v1.5.1: frontend auth hardening — rate limiting, email verification, honeypots, CSV safety
Security-only release per ADR-0001. Closes all six ship-blockers from the post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account enumeration via separate error messages), PSEC-003 (registration auto-login with no email verification), PSEC-004 (ungated "My Data" templates), PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no honeypot/CAPTCHA on public forms). Adds inc/config.php (single source of truth for all security thresholds, filterable via peptide_starter_security_config), inc/rate-limiter.php (Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver, transient-backed, never stores raw IPs), and inc/email-verification.php (43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint). Auth handlers rewritten to: unify all failure messages, rate-limit before any expensive check, drop registrations with a filled honeypot silently, stop auto-login on register, send a verification email instead. The require_login() helper lives in inc/helpers.php and is applied at the top of page-tracker.php, page-subject-log.php, and page-protocol-builder.php; page-calculator.php stays open (no PII, no writes). Newsletter signup gains: consent checkbox, privacy link, honeypot, autoload=false on the wp_options blob, unsubscribe token stored per row, /newsletter-unsubscribe route, merged success+duplicate into a single "ok" state. Admin export runs every cell through peptide_starter_csv_safe() which prefixes leading =/+/-/@/tab/CR with a quote. Contact handler hardens against email-header injection (rejects name values with \r \n , < >), rate-limits, honors honeypot, tags mail failures with a request ID for correlation without logging message content. Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail probe so we can check Hostinger outbound deliverability any time it looks flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1 subscribers into the verification flow (currently a no-op — zero users — but guarded for the future). Other cleanup from the audit: fallback primary menu moved out of header.php into inc/helpers.php (redeclaration risk), placeholder footer language links replaced with "Translations coming soon", footer copyright now reads through the customizer getter, settings-panel gains a proper Tab/Shift+Tab focus trap and saves/restores body overflow, documentation heading IDs slugified from heading text with collision counters, JS files standardized on const/let. Six new PHPUnit suites cover rate limiter lifecycle, auth handler error unification and rate limits, email verification token generation and expiry, contact handler header injection + rate limit + honeypot, newsletter signup consent + CSV safety, and require_login gate behavior. ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new module layout, data flows, security patterns for rate-limiting, honeypotting, gating, and CSV-safe export. Version bumped to 1.5.1 in style.css and functions.php. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
@@ -1,36 +1,37 @@
|
||||
/**
|
||||
* Authentication Page — Form Toggle & Validation
|
||||
* Authentication Page — Form Toggle & AJAX
|
||||
* Peptide Starter Theme
|
||||
*
|
||||
* Handles:
|
||||
* - Toggle between sign-in and register forms
|
||||
* - Client-side form validation
|
||||
* - Password strength indicator
|
||||
* - AJAX form submission to avoid full page reload
|
||||
* - AJAX form submission (no redirect on register — success message only)
|
||||
* - XSS-safe message rendering
|
||||
*
|
||||
* @see page-auth.php — renders the auth forms
|
||||
* @see functions.php — AJAX handlers (ps_auth_login, ps_auth_register)
|
||||
* @see page-auth.php — renders the forms
|
||||
* @see inc/auth-handlers.php — ps_auth_login / ps_auth_register
|
||||
*
|
||||
* Conditionally enqueued only on pages using the Sign In / Register template.
|
||||
* Conditionally enqueued on pages using the Sign In / Register template.
|
||||
*/
|
||||
|
||||
(function() {
|
||||
(function () {
|
||||
'use strict';
|
||||
|
||||
var loginWrap = document.getElementById('ps-auth-login');
|
||||
var registerWrap = document.getElementById('ps-auth-register');
|
||||
var showRegister = document.getElementById('ps-show-register');
|
||||
var showLogin = document.getElementById('ps-show-login');
|
||||
var messages = document.getElementById('ps-auth-messages');
|
||||
var loginForm = document.getElementById('ps-login-form');
|
||||
var registerForm = document.getElementById('ps-register-form');
|
||||
const loginWrap = document.getElementById('ps-auth-login');
|
||||
const registerWrap = document.getElementById('ps-auth-register');
|
||||
const showRegister = document.getElementById('ps-show-register');
|
||||
const showLogin = document.getElementById('ps-show-login');
|
||||
const messages = document.getElementById('ps-auth-messages');
|
||||
const loginForm = document.getElementById('ps-login-form');
|
||||
const registerForm = document.getElementById('ps-register-form');
|
||||
|
||||
if (!loginWrap || !registerWrap) {
|
||||
return;
|
||||
}
|
||||
|
||||
/**
|
||||
* Toggle between login and register views.
|
||||
* Swap which form is visible. Uses a class, not inline style, so the
|
||||
* stylesheet is the single source of truth.
|
||||
* @param {string} view - 'login' or 'register'.
|
||||
*/
|
||||
function showView(view) {
|
||||
@@ -45,121 +46,128 @@
|
||||
}
|
||||
|
||||
if (showRegister) {
|
||||
showRegister.addEventListener('click', function(e) {
|
||||
showRegister.addEventListener('click', function (e) {
|
||||
e.preventDefault();
|
||||
showView('register');
|
||||
});
|
||||
}
|
||||
|
||||
if (showLogin) {
|
||||
showLogin.addEventListener('click', function(e) {
|
||||
showLogin.addEventListener('click', function (e) {
|
||||
e.preventDefault();
|
||||
showView('login');
|
||||
});
|
||||
}
|
||||
|
||||
// Check URL hash on load for deep linking.
|
||||
if (window.location.hash === '#register') {
|
||||
showView('register');
|
||||
}
|
||||
|
||||
/**
|
||||
* Display a message in the auth messages area.
|
||||
* @param {string} text - Message text.
|
||||
* @param {string} type - 'success', 'error', or 'info'.
|
||||
* Render a message in the messages region. Text is escaped.
|
||||
* @param {string} text
|
||||
* @param {string} type - 'success' | 'error' | 'info'.
|
||||
*/
|
||||
function showMessage(text, type) {
|
||||
if (!messages) {
|
||||
return;
|
||||
}
|
||||
var alertClass = 'ps-alert ps-alert-' + (type || 'info');
|
||||
messages.innerHTML = '<div class="' + alertClass + '"><p>' + escapeHtml(text) + '</p></div>';
|
||||
if (!messages) return;
|
||||
const wrap = document.createElement('div');
|
||||
wrap.className = 'ps-alert ps-alert-' + (type || 'info');
|
||||
const p = document.createElement('p');
|
||||
p.textContent = text;
|
||||
wrap.appendChild(p);
|
||||
messages.innerHTML = '';
|
||||
messages.appendChild(wrap);
|
||||
}
|
||||
|
||||
function clearMessages() {
|
||||
if (messages) {
|
||||
messages.innerHTML = '';
|
||||
}
|
||||
if (messages) { messages.innerHTML = ''; }
|
||||
}
|
||||
|
||||
/**
|
||||
* Escape HTML entities to prevent XSS in message display.
|
||||
* @param {string} str - Raw string.
|
||||
* @returns {string} Escaped string.
|
||||
*/
|
||||
function escapeHtml(str) {
|
||||
var div = document.createElement('div');
|
||||
div.textContent = str;
|
||||
return div.innerHTML;
|
||||
}
|
||||
|
||||
/**
|
||||
* Password strength indicator.
|
||||
* Updates the #ps-password-strength element with a rating.
|
||||
*/
|
||||
var passwordInput = document.getElementById('ps-reg-password');
|
||||
var strengthEl = document.getElementById('ps-password-strength');
|
||||
// Password strength indicator (registration form).
|
||||
const passwordInput = document.getElementById('ps-reg-password');
|
||||
const strengthEl = document.getElementById('ps-password-strength');
|
||||
|
||||
if (passwordInput && strengthEl) {
|
||||
passwordInput.addEventListener('input', function() {
|
||||
var val = passwordInput.value;
|
||||
var score = 0;
|
||||
var label = '';
|
||||
passwordInput.addEventListener('input', function () {
|
||||
const val = passwordInput.value;
|
||||
let score = 0;
|
||||
|
||||
if (val.length >= 8) { score++; }
|
||||
if (val.length >= 12) { score++; }
|
||||
if (/[a-z]/.test(val) && /[A-Z]/.test(val)) { score++; }
|
||||
if (/\d/.test(val)) { score++; }
|
||||
if (/[^a-zA-Z0-9]/.test(val)) { score++; }
|
||||
if (val.length >= 8) { score++; }
|
||||
if (val.length >= 12) { score++; }
|
||||
if (/[a-z]/.test(val) && /[A-Z]/.test(val)) { score++; }
|
||||
if (/\d/.test(val)) { score++; }
|
||||
if (/[^a-zA-Z0-9]/.test(val)) { score++; }
|
||||
|
||||
if (val.length === 0) {
|
||||
label = '';
|
||||
} else if (score <= 1) {
|
||||
label = '<span class="ps-strength-weak">Weak</span>';
|
||||
} else if (score <= 3) {
|
||||
label = '<span class="ps-strength-fair">Fair</span>';
|
||||
} else {
|
||||
label = '<span class="ps-strength-strong">Strong</span>';
|
||||
let className = '';
|
||||
let label = '';
|
||||
if (val.length === 0) { className = ''; }
|
||||
else if (score <= 1) { className = 'ps-strength-weak'; label = 'Weak'; }
|
||||
else if (score <= 3) { className = 'ps-strength-fair'; label = 'Fair'; }
|
||||
else { className = 'ps-strength-strong'; label = 'Strong'; }
|
||||
|
||||
strengthEl.innerHTML = '';
|
||||
if (className) {
|
||||
const span = document.createElement('span');
|
||||
span.className = className;
|
||||
span.textContent = label;
|
||||
strengthEl.appendChild(span);
|
||||
}
|
||||
|
||||
strengthEl.innerHTML = label;
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* AJAX form submission handler.
|
||||
* @param {HTMLFormElement} form - The form to submit.
|
||||
* Submit a form via AJAX to admin-ajax. Login success redirects; register
|
||||
* success shows an inbox-check message (no redirect — email verification
|
||||
* is the next step).
|
||||
* @param {HTMLFormElement} form
|
||||
* @param {string} kind - 'login' or 'register'.
|
||||
*/
|
||||
function submitForm(form) {
|
||||
var formData = new FormData(form);
|
||||
var btn = form.querySelector('button[type="submit"]');
|
||||
var origText = btn.textContent;
|
||||
function submitForm(form, kind) {
|
||||
const formData = new FormData(form);
|
||||
const btn = form.querySelector('button[type="submit"]');
|
||||
const origText = btn.textContent;
|
||||
|
||||
btn.disabled = true;
|
||||
btn.textContent = '...';
|
||||
clearMessages();
|
||||
|
||||
var xhr = new XMLHttpRequest();
|
||||
xhr.open('POST', (typeof peptideStarterData !== 'undefined' ? peptideStarterData.ajaxUrl : '/wp-admin/admin-ajax.php'));
|
||||
const xhr = new XMLHttpRequest();
|
||||
const url = (typeof window.peptideStarterData !== 'undefined' && window.peptideStarterData.ajaxUrl)
|
||||
? window.peptideStarterData.ajaxUrl
|
||||
: '/wp-admin/admin-ajax.php';
|
||||
xhr.open('POST', url);
|
||||
xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
|
||||
|
||||
xhr.onload = function() {
|
||||
xhr.onload = function () {
|
||||
btn.disabled = false;
|
||||
btn.textContent = origText;
|
||||
|
||||
try {
|
||||
var resp = JSON.parse(xhr.responseText);
|
||||
if (resp.success && resp.data && resp.data.redirect) {
|
||||
window.location.href = resp.data.redirect;
|
||||
} else {
|
||||
showMessage(resp.data && resp.data.message ? resp.data.message : 'An error occurred.', 'error');
|
||||
}
|
||||
} catch (e) {
|
||||
let resp;
|
||||
try { resp = JSON.parse(xhr.responseText); } catch (e) {
|
||||
showMessage('An unexpected error occurred. Please try again.', 'error');
|
||||
return;
|
||||
}
|
||||
|
||||
if (resp && resp.success) {
|
||||
if (kind === 'login' && resp.data && resp.data.redirect) {
|
||||
window.location.href = resp.data.redirect;
|
||||
return;
|
||||
}
|
||||
if (kind === 'register' && resp.data && resp.data.message) {
|
||||
showMessage(resp.data.message, 'success');
|
||||
form.reset();
|
||||
if (strengthEl) { strengthEl.innerHTML = ''; }
|
||||
return;
|
||||
}
|
||||
showMessage('Request completed.', 'success');
|
||||
return;
|
||||
}
|
||||
|
||||
const msg = (resp && resp.data && resp.data.message) ? resp.data.message : 'An error occurred.';
|
||||
showMessage(msg, 'error');
|
||||
};
|
||||
|
||||
xhr.onerror = function() {
|
||||
xhr.onerror = function () {
|
||||
btn.disabled = false;
|
||||
btn.textContent = origText;
|
||||
showMessage('Network error. Please check your connection.', 'error');
|
||||
@@ -169,24 +177,29 @@
|
||||
}
|
||||
|
||||
if (loginForm) {
|
||||
loginForm.addEventListener('submit', function(e) {
|
||||
loginForm.addEventListener('submit', function (e) {
|
||||
e.preventDefault();
|
||||
if (!loginForm.checkValidity()) {
|
||||
loginForm.reportValidity();
|
||||
return;
|
||||
}
|
||||
submitForm(loginForm);
|
||||
submitForm(loginForm, 'login');
|
||||
});
|
||||
}
|
||||
|
||||
if (registerForm) {
|
||||
registerForm.addEventListener('submit', function(e) {
|
||||
registerForm.addEventListener('submit', function (e) {
|
||||
e.preventDefault();
|
||||
if (!registerForm.checkValidity()) {
|
||||
registerForm.reportValidity();
|
||||
return;
|
||||
}
|
||||
submitForm(registerForm);
|
||||
submitForm(registerForm, 'register');
|
||||
});
|
||||
}
|
||||
|
||||
// Surface /auth?verify_error=1.
|
||||
if (messages && /[?&]verify_error=1/.test(window.location.search)) {
|
||||
showMessage('That verification link is invalid or has expired. Sign in and request a new one.', 'error');
|
||||
}
|
||||
})();
|
||||
|
||||
Reference in New Issue
Block a user