Changeset 3470719

Timestamp:

02/26/2026 10:24:02 PM (4 weeks ago)

Author:

Marc4

Message:

v0.8

Location:

security-hardener

Files:

• assets/blueprint.json (added)
• tags/0.8 (added)
• tags/0.8/readme.txt (added)
• tags/0.8/security-hardener.php (added)
• tags/0.8/uninstall.php (added)
• trunk/readme.txt (modified) (3 diffs)
• trunk/security-hardener.php (modified) (11 diffs)

security-hardener/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 6.9
 Requires PHP: 8.0
-Stable tag: 0.7
+Stable tag: 0.8
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -53 +53 @@
 > ⚠️ **Important:** Always test security settings in a staging environment first. Some features may affect third-party integrations or plugins.
 
-**Privacy:** This plugin does not send data to external services, does not create custom database tables, and only uses WordPress transients for temporary login attempt tracking.
+**Privacy:** This plugin does not send data to external services and does not create custom database tables. It stores plugin settings and a security event log in the WordPress options table, and uses transients for temporary login attempt tracking. All data is deleted on uninstall.
 
 == Installation ==
@@ -160 +160 @@
 
 == Changelog ==
+
+= 0.8 - 2026-02-26 =
+* Improved: Moved define_security_constants() from plugins_loaded hook to the constructor, ensuring DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS are defined as early as possible in the WordPress lifecycle
+* Improved: Expanded @param docblock for render_checkbox_field() to document all $args keys
+* Added: WordPress Playground blueprint (assets/blueprints/blueprint.json) enabling live plugin preview directly from the WordPress.org plugin directory
+* Fixed: Plugin header description updated to remove REST API restriction option removed in 0.5
+* Fixed: Removed stale phpcs:ignore comment in show_admin_notices() — nonce verification is now correctly documented inline
+* Fixed: Wrapped login block error message with wp_kses_post() for consistent output escaping
+* Fixed: Added esc_url() and esc_html__() to add_settings_link() sprintf output
+* Fixed: Removed redundant get_client_ip() call in log_security_event() — IP resolved once per event
+* Fixed: Added autoload=false to wpsh_security_logs option — logs are only needed on the settings page, not loaded on every request
 
 = 0.7 - 2026-02-21 =

security-hardener/trunk/security-hardener.php

@@ -3 +3 @@
 Plugin Name: Security Hardener
 Plugin URI: https://wordpress.org/plugins/security-hardener/
-Description: Basic hardening: secure headers, disable XML-RPC/pingbacks, hide version, block user enumeration, login errors, IP-based rate limiting, and optional restriction of the REST API.
-Version: 0.7
+Description: Basic hardening: secure headers, disable XML-RPC/pingbacks, hide version, block user enumeration, generic login errors, and IP-based rate limiting.
+Version: 0.8
 Requires at least: 6.0
 Tested up to: 6.9
@@ -20 +20 @@
 
 // Plugin constants
-define( 'WPSH_VERSION', '0.7' );
+define( 'WPSH_VERSION', '0.8' );
 define( 'WPSH_FILE', __FILE__ );
 define( 'WPSH_DIR', plugin_dir_path( __FILE__ ) );
@@ -71 +71 @@
             $this->options = $this->get_options();
 
+            // Define security constants as early as possible
+            $this->define_security_constants();
+
             // Activation/Deactivation hooks
             register_activation_hook( WPSH_FILE, array( $this, 'activate' ) );
@@ -83 +86 @@
          */
         public function init() {
-            // Define security constants early
-            $this->define_security_constants();
-
             // Security headers
             add_action( 'send_headers', array( $this, 'send_security_headers' ) );
@@ -457 +457 @@
                 return new WP_Error(
                     'too_many_attempts',
-                    '<strong>' . esc_html__( 'Error:', 'security-hardener' ) . '</strong> ' . sprintf(
-                        /* translators: %d: number of minutes */
-                        esc_html__( 'Too many failed login attempts. Please try again in %d minutes.', 'security-hardener' ),
-                        $minutes
+                    wp_kses_post(
+                        '<strong>' . esc_html__( 'Error:', 'security-hardener' ) . '</strong> ' . sprintf(
+                            /* translators: %d: number of minutes */
+                            esc_html__( 'Too many failed login attempts. Please try again in %d minutes.', 'security-hardener' ),
+                            $minutes
+                        )
                     )
                 );
@@ -638 +640 @@
             $logs = get_option( 'wpsh_security_logs', array() );
 
+            // Resolve IP once to avoid calling get_client_ip() twice
+            $ip = $this->get_client_ip();
+
             // Add new log entry
             $logs[] = array(
@@ -643 +648 @@
                 'type'       => $event_type,
                 'message'    => $message,
-                'ip'         => $this->get_client_ip(),
+                'ip'         => $ip,
                 'user_agent' => isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '',
             );
@@ -652 +657 @@
             }
 
-            update_option( 'wpsh_security_logs', $logs );
+            // autoload=false: logs are only needed on the settings page, not on every request
+            update_option( 'wpsh_security_logs', $logs, false );
         }
 
@@ -831 +837 @@
          * Render checkbox field
          *
-         * @param array $args Field arguments.
+         * @param array $args {
+         *     Field arguments.
+         *
+         *     @type string $field_id    Option key in the stored options array.
+         *     @type string $description Optional description shown beside the checkbox.
+         * }
          */
         public function render_checkbox_field( $args ) {
@@ -1042 +1053 @@
         public function show_admin_notices() {
             // Clear logs action - verify nonce to prevent CSRF
-            // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-            if ( isset( $_GET['action'] ) && 'clear_logs' === $_GET['action'] && current_user_can( 'manage_options' ) ) {
+            if ( isset( $_GET['action'] ) && 'clear_logs' === $_GET['action'] && current_user_can( 'manage_options' ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- nonce is verified on the next line
                 if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'wpsh_clear_logs' ) ) {
                     wp_die( esc_html__( 'Security check failed.', 'security-hardener' ) );
@@ -1153 +1163 @@
             $settings_link = sprintf(
                 '<a href="%s">%s</a>',
-                admin_url( 'options-general.php?page=security-hardener' ),
-                __( 'Settings', 'security-hardener' )
+                esc_url( admin_url( 'options-general.php?page=security-hardener' ) ),
+                esc_html__( 'Settings', 'security-hardener' )
             );
             array_unshift( $links, $settings_link );