cb8b73f4ab
Security-only release per ADR-0001. Closes all six ship-blockers from the post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account enumeration via separate error messages), PSEC-003 (registration auto-login with no email verification), PSEC-004 (ungated "My Data" templates), PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no honeypot/CAPTCHA on public forms). Adds inc/config.php (single source of truth for all security thresholds, filterable via peptide_starter_security_config), inc/rate-limiter.php (Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver, transient-backed, never stores raw IPs), and inc/email-verification.php (43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint). Auth handlers rewritten to: unify all failure messages, rate-limit before any expensive check, drop registrations with a filled honeypot silently, stop auto-login on register, send a verification email instead. The require_login() helper lives in inc/helpers.php and is applied at the top of page-tracker.php, page-subject-log.php, and page-protocol-builder.php; page-calculator.php stays open (no PII, no writes). Newsletter signup gains: consent checkbox, privacy link, honeypot, autoload=false on the wp_options blob, unsubscribe token stored per row, /newsletter-unsubscribe route, merged success+duplicate into a single "ok" state. Admin export runs every cell through peptide_starter_csv_safe() which prefixes leading =/+/-/@/tab/CR with a quote. Contact handler hardens against email-header injection (rejects name values with \r \n , < >), rate-limits, honors honeypot, tags mail failures with a request ID for correlation without logging message content. Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail probe so we can check Hostinger outbound deliverability any time it looks flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1 subscribers into the verification flow (currently a no-op — zero users — but guarded for the future). Other cleanup from the audit: fallback primary menu moved out of header.php into inc/helpers.php (redeclaration risk), placeholder footer language links replaced with "Translations coming soon", footer copyright now reads through the customizer getter, settings-panel gains a proper Tab/Shift+Tab focus trap and saves/restores body overflow, documentation heading IDs slugified from heading text with collision counters, JS files standardized on const/let. Six new PHPUnit suites cover rate limiter lifecycle, auth handler error unification and rate limits, email verification token generation and expiry, contact handler header injection + rate limit + honeypot, newsletter signup consent + CSV safety, and require_login gate behavior. ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new module layout, data flows, security patterns for rate-limiting, honeypotting, gating, and CSV-safe export. Version bumped to 1.5.1 in style.css and functions.php. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
90 lines
3.6 KiB
PHP
90 lines
3.6 KiB
PHP
<?php
|
|
/**
|
|
* The footer for Peptide Starter theme
|
|
*
|
|
* Updated footer with disclaimer, language links, and settings panel.
|
|
*
|
|
* @see template-parts/settings-panel.php — slide-out support panel
|
|
* @see template-parts/newsletter-signup.php — newsletter CTA (on front page)
|
|
* @see functions.php — newsletter handler, contact form handler
|
|
*
|
|
* @package peptide-starter
|
|
*/
|
|
|
|
?>
|
|
|
|
<!-- Newsletter Signup (front page only — science feed includes its own) -->
|
|
<?php if ( is_front_page() ) : ?>
|
|
<?php get_template_part( 'template-parts/newsletter', 'signup' ); ?>
|
|
<?php endif; ?>
|
|
|
|
<footer class="site-footer">
|
|
<div class="footer-wrapper">
|
|
<!-- Footer Grid -->
|
|
<div class="footer-grid">
|
|
<?php
|
|
for ( $i = 1; $i <= 4; $i++ ) {
|
|
echo '<div class="footer-section">';
|
|
if ( is_active_sidebar( 'footer-' . $i ) ) {
|
|
dynamic_sidebar( 'footer-' . $i );
|
|
} else {
|
|
// Default footer content if no widgets.
|
|
if ( 1 === $i ) {
|
|
echo '<h3>' . esc_html__( 'About', 'peptide-starter' ) . '</h3>';
|
|
echo '<p>' . esc_html__( 'Peptide Repo is a comprehensive scientific database for peptide research.', 'peptide-starter' ) . '</p>';
|
|
} elseif ( 2 === $i ) {
|
|
echo '<h3>' . esc_html__( 'Quick Links', 'peptide-starter' ) . '</h3>';
|
|
echo '<ul>';
|
|
echo '<li><a href="' . esc_url( home_url( '/' ) ) . '">' . esc_html__( 'Home', 'peptide-starter' ) . '</a></li>';
|
|
echo '<li><a href="' . esc_url( home_url( '/peptides' ) ) . '">' . esc_html__( 'Peptides Database', 'peptide-starter' ) . '</a></li>';
|
|
echo '<li><a href="' . esc_url( home_url( '/documentation' ) ) . '">' . esc_html__( 'Documentation', 'peptide-starter' ) . '</a></li>';
|
|
echo '<li><a href="' . esc_url( home_url( '/news' ) ) . '">' . esc_html__( 'Science Feed', 'peptide-starter' ) . '</a></li>';
|
|
echo '</ul>';
|
|
} elseif ( 3 === $i ) {
|
|
echo '<h3>' . esc_html__( 'Tools', 'peptide-starter' ) . '</h3>';
|
|
echo '<ul>';
|
|
echo '<li><a href="' . esc_url( home_url( '/calculator' ) ) . '">' . esc_html__( 'Calculator', 'peptide-starter' ) . '</a></li>';
|
|
echo '<li><a href="' . esc_url( home_url( '/protocol-builder' ) ) . '">' . esc_html__( 'Protocol Builder', 'peptide-starter' ) . '</a></li>';
|
|
echo '<li><a href="' . esc_url( home_url( '/tracker' ) ) . '">' . esc_html__( 'Tracker', 'peptide-starter' ) . '</a></li>';
|
|
echo '</ul>';
|
|
} elseif ( 4 === $i ) {
|
|
echo '<h3>' . esc_html__( 'Connect', 'peptide-starter' ) . '</h3>';
|
|
echo '<ul>';
|
|
echo '<li><a href="https://github.com/peptiderepo" target="_blank" rel="noopener">' . esc_html__( 'GitHub', 'peptide-starter' ) . '</a></li>';
|
|
echo '</ul>';
|
|
}
|
|
}
|
|
echo '</div>';
|
|
}
|
|
?>
|
|
</div>
|
|
|
|
<!-- Footer Bottom -->
|
|
<div class="footer-bottom">
|
|
<p class="footer-copyright">
|
|
<?php echo wp_kses_post( peptide_starter_get_footer_copyright() ); ?>
|
|
</p>
|
|
|
|
<!-- Disclaimer -->
|
|
<p class="footer-disclaimer">
|
|
<?php esc_html_e( 'All data is provided for informational and educational purposes only. This platform does not provide medical advice, diagnoses, or treatment recommendations. Always consult qualified professionals.', 'peptide-starter' ); ?>
|
|
</p>
|
|
|
|
<!-- Translations note — placeholder links removed in v1.5.1;
|
|
renders only when localized blog URLs are wired up. -->
|
|
<p class="footer-languages-note">
|
|
<?php esc_html_e( 'Translations coming soon.', 'peptide-starter' ); ?>
|
|
</p>
|
|
</div>
|
|
</div>
|
|
</footer>
|
|
|
|
<?php
|
|
// Settings slide-out panel (hidden by default, toggled via JS).
|
|
get_template_part( 'template-parts/settings', 'panel' );
|
|
?>
|
|
|
|
<?php wp_footer(); ?>
|
|
</body>
|
|
</html>
|