Merge pull request #2 from loukie-pressable/plugin/github-actions

Introduced automated GitHub Actions workflow for packaging and releasing plugin updates. Added Ruby script to streamline release creation and asset uploads. Improved multisite compatibility and login redirection reliability.
Enhanced security for logout functionality with nonce verification and safer credential handling. Added exclusion for specific API and XML-RPC endpoints to bypass Basic Authentication.

Author: paulhtrott

.gitattributes

@@ -0,0 +1,17 @@
+# Auto detect text files and perform LF normalization
+* text=auto
+
+# Directories
+/.git export-ignore
+/.wordpress-org export-ignore
+/.github export-ignore
+/vendor export-ignore
+/dev export-ignore
+
+# Files
+/.gitattributes export-ignore
+/.gitignore export-ignore
+/README.md export-ignore
+/composer.json export-ignore
+/composer.lock export-ignore
+/.DS_Store export-ignore

.github/workflows/build.rb

@@ -0,0 +1,66 @@
+#!/usr/bin/env ruby
+
+require 'octokit'
+
+puts "Getting version from #{ENV['VERSION_FILE_PATH']}"
+  
+begin
+  version_line = File.foreach(ENV['VERSION_FILE_PATH']).grep(/Version:\s*(\d+\.\d+\.\d+(?:-\w+)?)/i)
+  version = version_line.empty? ? nil : version_line.first.match(/Version:\s*(\d+\.\d+\.\d+(?:-\w+)?)/i)[1]
+
+  puts "Version: #{version}"
+
+  raise 'Version not found in main PHP file' if version.nil? || version.empty?
+rescue => e
+  puts "Error extracting version: #{e.message}"
+  exit 1
+end
+
+if ENV['GITHUB_TOKEN'].nil? || ENV['GITHUB_TOKEN'].empty?
+  puts "Error: GITHUB_TOKEN environment variable not set to empty"
+  exit 1
+end
+
+client = Octokit::Client.new(access_token: ENV['GITHUB_TOKEN'])
+
+release_name = "Release #{version}"
+tag_name = version.to_s
+
+puts "Creating tagged release: #{release_name}"
+
+begin
+  release = client.create_release(
+    ENV['REPO_NAME'],
+    tag_name,
+    {
+      name: release_name,
+      target_commitish: ENV['REPO_SHA'],
+      draft: false,
+      prerelease: false
+    }
+  )
+  puts 'Done creating tagged release'
+rescue Octokit::Error => e
+  puts "GitHub API error: #{e.message}"
+  exit 1
+end
+
+begin
+  if !File.exist?(ENV['ZIP_FILE_NAME'])
+    puts "Error: ZIP file #{ENV['ZIP_FILE_NAME']} not found"
+    exit 1
+  end
+
+  client.upload_asset(
+    release[:url],
+    ENV['ZIP_FILE_NAME'],
+    {
+      content_type: 'application/zip',
+      name: ENV['PROJECT_ZIP_NAME']
+    }
+  )
+  puts 'Done uploading zip to assets'
+rescue => e
+  puts "Error uploading asset: #{e.message}"
+  exit 1
+end

.github/workflows/main.yml

@@ -0,0 +1,41 @@
+name: PressableBasicAuthReleaseCI
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  PROJECT_NAME: pressable-basic-authentication
+  VERSION_FILE_PATH: './pressable-basic-authentication.php'
+
+jobs:
+  build:
+    name: Package Release Project
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Install Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.1.3'
+          bundler-cache: true
+
+      - name: Create ZIP Archive
+        run: git archive --format zip --output ${{ env.PROJECT_NAME }}.zip --prefix ${{ env.PROJECT_NAME }}/ main -0
+
+      - name: Install Octokit Gem
+        run: gem install octokit
+
+      - name: Run Release Script
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO_NAME: ${{ github.repository }}
+          REPO_SHA: ${{ github.sha }}
+          VERSION_FILE_PATH: ${{ env.VERSION_FILE_PATH }}
+          ZIP_FILE_NAME: ${{ env.PROJECT_NAME }}.zip
+          PROJECT_ZIP_NAME: ${{ env.PROJECT_NAME }}.zip
+        run: ruby ./.github/workflows/build.rb

.gitignore

@@ -0,0 +1,9 @@
+vendor
+vendor/**
+.vscode/**
+.DS_Store
+*.zip
+*.swp
+release
+release/**
+.idea/**

README.md

@@ -0,0 +1,51 @@
+# Hosting Basic Authentication
+
+A WordPress plugin that forces all users to authenticate using Basic Authentication before accessing any page on the site.
+
+## Description
+
+This plugin implements server-level Basic Authentication for your WordPress site, requiring valid credentials before any page can be accessed. It's particularly useful for:
+
+- Sites that should not be publicly accessible
+- Sites under maintenance
+- Sites that need an additional layer of security before the WordPress login
+
+Key features:
+- Forces Basic Authentication for all requests (except AJAX, CRON, and CLI)
+- Integrates with WordPress user database for authentication
+- Handles logout functionality properly
+- Prevents caching of authentication requests
+- Logs failed authentication attempts
+- Bypasses authentication for Super Admins in multisite installations
+- Redirects authenticated users away from wp-login.php
+
+## Requirements
+
+- WordPress 6.7 or higher
+- PHP 8.1 or higher
+- Server must support PHP_AUTH_USER and PHP_AUTH_PW server variables (most standard hosting environments do)
+
+## Frequently Asked Questions
+
+### Why am I getting constant authentication prompts?
+
+This typically means:
+1. Your credentials are incorrect - verify your WordPress username and password
+2. Your server is stripping authentication headers - contact your hosting provider
+3. There may be a caching layer interfering - try clearing all caches
+
+### Can I bypass Basic Authentication for certain users?
+
+In a multisite installation, Super Admins can bypass the authentication. For single site installations, you would need to modify the plugin code.
+
+### How do I disable the plugin if I'm locked out?
+
+1. Access your site via FTP/SFTP or file manager
+2. Rename or delete the `hosting-basic-authentication` folder in `/wp-content/plugins/`
+3. This will deactivate the plugin
+
+## Changelog
+
+## License
+
+This plugin is licensed under the GPL2 license. See the [LICENSE](LICENSE) file for details.

pressable-basic-authentication.php

@@ -8,7 +8,7 @@
 /*
 Plugin Name: Hosting Basic Authentication
 Description: Forces all users to authenticate using Basic Authentication before accessing any page.
-Version: 1.0.0
+Version: 1.0.1
 License: GPL2
 Text Domain: hosting-basic-authentication
 */
@@ -56,6 +56,11 @@ public function init() {
 			return;
 		}
 
+		// Skip requests to excluded endpoints
+        if ($this->should_skip_auth()) {
+            return;
+        }
+
 		// Handle logout request.
 		if ( isset( $_GET['basic-auth-logout'] ) ) {
 			$this->handle_basic_auth_logout();
@@ -124,6 +129,48 @@ private function log_failed_auth( $message ) {
 		);
 	}
 
+	/**
+     * Check if the current request should skip authentication
+     *
+     * @return bool
+     */
+    private function should_skip_auth() {
+        // List of endpoints to exclude from Basic Auth
+        $excluded_endpoints = array(
+            'xmlrpc.php',
+            'wp-json/jetpack',
+            'wp-json/wp/v2',
+            'wp-json/wp/v3'
+        );
+
+        // Get current request details
+        $request_uri = $_SERVER['REQUEST_URI'] ?? '';
+        $script_name = $_SERVER['SCRIPT_NAME'] ?? '';
+
+        // Check if this is a direct xmlrpc.php request
+        if (basename($script_name) === 'xmlrpc.php') {
+            return true;
+        }
+
+        // Check all excluded endpoints
+        foreach ($excluded_endpoints as $endpoint) {
+            if (strpos($request_uri, $endpoint) !== false) {
+                return true;
+            }
+        }
+
+        // Check WordPress constants
+        if (defined('XMLRPC_REQUEST') && XMLRPC_REQUEST) {
+            return true;
+        }
+
+        if (defined('REST_REQUEST') && REST_REQUEST) {
+            return true;
+        }
+
+        return false;
+    }
+
 	/**
 	 * Sends authentication headers.
 	 */
@@ -291,4 +338,4 @@ private function is_cli_request() {
 }
 
 // Initialize the plugin.
-new Pressable_Basic_Auth();
+new Pressable_Basic_Auth();

readme.txt

@@ -0,0 +1,43 @@
+=== Pressable Basic Authentication ===
+Contributors: pressable
+Tags: pressable, basic auth, authentication, security
+Requires at least: 6.7
+Tested up to: 6.8
+Requires PHP: 8.1
+Stable tag: 1.0.1
+License: GPLv2 or later
+License URI: http://www.gnu.org/licenses/gpl-2.0.html
+
+== Description ==
+
+The Pressable Basic Authentication plugin enforces HTTP Basic Authentication across your WordPress site, requiring users to authenticate before accessing any page. This is particularly useful for development environments, ensuring that only authorized users can view or interact with the site during development or testing phases.​
+
+== FEATURES ==​
+
+* Enforces HTTP Basic Authentication on all front-end and back-end pages.
+* Installed on sites to restrict public access.
+* Allows super administrators to bypass authentication for seamless management.
+* Integrates with WordPress's authentication system for user verification.
+* Provides a mechanism to log out of Basic Authentication sessions.​
+
+== Frequently Asked Questions ==​
+
+= How do I use this plugin? =​
+
+No manual configuration is required. When accessing a protected site, you'll be prompted to enter your WordPress credentials.​
+
+= Can I disable Basic Authentication on my site? =​
+
+Basic Authentication is enforced on sites to protect your site during development. To remove this protection, you can promote your site to a live environment through the MyPressable Control Panel.​
+
+= What credentials should I use to authenticate? =​
+
+Use your WordPress username and password associated with the site. Ensure that your user account has the necessary permissions to access the site.​
+
+== Installation ==​
+
+No manual installation is necessary.​
+
+== Screenshots ==​
+
+* Initial release​