fff3fce432
Security follow-up to v1.5.1. Closes four items from the v1.5.1 review — two ship-blockers and two mediums — all within the ADR-0001 envelope. PSEC-007 — peptide_starter_get_client_ip() now trusts CF-Connecting-IP only when REMOTE_ADDR falls inside a published Cloudflare edge range. Previously, any direct-to-origin request (which Hostinger permits) could forge its rate-limit key by setting the header to a different IP per attempt, bypassing every abuse control in the theme. New module inc/cloudflare-ips.php embeds a dated snapshot of CF v4/v6 ranges and a CIDR matcher covering both families; list is overridable via the peptide_starter_cloudflare_ip_ranges filter for out-of-band updates. HTTP_X_FORWARDED_FOR stays ignored unless operators opt in via the peptide_starter_trust_xff filter. PSEC-008 — Removed the v1.5.1 user-verification migration (Option A as confirmed by peptiderepo). The sync-wp_mail-per-subscriber loop on admin_init would have blocked wp-admin and hammered deliverability. Existing accounts are now grandfathered: no ps_pending_verification meta = verified. Verification applies only to registrations from v1.5.2 forward. The ps_verify_migration_version option (written by v1.5.1) is cleared on theme activation. PSEC-009 — Registration validation no longer short-circuits. All five checks (username pattern, email validity, password length, username_exists, email_exists) evaluate unconditionally before the combined rejection. Closes the response-time oracle that let an attacker distinguish microsecond-fast regex rejection from DB-round-trip rejection and infer which field triggered the failure. PSEC-010 — Added the happy-path verify test that v1.5.1 was missing. Covers token match, user meta cleanup, auth cookie set, and the peptide_starter_user_verified action firing with the correct user ID. Seven new rate-limiter tests confirm CF-peer validation works end-to-end: trusted CF peer honours the header, untrusted peer ignores spoofed headers, invalid values fall through, XFF default-off, XFF filter opt-in, CF range filter override, IPv6 CIDR match, family mismatch rejection. Confirmed with peptiderepo before coding: (1) Option A for PSEC-008 because zero users; (2) Cloudflare IS in front of the origin (dig confirms 104.21.x / 172.67.x + CF-Ray response header), so PSEC-007 is a real fix not dead code; (3) no staging — treat prod as staging. ARCHITECTURE.md gains a client-IP trust model section; CONVENTIONS.md documents the header-trust rules for future modules. Version bumped to 1.5.2 in style.css and functions.php. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
113 lines
3.0 KiB
PHP
113 lines
3.0 KiB
PHP
<?php
|
|
/**
|
|
* Auto-Create Pages on Theme Activation
|
|
*
|
|
* Creates the required WordPress pages with the correct templates
|
|
* assigned on theme activation, and performs small one-off cleanups
|
|
* tied to version bumps.
|
|
*
|
|
* As of v1.5.2 this file does NOT run a user-verification migration:
|
|
* existing accounts created before v1.5.2 are grandfathered as
|
|
* verified (see ADR-0001 addendum / CHANGELOG [1.5.2] PSEC-008).
|
|
*
|
|
* @see functions.php — includes this file
|
|
* @see ARCHITECTURE.md — page/template map
|
|
*
|
|
* What: Theme-activation hook for page provisioning + version cleanup.
|
|
* Who calls it: WordPress after_switch_theme.
|
|
* Dependencies: wp_insert_post, update_post_meta.
|
|
*
|
|
* @package peptide-starter
|
|
*/
|
|
|
|
// Exit if accessed directly.
|
|
if ( ! defined( 'ABSPATH' ) ) {
|
|
exit;
|
|
}
|
|
|
|
/**
|
|
* Create required pages on theme activation.
|
|
*
|
|
* Idempotent: re-assigns the template on existing pages.
|
|
*
|
|
* @return void
|
|
*/
|
|
function peptide_starter_create_pages() {
|
|
$pages = array(
|
|
array(
|
|
'title' => __( 'Calculator', 'peptide-starter' ),
|
|
'slug' => 'calculator',
|
|
'template' => 'page-calculator.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Protocol Builder', 'peptide-starter' ),
|
|
'slug' => 'protocol-builder',
|
|
'template' => 'page-protocol-builder.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Tracker', 'peptide-starter' ),
|
|
'slug' => 'tracker',
|
|
'template' => 'page-tracker.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Subject Log', 'peptide-starter' ),
|
|
'slug' => 'subject-log',
|
|
'template' => 'page-subject-log.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Documentation', 'peptide-starter' ),
|
|
'slug' => 'documentation',
|
|
'template' => 'page-documentation.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Peptide Directory', 'peptide-starter' ),
|
|
'slug' => 'peptides',
|
|
'template' => 'page-directory.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Science Feed', 'peptide-starter' ),
|
|
'slug' => 'news',
|
|
'template' => 'page-science-feed.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Profile', 'peptide-starter' ),
|
|
'slug' => 'profile',
|
|
'template' => 'page-profile.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Sign In', 'peptide-starter' ),
|
|
'slug' => 'auth',
|
|
'template' => 'page-auth.php',
|
|
),
|
|
);
|
|
|
|
foreach ( $pages as $page_data ) {
|
|
$existing = get_page_by_path( $page_data['slug'] );
|
|
|
|
if ( $existing ) {
|
|
update_post_meta( $existing->ID, '_wp_page_template', $page_data['template'] );
|
|
continue;
|
|
}
|
|
|
|
$page_id = wp_insert_post(
|
|
array(
|
|
'post_title' => $page_data['title'],
|
|
'post_name' => $page_data['slug'],
|
|
'post_status' => 'publish',
|
|
'post_type' => 'page',
|
|
'post_content' => '',
|
|
'post_author' => 1,
|
|
)
|
|
);
|
|
|
|
if ( $page_id && ! is_wp_error( $page_id ) ) {
|
|
update_post_meta( $page_id, '_wp_page_template', $page_data['template'] );
|
|
}
|
|
}
|
|
|
|
// v1.5.2 cleanup: the v1.5.1 migration writes this flag. Drop it on
|
|
// activation so the removed migration doesn't leave dangling state.
|
|
delete_option( 'ps_verify_migration_version' );
|
|
}
|
|
add_action( 'after_switch_theme', 'peptide_starter_create_pages' );
|