PHP Parse error: syntax error, unexpected '|', expecting variable (T_VARIABLE) in /.wp-cli/packages/vendor/igor/wp_cli_secure_command/src/SubCommands/SubCommand.php on line 109

PHP 7.4.28 WP-CLI 2.6.0

Describe the bug I tried to install the package, just copied the line wp package install [email protected]:igorhrcek/wp-cli-secure-command.git and inserted it into iTerm. The error i got was:

`Warning: Package name mismatch...Updating from git name 'igorhrcek/wp-cli-secure-command' to composer.json name 'igor/wp_cli_secure_command'. Installing package igor/wp_cli_secure_command (dev-master) Updating /Users/xxxx/.wp-cli/packages/composer.json to require the package... Registering [email protected]:igorhrcek/wp-cli-secure-command.git as a VCS repository... Using Composer to install the package...

Loading composer repositories with package information Warning: The 'https://api.github.com/repos/igorhrcek/wp-cli-secure-command' URL could not be accessed: HTTP/1.1 400 Bad Request

Error: Package installation failed. Reverted composer.json.`

• OS: MacOS Monterey

Describe the bug

The Default permission mask used in FixFileAndDirPermissions sets files to 0666, which would allow any user to write to files in the WordPress installation.

I would recommend a file mask of 0644, which would only allow the owner of the file to write to it, and still allows read access to all other users.

To Reproduce

Run wp secure fix-permissions

Expected behavior

I suspect the intended behavior of this function would be to set the mask to 0644, which is rw-r--r-- or sets files readable by any user, but writable by only the owner of the file.

Describe the bug X-XSS-Protection is obsolete for a few years now and not supported by browsers anymore. This header will do nothing and at least caused privacy and security issues in the past.

To Reproduce

Expected behavior Remove the X-XSS-Protection header.

Additional context See also: https://caniuse.com/mdn-http_headers_x-xss-protection https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

Is your feature request related to a problem? Please describe. No

Describe the solution you'd like We need to develop custom CICD workflow for automated execution of tests using GitHub Actions

Describe alternatives you've considered None

Additional context We need to build Docker containers that will use both Apache and nginx to run WordPress. The reason for this is because we are doing integration tests for actual .htaccess and nginx rules that are deployed with our commands.

So to do so, we probably will have to modify official WordPress containers and add WP CLI and then to make a full workflow for performing tests.

Is your feature request related to a problem? Please describe. No

Describe the solution you'd like We need to update the Readme file to include information about managing security headers

Describe alternatives you've considered None

Additional context None

Describe the bug File manger always edits in the current working directory.

To Reproduce Steps to reproduce the behavior: run wp secure block-php plugins from the $HOME directory. An .htaccess will be created in the home directory. Even if a --path is specified.

Expected behavior

This is a tricky one. I think the default --path should be the default one in 90% of cases. But an .htaccess can also be located above a public folder. Probably the same applies to the nginx config files.

If the default path is respected a way for an exception should be available. maybe a --config-path flag.

Not a clear cut solution for this one.

Is your feature request related to a problem? Please describe. There are a few commands that are doing the same thing (blocking PHP execution) on various paths and instead of having 4 separate commands, we might have one.

Describe the solution you'd like Remove all existing block-php commands and replace it with only one that will accept arguments?

Describe alternatives you've considered None

Additional context For example, instead of:

wp secure block_php_exution_in_uploads

we should have:

wp secure blockphp --locations=uploads,themes,plugins,wp-includes

Describe the bug phpcs is reporting a huge amount of code style issues: https://github.com/igorhrcek/wp-cli-secure-command/actions/runs/2155584916

Expected behavior Try and fix all of the issues if possible

Additional context None

Is your feature request related to a problem? Please describe. No

Describe the solution you'd like Let's ask for confirmation before executing FixPermissions command.

Describe alternatives you've considered None

Additional context Here is the docs for the confirmation implementaion: https://make.wordpress.org/cli/handbook/references/internal-api/wp-cli-confirm/

We should say something like "This command will change file and folder permissions inside your WordPress installation which might affect the way it works. Are you sure that you want to do this?"

Is your feature request related to a problem? Please describe. No

Describe the solution you'd like TODO:

1. Refactor the block-access method to allow for custom files and folders
2. Fix the missing comments and check for PSR12 standardization of a code
3. Update the Readme file to reflect latest set of changes
4. Check existing Unit and Feature tests

Describe alternatives you've considered None

Additional context None

Is your feature request related to a problem? Please describe. No

Describe the solution you'd like Implement a new GHA workflow for automated testing of nginx rules

Describe alternatives you've considered None

Additional context In addition to this workflow I also need to build a WordPress container that uses nginx

Describe the bug Repeated and incorrectly formatted rules in .htacces causing errors.

To Reproduce Steps to reproduce the behavior:

1. Run wp secure block-access sensitive-files
2. Check .htaccess file
3. Each rule is repeated 4 times

Screenshots

Is your feature request related to a problem? Please describe. If we allow inline JS to exist then having strong CSP policies (https://github.com/igorhrcek/wp-cli-secure-command/issues/27) will have no real purpose.

Describe the solution you'd like We should find an elegant, sustainable and flexible solution for hooking into any WordPress installation in order to add and execute certain code.

Describe alternatives you've considered None

Additional context We should use a MU plugins for this. Practically every time we need to change the behavior of the WordPress we could just copy the PHP file from our codebase to a MU plugin and then update the main plugin file to include the new files. That way we can easily add and remove certain security features and hook into WP.

Is your feature request related to a problem? Please describe. No

Describe the solution you'd like We should implement a command that will allow us to manage different CSP policies - apply rules to certain policies, such as style-src, font-src, script-src etc.

The user should also be able to get information about what is applied as a policy, like "show me what I set as a script-src" and then to either add or remove addresses from it.

Describe alternatives you've considered None

Additional context CSP can get really messy, with too many URLs and different types of policies, so parsing them can be a tricky business.

I think that we should keep a state in a separate file (like in JSON object on FS) and use that to build policy directive and write it into configuration file.