WordPress.org
Get WordPress

Plugin Directory

Changeset 2457478


Ignore:
Timestamp:
01/16/2021 11:11:40 AM (5 years ago)
Author:
themexa
Message:

v2.8.2 - Authenticated RCE Vulnerability Fixed

Location:
secure-file-manager/trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • secure-file-manager/trunk/includes/assets.php

    r2454695 r2457478  
    1818    }
    1919
    20     $sfmp_nonce_key = wp_create_nonce( 'secure-file-manager-pro' );
     20    $currentUserRoles = wp_get_current_user()->roles;
     21   
     22    if ( in_array( get_current_user_id(), get_option( 'sfm_auth_user' ) ) || !empty( array_intersect( $currentUserRoles, get_option( 'sfm_auth_roles' ) ) ) ) {
     23        $sfmp_nonce_key = wp_create_nonce( 'secure-file-manager-pro' );
     24    }
    2125
    2226    wp_enqueue_style( 'sfm-admin-normalize',  plugin_dir_url( dirname( __FILE__ ) ) . 'assets/admin/css/normalize.css' );

  • secure-file-manager/trunk/readme.txt

    r2456064 r2457478  
    66Tested up to: 5.6
    77Requires PHP: 7.1
    8 Stable tag: 2.8.1
     8Stable tag: 2.8.2
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    155155* Latest Stable Bootstrap Used
    156156
     157= 2.8.2 =
     158* Authenticated RCE Vulnerability Fixed
     159
    157160== Upgrade Notice ==
    158161= 1.0 =

  • secure-file-manager/trunk/secure-file-manager.php

    r2455255 r2457478  
    33/**
    44 * @package Secure File Manager
    5  * @version 2.8.1
     5 * @version 2.8.2
    66 */
    77
    … …  
    1111Description: Most Beautiful and Secure WordPress File Manager
    1212Author: Themexa
    13 Version: 2.8.1
     13Version: 2.8.2
    1414Author URI: https://www.themexa.com
    1515License: GPL2
    … …  
    2525 * Current plugin version.
    2626 */
    27 define( 'secure-file-manager', '2.8.1' );
     27define( 'secure-file-manager', '2.8.2' );
    2828
    2929/**

  • secure-file-manager/trunk/vendor/elfinder/php/connector.minimal.php

    r2452008 r2457478  
    260260
    261261    $nonce = $_REQUEST['_wpnonce'];
    262 
    263     if ( wp_verify_nonce( $nonce, 'secure-file-manager-pro' ) ){
     262    $currentUserRoles = wp_get_current_user()->roles;
     263
     264    if ( wp_verify_nonce( $nonce, 'secure-file-manager-pro' ) && ( in_array( get_current_user_id(), get_option( 'sfm_auth_user' ) ) || !empty( array_intersect( $currentUserRoles, get_option( 'sfm_auth_roles' ) ) ) ) ) {
    264265        $connectorOptions = array(
    265266            'driver'     => 'LocalFileSystem',
Note: See TracChangeset for help on using the changeset viewer.