Security-only release per ADR-0001. Closes all six ship-blockers from the post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account enumeration via separate error messages), PSEC-003 (registration auto-login with no email verification), PSEC-004 (ungated "My Data" templates), PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no honeypot/CAPTCHA on public forms). Adds inc/config.php (single source of truth for all security thresholds, filterable via peptide_starter_security_config), inc/rate-limiter.php (Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver, transient-backed, never stores raw IPs), and inc/email-verification.php (43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint). Auth handlers rewritten to: unify all failure messages, rate-limit before any expensive check, drop registrations with a filled honeypot silently, stop auto-login on register, send a verification email instead. The require_login() helper lives in inc/helpers.php and is applied at the top of page-tracker.php, page-subject-log.php, and page-protocol-builder.php; page-calculator.php stays open (no PII, no writes). Newsletter signup gains: consent checkbox, privacy link, honeypot, autoload=false on the wp_options blob, unsubscribe token stored per row, /newsletter-unsubscribe route, merged success+duplicate into a single "ok" state. Admin export runs every cell through peptide_starter_csv_safe() which prefixes leading =/+/-/@/tab/CR with a quote. Contact handler hardens against email-header injection (rejects name values with \r \n , < >), rate-limits, honors honeypot, tags mail failures with a request ID for correlation without logging message content. Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail probe so we can check Hostinger outbound deliverability any time it looks flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1 subscribers into the verification flow (currently a no-op — zero users — but guarded for the future). Other cleanup from the audit: fallback primary menu moved out of header.php into inc/helpers.php (redeclaration risk), placeholder footer language links replaced with "Translations coming soon", footer copyright now reads through the customizer getter, settings-panel gains a proper Tab/Shift+Tab focus trap and saves/restores body overflow, documentation heading IDs slugified from heading text with collision counters, JS files standardized on const/let. Six new PHPUnit suites cover rate limiter lifecycle, auth handler error unification and rate limits, email verification token generation and expiry, contact handler header injection + rate limit + honeypot, newsletter signup consent + CSV safety, and require_login gate behavior. ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new module layout, data flows, security patterns for rate-limiting, honeypotting, gating, and CSV-safe export. Version bumped to 1.5.1 in style.css and functions.php. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
176 lines
5.3 KiB
PHP
176 lines
5.3 KiB
PHP
<?php
|
|
/**
|
|
* wp_mail Deliverability Diagnostic
|
|
*
|
|
* Admin-only tool under Tools → Mail Test. Sends a test message via
|
|
* wp_mail and reports whether delivery was accepted by the MTA,
|
|
* timing, and any PHPMailer error. Useful every time Hostinger (or any
|
|
* shared host) gets flaky on outbound SMTP.
|
|
*
|
|
* @see inc/config.php — no config dependency; uses hardcoded test body
|
|
* @see functions.php — includes this file
|
|
*
|
|
* What: Admin diagnostic page that exercises wp_mail().
|
|
* Who calls it: WordPress admin_menu + admin_post_*.
|
|
* Dependencies: wp_mail, phpmailer_init hook capture.
|
|
*
|
|
* @package peptide-starter
|
|
*/
|
|
|
|
// Exit if accessed directly.
|
|
if ( ! defined( 'ABSPATH' ) ) {
|
|
exit;
|
|
}
|
|
|
|
/**
|
|
* Register the Mail Test admin page under Tools.
|
|
*
|
|
* @return void
|
|
*/
|
|
function peptide_starter_mail_diagnostic_menu() {
|
|
add_management_page(
|
|
__( 'Mail Deliverability Test', 'peptide-starter' ),
|
|
__( 'Mail Test', 'peptide-starter' ),
|
|
'manage_options',
|
|
'ps-mail-test',
|
|
'peptide_starter_mail_diagnostic_page'
|
|
);
|
|
}
|
|
add_action( 'admin_menu', 'peptide_starter_mail_diagnostic_menu' );
|
|
|
|
/**
|
|
* Render the Mail Test admin page.
|
|
*
|
|
* @return void
|
|
*/
|
|
function peptide_starter_mail_diagnostic_page() {
|
|
$result = get_transient( 'ps_mail_test_result' );
|
|
if ( $result ) {
|
|
delete_transient( 'ps_mail_test_result' );
|
|
}
|
|
?>
|
|
<div class="wrap">
|
|
<h1><?php esc_html_e( 'Mail Deliverability Test', 'peptide-starter' ); ?></h1>
|
|
<p>
|
|
<?php esc_html_e( 'Sends a test message via wp_mail() to the address you specify and reports whether the local MTA accepted it. Use this after every host-side change to verify transactional mail (registration, verification, password reset) still works.', 'peptide-starter' ); ?>
|
|
</p>
|
|
|
|
<?php if ( is_array( $result ) ) : ?>
|
|
<div class="notice <?php echo $result['sent'] ? 'notice-success' : 'notice-error'; ?>">
|
|
<p>
|
|
<strong>
|
|
<?php
|
|
echo esc_html(
|
|
$result['sent']
|
|
? __( 'wp_mail returned true (local MTA accepted).', 'peptide-starter' )
|
|
: __( 'wp_mail returned false (local MTA rejected or plugin error).', 'peptide-starter' )
|
|
);
|
|
?>
|
|
</strong>
|
|
</p>
|
|
<p>
|
|
<?php
|
|
echo esc_html(
|
|
sprintf(
|
|
/* translators: 1: recipient, 2: duration in ms, 3: phpmailer error */
|
|
__( 'Recipient: %1$s — Duration: %2$s ms — PHPMailer: %3$s', 'peptide-starter' ),
|
|
$result['to'],
|
|
number_format( $result['ms'] ),
|
|
'' === $result['error'] ? '—' : $result['error']
|
|
)
|
|
);
|
|
?>
|
|
</p>
|
|
<p>
|
|
<?php esc_html_e( 'Note: wp_mail returning true only means the outbound MTA accepted the message. Spam placement can only be verified by checking the recipient inbox.', 'peptide-starter' ); ?>
|
|
</p>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<form method="post" action="<?php echo esc_url( admin_url( 'admin-post.php' ) ); ?>">
|
|
<?php wp_nonce_field( 'ps_mail_test', 'ps_mail_test_nonce' ); ?>
|
|
<input type="hidden" name="action" value="ps_mail_test">
|
|
<table class="form-table" role="presentation">
|
|
<tr>
|
|
<th scope="row"><label for="ps_mail_to"><?php esc_html_e( 'Recipient', 'peptide-starter' ); ?></label></th>
|
|
<td>
|
|
<input
|
|
type="email"
|
|
id="ps_mail_to"
|
|
name="to"
|
|
class="regular-text"
|
|
value="<?php echo esc_attr( get_option( 'admin_email' ) ); ?>"
|
|
required
|
|
>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
<?php submit_button( __( 'Send Test Email', 'peptide-starter' ) ); ?>
|
|
</form>
|
|
</div>
|
|
<?php
|
|
}
|
|
|
|
/**
|
|
* Handle the test-email POST.
|
|
*
|
|
* Side effects: calls wp_mail, stores a short-lived transient with the
|
|
* result, redirects back to the admin page.
|
|
*
|
|
* @return void
|
|
*/
|
|
function peptide_starter_mail_diagnostic_send() {
|
|
if ( ! current_user_can( 'manage_options' ) ) {
|
|
wp_die( esc_html__( 'Insufficient privileges.', 'peptide-starter' ), '', array( 'response' => 403 ) );
|
|
}
|
|
if ( ! isset( $_POST['ps_mail_test_nonce'] ) ||
|
|
! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['ps_mail_test_nonce'] ) ), 'ps_mail_test' ) ) {
|
|
wp_die( esc_html__( 'Security check failed.', 'peptide-starter' ), '', array( 'response' => 403 ) );
|
|
}
|
|
|
|
$to = isset( $_POST['to'] ) ? sanitize_email( wp_unslash( $_POST['to'] ) ) : '';
|
|
if ( ! is_email( $to ) ) {
|
|
wp_safe_redirect( admin_url( 'tools.php?page=ps-mail-test' ) );
|
|
exit;
|
|
}
|
|
|
|
$captured_error = '';
|
|
$capture = function ( $wp_error ) use ( &$captured_error ) {
|
|
if ( is_wp_error( $wp_error ) ) {
|
|
$captured_error = $wp_error->get_error_message();
|
|
}
|
|
};
|
|
add_action( 'wp_mail_failed', $capture );
|
|
|
|
$start = microtime( true );
|
|
$subject = sprintf(
|
|
/* translators: %s: site name */
|
|
__( '[%s] Mail deliverability test', 'peptide-starter' ),
|
|
wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES )
|
|
);
|
|
$body = sprintf(
|
|
/* translators: %s: site url */
|
|
__( "This is a wp_mail deliverability test from %s.\n\nIf you received this, wp_mail is working.", 'peptide-starter' ),
|
|
home_url( '/' )
|
|
);
|
|
$sent = wp_mail( $to, $subject, $body );
|
|
$elapsed = ( microtime( true ) - $start ) * 1000;
|
|
|
|
remove_action( 'wp_mail_failed', $capture );
|
|
|
|
set_transient(
|
|
'ps_mail_test_result',
|
|
array(
|
|
'sent' => (bool) $sent,
|
|
'to' => $to,
|
|
'ms' => (int) $elapsed,
|
|
'error' => (string) $captured_error,
|
|
),
|
|
60
|
|
);
|
|
|
|
wp_safe_redirect( admin_url( 'tools.php?page=ps-mail-test' ) );
|
|
exit;
|
|
}
|
|
add_action( 'admin_post_ps_mail_test', 'peptide_starter_mail_diagnostic_send' );
|