peptide-repo/peptide-starter-theme
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.5.2: CF-peer validated client IP, grandfather migration, de-short-circuit register

Browse Source 
Security follow-up to v1.5.1. Closes four items from the v1.5.1 review —
two ship-blockers and two mediums — all within the ADR-0001 envelope.

PSEC-007 — peptide_starter_get_client_ip() now trusts CF-Connecting-IP
only when REMOTE_ADDR falls inside a published Cloudflare edge range.
Previously, any direct-to-origin request (which Hostinger permits) could
forge its rate-limit key by setting the header to a different IP per
attempt, bypassing every abuse control in the theme. New module
inc/cloudflare-ips.php embeds a dated snapshot of CF v4/v6 ranges and a
CIDR matcher covering both families; list is overridable via the
peptide_starter_cloudflare_ip_ranges filter for out-of-band updates.
HTTP_X_FORWARDED_FOR stays ignored unless operators opt in via the
peptide_starter_trust_xff filter.

PSEC-008 — Removed the v1.5.1 user-verification migration (Option A as
confirmed by peptiderepo). The sync-wp_mail-per-subscriber loop on
admin_init would have blocked wp-admin and hammered deliverability.
Existing accounts are now grandfathered: no ps_pending_verification
meta = verified. Verification applies only to registrations from v1.5.2
forward. The ps_verify_migration_version option (written by v1.5.1) is
cleared on theme activation.

PSEC-009 — Registration validation no longer short-circuits. All five
checks (username pattern, email validity, password length,
username_exists, email_exists) evaluate unconditionally before the
combined rejection. Closes the response-time oracle that let an
attacker distinguish microsecond-fast regex rejection from DB-round-trip
rejection and infer which field triggered the failure.

PSEC-010 — Added the happy-path verify test that v1.5.1 was missing.
Covers token match, user meta cleanup, auth cookie set, and the
peptide_starter_user_verified action firing with the correct user ID.

Seven new rate-limiter tests confirm CF-peer validation works
end-to-end: trusted CF peer honours the header, untrusted peer ignores
spoofed headers, invalid values fall through, XFF default-off, XFF
filter opt-in, CF range filter override, IPv6 CIDR match, family
mismatch rejection.

Confirmed with peptiderepo before coding: (1) Option A for PSEC-008
because zero users; (2) Cloudflare IS in front of the origin (dig
confirms 104.21.x / 172.67.x + CF-Ray response header), so PSEC-007 is
a real fix not dead code; (3) no staging — treat prod as staging.

ARCHITECTURE.md gains a client-IP trust model section; CONVENTIONS.md
documents the header-trust rules for future modules.

Version bumped to 1.5.2 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
2026-04-14 15:39:09 +07:00
parent 3e1c12c94b
commit fff3fce432
13 changed files with 573 additions and 192 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
tests/test-auth-handlers.php
View File

@@ -137,6 +137,51 @@ class Test_Auth_Handlers extends WP_UnitTestCase {
$this->assertSame( peptide_starter_register_failure_message(), $this->captured['data']['message'] );
}
/**
* PSEC-009: registration validation path is not short-circuit.
*
* We can't directly mock `preg_match` / `username_exists` etc. from
* userland. Instead, we assert the behavioural contract: even when an
* early check has already failed (invalid username pattern), the
* handler still runs the later DB-backed checks. We observe this by
* filtering `pre_user_login` which wp_create_user-adjacent code paths
* consult, and by checking that `username_exists` was called via a
* filter it would fire. A simpler surrogate is to hook into WordPress'
* `user_search_query` / `query` action and confirm at least one user
* lookup happened during a failing registration — which would not
* happen if the handler short-circuited on the pattern failure.
*/
public function test_register_runs_all_checks_even_when_early_one_fails() {
$queries_ran = 0;
$counter = function ( $query ) use ( &$queries_ran ) {
// wp_cache_get avoids counting ourselves. We only care whether
// any user-table-touching query fires during the handler run.
if ( is_string( $query ) && false !== stripos( $query, 'users' ) ) {
$queries_ran++;
}
return $query;
};
add_filter( 'query', $counter );
update_option( 'users_can_register', 1 );
$_POST = array(
'ps_register_nonce' => wp_create_nonce( 'ps_auth_register' ),
'username' => 'ab', // Too short — early check fails.
'email' => 'validformat@example.com',
'password' => 'longenoughpassword',
);
try { peptide_starter_ajax_register(); } catch ( WPAjaxDieStopException $e ) { /* ok */ }
remove_filter( 'query', $counter );
$this->assertGreaterThan(
0,
$queries_ran,
'username_exists / email_exists must still run even when pattern check fails (PSEC-009 non-short-circuit).'
);
$this->assertSame( peptide_starter_register_failure_message(), $this->captured['data']['message'] );
}
public function test_register_duplicate_email_returns_unified_message() {
self::factory()->user->create( array( 'user_email' => 'dup@example.com' ) );
update_option( 'users_can_register', 1 );