Get WordPress

Plugin Directory

Changeset 738058

Timestamp:
07/09/2013 02:38:46 AM (11 years ago)
Author:
sean212
Message:

Updates for 2.0.2

Location:
lockdown-wp-admin/trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • lockdown-wp-admin/trunk/README.md

    r700782 r738058  
    8888
    89892.0.1
     90
    9091
    91 Tiny bug fix.
     922.0.2
     93* Query string detection bug fix by [James Bonham](http://wordpress.org/support/profile/jamesbonham)
     94* Issues with WordPress in a sub-directory

  • lockdown-wp-admin/trunk/admin.php

    r694254 r738058  
    3434            <br />
    3535            <em>This will change it from <?php echo wp_guess_url(); ?>/wp-login.php to whatever you put in this box. If you leave it <strong>black</strong>, it will be disabled.<br />
    36             Say if you put "login" into the box, your new login URL will be <?php echo wp_guess_url(); ?>/login/.</em></label>
     36            Say if you put "login" into the box, your new login URL will be <?php echo _url(); ?>/login/.</em></label>
    3737        <?php
    3838global $auth_obj;
    39 $url = wp_guess_url() . '/'. $this->login_base;
     39$url = _url() . '/'. $this->login_base;
    4040?>
    4141        <p>Your current login URL is <code><a href="<?php echo $url; ?>"><?php echo $url; ?></a></code>.</p>

  • lockdown-wp-admin/trunk/lockdown-wp-admin.php

    r700782 r738058  
    55Donate link: http://seanfisher.co/donate/
    66Description: Securing the WordPress Administration interface by concealing the administration dashboard and changing the login page URL.
    7 Version: 2.0.1
     7Version: 2.0.
    88Author: Sean Fisher
    99Author URI: http://seanfisher.co/
    … …  
    1818 *
    1919 * @author   Sean Fisher <me@seanfisher.co>
    20  * @version  1.9
     20 * @version 
    2121 * @license   GPL
    2222**/
    … …  
    2929     * @access private
    3030    **/
    31     private $ld_admin_version = 2.0;
     31    p;
    3232   
    3333    /**
    … …  
    4545     * @access  private
    4646    **/
    47     private $current_user = FALSE;
     47    pr $current_user = FALSE;
    4848   
    4949    /**
    … …  
    5252     * @access  private
    5353    **/
    54     private $login_base = FALSE;
     54    pr $login_base = FALSE;
    5555   
    5656    public function __construct()
    … …  
    7878    {
    7979        // Since PHP saves the HTTP Password in a bunch of places, we have to be able to test for all of them
    80         $username = NULL;
    81         $password = NULL;
     80        $username = $password = NULL;
    8281       
    8382        // mod_php
    … …  
    153152        if ( isset( $_GET['delete'] ) )
    154153        {
    155             //  Delete the user.
     154            //Delete the user.
    156155            unset( $users );
    157156            $users = $this->get_private_users();
    … …  
    165164                        if( $this->current_user !== '' && $to_delete === $this->current_user )
    166165                        {
    167                             //  They can't delete themselves!
     166                            //They can't delete themselves!
    168167                            define('LD_ERROR', 'delete-self');
    169168                            return;
    … …  
    198197            return;
    199198       
    200         //  Nonce
     199        //Nonce
    201200        $nonce = $_POST['_wpnonce'];
    202201        if (! wp_verify_nonce($nonce, 'lockdown-wp-admin') )
    203202            wp_die('Security error, please try again.');
    204203       
    205         //  ---------------------------------------------------
    206         //  They're updating.
    207         //  ---------------------------------------------------
     204        //---------------------------------------------------
     205        //They're updating.
     206        //---------------------------------------------------
    208207        if ( isset( $_POST['http_auth'] ) )
    209208            update_option('ld_http_auth', trim( strtolower( $_POST['http_auth'] ) ) );
    … …  
    245244        }
    246245       
    247         //  Redirect
     246        //Redirect
    248247        define('LD_WP_ADMIN', TRUE);
    249248        return;
    … …  
    259258    private function inauth_headers()
    260259    {
    261         //  Disable if there is a text file there.
     260        //Disable if there is a text file there.
    262261        if ( file_exists(dirname(__FILE__).DIRECTORY_SEPARATOR.'disable_auth.txt'))
    263262            return;
    … …  
    292291        $opt = get_option('ld_hide_wp_admin');
    293292       
    294         //  Nope, they didn't enable it.
     293        //Nope, they didn't enable it.
    295294        if ( $opt !== 'yep' )
    296295            return $this->setup_http_area();
    … …  
    300299        $no_check_files = apply_filters('no_check_files', $no_check_files);
    301300       
    302         $explode = explode('/', $_SERVER['SCRIPT_FILENAME'] );
     301        $script_filename = empty($_SERVER['SCRIPT_FILENAME'])
     302            ? $_SERVER['PATH_TRANSLATED']
     303            : $_SERVER['SCRIPT_FILENAME'];
     304        $explode = explode('/', $script_filename);
    303305        $file = end( $explode );
    304306           
    305307            if ( in_array( $file, $no_check_files ) )
    306308            {
     309
     310
     311
     312
     313
     314
     315
    307316            define('INTERNAL_AUTH_PASSED', TRUE);
    308317            return;
    … …  
    328337    public function get_file()
    329338    {
    330         //  We're gonna hide it.
     339        //We're gonna hide it.
    331340        $no_check_files = array('async-upload.php');
    332341        $no_check_files = apply_filters('no_check_files', $no_check_files);
    333342       
    334         $explode = explode('/', $_SERVER['SCRIPT_FILENAME'] );
     343        $script_filename = empty($_SERVER['SCRIPT_FILENAME'])
     344            ? $_SERVER['PATH_TRANSLATED']
     345            : $_SERVER['SCRIPT_FILENAME'];
     346        $explode = explode('/', $script_filename );
    335347        return end( $explode );
    336348    }
    … …  
    345357    protected function setup_http_area()
    346358    {
    347         //  We save what type of auth we're doing here.
     359        //We save what type of auth we're doing here.
    348360        $opt = get_option('ld_http_auth');
    349361       
    … …  
    351363        switch( $opt )
    352364        {
    353             //  HTTP auth is going to ask for their WordPress creds.
     365            //HTTP auth is going to ask for their WordPress creds.
    354366            case 'wp_creds' :
    355367                $creds = $this->get_http_auth_creds();
    … …  
    357369                    $this->inauth_headers(); // Invalid credentials
    358370               
    359                 //  Are they already logged in as this?
     371                //Are they already logged in as this?
    360372                $current_uid = get_current_user_id();
    361373               
    362                 //  We fixed this for use with non WP-MS sites
     374                //We fixed this for use with non WP-MS sites
    363375                $requested_user = get_user_by('login', $creds['username']);
    364376               
    365                 //  Not a valid user.
     377                //Not a valid user.
    366378                if (! $requested_user )
    367379                    $this->inauth_headers();
    368380               
    369                 //  The correct User ID.
     381                //The correct User ID.
    370382                $requested_uid = (int) $requested_user->ID;
    371383               
    372                 //  Already logged in?
     384                //Already logged in?
    373385                if ( $current_uid === $requested_uid )
    374386                {
    … …  
    377389                }
    378390               
    379                 //  Attempt to sign them in if they aren't already
     391                //Attempt to sign them in if they aren't already
    380392                if (! is_user_logged_in() ) :
    381                     //  Try it via wp_signon
     393                    //Try it via wp_signon
    382394                    $creds = array();
    383395                    $creds['user_login'] = $creds['username'];
    … …  
    386398                    $user = wp_signon( $creds, false );
    387399                   
    388                     //  In error :(
     400                    //
    389401                    if ( is_wp_error($user) )
    390402                        $this->inauth_headers();
    391403                endif;
    392404               
    393                 //  They passed!
     405                //They passed!
    394406                define('INTERNAL_AUTH_PASSED', TRUE);
    395407            break;
    … …  
    404416                    return;
    405417               
    406                 //  Let's NOT lock everybody out
     418                //Let's NOT lock everybody out
    407419                if ( count( $users ) < 1 )
    408420                    return;
    … …  
    415427                    $this->inauth_headers();
    416428               
    417                 //  Did they enter a valid user?
     429                //Did they enter a valid user?
    418430                if ( $this->user_array_check( $users, $creds['username'], $creds['password'] ) )
    419431                {
    … …  
    483495     * @param integer
    484496    **/
    485     private function set_current_user( $array, $user )
     497    pr function set_current_user( $array, $user )
    486498    {
    487499        foreach( $array as $key => $val )
    … …  
    510522    public function admin_callback()
    511523    {
    512         //  Update the options
     524        //Update the options
    513525        $this->update_options();
    514526       
    515         //  The UI
     527        //The UI
    516528        require_once( dirname( __FILE__ ) . '/admin.php' );
    517529    }   
    … …  
    541553        $login_base = get_option('ld_login_base');
    542554       
    543         //  It's not enabled.
     555        //It's not enabled.
    544556        if ( $login_base == NULL || ! $login_base || $login_base == '' )
    545557            return;
    … …  
    548560        unset( $login_base );
    549561       
    550         //  Setup the filters for the new login form
     562        //Setup the filters for the new login form
    551563        add_filter('wp_redirect', array( &$this, 'filter_wp_login'));
    552564        add_filter('network_site_url', array( &$this, 'filter_wp_login'));
    553565        add_filter('site_url', array( &$this, 'filter_wp_login'));
    554566       
    555         //  We need to get the URL
    556         //  This means we need to take the current URL,
    557         //  strip it of an WordPress path (if the blog is located @ /blog/)
    558         //  And then remove the query string
    559         //  We also need to remove the index.php from the URL if it exists
    560        
    561         //  The blog's URL
     567        //We need to get the URL
     568        //This means we need to take the current URL,
     569        //strip it of an WordPress path (if the blog is located @ /blog/)
     570        //And then remove the query string
     571        //We also need to remove the index.php from the URL if it exists
     572       
     573        //The blog's URL
    562574        $blog_url = trailingslashit( get_bloginfo('url') );
    563575       
    564         //  The Current URL
     576        //The Current URL
    565577        $schema = is_ssl() ? 'https://' : 'http://';
    566578        $current_url = $schema . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
    … …  
    569581        $request_url = str_replace('index.php/', '', $request_url);
    570582       
    571         list( $base, $query ) = explode( '?', $request_url, 2 );
    572        
    573         //  Remove trailing slash
     583        $url_parts = explode( '?', $request_url, 2 );
     584        $base = $url_parts[0];
     585
     586        // Remove trailing slash
    574587        $base = rtrim($base,"/");
    575588        $exp = explode( '/', $base, 2 );
    576         $super_base = reset( $exp );
    577        
    578         //  Are they visiting wp-login.php?
     589        $super_base = ( $exp );
     590
     591        //Are they visiting wp-login.php?
    579592        if ( $super_base == 'wp-login.php')
    580593            $this->throw_404();
    581594       
    582         //  Is this the "login" url?
     595        //Is this the "login" url?
    583596        if ( $base !== $this->login_base )
    584597            return FALSE;
    … …  
    592605        do_action('ld_login_page');
    593606       
    594         include ABSPATH . "/wp-login.php";
     607        include ABSPATH . ;
    595608        exit;
    596609    }
    … …  
    609622     * Launch and display the 404 page depending upon the template
    610623     *
    611      * @param       void
    612      * @return      void
     624     * @paramvoid
     625     * @returnvoid
    613626    **/
    614627    public function throw_404()
    … …  
    626639        wp_dequeue_script( 'admin-bar' );
    627640        wp_dequeue_style( 'admin-bar' );
    628        
     641
    629642        // Template
    630         $four_tpl = get_404_template();
     643        $four_tpl = );
    631644
    632645        // Handle the admin bar
    … …  
    637650        {
    638651            // We're gonna try and get TwentyTen's one
    639             $twenty_ten_tpl = apply_filters('LD_404_FALLBACK', WP_CONTENT_DIR . '/themes/twentytwelve/404.php');
     652            $twenty_ten_tpl = apply_filters('LD_404_FALLBACK', WP_CONTENT_DIR . '/themes/twentyt/404.php');
    640653           
    641654            if (file_exists($twenty_ten_tpl))

  • lockdown-wp-admin/trunk/no-wpmu.php

    r406374 r738058  
    3232        }
    3333       
    34         //  Default options
     34        //Default options
    3535        update_option('ld_http_auth', 'none');
    3636        update_option('ld_hide_wp_admin', 'no');
    … …  
    4444    function network_activate_error()
    4545    {
    46         //  De-activate the plugin
     46        //De-activate the plugin
    4747        $active_plugins = (array) get_option('active_plugins');
    4848        $active_plugins_network = (array) get_site_option('active_sitewide_plugins');
    … …  
    104104}
    105105
    106 //  The object.
     106//The object.
    107107$setup_no_wpmu = new Disable_WPMS_Plugin_LD();
    108108

  • lockdown-wp-admin/trunk/readme.txt

    r700782 r738058  
    66Requires at least: 3.3
    77Tested up to: 3.5.1
    8 Stable tag: 2.0.1
     8Stable tag: 2.0.
    99
    1010Lockdown WP Admin conceals the administration and login screen from intruders. It can hide WordPress Admin (/wp-admin/) and and login (/wp-login.php) as well as add HTTP authentication to the login system. We can also change the login URL from wp-login.php to whatever you'd like: /login, /log-in-here, etc.
    … …  
    9393
    9494= 2.0.1 =
    95 * Tiny bug fix
     95* Bug fix by [Michal Krause](https://github.com/michal-krause)
     96
     97= 2.0.2 =
     98* Query string detection bug fix by [James Bonham](http://wordpress.org/support/profile/jamesbonham)
     99* Issues with WordPress in a sub-directory
Note: See TracChangeset for help on using the changeset viewer.