 0 ) || ( preg_match( $pattern, $rest_route ) !== 0 ) ) {
    … …  
    198198                        return $access; // check not exception
    199199                    }
    200                    
     200
    201201                    // Get IP address for logging and filtering
    202202                    $ip = $this->get_ip();
    203                    
     203
    204204                    // Filter to allow extensions to determine if blocking should occur
    205205                    $should_block = apply_filters( 'stop_user_enumeration_should_block', true, $ip );
    206                    
     206
    207207                    if ( $should_block ) {
    208208                        $this->sue_log();
     209
    209210                        return new WP_Error( 'rest_cannot_access', esc_html__( 'Only authenticated users can access the User endpoint REST API.', 'stop-user-enumeration' ), array( 'status' => rest_authorization_required_code() ) );
    210211                    }

  • stop-user-enumeration/trunk/includes/vendor/composer/installed.php

    r3282442 r3287271  
    44        'pretty_version' => 'dev-main',
    55        'version' => 'dev-main',
    6         'reference' => 'df3c3d40306aa96fb00e8506f9aeba9ba9a477a1',
     6        'reference' => '1956095bc022fb1bd97264975c077e311373472c',
    77        'type' => 'wordpress-plugin',
    88        'install_path' => __DIR__ . '/../../../',
    … …  
    3232            'pretty_version' => 'dev-main',
    3333            'version' => 'dev-main',
    34             'reference' => 'df3c3d40306aa96fb00e8506f9aeba9ba9a477a1',
     34            'reference' => '1956095bc022fb1bd97264975c077e311373472c',
    3535            'type' => 'wordpress-plugin',
    3636            'install_path' => __DIR__ . '/../../../',

  • stop-user-enumeration/trunk/languages/stop-user-enumeration.pot

    r3282442 r3287271  
    33msgid ""
    44msgstr ""
    5 "Project-Id-Version: Stop User Enumeration 1.7.1\n"
     5"Project-Id-Version: Stop User Enumeration 1.7.2\n"
    66"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/stop-user-enumeration\n"
    77"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
    … …  
    1010"Content-Type: text/plain; charset=UTF-8\n"
    1111"Content-Transfer-Encoding: 8bit\n"
    12 "POT-Creation-Date: 2025-04-26T15:20:35+00:00\n"
     12"POT-Creation-Date: 2025-05-04T18:03:23+00:00\n"
    1313"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
    1414"X-Generator: WP-CLI 2.10.0\n"
    … …  
    136136msgstr ""
    137137
    138 #: frontend/class-frontend.php:209
     138#: frontend/class-frontend.php:210
    139139msgid "Only authenticated users can access the User endpoint REST API."
    140140msgstr ""

  • stop-user-enumeration/trunk/readme.txt

    r3282442 r3287271  
    66Tested up to: 6.8
    77Requires PHP: 7.4
    8 Stable tag: 1.7.1
     8Stable tag: 1.7.2
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html

  • stop-user-enumeration/trunk/stop-user-enumeration.php

    r3282442 r3287271  
    44Plugin URI: https://fullworksplugins.com/products/stop-user-enumeration/
    55Description: Helps secure your site against hacking attacks through detecting  User Enumeration
    6 Version: 1.7.1
     6Version: 1.7.2
    77Author: Fullworks
    88Requires at least: 6.3
Note: See TracChangeset for help on using the changeset viewer.