Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

XML RPC request should get hard blocker quicker #8855

Merged
merged 1 commit into from
Mar 16, 2018

Conversation

enejb
Copy link
Member

@enejb enejb commented Feb 15, 2018

Currently math fallback doesn't do anything for xml rpc requests. Lets hard block xmlprc requests when they get marked as blocked. This would help prevent more of the requests coming though.

This PR blocks xmlrpc requests for would regularly show the math test just gets bypassed and allows more valid xml rpc requests though.

Testing instructions:

use the following code. composer.json

{
    "name": "xmlrpc-tester",
    "type": "test",
    "require": {
        "hieu-le/wordpress-xmlrpc-client": "~2.0"
    },
    "license": "GPL2",
    "authors": [
        {
            "name": "Enej",
            "email": ""
        }
    ]
}

index.php

require __DIR__ . '/vendor/autoload.php';
# Your Wordpress website is at: http://wp-website.com
$endpoint = "https://enej.wpsandbox.me/aaa/xmlrpc.php";

# Create client instance
$wpClient = new \HieuLe\WordpressXmlrpcClient\WordpressClient();
# Log error
$wpClient->onError(function($error, $event) {
	print_r( $error );
});

# Set the credentials for the next requests
$do = $wpClient->setCredentials( $endpoint, 'enejtest999', 'nopassword' );

print_r( $wpClient->getPost( 11395 ) );

run composer install to install the dependencies
run php index.php

You should get blocked pretty after a few attempts.
with an error.

screen_shot_2018-02-15_at_1_08_02_pm

Changelog entry

Started blocking XML RPC requests when they get marked as blocked by Protect.

Currently math fallback doesn't do anything for xml rpc requests.

This PR blocks xmlrpc requests for would regularly show the math test just gets bypassed and allows more valid xml rpc requests though.
@enejb enejb added [Feature] Protect Also known as Brute Force Attack Protection [Status] Needs Review To request a review from fellow Jetpack developers. Label will be renamed soon. labels Feb 15, 2018
@enejb enejb requested review from lezama and samhotchkiss February 15, 2018 19:31
@enejb enejb requested a review from a team as a code owner February 15, 2018 19:31
@jeherve jeherve added [Type] Enhancement Changes to an existing feature — removing, adding, or changing parts of it [Pri] Normal labels Feb 15, 2018
@lezama
Copy link
Contributor

lezama commented Feb 20, 2018

cc @dereksmart

Copy link
Contributor

@samhotchkiss samhotchkiss left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Didn't test, but code is simple and looks 💯

Definitely comfortable shipping this. We should make sure to give HEs a heads up to let us know if we can an influx in tickets where users are having their XML-RPC connections blocked. I wouldn't expect this, but better safe than sorry...

cc: @richardmtl @chaselivingston

@enejb
Copy link
Member Author

enejb commented Mar 9, 2018

cc @dereksmart

Copy link
Member

@dereksmart dereksmart left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@dereksmart dereksmart added [Status] Ready to Merge Go ahead, you can push that green button! and removed [Status] Needs Review To request a review from fellow Jetpack developers. Label will be renamed soon. labels Mar 16, 2018
@dereksmart dereksmart merged commit 46152c6 into master Mar 16, 2018
@ghost ghost removed the [Status] Ready to Merge Go ahead, you can push that green button! label Mar 16, 2018
@dereksmart dereksmart deleted the fix/protect-xml-rpc-block branch March 16, 2018 15:22
@oskosk oskosk added this to the 6.0 milestone Mar 20, 2018
oskosk added a commit that referenced this pull request Mar 23, 2018
dereksmart pushed a commit that referenced this pull request Mar 27, 2018
* Changelog 6.0: create base for changelog.

* Add #8938 to changelog

* Add #8962 to changelog

* Add #8974 to changelog

* Add #8975 to changelog

* Add #8978 to changelog

* Add #8867 to changelog

* Add #8937 to changelog

* Add #8961 to changelog

* Add #8855 to changelog

* Add #8944 to changelog

* Add #8973 to changelog

* Add #8977 to changelog

* Add #8979 to changelog

* Add #8980 to changelog

* Add #8982 to changelog

* Add #8983 to changelog

* Add #8984 to changelog

* Add #8986 to changelog

* Add #9005 to changelog

* Add #9010 to changelog

* Add #9012 to changelog

* Add #9021 to changelog

* Add #9022 to changelog

* Add #9056 to changelog

* Add #9061 to changelog

* Add #9079 to changelog

* Add #9080 to changelog

* Add #9088 to changelog

* Add #9096 to changelog

* Add #9097 to changelog

* Add #9100 to changelog

* Add #9107 to changelog

* Add #8969 to changelog

* Add #8993 to changelog

* Add #9003 to changelog

* Add #9031 to changelog

* Add #8945 to changelog

* Add #9052 to changelog

* Add #9058 to changelog

* Add #9066 to changelog

* Add #9076 to changelog

* Add #9053 to changelog

* Add #9108 to changelog

* Add #9135 to changelog

* Add #9148 to changelog

* Add #9125 to changelog

* Add #9137 to changelog

* Added testing instructions for 6.0.

* Added IS testing instructions, huge props to @tiagonoronha.

* Added #8498 to changelog.

* Added #8954 to changelog.

* Added #8985 to changelog.

* add #9027

* add #9112 to changelog

* add #9136 to changelog

* add #9102 to changelog

* add #9093 to changelog

* add #9062 to changelog

* add #9172 to changelog
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
[Feature] Protect Also known as Brute Force Attack Protection [Pri] Normal [Type] Enhancement Changes to an existing feature — removing, adding, or changing parts of it
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants