cb8b73f4ab
Security-only release per ADR-0001. Closes all six ship-blockers from the post-v1.5.0 audit: PSEC-001 (no rate limiting), PSEC-002 (account enumeration via separate error messages), PSEC-003 (registration auto-login with no email verification), PSEC-004 (ungated "My Data" templates), PSEC-005 (CSV formula injection on subscriber export), PSEC-006 (no honeypot/CAPTCHA on public forms). Adds inc/config.php (single source of truth for all security thresholds, filterable via peptide_starter_security_config), inc/rate-limiter.php (Peptide_Starter_Rate_Limiter + Cloudflare-aware client IP resolver, transient-backed, never stores raw IPs), and inc/email-verification.php (43-char token, 24h TTL, /verify rewrite, rate-limited resend endpoint). Auth handlers rewritten to: unify all failure messages, rate-limit before any expensive check, drop registrations with a filled honeypot silently, stop auto-login on register, send a verification email instead. The require_login() helper lives in inc/helpers.php and is applied at the top of page-tracker.php, page-subject-log.php, and page-protocol-builder.php; page-calculator.php stays open (no PII, no writes). Newsletter signup gains: consent checkbox, privacy link, honeypot, autoload=false on the wp_options blob, unsubscribe token stored per row, /newsletter-unsubscribe route, merged success+duplicate into a single "ok" state. Admin export runs every cell through peptide_starter_csv_safe() which prefixes leading =/+/-/@/tab/CR with a quote. Contact handler hardens against email-header injection (rejects name values with \r \n , < >), rate-limits, honors honeypot, tags mail failures with a request ID for correlation without logging message content. Adds Tools → Mail Test (inc/mail-diagnostic.php): a permanent wp_mail probe so we can check Hostinger outbound deliverability any time it looks flaky. Adds a one-time admin_init migration that enrols pre-v1.5.1 subscribers into the verification flow (currently a no-op — zero users — but guarded for the future). Other cleanup from the audit: fallback primary menu moved out of header.php into inc/helpers.php (redeclaration risk), placeholder footer language links replaced with "Translations coming soon", footer copyright now reads through the customizer getter, settings-panel gains a proper Tab/Shift+Tab focus trap and saves/restores body overflow, documentation heading IDs slugified from heading text with collision counters, JS files standardized on const/let. Six new PHPUnit suites cover rate limiter lifecycle, auth handler error unification and rate limits, email verification token generation and expiry, contact handler header injection + rate limit + honeypot, newsletter signup consent + CSV safety, and require_login gate behavior. ARCHITECTURE.md and CONVENTIONS.md updated in the same commit — new module layout, data flows, security patterns for rate-limiting, honeypotting, gating, and CSV-safe export. Version bumped to 1.5.1 in style.css and functions.php. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
55 lines
1.5 KiB
PHP
55 lines
1.5 KiB
PHP
<?php
|
|
/**
|
|
* Template Name: Calculator
|
|
*
|
|
* Page template for the reconstitution calculator tool.
|
|
* Loads the Peptide Tools plugin calculator via shortcode.
|
|
*
|
|
* @see page-protocol-builder.php — sibling tool template
|
|
* @see functions.php — enqueue and page auto-creation
|
|
*
|
|
* What: Renders the calculator page with plugin shortcode integration.
|
|
* Who calls it: WordPress template hierarchy when a page uses this template.
|
|
* Dependencies: Peptide Tools plugin (optional — graceful fallback).
|
|
*
|
|
* @package peptide-starter
|
|
*/
|
|
|
|
// Exit if accessed directly.
|
|
if ( ! defined( 'ABSPATH' ) ) {
|
|
exit;
|
|
}
|
|
|
|
/*
|
|
* Intentionally open to anonymous users — the reconstitution calculator
|
|
* holds no PII and performs no writes. Gating it would add friction with
|
|
* no security benefit.
|
|
*/
|
|
|
|
get_header();
|
|
?>
|
|
|
|
<main id="main" class="site-main">
|
|
<section class="ps-tool-page">
|
|
<div class="ps-container">
|
|
<?php
|
|
if ( shortcode_exists( 'peptide_tools_calculator' ) ) {
|
|
echo do_shortcode( '[peptide_tools_calculator]' );
|
|
} else {
|
|
?>
|
|
<div class="ps-tool-fallback">
|
|
<h1><?php esc_html_e( 'Reconstitution Calculator', 'peptide-starter' ); ?></h1>
|
|
<p><?php esc_html_e( 'The calculator tool is currently being set up. Please check back soon.', 'peptide-starter' ); ?></p>
|
|
<a href="<?php echo esc_url( home_url( '/' ) ); ?>" class="ps-btn ps-btn-primary">
|
|
<?php esc_html_e( 'Return Home', 'peptide-starter' ); ?>
|
|
</a>
|
|
</div>
|
|
<?php
|
|
}
|
|
?>
|
|
</div>
|
|
</section>
|
|
</main>
|
|
|
|
<?php get_footer(); ?>
|