Skip to content

Commit 60e1034

Browse files
committed
Add a few more plugins that blocks XML-RPC
1 parent b68e345 commit 60e1034

1 file changed

Lines changed: 61 additions & 8 deletions

File tree

wp_api/src/login.rs

Lines changed: 61 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
use crate::{
22
JsonValue, login::url_discovery::is_local_dev_environment_url, parsed_url::ParsedUrl,
3-
uuid::WpUuid,
3+
plugins::PluginSlug, uuid::WpUuid,
44
};
55
use serde::{Deserialize, Serialize};
66
use std::{collections::HashMap, str, sync::Arc};
@@ -160,14 +160,24 @@ impl WpApiDetails {
160160
pub fn has_application_password_blocking_plugin(&self) -> bool {
161161
KnownAuthenticationBlockingPlugin::application_passwords()
162162
.iter()
163-
.any(|plugin| self.namespaces.contains(&plugin.namespace))
163+
.any(|plugin| {
164+
plugin
165+
.namespace
166+
.as_ref()
167+
.is_some_and(|ns| self.namespaces.contains(ns))
168+
})
164169
}
165170

166171
/// Returns a list of plugins that might be responsible for disabling application passwords.
167172
pub fn application_password_blocking_plugins(&self) -> Vec<KnownAuthenticationBlockingPlugin> {
168173
KnownAuthenticationBlockingPlugin::application_passwords()
169174
.iter()
170-
.filter(|plugin| self.namespaces.contains(&plugin.namespace))
175+
.filter(|plugin| {
176+
plugin
177+
.namespace
178+
.as_ref()
179+
.is_some_and(|ns| self.namespaces.contains(ns))
180+
})
171181
.cloned()
172182
.collect()
173183
}
@@ -176,7 +186,12 @@ impl WpApiDetails {
176186
pub fn xmlrpc_blocking_plugins(&self) -> Vec<KnownAuthenticationBlockingPlugin> {
177187
KnownAuthenticationBlockingPlugin::xmlrpc()
178188
.iter()
179-
.filter(|plugin| self.namespaces.contains(&plugin.namespace))
189+
.filter(|plugin| {
190+
plugin
191+
.namespace
192+
.as_ref()
193+
.is_some_and(|ns| self.namespaces.contains(ns))
194+
})
180195
.cloned()
181196
.collect()
182197
}
@@ -207,8 +222,10 @@ impl WpApiDetails {
207222
pub struct KnownAuthenticationBlockingPlugin {
208223
/// The name of the plugin.
209224
pub name: String,
225+
/// The plugin's slug. For example: "wordfence/wordfence"
226+
pub slug: PluginSlug,
210227
/// The plugin's REST API namespace.
211-
pub namespace: String,
228+
pub namespace: Option<String>,
212229
/// A URL to the plugin's support page, where users can find help.
213230
pub support_url: String,
214231
}
@@ -218,34 +235,70 @@ impl KnownAuthenticationBlockingPlugin {
218235
vec![
219236
Self {
220237
name: "Wordfence".to_string(),
221-
namespace: "wordfence/v1".to_string(),
238+
slug: PluginSlug::from("wordfence/wordfence"),
239+
namespace: Some("wordfence/v1".to_string()),
222240
// TODO: Ensure this is correct with the WordFence folks
223241
support_url: "https://www.wordfence.com/support/".to_string(),
224242
},
225243
Self {
226244
name: "Hostinger Tools".to_string(),
227-
namespace: "hostinger-tools-plugin/v1".to_string(),
245+
slug: PluginSlug::from("hostinger-tools/hostinger-tools"),
246+
namespace: Some("hostinger-tools-plugin/v1".to_string()),
228247
// TODO: Ensure this is correct with the Hostinger folks
229248
support_url: "https://wordpress.org/support/plugin/hostinger/".to_string(),
230249
},
231250
Self {
232251
name: "FluentAuth".to_string(),
233-
namespace: "fluent-auth".to_string(),
252+
slug: PluginSlug::from("fluent-security/fluent-security"),
253+
namespace: Some("fluent-auth".to_string()),
234254
// TODO: Ensure this is correct with the FluentAuth folks
235255
support_url: "https://wordpress.org/support/plugin/fluent-security/".to_string(),
236256
},
257+
Self {
258+
name: "Disable XML-RPC".to_string(),
259+
slug: PluginSlug::from("disable-xml-rpc/disable-xml-rpc"),
260+
namespace: None,
261+
support_url: "https://wordpress.org/plugins/disable-xml-rpc/".to_string(),
262+
},
263+
Self {
264+
name: "Disable XML-RPC-API".to_string(),
265+
slug: PluginSlug::from("disable-xml-rpc-api/disable-xml-rpc-api"),
266+
namespace: None,
267+
support_url: "https://wordpress.org/plugins/disable-xml-rpc-api/".to_string(),
268+
},
269+
Self {
270+
name: "Loginizer".to_string(),
271+
slug: PluginSlug::from("loginizer/loginizer"),
272+
namespace: None,
273+
support_url: "https://wordpress.org/support/plugin/loginizer/".to_string(),
274+
},
275+
Self {
276+
name: "Really Simple Security".to_string(),
277+
slug: PluginSlug::from("really-simple-ssl/rlrsssl-really-simple-ssl"),
278+
namespace: None,
279+
support_url: "https://wordpress.org/support/plugin/really-simple-ssl/".to_string(),
280+
},
237281
]
238282
}
239283

240284
fn application_passwords() -> Vec<Self> {
285+
let names = ["Wordfence", "Hostinger Tools", "FluentAuth"];
241286
Self::all()
287+
.into_iter()
288+
.filter(|plugin| names.contains(&plugin.name.as_str()))
289+
.collect()
242290
}
243291

244292
fn xmlrpc() -> Vec<Self> {
245293
Self::all()
246294
}
247295
}
248296

297+
#[uniffi::export]
298+
fn xmlrpc_blocking_plugins() -> Vec<KnownAuthenticationBlockingPlugin> {
299+
KnownAuthenticationBlockingPlugin::xmlrpc()
300+
}
301+
249302
#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
250303
#[serde(untagged)]
251304
pub enum WpRestApiAuthenticationScheme {

0 commit comments

Comments
 (0)