search

tokkonopapa / WordPress-IP-Geo-Block

A WordPress plugin that will blocks any comment, pingback and trackback spams posted from outside your nation. And it will also protect against malicious access to the login form, admin area and XML-RPC from undesired countries.
http://www.ipgeoblock.com/
29 stars 14 forks source link

XX private #59

Open ddur opened 5 years ago

ddur commented 5 years ago

Actually, private or localhost address can also be used from shared server by other shared server users. So, I believe that this line should not skip 'XX' code from checking, but leave it to user defined checks (country codes). Same as 'ZZ' code described in two lines below. https://github.com/tokkonopapa/WordPress-IP-Geo-Block/blob/5df0e717b27eb888b2559557f4c1c651fbbd99ad/ip-geo-block/classes/class-ip-geo-block.php#L383

I do not see why localhost/private request would be allowed to skip nonce validation, especially under shared server environment? https://github.com/tokkonopapa/WordPress-IP-Geo-Block/blob/5df0e717b27eb888b2559557f4c1c651fbbd99ad/ip-geo-block/classes/class-ip-geo-block.php#L825