diff --git a/lib/wpscan/wp_target.rb b/lib/wpscan/wp_target.rb index 17a2612d..59fa5a64 100644 --- a/lib/wpscan/wp_target.rb +++ b/lib/wpscan/wp_target.rb @@ -138,32 +138,42 @@ class WpTarget # Should check wp-login.php if registration is enabled or not def registration_enabled? resp = Browser.instance.get(registration_url) - if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?registration=disabled/ + # redirect only on non multi sites + if resp.code == 302 and resp.headers_hash["location"] =~ /wp-login\.php\?registration=disabled/i enabled = false - else + # multi site registration form + elsif resp.code == 200 and resp.body =~ /
/i enabled = true + # normal registration form + elsif resp.code == 200 and resp.body =~ / 200) + @wp_target.registration_url.to_s.should == "http://example.localhost/wp-signup.php" + end + + it "should return the correct url (not multisite)" do + # set to single site + stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 302, :headers => { "Location" => "wp-login.php?action=register" }) @wp_target.registration_url.to_s.should == "http://example.localhost/wp-login.php?action=register" end end describe "#registration_enabled?" do - it "should return false" do + it "should return false (multisite)" do + # set to multi site + stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 200) stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 302, :headers => { "Location" => "wp-login.php?registration=disabled" }) @wp_target.registration_enabled?.should be_false end - it "should return true" do - stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 200) + it "should return true (multisite)" do + # set to multi site + stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 200) + stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 200, :body => %{}) @wp_target.registration_enabled?.should be_true end + + it "should return false (not multisite)" do + # set to single site + stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 302, :headers => { "Location" => "wp-login.php?action=register" }) + stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 302, :headers => { "Location" => "wp-login.php?registration=disabled" }) + @wp_target.registration_enabled?.should be_false + end + + it "should return true (not multisite)" do + # set to single site + stub_request(:any, "http://example.localhost/wp-signup.php").to_return(:status => 302, :headers => { "Location" => "wp-login.php?action=register" }) + stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 200, :body => %{ 302, :headers => { "Location" => "wp-login.php?action=register" }) + stub_request(:any, @wp_target.registration_url.to_s).to_return(:status => 500) + @wp_target.registration_enabled?.should be_false + end end describe "#is_multisite?" do @@ -282,5 +315,10 @@ describe WpTarget do stub_request(:any, @url).to_return(:status => 200) @wp_target.is_multisite?.should be_true end + + it "should return false" do + stub_request(:any, @url).to_return(:status => 500) + @wp_target.is_multisite?.should be_false + end end end