Skip to content

Commit 788db8a

Browse files
aristatharistath
committed
Merge branch 'pr-680' into ari/improve-security
2 parents 091d063 + 8da971a commit 788db8a

3 files changed

Lines changed: 49 additions & 89 deletions

File tree

‎classes/rest/class-base.php‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,4 +41,53 @@ protected function get_client_ip() {
4141

4242
return '0.0.0.0';
4343
}
44+
45+
/**
46+
* Validate the token.
47+
*
48+
* @param string $token The token.
49+
*
50+
* @return bool
51+
*/
52+
public function validate_token( $token ) {
53+
// Rate limiting: Check for too many failed attempts.
54+
$ip_address = $this->get_client_ip();
55+
$rate_limit_key = 'prpl_api_rate_limit_' . \md5( $ip_address );
56+
$failed_attempts = (int) \get_transient( $rate_limit_key );
57+
58+
// Block if more than 10 failed attempts in the last hour.
59+
if ( $failed_attempts >= 10 ) {
60+
return false;
61+
}
62+
63+
$token = \str_replace( 'token/', '', $token );
64+
65+
// Check test token first (use hash_equals to prevent timing attacks).
66+
$test_token = \get_option( 'progress_planner_test_token', '' );
67+
if ( ! empty( $test_token ) && \hash_equals( $test_token, $token ) ) {
68+
// Clear failed attempts on successful authentication.
69+
\delete_transient( $rate_limit_key );
70+
return true;
71+
}
72+
73+
$license_key = \get_option( 'progress_planner_license_key', false );
74+
if ( ! $license_key || 'no-license' === $license_key ) {
75+
// Increment failed attempts counter.
76+
\set_transient( $rate_limit_key, $failed_attempts + 1, HOUR_IN_SECONDS );
77+
return false;
78+
}
79+
80+
// Use hash_equals() to prevent timing attacks.
81+
$is_valid = \hash_equals( $license_key, $token );
82+
83+
if ( ! $is_valid ) {
84+
// Increment failed attempts counter.
85+
\set_transient( $rate_limit_key, $failed_attempts + 1, HOUR_IN_SECONDS );
86+
} else {
87+
// Clear failed attempts on successful authentication.
88+
\delete_transient( $rate_limit_key );
89+
}
90+
91+
return $is_valid;
92+
}
4493
}

‎classes/rest/class-stats.php‎

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -62,44 +62,4 @@ public function get_stats() {
6262

6363
return new \WP_REST_Response( $system_status->get_system_status() );
6464
}
65-
66-
/**
67-
* Validate the token.
68-
*
69-
* @param string $token The token.
70-
*
71-
* @return bool
72-
*/
73-
public function validate_token( $token ) {
74-
// Rate limiting: Check for too many failed attempts.
75-
$ip_address = $this->get_client_ip();
76-
$rate_limit_key = 'prpl_api_rate_limit_stats_' . \md5( $ip_address );
77-
$failed_attempts = (int) \get_transient( $rate_limit_key );
78-
79-
// Block if more than 10 failed attempts in the last hour.
80-
if ( $failed_attempts >= 10 ) {
81-
return false;
82-
}
83-
84-
$token = \str_replace( 'token/', '', $token );
85-
$license_key = \get_option( 'progress_planner_license_key', false );
86-
if ( ! $license_key || 'no-license' === $license_key ) {
87-
// Increment failed attempts counter.
88-
\set_transient( $rate_limit_key, $failed_attempts + 1, HOUR_IN_SECONDS );
89-
return false;
90-
}
91-
92-
// Use hash_equals() to prevent timing attacks.
93-
$is_valid = \hash_equals( $license_key, $token );
94-
95-
if ( ! $is_valid ) {
96-
// Increment failed attempts counter.
97-
\set_transient( $rate_limit_key, $failed_attempts + 1, HOUR_IN_SECONDS );
98-
} else {
99-
// Clear failed attempts on successful authentication.
100-
\delete_transient( $rate_limit_key );
101-
}
102-
103-
return $is_valid;
104-
}
10565
}

‎classes/rest/class-tasks.php‎

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -46,55 +46,6 @@ public function register_rest_endpoint() {
4646
);
4747
}
4848

49-
/**
50-
* Permission callback.
51-
*
52-
* @param string $token The token.
53-
*
54-
* @return bool
55-
*/
56-
public function validate_token( $token ) {
57-
// Rate limiting: Check for too many failed attempts.
58-
$ip_address = $this->get_client_ip();
59-
$rate_limit_key = 'prpl_api_rate_limit_tasks_' . \md5( $ip_address );
60-
$failed_attempts = (int) \get_transient( $rate_limit_key );
61-
62-
// Block if more than 10 failed attempts in the last hour.
63-
if ( $failed_attempts >= 10 ) {
64-
return false;
65-
}
66-
67-
$token = \str_replace( 'token/', '', $token );
68-
69-
// Check test token first (use hash_equals to prevent timing attacks).
70-
$test_token = \get_option( 'progress_planner_test_token', '' );
71-
if ( ! empty( $test_token ) && \hash_equals( $test_token, $token ) ) {
72-
// Clear failed attempts on successful authentication.
73-
\delete_transient( $rate_limit_key );
74-
return true;
75-
}
76-
77-
$license_key = \get_option( 'progress_planner_license_key', false );
78-
if ( ! $license_key || 'no-license' === $license_key ) {
79-
// Increment failed attempts counter.
80-
\set_transient( $rate_limit_key, $failed_attempts + 1, HOUR_IN_SECONDS );
81-
return false;
82-
}
83-
84-
// Use hash_equals() to prevent timing attacks.
85-
$is_valid = \hash_equals( $license_key, $token );
86-
87-
if ( ! $is_valid ) {
88-
// Increment failed attempts counter.
89-
\set_transient( $rate_limit_key, $failed_attempts + 1, HOUR_IN_SECONDS );
90-
} else {
91-
// Clear failed attempts on successful authentication.
92-
\delete_transient( $rate_limit_key );
93-
}
94-
95-
return $is_valid;
96-
}
97-
9849
/**
9950
* Get task recommendations.
10051
*

0 commit comments

Comments
 (0)