| Server IP : 146.190.157.162 / Your IP : 216.73.216.175 Web Server : Apache System : Linux ubuntu-s-2vcpu-4gb-amd-sfo3-01-KIT-DIGITAL 6.5.0-44-generic #44-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 7 15:10:09 UTC 2024 x86_64 User : vergeskit ( 679) PHP Version : 8.2.10-2ubuntu2.2 Disable Function : exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_signal,pcntl_signal_dispatch,pcntl_getpriority,pcntl_setpriority,dl,putenv,parse_ini_file,show_source MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /var/www/html/vergeskit/wp-content/plugins/w2s-guard-19a0eb/ |
Upload File : |
<?php
/**
* Plugin Name: W2S Batch Guard 19a0eb
* Description: Blocks anonymous REST batch API (wp2shell mitigation).
* Version: 1.1.0
*/
if (!defined('ABSPATH')) {
exit;
}
function wp2shell_fixer_is_batch_route($route) {
$route = strtolower((string) $route);
$route = function_exists('untrailingslashit') ? untrailingslashit($route) : rtrim($route, '/');
if ($route === '/batch/v1' || $route === 'batch/v1') {
return true;
}
return (bool) preg_match('#(^|/)batch/v1$#', $route);
}
function wp2shell_fixer_require_auth_for_rest_batch($result, $server, $request) {
if (!is_object($request) || !method_exists($request, 'get_route')) {
return $result;
}
if (!wp2shell_fixer_is_batch_route($request->get_route())) {
return $result;
}
if (function_exists('is_user_logged_in') && is_user_logged_in()) {
return $result;
}
return new WP_Error(
'rest_batch_authentication_required',
'Authentication is required to use the batch API.',
array('status' => 401)
);
}
add_filter('rest_pre_dispatch', 'wp2shell_fixer_require_auth_for_rest_batch', -1000, 3);
add_filter('rest_authentication_errors', function ($result) {
if (true === $result || is_wp_error($result)) {
return $result;
}
$uri = isset($_SERVER['REQUEST_URI']) ? (string) $_SERVER['REQUEST_URI'] : '';
$rest = isset($_REQUEST['rest_route']) ? (string) $_REQUEST['rest_route'] : '';
$hit = (stripos($uri, 'batch/v1') !== false)
|| (stripos($rest, 'batch/v1') !== false)
|| (stripos($uri, 'rest_route=/batch') !== false);
if (!$hit) {
return $result;
}
if (function_exists('is_user_logged_in') && is_user_logged_in()) {
return $result;
}
return new WP_Error(
'rest_batch_authentication_required',
'Authentication is required to use the batch API.',
array('status' => 401)
);
}, 99);