Security-only release per ADR-0001. Closes all six ship-blockers from the post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account enumeration via separate error messages), PSEC-003 (registration auto-login with no email verification), PSEC-004 (ungated "My Data" templates), PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no honeypot/CAPTCHA on public forms). Adds inc/config.php (single source of truth for all security thresholds, filterable via peptide_starter_security_config), inc/rate-limiter.php (Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver, transient-backed, never stores raw IPs), and inc/email-verification.php (43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint). Auth handlers rewritten to: unify all failure messages, rate-limit before any expensive check, drop registrations with a filled honeypot silently, stop auto-login on register, send a verification email instead. The require_login() helper lives in inc/helpers.php and is applied at the top of page-tracker.php, page-subject-log.php, and page-protocol-builder.php; page-calculator.php stays open (no PII, no writes). Newsletter signup gains: consent checkbox, privacy link, honeypot, autoload=false on the wp_options blob, unsubscribe token stored per row, /newsletter-unsubscribe route, merged success+duplicate into a single "ok" state. Admin export runs every cell through peptide_starter_csv_safe() which prefixes leading =/+/-/@/tab/CR with a quote. Contact handler hardens against email-header injection (rejects name values with \r \n , < >), rate-limits, honors honeypot, tags mail failures with a request ID for correlation without logging message content. Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail probe so we can check Hostinger outbound deliverability any time it looks flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1 subscribers into the verification flow (currently a no-op — zero users — but guarded for the future). Other cleanup from the audit: fallback primary menu moved out of header.php into inc/helpers.php (redeclaration risk), placeholder footer language links replaced with "Translations coming soon", footer copyright now reads through the customizer getter, settings-panel gains a proper Tab/Shift+Tab focus trap and saves/restores body overflow, documentation heading IDs slugified from heading text with collision counters, JS files standardized on const/let. Six new PHPUnit suites cover rate limiter lifecycle, auth handler error unification and rate limits, email verification token generation and expiry, contact handler header injection + rate limit + honeypot, newsletter signup consent + CSV safety, and require_login gate behavior. ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new module layout, data flows, security patterns for rate-limiting, honeypotting, gating, and CSV-safe export. Version bumped to 1.5.1 in style.css and functions.php. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
65 lines
1.7 KiB
PHP
65 lines
1.7 KiB
PHP
<?php
|
|
/**
|
|
* Tests for peptide_starter_require_login() helper.
|
|
*
|
|
* @package peptide-starter
|
|
*/
|
|
|
|
class Test_Auth_Gate extends WP_UnitTestCase {
|
|
|
|
/**
|
|
* @var string|null Captured redirect target.
|
|
*/
|
|
protected $redirect = null;
|
|
|
|
public function set_up() {
|
|
parent::set_up();
|
|
$this->redirect = null;
|
|
add_filter(
|
|
'wp_redirect',
|
|
function ( $url ) {
|
|
$this->redirect = $url;
|
|
return false;
|
|
}
|
|
);
|
|
}
|
|
|
|
public function tear_down() {
|
|
remove_all_filters( 'wp_redirect' );
|
|
wp_set_current_user( 0 );
|
|
parent::tear_down();
|
|
}
|
|
|
|
public function test_anonymous_user_redirected_to_auth() {
|
|
$_SERVER['REQUEST_URI'] = '/tracker';
|
|
try { peptide_starter_require_login(); } catch ( Exception $e ) { /* exit */ }
|
|
$this->assertNotNull( $this->redirect );
|
|
$this->assertStringContainsString( '/auth', (string) $this->redirect );
|
|
$this->assertStringContainsString( 'redirect_to=', (string) $this->redirect );
|
|
}
|
|
|
|
public function test_unverified_user_redirected_to_profile_banner() {
|
|
$user_id = self::factory()->user->create();
|
|
update_user_meta( $user_id, 'ps_pending_verification', 1 );
|
|
wp_set_current_user( $user_id );
|
|
|
|
try { peptide_starter_require_login(); } catch ( Exception $e ) { /* exit */ }
|
|
$this->assertNotNull( $this->redirect );
|
|
$this->assertStringContainsString( 'verify_required=1', (string) $this->redirect );
|
|
}
|
|
|
|
public function test_verified_logged_in_user_passes_through() {
|
|
$user_id = self::factory()->user->create();
|
|
wp_set_current_user( $user_id );
|
|
|
|
$reached = false;
|
|
try {
|
|
peptide_starter_require_login();
|
|
$reached = true;
|
|
} catch ( Exception $e ) { /* would be redirect */ }
|
|
|
|
$this->assertTrue( $reached );
|
|
$this->assertNull( $this->redirect );
|
|
}
|
|
}
|