Skip to content

Add security fixes#18

Merged
MaggieCabrera merged 3 commits intotrunkfrom
add-secuirty-fixes
Nov 25, 2021
Merged

Add security fixes#18
MaggieCabrera merged 3 commits intotrunkfrom
add-secuirty-fixes

Conversation

@scruffian
Copy link
Copy Markdown
Contributor

@scruffian scruffian commented Nov 19, 2021

This adds some security fixes:

  • Sanitize all inputs
  • Add another user capability check
  • Add a nonce check
  • Add some error/success meessages

Fixes #15

@scruffian scruffian requested a review from a team November 19, 2021 11:56
@scruffian scruffian self-assigned this Nov 19, 2021

function create_blockbase_child_admin_notice_error() {
$class = 'notice notice-error';
$message = __( 'Please specify a theme name.', 'create-blockbase-theme' );
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sometimes you can get in here for other errors, but only ones that users shouldn't hit unless they are doing something dodgy!

@scruffian scruffian mentioned this pull request Nov 19, 2021
@MaggieCabrera
Copy link
Copy Markdown
Contributor

Should we add a require attr to the theme name input too?

@scruffian
Copy link
Copy Markdown
Contributor Author

Done!

@MaggieCabrera
Copy link
Copy Markdown
Contributor

Something is not working, I get the success message but I don't get a zip!

@scruffian
Copy link
Copy Markdown
Contributor Author

scruffian commented Nov 24, 2021

Something is not working, I get the success message but I don't get a zip!

are you running GB trunk?

@MaggieCabrera
Copy link
Copy Markdown
Contributor

are you running GB trunk?

yep!

@scruffian
Copy link
Copy Markdown
Contributor Author

I dont think this will work against trunk because of the key change from user to custom - it's probably throwing a fatal error.

@MaggieCabrera
Copy link
Copy Markdown
Contributor

I just tried with the latest version from the dotorg repo and it's the same. It's 12.0.0, on a fresh site too.

@scruffian
Copy link
Copy Markdown
Contributor Author

i just pushed a fix. Such a silly mistake! 🤦

Copy link
Copy Markdown
Contributor

@MaggieCabrera MaggieCabrera left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now!

@MaggieCabrera MaggieCabrera merged commit 37ead7c into trunk Nov 25, 2021
@MaggieCabrera MaggieCabrera deleted the add-secuirty-fixes branch November 25, 2021 08:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Validate the form

3 participants