Skip to content

Release 1.3.0

Choose a tag to compare

View all tags
@bryanlittlefield bryanlittlefield released this 21 Jul 18:08
· 17 commits to main since this release
1.3.0
6f38f04
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MightyShield 1.3.0

Hardening release in response to an automated card-testing attack. Focus: correctly identify the client IP behind Cloudflare, stop non-JavaScript bots that were slipping past the fingerprint/timing checks, and make silent failure modes loud. All changes are backward compatible — new options default to the previous ("flag") behavior, so upgrading changes no enforcement until you opt in.

🔒 Security & bug fixes

  • Real client IP behind Cloudflare. get_client_ip() no longer trusts the spoofable X-Forwarded-For / X-Real-IP headers. It now reads Cloudflare's CF-Connecting-IP, trusted only when the connection actually originates from a published Cloudflare range, and otherwise falls back to REMOTE_ADDR. This closes IP-based evasion of the block list, rate limiter, velocity detector and failed-payment blocks, and a whitelist-bypass where X-Forwarded-For: 127.0.0.1 matched the auto-whitelisted loopback entry. Configurable via the mshield_trusted_proxies filter and an optional MSHIELD_IP_HEADER constant for non-Cloudflare proxies.
  • Fixed a checkout-fatal CIDR bug. An IPv6 CIDR entry in the block/allow list caused an ArithmeticError (bit shift by a negative number) for every IPv4 visitor, breaking checkout. CIDR matching now requires matching address families and bounds-checks the mask.

🛡️ New protections

  • Fail-closed on missing device data. New settings Action on Missing Fingerprint (mshield_fingerprint_missing_action) and Action on Missing Token (mshield_timing_missing_action) — flag (default) or block. Set to block to stop scripted, non-JavaScript checkouts, which previously bypassed both checks. A block on missing data (a weaker signal) intentionally does not apply the 24-hour IP temp-block, so a false positive can't lock out a real shopper; positive detections still do.
  • Degraded-verification alerts. When the Smarty address API errors (e.g. HTTP 402 over-quota) and the plugin falls back to the basic ZIP/State check, it now logs a distinct degraded event, emails the admin (throttled to once/day), and shows a persistent admin notice until verification recovers — instead of silently downgrading.

🔧 Improvements

  • Removed the DNS auto-whitelist. Activation no longer resolves the site hostname and whitelists the result (behind a CDN that whitelisted the edge IP). A one-time upgrade migration removes stale Server IP (DNS: …) entries.
  • Forensic logging. Events now capture the user agent, billing email and request URI (previously the log stored none of these), surfaced in a new Details column in the log viewer.

⬆️ Upgrade notes

  • No action required to upgrade; enforcement is unchanged until you set the new missing-data actions to block.
  • Recommended when under active card-testing: set both missing-data actions to Block, and enable Cloudflare Turnstile (Fraud Checks → Bot Challenge) — the CAPTCHA fails closed and stops non-JS bots outright.
  • The upgrade migration cleans any CDN-edge IP that a prior version auto-added to the whitelist.

Full compatibility: WooCommerce, classic and block checkout. No database schema changes.

Assets 3
Loading