Version: 2.186

css/src/spbc-settings.css

@@ -76,11 +76,6 @@
 .spbc_waf_reason{display: none;}
 .spbc_waf_reason_title:hover + .spbc_waf_reason{display: inline;}
 
-/** .spbc_sub* and spbc_affiliate_shortcode used in General settings tab */
-.spbc_sub_setting{margin-left: 30px !important;}
-.spbc_sub2_setting{margin-left: 60px !important;}
-.spbc_affiliate_shortcode{width:inherit !important; min-width: inherit !important}
-
 .spbc_highlighted{
 	outline-offset: 5px;
 	outline-color: red;

inc/spbc-auth.php

@@ -139,10 +139,10 @@ function spbc_authenticate($user, $username)
 
     if ( is_wp_error($user) ) {
         /**
-         * @todo Migrate BFP disable from constant to settings option
+         * Constant kept for backward compatibility with temporary workaround via wp-config.php
          * @psalm-suppress RedundantCondition
          */
-        if (!SPBC_BFP_DISABLE) {
+        if (!empty($spbc->settings['bfp__enabled']) && !SPBC_BFP_DISABLE) {
             spbc_authenticate__check_brute_force();
         }
 

inc/spbc-firewall.php

@@ -14,7 +14,6 @@
 use CleantalkSP\SpbctWP\Firewall\UploadChecker;
 use CleantalkSP\SpbctWP\Helpers\IP;
 use CleantalkSP\SpbctWP\Variables\Cookie;
-use CleantalkSP\SpbctWP\RenameLoginPage;
 
 // Prevent direct call
 if ( ! defined('ABSPATH') ) {
@@ -51,33 +50,30 @@ function spbc_firewall__check()
     spbc_firewall_check_waf($firewall);
 
     if ( class_exists('Poppyz_Core') ) { //fix poppyz plugin early start conflict
-        $GLOBALS['wp_rewrite'] = is_null($GLOBALS['wp_rewrite']) ? new WP_Rewrite() : $GLOBALS['wp_rewrite']; // Fix for early load WP_Rewrite
-    }
-
-    $login_url = wp_login_url();
-    if ( $spbc->settings['login_page_rename__enabled'] ) {
-        $GLOBALS['wp_rewrite'] = is_null($GLOBALS['wp_rewrite']) ? new WP_Rewrite() : $GLOBALS['wp_rewrite']; // Fix for early load WP_Rewrite
-        $login_url = RenameLoginPage::getURL($spbc->settings['login_page_rename__name']);
+        if ( empty($GLOBALS['wp_rewrite']) || ! ($GLOBALS['wp_rewrite'] instanceof WP_Rewrite) ) {
+            $GLOBALS['wp_rewrite'] = new WP_Rewrite(); // Fix for early load WP_Rewrite
+        }
     }
 
-    // Compare only the path part of URLs to avoid scheme mismatch issues.
-    $current_path = Server::getCanonicalPath() ?: Server::getCanonicalUri();
-    $login_path = parse_url($login_url, PHP_URL_PATH) ?: '/wp-login.php';
-    $is_login_page = strpos(trim($current_path, '/'), trim($login_path, '/')) === 0;
-
-    $firewall->loadFwModule(
-        new BFP(
-            array(
-            'api_key'       => $spbc->api_key,
-            'state'         => $spbc,
-            'is_login_page' => $is_login_page,
-            'is_logged_in'  => Cookie::getString('spbc_is_logged_in') === md5($spbc->data['salt'] . get_option('home')),
-            'bf_limit'      => $spbc->settings['bfp__allowed_wrong_auths'],
-            'block_period'  => $spbc->settings['bfp__block_period__5_fails'],
-            'count_period'  => $spbc->settings['bfp__count_interval'], // Counting login attempts in this interval
+     /**
+     * Constant kept for backward compatibility; may be overridden in wp-config.php
+     * @psalm-suppress RedundantCondition
+     */
+    if (!empty($spbc->settings['bfp__enabled']) && !SPBC_BFP_DISABLE) {
+        $firewall->loadFwModule(
+            new BFP(
+                array(
+                'api_key'       => $spbc->api_key,
+                'state'         => $spbc,
+                'is_login_page' => spbc_is_login_page_request(),
+                'is_logged_in'  => Cookie::getString('spbc_is_logged_in') === md5($spbc->data['salt'] . get_option('home')),
+                'bf_limit'      => $spbc->settings['bfp__allowed_wrong_auths'],
+                'block_period'  => $spbc->settings['bfp__block_period__5_fails'],
+                'count_period'  => $spbc->settings['bfp__count_interval'], // Counting login attempts in this interval
+                )
             )
-        )
-    );
+        );
+    }
 
     if (
         $spbc->settings['traffic_control__enabled'] &&
@@ -193,7 +189,9 @@ function spbc_upload_checker__check()
                     //Nonce can be different here
                     !(
                         wp_verify_nonce(Request::getString('_wpnonce') ?: '', 'media-form') ||
-                        wp_verify_nonce(Request::getString('emr_nonce') ?: '', 'media_replace_upload')
+                        wp_verify_nonce(Request::getString('emr_nonce') ?: '', 'media_replace_upload') ||
+                        // ACF Tools > Import Field Groups (JSON)
+                        wp_verify_nonce(Request::getString('_acf_nonce') ?: '', 'import')
                     )
                 ) {
                     $run_checker_error = new WP_Error(403, __('You do not have sufficient permissions to upload files. Upload files request wrong', 'security-malware-firewall'));
@@ -285,7 +283,7 @@ function spbc_firewall_skip_check()
  */
 function spbc_firewall_skip_check_uploadchecker()
 {
-    global $spbc;
+    global $spbc, $pagenow;
 
     if (empty($_FILES)) {
         return true;
@@ -298,6 +296,8 @@ function spbc_firewall_skip_check_uploadchecker()
         || \CleantalkSP\Variables\Server::inUri('/favicon.ico')  // Exclude favicon.ico requests from the check
         || spbc_mailpoet_doing_cron()
         || spbc_is_cli()
+        || $pagenow === 'upload.php'
+        || $pagenow === 'async-upload.php'
     ) {
         return true;
     }

inc/spbc-pluggable.php

@@ -1,5 +1,7 @@
 <?php
 
+use CleantalkSP\SpbctWP\RenameLoginPage;
+use CleantalkSP\Variables\Post;
 use CleantalkSP\Variables\Server;
 
 // Prevent direct call
@@ -95,3 +97,140 @@ function spbc_is_cli()
 {
     return PHP_SAPI === "cli";
 }
+
+/**
+ * Whether current request is a login page where BFP should enforce blocks.
+ * Covers wp-login.php (incl. renamed login URL) and WooCommerce My Account.
+ *
+ * @return bool
+ */
+function spbc_is_login_page_request()
+{
+    global $spbc;
+
+    $login_url = wp_login_url();
+    if ( ! empty($spbc->settings['login_page_rename__enabled']) ) {
+        if ( empty($GLOBALS['wp_rewrite']) || ! ($GLOBALS['wp_rewrite'] instanceof WP_Rewrite) ) {
+            $GLOBALS['wp_rewrite'] = new WP_Rewrite();
+        }
+        $login_url = RenameLoginPage::getURL($spbc->settings['login_page_rename__name']);
+    }
+
+    if ( spbc_request_uri_matches_url($login_url) ) {
+        return true;
+    }
+
+    return spbc_is_woocommerce_login_request();
+}
+
+/**
+ * Detect WooCommerce My Account page / login form for BFP.
+ *
+ * @return bool
+ */
+function spbc_is_woocommerce_login_request()
+{
+    if ( ! spbc_is_plugin_active('woocommerce/woocommerce.php') ) {
+        return false;
+    }
+
+    // Login form POST from WooCommerce My Account
+    if ( Post::getString('woocommerce-login-nonce') !== '' ) {
+        return true;
+    }
+
+    // Visiting My Account so already-banned IPs are blocked before form submit
+    $myaccount_page_id = (int) get_option('woocommerce_myaccount_page_id');
+    if ( ! $myaccount_page_id ) {
+        return false;
+    }
+
+    $myaccount_url = get_permalink($myaccount_page_id);
+    if ( ! $myaccount_url ) {
+        return false;
+    }
+
+    return spbc_request_uri_matches_url($myaccount_url);
+}
+
+/**
+ * Whether the current REQUEST_URI matches the given absolute URL.
+ * Compares path and, when present, required query args — so plain-permalink
+ * URLs like /?my-login or /?page_id=37 do not match the whole site.
+ *
+ * @param string $url Absolute URL (e.g. from wp_login_url() / get_permalink()).
+ *
+ * @return bool
+ */
+function spbc_request_uri_matches_url($url)
+{
+    $url_parts = parse_url((string) $url);
+    if ( ! is_array($url_parts) ) {
+        return false;
+    }
+
+    $target_path  = isset($url_parts['path']) ? $url_parts['path'] : '/';
+    $target_query = isset($url_parts['query']) ? $url_parts['query'] : '';
+
+    // Path: canonical (percent-decoded). Query: raw QUERY_STRING — do not take it from
+    // rawurldecoded REQUEST_URI (%3F in path / %2B semantics would break parsing).
+    $current_path  = Server::getCanonicalPath();
+    $current_query = (string) Server::get('QUERY_STRING', null, 'url');
+
+    if ( $current_path === '' ) {
+        $current_path = '/';
+    }
+
+    $target_path_norm  = spbc_normalize_request_path($target_path);
+    $current_path_norm = spbc_normalize_request_path($current_path);
+
+    // Query-based URLs (plain permalinks / renamed login): require path + query keys.
+    if ( $target_query !== '' ) {
+        if ( $target_path_norm !== $current_path_norm ) {
+            return false;
+        }
+
+        parse_str($target_query, $target_params);
+        parse_str($current_query, $current_params);
+
+        if ( empty($target_params) ) {
+            return false;
+        }
+
+        foreach ( $target_params as $key => $value ) {
+            if ( ! array_key_exists($key, $current_params) ) {
+                return false;
+            }
+            if ( $value !== '' && (string) $current_params[$key] !== (string) $value ) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    // Path-only URL: never treat bare "/" as a match (would mark every request).
+    if ( $target_path_norm === '/' ) {
+        return false;
+    }
+
+    $target_trim  = trim($target_path_norm, '/');
+    $current_trim = trim($current_path_norm, '/');
+
+    return $current_trim === $target_trim || strpos($current_trim, $target_trim . '/') === 0;
+}
+
+/**
+ * @param string $path
+ *
+ * @return string
+ */
+function spbc_normalize_request_path($path)
+{
+    $path = (string) $path;
+    if ( $path === '' || $path === '/' ) {
+        return '/';
+    }
+
+    return '/' . trim($path, '/');
+}