iMil

Hi,

sorry I haven’t been very helpful these days, for you to know, I “fixed” (ugly fix) the issue by replacing:

$the_content = $the_title . do_shortcode( apply_filters( ‘the_co
ntent’, $the_article ) );

with

$the_content = $the_title . do_shortcode( $the_article );

I know that sucks a lot…

The main problem is that whenever a plugin is activated, it will be re-included as apply_filter() is called before inclusion.

It appears that it’s RPS include content who’s duplicating entries…

As I regularly update the rules for my WordPress websites, I wrote a post I keep up-to-date with latest rules. It is available here https://imil.net/wp/2012/12/30/wordpress-3-5-and-naxsi/
Note that this website is actually using that very configuration and I see various attacks blocked by the system.

Stripped down, more secure:

# WP website itself
BasicRule wl:1005,1010,1011,1308,1309,1315 “mz:$HEADERS_VAR:cookie”;

# WP login screen
BasicRule wl:1100 “mz:$ARGS_VAR:redirect_to”;
BasicRule wl:1100 “mz:$BODY_VAR:redirect_to”;
# WP backend
BasicRule wl:1000 “mz:URL|$URL:/wp/wp-admin/update-core.php”;
BasicRule wl:1000 “mz:URL|$URL:/wp/wp-admin/update.php”;
BasicRule wl:1000 “mz:$BODY_VAR:_wp_http_referer”;
BasicRule wl:1000 “mz:$ARGS_VAR:action”;
# load and load[] GET variable
BasicRule wl:1015 “mz:$ARGS_VAR:load”;
BasicRule wl:1015 “mz:$ARGS_VAR:load[]”;
# WP categories and add new
BasicRule wl:1310,1311 “mz:$URL:/wp/wp-admin/load-scripts.php|$ARGS_VAR:load[]|NAME”;