WordPress.org
Get WordPress

Plugin Directory

Changeset 2353220


Ignore:
Timestamp:
08/05/2020 02:55:28 PM (5 years ago)
Author:
wfmatt
Message:

7.4.10 - August 5, 2020

  • Improvement: Prevent author sitemap from leaking usernames in WordPress >= 5.5.0.
  • Fix: Prevent Wordfence auto-update from running if the user has enabled auto-update through WordPress.
  • Fix: Added default permission_callback params to Wordfence Central REST routes.
  • Fix: Fixed missing styling on WAF optimization admin notice.
Location:
wordfence
Files:
112 added
112 deleted
16 edited
1 copied

Legend:

Unmodified
Added
Removed

  • wordfence/tags/7.4.10/lib/menu_options.php

    r2337484 r2353220  
    122122                'wf-option-loginSec-maskLoginErrors' => __('Don\'t let WordPress reveal valid users in login errors', 'wordfence'),
    123123                'wf-option-loginSec-blockAdminReg' => __('Prevent users registering "admin" username if it doesn\'t exist', 'wordfence'),
    124                 'wf-option-loginSec-disableAuthorScan' => __('Prevent discovery of usernames through "/?author=N" scans, the oEmbed API, and the WordPress REST API', 'wordfence'),
     124                'wf-option-loginSec-disableAuthorScan' => __('Prevent discovery of usernames through "/?author=N" scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps', 'wordfence'),
    125125                'wf-option-other-blockBadPOST' => __('Block IPs who send POST requests with blank User-Agent and Referer', 'wordfence'),
    126126                'wf-option-blockCustomText' => __('Custom text shown on block pages', 'wordfence'),

  • wordfence/tags/7.4.10/lib/rest-api/wfRESTAuthenticationController.php

    r2131558 r2353220  
    2929            'methods'  => WP_REST_Server::READABLE,
    3030            'callback' => array($this, 'nonce'),
     31            'permission_callback' => '__return_true',
    3132        ));
    3233        register_rest_route('wordfence/v1', '/authenticate', array(
    3334            'methods'  => WP_REST_Server::CREATABLE,
    3435            'callback' => array($this, 'authenticate'),
     36            'permission_callback' => '__return_true',
    3537        ));
    3638        register_rest_route('wordfence/v1', '/authenticate-premium', array(
    3739            'methods'  => WP_REST_Server::CREATABLE,
    3840            'callback' => array($this, 'authenticatePremium'),
     41            'permission_callback' => '__return_true',
    3942        ));
    4043    }

  • wordfence/tags/7.4.10/lib/wfConfig.php

    r2337484 r2353220  
    935935        if (version_compare(PHP_VERSION, '5.3', '<')) {
    936936            return;
     937        }
     938
     939        // Prevent WF auto-update if the user has enabled auto-update through the plugins page.
     940        if (version_compare(wfUtils::getWPVersion(), '5.5-x', '>=')) {
     941            $autoUpdatePlugins = get_site_option('auto_update_plugins');
     942            if (is_array($autoUpdatePlugins) && in_array(WORDFENCE_BASENAME, $autoUpdatePlugins)) {
     943                return;
     944            }
    937945        }
    938946

  • wordfence/tags/7.4.10/lib/wordfenceClass.php

    r2337484 r2353220  
    12711271            add_filter('rest_request_before_callbacks', 'wordfence::jsonAPIAuthorFilter', 99, 3);
    12721272            add_filter('rest_post_dispatch', 'wordfence::jsonAPIAdjustHeaders', 99, 3);
     1273            add_filter('wp_sitemaps_users_pre_url_list', '__return_false', 99, 0);
     1274            add_filter('wp_sitemaps_add_provider', 'wordfence::wpSitemapUserProviderFilter', 99, 2);
    12731275        }
    12741276       
    … …  
    25592561       
    25602562        return $response;
     2563    }
     2564    public static function wpSitemapUserProviderFilter($provider, $name) {
     2565        if ($name === 'users') {
     2566            return false;
     2567        }
     2568        return $provider;
    25612569    }
    25622570    public static function _filterCentralFromLiveTraffic($dispatch_result, $request, $route, $handler) {

  • wordfence/tags/7.4.10/modules/login-security/wordfence-login-security.php

    r2337484 r2353220  
    2828   
    2929    define('WORDFENCE_LS_VERSION', '1.0.5');
    30     define('WORDFENCE_LS_BUILD_NUMBER', '1594219913');
     30    define('WORDFENCE_LS_BUILD_NUMBER', '1596638737');
    3131   
    3232    if (!defined('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES')) { define('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES', 15); }

  • wordfence/tags/7.4.10/readme.txt

    r2337496 r2353220  
    44Requires at least: 3.9
    55Requires PHP: 5.3
    6 Tested up to: 5.4
    7 Stable tag: 7.4.9
     6Tested up to: 5.5
     7Stable tag: 7.4.10
    88
    99Secure your website with the most comprehensive WordPress security plugin. Firewall, malware scan, blocking, live traffic, login security & more.
    … …  
    183183
    184184== Changelog ==
     185
     186= 7.4.10 - August 5, 2020 =
     187
     188* Improvement: Prevent author sitemap from leaking usernames in WordPress >= 5.5.0.
     189* Fix: Prevent Wordfence auto-update from running if the user has enabled auto-update through WordPress.
     190* Fix: Added default `permission_callback` params to Wordfence Central REST routes.
     191* Fix: Fixed missing styling on WAF optimization admin notice.
    185192
    186193= 7.4.9 - July 8, 2020 =

  • wordfence/tags/7.4.10/views/waf/options-group-brute-force.php

    r2087795 r2353220  
    212212                            'disabledValue' => 0,
    213213                            'value' => wfConfig::get('loginSec_disableAuthorScan') ? 1 : 0,
    214                             'title' => __('Prevent discovery of usernames through \'/?author=N\' scans, the oEmbed API, and the WordPress REST API', 'wordfence'),
     214                            'title' => __('Prevent discovery of usernames through \'/?author=N\' scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps', 'wordfence'),
    215215                            'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_PREVENT_AUTHOR_SCAN),
    216216                        ))->render();

  • wordfence/tags/7.4.10/wordfence.php

    r2337484 r2353220  
    55Description: Wordfence Security - Anti-virus, Firewall and Malware Scan
    66Author: Wordfence
    7 Version: 7.4.9
     7Version: 7.4.10
    88Author URI: http://www.wordfence.com/
    99Network: true
    … …  
    1616    exit;
    1717}
    18 define('WORDFENCE_VERSION', '7.4.9');
    19 define('WORDFENCE_BUILD_NUMBER', '1594219913');
     18define('WORDFENCE_VERSION', '7.4.10');
     19define('WORDFENCE_BUILD_NUMBER', '1596638737');
    2020define('WORDFENCE_BASENAME', function_exists('plugin_basename') ? plugin_basename(__FILE__) :
    2121    basename(dirname(__FILE__)) . '/' . basename(__FILE__));

  • wordfence/trunk/lib/menu_options.php

    r2337484 r2353220  
    122122                'wf-option-loginSec-maskLoginErrors' => __('Don\'t let WordPress reveal valid users in login errors', 'wordfence'),
    123123                'wf-option-loginSec-blockAdminReg' => __('Prevent users registering "admin" username if it doesn\'t exist', 'wordfence'),
    124                 'wf-option-loginSec-disableAuthorScan' => __('Prevent discovery of usernames through "/?author=N" scans, the oEmbed API, and the WordPress REST API', 'wordfence'),
     124                'wf-option-loginSec-disableAuthorScan' => __('Prevent discovery of usernames through "/?author=N" scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps', 'wordfence'),
    125125                'wf-option-other-blockBadPOST' => __('Block IPs who send POST requests with blank User-Agent and Referer', 'wordfence'),
    126126                'wf-option-blockCustomText' => __('Custom text shown on block pages', 'wordfence'),

  • wordfence/trunk/lib/rest-api/wfRESTAuthenticationController.php

    r2131558 r2353220  
    2929            'methods'  => WP_REST_Server::READABLE,
    3030            'callback' => array($this, 'nonce'),
     31            'permission_callback' => '__return_true',
    3132        ));
    3233        register_rest_route('wordfence/v1', '/authenticate', array(
    3334            'methods'  => WP_REST_Server::CREATABLE,
    3435            'callback' => array($this, 'authenticate'),
     36            'permission_callback' => '__return_true',
    3537        ));
    3638        register_rest_route('wordfence/v1', '/authenticate-premium', array(
    3739            'methods'  => WP_REST_Server::CREATABLE,
    3840            'callback' => array($this, 'authenticatePremium'),
     41            'permission_callback' => '__return_true',
    3942        ));
    4043    }

  • wordfence/trunk/lib/wfConfig.php

    r2337484 r2353220  
    935935        if (version_compare(PHP_VERSION, '5.3', '<')) {
    936936            return;
     937        }
     938
     939        // Prevent WF auto-update if the user has enabled auto-update through the plugins page.
     940        if (version_compare(wfUtils::getWPVersion(), '5.5-x', '>=')) {
     941            $autoUpdatePlugins = get_site_option('auto_update_plugins');
     942            if (is_array($autoUpdatePlugins) && in_array(WORDFENCE_BASENAME, $autoUpdatePlugins)) {
     943                return;
     944            }
    937945        }
    938946

  • wordfence/trunk/lib/wordfenceClass.php

    r2337484 r2353220  
    12711271            add_filter('rest_request_before_callbacks', 'wordfence::jsonAPIAuthorFilter', 99, 3);
    12721272            add_filter('rest_post_dispatch', 'wordfence::jsonAPIAdjustHeaders', 99, 3);
     1273            add_filter('wp_sitemaps_users_pre_url_list', '__return_false', 99, 0);
     1274            add_filter('wp_sitemaps_add_provider', 'wordfence::wpSitemapUserProviderFilter', 99, 2);
    12731275        }
    12741276       
    … …  
    25592561       
    25602562        return $response;
     2563    }
     2564    public static function wpSitemapUserProviderFilter($provider, $name) {
     2565        if ($name === 'users') {
     2566            return false;
     2567        }
     2568        return $provider;
    25612569    }
    25622570    public static function _filterCentralFromLiveTraffic($dispatch_result, $request, $route, $handler) {

  • wordfence/trunk/modules/login-security/wordfence-login-security.php

    r2337484 r2353220  
    2828   
    2929    define('WORDFENCE_LS_VERSION', '1.0.5');
    30     define('WORDFENCE_LS_BUILD_NUMBER', '1594219913');
     30    define('WORDFENCE_LS_BUILD_NUMBER', '1596638737');
    3131   
    3232    if (!defined('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES')) { define('WORDFENCE_LS_EMAIL_VALIDITY_DURATION_MINUTES', 15); }

  • wordfence/trunk/readme.txt

    r2337496 r2353220  
    44Requires at least: 3.9
    55Requires PHP: 5.3
    6 Tested up to: 5.4
     6Tested up to: 5.5
    77Stable tag: 7.4.9
    88
    … …  
    183183
    184184== Changelog ==
     185
     186= 7.4.10 - August 5, 2020 =
     187
     188* Improvement: Prevent author sitemap from leaking usernames in WordPress >= 5.5.0.
     189* Fix: Prevent Wordfence auto-update from running if the user has enabled auto-update through WordPress.
     190* Fix: Added default `permission_callback` params to Wordfence Central REST routes.
     191* Fix: Fixed missing styling on WAF optimization admin notice.
    185192
    186193= 7.4.9 - July 8, 2020 =

  • wordfence/trunk/views/waf/options-group-brute-force.php

    r2087795 r2353220  
    212212                            'disabledValue' => 0,
    213213                            'value' => wfConfig::get('loginSec_disableAuthorScan') ? 1 : 0,
    214                             'title' => __('Prevent discovery of usernames through \'/?author=N\' scans, the oEmbed API, and the WordPress REST API', 'wordfence'),
     214                            'title' => __('Prevent discovery of usernames through \'/?author=N\' scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps', 'wordfence'),
    215215                            'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_PREVENT_AUTHOR_SCAN),
    216216                        ))->render();

  • wordfence/trunk/wordfence.php

    r2337484 r2353220  
    55Description: Wordfence Security - Anti-virus, Firewall and Malware Scan
    66Author: Wordfence
    7 Version: 7.4.9
     7Version: 7.4.10
    88Author URI: http://www.wordfence.com/
    99Network: true
    … …  
    1616    exit;
    1717}
    18 define('WORDFENCE_VERSION', '7.4.9');
    19 define('WORDFENCE_BUILD_NUMBER', '1594219913');
     18define('WORDFENCE_VERSION', '7.4.10');
     19define('WORDFENCE_BUILD_NUMBER', '1596638737');
    2020define('WORDFENCE_BASENAME', function_exists('plugin_basename') ? plugin_basename(__FILE__) :
    2121    basename(dirname(__FILE__)) . '/' . basename(__FILE__));
Note: See TracChangeset for help on using the changeset viewer.