{"id":280,"date":"2009-08-13T03:13:50","date_gmt":"2009-08-13T01:13:50","guid":{"rendered":"http:\/\/gcolpart.evolix.net\/blog21\/?p=280"},"modified":"2009-08-13T12:34:33","modified_gmt":"2009-08-13T10:34:33","slug":"mise-a-jour-wordpress-et-securisation-basique","status":"publish","type":"post","link":"https:\/\/gcolpart.evolix.net\/blog21\/mise-a-jour-wordpress-et-securisation-basique\/","title":{"rendered":"Mise-\u00e0-jour WordPress et s\u00e9curisation basique"},"content":{"rendered":"<p>Une faille de s\u00e9curit\u00e9 sur le logiciel <a href=\"http:\/\/www.wordpress.org\/\">WordPress<\/a> permet de r\u00e9initialiser le mot de passe d&#8217;un utilisateur connu (<em>admin<\/em> par exemple&#8230;). Cela consiste \u00e0 faire une requ\u00eate du type <em>http:\/\/SERVERNAME\/wp-login.php?action=rp&amp;key[]=<\/em> (soumettre une <em>key[]<\/em> vide permet apparemment de rendre inutile la v\u00e9rification par mail). Il est donc conseill\u00e9 de mettre \u00e0 jour WordPress en version 2.8.4 (voici le <a href=\"http:\/\/gcolpart.evolix.net\/docs\/wordpress-2.8.3_2.8.4.patch\">patch pour passer de la version 2.8.3 \u00e0 2.8.4<\/a>).<\/p>\n<p>J&#8217;en profite pour rappeler quelques notions basiques pour s\u00e9curiser une installation d&#8217;un logiciel PHP, surtout quand il est tr\u00e8s r\u00e9pandu : si possible, limiter les acc\u00e8s aux parties backoffice via Apache (restriction par adresses IP et\/ou authentification HTTP), utiliser des identifiants originaux (pas forc\u00e9ment <em>admin<\/em>&#8230;), des mots de passes complexes, \u00e9viter les modules\/plugins non fiables, suivre les notifications de mises-\u00e0-jour et les appliquer rapidement (cela implique de limiter les modifications intrusives emp\u00eachant des futures mises-\u00e0-jour, ou du moins les pr\u00e9parer sous forme de patch pour les r\u00e9-appliquer tr\u00e8s rapidement), etc. Pour le premier point, voici un exemple de s\u00e9curisation de WordPress via Apache :<\/p>\n<pre>&lt;LocationMatch \"^\/wordpress\/wp-(admin|login)\"&gt;\r\nDeny from all\r\nAllow from YOUR_IP\r\n&lt;\/LocationMatch&gt;<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Une faille de s\u00e9curit\u00e9 sur le logiciel WordPress permet de r\u00e9initialiser le mot de passe d&#8217;un utilisateur connu (admin par exemple&#8230;). Cela consiste \u00e0 faire une requ\u00eate du type http:\/\/SERVERNAME\/wp-login.php?action=rp&amp;key[]= (soumettre une key[] vide permet apparemment de rendre inutile la v\u00e9rification par mail). Il est donc conseill\u00e9 de mettre \u00e0 jour WordPress en version 2.8.4 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,72],"tags":[22,37,106,14],"class_list":["post-280","post","type-post","status-publish","format-standard","hentry","category-evolix","category-french","tag-lamp","tag-php","tag-security","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/gcolpart.evolix.net\/blog21\/wp-json\/wp\/v2\/posts\/280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gcolpart.evolix.net\/blog21\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gcolpart.evolix.net\/blog21\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gcolpart.evolix.net\/blog21\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/gcolpart.evolix.net\/blog21\/wp-json\/wp\/v2\/comments?post=280"}],"version-history":[{"count":6,"href":"https:\/\/gcolpart.evolix.net\/blog21\/wp-json\/wp\/v2\/posts\/280\/revisions"}],"predecessor-version":[{"id":285,"href":"https:\/\/gcolpart.evolix.net\/blog21\/wp-json\/wp\/v2\/posts\/280\/revisions\/285"}],"wp:attachment":[{"href":"https:\/\/gcolpart.evolix.net\/blog21\/wp-json\/wp\/v2\/media?parent=280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gcolpart.evolix.net\/blog21\/wp-json\/wp\/v2\/categories?post=280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gcolpart.evolix.net\/blog21\/wp-json\/wp\/v2\/tags?post=280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}