peptide-repo/peptide-starter-theme
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.5.1: frontend auth hardening — rate limiting, email verification, honeypots, CSV safety

Browse Source 
Security-only release per ADR-0001. Closes all six ship-blockers from the
post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account
enumeration via separate error messages), PSEC-003 (registration auto-login
with no email verification), PSEC-004 (ungated "My Data" templates),
PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no
honeypot/CAPTCHA on public forms).

Adds inc/config.php (single source of truth for all security thresholds,
filterable via peptide_starter_security_config), inc/rate-limiter.php
(Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver,
transient-backed, never stores raw IPs), and inc/email-verification.php
(43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint).

Auth handlers rewritten to: unify all failure messages, rate-limit before
any expensive check, drop registrations with a filled honeypot silently,
stop auto-login on register, send a verification email instead. The
require_login() helper lives in inc/helpers.php and is applied at the top
of page-tracker.php, page-subject-log.php, and page-protocol-builder.php;
page-calculator.php stays open (no PII, no writes).

Newsletter signup gains: consent checkbox, privacy link, honeypot,
autoload=false on the wp_options blob, unsubscribe token stored per row,
/newsletter-unsubscribe route, merged success+duplicate into a single "ok"
state. Admin export runs every cell through peptide_starter_csv_safe()
which prefixes leading =/+/-/@/tab/CR with a quote.

Contact handler hardens against email-header injection (rejects name
values with \r \n , < >), rate-limits, honors honeypot, tags mail
failures with a request ID for correlation without logging message
content.

Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail
probe so we can check Hostinger outbound deliverability any time it looks
flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1
subscribers into the verification flow (currently a no-op — zero users —
but guarded for the future).

Other cleanup from the audit: fallback primary menu moved out of
header.php into inc/helpers.php (redeclaration risk), placeholder footer
language links replaced with "Translations coming soon", footer copyright
now reads through the customizer getter, settings-panel gains a proper
Tab/Shift+Tab focus trap and saves/restores body overflow, documentation
heading IDs slugified from heading text with collision counters, JS files
standardized on const/let.

Six new PHPUnit suites cover rate limiter lifecycle, auth handler error
unification and rate limits, email verification token generation and
expiry, contact handler header injection + rate limit + honeypot,
newsletter signup consent + CSV safety, and require_login gate behavior.

ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new
module layout, data flows, security patterns for rate-limiting,
honeypotting, gating, and CSV-safe export.

Version bumped to 1.5.1 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
2026-04-14 13:01:22 +07:00
parent d28d5f45d5
commit cb8b73f4ab
34 changed files with 2816 additions and 745 deletions
Download Patch File Download Diff File Expand all files Collapse all files

94
tests/test-rate-limiter.php Normal file
View File

@@ -0,0 +1,94 @@
<?php
/**
* Tests for inc/rate-limiter.php and inc/config.php.
*
* @package peptide-starter
*/
/**
* Rate limiter check / record / reset lifecycle and filterability.
*/
class Test_Rate_Limiter extends WP_UnitTestCase {
/**
* Reset all transients we touched between tests.
*/
public function tear_down() {
global $wpdb;
$wpdb->query( "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_ps_rl_%'" );
$wpdb->query( "DELETE FROM {$wpdb->options} WHERE option_name LIKE '_transient_timeout_ps_rl_%'" );
remove_all_filters( 'peptide_starter_security_config' );
parent::tear_down();
}
public function test_check_allows_under_limit() {
$this->assertTrue( Peptide_Starter_Rate_Limiter::check( 'login', 'user-a' ) );
}
public function test_record_increments_and_eventually_blocks() {
$config = peptide_starter_config_rate_limit( 'login' );
for ( $i = 0; $i < $config['limit']; $i++ ) {
Peptide_Starter_Rate_Limiter::record( 'login', 'user-b' );
}
$this->assertFalse(
Peptide_Starter_Rate_Limiter::check( 'login', 'user-b' ),
'check() must return false after recording limit-many attempts.'
);
}
public function test_reset_clears_counter() {
$config = peptide_starter_config_rate_limit( 'login' );
for ( $i = 0; $i < $config['limit']; $i++ ) {
Peptide_Starter_Rate_Limiter::record( 'login', 'user-c' );
}
Peptide_Starter_Rate_Limiter::reset( 'login', 'user-c' );
$this->assertTrue( Peptide_Starter_Rate_Limiter::check( 'login', 'user-c' ) );
}
public function test_identifiers_are_isolated() {
$config = peptide_starter_config_rate_limit( 'login' );
for ( $i = 0; $i < $config['limit']; $i++ ) {
Peptide_Starter_Rate_Limiter::record( 'login', 'user-d' );
}
$this->assertTrue(
Peptide_Starter_Rate_Limiter::check( 'login', 'user-e' ),
'Recording against user-d must not affect user-e.'
);
}
public function test_filter_override_changes_limit() {
add_filter(
'peptide_starter_security_config',
function ( $c ) {
$c['rate_limits']['login']['limit'] = 1;
return $c;
}
);
Peptide_Starter_Rate_Limiter::record( 'login', 'user-f' );
$this->assertFalse( Peptide_Starter_Rate_Limiter::check( 'login', 'user-f' ) );
}
public function test_hash_identifier_is_stable_and_non_reversible() {
$a = peptide_starter_hash_identifier( 'alice@example.com' );
$b = peptide_starter_hash_identifier( 'alice@example.com' );
$c = peptide_starter_hash_identifier( 'bob@example.com' );
$this->assertSame( $a, $b );
$this->assertNotSame( $a, $c );
$this->assertSame( 32, strlen( $a ) );
$this->assertStringNotContainsString( 'alice', $a );
}
public function test_client_ip_prefers_cf_header() {
$_SERVER['HTTP_CF_CONNECTING_IP'] = '203.0.113.5';
$_SERVER['REMOTE_ADDR'] = '10.0.0.1';
$this->assertSame( '203.0.113.5', peptide_starter_get_client_ip() );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'] );
}
public function test_client_ip_rejects_garbage() {
$_SERVER['HTTP_CF_CONNECTING_IP'] = 'not-an-ip';
$_SERVER['REMOTE_ADDR'] = '10.0.0.1';
$this->assertSame( '10.0.0.1', peptide_starter_get_client_ip() );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'] );
}
}