WordPress.org
Get WordPress

Plugin Directory

Changeset 2939202


Ignore:
Timestamp:
07/16/2023 06:14:12 PM (3 years ago)
Author:
notetoservices
Message:

fixed CSRF vulnerability

Location:
upload-media-by-url/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • upload-media-by-url/trunk/readme.txt

    r2482063 r2939202  
    44Author website: https://notetoservices.com
    55Tags: upload, url, multiple, files, media, library, attachment
    6 Requires at least: 5.6
    7 Tested up to: 5.6
    8 Stable tag: 1.0.7
     6Requires at least: 6.2
     7Tested up to: 6.2
     8Stable tag: 1.0.8
    99Requires PHP: 7.4
    1010Plugin URI: http://wordpress.org/plugins/upload-media-by-url/
    … …  
    4545
    4646== Changelog ==
     47= 1.0.8 =
     48Fixed issue with CSRF vulnerability found by Dmitrii Ignatiev
     49
    4750= 1.0.7 =
    4851Fixed issue with $this in umbu_mediaButton function

  • upload-media-by-url/trunk/uploadmediabyurl.php

    r2482068 r2939202  
    88Author URI: https://notetoservices.com
    99License: GPLv2 or later
    10 Version: 1.0.7
     10Version: 1.0.8
    1111*/
    1212
    … …  
    6969    );
    7070
    71     $overrides = array(
     71    $nonce = wp_create_nonce('umbu_download');
     72
     73    // Add the nonce field to the form
     74    wp_nonce_field('umbu_download', $nonce);
     75
     76    // Move the temporary file into the uploads directory
    7277        // Tells WordPress to not look for the POST form
    7378        // fields that would normally be present as
    … …  
    7580        // will be no form fields
    7681        // Default is true
    77         'test_form' => false,
    7882
    79         // Setting this to false lets WordPress allow empty files, not recommended
    80         // Default is true
    81         'test_size' => true,
    82     );
    83 
    84     // Move the temporary file into the uploads directory
    85     $results = media_handle_sideload( $file, $post->$id, NULL, $overrides );
     83    $results = media_handle_sideload( $file, $post->$id, NULL, array( 'test_size' => false ) );
    8684//  $results = media_handle_sideload( $file, $overrides );
    8785  }
Note: See TracChangeset for help on using the changeset viewer.