<?php
/**
 * Block author enum.
 *
 * @package OvanapAdminToolkit
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}
return array(
	'key'      => 'block_author_enum',
	'title'    => 'Block author ID lookups',
	'desc'     => 'Redirect /?author=N requests to the homepage',
	'icon'     => 'shield',
	'risk'     => 'safe',
	'level'    => 'beginner',
	'audience' => 'everyone',
	'priority' => 3,
	'benefit'  => 'By default, /?author=1 redirects to that user\'s author archive, whose URL usually contains their login name. Bots use this to collect usernames before guessing passwords. With this on, those requests go to the homepage instead.',
	'help'     => 'Any front-end request with a numeric ?author= value (for example /?author=1) gets a 301 redirect to the homepage. Author archives at /author/name/ still work unless you also turn on "Disable author pages", and the REST API user list is covered by "Block public user list API".',
	'before'   => '/?author=1 redirects to /author/admin/',
	'after'    => '/?author=1 redirects to the homepage.',
	'detect'   => function () {
		return array(
			'detected' => true,
			'message'  => 'Author usernames discoverable via /?author=1',
			'safe'     => true,
			'savings'  => 'Security',
		);
	},
	'callback' => function () {
		add_action(
			'template_redirect',
			function () {
				if ( is_admin() ) {
					return;
				}
				// Public, read-only query argument: there is no form submission to protect with a nonce.
				$author = isset( $_GET['author'] ) ? sanitize_text_field( wp_unslash( $_GET['author'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only query argument.
				if ( '' !== $author && is_numeric( $author ) ) {
					wp_safe_redirect( home_url(), 301 );
					exit;
				}
			},
			1
		);
	},
);