WordPress.org
Get WordPress

Plugin Directory

Changeset 722992


Ignore:
Timestamp:
06/05/2013 08:42:02 AM (13 years ago)
Author:
planetzuda
Message:

Please read this! The XMLRPC is not off on any current version of this plugin. Code passed around wordpress that is supposed to turn it off, doesn't actually work. If we find a way to disable it, we will add it to an update. We removed the xmlrpc disable feature in this version and updated the readme.txt.

Location:
disable-insecure-features/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • disable-insecure-features/trunk/functions.php

    r712114 r722992  
    22/*
    33Plugin Name: disable insecure features
    4 Plugin URI: http://www.planetzuda.com/news/
    5 Description: This disables pingbacks on previously published posts and pages, disables the xmlrpc, hides the readme.html, license.txt and fixes wp-config.php and .htaccess permissions so hackers can't modify them.
    6 Version: 0.3
     4Plugin URI: http://www.planetzuda.com/news/plugins/
     5Description: This automatically disables pingbacks on old posts and pages, not new ones. This locks down htaccess, hides readme.html, and other files. Credit to Shivanand Sharma from http://binaryturf.com for  SQL statements to disable old post pingbacks.  Version 0.1 through 0.3 said xmlrpc was turned off. We discovered with the help from tw2113 that the WordPress code that claims it disables the xmlrpc, doesn't disable it. This means the plugin disable xmlrpc is useless. We are working to see if there is a way to disable the xmlrpc via plugin.
     6Version: 0.4
    77Author: Planet Zuda, LLC
    8 Author URI: http://www.planetzuda.com/news/plugins/
     8Author URI: http://www.planetzuda.com/news/
    99License: GPLv2
    1010*/
    … …  
    4646add_action('admin_menu','swph_setup');
    4747
    48 function no_more_xmlrpc()
    49 {
    50 add_filter( 'xmlrpc_enabled', '__return_false' ); //
    51 }
    52 function swph_xmlrpc()
    53 {
    54 add_filter( 'xmlrpc_enabled', '__return_true' );
    55 }
    5648
    5749
    5850function swph_auto_disabled_features()
    5951{
     52
     53   
    6054// the following turns off pingbacks for already published posts and pages
    6155global $wpdb;
     56
    6257$wpdb->query("UPDATE $wpdb->posts SET ping_status='closed' WHERE post_status = 'publish' AND post_type = 'post';");
    6358$wpdb->query("UPDATE $wpdb->posts SET ping_status='closed' WHERE post_status = 'publish' AND post_type = 'page';");
    64 // this will lock down the readme.html so hackers can't see it.
    6559
    66 // the rest is by us. All chmod files will be moved to the .htaccess in the future.
     60//thank you to http://wordpress.stackexchange.com/questions/78780/xmlrpc-enabled-filter-not-called for this answer and tw2113 for helping out in the wordpress IRC. This may be implemented in the future.
    6761
    68 $swph_readme = ABSPATH . 'readme.html';
     62$swph_readme = ABSPATH . 'readme.html'; // you don't want people to see what version of WordPress you're running.
    6963if(file_exists($swph_readme))
    7064{
    71 chmod($swph_readme,0600);
     65chmod($swph_readme,0600); // makes it seem like the file doesn't exist for users who look for it.
    7266}
    7367
    … …  
    8478chmod($swph_config,0600);
    8579}
     80
    8681// lock down the .htaccess so hackers can't write to it via bad permissions.
    8782$swph_access = ABSPATH . '.htaccess';
    … …  
    9085chmod($swph_access,0644);
    9186}
    92 else
    93 {
    94 ?>
    95  you moved your wp-config file, so we can't secure it. Sorry.
    96 <?php
    97 }
    98 /*
    99 botme needs a lot more work before it is auto enabled.
    100 */
    101 }
    102 
     87} // closes function
    10388register_activation_hook(__FILE__,'swph_auto_disabled_features');
    104 function botme()
    105 {
    106 $bot = WP_PLUGIN_DIR . '/disable-insecure-features/robots.txt';
    107 $newbot =  ABSPATH . 'robots.txt';
    108 if(file_exists($newbot))
    109 {
    110 copy($bot,$newbot);
    111 chmod($newbot,0644);
    112 }
    113 else
    114 {
    115 fopen($newbot,"a+");
    116 fclose($newbot,"a+");
    117 copy($bot,$newbot);
    118 chmod($newbot,0644);
    119 }
    120 } // closes botme()
    12189
    12290
    … …  
    12492{
    12593// settings page put all variables up here to make it clean then generate the form.
    126 $swph_url = get_bloginfo('url'); // straight-forward
    127 $swph_on  = swph_xmlrpc(); // turns the xmlrpc on. Not a good idea, but a few people need it.
    128 if($swph_on)
    129 register_activation_hook(__FILE__,'swph_xmlrpc');
    130 ?>
    131 <br />
    132 <input type="radio" value="<?php swph_disable_xmlrpc(); echo 'disabled' // make sure this works before releasing it. Test it with a xmlrpc program. ?> turn off xmlrpc"> Turn off XMLRPC
    133 <input type="submit" value="Submit">
    134 <?php
    135 if(!$swph_on)
    136 register_activation_hook(__FILE__,'swph_disable_xmlrpc');
    137 ?>
    138 
    139 <input type="radio" value="<?php $swph_on; echo 'enabled'; // make sure this works before releasing it. Test it with a xmlrpc program. ?> turn on xmlrpc "> Turn on XMLRPC
    140 <input type="submit" value="Submit">
    141 <?php
    142 
    143 ?>
    144 Please go to <a href="<?php echo $swph_url; ?>/wp-admin/options-discussion.php"> settings->discussion </a> and uncheck the box next to the words that say "Allow link notifications from other blogs (pingbacks and trackbacks)"
    145  <br /> then click save changes. This will disable any pingbacks for future posts and pages. This plugin automatically disables pingbacks for posts and pages already published. It also disables the xmlrpc.<br />
    146  This is important since hackers are abusing these features to hack other sites. <br />
    147  A future update will let you turn pingbacks on for old posts and pages and re-enable the xmlrpc, even though we really don't recommend it.
     94 
     95?>     
     96 Disable pingbacks for future posts by going to <a href="<?php $swph_url; ?>/wp-admin/options-discussion.php"> settings->discussion </a> and uncheck the box that say "Allow link notifications from other blogs (pingbacks and trackbacks)"
     97 <br />
    14898<?php
    14999}
    150 
    151 function swph_disable_xmlrpc()
    152 {
    153 add_filter( 'xmlrpc_enabled', 'no_more_xmlrpc' );
    154 }
     100?>

  • disable-insecure-features/trunk/readme.txt

    r712114 r722992  
    33Contributors: Planet Zuda, LLC
    44Tags: comments, spam, hacking, security,wordpress security, readme, htaccess, license, remove version, version, wp-config,
    5 Requires at least: 3.0.1
     5Requires at least: 3.0
    66Tested up to: 3.5.1
    77Stable tag: 3.5.1
    … …  
    1111== Description ==
    1212
    13 This disables pingbacks on previously published posts and pages, disables the xmlrpc, hides the readme.html, license.txt and fixes wp-config.php and .htaccess permissions so hackers can't modify them.
     13This disables pingbacks on previously published posts and pages,hides the readme.html, license.txt and fixes wp-config.php and .htaccess permissions so hackers can't modify them.
    1414== Installation ==
    15 
    16 1. Upload the disable-insecure-features directory to the `/wp-content/plugins/` directory in your WordPress installation
    17 2. Activate the plugin through the 'Plugins' menu in WordPress
    18 3. Pingbacks for previously published posts and pages are disabled and so is the XML-RPC!
     151. Go to your WordPress admin dashboard and go to  plugins > add new and then type disable insecure features. Our plugin will come up.
     16   click install now and then hit activate now.
     17   2. You are now more secure.
     18   
    1919== Credits ==
    20 We would like to give credit where credit is due. We would like to thank Shivanand Sharma from http://binaryturf.com for his article on disabling pingbacks from previously published posts and pages. The disabling feature of the xml-rpc is from the disable xml-rpc plugin, so they also deserve credit. 
     20We would like to give credit where credit is due. We would like to thank Shivanand Sharma from http://binaryturf.com for his article on disabling pingbacks from previously published posts and pages.
    2121== Frequently Asked Questions ==
    2222
    … …  
    3434= Will the readme.html, license.txt, wp-config.php, .htaccess or any other file reset to insecure permissions if I delete this plugin? =
    3535No.
     36= Does this plugin disable the XMLRPC?
     37No. Code has been passed around WordPress claiming that it disables the XMLRPC and there is even a plugin called disable xmlrpc using that code, but it doesn't work
     38= Will you be disabling the xmlrpc in the future?
     39Hopefully. We are looking into how we can turn it off via the plugin.
     40= I don't want pingbacks turned off for future posts. WIll this plugin do that?
     41Whenever you update the core or reactivate the plugin your pingbacks for all published posts and pages will be turned off.
    3642== Changelog ==
     43=0.4=
     44We discovered that the code everyone is using to disable the xmlrpc for 3.5 and up isn't disabling the xmlrpc, so we've removed that feature. We hope to actually disable the xmlrpc if at all possible.
     45= 0.3 =
     46changes permissions for readme.html, license.txt, and .htaccess. It makes it so readme.html and license.txt can't be accessed by visitors. It makes sure .htaccess has the appropiate permissions.
    3747
    3848= 0.2 =
Note: See TracChangeset for help on using the changeset viewer.