Security-only release per ADR-0001. Closes all six ship-blockers from the post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account enumeration via separate error messages), PSEC-003 (registration auto-login with no email verification), PSEC-004 (ungated "My Data" templates), PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no honeypot/CAPTCHA on public forms). Adds inc/config.php (single source of truth for all security thresholds, filterable via peptide_starter_security_config), inc/rate-limiter.php (Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver, transient-backed, never stores raw IPs), and inc/email-verification.php (43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint). Auth handlers rewritten to: unify all failure messages, rate-limit before any expensive check, drop registrations with a filled honeypot silently, stop auto-login on register, send a verification email instead. The require_login() helper lives in inc/helpers.php and is applied at the top of page-tracker.php, page-subject-log.php, and page-protocol-builder.php; page-calculator.php stays open (no PII, no writes). Newsletter signup gains: consent checkbox, privacy link, honeypot, autoload=false on the wp_options blob, unsubscribe token stored per row, /newsletter-unsubscribe route, merged success+duplicate into a single "ok" state. Admin export runs every cell through peptide_starter_csv_safe() which prefixes leading =/+/-/@/tab/CR with a quote. Contact handler hardens against email-header injection (rejects name values with \r \n , < >), rate-limits, honors honeypot, tags mail failures with a request ID for correlation without logging message content. Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail probe so we can check Hostinger outbound deliverability any time it looks flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1 subscribers into the verification flow (currently a no-op — zero users — but guarded for the future). Other cleanup from the audit: fallback primary menu moved out of header.php into inc/helpers.php (redeclaration risk), placeholder footer language links replaced with "Translations coming soon", footer copyright now reads through the customizer getter, settings-panel gains a proper Tab/Shift+Tab focus trap and saves/restores body overflow, documentation heading IDs slugified from heading text with collision counters, JS files standardized on const/let. Six new PHPUnit suites cover rate limiter lifecycle, auth handler error unification and rate limits, email verification token generation and expiry, contact handler header injection + rate limit + honeypot, newsletter signup consent + CSV safety, and require_login gate behavior. ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new module layout, data flows, security patterns for rate-limiting, honeypotting, gating, and CSV-safe export. Version bumped to 1.5.1 in style.css and functions.php. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
155 lines
4.3 KiB
PHP
155 lines
4.3 KiB
PHP
<?php
|
|
/**
|
|
* Auto-Create Pages + v1.5.0 User Migration
|
|
*
|
|
* On theme activation, creates the required WordPress pages with the
|
|
* correct templates assigned, and runs a one-time migration that enrols
|
|
* pre-v1.5.1 users into the email-verification flow.
|
|
*
|
|
* @see functions.php — includes this file
|
|
* @see inc/email-verification.php — peptide_starter_send_verification_email()
|
|
* @see ARCHITECTURE.md — page/template map
|
|
*
|
|
* What: Theme-activation hooks for page provisioning and user enrolment.
|
|
* Who calls it: WordPress after_switch_theme.
|
|
* Dependencies: wp_insert_post, update_post_meta, user meta.
|
|
*
|
|
* @package peptide-starter
|
|
*/
|
|
|
|
// Exit if accessed directly.
|
|
if ( ! defined( 'ABSPATH' ) ) {
|
|
exit;
|
|
}
|
|
|
|
/**
|
|
* Create required pages on theme activation.
|
|
*
|
|
* Idempotent: re-assigns the template on existing pages.
|
|
*
|
|
* @return void
|
|
*/
|
|
function peptide_starter_create_pages() {
|
|
$pages = array(
|
|
array(
|
|
'title' => __( 'Calculator', 'peptide-starter' ),
|
|
'slug' => 'calculator',
|
|
'template' => 'page-calculator.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Protocol Builder', 'peptide-starter' ),
|
|
'slug' => 'protocol-builder',
|
|
'template' => 'page-protocol-builder.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Tracker', 'peptide-starter' ),
|
|
'slug' => 'tracker',
|
|
'template' => 'page-tracker.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Subject Log', 'peptide-starter' ),
|
|
'slug' => 'subject-log',
|
|
'template' => 'page-subject-log.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Documentation', 'peptide-starter' ),
|
|
'slug' => 'documentation',
|
|
'template' => 'page-documentation.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Peptide Directory', 'peptide-starter' ),
|
|
'slug' => 'peptides',
|
|
'template' => 'page-directory.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Science Feed', 'peptide-starter' ),
|
|
'slug' => 'news',
|
|
'template' => 'page-science-feed.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Profile', 'peptide-starter' ),
|
|
'slug' => 'profile',
|
|
'template' => 'page-profile.php',
|
|
),
|
|
array(
|
|
'title' => __( 'Sign In', 'peptide-starter' ),
|
|
'slug' => 'auth',
|
|
'template' => 'page-auth.php',
|
|
),
|
|
);
|
|
|
|
foreach ( $pages as $page_data ) {
|
|
$existing = get_page_by_path( $page_data['slug'] );
|
|
|
|
if ( $existing ) {
|
|
update_post_meta( $existing->ID, '_wp_page_template', $page_data['template'] );
|
|
continue;
|
|
}
|
|
|
|
$page_id = wp_insert_post(
|
|
array(
|
|
'post_title' => $page_data['title'],
|
|
'post_name' => $page_data['slug'],
|
|
'post_status' => 'publish',
|
|
'post_type' => 'page',
|
|
'post_content' => '',
|
|
'post_author' => 1,
|
|
)
|
|
);
|
|
|
|
if ( $page_id && ! is_wp_error( $page_id ) ) {
|
|
update_post_meta( $page_id, '_wp_page_template', $page_data['template'] );
|
|
}
|
|
}
|
|
}
|
|
add_action( 'after_switch_theme', 'peptide_starter_create_pages' );
|
|
|
|
/**
|
|
* One-time migration: enrol v1.5.0 subscribers into email verification.
|
|
*
|
|
* Runs once per site — guarded by the ps_verify_migration_version option.
|
|
* Iterates subscribers in batches of 50 via wp_mail(). Users created by
|
|
* admin (any role above subscriber) are skipped — we assume admin-created
|
|
* accounts are trusted.
|
|
*
|
|
* Side effects: writes user meta + sends email per enrolled user.
|
|
*
|
|
* Cost note: worst case N emails on first admin page load after deploy.
|
|
* If the site has many users, move this to WP-Cron before shipping a
|
|
* large-user release (not a concern for the current zero-user site).
|
|
*
|
|
* @return void
|
|
*/
|
|
function peptide_starter_migrate_existing_users_to_verification() {
|
|
if ( ! is_admin() ) {
|
|
return;
|
|
}
|
|
$done = get_option( 'ps_verify_migration_version' );
|
|
if ( PEPTIDE_STARTER_VERSION === $done ) {
|
|
return;
|
|
}
|
|
|
|
$subscribers = get_users(
|
|
array(
|
|
'role' => 'subscriber',
|
|
'fields' => array( 'ID' ),
|
|
'number' => 500,
|
|
'orderby' => 'ID',
|
|
'order' => 'ASC',
|
|
)
|
|
);
|
|
|
|
foreach ( $subscribers as $user ) {
|
|
$already_enrolled = get_user_meta( $user->ID, 'ps_pending_verification', true );
|
|
if ( '' !== (string) $already_enrolled ) {
|
|
continue;
|
|
}
|
|
if ( function_exists( 'peptide_starter_send_verification_email' ) ) {
|
|
peptide_starter_send_verification_email( $user->ID );
|
|
}
|
|
}
|
|
|
|
update_option( 'ps_verify_migration_version', PEPTIDE_STARTER_VERSION, false );
|
|
}
|
|
add_action( 'admin_init', 'peptide_starter_migrate_existing_users_to_verification' );
|