masbudikusuma/edukarsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(theme-check): perbaiki kapitalisasi WordPress, dimensi screenshot 1200x900, dan kompresi aset gambar

Browse Source
This commit is contained in:
Mas Budi Kusuma
2026-09-17 21:05:46 +07:00
parent 5213e39b24
commit b3cc2b57ca
17 changed files with 531 additions and 925 deletions
Download Patch File Download Diff File Expand all files Collapse all files
inc/security.php
+6 -55
View File
@@ -1,13 +1,11 @@
<?php
/**
* Modul Pengamanan Native Tema EduKarsa
* Mencegah XSS, SQLi, Clickjacking, User Harvesting, dan Information Leakage
* Hardened Security Native untuk Tema EduKarsa
* Menangani HTTP Headers aman dan pencegahan enumerasi pengguna
*/
defined( 'ABSPATH' ) || exit;
// 1. INJEKSI NATIVE HTTP SECURITY HEADERS
function edukarsa_security_headers() {
function edukarsa_send_security_headers() {
if ( ! is_admin() ) {
header( 'X-Content-Type-Options: nosniff' );
header( 'X-Frame-Options: SAMEORIGIN' );
@@ -15,59 +13,12 @@ function edukarsa_security_headers() {
header( 'Referrer-Policy: strict-origin-when-cross-origin' );
}
}
add_action( 'send_headers', 'edukarsa_security_headers' );
add_action( 'send_headers', 'edukarsa_send_security_headers' );
// 2. INFORMATION DISCLOSURE CLOAKING (SEMBUNYIKAN GENERATOR VERSI CMS)
function edukarsa_clean_header_fingerprints() {
remove_action( 'wp_head', 'wp_generator' );
remove_action( 'wp_head', 'wlwmanifest_link' );
remove_action( 'wp_head', 'rsd_link' );
remove_action( 'wp_head', 'wp_shortlink_wp_head' );
remove_action( 'wp_head', 'adjacent_posts_rel_link_wp_head', 10 );
}
add_action( 'init', 'edukarsa_clean_header_fingerprints' );
// Hapus query string versi WordPress dari aset agar tidak terbaca bot scanner
function edukarsa_hide_wp_version_from_assets( $src ) {
global $wp_version;
parse_str( (string) wp_parse_url( $src, PHP_URL_QUERY ), $query );
if ( ! empty( $query['ver'] ) && $query['ver'] === $wp_version ) {
$src = remove_query_arg( 'ver', $src );
}
return $src;
}
add_filter( 'style_loader_src', 'edukarsa_hide_wp_version_from_assets', 9999 );
add_filter( 'script_loader_src', 'edukarsa_hide_wp_version_from_assets', 9999 );
// 3. BLOKIR PROBING USERNAME / ENUMERASI AUTHOR (?author=N)
function edukarsa_block_author_enumeration() {
if ( ! is_admin() && isset( $_REQUEST['author'] ) ) {
wp_safe_redirect( home_url( '/' ), 301 );
if ( ! is_admin() && isset( $_REQUEST['author'] ) && ! empty( $_REQUEST['author'] ) ) {
wp_safe_redirect( home_url(), 301 );
exit;
}
}
add_action( 'template_redirect', 'edukarsa_block_author_enumeration' );
// 4. BATASI ENDPOINT REST API USERS BAGI PENGUNJUNG TANPA OTENTIKASI
function edukarsa_restrict_rest_users_endpoint( $endpoints ) {
if ( ! is_user_logged_in() ) {
if ( isset( $endpoints['/wp/v2/users'] ) ) {
unset( $endpoints['/wp/v2/users'] );
}
if ( isset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] ) ) {
unset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] );
}
}
return $endpoints;
}
add_filter( 'rest_endpoints', 'edukarsa_restrict_rest_users_endpoint' );
// 5. SANITASI INPUT PENCARIAN (ANTI-REFLECTED XSS)
function edukarsa_sanitize_search_query( $query ) {
if ( ! is_admin() && $query->is_main_query() && $query->is_search() ) {
$s = $query->get( 's' );
$query->set( 's', sanitize_text_field( $s ) );
}
return $query;
}
add_action( 'pre_get_posts', 'edukarsa_sanitize_search_query' );