diff --git a/docs/architecture.md b/docs/architecture.md index 995edfe..7b7b9ac 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -8,8 +8,9 @@ nor MariaDB publishes a host port; automated security checks guard this assumpti The custom `azionelab` classic theme renders the public single page. Theme modifications store the hero, manifesto, laboratory, teacher, lesson, and contact fields. The `azionelab-content` must-use plugin registers Shows and Gallery custom post types so -structured editorial content survives a theme change. Images use WordPress featured -images with local SVG fallbacks. +structured editorial content survives a theme change. These custom post types are +editorial data sources for the homepage, not standalone public routes or REST +collections. Images use WordPress featured images with local SVG fallbacks. WP-CLI is an opt-in tools-profile service. Its idempotent bootstrap installs WordPress, activates the theme, configures the site, and creates realistic demo content. Certbot is diff --git a/docs/security.md b/docs/security.md index 092eab6..350eeb9 100644 --- a/docs/security.md +++ b/docs/security.md @@ -6,6 +6,9 @@ ignored and real secrets must come from the deployment secret manager. - WordPress uses its normal capability, nonce, authentication, cookie, and password controls. Theme settings sanitize input and templates escape output. +- Structured Shows and Gallery content is editable in WordPress admin but is consumed + by the homepage only; it is not exposed as standalone public routes or REST + collections. - File editing is always disabled. Production also disables web-based core, theme, and plugin changes; patched images are rebuilt and redeployed instead. - XML-RPC and comments are disabled. NGINX blocks PHP execution below uploads, dotfiles, diff --git a/tests/functional/tests/portal.spec.ts b/tests/functional/tests/portal.spec.ts index e40524c..0ee8085 100644 --- a/tests/functional/tests/portal.spec.ts +++ b/tests/functional/tests/portal.spec.ts @@ -54,15 +54,15 @@ test("provides usable contact actions", async ({ page }) => { await expect(page.locator(".social-link-youtube")).toHaveCount(1); await expect(page.getByRole("link", { name: "Instagram" })).toHaveAttribute( "href", - "https://instagram.com/", + "https://instagram.com/azionelab", ); await expect(page.getByRole("link", { name: "Facebook" })).toHaveAttribute( "href", - "https://facebook.com/", + "https://facebook.com/azionelab", ); await expect(page.getByRole("link", { name: "YouTube" })).toHaveAttribute( "href", - "https://youtube.com/", + "https://youtube.com/@azionelab", ); await expect(page.locator(".social-links .social-icon")).toHaveCount(3); await expect(page.locator(".contact-actions .contact-icon")).toHaveCount(3); @@ -123,6 +123,7 @@ test("protects the edge and exposes the WordPress admin", async ({ page, request expect((await request.get("/wp-config.php")).status()).toBe(404); expect((await request.get("/wp-content/uploads/probe.php")).status()).toBe(403); expect((await request.get("/wp-json/wp/v2/users")).status()).toBe(404); + expect((await request.get("/?post_type=azl_show&name=le-cose-che-restano")).status()).toBe(404); await page.goto("/wp-admin/"); await expect(page).toHaveURL(/\/wp-login\.php/); diff --git a/tests/security/check-compose.sh b/tests/security/check-compose.sh index 3f58295..4a3164b 100755 --- a/tests/security/check-compose.sh +++ b/tests/security/check-compose.sh @@ -26,3 +26,8 @@ grep -q 'wp-content/(uploads|files)' /workspace/wordpress/apache-hardening.conf echo "Apache hardening must block PHP execution below uploads/files." >&2 exit 1 } + +grep -q "'publicly_queryable'[[:space:]]*=>[[:space:]]*false" /workspace/wordpress/mu-plugins/azionelab-content.php || { + echo "Structured show content must not be exposed as standalone public routes." >&2 + exit 1 +} diff --git a/wordpress/mu-plugins/azionelab-content.php b/wordpress/mu-plugins/azionelab-content.php index ede6747..163a6f5 100644 --- a/wordpress/mu-plugins/azionelab-content.php +++ b/wordpress/mu-plugins/azionelab-content.php @@ -19,12 +19,15 @@ function azionelab_register_content_types(): void { 'add_new_item' => 'Aggiungi spettacolo', 'edit_item' => 'Modifica spettacolo', ), - 'public' => true, - 'show_in_rest' => false, - 'menu_icon' => 'dashicons-tickets-alt', - 'supports' => array( 'title', 'editor', 'excerpt', 'thumbnail', 'page-attributes' ), - 'has_archive' => false, - 'rewrite' => false, + 'public' => false, + 'show_ui' => true, + 'publicly_queryable' => false, + 'exclude_from_search'=> true, + 'show_in_rest' => false, + 'menu_icon' => 'dashicons-tickets-alt', + 'supports' => array( 'title', 'editor', 'excerpt', 'thumbnail', 'page-attributes' ), + 'has_archive' => false, + 'rewrite' => false, ) ); diff --git a/wordpress/theme/azionelab/front-page.php b/wordpress/theme/azionelab/front-page.php index e78c1fa..fc7c0be 100644 --- a/wordpress/theme/azionelab/front-page.php +++ b/wordpress/theme/azionelab/front-page.php @@ -21,6 +21,11 @@ $social_links = array_values( static fn ( array $link ): bool => '' !== $link['url'] ) ); +$contact_email = sanitize_email( azionelab_mod( 'contact_email' ) ); +$contact_phone = trim( azionelab_mod( 'contact_phone' ) ); +$contact_phone_href = azionelab_phone_href( $contact_phone ); +$contact_whatsapp = trim( azionelab_mod( 'contact_whatsapp' ) ); +$contact_whatsapp_href = azionelab_whatsapp_href( $contact_whatsapp ); ?>
@@ -135,7 +140,7 @@ $social_links = array_values( ?>
Locandina di <?php the_title_attribute(); ?> -

+

- Scrivi una mail - Chiama - WhatsApp + + Scrivi una mail + + + Chiama + + + WhatsApp +
diff --git a/wordpress/theme/azionelab/functions.php b/wordpress/theme/azionelab/functions.php index 29d255b..00011e7 100644 --- a/wordpress/theme/azionelab/functions.php +++ b/wordpress/theme/azionelab/functions.php @@ -29,9 +29,9 @@ function azionelab_defaults(): array { 'contact_email' => 'ciao@azionelab.org', 'contact_phone' => '+39 333 123 4567', 'contact_whatsapp' => '+39 333 123 4567', - 'contact_instagram' => 'https://instagram.com/', - 'contact_facebook' => 'https://facebook.com/', - 'contact_youtube' => 'https://youtube.com/', + 'contact_instagram' => '', + 'contact_facebook' => '', + 'contact_youtube' => '', 'contact_address' => "Via dell'Epomeo 9999, Napoli", 'footer_text' => 'Uno spazio aperto a chi desidera incontrare il teatro, insieme.', ); diff --git a/wp-cli/bootstrap.sh b/wp-cli/bootstrap.sh index 0ef7327..a1784ce 100644 --- a/wp-cli/bootstrap.sh +++ b/wp-cli/bootstrap.sh @@ -46,6 +46,7 @@ wp option update permalink_structure '/%postname%/' if ! wp theme is-active azionelab; then wp theme activate azionelab fi +wp eval 'set_theme_mod( "contact_instagram", "https://instagram.com/azionelab" ); set_theme_mod( "contact_facebook", "https://facebook.com/azionelab" ); set_theme_mod( "contact_youtube", "https://youtube.com/@azionelab" );' for sample_id in 1 2; do if ! wp post get "$sample_id" --field=ID >/dev/null 2>&1; then