v1.5.1: frontend auth hardening — rate limiting, email verification, honeypots, CSV safety
Security-only release per ADR-0001. Closes all six ship-blockers from the post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account enumeration via separate error messages), PSEC-003 (registration auto-login with no email verification), PSEC-004 (ungated "My Data" templates), PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no honeypot/CAPTCHA on public forms). Adds inc/config.php (single source of truth for all security thresholds, filterable via peptide_starter_security_config), inc/rate-limiter.php (Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver, transient-backed, never stores raw IPs), and inc/email-verification.php (43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint). Auth handlers rewritten to: unify all failure messages, rate-limit before any expensive check, drop registrations with a filled honeypot silently, stop auto-login on register, send a verification email instead. The require_login() helper lives in inc/helpers.php and is applied at the top of page-tracker.php, page-subject-log.php, and page-protocol-builder.php; page-calculator.php stays open (no PII, no writes). Newsletter signup gains: consent checkbox, privacy link, honeypot, autoload=false on the wp_options blob, unsubscribe token stored per row, /newsletter-unsubscribe route, merged success+duplicate into a single "ok" state. Admin export runs every cell through peptide_starter_csv_safe() which prefixes leading =/+/-/@/tab/CR with a quote. Contact handler hardens against email-header injection (rejects name values with \r \n , < >), rate-limits, honors honeypot, tags mail failures with a request ID for correlation without logging message content. Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail probe so we can check Hostinger outbound deliverability any time it looks flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1 subscribers into the verification flow (currently a no-op — zero users — but guarded for the future). Other cleanup from the audit: fallback primary menu moved out of header.php into inc/helpers.php (redeclaration risk), placeholder footer language links replaced with "Translations coming soon", footer copyright now reads through the customizer getter, settings-panel gains a proper Tab/Shift+Tab focus trap and saves/restores body overflow, documentation heading IDs slugified from heading text with collision counters, JS files standardized on const/let. Six new PHPUnit suites cover rate limiter lifecycle, auth handler error unification and rate limits, email verification token generation and expiry, contact handler header injection + rate limit + honeypot, newsletter signup consent + CSV safety, and require_login gate behavior. ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new module layout, data flows, security patterns for rate-limiting, honeypotting, gating, and CSV-safe export. Version bumped to 1.5.1 in style.css and functions.php. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
110
tests/test-contact-handler.php
Normal file
110
tests/test-contact-handler.php
Normal file
@@ -0,0 +1,110 @@
|
||||
<?php
|
||||
/**
|
||||
* Tests for inc/contact-handler.php.
|
||||
*
|
||||
* @package peptide-starter
|
||||
*/
|
||||
|
||||
class Test_Contact_Handler extends WP_UnitTestCase {
|
||||
|
||||
protected $captured = null;
|
||||
|
||||
public function set_up() {
|
||||
parent::set_up();
|
||||
$this->captured = null;
|
||||
add_filter(
|
||||
'wp_die_ajax_handler',
|
||||
function () {
|
||||
return array( $this, 'throwing_die' );
|
||||
}
|
||||
);
|
||||
add_filter(
|
||||
'wp_die_handler',
|
||||
function () {
|
||||
return array( $this, 'throwing_die' );
|
||||
}
|
||||
);
|
||||
add_filter(
|
||||
'wp_json_encode_data',
|
||||
function ( $data ) {
|
||||
$this->captured = $data;
|
||||
return $data;
|
||||
}
|
||||
);
|
||||
add_filter(
|
||||
'pre_wp_mail',
|
||||
function () {
|
||||
return true;
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
public function tear_down() {
|
||||
remove_all_filters( 'wp_die_ajax_handler' );
|
||||
remove_all_filters( 'wp_die_handler' );
|
||||
remove_all_filters( 'wp_json_encode_data' );
|
||||
remove_all_filters( 'pre_wp_mail' );
|
||||
global $wpdb;
|
||||
$wpdb->query( "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_ps_rl_%'" );
|
||||
$wpdb->query( "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_timeout_ps_rl_%'" );
|
||||
$_POST = array();
|
||||
parent::tear_down();
|
||||
}
|
||||
|
||||
public function throwing_die( $message = '' ) {
|
||||
throw new WPAjaxDieStopException( is_scalar( $message ) ? (string) $message : wp_json_encode( $message ) );
|
||||
}
|
||||
|
||||
protected function post( $overrides = array() ) {
|
||||
$defaults = array(
|
||||
'ps_contact_nonce' => wp_create_nonce( 'ps_contact_form' ),
|
||||
'name' => 'Dr Valid',
|
||||
'email' => 'valid@example.com',
|
||||
'topic' => 'bug',
|
||||
'message' => 'There is a bug in the tracker.',
|
||||
);
|
||||
$_POST = array_merge( $defaults, $overrides );
|
||||
try { peptide_starter_ajax_contact(); } catch ( WPAjaxDieStopException $e ) { /* ok */ }
|
||||
}
|
||||
|
||||
public function test_valid_submission_succeeds() {
|
||||
$this->post();
|
||||
$this->assertTrue( $this->captured['success'] );
|
||||
}
|
||||
|
||||
public function test_nonce_failure_rejects() {
|
||||
$this->post( array( 'ps_contact_nonce' => 'bogus' ) );
|
||||
$this->assertFalse( $this->captured['success'] );
|
||||
$this->assertStringContainsString( 'Security', $this->captured['data']['message'] );
|
||||
}
|
||||
|
||||
public function test_name_with_newline_rejected_for_header_injection() {
|
||||
$this->post( array( 'name' => "Mallory\r\nBcc: attacker@x.com" ) );
|
||||
$this->assertFalse( $this->captured['success'] );
|
||||
}
|
||||
|
||||
public function test_name_with_angle_brackets_rejected() {
|
||||
$this->post( array( 'name' => 'Alice <injected@x.com>' ) );
|
||||
$this->assertFalse( $this->captured['success'] );
|
||||
}
|
||||
|
||||
public function test_invalid_topic_rejected() {
|
||||
$this->post( array( 'topic' => 'not-an-allowlisted-topic' ) );
|
||||
$this->assertFalse( $this->captured['success'] );
|
||||
}
|
||||
|
||||
public function test_honeypot_returns_fake_success() {
|
||||
$this->post( array( 'ps_hp_contact' => 'filled-by-bot' ) );
|
||||
$this->assertTrue( $this->captured['success'] );
|
||||
}
|
||||
|
||||
public function test_rate_limit_exceeded_rejects() {
|
||||
$config = peptide_starter_config_rate_limit( 'contact' );
|
||||
for ( $i = 0; $i < $config['limit']; $i++ ) {
|
||||
Peptide_Starter_Rate_Limiter::record( 'contact', 'ip' );
|
||||
}
|
||||
$this->post();
|
||||
$this->assertFalse( $this->captured['success'] );
|
||||
$this->assertStringContainsString( 'Too many', $this->captured['data']['message'] );
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user