WordPress.org
Get WordPress

Plugin Directory

Changeset 2804133


Ignore:
Timestamp:
10/25/2022 09:43:23 PM (3 years ago)
Author:
resmushit
Message:

release 0.4.7 : CSRF protection

Location:
resmushit-image-optimizer/trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • resmushit-image-optimizer/trunk/classes/resmushitUI.class.php

    r2784230 r2804133  
    163163        }
    164164
    165         echo wp_kses_post("<div class='rsmt-bulk'><div class='non-optimized-wrapper $additionnalClassNeedOptimization'><h3 class='icon_message warning'>");
    166 
     165        echo wp_kses_post("<div class='rsmt-bulk' data-csrf='" . wp_create_nonce( 'bulk_process_image' ) . "'><div class='non-optimized-wrapper $additionnalClassNeedOptimization'><h3 class='icon_message warning'>");
     166       
    167167        if(get_option('resmushit_cron') && get_option('resmushit_cron') == 1) {
    168168            echo  wp_kses_post("<em>$countNonOptimizedPictures "
    … …  
    186186            )));
    187187
    188         echo wp_kses("</p><p class='submit' id='bulk-resize-examine-button'><button class='button-primary' onclick='resmushit_bulk_resize(\"bulk_resize_image_list\");'>", $allowed_html);
     188        echo wp_kses("</p><p class='submit' id='bulk-resize-examine-button'><button class='button-primary' onclick='resmushit_bulk_resize(\"bulk_resize_image_list\", \"" . wp_create_nonce( 'bulk_resize' ) . "\");'>", $allowed_html);
    189189       
    190190        if(get_option('resmushit_cron') && get_option('resmushit_cron') == 1) {
    … …  
    320320            'value'      => array(),
    321321            'class'      => array(),
    322             'name'      => array()
     322            'name'      => array(),
     323            'data-csrf'      => array(),
    323324        )));
    324325
    … …  
    327328            . __('Warning! By clicking the button below, you will restore all the original pictures, as before reSmush.it Image Optimizer installation. You will not have your pictures optimized! We strongly advice to be sure to have a complete backup of your website before performing this action', 'resmushit-image-optimizer')
    328329            . '</strong></p><p>'
    329             . '<input type="button" value="'. __('Restore ALL my original pictures', 'resmushit-image-optimizer') .'" class="rsmt-trigger--restore-backup-files button media-button  select-mode-toggle-button" name="resmushit" class="button wp-smush-send" />'
     330            . '<input type="button" data-csrf="'. wp_create_nonce( 'restore_library' ) .'" value="'. __('Restore ALL my original pictures', 'resmushit-image-optimizer') .'" class="rsmt-trigger--restore-backup-files button media-button  select-mode-toggle-button" name="resmushit" class="button wp-smush-send" />'
    330331            . '</div>', $allowed_html);
    331332        self::fullWidthPanelEndWrapper();       
    … …  
    456457                    'class'      => array(),
    457458                    'name'      => array(),
     459                    'data-csrf'      => array()
    458460                )));
    459461                echo wp_kses("<div class='rsmt-alert'>"
    … …  
    466468                . sprintf( __( 'We have found %s files ready to be removed', 'resmushit-image-optimizer' ), count(detect_unsmushed_files()) )
    467469                . '</p><p>'
    468                 . '<input type="button" value="'. __('Remove backup files', 'resmushit-image-optimizer') .'" class="rsmt-trigger--remove-backup-files button media-button  select-mode-toggle-button" name="resmushit" class="button wp-smush-send" />'
     470                . '<input type="button" value="'. __('Remove backup files', 'resmushit-image-optimizer') .'" data-csrf="'. wp_create_nonce( 'remove_backup' ) .'" class="rsmt-trigger--remove-backup-files button media-button  select-mode-toggle-button" name="resmushit" class="button wp-smush-send" />'
    469471                . "</div>", $allowed_html);
    470472            }
    … …  
    531533            $attachment_resmushit_disabled = 'checked';
    532534
    533         $output = '<input type="checkbox" data-attachment-id="'. $id .'"" class="rsmt-trigger--disabled-checkbox" '. $attachment_resmushit_disabled .'  />';
     535        $output = '<input type="checkbox" data-attachment-id="'. $id .'"" data-csrf="'. wp_create_nonce( 'single_attachment' ) .'"" class="rsmt-trigger--disabled-checkbox" '. $attachment_resmushit_disabled .'  />';
    534536       
    535537        if($return)
    … …  
    539541            'input' => array(
    540542                'type'      => array(),
    541                 'data-attachment-id'      => array(),
     543                'data-*'      => array(),
    542544                'checked'   => array(),
    543545        ));
    … …  
    561563        }
    562564        else if(reSmushit::getAttachmentQuality($attachment_id) != reSmushit::getPictureQualitySetting())
    563             $output = '<input type="button" value="'. __('Optimize', 'resmushit-image-optimizer') .'" class="rsmt-trigger--optimize-attachment button media-button  select-mode-toggle-button" name="resmushit" data-attachment-id="'. $attachment_id .'" class="button wp-smush-send" />';
     565            $output = '<input type="button" data-csrf="' . wp_create_nonce( 'single_attachment' ) . '" value="'. __('Optimize', 'resmushit-image-optimizer') .'" class="rsmt-trigger--optimize-attachment button media-button  select-mode-toggle-button" name="resmushit" data-attachment-id="'. $attachment_id .'" class="button wp-smush-send" />';
    564566        else{
    565567            $statistics = reSmushit::getStatistics($attachment_id);
    566568            $output = __('Reduced by', 'resmushit-image-optimizer') . " ". $statistics['total_saved_size_nice'] ." (". $statistics['percent_reduction'] . ' ' . __('saved', 'resmushit-image-optimizer') . ")";
    567             $output .= '<input type="button" value="'. __('Force re-optimize', 'resmushit-image-optimizer') .'" class="rsmt-trigger--optimize-attachment button media-button  select-mode-toggle-button" name="resmushit" data-attachment-id="'. $attachment_id .'" class="button wp-smush-send" />';
     569            $output .= '<input type="button" data-csrf="' . wp_create_nonce( 'single_attachment' ) . '" value="'. __('Force re-optimize', 'resmushit-image-optimizer') .'" class="rsmt-trigger--optimize-attachment button media-button  select-mode-toggle-button" name="resmushit" data-attachment-id="'. $attachment_id .'" class="button wp-smush-send" />';
    568570        }
    569571
    … …  
    576578                'class'      => array(),
    577579                'name'      => array(),
    578                 'data-attachment-id'      => array(),
     580                'data-*'      => array(),
    579581                'checked'   => array(),
    580582        )));

  • resmushit-image-optimizer/trunk/js/script.js

    r2528324 r2804133  
    4444function resmushit_bulk_process(bulk, item){
    4545    var error_occured = false; 
     46    var csrf_token = jQuery('.rsmt-bulk').attr('data-csrf');
    4647    jQuery.post(
    4748        ajaxurl, {
    4849            action: 'resmushit_bulk_process_image',
    49             data: bulk[item]
     50            data: bulk[item],
     51            csrf: csrf_token
    5052        },
    5153        function(response) {
    … …  
    98100 * @param string the id of the html element into which results will be appended
    99101 */
    100 function resmushit_bulk_resize(container_id) {
     102function resmushit_bulk_resize(container_id, csrf_token) {
    101103    container = jQuery('#'+container_id);
    102104    container.html('<div id="bulk_resize_target">');
    … …  
    112114            jQuery.post(
    113115                ajaxurl,
    114                 { action: 'resmushit_bulk_get_images' },
     116                { action: 'resmushit_bulk_get_images', csrf: csrf_token },
    115117                function(response) {
    116                     var images = JSON.parse(response);         
    117                     if (images.nonoptimized.length > 0) {   
     118                    var images = JSON.parse(response);
     119                    if (images.hasOwnProperty('error')) {
     120                        target.html('<div>' + images.error + '.</div>');
     121                    } else if (images.hasOwnProperty('nonoptimized') && images.nonoptimized.length > 0) {   
    118122                        bulkTotalimages = images.nonoptimized.length;
    119123                        target.html('<div class="loading--bulk"><span class="loader"></span><br />' + bulkTotalimages + ' attachment(s) found, starting optimization...</div>');
    … …  
    134138 */
    135139function updateStatistics() {
     140    var csrf_token = jQuery('.rsmt-bulk').attr('data-csrf');
    136141    jQuery.post(
    137142        ajaxurl, {
    138             action: 'resmushit_update_statistics'
     143            action: 'resmushit_update_statistics',
     144            csrf: csrf_token
    139145        },
    140146        function(response) {
    … …  
    160166        var disabledState = jQuery(current).is(':checked');
    161167        var postID = jQuery(current).attr('data-attachment-id');
     168        var csrfToken = jQuery(current).attr('data-csrf');
    162169
    163170        jQuery.post(
    164171            ajaxurl, {
    165172                action: 'resmushit_update_disabled_state',
    166                 data: {id: postID, disabled: disabledState}
     173                data: {id: postID, disabled: disabledState, csrf: csrfToken}
    167174            },
    168175            function(response) {
    … …  
    200207        var disabledState = jQuery(current).is(':checked');
    201208        var postID = jQuery(current).attr('data-attachment-id');
     209        var csrf_token = jQuery(current).attr('data-csrf');
     210       
    202211        jQuery.post(
    203212            ajaxurl, {
    204213                action: 'resmushit_optimize_single_attachment',
    205                 data: {id: postID}
     214                data: {id: postID, csrf: csrf_token}
    206215            },
    207216            function(response) {
    … …  
    225234            jQuery(current).val('Removing backups...');
    226235            jQuery(current).prop('disabled', true);
     236            var csrf_token = jQuery(current).attr('data-csrf');
    227237            jQuery.post(
    228238                ajaxurl, {
    229                     action: 'resmushit_remove_backup_files'
     239                    action: 'resmushit_remove_backup_files',
     240                    csrf: csrf_token
    230241                },
    231242                function(response) {
    … …  
    251262            jQuery(current).val('Restoring backups...');
    252263            jQuery(current).prop('disabled', true);
     264            var csrf_token = jQuery(current).attr('data-csrf');
    253265            jQuery.post(
    254266                ajaxurl, {
    255                     action: 'resmushit_restore_backup_files'
     267                    action: 'resmushit_restore_backup_files',
     268                    csrf: csrf_token
    256269                },
    257270                function(response) {

  • resmushit-image-optimizer/trunk/readme.txt

    r2784230 r2804133  
    33Tags: image, optimizer, image optimization, resmush.it, smush, jpg, png, gif, optimization, compression, Compress, Images, Pictures, Reduce Image Size, Smush, Smush.it
    44Requires at least: 4.0.0
    5 Tested up to: 6.0.2
    6 Stable tag: 0.4.6
     5Tested up to: 6.0.3
     6Stable tag: 0.4.7
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    99
    10 The FREE Image Optimizer which will compress your pictures and improve your SEO & performances by using reSmush.it, the 10+ billion images API optimizer.
     10The FREE Image Optimizer which will compress your pictures and improve your SEO & performances by using reSmush.it, the 20+ billion images API optimizer.
    1111
    1212== Description ==
    … …  
    7575== Changelog ==
    7676
     77
     78= 0.4.7 =
     79* Security fixes : CSRF protection for Ajax Calls
    7780
    7881= 0.4.6 =

  • resmushit-image-optimizer/trunk/resmushit.php

    r2784230 r2804133  
    1111 * Plugin URI:        https://wordpress.org/plugins/resmushit-image-optimizer/
    1212 * Description:       Image Optimization API. Provides image size optimization
    13  * Version:           0.4.6
    14  * Timestamp:         2022.09.13
     13 * Version:           0.4.7
     14 * Timestamp:         2022.10.25
    1515 * Author:            reSmush.it
    1616 * Author URI:        https://resmush.it
    … …  
    2323
    2424require('resmushit.inc.php');
    25 
    26 
     25require_once( ABSPATH . 'wp-includes/pluggable.php' );
    2726/**
    2827*
    … …  
    194193*/
    195194function resmushit_bulk_get_images() {
     195    if ( !isset($_REQUEST['csrf']) || ! wp_verify_nonce( $_REQUEST['csrf'], 'bulk_resize' ) ) {
     196        wp_send_json(json_encode(array('error' => 'Invalid CSRF token')));
     197        die();
     198    }
    196199    if(!is_super_admin() && !current_user_can('administrator')) {
    197200        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    … …  
    214217*/
    215218function resmushit_update_disabled_state() {
     219    if ( !isset($_REQUEST['data']['csrf']) || ! wp_verify_nonce( $_REQUEST['data']['csrf'], 'single_attachment' ) ) {
     220        wp_send_json(json_encode(array('error' => 'Invalid CSRF token')));
     221        die();
     222    }
    216223    if(!is_super_admin() && !current_user_can('administrator')) {
    217224        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    … …  
    237244*/
    238245function resmushit_optimize_single_attachment() {
     246    if ( !isset($_REQUEST['data']['csrf']) || ! wp_verify_nonce( $_REQUEST['data']['csrf'], 'single_attachment' ) ) {
     247        wp_send_json(json_encode(array('error' => 'Invalid CSRF token')));
     248        die();
     249    }
    239250    if(!is_super_admin() && !current_user_can('administrator')) {
    240251        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    … …  
    261272*/ 
    262273function resmushit_bulk_process_image() {
     274    if ( !isset($_REQUEST['csrf']) || ! wp_verify_nonce( $_REQUEST['csrf'], 'bulk_process_image' ) ) {
     275        wp_send_json(json_encode(array('error' => 'Invalid CSRF token')));
     276        die();
     277    }
    263278    if(!is_super_admin() && !current_user_can('administrator')) {
    264279        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    … …  
    283298*/
    284299function resmushit_update_statistics() {
     300    if ( !isset($_REQUEST['csrf']) || ! wp_verify_nonce( $_REQUEST['csrf'], 'bulk_process_image' ) ) {
     301        wp_send_json(json_encode(array('error' => 'Invalid CSRF token')));
     302        die();
     303    }
    285304    if(!is_super_admin() && !current_user_can('administrator')) {
    286305        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    … …  
    453472function resmushit_remove_backup_files() {
    454473    $return = array('success' => 0);
     474    if ( !isset($_REQUEST['csrf']) || ! wp_verify_nonce( $_REQUEST['csrf'], 'remove_backup' ) ) {
     475        wp_send_json(json_encode(array('error' => 'Invalid CSRF token')));
     476        die();
     477    }
    455478    if(!is_super_admin() && !current_user_can('administrator')) {
    456479        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));
    … …  
    495518*/
    496519function resmushit_restore_backup_files() {
     520    if ( !isset($_REQUEST['csrf']) || ! wp_verify_nonce( $_REQUEST['csrf'], 'restore_library' ) ) {
     521        wp_send_json(json_encode(array('error' => 'Invalid CSRF token')));
     522        die();
     523    }
    497524    if(!is_super_admin() && !current_user_can('administrator')) {
    498525        wp_send_json(json_encode(array('error' => 'User must be at least administrator to retrieve these data')));

  • resmushit-image-optimizer/trunk/resmushit.settings.php

    r2784230 r2804133  
    22
    33define('RESMUSHIT_ENDPOINT', 'http://api.resmush.it/');
    4 define('RESMUSHIT_VERSION', '0.4.6');
     4define('RESMUSHIT_VERSION', '0.4.7');
    55define('RESMUSHIT_DEFAULT_QLTY', '92');
    66define('RESMUSHIT_TIMEOUT', '10');
Note: See TracChangeset for help on using the changeset viewer.