peptide-repo/peptide-starter-theme
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.5.2: CF-peer validated client IP, grandfather migration, de-short-circuit register

Browse Source 
Security follow-up to v1.5.1. Closes four items from the v1.5.1 review —
two ship-blockers and two mediums — all within the ADR-0001 envelope.

PSEC-007 — peptide_starter_get_client_ip() now trusts CF-Connecting-IP
only when REMOTE_ADDR falls inside a published Cloudflare edge range.
Previously, any direct-to-origin request (which Hostinger permits) could
forge its rate-limit key by setting the header to a different IP per
attempt, bypassing every abuse control in the theme. New module
inc/cloudflare-ips.php embeds a dated snapshot of CF v4/v6 ranges and a
CIDR matcher covering both families; list is overridable via the
peptide_starter_cloudflare_ip_ranges filter for out-of-band updates.
HTTP_X_FORWARDED_FOR stays ignored unless operators opt in via the
peptide_starter_trust_xff filter.

PSEC-008 — Removed the v1.5.1 user-verification migration (Option A as
confirmed by peptiderepo). The sync-wp_mail-per-subscriber loop on
admin_init would have blocked wp-admin and hammered deliverability.
Existing accounts are now grandfathered: no ps_pending_verification
meta = verified. Verification applies only to registrations from v1.5.2
forward. The ps_verify_migration_version option (written by v1.5.1) is
cleared on theme activation.

PSEC-009 — Registration validation no longer short-circuits. All five
checks (username pattern, email validity, password length,
username_exists, email_exists) evaluate unconditionally before the
combined rejection. Closes the response-time oracle that let an
attacker distinguish microsecond-fast regex rejection from DB-round-trip
rejection and infer which field triggered the failure.

PSEC-010 — Added the happy-path verify test that v1.5.1 was missing.
Covers token match, user meta cleanup, auth cookie set, and the
peptide_starter_user_verified action firing with the correct user ID.

Seven new rate-limiter tests confirm CF-peer validation works
end-to-end: trusted CF peer honours the header, untrusted peer ignores
spoofed headers, invalid values fall through, XFF default-off, XFF
filter opt-in, CF range filter override, IPv6 CIDR match, family
mismatch rejection.

Confirmed with peptiderepo before coding: (1) Option A for PSEC-008
because zero users; (2) Cloudflare IS in front of the origin (dig
confirms 104.21.x / 172.67.x + CF-Ray response header), so PSEC-007 is
a real fix not dead code; (3) no staging — treat prod as staging.

ARCHITECTURE.md gains a client-IP trust model section; CONVENTIONS.md
documents the header-trust rules for future modules.

Version bumped to 1.5.2 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
2026-04-14 15:39:09 +07:00
parent 3e1c12c94b
commit fff3fce432
13 changed files with 573 additions and 192 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
tests/test-email-verification.php
View File

@@ -44,6 +44,50 @@ class Test_Email_Verification extends WP_UnitTestCase {
$this->assertFalse( peptide_starter_user_is_verified( $user_id ) );
}
public function test_valid_token_verifies_user_clears_meta_and_fires_hook() {
$user_id = self::factory()->user->create();
peptide_starter_send_verification_email( $user_id );
$token = get_user_meta( $user_id, 'ps_verify_token', true );
$this->assertNotEmpty( $token );
$_GET['uid'] = $user_id;
$_GET['token'] = $token;
set_query_var( 'ps_verify', 1 );
$redirected = null;
$hook_user_id = null;
add_filter(
'wp_redirect',
function ( $url ) use ( &$redirected ) {
$redirected = $url;
return false;
}
);
add_action(
'peptide_starter_user_verified',
function ( $uid ) use ( &$hook_user_id ) {
$hook_user_id = $uid;
}
);
try {
peptide_starter_handle_verify_request();
} catch ( Exception $e ) { /* exit path */ }
$this->assertNotNull( $redirected, 'Must redirect on successful verify.' );
$this->assertStringContainsString( 'verified=1', (string) $redirected );
$this->assertSame( '', (string) get_user_meta( $user_id, 'ps_pending_verification', true ) );
$this->assertSame( '', (string) get_user_meta( $user_id, 'ps_verify_token', true ) );
$this->assertSame( '', (string) get_user_meta( $user_id, 'ps_verify_expires', true ) );
$this->assertSame( $user_id, get_current_user_id(), 'User must be logged in after successful verify.' );
$this->assertSame( $user_id, $hook_user_id, 'peptide_starter_user_verified must fire with the user ID.' );
remove_all_filters( 'wp_redirect' );
remove_all_actions( 'peptide_starter_user_verified' );
set_query_var( 'ps_verify', 0 );
wp_set_current_user( 0 );
}
public function test_verification_handler_rejects_bad_token() {
$user_id = self::factory()->user->create();
peptide_starter_send_verification_email( $user_id );