v1.5.2: CF-peer validated client IP, grandfather migration, de-short-circuit register
Security follow-up to v1.5.1. Closes four items from the v1.5.1 review — two ship-blockers and two mediums — all within the ADR-0001 envelope. PSEC-007 — peptide_starter_get_client_ip() now trusts CF-Connecting-IP only when REMOTE_ADDR falls inside a published Cloudflare edge range. Previously, any direct-to-origin request (which Hostinger permits) could forge its rate-limit key by setting the header to a different IP per attempt, bypassing every abuse control in the theme. New module inc/cloudflare-ips.php embeds a dated snapshot of CF v4/v6 ranges and a CIDR matcher covering both families; list is overridable via the peptide_starter_cloudflare_ip_ranges filter for out-of-band updates. HTTP_X_FORWARDED_FOR stays ignored unless operators opt in via the peptide_starter_trust_xff filter. PSEC-008 — Removed the v1.5.1 user-verification migration (Option A as confirmed by peptiderepo). The sync-wp_mail-per-subscriber loop on admin_init would have blocked wp-admin and hammered deliverability. Existing accounts are now grandfathered: no ps_pending_verification meta = verified. Verification applies only to registrations from v1.5.2 forward. The ps_verify_migration_version option (written by v1.5.1) is cleared on theme activation. PSEC-009 — Registration validation no longer short-circuits. All five checks (username pattern, email validity, password length, username_exists, email_exists) evaluate unconditionally before the combined rejection. Closes the response-time oracle that let an attacker distinguish microsecond-fast regex rejection from DB-round-trip rejection and infer which field triggered the failure. PSEC-010 — Added the happy-path verify test that v1.5.1 was missing. Covers token match, user meta cleanup, auth cookie set, and the peptide_starter_user_verified action firing with the correct user ID. Seven new rate-limiter tests confirm CF-peer validation works end-to-end: trusted CF peer honours the header, untrusted peer ignores spoofed headers, invalid values fall through, XFF default-off, XFF filter opt-in, CF range filter override, IPv6 CIDR match, family mismatch rejection. Confirmed with peptiderepo before coding: (1) Option A for PSEC-008 because zero users; (2) Cloudflare IS in front of the origin (dig confirms 104.21.x / 172.67.x + CF-Ray response header), so PSEC-007 is a real fix not dead code; (3) no staging — treat prod as staging. ARCHITECTURE.md gains a client-IP trust model section; CONVENTIONS.md documents the header-trust rules for future modules. Version bumped to 1.5.2 in style.css and functions.php. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
154
style.css
154
style.css
@@ -4,7 +4,7 @@ Theme URI: https://github.com/peptiderepo/peptide-starter
|
||||
Description: Premium, accessible WordPress theme for scientific peptide reference database
|
||||
Author: Peptide Repo
|
||||
Author URI: https://peptiderepo.com
|
||||
Version: 1.5.1
|
||||
Version: 1.5.2
|
||||
License: GPL v2 or later
|
||||
License URI: https://www.gnu.org/licenses/gpl-2.0.html
|
||||
Text Domain: peptide-starter
|
||||
@@ -3077,79 +3077,79 @@ html[data-theme="dark"] .ps-modules-section {
|
||||
/* ============================================================================
|
||||
END OF STYLESHEET
|
||||
============================================================================ */
|
||||
|
||||
/* =====================================================================
|
||||
Section 26 — v1.5.1 security/UX additions
|
||||
===================================================================== */
|
||||
|
||||
/* Visually hidden honeypot wrapper — off-screen, keyboard-skipped, bot-visible. */
|
||||
.ps-hp-wrap {
|
||||
position: absolute;
|
||||
left: -9999px;
|
||||
top: auto;
|
||||
width: 1px;
|
||||
height: 1px;
|
||||
overflow: hidden;
|
||||
pointer-events: none;
|
||||
}
|
||||
|
||||
/* Email verification banner on /profile */
|
||||
.ps-verify-required {
|
||||
padding: var(--spacing-md);
|
||||
margin-bottom: var(--spacing-lg);
|
||||
border-left: 4px solid #F59E0B;
|
||||
background-color: #FEF3C7;
|
||||
color: #78350F;
|
||||
border-radius: 6px;
|
||||
}
|
||||
|
||||
html[data-theme="dark"] .ps-verify-required {
|
||||
background-color: #451A03;
|
||||
color: #FEF3C7;
|
||||
border-left-color: #F59E0B;
|
||||
}
|
||||
|
||||
.ps-verify-required h3 {
|
||||
margin: 0 0 var(--spacing-xs) 0;
|
||||
font-size: 1.05rem;
|
||||
}
|
||||
|
||||
.ps-verify-resend {
|
||||
margin-top: var(--spacing-sm);
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: var(--spacing-sm);
|
||||
}
|
||||
|
||||
.ps-verify-resend-status {
|
||||
font-size: 0.9rem;
|
||||
color: inherit;
|
||||
}
|
||||
|
||||
/* Newsletter consent + privacy link */
|
||||
.ps-newsletter-consent {
|
||||
display: flex;
|
||||
align-items: flex-start;
|
||||
gap: var(--spacing-xs);
|
||||
margin-top: var(--spacing-sm);
|
||||
font-size: 0.9rem;
|
||||
line-height: 1.5;
|
||||
}
|
||||
|
||||
.ps-newsletter-consent input[type="checkbox"] {
|
||||
margin-top: 0.25em;
|
||||
flex-shrink: 0;
|
||||
}
|
||||
|
||||
.ps-newsletter-privacy {
|
||||
margin-top: var(--spacing-xs);
|
||||
font-size: 0.85rem;
|
||||
opacity: 0.85;
|
||||
}
|
||||
|
||||
/* Footer translations note */
|
||||
.footer-languages-note {
|
||||
margin-top: var(--spacing-sm);
|
||||
font-size: 0.85rem;
|
||||
opacity: 0.7;
|
||||
}
|
||||
|
||||
/* =====================================================================
|
||||
Section 26 — v1.5.1 security/UX additions
|
||||
===================================================================== */
|
||||
|
||||
/* Visually hidden honeypot wrapper — off-screen, keyboard-skipped, bot-visible. */
|
||||
.ps-hp-wrap {
|
||||
position: absolute;
|
||||
left: -9999px;
|
||||
top: auto;
|
||||
width: 1px;
|
||||
height: 1px;
|
||||
overflow: hidden;
|
||||
pointer-events: none;
|
||||
}
|
||||
|
||||
/* Email verification banner on /profile */
|
||||
.ps-verify-required {
|
||||
padding: var(--spacing-md);
|
||||
margin-bottom: var(--spacing-lg);
|
||||
border-left: 4px solid #F59E0B;
|
||||
background-color: #FEF3C7;
|
||||
color: #78350F;
|
||||
border-radius: 6px;
|
||||
}
|
||||
|
||||
html[data-theme="dark"] .ps-verify-required {
|
||||
background-color: #451A03;
|
||||
color: #FEF3C7;
|
||||
border-left-color: #F59E0B;
|
||||
}
|
||||
|
||||
.ps-verify-required h3 {
|
||||
margin: 0 0 var(--spacing-xs) 0;
|
||||
font-size: 1.05rem;
|
||||
}
|
||||
|
||||
.ps-verify-resend {
|
||||
margin-top: var(--spacing-sm);
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: var(--spacing-sm);
|
||||
}
|
||||
|
||||
.ps-verify-resend-status {
|
||||
font-size: 0.9rem;
|
||||
color: inherit;
|
||||
}
|
||||
|
||||
/* Newsletter consent + privacy link */
|
||||
.ps-newsletter-consent {
|
||||
display: flex;
|
||||
align-items: flex-start;
|
||||
gap: var(--spacing-xs);
|
||||
margin-top: var(--spacing-sm);
|
||||
font-size: 0.9rem;
|
||||
line-height: 1.5;
|
||||
}
|
||||
|
||||
.ps-newsletter-consent input[type="checkbox"] {
|
||||
margin-top: 0.25em;
|
||||
flex-shrink: 0;
|
||||
}
|
||||
|
||||
.ps-newsletter-privacy {
|
||||
margin-top: var(--spacing-xs);
|
||||
font-size: 0.85rem;
|
||||
opacity: 0.85;
|
||||
}
|
||||
|
||||
/* Footer translations note */
|
||||
.footer-languages-note {
|
||||
margin-top: var(--spacing-sm);
|
||||
font-size: 0.85rem;
|
||||
opacity: 0.7;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user