feat(*): Remove blaas subscription button (#170)

julienloizelet · web-flow · commit 0cf1e8aee99a · 2025-12-05T10:56:42.000+09:00
* feat(blaas): Remove blaas subscription button

* feat(*): Add compatibility for WordPress 6.9

* test(e2e): Be less restrictive on metrics test

* test(e2e): Clear cache for 6.9
diff --git a/.githooks/commit-msg b/.githooks/commit-msg
diff --git a/.github/workflows/doc-links.yml b/.github/workflows/doc-links.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
 
       - name: Clone sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: extension
 
diff --git a/.github/workflows/end-to-end-auto-prepend-test-suite.yml b/.github/workflows/end-to-end-auto-prepend-test-suite.yml
@@ -34,9 +34,9 @@ jobs:
             php-version: '7.2'
           - wp-version: '6.0'
             php-version: '8.0'
-          - wp-version: '6.8'
+          - wp-version: '6.9'
             php-version: '7.2'
-          - wp-version: '6.8'
+          - wp-version: '6.9'
             php-version: '8.3'
 
     name: End-to-end auto-prepend-file mode test suite
@@ -100,7 +100,7 @@ jobs:
           ddev wp core install --url='https://${{ env.WP_VERSION_CODE }}.ddev.site' --title='WordPress' --admin_user='admin' --admin_password='admin123' --admin_email='admin@admin.com'  
 
       - name: Clone ${{ env.EXTENSION_NAME }} files
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: ${{ env.EXTENSION_PATH }}
 
diff --git a/.github/workflows/end-to-end-multisite.yml b/.github/workflows/end-to-end-multisite.yml
@@ -26,7 +26,7 @@ jobs:
       # Latest minor version of each major version
       # Minimum PHP version compatible with all WordPress versions
       matrix:
-        wp-version: [ "4.9", "5.9", "6.8" ]
+        wp-version: [ "4.9", "5.9", "6.9" ]
         php-version: [ "7.2" ]
         subsite: ["site1", "site2"]
 
@@ -103,7 +103,7 @@ jobs:
           ddev wp site create --slug="site2" --title="WordPress Site2"  
 
       - name: Clone ${{ env.EXTENSION_NAME }} files
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: ${{ env.EXTENSION_PATH }}
 
diff --git a/.github/workflows/end-to-end-test-suite.yml b/.github/workflows/end-to-end-test-suite.yml
@@ -41,9 +41,9 @@ jobs:
             php-version: '7.2'
           - wp-version: '6.0'
             php-version: '8.0'
-          - wp-version: '6.8'
+          - wp-version: '6.9'
             php-version: '7.2'
-          - wp-version: '6.8'
+          - wp-version: '6.9'
             php-version: '8.3'
 
     name: End-to-end test suite
@@ -107,7 +107,7 @@ jobs:
           ddev wp core install --url='https://${{ env.WP_VERSION_CODE }}.ddev.site' --title='WordPress' --admin_user='admin' --admin_password='admin123' --admin_email='admin@admin.com'
 
       - name: Clone ${{ env.EXTENSION_NAME }} files
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: ${{ env.EXTENSION_PATH }}
 
diff --git a/.github/workflows/release-test.yml b/.github/workflows/release-test.yml
@@ -39,9 +39,9 @@ jobs:
             php-version: '7.2'
           - wp-version: '6.0'
             php-version: '8.0'
-          - wp-version: '6.8'
+          - wp-version: '6.9'
             php-version: '7.2'
-          - wp-version: '6.8'
+          - wp-version: '6.9'
             php-version: '8.3'
 
     name: End-to-end release test suite
@@ -112,15 +112,15 @@ jobs:
 
       - name: Clone files from last release
         if: github.event.inputs.check_head_zip != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: raw_sources
           ref: "v${{ env.LAST_TAG }}"
           repository: "${{ env.GITHUB_ORIGIN }}"
 
       - name: Clone files from HEAD
         if: github.event.inputs.check_head_zip == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: raw_sources
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -6,6 +6,7 @@ on:
             tag_name:
                 type: string
                 required: true
+                description: Tag with v prefix
             deploy_to_wordpress:
                 type: boolean
                 description: Deploy to WordPress
@@ -41,7 +42,7 @@ jobs:
                     echo "version_number=$(echo ${{ github.event.inputs.tag_name }} | sed 's/v//g' )" >> $GITHUB_OUTPUT
 
             -   name: Clone sources
-                uses: actions/checkout@v4
+                uses: actions/checkout@v5
 
             -   name: Check version consistency in files
                 # Check crowdsec.php (2), readme.txt (1), inc/Constants.php (1) and CHANGELOG.md (3)
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+---
+
+## [2.12.0](https://github.com/crowdsecurity/cs-wordpress-bouncer/releases/tag/v2.12.0) - 2025-12-05
+[_Compare with previous release_](https://github.com/crowdsecurity/cs-wordpress-bouncer/compare/v2.11.0...v2.12.0)
+
+### Added
+
+- Add compatibility with WordPress 6.9
+
+### Removed
+
+- Remove Blocklist as a Service (BLaaS) subscription button
+
+
 ---
 
 ## [2.11.1](https://github.com/crowdsecurity/cs-wordpress-bouncer/releases/tag/v2.11.1) - 2025-06-13
diff --git a/crowdsec.php b/crowdsec.php
@@ -4,16 +4,16 @@
  * Plugin URI: https://github.com/crowdsecurity/cs-wordpress-bouncer
  * Description: Safer Together. Protect your WordPress application with CrowdSec.
  * Tags: security, captcha, ip-blocker, crowdsec, hacker-protection, appsec
- * Version: 2.11.1
+ * Version: 2.12.0
  * Author: CrowdSec
  * Author URI: https://www.crowdsec.net/
  * Github: https://github.com/crowdsecurity/cs-wordpress-bouncer
  * License: MIT
  * License URI: https://opensource.org/licenses/MIT
  * Requires PHP: 7.2
  * Requires at least: 4.9
- * Tested up to: 6.8
- * Stable tag: 2.11.1
+ * Tested up to: 6.9
+ * Stable tag: 2.12.0
  * Text Domain: crowdsec-wp
  * First release: 2021.
  */
diff --git a/docs/DEVELOPER.md b/docs/DEVELOPER.md
@@ -409,14 +409,6 @@ Example:
 
     feat(admin): Add css for admin actions
 
-
-You can use the `commit-msg` git hook that you will find in the `.githooks` folder :
-
-```
-cp .githooks/commit-msg .git/hooks/commit-msg
-chmod +x .git/hooks/commit-msg
-```
-
 ### Allowed message `type` values
 
 - chore (automatic tasks; no production code change)
@@ -443,7 +435,7 @@ npm install -g doctoc
 Then, run it in the documentation folder:
 
 ```bash
-doctoc docs/*
+doctoc docs/* --maxlevel 4  
 ```
 
 
diff --git a/inc/Admin/settings.php b/inc/Admin/settings.php
@@ -58,23 +58,11 @@ function crowdsec_multi_save_settings()
     /**********************************
      ** Section "Connection details" **
      *********************************/
-
-    function getIntro()
-    {
-
-        $intro ='<p>The <b>Instant WordPress Blocklist</b> is an exclusive feature available through the CrowdSec plugin. <br>
-        <p class="submit blaas-button"><a class="button button-primary crowdsec-button"  href="https://buy.stripe.com/00g3cIcu59JVfewaES"
-                             target="_blank">Subscribe now</a></p>for only $5/month, proactively block thousands of attackers\' IPs currently targeting WordPress sites.
-        </p>'
-        . '<p><i>Instructions are available in the <a target="_blank" href="https://doc.crowdsec.net/u/bouncers/wordpress#instant-wordpress-blocklist">public documentation</a></i></p>'
-        ;
-
-        return $intro;
-    }
+    
 
     add_settings_section('crowdsec_admin_connection', 'Connection details', function () {
         echo 'Connect WordPress to your CrowdSec Local API.';
-    }, 'crowdsec_settings', ['after_section' => '<hr>', 'before_section' => getIntro()]);
+    }, 'crowdsec_settings', ['after_section' => '<hr>']);
 
     // Field "crowdsec_api_url"
     addFieldString('crowdsec_api_url', 'Local API URL', 'crowdsec_plugin_settings', 'crowdsec_settings', 'crowdsec_admin_connection', function ($input, $default ='') {
diff --git a/inc/Constants.php b/inc/Constants.php
@@ -21,5 +21,5 @@ class Constants extends LibConstants
     public const BOUNCER_NAME = 'wordpress-bouncer';
     public const DEFAULT_BASE_FILE_PATH = __DIR__ . '/../../../../wp-content/uploads/crowdsec/';
     public const STANDALONE_CONFIG_PATH = __DIR__ . '/standalone-settings.php';
-    public const VERSION = 'v2.11.1';
+    public const VERSION = 'v2.12.0';
 }
diff --git a/readme.txt b/readme.txt
@@ -3,8 +3,8 @@ Contributors: crowdsec
 Donate link: https://crowdsec.net/
 Tags: security, captcha, ip-blocker, crowdsec, hacker-protection
 Requires at least: 4.9
-Tested up to: 6.8
-Stable tag: 2.11.1
+Tested up to: 6.9
+Stable tag: 2.12.0
 Requires PHP: 7.2
 License: MIT
 License URI: https://opensource.org/licenses/MIT
@@ -63,6 +63,10 @@ Multiple ways you can use the plugin
 
 == Changelog ==
 
+= 2.12 (2025-12-05) =
+
+- Remove Blocklist as a Service (BLaaS) subscription button
+
 = 2.11 (2025-06-02) =
 
 - Add Blocklist as a Service (BLaaS) subscription button
diff --git a/tests/e2e-ddev/__tests__/2-live-mode-remediations.js b/tests/e2e-ddev/__tests__/2-live-mode-remediations.js
@@ -132,6 +132,7 @@ describe(`Run in Live mode`, () => {
         await publicHomepageShouldBeCaptchaWall();
         await page.click("#refresh_link");
         await runCacheAction("captcha-phrase", `&ip=${CURRENT_IP}`);
+        await wait(1000);
         const newPhrase = await page.$eval("h1", (el) => el.innerText);
         await expect(newPhrase).not.toEqual(phrase);
     });
diff --git a/tests/e2e-ddev/__tests__/3-live-mode-more.js b/tests/e2e-ddev/__tests__/3-live-mode-more.js
@@ -122,12 +122,27 @@ describe(`Run in Live mode`, () => {
         await goToAdmin();
         await onAdminGoToAdvancedPage();
 
-        await expect(page).toHaveText("#metrics-cscli-captcha", "captcha: 2");
-        await expect(page).toHaveText("#metrics-cscli-ban", "ban: 1");
-        await expect(page).toHaveText("#metrics-total-ban", "ban: 1");
-        await expect(page).toHaveText("#metrics-total-captcha", "captcha: 2");
-        // In multisite, it's 4, not sure why...(perhaps some admin pages is considered as "non admin" and bounced)
-        await expect(page).toMatchText("#metrics-total-bypass", /bypass: 2|4/);
+        // Extract numeric values and check they meet minimum thresholds
+        // We don't check exact values as it may vary depending on some complex conditions (WP-cron execution, multisite behavior, etc)
+        const captchaText = await page.textContent("#metrics-cscli-captcha");
+        const captchaCount = parseInt(captchaText.match(/captcha: (\d+)/)[1], 10);
+        expect(captchaCount).toBeGreaterThanOrEqual(2);
+
+        const banText = await page.textContent("#metrics-cscli-ban");
+        const banCount = parseInt(banText.match(/ban: (\d+)/)[1], 10);
+        expect(banCount).toBeGreaterThanOrEqual(1);
+
+        const totalBanText = await page.textContent("#metrics-total-ban");
+        const totalBanCount = parseInt(totalBanText.match(/ban: (\d+)/)[1], 10);
+        expect(totalBanCount).toBeGreaterThanOrEqual(1);
+
+        const totalCaptchaText = await page.textContent("#metrics-total-captcha");
+        const totalCaptchaCount = parseInt(totalCaptchaText.match(/captcha: (\d+)/)[1], 10);
+        expect(totalCaptchaCount).toBeGreaterThanOrEqual(2);
+
+        const totalBypassText = await page.textContent("#metrics-total-bypass");
+        const totalBypassCount = parseInt(totalBypassText.match(/bypass: (\d+)/)[1], 10);
+        expect(totalBypassCount).toBeGreaterThanOrEqual(2);
     });
 
     it("Should push remediation metrics", async () => {
@@ -141,15 +156,31 @@ describe(`Run in Live mode`, () => {
         // Cron is set to 15 minutes, so we need to force execution
         await forceCronRun();
         logContent = await getFileContent(DEBUG_LOG_PATH);
-        // metrics: cscli/captcha = 2 | cscli/ban = 1 | clean/bypass = 3
-        // The log should contain processed count = 5 or 6, depending how WordPress handle its cron...
-        // (if its 5, that means that there is another metrics call with processed = 1)
-        // In multisite, it can be 7, not sure why...(perhaps some admin pages is considered as "non admin" and bounced)
-        await expect(logContent).toMatch(
-            new RegExp(
-                `{"name":"dropped","value":2,"unit":"request","labels":{"origin":"cscli","remediation":"captcha"}},{"name":"dropped","value":1,"unit":"request","labels":{"origin":"cscli","remediation":"ban"}},{"name":"processed","value":(5|6|7),"unit":"request"}`,
-            ),
+        // Extract and validate metric values are within expected range
+        // Values may vary depending on WP-cron execution, multisite behavior, etc.
+        const captchaMatch = logContent.match(
+            /{"name":"dropped","value":(\d+),"unit":"request","labels":{"origin":"cscli","remediation":"captcha"}}/,
         );
+        expect(captchaMatch).not.toBeNull();
+        const captchaValue = parseInt(captchaMatch[1], 10);
+        expect(captchaValue).toBeGreaterThanOrEqual(2);
+        expect(captchaValue).toBeLessThanOrEqual(20);
+
+        const banMatch = logContent.match(
+            /{"name":"dropped","value":(\d+),"unit":"request","labels":{"origin":"cscli","remediation":"ban"}}/,
+        );
+        expect(banMatch).not.toBeNull();
+        const banValue = parseInt(banMatch[1], 10);
+        expect(banValue).toBeGreaterThanOrEqual(1);
+        expect(banValue).toBeLessThanOrEqual(20);
+
+        const processedMatch = logContent.match(
+            /{"name":"processed","value":(\d+),"unit":"request"}/,
+        );
+        expect(processedMatch).not.toBeNull();
+        const processedValue = parseInt(processedMatch[1], 10);
+        expect(processedValue).toBeGreaterThanOrEqual(5);
+        expect(processedValue).toBeLessThanOrEqual(30);
 
         await expect(logContent).not.toContain("No metrics to send");
         await goToAdmin();
diff --git a/tests/e2e-ddev/__tests__/4-live-mode-cache.js b/tests/e2e-ddev/__tests__/4-live-mode-cache.js
@@ -11,7 +11,7 @@ const {
     banOwnIpForSeconds,
     removeAllDecisions,
     onLoginPageLoginAsAdmin,
-    setDefaultConfig,
+    setDefaultConfig, runCacheAction,
 } = require("../utils/helpers");
 
 const { CURRENT_IP } = require("../utils/constants");
@@ -40,12 +40,14 @@ describe(`Run in Live mode`, () => {
         await onAdminAdvancedSettingsPageSetCleanIpCacheDurationTo(60);
         await onAdminAdvancedSettingsPageSetBadIpCacheDurationTo(60);
         await onAdminSaveSettings();
+        // Needed since 6.9 as it seems that some admin page are now bounced eve if "bounce public web only" is set to true
+        await runCacheAction("clear");
         await banOwnIpForSeconds(15 * 60, CURRENT_IP);
         await publicHomepageShouldBeBanWall();
-        wait(2000);
+        await wait(2000);
         await publicHomepageShouldBeBanWall();
         await removeAllDecisions();
-        wait(2000);
+        await wait(2000);
         await publicHomepageShouldBeBanWall();
 
         await goToAdmin();
diff --git a/tests/e2e-ddev/__tests__/5-stream-mode.js b/tests/e2e-ddev/__tests__/5-stream-mode.js
@@ -120,12 +120,23 @@ describe(`Run in Stream mode`, () => {
         );
 
         const logContent = await getFileContent(DEBUG_LOG_PATH);
-        // Should be 4 processed requests (or 6 in multisite tests)
-        await expect(logContent).toMatch(
-            new RegExp(
-                `{"name":"dropped","value":2,"unit":"request","labels":{"origin":"cscli","remediation":"ban"}},{"name":"processed","value":(4|6),"unit":"request"}`,
-            ),
+        // Extract and validate metric values are within expected range (>= 2 and <= 20)
+        // Values may vary depending on WP-cron execution, multisite behavior, etc.
+        const banMatch = logContent.match(
+            /{"name":"dropped","value":(\d+),"unit":"request","labels":{"origin":"cscli","remediation":"ban"}}/,
         );
+        expect(banMatch).not.toBeNull();
+        const banValue = parseInt(banMatch[1], 10);
+        expect(banValue).toBeGreaterThanOrEqual(2);
+        expect(banValue).toBeLessThanOrEqual(20);
+
+        const processedMatch = logContent.match(
+            /{"name":"processed","value":(\d+),"unit":"request"}/,
+        );
+        expect(processedMatch).not.toBeNull();
+        const processedValue = parseInt(processedMatch[1], 10);
+        expect(processedValue).toBeGreaterThanOrEqual(2);
+        expect(processedValue).toBeLessThanOrEqual(20);
 
         // Disable remediation metrics for future tests
         await goToAdmin();
