The WordPress REST API was introduced in the WordPress core at the end of 2016 with the release of WordPress 4.6. Like all the big changes that appear in the platform, the REST API generated controversy in some and indifference in others.
It’s even possible that you have no idea what it is, but if you have an updated version of WordPress (and you should) you are exposing many aspects of your website publicly through the REST API. Just append the fragment /wp-json/ to your domain name and visit this URL to see it with your own eyes.
Moreover, do the exercise of visiting the following web URLs and you may be surprised with what you’ll find:
mydomain.com/wp-json/wp/v2/users
mydomain.com/wp-json/wp/v2/posts
As a result of the first URL you will have a JSON with the data of the users of your web. Notice that user identifiers are included there, and this is something that people traditionally hide due to security issues and to prevent possible attacks.
The second URL shows us a list with the last posts. However, if you have protected content that only certain premium users of your website (in a membership site, for example) should have access to, it’s possible that you’ve been exposing this premium content through the REST API.
Let’s see how we can avoid compromised situations by being more aware of what we publicly expose through the WordPress REST API.
Show WordPress REST API Only to Registered Users
A solution that we can implement to hide the WordPress REST API is to prevent those users who are not registered on our website from accessing it.
To hide the REST API to unregistered users, we must add the following code in our WordPress. Remember that you can put it in the functions.php file of your theme or just develop a plugin for it (a much better option).
}
if ( ! current_user_can( 'administrator' ) ) {
return new WP_Error( 'rest_not_admin', 'You are not an administrator.', array( 'status' => 401 ) );
}
return $result;
});
Change password in CodeIgniter with callback validation for check old password.
Controller
application/controllers/Users.php
defined('BASEPATH')ORexit('No direct script access allowed');classUsersextendsCI_Controller{publicfunction__construct(){parent::__construct();$this->load->helper('form');$this->load->library('form_validation');$this->load->model('users_model');}privatefunctionlogged_in(){if(!$this->session->userdata('authenticated')){redirect('users/login');}}publicfunctionchangePassword(){$this->logged_in();$data['title']='Change Password';$this->load->library('form_validation');$this->form_validation->set_rules('oldpass','old password','callback_password_check');$this->form_validation->set_rules('newpass','new password','required');$this->form_validation->set_rules('passconf','confirm password','required|matches[newpass]');$this->form_validation->set_error_delimiters('
','
');if($this->form_validation->run()==false){$this->load->view('header',$data);$this->load->view('users/change_password',$data);$this->load->view('footer',$data);}else{$id=$this->session->userdata('id');$newpass=$this->input->post('newpass');$this->users_model->update_user($id,array('password'=>md5($newpass)));redirect('users/logout');}}publicfunctionpassword_check($oldpass){$id=$this->session->userdata('id');$user=$this->users_model->get_user($id);if($user->password!==md5($oldpass)){$this->form_validation->set_message('password_check','The {field} does not match');returnfalse;}returntrue;}}?>
Model
application/models/Users_model.php
defined('BASEPATH')ORexit('No direct script access allowed');classUsers_modelextendsCI_Model{publicfunctionget_user($id){$this->db->where('id',$id);$query=$this->db->get('users');return$query->row();}publicfunctionupdate_user($id,$userdata){$this->db->where('id',$id);$this->db->update('users',$userdata);}}?>
View
application/views/users/change_password.php
div class="row justify-content-center"><div class="col-6"><h1>echo$title?>h1>echoform_open('users/changePassword',array('id'=>'passwordForm'))?><div class="form-group"><input type="password"name="oldpass"id="oldpass"class="form-control"placeholder="Old Password"/>echoform_error('oldpass','
CREATE TABLE IF NOT EXISTS `ci_sessions` (
`id` varchar(40) NOT NULL,
`ip_address` varchar(45) NOT NULL,
`timestamp` int(10) unsigned DEFAULT 0 NOT NULL,
`data` blob NOT NULL,
KEY `ci_sessions_timestamp` (`timestamp`)
)
How do I install MySQL server 8.0 on CentOS 8 Linux server running on Linode and AWS cloud? How do I add and set up a new MySQL user and database account on the newly created CentOS server?
Oracle MySQL server version 8.0 is a free and open-source free database server. It is one of the most popular database system used in web apps and websites on the Internet.
Typically MySQL is part of the LAMP (Linux, Apache/Nginx, MySQL, Perl/Python/PHP) stack. Popular open-source software such as WordPress, MediaWiki, and others profoundly used by MySQL as a database storage engine. Let us see how to install MySQL server version 8.x on CentOS 8 Linux server.
First, open the terminal app and then log in to your CentOS server using the ssh command: $ ssh vivek@centos-8-ec2-box-ip
Now, update CentOS system to apply security updates and fixes on Linux system using the dnf command/yum command: $ sudo yum update ## or ##
$ sudo dnf update Sample outputs:
Luckily our CentOS 8 box comes with MySQL 8 server package. Let us search for it: $ sudo yum search mysql-server
$ sudo yum module list mysql
And we see:
Last metadata expiration check: 0:02:47 ago on Mon Nov 23 16:26:31 2020.
===================== Name Exactly Matched: mysql-server ======================
mysql-server.x86_64 : The MySQL server and related files
Next, find out version information, run: $ sudo yum info mysql-server
Here is what we see:
Last metadata expiration check: 0:02:22 ago on Mon Nov 23 16:26:31 2020.
Available Packages
Name : mysql-server
Version : 8.0.21
Release : 1.module_el8.2.0+493+63b41e36
Architecture : x86_64
Size : 22 M
Source : mysql-8.0.21-1.module_el8.2.0+493+63b41e36.src.rpm
Repository : AppStream
Summary : The MySQL server and related files
URL : http://www.mysql.com
License : GPLv2 with exceptions and LGPLv2 and BSD
Description : MySQL is a multi-user, multi-threaded SQL database server. MySQL
: is a client/server implementation consisting of a server daemon
: (mysqld) and many different client programs and libraries. This
: package contains the MySQL server and some accompanying files
: and directories.
Install it: $ sudo yum install mysql-server
Click to enlarge
Step 2 – Enabling MySQL 8 mysqld.service,server
The service name is mysqld.service, and we need to enable it using the following systemctl command: $ sudo systemctl enable mysqld.service
Confirmation displayed:
Start the service and then verify it: $ sudo systemctl start mysqld.service
$ sudo systemctl status mysqld.service
● mysqld.service - MySQL 8.0 database server
Loaded: loaded (/usr/lib/systemd/system/mysqld.service; enabled; vendor preset: disabled)
Active: active (running) since Mon 2020-11-23 16:50:14 UTC; 4s ago
Process: 551 ExecStopPost=/usr/libexec/mysql-wait-stop (code=exited, status=0/SUCCESS)
Process: 681 ExecStartPost=/usr/libexec/mysql-check-upgrade (code=exited, status=0/SUCCESS)
Process: 601 ExecStartPre=/usr/libexec/mysql-prepare-db-dir mysqld.service (code=exited, status=0/SUCCESS)
Process: 577 ExecStartPre=/usr/libexec/mysql-check-socket (code=exited, status=0/SUCCESS)
Main PID: 637 (mysqld)
Status: "Server is operational"
Tasks: 39 (limit: 24960)
Memory: 331.0M
CGroup: /system.slice/mysqld.service
└─637 /usr/libexec/mysqld --basedir=/usr
Nov 23 16:50:13 centos-aws-mysql systemd[1]: Stopped MySQL 8.0 database server.
Nov 23 16:50:13 centos-aws-mysql systemd[1]: Starting MySQL 8.0 database server...
Nov 23 16:50:14 centos-aws-mysql systemd[1]: Started MySQL 8.0 database server.
Step 3 – Securing MySQL 8 server
All you need to do is type the following command, and it will secure MySQL 8 server installation on CentOS Linux: $ sudo mysql_secure_installation
Please set the password for root here.
New password:
Re-enter new password:
Estimated strength of the password: 100
Do you wish to continue with the password provided?(Press y|Y for Yes, any other key for No) : y
By default, a MySQL installation has an anonymous user,
allowing anyone to log into MySQL without having to have
a user account created for them. This is intended only for
testing, and to make the installation go a bit smoother.
You should remove them before moving into a production
environment.
Remove anonymous users? (Press y|Y for Yes, any other key for No) : y
Success.
Normally, root should only be allowed to connect from
'localhost'. This ensures that someone cannot guess at
the root password from the network.
Disallow root login remotely? (Press y|Y for Yes, any other key for No) : y
Success.
By default, MySQL comes with a database named 'test' that
anyone can access. This is also intended only for testing,
and should be removed before moving into a production
environment.
Remove test database and access to it? (Press y|Y for Yes, any other key for No) : y
- Dropping test database...
Success.
- Removing privileges on test database...
Success.
Reloading the privilege tables will ensure that all changes
made so far will take effect immediately.
Reload privilege tables now? (Press y|Y for Yes, any other key for No) : y
Success.
All done!
Step 4 – Starting/Stopping/Restarting MySQL 8 server
The syntax is: $ sudo systemctl start mysql.service
$ sudo systemctl stop mysql.service
$ sudo systemctl restart mysql.service
To view the MySQL 8 service log as follows using the journalctl command: $ sudo journalctl -u mysqld.service -xe
$ sudo tail -f /var/log/mysql/mysqld.log MySQL 8 log file sample entries:
2020-11-23T16:55:19.101316Z 0 [System] [MY-013172] [Server] Received SHUTDOWN from user . Shutting down mysqld (Version: 8.0.21).
2020-11-23T16:55:21.728819Z 0 [Warning] [MY-010909] [Server] /usr/libexec/mysqld: Forcing close of thread 10 user: 'root'.
2020-11-23T16:55:23.083389Z 0 [System] [MY-010910] [Server] /usr/libexec/mysqld: Shutdown complete (mysqld 8.0.21) Source distribution.
2020-11-23T16:56:19.225544Z 0 [System] [MY-010116] [Server] /usr/libexec/mysqld (mysqld 8.0.21) starting as process 524
2020-11-23T16:56:19.237500Z 1 [System] [MY-013576] [InnoDB] InnoDB initialization has started.
2020-11-23T16:56:19.562441Z 1 [System] [MY-013577] [InnoDB] InnoDB initialization has ended.
2020-11-23T16:56:19.677202Z 0 [System] [MY-011323] [Server] X Plugin ready for connections. Bind-address: '::' port: 33060, socket: /var/lib/mysql/mysqlx.sock
2020-11-23T16:56:19.754024Z 0 [Warning] [MY-010068] [Server] CA certificate ca.pem is self signed.
2020-11-23T16:56:19.754207Z 0 [System] [MY-013602] [Server] Channel mysql_main configured to support TLS. Encrypted connections are now supported for this channel.
2020-11-23T16:56:19.780843Z 0 [System] [MY-010931] [Server] /usr/libexec/mysqld: ready for connections. Version: '8.0.21' socket: '/var/lib/mysql/mysql.sock' port: 3306 Source distribution.
Step 5 – Testing MySQL 8 installation
So far, so good. You learned how to install, set up, secure, and start/stop the MySQL 8 on CentOS 8 Linux cloud server. It is time to log in as a
mysql root user. The syntax is: $ mysql -u root -p
$ mysql -u USER -h host -p
$ mysql -u USER -h host -p mysql
Let us type a few SQL commands at the mysql> prompt: STATUS;
SHOW VARIABLES LIKE "%version%";
quit
Step 6 – Creating a new MySQL 8 database and user account with password
Let create a new database called ‘spacedb‘, type at the mysql> prompt: CREATE DATABASE spacedb;
Next, we are going to create a new user named ‘mars‘ for our database called ‘spacedb’ as follows: CREATE USER 'mars'@'%' IDENTIFIED BY 'User_Password_Here';
Finally, give permissions: GRANT SELECT, INSERT, UPDATE, DELETE ON spacedb.* TO 'mars'@'%';
Of course, we can grant ALL PRIVILEGES too as follows: GRANT ALL PRIVILEGES ON spacedb.* TO 'mars'@'%';
See MySQL 8 users and their grants/permissions as follows: SELECT user,host FROM mysql.user;
SHOW GRANTS for mars;
quit
Test new user settings and DB as follows: mysql -u mars -p spacedb
mysql -u mars -h localhost -p spacedb
Where,
-u mars; : User name for login
-h localhost : Connect to server named localhost
-p : Prompt for password
spacedb : Connect to database named spacedb
Step 7 – Configuring MySQL 8 server on a CentOS 8
Let us see default config file using the cat command: # cat /etc/my.cnf.d/mysql-server.cnf Config:
WARNING: See MySQL documentation for a detailed explanation for tuning options as to each server and set up is unique. Do not set up values blindly. I provide them as a starting point for optimizing MySQL 8 installation and values depending upon available RAM, CPU cores, server load and other circumstances.
Step 8 – Firewall configuration to open MySQL server TCP port 3306
Are you using MySQL 8 server remotely? Do you have Apache/Nginx/PHP/Python/Perl app on another server? Then open port for everyone: $ sudo firewall-cmd --zone=public --add-service=mysql --permanent
Only allow access from 192.168.1.0/24 CIDR: $ sudo firewall-cmd \
--add-rich-rule 'rule family="ipv4" \
source address="192.168.1.0/24" \
service name="mysql" accept' --permanent
The above is fine grained firewalld access rules to restrict access to MySQL 8 server to VLAN users only. See how to set up a firewall using FirewallD on CentOS 8 Linux for more info.
Conclusion
And there you have it, Oracle MySQL server version 8.x set up and running correctly on a CentOS Linux 8 server with Firewalld config. Further, you learned how to add a new database, user, and password for your project including MySQL 8 server tuning options.
Create a new virtual machine and install the CentOS to the virtual machine. During the CentOS installation, select Workstation as Base Environment, select Container Management, Development Tools and Graphical Administration Tools as Additional software for Selected Environment. Use http://mirror.centos.org/centos/8/BaseOS/x86_64/os/ as the installation source.
After installing the CentOS, execute the following commands to get the required libraries to create applications for handling compiled objects.
dnf update
dnf -y install elfutils-libelf-devel
Insert the ISO of VirtualBox Guest Additions to the virtual machine, and then install it.
Use the following command, with oracle user, to edit the crontab file.
crontab -e
Put the following cron job in the first line of crontab file, then press the keys :wq to save and exit.
@reboot /home/oracle/scripts/cron.sh
Healthcheck
Login as oracle user and then execute the following commands one-by-one.
sqlplus /nolog
conn / as sysdba;select* from v$version;
show pdbs;
Create New User and Tablespace
Login as Sysdba with SqlPlus.
sqlplus / as sysdba
Update the seesion setting _ORACLE_SCRIPT to true to allow common user comes without c## as prefix.
ALTER SESSION SET"_ORACLE_SCRIPT"=true;
Create a new tablespace with an automatic extensible size 100MB, maximum 10G in size.
-- DROP TABLESPACE my_tablespace INCLUDING CONTENTS AND DATAFILES;-- Location of the dat file: /u01/app/oracle/product/19.3.0/dbhome_1/dbs/my_tablespace.dat-- SELECT tablespace_name, block_size, max_size, status FROM DBA_TABLESPACES;CREATETABLESPACEmy_tablespace
DATAFILE 'my_tablespace.dat'
SIZE 100M
AUTOEXTEND ON
NEXT 32M MAXSIZE 10G
EXTENT MANAGEMENT LOCAL
SEGMENT SPACE MANAGEMENT AUTO
;
SELECT FILE_ID, FILE_NAME, TABLESPACE_NAME, AUTOEXTENSIBLE, INCREMENT_BY
FROM DBA_DATA_FILES ORDER BY FILE_ID DESC;
[Optional] Update the password life time from 180 days (default) to unlimited.
ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME UNLIMITED;
Create a new user.
-- ALTER SESSION SET "_ORACLE_SCRIPT"=true;-- DROP USER newuser CASCADE;CREATEUSERnewuser IDENTIFIED BY "P@ssw0rd" DEFAULT TABLESPACE my_tablespace;
Grant permissions to the new user.
-- REVOKE CREATE SESSION FROM newuser;-- REVOKE CREATE TABLE FROM newuser;-- REVOKE CREATE VIEW FROM newuser;-- REVOKE CREATE ANY TRIGGER FROM newuser;-- REVOKE CREATE ANY PROCEDURE FROM newuser;-- REVOKE CREATE SEQUENCE FROM newuser;-- REVOKE CREATE SYNONYM FROM newuser;GRANT CREATE SESSION TO newuser;
GRANT CREATE TABLE TO newuser;
GRANT CREATE VIEW TO newuser;
GRANT CREATE ANY TRIGGER TO newuser;
GRANT CREATE ANY PROCEDURE TO newuser;
GRANT CREATE SEQUENCE TO newuser;
GRANT CREATE SYNONYM TO newuser;
ALTERUSER newuser QUOTA UNLIMITED ON my_tablespace;
ISD ofron suport IT me staf të kualifikuar të gatshëm 24×7. Suporti ynë është i disponueshëm online, offline, remote, offsite dhe përmes manualeve të përdorimit dhe të administrimit. Suporti i ISD ofrohet në forma të ndryshme: të herëpashershëm, me kontratë të thjeshtë dhe me kontratë profesionale.