WordPress.org
Get WordPress

Plugin Directory

Changeset 3380779


Ignore:
Timestamp:
10/19/2025 11:29:34 AM (6 months ago)
Author:
webfiable
Message:

Update to version 2.0.0 from GitHub

Location:
webfiable-info
Files:
18 added
6 edited
1 copied

Legend:

Unmodified
Added
Removed

  • webfiable-info/tags/2.0.0/README.md

    r3365319 r3380779  
    1 === Webfiable Info ===
    2 Contributors: webfiable
    3 Tags: security, monitoring, WordPress security
    4 Requires at least: 5.0
    5 Tested up to: 6.7
    6 Stable tag: 1.4
    7 License: GPLv3 or later
    8 License URI: https://www.gnu.org/licenses/gpl-3.0.html
     1# Webfiable Info
    92
    10 Webfiable is a monitoring plugin that provides insights into your site's health and security posture. Requires a free Webfiable subscription.
     3> A lightweight, privacy-respecting companion plugin that connects your WordPress site to the [Webfiable](https://webfiable.com) security service for configuration monitoring and actionable recommendations.
    114
    12 == Description ==
     5- Status: Publicly available in white-march (early access)
     6- License: GPLv3 or later
     7- WordPress: 5.0+
     8- PHP: 7.4+
    139
    14 **Ensure your website's security posture and configuration health with monitoring and recommendations. Requires an active Webfiable subscription (currently free).**
     10## Overview
    1511
    16 The Webfiable Info plugin is a component of the Webfiable security service, designed to help you maintain a robust security posture for your WordPress website. By securely gathering information about your site's plugins, themes, and WordPress version, the plugin enables the Webfiable service to perform in-depth analysis and provide weekly recommendations tailored to your specific configuration.
     12Webfiable Info securely gathers a minimal software inventory (WordPress version, installed plugins and themes, and basic site metadata) and registers your site with [Webfiable](https://webfiable.com). You receive the first full report and ongoing summaries via email.
    1713
    18 == Features ==
     14During the white-march period there is no separate sign-up or billing—the plugin registers your site from the settings screen and the service is free to use. A subscription may be required after general availability; administrators will be notified well in advance.
    1915
    20 * **Simple and Reliable Design**: Built with simplicity in mind, this plugin minimizes the risk of issues arising on your website and reduces the need for frequent updates, contributing to a stable and secure environment.
    21 * **Lightweight and Efficient**: The plugin is designed to be very lightweight, executing its tasks within seconds, and running no more than once per day, ensuring no impact on your website's performance.
    22 * **Secure Data Transmission**: Utilizes advanced hybrid encryption (AES + RSA) to securely transmit data to the Webfiable service.
    23 * **Proactive Security Monitoring**: Enables continuous monitoring of your site’s security posture and configuration health.
    24 * **Part of the Webfiable Service**: Requires an active Webfiable subscription (currently free).
     16## Features
    2517
    26 == Security Features ==
     18- One-click registration: enter a report email, grant consent, and enable the endpoint. The plugin verifies the endpoint and completes registration automatically.
     19- Opt-in endpoint: the public `/webfiable` endpoint is disabled by default and verified when enabled. If verification or registration fails, the plugin safely disables it.
     20- Consent-aware behavior: turning off consent simply saves your choice and disables the endpoint; you can re-enable later.
     21- Lightweight by design: no heavy background jobs; the endpoint serves inventory on demand and runs in milliseconds.
     22- Secure by default: hybrid encryption (AES-256-CBC + RSA-2048) protects the transport payload.
     23- Part of the Webfiable service: learn more at [webfiable.com](https://webfiable.com).
    2724
    28 Webfiable Info is built with security at its core, ensuring that your website’s data is protected at every stage:
     25## Security
    2926
    30 * **Hybrid Encryption**: Combines AES and RSA encryption to safeguard your data. The plugin uses AES-256 to encrypt the collected data, and then securely transmits the AES key by encrypting it with RSA-2048.
    31 * **Initialization Vector (IV)**: Each data transmission uses a unique Initialization Vector (IV) to ensure that even identical data produces different ciphertexts, enhancing security.
    32 * **RSA Key Management**: The RSA encryption ensures that only the Webfiable service can decrypt the transmitted data, using a private key that remains secure on the Webfiable infrastructure.
     27- Hybrid Encryption: inventory is encrypted with AES-256-CBC; the AES key is encrypted with RSA-2048.
     28- Fresh IV per response: each response uses a new IV so ciphertext is always unique.
     29- Public endpoint, private content: the `/webfiable` endpoint may be accessed publicly, but the payload can only be decrypted by Webfiable.
     30- Rate limiting: basic per-IP limiting reduces abuse.
    3331
    34 == Why It Is Secure ==
     32## Installation & Setup
    3533
    36 1. **Advanced Encryption Techniques**: Webfiable Info employs AES-256 for data encryption, a standard widely recognized for its strength and security. The AES key is then encrypted with RSA-2048, ensuring that even if the data is intercepted, it cannot be decrypted without the corresponding private RSA key, which is securely stored by Webfiable.
     341. Install the plugin (zip upload or from source).
     352. Activate it in WordPress.
     363. Go to Settings -> Webfiable Info.
     374. Enter the report recipient email and check the consent box.
     385. Enable the `/webfiable` endpoint and click “Save settings”.
     396. The plugin verifies the endpoint and completes registration. If verification fails, a notice explains what to fix and the endpoint is safely disabled.
    3740
    38 2. **Data Integrity**: The use of a unique IV for each transmission guarantees that your data remains confidential and secure, preventing any potential attackers from predicting or replicating encrypted data streams.
     41## FAQ
    3942
    40 3. **Confidentiality by Design**: The plugin is designed to collect only the necessary information for security analysis, ensuring that your website's sensitive data is handled with the utmost care and never exposed.
     43### Do I need a Webfiable subscription?
     44Not during white-march (early access). The plugin registers your site automatically and the service is free to use. When the service launches publicly, a subscription may be required. We will provide clear notice and a smooth path to upgrade. See updates at [webfiable.com](https://webfiable.com).
    4145
    42 == Installation ==
     46### How is my data secured?
     47Data is encrypted on your site before transport using AES-256-CBC. The AES key is encrypted with RSA-2048 so only Webfiable can decrypt the payload.
    4348
    44 1. Download the `webfiable-info.zip` file to your computer.
    45 2. Log in to your WordPress admin dashboard.
    46 3. Go to `Plugins > Add New`.
    47 4. Click the `Upload Plugin` button at the top of the page.
    48 5. Click `Choose File` and select the `webfiable-info.zip` file you downloaded.
    49 6. Click `Install Now`.
    50 7. Once the installation is complete, click `Activate Plugin`.
     49### What information is collected?
     50Minimal inventory only: site URL, WordPress version, installed plugins and themes (name, slug, version, short description), a site identifier, consent timestamp, and the email you provide for reports. No user content or credentials.
    5151
    52 == Frequently Asked Questions ==
     52### What happens if I disable consent?
     53Your preference is saved immediately, and the `/webfiable` endpoint is turned off. You can re-enable consent and the endpoint at any time from Settings.
    5354
    54 = Do I need a Webfiable subscription to use this plugin? =
     55### Why might registration fail?
     56The plugin verifies the endpoint before registering. If your server blocks loopback requests, permalinks are misconfigured, or the PHP OpenSSL extension is missing, verification may fail. Fix the issue and click "Save settings" again — the plugin will retry.
    5557
    56 Yes, an active Webfiable subscription is required for the plugin to function. The plugin sends encrypted data to the Webfiable service, where it is analyzed as part of your subscription.
     58## Contributing
     59Issues and PRs are welcome. Please keep changes focused and consistent with the existing code style.
    5760
    58 = How does the plugin ensure my data is secure? =
     61## License
     62GPLv3 or later. See the [LICENSE](https://www.gnu.org/licenses/gpl-3.0.html).
    5963
    60 The plugin uses a hybrid encryption method, combining AES-256 and RSA-2048, to securely encrypt and transmit your website's data. This ensures that only the Webfiable service can decrypt and analyze the information.
    6164
    62 = What information does this plugin collect? =
    6365
    64 The plugin collects information about your installed plugins, themes, and the WordPress version. This data is used by the Webfiable service to assess your website's security posture and provide recommendations.
    6566
    66 == Changelog ==
    6767
    68 = 1.4 =
    69 * Initial release with enhanced security features, including AES-256 encryption and RSA-2048 for key transmission.
    7068
    71 == Upgrade Notice ==
    7269
    73 = 1.4 =
    74 Initial release.
    7570
    76 == License ==
    77 
    78 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.

  • webfiable-info/tags/2.0.0/readme.txt

    r3365319 r3380779  
    11=== Webfiable Info ===
    22Contributors: webfiable
    3 Tags: security, monitoring, WordPress security
    4 Requires at least: 5.0
    5 Tested up to: 6.7
    6 Stable tag: 1.4.1
     3Tags: security, monitoring, hardening, inventory, endpoint
     4Requires at least: 4.7
     5Tested up to: 6.8
     6Requires PHP: 7.4
     7Stable tag: 2.0.0
    78License: GPLv3 or later
    89License URI: https://www.gnu.org/licenses/gpl-3.0.html
    910
    10 Webfiable is a monitoring plugin that provides insights into your site's health and security posture. Requires a free Webfiable subscription.
     11Webfiable Info connects your WordPress site to the Webfiable security service (https://webfiable.com) to monitor configuration health and receive actionable recommendations. The service is publicly available in white march (early access) and is free to use - no separate sign-up required.
    1112
    1213== Description ==
    1314
    14 **Ensure your website's security posture and configuration health with monitoring and recommendations. Requires an active Webfiable subscription (currently free).**
     15**Improve your site's security posture and configuration health with monitoring and recommendations.**
    1516
    16 The Webfiable Info plugin is a component of the Webfiable security service, designed to help you maintain a robust security posture for your WordPress website. By securely gathering information about your site's plugins, themes, and WordPress version, the plugin enables the Webfiable service to perform in-depth analysis and provide weekly recommendations tailored to your specific configuration.
     17Webfiable Info is the on-site companion for the Webfiable security service (https://webfiable.com). It securely gathers information about your site's WordPress version, plugins, themes, and basic site metadata and registers your site with Webfiable so you can receive ongoing reports via email. You stay in control: consent is explicit, and the public endpoint is opt-in and verified on save.
     18
     19During the white march period, there is no separate signup or billing - the plugin registers your site automatically from the settings screen and you can use the service for free. A subscription may be required in the future; we will notify administrators well in advance.
    1720
    1821== Features ==
    1922
    20 * **Simple and Reliable Design**: Built with simplicity in mind, this plugin minimizes the risk of issues arising on your website and reduces the need for frequent updates, contributing to a stable and secure environment.
    21 * **Lightweight and Efficient**: The plugin is designed to be very lightweight, executing its tasks within seconds, and running no more than once per day, ensuring no impact on your website's performance.
    22 * **Secure Data Transmission**: Utilizes advanced hybrid encryption (AES + RSA) to securely transmit data to the Webfiable service.
    23 * **Proactive Security Monitoring**: Enables continuous monitoring of your site’s security posture and configuration health.
    24 * **Part of the Webfiable Service**: Requires an active Webfiable subscription (currently free).
     23* **One-click registration**: Enter a report recipient email, grant consent, and enable the endpoint; Webfiable Info verifies the endpoint and registers the site automatically.
     24* **Opt-in endpoint**: The public `/webfiable` endpoint is disabled by default and verified when enabled. If verification or registration fails, the plugin safely disables it.
     25* **Consent-aware behavior**: Turning off consent simply saves your choice and disables the endpoint; you can re-enable later.
     26* **Lightweight by design**: No heavy background jobs; the endpoint serves inventory on demand and runs in milliseconds.
     27* **Secure by default**: Uses hybrid encryption (AES-256 + RSA-2048) to transport data.
     28* **Part of the Webfiable service**: Currently in white march (early access) and free to use; a subscription may be required in the future. Learn more at https://webfiable.com.
    2529
    2630== Security Features ==
    2731
    28 Webfiable Info is built with security at its core, ensuring that your website’s data is protected at every stage:
     32Webfiable Info is built with security at its core, ensuring that your website's data is protected at every stage:
    2933
    30 * **Hybrid Encryption**: Combines AES and RSA encryption to safeguard your data. The plugin uses AES-256 to encrypt the collected data, and then securely transmits the AES key by encrypting it with RSA-2048.
    31 * **Initialization Vector (IV)**: Each data transmission uses a unique Initialization Vector (IV) to ensure that even identical data produces different ciphertexts, enhancing security.
    32 * **RSA Key Management**: The RSA encryption ensures that only the Webfiable service can decrypt the transmitted data, using a private key that remains secure on the Webfiable infrastructure.
     34* **Hybrid Encryption**: Combines AES and RSA. The inventory is encrypted with AES-256-CBC; the AES key is encrypted with RSA-2048.
     35* **Fresh IV per response**: Each response uses a new IV so ciphertext is always unique.
     36* **Public endpoint, private content**: The `/webfiable` endpoint can be accessed by anyone, but the payload is encrypted for Webfiable only.
     37* **Rate limiting**: Basic per-IP rate limiting reduces abuse.
    3338
    3439== Why It Is Secure ==
    3540
    36 1. **Advanced Encryption Techniques**: Webfiable Info employs AES-256 for data encryption, a standard widely recognized for its strength and security. The AES key is then encrypted with RSA-2048, ensuring that even if the data is intercepted, it cannot be decrypted without the corresponding private RSA key, which is securely stored by Webfiable.
    37 
    38 2. **Data Integrity**: The use of a unique IV for each transmission guarantees that your data remains confidential and secure, preventing any potential attackers from predicting or replicating encrypted data streams.
    39 
    40 3. **Confidentiality by Design**: The plugin is designed to collect only the necessary information for security analysis, ensuring that your website's sensitive data is handled with the utmost care and never exposed.
     411. **Strong transport**: AES-256 for data, RSA-2048 for the key - only Webfiable can decrypt.
     422. **Unique IVs**: Each response is unique even for identical content.
     433. **Minimal inventory**: Only software inventory and basic metadata needed for analysis; no credentials or content are collected.
    4144
    4245== Installation ==
    … …  
    50537. Once the installation is complete, click `Activate Plugin`.
    5154
     55After activation:
     56
     571. Go to `Settings -> Webfiable Info`.
     582. Enter the report recipient email and check the consent box.
     593. Enable the `/webfiable` endpoint and click `Save settings`.
     604. The plugin verifies the endpoint and completes registration. If verification fails, the endpoint will be disabled and a notice explains what to fix.
     61
    5262== Frequently Asked Questions ==
    5363
    54 = Do I need a Webfiable subscription to use this plugin? =
     64= Do I need a Webfiable subscription? =
    5565
    56 Yes, an active Webfiable subscription is required for the plugin to function. The plugin sends encrypted data to the Webfiable service, where it is analyzed as part of your subscription.
     66Not during the white march (early access). The plugin registers your site automatically from the settings screen and you can use the service for free. A subscription may be required in the future. We will provide clear notice and a smooth upgrade path. See https://webfiable.com for updates.
    5767
    58 = How does the plugin ensure my data is secure? =
     68= How is my data secured? =
    5969
    60 The plugin uses a hybrid encryption method, combining AES-256 and RSA-2048, to securely encrypt and transmit your website's data. This ensures that only the Webfiable service can decrypt and analyze the information.
     70Data is encrypted on your site before transport using AES-256-CBC. The AES key is encrypted with RSA-2048 so only Webfiable can decrypt the payload.
    6171
    62 = What information does this plugin collect? =
     72= What information is collected? =
    6373
    64 The plugin collects information about your installed plugins, themes, and the WordPress version. This data is used by the Webfiable service to assess your website's security posture and provide recommendations.
     74Minimal inventory only: site URL, WordPress version, installed plugins and themes (name, slug, version, short description), a site identifier, consent timestamp, and the email you provide for reports. No user content or credentials.
     75
     76= What happens if I disable consent? =
     77
     78Your preference is saved immediately, and the `/webfiable` endpoint is turned off. You can re-enable consent and the endpoint at any time from Settings.
     79
     80= Why did registration fail? =
     81
     82The plugin enables and verifies the endpoint before registering. If your server blocks loopback requests, permalinks are misconfigured, or the OpenSSL PHP extension is missing, verification may fail. Fix the issue and click `Save settings` again - the plugin will retry.
    6583
    6684== Changelog ==
    6785
     86= 2.0.0 =
     87* New settings page under Settings -> Webfiable Info.
     88* Opt-in `/webfiable` endpoint with on-save verification.
     89* Automatic customer registration after successful verification.
     90* Consent gating that saves your choice and disables the endpoint when consent is off.
     91* Improved notices and lightweight, reliable design.
     92
    6893= 1.4 =
    69 * Initial release with enhanced security features, including AES-256 encryption and RSA-2048 for key transmission.
     94* Initial release with AES-256/RSA-2048 hybrid encryption.
    7095
    7196== Upgrade Notice ==
    7297
    73 = 1.4 =
    74 Initial release.
     98= 2.0.0 =
     99Visit Settings -> Webfiable Info to enter a report email, grant consent, and enable the endpoint. The plugin will verify and complete registration automatically.
    75100
    76101== License ==
    77102
    78103This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.
     104
     105
     106
     107
     108
     109
     110
     111
     112
     113
     114
     115
     116
     117
     118
     119

  • webfiable-info/tags/2.0.0/webfiable-info.php

    r3365319 r3380779  
    22/**
    33 * Plugin Name: Webfiable Info
    4  * Plugin URI: https://webfiable.com/webfiable-info
     4 * Plugin URI: https://wordpress.org/plugins/webfiable-info/
    55 * Description: Ensure your website's security posture and configuration health with monitoring and recommendations.
    6  * Version: 1.4.1
     6 * Version: 2.0.0
    77 * Author: Webfiable Team
    88 * Author URI: https://webfiable.com
    … …  
    1414 */
    1515
    16 // Prevent direct access.
    1716if ( ! defined( 'ABSPATH' ) ) {
    1817    exit;
    1918}
    2019
    21 // RSA public key (provided by the user).
    22 define(
    23     'WEBFIABLE_RSA_PUBLIC_KEY',
    24     '-----BEGIN PUBLIC KEY-----
    25 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw8y6jWyyz5yJzdj1kdDJ
    26 KDU54+MryJYTBHogyq8m+557Q8gciul2cAZexdhC6EkIzI/hxwNi/t6fcLiK0hdC
    27 88nVaP6B/xkZPuURW/cjtKbCBXo0CLTMNnJSxhECI4Xq5l5koiThdhSvDlqsuMWy
    28 xCUUlbvU9Vg+MmiaEiRtZT7Nd5/NSqftqqdiVH0Q6sUd2OEFYPwnDI5615ALLH+h
    29 XeaQhTu053Tpqcw6cMNbqOCc9Gk6esoM69oNHtXR2tKxxzWldwb0+mRRypUiPLUn
    30 /n/9w5jnPrNsYGu1PVLXb+wlspPyZCSItq4zkzkFPYKvQ7u+U2UY28dHqSeHJhGd
    31 FQIDAQAB
    32 -----END PUBLIC KEY-----'
    33 );
     20/** Paths */
     21define( 'WEBFIABLE_PLUGIN_FILE', __FILE__ );
     22define( 'WEBFIABLE_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );
     23define( 'WEBFIABLE_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
     24define( 'WEBFIABLE_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
    3425
    35 /**
    36  * Registers the custom rewrite rule for the `webfiable` endpoint.
    37  *
    38  * Hooked to `init`.
    39  *
    40  * @since 1.4
    41  * @return void
    42  */
    43 function webfiable_register_route() {
    44     add_rewrite_rule( '^webfiable$', 'index.php?webfiable_route=1', 'top' );
    45 }
    46 add_action( 'init', 'webfiable_register_route' );
     26/** Load modules (order matters: constants → i18n → options → admin/routing/endpoint) */
     27require_once WEBFIABLE_PLUGIN_DIR . 'includes/constants.php';
     28require_once WEBFIABLE_PLUGIN_DIR . 'includes/i18n.php';
     29require_once WEBFIABLE_PLUGIN_DIR . 'includes/options.php';
     30require_once WEBFIABLE_PLUGIN_DIR . 'includes/admin.php';
     31require_once WEBFIABLE_PLUGIN_DIR . 'includes/routing.php';
     32require_once WEBFIABLE_PLUGIN_DIR . 'includes/endpoint.php';
     33require_once WEBFIABLE_PLUGIN_DIR . 'includes/registration.php';
    4734
    48 /**
    49  * Adds the `webfiable_route` query var so WordPress recognizes the endpoint.
    50  *
    51  * Hooked to `query_vars`.
    52  *
    53  * @since 1.4
    54  * @param string[] $vars List of public query vars.
    55  * @return string[] Modified list of query vars.
    56  */
    57 function webfiable_add_query_vars( $vars ) {
    58     $vars[] = 'webfiable_route';
    59     return $vars;
    60 }
    61 add_filter( 'query_vars', 'webfiable_add_query_vars' );
    62 
    63 /**
    64  * Handles the request to the `webfiable` endpoint and outputs an encrypted JSON payload.
    65  *
    66  * Hooked to `template_redirect`.
    67  *
    68  * Collects WP version, installed plugins and themes, builds a payload, encrypts it
    69  * with a random AES-256-CBC key/IV, encrypts that key with the RSA public key,
    70  * and returns base64-encoded values.
    71  *
    72  * @since 1.4
    73  * @return void
    74  */
    75 function webfiable_template_redirect() {
    76     if ( get_query_var( 'webfiable_route' ) ) {
    77 
    78         // Get all installed plugins.
    79         $installed_plugins = get_plugins();
    80         $plugins_info      = array();
    81 
    82         foreach ( $installed_plugins as $plugin_slug => $plugin_data ) {
    83             $plugins_info[] = array(
    84                 'name'        => $plugin_data['Name'],
    85                 'slug'        => dirname( $plugin_slug ),
    86                 'version'     => $plugin_data['Version'],
    87                 'description' => wp_strip_all_tags( $plugin_data['Description'] ),  // Remove HTML tags from description.
    88             );
    89         }
    90 
    91         // Get all installed themes.
    92         $installed_themes = wp_get_themes();
    93         $themes_info      = array();
    94 
    95         foreach ( $installed_themes as $theme_slug => $theme_data ) {
    96             $themes_info[] = array(
    97                 'name'        => $theme_data->get( 'Name' ),
    98                 'slug'        => $theme_data->get_stylesheet(),
    99                 'version'     => $theme_data->get( 'Version' ),
    100                 'description' => wp_strip_all_tags( $theme_data->get( 'Description' ) ),  // Remove HTML tags from description.
    101             );
    102         }
    103 
    104         // Get the WordPress version.
    105         $wordpress_version = get_bloginfo( 'version' );
    106 
    107         // Merge all info into one array.
    108         $all_info = array(
    109             'wordpress_version' => $wordpress_version,
    110             'plugins'           => $plugins_info,
    111             'themes'            => $themes_info,
    112         );
    113 
    114         // Convert to JSON.
    115         $json_data = wp_json_encode( $all_info );
    116 
    117         // Generate a 256-bit AES key.
    118         $aes_key = openssl_random_pseudo_bytes( 32 );
    119 
    120         // Encrypt the JSON data with the AES key.
    121         $encrypted_data = openssl_encrypt( $json_data, 'AES-256-CBC', $aes_key, OPENSSL_RAW_DATA, $iv = openssl_random_pseudo_bytes( 16 ) );
    122 
    123         // Encrypt the AES key with the RSA public key.
    124         openssl_public_encrypt( $aes_key, $encrypted_key, WEBFIABLE_RSA_PUBLIC_KEY );
    125 
    126         // Return both the encrypted AES key and the encrypted JSON data.
    127         // We base64-encode binary values to transport them safely in JSON.
    128         // phpcs:disable WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Transport encoding, not obfuscation.
    129         $encoded_key  = base64_encode( $encrypted_key );
    130         $encoded_iv   = base64_encode( $iv );
    131         $encoded_data = base64_encode( $encrypted_data );
    132         // phpcs:enable WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
    133 
    134         $response = array(
    135             'encrypted_key' => $encoded_key,
    136             'iv'            => $encoded_iv,
    137             'data'          => $encoded_data,
    138         );
    139 
    140         // Send JSON response.
    141         wp_send_json( $response );
    142         exit;
    143     }
    144 }
    145 add_action( 'template_redirect', 'webfiable_template_redirect' );
    146 
    147 /**
    148  * Flushes rewrite rules on plugin activation so the custom endpoint works immediately.
    149  *
    150  * Calls our route registrar and then flushes the rules. This should only run on activation,
    151  * never on every request (for performance reasons).
    152  *
    153  * Hooked via `register_activation_hook()`.
    154  *
    155  * @since 1.4
    156  * @return void
    157  */
    158 function webfiable_flush_rewrite_rules() {
    159     webfiable_register_route();
    160     flush_rewrite_rules();
    161 }
    162 register_activation_hook( __FILE__, 'webfiable_flush_rewrite_rules' );
    163 
    164 /**
    165  * Flushes rewrite rules on plugin deactivation to remove the custom endpoint.
    166  *
    167  * Hooked via `register_deactivation_hook()`.
    168  *
    169  * @since 1.4
    170  * @return void
    171  */
    172 function webfiable_deactivate() {
    173     flush_rewrite_rules();
    174 }
     35/** Register activation/deactivation hooks provided by routing.php */
     36register_activation_hook( __FILE__, 'webfiable_activate' );
    17537register_deactivation_hook( __FILE__, 'webfiable_deactivate' );

  • webfiable-info/trunk/README.md

    r3365319 r3380779  
    1 === Webfiable Info ===
    2 Contributors: webfiable
    3 Tags: security, monitoring, WordPress security
    4 Requires at least: 5.0
    5 Tested up to: 6.7
    6 Stable tag: 1.4
    7 License: GPLv3 or later
    8 License URI: https://www.gnu.org/licenses/gpl-3.0.html
     1# Webfiable Info
    92
    10 Webfiable is a monitoring plugin that provides insights into your site's health and security posture. Requires a free Webfiable subscription.
     3> A lightweight, privacy-respecting companion plugin that connects your WordPress site to the [Webfiable](https://webfiable.com) security service for configuration monitoring and actionable recommendations.
    114
    12 == Description ==
     5- Status: Publicly available in white-march (early access)
     6- License: GPLv3 or later
     7- WordPress: 5.0+
     8- PHP: 7.4+
    139
    14 **Ensure your website's security posture and configuration health with monitoring and recommendations. Requires an active Webfiable subscription (currently free).**
     10## Overview
    1511
    16 The Webfiable Info plugin is a component of the Webfiable security service, designed to help you maintain a robust security posture for your WordPress website. By securely gathering information about your site's plugins, themes, and WordPress version, the plugin enables the Webfiable service to perform in-depth analysis and provide weekly recommendations tailored to your specific configuration.
     12Webfiable Info securely gathers a minimal software inventory (WordPress version, installed plugins and themes, and basic site metadata) and registers your site with [Webfiable](https://webfiable.com). You receive the first full report and ongoing summaries via email.
    1713
    18 == Features ==
     14During the white-march period there is no separate sign-up or billing—the plugin registers your site from the settings screen and the service is free to use. A subscription may be required after general availability; administrators will be notified well in advance.
    1915
    20 * **Simple and Reliable Design**: Built with simplicity in mind, this plugin minimizes the risk of issues arising on your website and reduces the need for frequent updates, contributing to a stable and secure environment.
    21 * **Lightweight and Efficient**: The plugin is designed to be very lightweight, executing its tasks within seconds, and running no more than once per day, ensuring no impact on your website's performance.
    22 * **Secure Data Transmission**: Utilizes advanced hybrid encryption (AES + RSA) to securely transmit data to the Webfiable service.
    23 * **Proactive Security Monitoring**: Enables continuous monitoring of your site’s security posture and configuration health.
    24 * **Part of the Webfiable Service**: Requires an active Webfiable subscription (currently free).
     16## Features
    2517
    26 == Security Features ==
     18- One-click registration: enter a report email, grant consent, and enable the endpoint. The plugin verifies the endpoint and completes registration automatically.
     19- Opt-in endpoint: the public `/webfiable` endpoint is disabled by default and verified when enabled. If verification or registration fails, the plugin safely disables it.
     20- Consent-aware behavior: turning off consent simply saves your choice and disables the endpoint; you can re-enable later.
     21- Lightweight by design: no heavy background jobs; the endpoint serves inventory on demand and runs in milliseconds.
     22- Secure by default: hybrid encryption (AES-256-CBC + RSA-2048) protects the transport payload.
     23- Part of the Webfiable service: learn more at [webfiable.com](https://webfiable.com).
    2724
    28 Webfiable Info is built with security at its core, ensuring that your website’s data is protected at every stage:
     25## Security
    2926
    30 * **Hybrid Encryption**: Combines AES and RSA encryption to safeguard your data. The plugin uses AES-256 to encrypt the collected data, and then securely transmits the AES key by encrypting it with RSA-2048.
    31 * **Initialization Vector (IV)**: Each data transmission uses a unique Initialization Vector (IV) to ensure that even identical data produces different ciphertexts, enhancing security.
    32 * **RSA Key Management**: The RSA encryption ensures that only the Webfiable service can decrypt the transmitted data, using a private key that remains secure on the Webfiable infrastructure.
     27- Hybrid Encryption: inventory is encrypted with AES-256-CBC; the AES key is encrypted with RSA-2048.
     28- Fresh IV per response: each response uses a new IV so ciphertext is always unique.
     29- Public endpoint, private content: the `/webfiable` endpoint may be accessed publicly, but the payload can only be decrypted by Webfiable.
     30- Rate limiting: basic per-IP limiting reduces abuse.
    3331
    34 == Why It Is Secure ==
     32## Installation & Setup
    3533
    36 1. **Advanced Encryption Techniques**: Webfiable Info employs AES-256 for data encryption, a standard widely recognized for its strength and security. The AES key is then encrypted with RSA-2048, ensuring that even if the data is intercepted, it cannot be decrypted without the corresponding private RSA key, which is securely stored by Webfiable.
     341. Install the plugin (zip upload or from source).
     352. Activate it in WordPress.
     363. Go to Settings -> Webfiable Info.
     374. Enter the report recipient email and check the consent box.
     385. Enable the `/webfiable` endpoint and click “Save settings”.
     396. The plugin verifies the endpoint and completes registration. If verification fails, a notice explains what to fix and the endpoint is safely disabled.
    3740
    38 2. **Data Integrity**: The use of a unique IV for each transmission guarantees that your data remains confidential and secure, preventing any potential attackers from predicting or replicating encrypted data streams.
     41## FAQ
    3942
    40 3. **Confidentiality by Design**: The plugin is designed to collect only the necessary information for security analysis, ensuring that your website's sensitive data is handled with the utmost care and never exposed.
     43### Do I need a Webfiable subscription?
     44Not during white-march (early access). The plugin registers your site automatically and the service is free to use. When the service launches publicly, a subscription may be required. We will provide clear notice and a smooth path to upgrade. See updates at [webfiable.com](https://webfiable.com).
    4145
    42 == Installation ==
     46### How is my data secured?
     47Data is encrypted on your site before transport using AES-256-CBC. The AES key is encrypted with RSA-2048 so only Webfiable can decrypt the payload.
    4348
    44 1. Download the `webfiable-info.zip` file to your computer.
    45 2. Log in to your WordPress admin dashboard.
    46 3. Go to `Plugins > Add New`.
    47 4. Click the `Upload Plugin` button at the top of the page.
    48 5. Click `Choose File` and select the `webfiable-info.zip` file you downloaded.
    49 6. Click `Install Now`.
    50 7. Once the installation is complete, click `Activate Plugin`.
     49### What information is collected?
     50Minimal inventory only: site URL, WordPress version, installed plugins and themes (name, slug, version, short description), a site identifier, consent timestamp, and the email you provide for reports. No user content or credentials.
    5151
    52 == Frequently Asked Questions ==
     52### What happens if I disable consent?
     53Your preference is saved immediately, and the `/webfiable` endpoint is turned off. You can re-enable consent and the endpoint at any time from Settings.
    5354
    54 = Do I need a Webfiable subscription to use this plugin? =
     55### Why might registration fail?
     56The plugin verifies the endpoint before registering. If your server blocks loopback requests, permalinks are misconfigured, or the PHP OpenSSL extension is missing, verification may fail. Fix the issue and click "Save settings" again — the plugin will retry.
    5557
    56 Yes, an active Webfiable subscription is required for the plugin to function. The plugin sends encrypted data to the Webfiable service, where it is analyzed as part of your subscription.
     58## Contributing
     59Issues and PRs are welcome. Please keep changes focused and consistent with the existing code style.
    5760
    58 = How does the plugin ensure my data is secure? =
     61## License
     62GPLv3 or later. See the [LICENSE](https://www.gnu.org/licenses/gpl-3.0.html).
    5963
    60 The plugin uses a hybrid encryption method, combining AES-256 and RSA-2048, to securely encrypt and transmit your website's data. This ensures that only the Webfiable service can decrypt and analyze the information.
    6164
    62 = What information does this plugin collect? =
    6365
    64 The plugin collects information about your installed plugins, themes, and the WordPress version. This data is used by the Webfiable service to assess your website's security posture and provide recommendations.
    6566
    66 == Changelog ==
    6767
    68 = 1.4 =
    69 * Initial release with enhanced security features, including AES-256 encryption and RSA-2048 for key transmission.
    7068
    71 == Upgrade Notice ==
    7269
    73 = 1.4 =
    74 Initial release.
    7570
    76 == License ==
    77 
    78 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.

  • webfiable-info/trunk/readme.txt

    r3365319 r3380779  
    11=== Webfiable Info ===
    22Contributors: webfiable
    3 Tags: security, monitoring, WordPress security
    4 Requires at least: 5.0
    5 Tested up to: 6.7
    6 Stable tag: 1.4.1
     3Tags: security, monitoring, hardening, inventory, endpoint
     4Requires at least: 4.7
     5Tested up to: 6.8
     6Requires PHP: 7.4
     7Stable tag: 2.0.0
    78License: GPLv3 or later
    89License URI: https://www.gnu.org/licenses/gpl-3.0.html
    910
    10 Webfiable is a monitoring plugin that provides insights into your site's health and security posture. Requires a free Webfiable subscription.
     11Webfiable Info connects your WordPress site to the Webfiable security service (https://webfiable.com) to monitor configuration health and receive actionable recommendations. The service is publicly available in white march (early access) and is free to use - no separate sign-up required.
    1112
    1213== Description ==
    1314
    14 **Ensure your website's security posture and configuration health with monitoring and recommendations. Requires an active Webfiable subscription (currently free).**
     15**Improve your site's security posture and configuration health with monitoring and recommendations.**
    1516
    16 The Webfiable Info plugin is a component of the Webfiable security service, designed to help you maintain a robust security posture for your WordPress website. By securely gathering information about your site's plugins, themes, and WordPress version, the plugin enables the Webfiable service to perform in-depth analysis and provide weekly recommendations tailored to your specific configuration.
     17Webfiable Info is the on-site companion for the Webfiable security service (https://webfiable.com). It securely gathers information about your site's WordPress version, plugins, themes, and basic site metadata and registers your site with Webfiable so you can receive ongoing reports via email. You stay in control: consent is explicit, and the public endpoint is opt-in and verified on save.
     18
     19During the white march period, there is no separate signup or billing - the plugin registers your site automatically from the settings screen and you can use the service for free. A subscription may be required in the future; we will notify administrators well in advance.
    1720
    1821== Features ==
    1922
    20 * **Simple and Reliable Design**: Built with simplicity in mind, this plugin minimizes the risk of issues arising on your website and reduces the need for frequent updates, contributing to a stable and secure environment.
    21 * **Lightweight and Efficient**: The plugin is designed to be very lightweight, executing its tasks within seconds, and running no more than once per day, ensuring no impact on your website's performance.
    22 * **Secure Data Transmission**: Utilizes advanced hybrid encryption (AES + RSA) to securely transmit data to the Webfiable service.
    23 * **Proactive Security Monitoring**: Enables continuous monitoring of your site’s security posture and configuration health.
    24 * **Part of the Webfiable Service**: Requires an active Webfiable subscription (currently free).
     23* **One-click registration**: Enter a report recipient email, grant consent, and enable the endpoint; Webfiable Info verifies the endpoint and registers the site automatically.
     24* **Opt-in endpoint**: The public `/webfiable` endpoint is disabled by default and verified when enabled. If verification or registration fails, the plugin safely disables it.
     25* **Consent-aware behavior**: Turning off consent simply saves your choice and disables the endpoint; you can re-enable later.
     26* **Lightweight by design**: No heavy background jobs; the endpoint serves inventory on demand and runs in milliseconds.
     27* **Secure by default**: Uses hybrid encryption (AES-256 + RSA-2048) to transport data.
     28* **Part of the Webfiable service**: Currently in white march (early access) and free to use; a subscription may be required in the future. Learn more at https://webfiable.com.
    2529
    2630== Security Features ==
    2731
    28 Webfiable Info is built with security at its core, ensuring that your website’s data is protected at every stage:
     32Webfiable Info is built with security at its core, ensuring that your website's data is protected at every stage:
    2933
    30 * **Hybrid Encryption**: Combines AES and RSA encryption to safeguard your data. The plugin uses AES-256 to encrypt the collected data, and then securely transmits the AES key by encrypting it with RSA-2048.
    31 * **Initialization Vector (IV)**: Each data transmission uses a unique Initialization Vector (IV) to ensure that even identical data produces different ciphertexts, enhancing security.
    32 * **RSA Key Management**: The RSA encryption ensures that only the Webfiable service can decrypt the transmitted data, using a private key that remains secure on the Webfiable infrastructure.
     34* **Hybrid Encryption**: Combines AES and RSA. The inventory is encrypted with AES-256-CBC; the AES key is encrypted with RSA-2048.
     35* **Fresh IV per response**: Each response uses a new IV so ciphertext is always unique.
     36* **Public endpoint, private content**: The `/webfiable` endpoint can be accessed by anyone, but the payload is encrypted for Webfiable only.
     37* **Rate limiting**: Basic per-IP rate limiting reduces abuse.
    3338
    3439== Why It Is Secure ==
    3540
    36 1. **Advanced Encryption Techniques**: Webfiable Info employs AES-256 for data encryption, a standard widely recognized for its strength and security. The AES key is then encrypted with RSA-2048, ensuring that even if the data is intercepted, it cannot be decrypted without the corresponding private RSA key, which is securely stored by Webfiable.
    37 
    38 2. **Data Integrity**: The use of a unique IV for each transmission guarantees that your data remains confidential and secure, preventing any potential attackers from predicting or replicating encrypted data streams.
    39 
    40 3. **Confidentiality by Design**: The plugin is designed to collect only the necessary information for security analysis, ensuring that your website's sensitive data is handled with the utmost care and never exposed.
     411. **Strong transport**: AES-256 for data, RSA-2048 for the key - only Webfiable can decrypt.
     422. **Unique IVs**: Each response is unique even for identical content.
     433. **Minimal inventory**: Only software inventory and basic metadata needed for analysis; no credentials or content are collected.
    4144
    4245== Installation ==
    … …  
    50537. Once the installation is complete, click `Activate Plugin`.
    5154
     55After activation:
     56
     571. Go to `Settings -> Webfiable Info`.
     582. Enter the report recipient email and check the consent box.
     593. Enable the `/webfiable` endpoint and click `Save settings`.
     604. The plugin verifies the endpoint and completes registration. If verification fails, the endpoint will be disabled and a notice explains what to fix.
     61
    5262== Frequently Asked Questions ==
    5363
    54 = Do I need a Webfiable subscription to use this plugin? =
     64= Do I need a Webfiable subscription? =
    5565
    56 Yes, an active Webfiable subscription is required for the plugin to function. The plugin sends encrypted data to the Webfiable service, where it is analyzed as part of your subscription.
     66Not during the white march (early access). The plugin registers your site automatically from the settings screen and you can use the service for free. A subscription may be required in the future. We will provide clear notice and a smooth upgrade path. See https://webfiable.com for updates.
    5767
    58 = How does the plugin ensure my data is secure? =
     68= How is my data secured? =
    5969
    60 The plugin uses a hybrid encryption method, combining AES-256 and RSA-2048, to securely encrypt and transmit your website's data. This ensures that only the Webfiable service can decrypt and analyze the information.
     70Data is encrypted on your site before transport using AES-256-CBC. The AES key is encrypted with RSA-2048 so only Webfiable can decrypt the payload.
    6171
    62 = What information does this plugin collect? =
     72= What information is collected? =
    6373
    64 The plugin collects information about your installed plugins, themes, and the WordPress version. This data is used by the Webfiable service to assess your website's security posture and provide recommendations.
     74Minimal inventory only: site URL, WordPress version, installed plugins and themes (name, slug, version, short description), a site identifier, consent timestamp, and the email you provide for reports. No user content or credentials.
     75
     76= What happens if I disable consent? =
     77
     78Your preference is saved immediately, and the `/webfiable` endpoint is turned off. You can re-enable consent and the endpoint at any time from Settings.
     79
     80= Why did registration fail? =
     81
     82The plugin enables and verifies the endpoint before registering. If your server blocks loopback requests, permalinks are misconfigured, or the OpenSSL PHP extension is missing, verification may fail. Fix the issue and click `Save settings` again - the plugin will retry.
    6583
    6684== Changelog ==
    6785
     86= 2.0.0 =
     87* New settings page under Settings -> Webfiable Info.
     88* Opt-in `/webfiable` endpoint with on-save verification.
     89* Automatic customer registration after successful verification.
     90* Consent gating that saves your choice and disables the endpoint when consent is off.
     91* Improved notices and lightweight, reliable design.
     92
    6893= 1.4 =
    69 * Initial release with enhanced security features, including AES-256 encryption and RSA-2048 for key transmission.
     94* Initial release with AES-256/RSA-2048 hybrid encryption.
    7095
    7196== Upgrade Notice ==
    7297
    73 = 1.4 =
    74 Initial release.
     98= 2.0.0 =
     99Visit Settings -> Webfiable Info to enter a report email, grant consent, and enable the endpoint. The plugin will verify and complete registration automatically.
    75100
    76101== License ==
    77102
    78103This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.
     104
     105
     106
     107
     108
     109
     110
     111
     112
     113
     114
     115
     116
     117
     118
     119

  • webfiable-info/trunk/webfiable-info.php

    r3365319 r3380779  
    22/**
    33 * Plugin Name: Webfiable Info
    4  * Plugin URI: https://webfiable.com/webfiable-info
     4 * Plugin URI: https://wordpress.org/plugins/webfiable-info/
    55 * Description: Ensure your website's security posture and configuration health with monitoring and recommendations.
    6  * Version: 1.4.1
     6 * Version: 2.0.0
    77 * Author: Webfiable Team
    88 * Author URI: https://webfiable.com
    … …  
    1414 */
    1515
    16 // Prevent direct access.
    1716if ( ! defined( 'ABSPATH' ) ) {
    1817    exit;
    1918}
    2019
    21 // RSA public key (provided by the user).
    22 define(
    23     'WEBFIABLE_RSA_PUBLIC_KEY',
    24     '-----BEGIN PUBLIC KEY-----
    25 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw8y6jWyyz5yJzdj1kdDJ
    26 KDU54+MryJYTBHogyq8m+557Q8gciul2cAZexdhC6EkIzI/hxwNi/t6fcLiK0hdC
    27 88nVaP6B/xkZPuURW/cjtKbCBXo0CLTMNnJSxhECI4Xq5l5koiThdhSvDlqsuMWy
    28 xCUUlbvU9Vg+MmiaEiRtZT7Nd5/NSqftqqdiVH0Q6sUd2OEFYPwnDI5615ALLH+h
    29 XeaQhTu053Tpqcw6cMNbqOCc9Gk6esoM69oNHtXR2tKxxzWldwb0+mRRypUiPLUn
    30 /n/9w5jnPrNsYGu1PVLXb+wlspPyZCSItq4zkzkFPYKvQ7u+U2UY28dHqSeHJhGd
    31 FQIDAQAB
    32 -----END PUBLIC KEY-----'
    33 );
     20/** Paths */
     21define( 'WEBFIABLE_PLUGIN_FILE', __FILE__ );
     22define( 'WEBFIABLE_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );
     23define( 'WEBFIABLE_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
     24define( 'WEBFIABLE_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
    3425
    35 /**
    36  * Registers the custom rewrite rule for the `webfiable` endpoint.
    37  *
    38  * Hooked to `init`.
    39  *
    40  * @since 1.4
    41  * @return void
    42  */
    43 function webfiable_register_route() {
    44     add_rewrite_rule( '^webfiable$', 'index.php?webfiable_route=1', 'top' );
    45 }
    46 add_action( 'init', 'webfiable_register_route' );
     26/** Load modules (order matters: constants → i18n → options → admin/routing/endpoint) */
     27require_once WEBFIABLE_PLUGIN_DIR . 'includes/constants.php';
     28require_once WEBFIABLE_PLUGIN_DIR . 'includes/i18n.php';
     29require_once WEBFIABLE_PLUGIN_DIR . 'includes/options.php';
     30require_once WEBFIABLE_PLUGIN_DIR . 'includes/admin.php';
     31require_once WEBFIABLE_PLUGIN_DIR . 'includes/routing.php';
     32require_once WEBFIABLE_PLUGIN_DIR . 'includes/endpoint.php';
     33require_once WEBFIABLE_PLUGIN_DIR . 'includes/registration.php';
    4734
    48 /**
    49  * Adds the `webfiable_route` query var so WordPress recognizes the endpoint.
    50  *
    51  * Hooked to `query_vars`.
    52  *
    53  * @since 1.4
    54  * @param string[] $vars List of public query vars.
    55  * @return string[] Modified list of query vars.
    56  */
    57 function webfiable_add_query_vars( $vars ) {
    58     $vars[] = 'webfiable_route';
    59     return $vars;
    60 }
    61 add_filter( 'query_vars', 'webfiable_add_query_vars' );
    62 
    63 /**
    64  * Handles the request to the `webfiable` endpoint and outputs an encrypted JSON payload.
    65  *
    66  * Hooked to `template_redirect`.
    67  *
    68  * Collects WP version, installed plugins and themes, builds a payload, encrypts it
    69  * with a random AES-256-CBC key/IV, encrypts that key with the RSA public key,
    70  * and returns base64-encoded values.
    71  *
    72  * @since 1.4
    73  * @return void
    74  */
    75 function webfiable_template_redirect() {
    76     if ( get_query_var( 'webfiable_route' ) ) {
    77 
    78         // Get all installed plugins.
    79         $installed_plugins = get_plugins();
    80         $plugins_info      = array();
    81 
    82         foreach ( $installed_plugins as $plugin_slug => $plugin_data ) {
    83             $plugins_info[] = array(
    84                 'name'        => $plugin_data['Name'],
    85                 'slug'        => dirname( $plugin_slug ),
    86                 'version'     => $plugin_data['Version'],
    87                 'description' => wp_strip_all_tags( $plugin_data['Description'] ),  // Remove HTML tags from description.
    88             );
    89         }
    90 
    91         // Get all installed themes.
    92         $installed_themes = wp_get_themes();
    93         $themes_info      = array();
    94 
    95         foreach ( $installed_themes as $theme_slug => $theme_data ) {
    96             $themes_info[] = array(
    97                 'name'        => $theme_data->get( 'Name' ),
    98                 'slug'        => $theme_data->get_stylesheet(),
    99                 'version'     => $theme_data->get( 'Version' ),
    100                 'description' => wp_strip_all_tags( $theme_data->get( 'Description' ) ),  // Remove HTML tags from description.
    101             );
    102         }
    103 
    104         // Get the WordPress version.
    105         $wordpress_version = get_bloginfo( 'version' );
    106 
    107         // Merge all info into one array.
    108         $all_info = array(
    109             'wordpress_version' => $wordpress_version,
    110             'plugins'           => $plugins_info,
    111             'themes'            => $themes_info,
    112         );
    113 
    114         // Convert to JSON.
    115         $json_data = wp_json_encode( $all_info );
    116 
    117         // Generate a 256-bit AES key.
    118         $aes_key = openssl_random_pseudo_bytes( 32 );
    119 
    120         // Encrypt the JSON data with the AES key.
    121         $encrypted_data = openssl_encrypt( $json_data, 'AES-256-CBC', $aes_key, OPENSSL_RAW_DATA, $iv = openssl_random_pseudo_bytes( 16 ) );
    122 
    123         // Encrypt the AES key with the RSA public key.
    124         openssl_public_encrypt( $aes_key, $encrypted_key, WEBFIABLE_RSA_PUBLIC_KEY );
    125 
    126         // Return both the encrypted AES key and the encrypted JSON data.
    127         // We base64-encode binary values to transport them safely in JSON.
    128         // phpcs:disable WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Transport encoding, not obfuscation.
    129         $encoded_key  = base64_encode( $encrypted_key );
    130         $encoded_iv   = base64_encode( $iv );
    131         $encoded_data = base64_encode( $encrypted_data );
    132         // phpcs:enable WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
    133 
    134         $response = array(
    135             'encrypted_key' => $encoded_key,
    136             'iv'            => $encoded_iv,
    137             'data'          => $encoded_data,
    138         );
    139 
    140         // Send JSON response.
    141         wp_send_json( $response );
    142         exit;
    143     }
    144 }
    145 add_action( 'template_redirect', 'webfiable_template_redirect' );
    146 
    147 /**
    148  * Flushes rewrite rules on plugin activation so the custom endpoint works immediately.
    149  *
    150  * Calls our route registrar and then flushes the rules. This should only run on activation,
    151  * never on every request (for performance reasons).
    152  *
    153  * Hooked via `register_activation_hook()`.
    154  *
    155  * @since 1.4
    156  * @return void
    157  */
    158 function webfiable_flush_rewrite_rules() {
    159     webfiable_register_route();
    160     flush_rewrite_rules();
    161 }
    162 register_activation_hook( __FILE__, 'webfiable_flush_rewrite_rules' );
    163 
    164 /**
    165  * Flushes rewrite rules on plugin deactivation to remove the custom endpoint.
    166  *
    167  * Hooked via `register_deactivation_hook()`.
    168  *
    169  * @since 1.4
    170  * @return void
    171  */
    172 function webfiable_deactivate() {
    173     flush_rewrite_rules();
    174 }
     35/** Register activation/deactivation hooks provided by routing.php */
     36register_activation_hook( __FILE__, 'webfiable_activate' );
    17537register_deactivation_hook( __FILE__, 'webfiable_deactivate' );
Note: See TracChangeset for help on using the changeset viewer.