peptide-repo/peptide-starter-theme
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.5.1: frontend auth hardening — rate limiting, email verification, honeypots, CSV safety

Browse Source 
Security-only release per ADR-0001. Closes all six ship-blockers from the
post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account
enumeration via separate error messages), PSEC-003 (registration auto-login
with no email verification), PSEC-004 (ungated "My Data" templates),
PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no
honeypot/CAPTCHA on public forms).

Adds inc/config.php (single source of truth for all security thresholds,
filterable via peptide_starter_security_config), inc/rate-limiter.php
(Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver,
transient-backed, never stores raw IPs), and inc/email-verification.php
(43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint).

Auth handlers rewritten to: unify all failure messages, rate-limit before
any expensive check, drop registrations with a filled honeypot silently,
stop auto-login on register, send a verification email instead. The
require_login() helper lives in inc/helpers.php and is applied at the top
of page-tracker.php, page-subject-log.php, and page-protocol-builder.php;
page-calculator.php stays open (no PII, no writes).

Newsletter signup gains: consent checkbox, privacy link, honeypot,
autoload=false on the wp_options blob, unsubscribe token stored per row,
/newsletter-unsubscribe route, merged success+duplicate into a single "ok"
state. Admin export runs every cell through peptide_starter_csv_safe()
which prefixes leading =/+/-/@/tab/CR with a quote.

Contact handler hardens against email-header injection (rejects name
values with \r \n , < >), rate-limits, honors honeypot, tags mail
failures with a request ID for correlation without logging message
content.

Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail
probe so we can check Hostinger outbound deliverability any time it looks
flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1
subscribers into the verification flow (currently a no-op — zero users —
but guarded for the future).

Other cleanup from the audit: fallback primary menu moved out of
header.php into inc/helpers.php (redeclaration risk), placeholder footer
language links replaced with "Translations coming soon", footer copyright
now reads through the customizer getter, settings-panel gains a proper
Tab/Shift+Tab focus trap and saves/restores body overflow, documentation
heading IDs slugified from heading text with collision counters, JS files
standardized on const/let.

Six new PHPUnit suites cover rate limiter lifecycle, auth handler error
unification and rate limits, email verification token generation and
expiry, contact handler header injection + rate limit + honeypot,
newsletter signup consent + CSV safety, and require_login gate behavior.

ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new
module layout, data flows, security patterns for rate-limiting,
honeypotting, gating, and CSV-safe export.

Version bumped to 1.5.1 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
2026-04-14 13:01:22 +07:00
parent d28d5f45d5
commit cb8b73f4ab
34 changed files with 2816 additions and 745 deletions
Download Patch File Download Diff File Expand all files Collapse all files

89
page-profile.php
View File

@@ -2,15 +2,12 @@
/**
* Template Name: User Profile
*
* Page template for the user profile page.
* Loads the Peptide Community plugin profile via shortcode.
* Renders the logged-in user's profile. Shows a verify-required banner
* when the account has ps_pending_verification=1 and an inline "verified"
* confirmation after a successful /verify click-through.
*
* @see page-auth.php — authentication template
* @see functions.php — enqueue and page auto-creation
*
* What: Renders the user profile page with plugin shortcode integration.
* Who calls it: WordPress template hierarchy when a page uses this template.
* Dependencies: Peptide Community plugin (optional — graceful fallback).
* @see inc/email-verification.php — verification flow + resend endpoint
*
* @package peptide-starter
*/
@@ -20,26 +17,69 @@ if ( ! defined( 'ABSPATH' ) ) {
exit;
}
// Redirect unauthenticated users to the auth page.
// Redirect unauthenticated users to the auth page. Intentionally does not
// use peptide_starter_require_login() — that would redirect unverified
// users away from profile, but profile is where we surface the verify UI.
if ( ! is_user_logged_in() ) {
wp_safe_redirect( home_url( '/auth?redirect_to=' . rawurlencode( get_permalink() ) ) );
exit;
}
$current_user = wp_get_current_user();
$needs_verify = ! peptide_starter_user_is_verified( $current_user->ID );
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
$show_verified = isset( $_GET['verified'] ) && '1' === $_GET['verified'];
get_header();
?>
<main id="main" class="site-main">
<section class="ps-tool-page">
<div class="ps-container">
<?php if ( $show_verified ) : ?>
<div class="ps-alert ps-alert-success" role="alert">
<p><?php esc_html_e( 'Your email address has been verified. Welcome aboard.', 'peptide-starter' ); ?></p>
</div>
<?php endif; ?>
<?php if ( $needs_verify ) : ?>
<div class="ps-alert ps-alert-warning ps-verify-required" role="alert">
<h3><?php esc_html_e( 'Verify your email to unlock data tools', 'peptide-starter' ); ?></h3>
<p>
<?php
echo esc_html(
sprintf(
/* translators: %s: user email */
__( 'We sent a verification link to %s. Click it to activate Subject Log, Tracker, and Protocol Builder. Links expire after 24 hours.', 'peptide-starter' ),
$current_user->user_email
)
);
?>
</p>
<form class="ps-verify-resend" id="ps-verify-resend" method="post" novalidate>
<?php wp_nonce_field( 'ps_resend_verify', 'ps_resend_nonce' ); ?>
<input type="hidden" name="action" value="ps_resend_verify">
<input type="hidden" name="email" value="<?php echo esc_attr( $current_user->user_email ); ?>">
<button type="submit" class="ps-btn ps-btn-secondary">
<?php esc_html_e( 'Resend verification email', 'peptide-starter' ); ?>
</button>
<span class="ps-verify-resend-status" aria-live="polite"></span>
</form>
</div>
<?php endif; ?>
<?php
if ( shortcode_exists( 'peptide_community_profile' ) ) {
echo do_shortcode( '[peptide_community_profile]' );
} else {
$current_user = wp_get_current_user();
?>
<div class="ps-profile-basic">
<h1><?php echo esc_html( sprintf( __( 'Welcome, %s', 'peptide-starter' ), $current_user->display_name ) ); ?></h1>
<h1>
<?php
/* translators: %s: user display name */
echo esc_html( sprintf( __( 'Welcome, %s', 'peptide-starter' ), $current_user->display_name ) );
?>
</h1>
<p><?php esc_html_e( 'Your profile page is being set up. Check back soon for full profile features.', 'peptide-starter' ); ?></p>
<div class="ps-profile-links">
<a href="<?php echo esc_url( home_url( '/tracker' ) ); ?>" class="ps-btn ps-btn-secondary">
@@ -60,4 +100,33 @@ get_header();
</section>
</main>
<script>
(function() {
const form = document.getElementById('ps-verify-resend');
if (!form) return;
const status = form.querySelector('.ps-verify-resend-status');
form.addEventListener('submit', function(e) {
e.preventDefault();
const data = new FormData(form);
const xhr = new XMLHttpRequest();
xhr.open('POST', '<?php echo esc_js( admin_url( 'admin-ajax.php' ) ); ?>');
xhr.onload = function() {
try {
const resp = JSON.parse(xhr.responseText);
if (status) {
const msg = (resp && resp.data && resp.data.message) ? resp.data.message : '';
const div = document.createElement('span');
div.textContent = ' ' + msg;
status.innerHTML = '';
status.appendChild(div);
}
} catch (ex) {
if (status) { status.textContent = ''; }
}
};
xhr.send(data);
});
})();
</script>
<?php get_footer(); ?>