├── LICENSE
├── README.md
├── composer.json
└── plugin.php


/LICENSE:
--------------------------------------------------------------------------------
1 | The MIT License (MIT)
2 | Copyright (c) 2016 Geniem Oy
3 | 
4 | Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
5 | 
6 | The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
7 | 
8 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
9 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | ![geniem-github-banner](https://cloud.githubusercontent.com/assets/5691777/14319886/9ae46166-fc1b-11e5-9630-d60aa3dc4f9e.png)
 2 | # WP Plugin: No-Admin-Ajax
 3 | [![Latest Stable Version](https://poser.pugx.org/devgeniem/wp-no-admin-ajax/v/stable)](https://packagist.org/packages/devgeniem/wp-no-admin-ajax) [![Total Downloads](https://poser.pugx.org/devgeniem/wp-no-admin-ajax/downloads)](https://packagist.org/packages/devgeniem/wp-no-admin-ajax) [![Latest Unstable Version](https://poser.pugx.org/devgeniem/wp-no-admin-ajax/v/unstable)](https://packagist.org/packages/devgeniem/wp-no-admin-ajax) [![License](https://poser.pugx.org/devgeniem/wp-no-admin-ajax/license)](https://packagist.org/packages/devgeniem/wp-no-admin-ajax)
 4 | 
 5 | A WordPress plugin that changes the WP AJAX routine and rewrites the ajax requests to custom url rather than `/wp-admin/admin-ajax.php` back-end.
 6 | 
 7 | ## Install
 8 | 
 9 | Recommended installation to WP project is through composer:
10 | ```
11 | $ composer require devgeniem/wp-no-admin-ajax
12 | ```
13 | 
14 | ## Use cases
15 | - Rewrite all admin-ajax.php queries into custom url so you can allow `/wp-admin/` to only certain IP-addresses.
16 | - You can use this to confuse bots which might try to use vulnerabilities in admin-ajax.php.
17 | 
18 | ## Configuration
19 | ### Variables
20 | This plugin url is by default `/no-admin-ajax/`. You can use filters to change it or you can set the default value by yourself by using:
21 | 
22 | ```php
23 | // This turns the no admin ajax url to -> /ajax/
24 | define('WP_NO_ADMIN_AJAX_URL','ajax');
25 | ```
26 | 
27 | **Notice:** Value set here can be filtered too, this just sets the starting point for the custom url.
28 | 
29 | **Notice 2:** After plugin installation and other changes be sure to refresh your permalinks by just going to Settings > Permalinks > and saving it without any modification.
30 | 
31 | ### Hooks & Filters
32 | You can customize the url by using filter `no-admin-ajax/keyword`.
33 | ```php
34 | <?php
35 | 
36 | // This changes /no-admin-ajax/ -> /ajax/
37 | add_filter( 'no-admin-ajax/keyword', 'my_custom_no_admin_ajax_url' );
38 | function my_custom_no_admin_ajax_url( $ajax_url ) {
39 |     return "ajax";
40 | }
41 | ```
42 | 
43 | You can run commands before ajax calls by using `no-admin-ajax/before` or `no-admin-ajax/before/{action}`
44 | ```php
45 | <?php
46 | // Writes log entries after hearthbeat action for debugging
47 | do_action( 'no-admin-ajax/before/heartbeat' , 'my_custom_no_admin_ajax_debug' );
48 | function my_custom_no_admin_ajax_debug() {
49 |     error_log( 'DEBUG | heartbeat action was run by: '.$_SERVER[“REMOTE_ADDR”] );
50 | }
51 | ```
52 | 


--------------------------------------------------------------------------------
/composer.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "name": "devgeniem/wp-no-admin-ajax",
 3 |   "type": "wordpress-plugin",
 4 |   "license": "MIT",
 5 |   "description": "A WordPress plugin that lightens the WP AJAX routine and directs the requests to front-end rather than admin back-end.",
 6 |   "authors": [
 7 |     {
 8 |       "name": "Miika Arponen",
 9 |       "email": "miika.arponen@geniem.com",
10 |       "homepage" : "https://github.com/Nomafin"
11 |     }
12 |   ],
13 |   "require": {
14 |     "php": ">=5.6",
15 |     "composer/installers": "^v1.0.12"
16 |   }
17 | }
18 | 


--------------------------------------------------------------------------------
/plugin.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | /**
  3 |  * Plugin Name: No-Admin-Ajax
  4 |  * Plugin URI: https://github.com/devgeniem/wp-no-admin-ajax
  5 |  * Description: A plugin that lightens the WP AJAX routine and directs the requests to front-end rather than admin back-end.
  6 |  * Author: Miika Arponen / Geniem Oy
  7 |  * Author URI: http://www.geniem.com
  8 |  * License: MIT
  9 |  * License URI: https://github.com/devgeniem/wp-no-admin-ajax/blob/master/LICENSE
 10 |  * Version: 1.0.2
 11 |  */
 12 | namespace Geniem\Helper;
 13 | 
 14 | class No_Admin_Ajax {
 15 |   public $keyword;
 16 | 
 17 |   protected static $already_run = false;
 18 | 
 19 |   public function __construct() {
 20 |     // This class should be run only once
 21 |     if ( self::$already_run === true ) {
 22 |       return false;
 23 |     }
 24 |     else {
 25 |       self::$already_run = true;
 26 |     }
 27 | 
 28 |     add_action( "after_setup_theme", array( $this, "init" ) );
 29 |   }
 30 | 
 31 |   public function init() {
 32 |     // Rewrite only public side admin urls
 33 |     if ( ! is_admin() ) {
 34 |       add_filter( 'admin_url', array( $this, 'redirect_ajax_url' ), 11, 3 );
 35 | 
 36 |       add_action( "template_redirect", array( $this, "run_ajax" ) );
 37 |     }
 38 | 
 39 |     // Register activation hook to flush the rewrites
 40 |     register_activation_hook( __FILE__, array( $this, "activate" ) );
 41 |     add_action( "init", array( $this, "rewrite" ) );
 42 | 
 43 |     // Url keyword to use for the ajax calls. Is modifiable with filter "no-admin-ajax/keyword"
 44 |     if ( defined('WP_NO_ADMIN_AJAX_URL') ) {
 45 |         // keyword doesn't need to contain slashes because they are set in redirect_ajax_url()
 46 |         // trim slashes to avoid confusion
 47 |         $default_keyword = trim(WP_NO_ADMIN_AJAX_URL,'/');
 48 |     } else {
 49 |         $default_keyword = "no-admin-ajax";
 50 |     }
 51 | 
 52 |     $this->keyword = apply_filters( "no-admin-ajax/keyword", $default_keyword );
 53 |   }
 54 | 
 55 |   // Function that handles rewriting the admin-ajax url to the one we want
 56 |   public function redirect_ajax_url( $url, $path, $blog_id ) {
 57 |     if( strpos( $url, 'admin-ajax' ) ) {
 58 |       return home_url( "/". $this->keyword ."/" );
 59 |     }
 60 |     else {
 61 |       return $url;
 62 |     }
 63 |   }
 64 | 
 65 |   // Creates the rewrite
 66 |   public function rewrite() {
 67 |     global $wp_rewrite;
 68 | 
 69 |     add_rewrite_tag( "%no-admin-ajax%", "([0-9]+)" );
 70 | 
 71 |     // The whole ajax url matching pattern can be altered with filter "no-admin-ajax/rule"
 72 |     $default_rule = "^". $this->keyword ."/?$";
 73 | 
 74 |     $rule = apply_filters( "no-admin-ajax/rule", $default_rule );
 75 | 
 76 |     add_rewrite_rule(
 77 |       $rule,
 78 |       "index.php?no-admin-ajax=true",
 79 |       "top"
 80 |     );
 81 |   }
 82 | 
 83 |   // Runs the ajax calls. Equivalent to the real admin-ajax.php
 84 |   public function run_ajax() {
 85 |     global $wp_query;
 86 | 
 87 |     if ( $wp_query->get("no-admin-ajax") ) {
 88 |       // Constant for plugins to know that we are on an AJAX request
 89 |       define("DOING_AJAX", true);
 90 | 
 91 |       // If we don't have an action, do nothing
 92 |       if ( ! isset( $_REQUEST["action"] ) ) {
 93 |           die(0);
 94 |       }
 95 | 
 96 |       // Escape the parameter to prevent disastrous things
 97 |       $action = esc_attr( $_REQUEST["action"] );
 98 | 
 99 |       // Run customized no-admin-ajax methods with action "no-admin-ajax/before"
100 |       do_action( "no-admin-ajax/before" );
101 | 
102 |       // Run customized no-admin-ajax methods for specific ajax actions with "no-admin-ajax/before/{action}"
103 |       do_action( "no-admin-ajax/before/". $action );
104 | 
105 |       // Same headers as WordPress normal AJAX routine sends
106 |       $default_headers = array(
107 |         "Content-Type: text/html; charset=" . get_option( "blog_charset" ),
108 |         "X-Robots-Tag: noindex"
109 |       );
110 | 
111 |       // Filter to customize the headers sent by ajax calls
112 |       $headers = apply_filters( "no-admin-ajax/headers", $default_headers );
113 | 
114 |       // Send the headers to the user
115 |       if ( is_array( $headers ) && count( $headers ) > 0 ) {
116 |         foreach ( $headers as $header ) {
117 |           @header( $header );
118 |         }
119 |       }
120 | 
121 |       send_nosniff_header();
122 |       nocache_headers();
123 | 
124 |       // Run the actions
125 |       if(is_user_logged_in()) {
126 |           do_action( "wp_ajax_" . $action );
127 |       }
128 |       else {
129 |           do_action( "wp_ajax_nopriv_" . $action );
130 |       }
131 | 
132 |       die(0);
133 |     }
134 |   }
135 | 
136 |   // Run activate during plugin activation
137 |   public function activate() {
138 |     global $wp_rewrite;
139 |     $this->rewrite();
140 |     $wp_rewrite->flush_rules();
141 |   }
142 | }
143 | 
144 | new No_Admin_Ajax();
145 | 


--------------------------------------------------------------------------------