nixpanelandClaude Sonnet 5
15d6060ae3
New browse/edit interface for the WordPress install's own files, built using the installed "WP File Manager" plugin (elFinder-based) as a functional reference rather than embedding it. Own REST controller (FileManagerData.php) + Vue page, same pattern as every other sub-app. Security is the whole point here (highest-risk surface in the plugin — arbitrary filesystem read/write): - Root is ABSPATH, manage_options-gated throughout. - Every client path is resolved via realpath() and checked for root containment against the *resolved* path, not string-matched against the raw input — catches symlink tricks and encoded traversal that a naive "../" check would miss. - Uploads/new files/renames reject a blocklist of server-executable extensions (.php, .cgi, .sh, etc.) — the single most important control, since uploading a webshell is the classic exploit path for this class of feature. - Deliberately not built: zip/unzip (zip-slip vulnerability class), chmod/permissions editing, cross-directory move/copy. Gated as a paid feature (riskier than Database Explorer, which is already paid) — a judgment call flagged to the user, not something they specified. Also fixed a real bug found while wiring this up: SubApps.php's page-level lock doesn't stop someone with manage_options from calling the REST endpoints directly, bypassing the license check entirely. File Manager's REST permission callbacks now also check License::is_feature_available(). The same gap exists in Database Explorer, Role Editor, and Activity Log's REST controllers and is flagged as a follow-up task, not fixed here (out of scope for what was asked, affects three unrelated features). Verified live via direct REST calls: path traversal blocked (404), blocked extensions rejected (400), root deletion blocked (400), and a full create/write/read/rename/delete round trip succeeded cleanly. Co-Authored-By: Claude Sonnet 5 <[email protected]>
55 lines
2.5 KiB
PHP
55 lines
2.5 KiB
PHP
<?php
|
|
/*
|
|
* Plugin Name: Aurora Admin
|
|
* Plugin URI: https://aurora.co
|
|
* Description: A modern, fast WordPress admin interface.
|
|
* Version: 2.7.0
|
|
* Author: Aurora
|
|
* Text Domain: aurora-admin
|
|
* Domain Path: /languages/
|
|
* Requires PHP: 7.4
|
|
* Requires at least: 5.5
|
|
* License: GPLv2 or later
|
|
*/
|
|
|
|
defined("ABSPATH") || exit();
|
|
|
|
define("AURORA_ADMIN_VERSION", "2.7.0");
|
|
define("AURORA_ADMIN_PATH", plugin_dir_path(__FILE__));
|
|
define("AURORA_ADMIN_URL", plugins_url("aurora-admin/"));
|
|
|
|
require AURORA_ADMIN_PATH . "admin/src/App/AuroraAdmin.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Options/Settings.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Licensing/Integrity.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Licensing/License.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Utility/Assets.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Shell/MenuSerializer.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Shell/Shell.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Pages/DashboardTakeover.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Pages/SettingsPage.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Rest/DashboardData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Analytics/Analytics.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Rest/AnalyticsData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Rest/PluginsData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Rest/CommentsData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Rest/PostsData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Rest/PagesData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Rest/MediaData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Rest/UsersData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/FileManager/FileManagerData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Posts/ScheduledDayFilter.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/WhiteLabel/WhiteLabel.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Pages/SubApps.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/MenuCreator/MenuCreator.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/MenuCreator/MenuCreatorData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Notices/Notices.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Notices/NoticesData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Roles/RolesData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/ActivityLog/ActivityLog.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/ActivityLog/ActivityLogData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/DatabaseExplorer/DatabaseExplorerData.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Login/LoginStyle.php";
|
|
require AURORA_ADMIN_PATH . "admin/src/Media/SvgUploads.php";
|
|
|
|
new AuroraAdmin\App\AuroraAdmin();
|