Changeset 2002769

Timestamp:

12/28/2018 09:31:49 AM (7 years ago)

Author:

thapa.laxman

Message:

fixed author enumeration via curl & grep

Location:

disable-feeds-and-hide-usernames/trunk

Files:

• README.txt (modified) (1 diff)
• disable-feeds-hide-usernames.php (modified) (2 diffs)

disable-feeds-and-hide-usernames/trunk/README.txt

@@ -4 +4 @@
 Tags: disable feeds, hide username, remove rss
 Requires at least: 3.0.1
-Tested up to: 4.7.2
+Tested up to: 5.0.2
 Stable tag: 1.1
 License: GPLv2 or later

disable-feeds-and-hide-usernames/trunk/disable-feeds-hide-usernames.php

@@ -4 +4 @@
 Description: This tiny and lightweight plugin removes all the rss feeds  and hides usernames making it harder for attacker to guess the username.
 Author: Laxman Thapa
-Version: 1.0
+Version: 1.1
 */
 
@@ -18 +18 @@
 
 if (!is_admin()) {
-    if (preg_match('/author=([0-9]*)/i', $_SERVER['QUERY_STRING'])) die();
+    if (preg_match('/author=([0-9]*)/i', $_SERVER['QUERY_STRING'])) {
+        header('Location: '.home_url().'', false, 301);
+        die();
+    }
     add_filter('redirect_canonical', function($redirect, $request){
-        if (preg_match('/\?author=([0-9]*)(\/*)/i', $request)) die();
+        if (preg_match('/\?author=([0-9]*)(\/*)/i', $request)) {
+            header('Location: '.home_url().'', false, 301);
+            die();
+        }
         else return $redirect;
     }, 10, 2);