From abb8a26a48e0d9817d999837b7e7becb65c54532 Mon Sep 17 00:00:00 2001 From: clawbot <35+clawbot@noreply.example.org> Date: Tue, 10 Nov 2026 20:43:17 +0100 Subject: [PATCH] Core Rule Set: random passwords pass on the multisite network profile page (closes #300) /wp-admin/network/profile.php posts pass1 and pass2 to itself. The exclusion that lets them skip the random-password rules on WordPress's other profile pages now names it too. Model: opus-5-5 --- SPEC.md | 4 ++-- internal/coreruleset/coreruleset_test.go | 1 + internal/coreruleset/wordpress.conf | 6 +++--- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/SPEC.md b/SPEC.md index b5fa734..96cf3a9 100644 --- a/SPEC.md +++ b/SPEC.md @@ -960,8 +960,8 @@ The changes hold in front of every app, and no setting undoes them: - `/wp-admin/profile.php`; - `/wp-admin/user-edit.php`; - `/wp-admin/user-new.php`; - - `/wp-admin/network/user-edit.php` and - `/wp-admin/user/profile.php`, on a multisite install. + - `/wp-admin/network/user-edit.php`, `/wp-admin/network/profile.php` + and `/wp-admin/user/profile.php`, on a multisite install. Each of `pass1`, `pass2` and `post_password` skips these rules on all of these pages and on `/wp-login.php`. diff --git a/internal/coreruleset/coreruleset_test.go b/internal/coreruleset/coreruleset_test.go index 133e943..8dfcb86 100644 --- a/internal/coreruleset/coreruleset_test.go +++ b/internal/coreruleset/coreruleset_test.go @@ -1646,6 +1646,7 @@ func TestWordPressPasswordFieldsPass(t *testing.T) { {"/wp-admin/user-edit.php?user_id=2", formData, pass}, {"/wp-admin/user-new.php", formData, pass}, {"/wp-admin/network/user-edit.php?user_id=2", formData, pass}, + {"/wp-admin/network/profile.php", formData, pass}, {"/wp-admin/user/profile.php", formData, pass}, {"/wp-json/wp/v2/users", jsonBody, []string{passwordKey}}, {"/wp-json/wp/v2/users/me", formData, []string{passwordKey}}, diff --git a/internal/coreruleset/wordpress.conf b/internal/coreruleset/wordpress.conf index 3a17b71..1ba9ba0 100644 --- a/internal/coreruleset/wordpress.conf +++ b/internal/coreruleset/wordpress.conf @@ -139,10 +139,10 @@ SecRule REQUEST_FILENAME "@streq /wp-login.php" \ # The other passwords, which skip the same rules: # pass1, pass2: resetting the password at /wp-login.php, changing it on the # profile page and the page that edits a user, and adding a user; a -# multisite install also changes it on network/user-edit.php and -# user/profile.php +# multisite install also changes it on network/user-edit.php, +# network/profile.php and user/profile.php # post_password: the password of a protected post, sent to /wp-login.php -SecRule REQUEST_FILENAME "@rx ^/(?:wp-login\.php|wp-admin/(?:profile|user-edit|user-new|network/user-edit|user/profile)\.php)$" \ +SecRule REQUEST_FILENAME "@rx ^/(?:wp-login\.php|wp-admin/(?:profile|user-edit|user-new|network/user-edit|network/profile|user/profile)\.php)$" \ "id:900715,phase:1,pass,nolog,chain" SecRule &ARGS_GET:/^(?:pass[12]|post_password)$/ "@eq 0" \ "ctl:ruleRemoveTargetById=920270;ARGS:/^(?:pass[12]|post_password)$/,\