WordPress.org
Get WordPress

Plugin Directory

Changeset 1389771


Ignore:
Timestamp:
04/07/2016 10:25:30 PM (10 years ago)
Author:
cbergen
Message:

tagging v1.4.0

Location:
gauntlet-security
Files:
4 added
16 edited
1 copied

Legend:

Unmodified
Added
Removed

  • gauntlet-security/tags/1.4.0/README.txt

    r1256325 r1389771  
    22Contributors: cbergen
    33Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=RGTZ39B4M83SA
    4 Tags: security, secure, vulnerability, exploit, hacks, audit, scanner, virus, multisite, network, gauntlet, checklist, protection
     4Tags: security, secure, vulnerability, exploit, hacks, audit, scanner, virus, multisite, network, gauntlet, checklist, protection, security hardening
    55Requires at least: 3.4
    6 Tested up to: 4.3.1
    7 Stable tag: 1.3.0
     6Tested up to: 4.5
     7Stable tag: 1.4.0
    88License: GPLv3
    99License URI: http://www.gnu.org/licenses/gpl-3.0.html
    … …  
    2525* Prevent access to any stray files which could be useful to attackers
    2626* Rename or move the content directory
     27* Keep PHP up-to-date
    2728* Disable dangerous PHP functions
    2829* Disable allow_url_include and allow_url_fopen PHP flags
     30* Turn off the display of PHP errors
     31* Don't advertise the PHP version you are running
    2932* Use a strong database password
    3033* Change the default database table prefix
    3134* Keep WordPress up-to-date
    32 * Turn off the display of PHP errors
    3335* Turn off file editing in the control panel
    3436* Set security keys in WP-Config file
    … …  
    5355* Apache web server
    5456* WordPress 3.4 minimum
    55 * PHP 5.2 minimum
     57* PHP 5.2.7 minimum
    5658
    5759= Disclaimer =
    … …  
    107109== Changelog ==
    108110
     111= 1.4.0 =
     112* New test: Keep PHP up-to-date
     113* New test: Don't advertise the PHP version you are running
     114* Enhancement: Remove deprecated WordPress function, force_ssl_login
     115* Enhancement: Improve colour-coding on plugin check
     116* Enhancement: Add stray file check for "error_log" files
     117* Tested on WordPress 4.5
     118
    109119= 1.3.0 =
    110120* Enhancement: Add compatibility with WordPress Multisite installs

  • gauntlet-security/tags/1.4.0/admin/assets/css/admin.css

    r1040048 r1389771  
    327327    color:#7F7F7F;
    328328}
    329 
     329/*
     330    Override critical colours on plugin check
     331*/
     332.gus_PluginAudit table .critical td .okay{
     333    color:#444;
     334}
    330335
    331336

  • gauntlet-security/tags/1.4.0/admin/assets/js/admin.js

    r1040048 r1389771  
    2424                ['gus_StrayFiles', 'slow'],
    2525                ['gus_WpContentLocation', 2],
     26                ['gus_PhpVersion', 2],
    2627                ['gus_PhpFunctions', 2],
    2728                ['gus_PhpAllowUrl', 2],
     29                ['gus_PhpDisplayErrors', 2],
     30                ['gus_HidePhpVersion', 2],
    2831                ['gus_DbPassword', 2],
    2932                ['gus_WpTable', 2],
    3033                ['gus_WpVersion', 2],
    31                 ['gus_PhpDisplayErrors', 2],
    3234                ['gus_FileEditing', 2],
    3335                ['gus_KeysAndSalts', 2],

  • gauntlet-security/tags/1.4.0/admin/includes/classes/gus_DirectoryIndexing.php

    r998103 r1389771  
    6262        When directory indexing is left on, visitors can navigate to a directory on your site
    6363        and (if there's no index file) view a listing of all the files inside. This information
    64         can be useful to hackers who are targetting your site and want to understand the structure
     64        can be useful to hackers who are targeting your site and want to understand the structure
    6565        and contents of the server.
    6666       

  • gauntlet-security/tags/1.4.0/admin/includes/classes/gus_SslAdmin.php

    r998103 r1389771  
    33class gus_SslAdmin extends gus_TestBase
    44{
    5     private $force_ssl_login = false;
    6 
    75    protected function main_check()
    86    {
    9         if( force_ssl_login() )
    10         {
    11             $this->force_ssl_login = true;
    12         }
    13 
    14         /*
    15             Even if FORCE_SSL_LOGIN is true,
    16             if FORCE_SSL_ADMIN is not set, there will be security issues.
    17        
    18             https://core.trac.wordpress.org/ticket/10267#comment:20
    19        
    20             TODO: This may not be true in WP v.4. The functionality of
    21             FORCE_SSL_LOGIN may become the same as FORCE_SSL_ADMIN.
    22         */
    23 
    247        if( force_ssl_admin() )
    258        {
    … …  
    5437    protected function result_text()
    5538    {
    56         /*
    57             FORCE_SSL_ADMIN is not set but FORCE_SSL_LOGIN is: Boo
    58         */
    59         if( $this->pass !== 'pass' && $this->force_ssl_login == true )
    60         {
    61             return <<<EOD
    62 
    63             <p>This site enforces SSL for the login page but not for the general
    64                 admin area. While the act of logging
    65                 in is encrypted, any of the logged-in users' cookies will still be
    66                 accessible over regular HTTP.</p>
    67 
    68             <div class='subtests'>
    69                 <table>
    70                     <tbody>
    71                         <tr>
    72                             <td>FORCE_SSL_LOGIN</td>
    73                             <td>true</td>
    74                         </tr>
    75                         <tr>
    76                             <td>FORCE_SSL_ADMIN</td>
    77                             <td><span class="error">false</span></td>
    78                         </tr>
    79                     </tbody>
    80                 </table>
    81             </div>
    82 
    83 EOD;
    84         }
    85        
    8639        /*
    8740            Neither FORCE_SSL_ADMIN nor FORCE_SSL_LOGIN is set: Boo

  • gauntlet-security/tags/1.4.0/admin/includes/classes/gus_StrayFiles.php

    r1115774 r1389771  
    390390        $description = 'Logs';
    391391       
    392         // Common git locations: WP root and Active theme root
    393         $common_paths = array();
     392        // Common locations: content directory, plugins directory, and active theme directory
     393        $common_paths = array(
     394            ABSPATH . 'error_log',
     395            WP_CONTENT_DIR . '/error_log',
     396            WP_CONTENT_DIR . '/plugins/error_log',
     397            get_stylesheet_directory() . '/error_log',
     398        );
    394399
    395400        // Find existing files
    … …  
    412417                'url_blocked' => $url_blocked
    413418            ) );
     419            if($description !== '')
     420            {
     421                $description = '';
     422            }
    414423        }
    415424       
    … …  
    418427            $this->run_sub_test( array(
    419428                'description' => $description,
    420                 'path' => 'eg: debug.log',
     429                'path' => 'eg: debug.log, error_log',
    421430                'path_exists' => false,
    422431                'url_blocked' => true

  • gauntlet-security/tags/1.4.0/admin/includes/classes/gus_TestRunner.php

    r1040048 r1389771  
    1919                               
    2020        // PHP configuration   
     21        $this->tests[] = array('gus_PhpVersion', 'PHP');
    2122        $this->tests[] = array('gus_PhpFunctions', 'PHP');
    2223        $this->tests[] = array('gus_PhpAllowUrl', 'PHP');
     24        $this->tests[] = array('gus_PhpDisplayErrors', 'PHP');
     25        $this->tests[] = array('gus_HidePhpVersion', 'PHP');
    2326                               
    2427        // Database             
    … …  
    2831        // WordPress configuration
    2932        $this->tests[] = array('gus_WpVersion', 'WordPress');
    30         $this->tests[] = array('gus_PhpDisplayErrors', 'WordPress');
    3133        $this->tests[] = array('gus_FileEditing', 'WordPress');
    3234        $this->tests[] = array('gus_KeysAndSalts', 'WordPress');

  • gauntlet-security/tags/1.4.0/gauntlet-security.php

    r1256325 r1389771  
    77 * Author: Cornelius Bergen, Matchbox Creative
    88 * Author URI: http://matchboxcreative.com
    9  * Version: 1.3.0
     9 * Version: 1.4.0
    1010 * Text Domain: gauntlet
    1111 */

  • gauntlet-security/trunk/README.txt

    r1256325 r1389771  
    22Contributors: cbergen
    33Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=RGTZ39B4M83SA
    4 Tags: security, secure, vulnerability, exploit, hacks, audit, scanner, virus, multisite, network, gauntlet, checklist, protection
     4Tags: security, secure, vulnerability, exploit, hacks, audit, scanner, virus, multisite, network, gauntlet, checklist, protection, security hardening
    55Requires at least: 3.4
    6 Tested up to: 4.3.1
    7 Stable tag: 1.3.0
     6Tested up to: 4.5
     7Stable tag: 1.4.0
    88License: GPLv3
    99License URI: http://www.gnu.org/licenses/gpl-3.0.html
    … …  
    2525* Prevent access to any stray files which could be useful to attackers
    2626* Rename or move the content directory
     27* Keep PHP up-to-date
    2728* Disable dangerous PHP functions
    2829* Disable allow_url_include and allow_url_fopen PHP flags
     30* Turn off the display of PHP errors
     31* Don't advertise the PHP version you are running
    2932* Use a strong database password
    3033* Change the default database table prefix
    3134* Keep WordPress up-to-date
    32 * Turn off the display of PHP errors
    3335* Turn off file editing in the control panel
    3436* Set security keys in WP-Config file
    … …  
    5355* Apache web server
    5456* WordPress 3.4 minimum
    55 * PHP 5.2 minimum
     57* PHP 5.2.7 minimum
    5658
    5759= Disclaimer =
    … …  
    107109== Changelog ==
    108110
     111= 1.4.0 =
     112* New test: Keep PHP up-to-date
     113* New test: Don't advertise the PHP version you are running
     114* Enhancement: Remove deprecated WordPress function, force_ssl_login
     115* Enhancement: Improve colour-coding on plugin check
     116* Enhancement: Add stray file check for "error_log" files
     117* Tested on WordPress 4.5
     118
    109119= 1.3.0 =
    110120* Enhancement: Add compatibility with WordPress Multisite installs

  • gauntlet-security/trunk/admin/assets/css/admin.css

    r1040048 r1389771  
    327327    color:#7F7F7F;
    328328}
    329 
     329/*
     330    Override critical colours on plugin check
     331*/
     332.gus_PluginAudit table .critical td .okay{
     333    color:#444;
     334}
    330335
    331336

  • gauntlet-security/trunk/admin/assets/js/admin.js

    r1040048 r1389771  
    2424                ['gus_StrayFiles', 'slow'],
    2525                ['gus_WpContentLocation', 2],
     26                ['gus_PhpVersion', 2],
    2627                ['gus_PhpFunctions', 2],
    2728                ['gus_PhpAllowUrl', 2],
     29                ['gus_PhpDisplayErrors', 2],
     30                ['gus_HidePhpVersion', 2],
    2831                ['gus_DbPassword', 2],
    2932                ['gus_WpTable', 2],
    3033                ['gus_WpVersion', 2],
    31                 ['gus_PhpDisplayErrors', 2],
    3234                ['gus_FileEditing', 2],
    3335                ['gus_KeysAndSalts', 2],

  • gauntlet-security/trunk/admin/includes/classes/gus_DirectoryIndexing.php

    r998103 r1389771  
    6262        When directory indexing is left on, visitors can navigate to a directory on your site
    6363        and (if there's no index file) view a listing of all the files inside. This information
    64         can be useful to hackers who are targetting your site and want to understand the structure
     64        can be useful to hackers who are targeting your site and want to understand the structure
    6565        and contents of the server.
    6666       

  • gauntlet-security/trunk/admin/includes/classes/gus_SslAdmin.php

    r998103 r1389771  
    33class gus_SslAdmin extends gus_TestBase
    44{
    5     private $force_ssl_login = false;
    6 
    75    protected function main_check()
    86    {
    9         if( force_ssl_login() )
    10         {
    11             $this->force_ssl_login = true;
    12         }
    13 
    14         /*
    15             Even if FORCE_SSL_LOGIN is true,
    16             if FORCE_SSL_ADMIN is not set, there will be security issues.
    17        
    18             https://core.trac.wordpress.org/ticket/10267#comment:20
    19        
    20             TODO: This may not be true in WP v.4. The functionality of
    21             FORCE_SSL_LOGIN may become the same as FORCE_SSL_ADMIN.
    22         */
    23 
    247        if( force_ssl_admin() )
    258        {
    … …  
    5437    protected function result_text()
    5538    {
    56         /*
    57             FORCE_SSL_ADMIN is not set but FORCE_SSL_LOGIN is: Boo
    58         */
    59         if( $this->pass !== 'pass' && $this->force_ssl_login == true )
    60         {
    61             return <<<EOD
    62 
    63             <p>This site enforces SSL for the login page but not for the general
    64                 admin area. While the act of logging
    65                 in is encrypted, any of the logged-in users' cookies will still be
    66                 accessible over regular HTTP.</p>
    67 
    68             <div class='subtests'>
    69                 <table>
    70                     <tbody>
    71                         <tr>
    72                             <td>FORCE_SSL_LOGIN</td>
    73                             <td>true</td>
    74                         </tr>
    75                         <tr>
    76                             <td>FORCE_SSL_ADMIN</td>
    77                             <td><span class="error">false</span></td>
    78                         </tr>
    79                     </tbody>
    80                 </table>
    81             </div>
    82 
    83 EOD;
    84         }
    85        
    8639        /*
    8740            Neither FORCE_SSL_ADMIN nor FORCE_SSL_LOGIN is set: Boo

  • gauntlet-security/trunk/admin/includes/classes/gus_StrayFiles.php

    r1115774 r1389771  
    390390        $description = 'Logs';
    391391       
    392         // Common git locations: WP root and Active theme root
    393         $common_paths = array();
     392        // Common locations: content directory, plugins directory, and active theme directory
     393        $common_paths = array(
     394            ABSPATH . 'error_log',
     395            WP_CONTENT_DIR . '/error_log',
     396            WP_CONTENT_DIR . '/plugins/error_log',
     397            get_stylesheet_directory() . '/error_log',
     398        );
    394399
    395400        // Find existing files
    … …  
    412417                'url_blocked' => $url_blocked
    413418            ) );
     419            if($description !== '')
     420            {
     421                $description = '';
     422            }
    414423        }
    415424       
    … …  
    418427            $this->run_sub_test( array(
    419428                'description' => $description,
    420                 'path' => 'eg: debug.log',
     429                'path' => 'eg: debug.log, error_log',
    421430                'path_exists' => false,
    422431                'url_blocked' => true

  • gauntlet-security/trunk/admin/includes/classes/gus_TestRunner.php

    r1040048 r1389771  
    1919                               
    2020        // PHP configuration   
     21        $this->tests[] = array('gus_PhpVersion', 'PHP');
    2122        $this->tests[] = array('gus_PhpFunctions', 'PHP');
    2223        $this->tests[] = array('gus_PhpAllowUrl', 'PHP');
     24        $this->tests[] = array('gus_PhpDisplayErrors', 'PHP');
     25        $this->tests[] = array('gus_HidePhpVersion', 'PHP');
    2326                               
    2427        // Database             
    … …  
    2831        // WordPress configuration
    2932        $this->tests[] = array('gus_WpVersion', 'WordPress');
    30         $this->tests[] = array('gus_PhpDisplayErrors', 'WordPress');
    3133        $this->tests[] = array('gus_FileEditing', 'WordPress');
    3234        $this->tests[] = array('gus_KeysAndSalts', 'WordPress');

  • gauntlet-security/trunk/gauntlet-security.php

    r1256325 r1389771  
    77 * Author: Cornelius Bergen, Matchbox Creative
    88 * Author URI: http://matchboxcreative.com
    9  * Version: 1.3.0
     9 * Version: 1.4.0
    1010 * Text Domain: gauntlet
    1111 */
Note: See TracChangeset for help on using the changeset viewer.