Changeset 3669794

Timestamp:

08/28/2026 04:57:55 AM (2 months ago)

Author:

sstoqnov

Message:

Bump to 1.6.7

Location:

sg-security/trunk

Files:

• core/Loader/Loader.php (modified) (1 diff)
• core/Sg_2fa/Sg_2fa.php (modified) (2 diffs)
• readme.txt (modified) (2 diffs)
• sg-security.php (modified) (2 diffs)
• vendor/autoload.php (modified) (1 diff)
• vendor/composer/autoload_psr4.php (modified) (1 diff)
• vendor/composer/autoload_real.php (modified) (2 diffs)
• vendor/composer/autoload_static.php (modified) (4 diffs)
• vendor/composer/installed.json (modified) (1 diff)
• vendor/composer/installed.php (modified) (2 diffs)
• vendor/siteground/siteground-emails/src/Email_Service.php (modified) (4 diffs)
• vendor/siteground/siteground-helper/src/Helper_Service.php (modified) (1 diff)

sg-security/trunk/core/Loader/Loader.php

@@ -340 +340 @@
                 add_action( 'wp_login', array( $this->sg_2fa, 'move_encryption_file' ), 9, 2 );
                 add_action( 'wp_login', array( $this->sg_2fa, 'init_2fa' ), 10, 2 );
+                add_filter( 'authenticate', array( $this->sg_2fa, 'block_xmlrpc_for_2fa_users' ), 99, 1 );
                 add_action( 'login_form_sgs2fa', array( $this->sg_2fa, 'validate_2fa_login' ) );
                 add_action( 'login_form_sgs2fabc', array( $this->sg_2fa, 'validate_2fabc_login' ) );

sg-security/trunk/core/Sg_2fa/Sg_2fa.php

@@ -455 +455 @@
                 }
 
-                // Parse the cookie.
+                // Parse the cookie into the user ID and the token.
                 $cookie_data = explode( '|', $_COOKIE[ $sg_2fa_user_cookie ] );
 
-                if (
-                        // If the 2FA is configured for the user.
-                        1 == get_user_meta( $cookie_data[0], 'sg_security_2fa_configured', true ) && // phpcs:ignore
-                        get_user_meta( $cookie_data[0], 'sgs_2fa_dnc_token', true ) === $cookie_data[1]  && // If there is already a cookie with that name and the name matches.
-                        (int) $cookie_data[0] === (int) $user->ID // If the cookie ID matches the logging in user ID.
-                ) {
-                        return true;
-                }
-
-                return false;
+                // Bail if the cookie is malformed. It must be exactly "<user_id>|<token>" with both parts present.
+                if ( 2 !== count( $cookie_data ) || '' === $cookie_data[0] || '' === $cookie_data[1] ) {
+                        return false;
+                }
+
+                // Bail if the cookie user ID does not match the logging in user ID.
+                if ( (int) $cookie_data[0] !== (int) $user->ID ) {
+                        return false;
+                }
+
+                // Bail if the 2FA is not configured for the user.
+                if ( 1 != get_user_meta( $cookie_data[0], 'sg_security_2fa_configured', true ) ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison
+                        return false;
+                }
+
+                // Bail if the user has no stored token. An absent single-value meta returns an empty
+                // string, which must never be treated as a match for an empty cookie token.
+                if ( ! metadata_exists( 'user', (int) $cookie_data[0], 'sgs_2fa_dnc_token' ) ) {
+                        return false;
+                }
+
+                // Get the stored 'do not challenge' token for the user.
+                $stored_token = get_user_meta( $cookie_data[0], 'sgs_2fa_dnc_token', true ); // phpcs:ignore
+
+                // Bail if the stored token is empty.
+                if ( '' === $stored_token ) {
+                        return false;
+                }
+
+                // Constant-time comparison of the stored token against the supplied cookie token.
+                return hash_equals( (string) $stored_token, (string) $cookie_data[1] );
         }
 
@@ -525 +546 @@
                 <?php
                 exit;
+        }
+
+        /**
+         * Block XML-RPC password authentication for users who are in 2FA scope.
+         *
+         * @since  1.6.6
+         *
+         * @param  null|\WP_User|\WP_Error $user The authenticated user, a WP_Error, or null.
+         * @return null|\WP_User|\WP_Error       WP_Error to block, otherwise $user unchanged.
+         */
+        public function block_xmlrpc_for_2fa_users( $user ) {
+                // Only act on XML-RPC requests; leave every other auth path untouched.
+                if ( ! defined( 'XMLRPC_REQUEST' ) || ! XMLRPC_REQUEST ) {
+                        return $user;
+                }
+
+                // Let core's own failures/short-circuits stand; only act on a resolved user.
+                if ( ! ( $user instanceof \WP_User ) ) {
+                        return $user;
+                }
+
+                // Allow users who are not in 2FA scope (e.g. subscribers) to keep using XML-RPC.
+                if ( empty( array_intersect( $this->get_admin_user_roles(), $user->roles ) ) ) {
+                        return $user;
+                }
+
+                // Escape hatch for sites that intentionally rely on XML-RPC for covered users.
+                if ( ! apply_filters( 'sg_security_2fa_block_xmlrpc', true, $user ) ) {
+                        return $user;
+                }
+
+                // Reject: wp_xmlrpc_server::login() turns this into a 403 fault before
+                // wp_set_current_user() runs, so no authenticated session is created.
+                return new \WP_Error(
+                        'sgs_2fa_xmlrpc_blocked',
+                        __( 'XML-RPC authentication is disabled for accounts that require 2-factor authentication.', 'sg-security' )
+                );
         }
 

sg-security/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.0
-Stable tag: 1.6.6
+Stable tag: 1.6.7
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
@@ -144 +144 @@
 
 == Changelog ==
+= Version 1.6.7 =
+Release Date Aug 28th, 2026
+
+* Security Improvements
+
 = Version 1.6.6 =
 Release Date Aug 26th, 2026

sg-security/trunk/sg-security.php

@@ -11 +11 @@
  * Plugin URI:        https://siteground.com
  * Description:       Security Optimizer by SiteGround is the all-in-one security solution for your WordPress website. With the carefully selected and easy to configure functions the plugin provides everything you need to secure your website and prevent a number of threats such as brute-force attacks, compromised login, data leaks and more.
- * Version:           1.6.6
+ * Version:           1.6.7
  * Author:            SiteGround
  * Author URI:        https://www.siteground.com
@@ -33 +33 @@
 // Define version constant.
 if ( ! defined( __NAMESPACE__ . '\VERSION' ) ) {
-        define( __NAMESPACE__ . '\VERSION', '1.6.6' );
+        define( __NAMESPACE__ . '\VERSION', '1.6.7' );
 }
 

sg-security/trunk/vendor/autoload.php

@@ -20 +20 @@
 require_once __DIR__ . '/composer/autoload_real.php';
 
-return ComposerAutoloaderInitc293d1e978bd19a1e0aed5fa8f47c860::getLoader();
+return ComposerAutoloaderInit0bdd2490f3df64761a8cfea216f31e5d::getLoader();

sg-security/trunk/vendor/composer/autoload_psr4.php

@@ -10 +10 @@
     'SiteGround_Helper\\' => array($vendorDir . '/siteground/siteground-helper/src'),
     'SiteGround_Emails\\' => array($vendorDir . '/siteground/siteground-emails/src'),
-    'SiteGround_Data\\' => array($vendorDir . '/siteground/siteground-data/src'),
     'SG_Security\\' => array($baseDir . '/core'),
     'PragmaRX\\Recovery\\' => array($vendorDir . '/pragmarx/recovery/src'),

sg-security/trunk/vendor/composer/autoload_real.php

@@ -3 +3 @@
 // autoload_real.php @generated by Composer
 
-class ComposerAutoloaderInitc293d1e978bd19a1e0aed5fa8f47c860
+class ComposerAutoloaderInit0bdd2490f3df64761a8cfea216f31e5d
 {
     private static $loader;
@@ -25 +25 @@
         require __DIR__ . '/platform_check.php';
 
-        spl_autoload_register(array('ComposerAutoloaderInitc293d1e978bd19a1e0aed5fa8f47c860', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInit0bdd2490f3df64761a8cfea216f31e5d', 'loadClassLoader'), true, true);
         self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInitc293d1e978bd19a1e0aed5fa8f47c860', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInit0bdd2490f3df64761a8cfea216f31e5d', 'loadClassLoader'));
 
         require __DIR__ . '/autoload_static.php';
-        call_user_func(\Composer\Autoload\ComposerStaticInitc293d1e978bd19a1e0aed5fa8f47c860::getInitializer($loader));
+        call_user_func(\Composer\Autoload\ComposerStaticInit0bdd2490f3df64761a8cfea216f31e5d::getInitializer($loader));
 
         $loader->register(true);

sg-security/trunk/vendor/composer/autoload_static.php

@@ -5 +5 @@
 namespace Composer\Autoload;
 
-class ComposerStaticInitc293d1e978bd19a1e0aed5fa8f47c860
+class ComposerStaticInit0bdd2490f3df64761a8cfea216f31e5d
 {
     public static $prefixLengthsPsr4 = array (
@@ -13 +13 @@
             'SiteGround_Helper\\' => 18,
             'SiteGround_Emails\\' => 18,
-            'SiteGround_Data\\' => 16,
             'SG_Security\\' => 12,
         ),
@@ -41 +40 @@
         array (
             0 => __DIR__ . '/..' . '/siteground/siteground-emails/src',
-        ),
-        'SiteGround_Data\\' =>
-        array (
-            0 => __DIR__ . '/..' . '/siteground/siteground-data/src',
         ),
         'SG_Security\\' =>
@@ -90 +85 @@
     {
         return \Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInitc293d1e978bd19a1e0aed5fa8f47c860::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInitc293d1e978bd19a1e0aed5fa8f47c860::$prefixDirsPsr4;
-            $loader->prefixesPsr0 = ComposerStaticInitc293d1e978bd19a1e0aed5fa8f47c860::$prefixesPsr0;
-            $loader->classMap = ComposerStaticInitc293d1e978bd19a1e0aed5fa8f47c860::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInit0bdd2490f3df64761a8cfea216f31e5d::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInit0bdd2490f3df64761a8cfea216f31e5d::$prefixDirsPsr4;
+            $loader->prefixesPsr0 = ComposerStaticInit0bdd2490f3df64761a8cfea216f31e5d::$prefixesPsr0;
+            $loader->classMap = ComposerStaticInit0bdd2490f3df64761a8cfea216f31e5d::$classMap;
 
         }, null, ClassLoader::class);

sg-security/trunk/vendor/composer/installed.json

@@ -451 +451 @@
         },
         {
-            "name": "siteground/siteground-data",
-            "version": "dev-master",
-            "version_normalized": "dev-master",
-            "source": {
-                "type": "git",
-                "url": "git@gitlab.siteground.com:wordpress/siteground-data.git",
-                "reference": "9716965f513427cc017f787b43531c437227021d"
-            },
-            "require": {
-                "siteground/siteground-helper": "master@dev"
-            },
-            "time": "2026-02-25T15:08:41+00:00",
-            "default-branch": true,
-            "type": "library",
-            "installation-source": "source",
-            "autoload": {
-                "psr-4": {
-                    "SiteGround_Data\\": "src/"
-                }
-            },
-            "authors": [
-                {
-                    "name": "Stanimir Stoyanov",
-                    "email": "stanimir.stoyanov@siteground.com"
-                }
-            ],
-            "install-path": "../siteground/siteground-data"
-        },
-        {
             "name": "siteground/siteground-emails",
             "version": "dev-master",

sg-security/trunk/vendor/composer/installed.php

@@ -4 +4 @@
         'pretty_version' => 'dev-develop',
         'version' => 'dev-develop',
-        'reference' => '866b342b625a5f2fde85c7ea4a23155fa89c6824',
+        'reference' => 'bd34eb1c269c7c940e435d7786d5c4023d6877a8',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
@@ -84 +84 @@
             'pretty_version' => 'dev-develop',
             'version' => 'dev-develop',
-            'reference' => '866b342b625a5f2fde85c7ea4a23155fa89c6824',
+            'reference' => 'bd34eb1c269c7c940e435d7786d5c4023d6877a8',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
-            'dev_requirement' => false,
-        ),
-        'siteground/siteground-data' => array(
-            'pretty_version' => 'dev-master',
-            'version' => 'dev-master',
-            'reference' => '9716965f513427cc017f787b43531c437227021d',
-            'type' => 'library',
-            'install_path' => __DIR__ . '/../siteground/siteground-data',
-            'aliases' => array(
-                0 => '9999999-dev',
-            ),
             'dev_requirement' => false,
         ),

sg-security/trunk/vendor/siteground/siteground-emails/src/Email_Service.php

@@ -88 +88 @@
          */
         protected $sg_mail_from_name;
-
-        /**
-         * Mail From Email Address.
-         *
-         * @since  1.6.1
-         *
-         * @var    string
-         * @access protected
-         */
-        protected $sg_mail_from_address = false;
 
         /**
@@ -161 +151 @@
                         add_filter( 'wp_mail_from_name', array( $this, 'set_mail_from_name' ) );
                 }
-
-                // Set a same-domain email address as the From address.
-                $this->set_default_from_mail_address();
 
                 // Sent the email.
@@ -173 +160 @@
                 );
 
-                // Remove the default From mail address.
-                $this->remove_default_from_mail_address();
-
                 // Remove the from name if it is set.
                 if ( false !== $this->sg_mail_from_name ) {
@@ -229 +213 @@
                 return wp_unschedule_event( $timestamp, $this->sg_cron_name );
         }
-
-        /**
-         * Sets a default From email address.
-         *
-         * @since 1.6.1
-         */
-        public function set_default_from_mail_address() {
-                $host = wp_parse_url( home_url(), PHP_URL_HOST );
-                $host = preg_replace( '/^www\./', '', $host );
-
-                if ( empty( $host ) ) {
-                        return;
-                }
-
-                // Set the default wp_mail() from address.
-                $this->sg_mail_from_address = 'wordpress@' . $host;
-                add_filter( 'wp_mail_from', array( $this, 'set_mail_from_address' ), PHP_INT_MAX );
-
-                // Also set the PHP Mailer from address.
-                add_action( 'phpmailer_init', array( $this, 'set_phpmailer_from_address' ), PHP_INT_MAX );
-        }
-
-        /**
-         * Removes the default From email address.
-         *
-         * @since 1.6.1
-         */
-        public function remove_default_from_mail_address() {
-                // Remove the PHP Mailer from address first.
-                if ( false !== $this->sg_mail_from_address ) {
-                        remove_action( 'phpmailer_init', array( $this, 'set_phpmailer_from_address' ), PHP_INT_MAX );
-                }
-
-                // Remove the default wp_mail() filter.
-                remove_filter( 'wp_mail_from', array( $this, 'set_mail_from_address' ), PHP_INT_MAX );
-
-                $this->sg_mail_from_address = false;
-        }
-
-        /**
-         * Returns the default email address.
-         *
-         * @since 1.6.1
-         *
-         * @param string $from_email The original From email address.
-         *
-         * @return string The default From email address.
-         */
-        public function set_mail_from_address( $from_email ) {
-                return $this->sg_mail_from_address;
-        }
-
-        /**
-         * Sets PHP Mailer from address and force server mail transport instead of configured SMTP.
-         *
-         * @since 1.6.1
-         *
-         * @param object The PHPMailer object.
-         */
-        public function set_phpmailer_from_address( $phpmailer ) {
-                if ( ! is_object( $phpmailer ) || ! method_exists( $phpmailer, 'setFrom' ) ) {
-                        return;
-                }
-
-                // Force local/server mail transport instead of configured SMTP.
-                if ( method_exists( $phpmailer, 'isMail' ) ) {
-                        $phpmailer->isMail();
-                }
-
-                $phpmailer->setFrom(
-                        $this->sg_mail_from_address,
-                        $this->sg_mail_from_name,
-                        true
-                );
-
-                // Force the envelope sender / Return-Path too.
-                $phpmailer->Sender = $this->sg_mail_from_address;
-        }
 }

sg-security/trunk/vendor/siteground/siteground-helper/src/Helper_Service.php

@@ -267 +267 @@
                 return $data;
         }
-
-        /**
-         * Returns the assets URL.
-         *
-         * @return string The URL to the uploads assets.
-         */
-        public static function get_assets_url() {
-                // Get the uploads data.
-                $uploads = wp_upload_dir();
-
-                // Get the baseurl.
-                $baseurl = rtrim( $uploads['baseurl'], '/' );
-
-                // Add the necessary protocol.
-                if ( is_ssl() && 0 === strpos( $baseurl, 'http://' ) ) {
-                        return str_replace( 'http://', 'https://', $baseurl );
-                }
-
-                return $baseurl;
-        }
 }