Skip to content

Hide WP Surface 0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 04:08
v0.2.0
86a0110
This commit was signed with the committer’s verified signature.
fifoqueue FiLo
GPG key ID: 7A4480C42B88203E
Verified
Learn about vigilant mode.

This security update disables markers created by older releases. After updating, replace the generated server block and verify the login and path aliases again from the standard wp-admin path. The runtime GitHub updater and Nginx FastCGI compatibility mode were removed.

== Changelog ==

  • Bound activation and probe markers to the exact configuration hash so an old verified marker cannot enable changed paths or login settings.
  • Disabled active aliases before saving path changes and made every login alias require its own verified marker.
  • Authenticated the original-path server handoff, removed unauthenticated internal flags, disabled their caching, and separated internal capabilities by login, admin, content, and includes purpose.
  • Matched normalized Nginx URIs and added verification for percent-encoded and duplicate-slash original-path bypasses.
  • Removed the direct Nginx FastCGI compatibility blocks so aliases re-enter canonical locations and retain origin access controls.
  • Removed unsigned runtime GitHub update installation, third-party updater code, stored GitHub credentials, and outbound update telemetry.
  • Removed whole-response HTML buffering to avoid response-sized memory amplification.
  • Expire authentication cookies from old admin alias paths and clean their tracked paths during uninstall.
  • Hardened marker and recovery files against symlink writes, modernized Apache deny rules, and made verification-probe cleanup fail closed.
  • Registered the unauthenticated AJAX route probe only while a matching one-time verification probe exists.
  • Pinned every third-party GitHub Actions step to a full commit SHA.
Assets 4
Loading