Translated from 日本語 • View original DEVLAB is run on WordPress, and I found an article about WordPress that caught my attention. By adding a GET query of "?author=x" to the home URL of a WordPress site, the username in the site will be revealed (* For details, see MT Systems' WordPress TIP）。 The x in '?author=x' is a number and is your WordPress user ID (the primary key in the user table). This means that if you specify 1 for x, you will become a WordPress root management user. I immediately tried it in DEVLAB and found that 'https://dev.blog.colorkrew.com?author=1' was rewritten according to the rewrite rules specified in the permalink settings, and 'https://blog.colorkrew.com/author/<ルート管理ユーザー名>/'. If this continues, the password will be brute-forced, and if the login is successful, the site will be cracked! However, in the case of DEVLAB, the general WordPress login screen 'wp-login.php' is disabled, making it difficult to find a way to log in, so it is safe for now. However, we need to prevent vulnerabilities that cause usernames to be leaked, so we have thought about countermeasures.
As introduced on MT Systems' site, if you redirect by the template 'author.php' on the author's archive page, the username will be printed as the location of the redirect in the HTTP response header, so even if you use '.htaccess' Even if you add a rewrite rule to , it is annoying that it cannot be prevented. MT Systems' website posted a countermeasure to eventually rewrite the 'user_nicename' of user data to a different value from the 'user_login' of the login account, but it is quite difficult because it is an item that cannot be edited directly from the admin panel.
I wonder if it can't be a little easier to deal with... ──So, I tried to make my own countermeasures.
// prevent the leakage of user name by author query on WordPress.
function knockout_author_query() {
// disable author rewrite rule
global $wp_rewrite;
$wp_rewrite->flush_rules();
$wp_rewrite->author_base = '';
$wp_rewrite->author_structure = '/';
// for author query request
if (isset($_REQUEST['author']) && !empty($_REQUEST['author'])) {
$user_info = get_userdata(intval($_REQUEST['author']));
if ($user_info && array_key_exists('administrator', $user_info->caps) && in_array('administrator', $user_info->roles)) {
wp_redirect(home_url());
exit;
} else {
// enable author rewrite rule
$wp_rewrite->author_base = 'author';
$wp_rewrite->author_structure = '/author/%author%/';
}
}
}
add_action('init', 'knockout_author_query');
You can add the above source to your theme's 'function.php' or something like that to get it enabled immediately.
As for the content of the process, for sites that have rewritten settings other than the default in the permalink settings, we first override the WP_Rewrite process and change the rewrite to the author archive to a uniform TOP page ('/' directly below the domain). Next, when retrieving a query with '?author=x', if the user ID specified in the query is a user with administrator privileges, go to the TOP page (rewrite if the permalink settings have been changed from the default, redirect if the default), and display the author archive if it is a non-administrator user. In this case, it is not a redirect after sending the header with a 'author.php' template, etc., so even if it is redirected (or rewritten), the loction will not be printed in the HTTP response header.
HTTP request header when requested with ?author=1
GET /?author=1 HTTP/1.1
Host: devlab.isao.co.jp
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*; q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: ja,en-US; q=0.8,en; q=0.6
Cookies: (omitted)
HTTP response header when requested with ?author=1
HTTP/1.1 302 Found
Date: Fri, 12 Sep 2014 08:07:24 GMT
Server: Apache/2.4.9 (Win32) OpenSSL/1.0.1g PHP/5.5.11
X-Powered-By: PHP/5.5.11
Location: https://dev.blog.colorkrew.com
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
However, this alone is not a security measure, and if you view the author archive with a non-administrator user, the username of this user will be displayed, so after all, the 'user_nicename' of the user information must be different from the value of 'user_login'. The risk of having your login account ripped off and eating a password brute force attack remains. Well, the login account of the admin user will not be leaked, so it will not be the worst damage, but site tampering can be done with ease, so if you want to use the author archive function, it is better to take measures by changing the 'user_nicename' as well. If the site does not use the author archive, you can delete the processing of that part from the previous source and do it as follows.
// prevent the leakage of user name by author query on WordPress.
function knockout_author_query() {
// disable author rewrite rule
global $wp_rewrite;
$wp_rewrite->flush_rules();
$wp_rewrite->author_base = '';
$wp_rewrite->author_structure = '/';
// for author query request
if (isset($_REQUEST['author']) && !empty($_REQUEST['author'])) {
$user_info = get_userdata(intval($_REQUEST['author']));
if ($user_info && array_key_exists('administrator', $user_info->caps) && in_array('administrator', $user_info->roles)) {
wp_redirect(home_url());
exit;
}
}
}
add_action('init', 'knockout_author_query');
In this case, no matter what user they are, the author archive will be uniformly redirected to the TOP page, so there is no risk of username leakage due to the '?author=x' query. DEVLAB is taking measures with this.
In addition, if you have enabled rewrite in the permalink settings, disabling access to the path of '/author/' will further increase security, so we recommend that you take measures here (add the following rewrite rule to '.htaccess') as well.
RewriteRule ^author/(.*)? / [R=302,L]