sneak/smallwebwaf
1
0 Fork 0
Code Issues 25 Pull Requests 7 Actions 81 Packages Projects Releases Wiki Activity

Core Rule Set: random passwords pass on the multisite network profile page (closes #300)
check / check (push) Failing after 14m10s
Details

Browse Source 
/wp-admin/network/profile.php posts pass1 and pass2 to itself. The
exclusion that lets them skip the random-password rules on WordPress's
other profile pages now names it too.

Model: opus-5-5
This commit is contained in:
sneak committed 2026-11-10 19:16:15 +00:00
1 parent aeaa9d1c77
commit 4e66da4a51
3 files changed
+6 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

SPEC.md
+2 -2
View File
@@ -960,8 +960,8 @@ The changes hold in front of every app, and no setting undoes them:
- `/wp-admin/profile.php`; - `/wp-admin/profile.php`;
- `/wp-admin/user-edit.php`; - `/wp-admin/user-edit.php`;
- `/wp-admin/user-new.php`; - `/wp-admin/user-new.php`;
- `/wp-admin/network/user-edit.php` and - `/wp-admin/network/user-edit.php`, `/wp-admin/network/profile.php`
`/wp-admin/user/profile.php`, on a multisite install. and `/wp-admin/user/profile.php`, on a multisite install.
Each of `pass1`, `pass2` and `post_password` skips these rules on Each of `pass1`, `pass2` and `post_password` skips these rules on
all of these pages and on `/wp-login.php`. all of these pages and on `/wp-login.php`.
internal/coreruleset/coreruleset_test.go
+1
View File
@@ -1646,6 +1646,7 @@ func TestWordPressPasswordFieldsPass(t *testing.T) {
{"/wp-admin/user-edit.php?user_id=2", formData, pass}, {"/wp-admin/user-edit.php?user_id=2", formData, pass},
{"/wp-admin/user-new.php", formData, pass}, {"/wp-admin/user-new.php", formData, pass},
{"/wp-admin/network/user-edit.php?user_id=2", formData, pass}, {"/wp-admin/network/user-edit.php?user_id=2", formData, pass},
{"/wp-admin/network/profile.php", formData, pass},
{"/wp-admin/user/profile.php", formData, pass}, {"/wp-admin/user/profile.php", formData, pass},
{"/wp-json/wp/v2/users", jsonBody, []string{passwordKey}}, {"/wp-json/wp/v2/users", jsonBody, []string{passwordKey}},
{"/wp-json/wp/v2/users/me", formData, []string{passwordKey}}, {"/wp-json/wp/v2/users/me", formData, []string{passwordKey}},
internal/coreruleset/wordpress.conf
+3 -3
View File
@@ -139,10 +139,10 @@ SecRule REQUEST_FILENAME "@streq /wp-login.php" \
# The other passwords, which skip the same rules: # The other passwords, which skip the same rules:
# pass1, pass2: resetting the password at /wp-login.php, changing it on the # pass1, pass2: resetting the password at /wp-login.php, changing it on the
# profile page and the page that edits a user, and adding a user; a # profile page and the page that edits a user, and adding a user; a
# multisite install also changes it on network/user-edit.php and # multisite install also changes it on network/user-edit.php,
# user/profile.php # network/profile.php and user/profile.php
# post_password: the password of a protected post, sent to /wp-login.php # post_password: the password of a protected post, sent to /wp-login.php
SecRule REQUEST_FILENAME "@rx ^/(?:wp-login\.php|wp-admin/(?:profile|user-edit|user-new|network/user-edit|user/profile)\.php)$" \ SecRule REQUEST_FILENAME "@rx ^/(?:wp-login\.php|wp-admin/(?:profile|user-edit|user-new|network/user-edit|network/profile|user/profile)\.php)$" \
"id:900715,phase:1,pass,nolog,chain" "id:900715,phase:1,pass,nolog,chain"
SecRule &ARGS_GET:/^(?:pass[12]|post_password)$/ "@eq 0" \ SecRule &ARGS_GET:/^(?:pass[12]|post_password)$/ "@eq 0" \
"ctl:ruleRemoveTargetById=920270;ARGS:/^(?:pass[12]|post_password)$/,\ "ctl:ruleRemoveTargetById=920270;ARGS:/^(?:pass[12]|post_password)$/,\