WordPress.org
Get WordPress

Plugin Directory

Changeset 2929413 for anrghg


Ignore:
Timestamp:
06/21/2023 11:19:04 PM (3 years ago)
Author:
anrghg
Message:

1.10.1,0

1.10.1 (2023-06-21)

  • Settings: Security: Modify the warning about shared hosting, after validation by a hosting provider.
  • Documentation: Security: Modify the warning about shared hosting, after validation by a hosting provider.
Location:
anrghg
Files:
16 edited
1 copied

Legend:

Unmodified
Added
Removed

  • anrghg/tags/1.10.1/admin/options/settings-cb-access.php

    r2918017 r2929413  
    5656    anrghg_introduction(
    5757        'important',
    58         __( 'This security feature is efficient only on websites hosted on a Virtual Private Server (VPS) or a dedicated server.', 'anrghg' ),
    59         __( 'Shared hosting can be hacked by webshell, from any website in the same root directory.', 'anrghg' )
     58        __( 'This security feature is efficient only on websites hosted on a dedicated server, a Virtual Private Server (VPS), or shared hosting with VPS level security set up by the hosting provider.', 'anrghg' ),
     59        __( 'Unless the hosting provider has set up VPS level security, shared hosting can be hacked by web shell from any website in the same root directory.', 'anrghg' )
    6060    );
    6161    anrghg_introduction(

  • anrghg/tags/1.10.1/anrghg.php

    r2918017 r2929413  
    1414 * Tested PHP up to: 8.1
    1515 * CAUTION: The following field is parsed in the `stable tag` folder for upgrade configuration:
    16  * Version: 1.10.0
     16 * Version: 1.10.1
    1717 * Author: ANRGHG
    1818 * Author URI: https://anrghg.sunsite.fr
    … …  
    3939 *
    4040 * Fixes:
     41 * @todo Add option to clean up errand meta tags in HTML output, or in editor. Raise issue to WP Core.
    4142 * @todo Code: Switch to object oriented.
    4243 * @todo Documentation: Plugin list: Add mention “AMP compatible”.
    … …  
    117118 * @var string C_S_ANRGHG_VER  Plugin version constant.
    118119 */
    119 define( 'C_S_ANRGHG_VER', '1.10.0' );
     120define( 'C_S_ANRGHG_VER', '1.10.1' );
    120121
    121122/**
    … …  
    191192 * its development without making sure that the job will be done effectively. The
    192193 * unaddressed Footnotes user requests are followed up in this new plugin started
    193  * after it had become clear to me that there was no other way left.
     194 * after it had become clear to me that there remained no other way forward.
    194195 * @pewgeuges provided support to Footnotes users from 2020-10-26 to 2022-03-29,
    195196 * until the Footnotes plugin was abandoned on 2022-04-14.
    … …  
    221222 * Style sheets.
    222223 *
    223  * @see * Outputs internal CSS.
    224  * @see anrghg_protected_echo().
    225224 * External style sheets appear to have too many and too serious downsides:
    226225 *
    … …  
    235234 *   internal.
    236235 *
     236 * @see * Outputs internal CSS.
     237 * @see anrghg_protected_echo().
     238 *
     239 *
     240 * Separators in class names:
     241 *
    237242 * Class names derived from settings keys still contain underscores but as far as
    238243 * possible, CSS classes use hyphen only. Identifiers used in URLs, likewise. But
    … …  
    248253 * are even harder to keep in sync. Loading partials has certainly downsides from
    249254 * a performance perspective.
     255 *
    250256 * Instead, filters may be added to a set of output hooks.
    251257 */

  • anrghg/tags/1.10.1/package.json

    r2918017 r2929413  
    11{
    22    "name": "anrghg",
    3     "version": " 1.10.0",
     3    "version": " 1.10.1",
    44    "description": "A.N.R.GHG Publishing Toolkit",
    55    "main": "index.js",

  • anrghg/tags/1.10.1/readme.txt

    r2918017 r2929413  
    88Requires PHP: 5.6
    99Tested PHP up to: 8.1
    10 Package Version: 1.10.0.0
    11 Version: 1.10.0
     10Package Version: 1.10.1.0
     11Version: 1.10.1
    1212CAUTION: The following field is parsed in `trunk/` for release configuration:
    13 Stable Tag: 1.10.0
     13Stable Tag: 1.10.1
    1414License: GPLv2 or later
    1515License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    4646* Display the login activation status by icon in the Admin bar;
    4747* Blank the login dialog out if it is convenient to access the WordPress Admin area through the hosting platform exclusively.
    48 * CAUTION: Shared hosting is prone to being hacked by webshell even if only a single one of the hundreds of websites sharing the same server’s root directory is compromised. Therefore, the A.N.R.GHG Publishing Toolkit’s security feature is efficient only on websites hosted on a Virtual Private Server (VPS) or a dedicated server.
     48* CAUTION: Unless the hosting provider has set up VPS level security, shared hosting is prone to being hacked by web shell even if only a single one of the websites sharing the same server’s root directory is compromised. Therefore, the A.N.R.GHG Publishing Toolkit’s security feature is efficient only on websites hosted on a dedicated server, a Virtual Private Server (VPS), or shared hosting with VPS level security set up by the hosting provider.
    4949
    5050
    … …  
    174174= Security =
    175175
    176 Shared hosting is prone to being hacked by webshell even if only a single one of the hundreds of websites sharing the same server’s root directory is compromised. Therefore, the A.N.R.GHG Publishing Toolkit’s security feature is efficient only on websites hosted on a Virtual Private Server (VPS) or a dedicated server.
     176Unless the hosting provider has set up VPS level security, shared hosting is prone to being hacked by web shell even if only a single one of the websites sharing the same server’s root directory is compromised. Therefore, the A.N.R.GHG Publishing Toolkit’s security feature is efficient only on websites hosted on a dedicated server, a Virtual Private Server (VPS), or shared hosting with VPS level security set up by the hosting provider.
    177177
    178178For an additional layer of security, it is recommended to deny access to the `wp-config.php` file, and to the `debug.log` file in case there is any. To achieve this, please add the code snippet provided for the purpose near the bottom of the `template-wp-config.php` file by copy-pasting it from this file in the `anrghg/` plugin folder to the `.htaccess` file in the WordPress root directory.
    … …  
    586586= 1.10.0 (2023-05-27) =
    587587
    588 * Settings: Security: Add warning in the Security section introduction.
    589 * Documentation: Security: Add warning in the Security notice of the Installation section.
    590 * Documentation: Security: Add warning in the Security feature description.
    591 * Documentation: Security: Add warning in the “How about using jQuery?” FAQ item.
    592 * Documentation: Change plugin name from “A.N.R.GHG Publishing Helper“ to “A.N.R.GHG Publishing Toolkit”.
    593 * Documentation: Rename template files from `tpl-*.php` to `template-*.php`.
     588* Settings: Security: Add a warning in the Security section introduction.
     589* Documentation: Security: Add a warning in the Security notice of the Installation section.
     590* Documentation: Security: Add a warning in the Security feature description.
     591* Documentation: Security: Add a warning in the “How about using jQuery?” FAQ item.
     592* Documentation: Change the plugin name from “A.N.R.GHG Publishing Helper” to “A.N.R.GHG Publishing Toolkit”.
     593* Documentation: Rename the template files from `tpl-*.php` to `template-*.php`.
    594594* Documentation: Remove the sample `anrghg-thanks-block.json` file for now.
    595595

  • anrghg/tags/1.10.1/svn-revs.txt

    r2918017 r2929413  
    1111Past revisions:
    1212
     131.10.0.0       2918017  2023-05-27 09:02:28 +0000 (Sat, 27 May 2023)
    13141.9.4.0        2914557  2023-05-19 02:11:49 +0000 (Fri, 19 May 2023)
    14151.9.3.0        2913991  2023-05-17 22:06:16 +0000 (Wed, 17 May 2023)

  • anrghg/tags/1.10.1/template-filter-config.php

    r2918017 r2929413  
    6565 *
    6666 * CAUTION: This security feature is efficient only on websites hosted on
    67  *          a Virtual Private Server (VPS) or a dedicated server.
    68  *
    69  *          Shared hosting can be hacked by webshell, from any website in
    70  *          the same root directory.
     67 *          a dedicated server, a Virtual Private Server (VPS), or shared
     68 *          hosting with VPS level security set up by the hosting provider.
     69 *
     70 *          Unless the hosting provider has set up VPS level security,
     71 *          shared hosting can be hacked by web shell from any website
     72 *          in the same root directory.
     73 *
     74 * @link https://resources.infosecinstitute.com/topic/hacking-a-wordpress-site/
     75 * @date updated_date="05/05/2015" posted_date="05/05/2015"
     76 * @link https://secure.wphackedhelp.com/blog/hack-wordpress-website/
     77 * @date updated_time="2023-01-06T07:34:56+00:00" published_time="2021-02-25T14:16:20+00:00"
     78 * @link https://www.cloudways.com/blog/wordpress-sql-injection-protection/
     79 * @date Updated on December 8, 2021
     80 * @link https://www.getastra.com/blog/knowledge-base/shared-hosting-security-risks/
     81 * @date Updated on: July 22, 2022
     82 * @link https://secure.wphackedhelp.com/blog/web-shell-php-exploit/
     83 * @date Updated on January 4, 2023
     84 *
     85 * Unlike hosting platform login information, WordPress login information
     86 * may be transparent to SQL injection attacks.
     87 *
     88 * Logging into WordPress may be done through the Hosting Platform.
     89 * If this is the only way used to access the Admin area, then the login
     90 * dialog may be blanked out. An optional message may then be displayed
     91 * in its place.
    7192 *
    7293 * This security enhancement optionally prevents a WordPress website from
    … …  
    7798 * bots to monitor that availability in real time.
    7899 *
    79  * Unlike hosting platform login information, WordPress login information
    80  * may be transparent to SQL injection attacks.
    81  *
    82  * Logging into WordPress may be done through the Hosting Platform.
    83  * If this is the only way used to access the Admin area, then the login
    84  * dialog may be blanked out. An optional message may then be displayed
    85  * in its place.
    86  *
    87100 * If logging in on a public page is desired, the authentication cookie
    88101 * generation may be active during narrow windows of opportunity.
    … …  
    104117 * FTP client for editing the file locally.
    105118 *
    106  * @link https://resources.infosecinstitute.com/topic/hacking-a-wordpress-site/
    107  * @link https://secure.wphackedhelp.com/blog/hack-wordpress-website/
    108  * @link https://www.cloudways.com/blog/wordpress-sql-injection-protection/
    109  *
    110119 * The name of the constant is `ANRGHG_WP_LOGIN_ACTIVE` (by default) or
    111120 * `ANRGHG_WP_LOGIN_` plus some letters and underscore as configured so
    … …  
    113122 * @see template in `template-mini-plugin.php`.
    114123 *
    115  *     // Turn login off by replacing true with false:
    116  *     define( 'ANRGHG_WP_LOGIN_ACTIVE', true );
    117  *
    118124 * If the login dialog is not used any longer, alternative high-profile
    119125 * or standard behavior blanks the dialog out and displays a message in
    120  * its place (high profile) or does not elaborate (standard).
     126 * its place, for high profile, or does not elaborate, for standard.
    121127 *
    122128 * This option is based on code from Jonathan Daggerhart (@daggerhart on GitHub).

  • anrghg/tags/1.10.1/template-mini-plugin.php

    r2918017 r2929413  
    66 * @package WordPress
    77 *
    8  * Description: My configuration filters and output filters.
     8 * Description: Access toggle, configuration filters and output filters.
    99 *
    1010 * Installation:
    … …  
    1717 *
    1818 * Once this mini plugin is activated, the filters copy-pasted from the filter template
    19  * files, become effective and override the settings.
     19 * files or already present below become effective and override the settings configured
     20 * on the A.N.R.GHG Publishing Toolkit’s Settings page. Also the access toggle constanẗ
     21 * starts determining whether authentication cookies are sent, or whether logging in is
     22 * available at all, depending on the settings.
    2023 *
    2124 * @see anrghg/template-filter-config.php
    … …  
    4043 *
    4144 * CAUTION: This security feature is efficient only on websites hosted on
    42  *          a Virtual Private Server (VPS) or a dedicated server.
     45 *          a dedicated server, a Virtual Private Server (VPS), or shared
     46 *          hosting with VPS level security set up by the hosting provider.
    4347 *
    44  *          Shared hosting can be hacked by webshell, from any website in
    45  *          the same root directory.
     48 *          Unless the hosting provider has set up VPS level security,
     49 *          shared hosting can be hacked by web shell from any website
     50 *          in the same root directory.
    4651 *
    47  * This security enhancement optionally prevents a WordPress website from
    48  * sending auth cookies, either by blocking auth cookie generation, or by
    49  * making the login dialog unavailable in the first place, an option that
    50  * must not be chosen if the login dialog is still used sporadically.
    51  * Making a public page reflect the availability of an action would allow
    52  * bots to monitor that availability in real time.
     52 * @link https://resources.infosecinstitute.com/topic/hacking-a-wordpress-site/
     53 * @date updated_date="05/05/2015" posted_date="05/05/2015"
     54 * @link https://secure.wphackedhelp.com/blog/hack-wordpress-website/
     55 * @date updated_time="2023-01-06T07:34:56+00:00" published_time="2021-02-25T14:16:20+00:00"
     56 * @link https://www.cloudways.com/blog/wordpress-sql-injection-protection/
     57 * @date Updated on December 8, 2021
     58 * @link https://www.getastra.com/blog/knowledge-base/shared-hosting-security-risks/
     59 * @date Updated on: July 22, 2022
     60 * @link https://secure.wphackedhelp.com/blog/web-shell-php-exploit/
     61 * @date Updated on January 4, 2023
    5362 *
    5463 * Unlike hosting platform login information, WordPress login information
    … …  
    5968 * dialog may be blanked out. An optional message may then be displayed
    6069 * in its place.
     70 *
     71 * This security enhancement optionally prevents a WordPress website from
     72 * sending auth cookies, either by blocking auth cookie generation, or by
     73 * making the login dialog unavailable in the first place, an option that
     74 * must not be chosen if the login dialog is still used sporadically.
     75 * Making a public page reflect the availability of an action would allow
     76 * bots to monitor that availability in real time.
    6177 *
    6278 * If logging in on a public page is desired, the authentication cookie
    … …  
    7995 * FTP client for editing the file locally.
    8096 *
    81  * @link https://resources.infosecinstitute.com/topic/hacking-a-wordpress-site/
    82  * @link https://secure.wphackedhelp.com/blog/hack-wordpress-website/
    83  * @link https://www.cloudways.com/blog/wordpress-sql-injection-protection/
    84  *
    8597 * The name of the constant is `ANRGHG_WP_LOGIN_ACTIVE` (by default) or
    8698 * `ANRGHG_WP_LOGIN_` plus some letters and underscore as configured so
    … …  
    88100 * @see template in `template-mini-plugin.php`.
    89101 *
    90  *     // Turn login off by replacing true with false:
    91  *     define( 'ANRGHG_WP_LOGIN_ACTIVE', true );
    92  *
    93102 * If the login dialog is not used any longer, alternative high-profile
    94103 * or standard behavior blanks the dialog out and displays a message in
    95  * its place (high profile) or does not elaborate (standard).
     104 * its place, for high profile, or does not elaborate, for standard.
    96105 *
    97106 * This option is based on code from Jonathan Daggerhart (@daggerhart on GitHub).

  • anrghg/tags/1.10.1/template-wp-config.php

    r2918017 r2929413  
    6969// In the process, the wp-config.php file should be protected as well
    7070// by adding "wp-config.php" in the start tag of the Files directive,
    71 // with extended regular expressions supported:
     71// with extended regular expressions supported due to the "~" in the
     72// opening tag of the "Files" directive:
    7273/*
    7374

  • anrghg/trunk/admin/options/settings-cb-access.php

    r2918017 r2929413  
    5656    anrghg_introduction(
    5757        'important',
    58         __( 'This security feature is efficient only on websites hosted on a Virtual Private Server (VPS) or a dedicated server.', 'anrghg' ),
    59         __( 'Shared hosting can be hacked by webshell, from any website in the same root directory.', 'anrghg' )
     58        __( 'This security feature is efficient only on websites hosted on a dedicated server, a Virtual Private Server (VPS), or shared hosting with VPS level security set up by the hosting provider.', 'anrghg' ),
     59        __( 'Unless the hosting provider has set up VPS level security, shared hosting can be hacked by web shell from any website in the same root directory.', 'anrghg' )
    6060    );
    6161    anrghg_introduction(

  • anrghg/trunk/anrghg.php

    r2918017 r2929413  
    1414 * Tested PHP up to: 8.1
    1515 * CAUTION: The following field is parsed in the `stable tag` folder for upgrade configuration:
    16  * Version: 1.10.0
     16 * Version: 1.10.1
    1717 * Author: ANRGHG
    1818 * Author URI: https://anrghg.sunsite.fr
    … …  
    3939 *
    4040 * Fixes:
     41 * @todo Add option to clean up errand meta tags in HTML output, or in editor. Raise issue to WP Core.
    4142 * @todo Code: Switch to object oriented.
    4243 * @todo Documentation: Plugin list: Add mention “AMP compatible”.
    … …  
    117118 * @var string C_S_ANRGHG_VER  Plugin version constant.
    118119 */
    119 define( 'C_S_ANRGHG_VER', '1.10.0' );
     120define( 'C_S_ANRGHG_VER', '1.10.1' );
    120121
    121122/**
    … …  
    191192 * its development without making sure that the job will be done effectively. The
    192193 * unaddressed Footnotes user requests are followed up in this new plugin started
    193  * after it had become clear to me that there was no other way left.
     194 * after it had become clear to me that there remained no other way forward.
    194195 * @pewgeuges provided support to Footnotes users from 2020-10-26 to 2022-03-29,
    195196 * until the Footnotes plugin was abandoned on 2022-04-14.
    … …  
    221222 * Style sheets.
    222223 *
    223  * @see * Outputs internal CSS.
    224  * @see anrghg_protected_echo().
    225224 * External style sheets appear to have too many and too serious downsides:
    226225 *
    … …  
    235234 *   internal.
    236235 *
     236 * @see * Outputs internal CSS.
     237 * @see anrghg_protected_echo().
     238 *
     239 *
     240 * Separators in class names:
     241 *
    237242 * Class names derived from settings keys still contain underscores but as far as
    238243 * possible, CSS classes use hyphen only. Identifiers used in URLs, likewise. But
    … …  
    248253 * are even harder to keep in sync. Loading partials has certainly downsides from
    249254 * a performance perspective.
     255 *
    250256 * Instead, filters may be added to a set of output hooks.
    251257 */

  • anrghg/trunk/package.json

    r2918017 r2929413  
    11{
    22    "name": "anrghg",
    3     "version": " 1.10.0",
     3    "version": " 1.10.1",
    44    "description": "A.N.R.GHG Publishing Toolkit",
    55    "main": "index.js",

  • anrghg/trunk/readme.txt

    r2918017 r2929413  
    88Requires PHP: 5.6
    99Tested PHP up to: 8.1
    10 Package Version: 1.10.0.0
    11 Version: 1.10.0
     10Package Version: 1.10.1.0
     11Version: 1.10.1
    1212CAUTION: The following field is parsed in `trunk/` for release configuration:
    13 Stable Tag: 1.10.0
     13Stable Tag: 1.10.1
    1414License: GPLv2 or later
    1515License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    4646* Display the login activation status by icon in the Admin bar;
    4747* Blank the login dialog out if it is convenient to access the WordPress Admin area through the hosting platform exclusively.
    48 * CAUTION: Shared hosting is prone to being hacked by webshell even if only a single one of the hundreds of websites sharing the same server’s root directory is compromised. Therefore, the A.N.R.GHG Publishing Toolkit’s security feature is efficient only on websites hosted on a Virtual Private Server (VPS) or a dedicated server.
     48* CAUTION: Unless the hosting provider has set up VPS level security, shared hosting is prone to being hacked by web shell even if only a single one of the websites sharing the same server’s root directory is compromised. Therefore, the A.N.R.GHG Publishing Toolkit’s security feature is efficient only on websites hosted on a dedicated server, a Virtual Private Server (VPS), or shared hosting with VPS level security set up by the hosting provider.
    4949
    5050
    … …  
    174174= Security =
    175175
    176 Shared hosting is prone to being hacked by webshell even if only a single one of the hundreds of websites sharing the same server’s root directory is compromised. Therefore, the A.N.R.GHG Publishing Toolkit’s security feature is efficient only on websites hosted on a Virtual Private Server (VPS) or a dedicated server.
     176Unless the hosting provider has set up VPS level security, shared hosting is prone to being hacked by web shell even if only a single one of the websites sharing the same server’s root directory is compromised. Therefore, the A.N.R.GHG Publishing Toolkit’s security feature is efficient only on websites hosted on a dedicated server, a Virtual Private Server (VPS), or shared hosting with VPS level security set up by the hosting provider.
    177177
    178178For an additional layer of security, it is recommended to deny access to the `wp-config.php` file, and to the `debug.log` file in case there is any. To achieve this, please add the code snippet provided for the purpose near the bottom of the `template-wp-config.php` file by copy-pasting it from this file in the `anrghg/` plugin folder to the `.htaccess` file in the WordPress root directory.
    … …  
    586586= 1.10.0 (2023-05-27) =
    587587
    588 * Settings: Security: Add warning in the Security section introduction.
    589 * Documentation: Security: Add warning in the Security notice of the Installation section.
    590 * Documentation: Security: Add warning in the Security feature description.
    591 * Documentation: Security: Add warning in the “How about using jQuery?” FAQ item.
    592 * Documentation: Change plugin name from “A.N.R.GHG Publishing Helper“ to “A.N.R.GHG Publishing Toolkit”.
    593 * Documentation: Rename template files from `tpl-*.php` to `template-*.php`.
     588* Settings: Security: Add a warning in the Security section introduction.
     589* Documentation: Security: Add a warning in the Security notice of the Installation section.
     590* Documentation: Security: Add a warning in the Security feature description.
     591* Documentation: Security: Add a warning in the “How about using jQuery?” FAQ item.
     592* Documentation: Change the plugin name from “A.N.R.GHG Publishing Helper” to “A.N.R.GHG Publishing Toolkit”.
     593* Documentation: Rename the template files from `tpl-*.php` to `template-*.php`.
    594594* Documentation: Remove the sample `anrghg-thanks-block.json` file for now.
    595595

  • anrghg/trunk/svn-revs.txt

    r2918017 r2929413  
    1111Past revisions:
    1212
     131.10.0.0       2918017  2023-05-27 09:02:28 +0000 (Sat, 27 May 2023)
    13141.9.4.0        2914557  2023-05-19 02:11:49 +0000 (Fri, 19 May 2023)
    14151.9.3.0        2913991  2023-05-17 22:06:16 +0000 (Wed, 17 May 2023)

  • anrghg/trunk/template-filter-config.php

    r2918017 r2929413  
    6565 *
    6666 * CAUTION: This security feature is efficient only on websites hosted on
    67  *          a Virtual Private Server (VPS) or a dedicated server.
    68  *
    69  *          Shared hosting can be hacked by webshell, from any website in
    70  *          the same root directory.
     67 *          a dedicated server, a Virtual Private Server (VPS), or shared
     68 *          hosting with VPS level security set up by the hosting provider.
     69 *
     70 *          Unless the hosting provider has set up VPS level security,
     71 *          shared hosting can be hacked by web shell from any website
     72 *          in the same root directory.
     73 *
     74 * @link https://resources.infosecinstitute.com/topic/hacking-a-wordpress-site/
     75 * @date updated_date="05/05/2015" posted_date="05/05/2015"
     76 * @link https://secure.wphackedhelp.com/blog/hack-wordpress-website/
     77 * @date updated_time="2023-01-06T07:34:56+00:00" published_time="2021-02-25T14:16:20+00:00"
     78 * @link https://www.cloudways.com/blog/wordpress-sql-injection-protection/
     79 * @date Updated on December 8, 2021
     80 * @link https://www.getastra.com/blog/knowledge-base/shared-hosting-security-risks/
     81 * @date Updated on: July 22, 2022
     82 * @link https://secure.wphackedhelp.com/blog/web-shell-php-exploit/
     83 * @date Updated on January 4, 2023
     84 *
     85 * Unlike hosting platform login information, WordPress login information
     86 * may be transparent to SQL injection attacks.
     87 *
     88 * Logging into WordPress may be done through the Hosting Platform.
     89 * If this is the only way used to access the Admin area, then the login
     90 * dialog may be blanked out. An optional message may then be displayed
     91 * in its place.
    7192 *
    7293 * This security enhancement optionally prevents a WordPress website from
    … …  
    7798 * bots to monitor that availability in real time.
    7899 *
    79  * Unlike hosting platform login information, WordPress login information
    80  * may be transparent to SQL injection attacks.
    81  *
    82  * Logging into WordPress may be done through the Hosting Platform.
    83  * If this is the only way used to access the Admin area, then the login
    84  * dialog may be blanked out. An optional message may then be displayed
    85  * in its place.
    86  *
    87100 * If logging in on a public page is desired, the authentication cookie
    88101 * generation may be active during narrow windows of opportunity.
    … …  
    104117 * FTP client for editing the file locally.
    105118 *
    106  * @link https://resources.infosecinstitute.com/topic/hacking-a-wordpress-site/
    107  * @link https://secure.wphackedhelp.com/blog/hack-wordpress-website/
    108  * @link https://www.cloudways.com/blog/wordpress-sql-injection-protection/
    109  *
    110119 * The name of the constant is `ANRGHG_WP_LOGIN_ACTIVE` (by default) or
    111120 * `ANRGHG_WP_LOGIN_` plus some letters and underscore as configured so
    … …  
    113122 * @see template in `template-mini-plugin.php`.
    114123 *
    115  *     // Turn login off by replacing true with false:
    116  *     define( 'ANRGHG_WP_LOGIN_ACTIVE', true );
    117  *
    118124 * If the login dialog is not used any longer, alternative high-profile
    119125 * or standard behavior blanks the dialog out and displays a message in
    120  * its place (high profile) or does not elaborate (standard).
     126 * its place, for high profile, or does not elaborate, for standard.
    121127 *
    122128 * This option is based on code from Jonathan Daggerhart (@daggerhart on GitHub).

  • anrghg/trunk/template-mini-plugin.php

    r2918017 r2929413  
    66 * @package WordPress
    77 *
    8  * Description: My configuration filters and output filters.
     8 * Description: Access toggle, configuration filters and output filters.
    99 *
    1010 * Installation:
    … …  
    1717 *
    1818 * Once this mini plugin is activated, the filters copy-pasted from the filter template
    19  * files, become effective and override the settings.
     19 * files or already present below become effective and override the settings configured
     20 * on the A.N.R.GHG Publishing Toolkit’s Settings page. Also the access toggle constanẗ
     21 * starts determining whether authentication cookies are sent, or whether logging in is
     22 * available at all, depending on the settings.
    2023 *
    2124 * @see anrghg/template-filter-config.php
    … …  
    4043 *
    4144 * CAUTION: This security feature is efficient only on websites hosted on
    42  *          a Virtual Private Server (VPS) or a dedicated server.
     45 *          a dedicated server, a Virtual Private Server (VPS), or shared
     46 *          hosting with VPS level security set up by the hosting provider.
    4347 *
    44  *          Shared hosting can be hacked by webshell, from any website in
    45  *          the same root directory.
     48 *          Unless the hosting provider has set up VPS level security,
     49 *          shared hosting can be hacked by web shell from any website
     50 *          in the same root directory.
    4651 *
    47  * This security enhancement optionally prevents a WordPress website from
    48  * sending auth cookies, either by blocking auth cookie generation, or by
    49  * making the login dialog unavailable in the first place, an option that
    50  * must not be chosen if the login dialog is still used sporadically.
    51  * Making a public page reflect the availability of an action would allow
    52  * bots to monitor that availability in real time.
     52 * @link https://resources.infosecinstitute.com/topic/hacking-a-wordpress-site/
     53 * @date updated_date="05/05/2015" posted_date="05/05/2015"
     54 * @link https://secure.wphackedhelp.com/blog/hack-wordpress-website/
     55 * @date updated_time="2023-01-06T07:34:56+00:00" published_time="2021-02-25T14:16:20+00:00"
     56 * @link https://www.cloudways.com/blog/wordpress-sql-injection-protection/
     57 * @date Updated on December 8, 2021
     58 * @link https://www.getastra.com/blog/knowledge-base/shared-hosting-security-risks/
     59 * @date Updated on: July 22, 2022
     60 * @link https://secure.wphackedhelp.com/blog/web-shell-php-exploit/
     61 * @date Updated on January 4, 2023
    5362 *
    5463 * Unlike hosting platform login information, WordPress login information
    … …  
    5968 * dialog may be blanked out. An optional message may then be displayed
    6069 * in its place.
     70 *
     71 * This security enhancement optionally prevents a WordPress website from
     72 * sending auth cookies, either by blocking auth cookie generation, or by
     73 * making the login dialog unavailable in the first place, an option that
     74 * must not be chosen if the login dialog is still used sporadically.
     75 * Making a public page reflect the availability of an action would allow
     76 * bots to monitor that availability in real time.
    6177 *
    6278 * If logging in on a public page is desired, the authentication cookie
    … …  
    7995 * FTP client for editing the file locally.
    8096 *
    81  * @link https://resources.infosecinstitute.com/topic/hacking-a-wordpress-site/
    82  * @link https://secure.wphackedhelp.com/blog/hack-wordpress-website/
    83  * @link https://www.cloudways.com/blog/wordpress-sql-injection-protection/
    84  *
    8597 * The name of the constant is `ANRGHG_WP_LOGIN_ACTIVE` (by default) or
    8698 * `ANRGHG_WP_LOGIN_` plus some letters and underscore as configured so
    … …  
    88100 * @see template in `template-mini-plugin.php`.
    89101 *
    90  *     // Turn login off by replacing true with false:
    91  *     define( 'ANRGHG_WP_LOGIN_ACTIVE', true );
    92  *
    93102 * If the login dialog is not used any longer, alternative high-profile
    94103 * or standard behavior blanks the dialog out and displays a message in
    95  * its place (high profile) or does not elaborate (standard).
     104 * its place, for high profile, or does not elaborate, for standard.
    96105 *
    97106 * This option is based on code from Jonathan Daggerhart (@daggerhart on GitHub).

  • anrghg/trunk/template-wp-config.php

    r2918017 r2929413  
    6969// In the process, the wp-config.php file should be protected as well
    7070// by adding "wp-config.php" in the start tag of the Files directive,
    71 // with extended regular expressions supported:
     71// with extended regular expressions supported due to the "~" in the
     72// opening tag of the "Files" directive:
    7273/*
    7374
Note: See TracChangeset for help on using the changeset viewer.