WordPress.org
Get WordPress

Plugin Directory

Changeset 3072085


Ignore:
Timestamp:
04/17/2024 06:12:11 AM (2 years ago)
Author:
atomchat
Message:

Added secret key check in the permission callback function

File:
1 edited

Legend:

Unmodified
Added
Removed

  • atomchat/tags/1.1.5/atomchat.php

    r3055042 r3072085  
    201201if( !function_exists( 'atomchatDeductPointsCallback' ) ) {
    202202    function atomchatDeductPointsCallback() {
    203         $auth_key = get_option('atomchat_auth_key');
    204         $data = json_decode(file_get_contents('php://input'));
    205         $server_secret = $data->secretkey;
    206         $randomString = $data->randomString;
    207         $client_secret = md5($auth_key.$randomString."dcomdemaetand");
    208         if($client_secret == $server_secret){
    209             include_once(dirname(__FILE__).DIRECTORY_SEPARATOR.'plugins'.DIRECTORY_SEPARATOR.'mycred'.DIRECTORY_SEPARATOR.'credits.php');
    210         }else{
    211             wp_send_json_error(array(
    212                'code' => 'NOT_AUTHORIZED',
    213                'message' => 'You are not authorized'
    214            ), 401);
    215         }   
     203        include_once(dirname(__FILE__).DIRECTORY_SEPARATOR.'plugins'.DIRECTORY_SEPARATOR.'mycred'.DIRECTORY_SEPARATOR.'credits.php');
    216204    }
    217205}
    … …  
    239227    $data = json_decode(file_get_contents('php://input'));
    240228    $user_id = $data->UID;
     229    $server_secret = $data->secretkey;
     230    $randomString = $data->randomString;
     231    $auth_key = get_option('atomchat_auth_key');
     232    $client_secret = md5($auth_key.$randomString."dcomdemaetand");
    241233    if( $user_id ){
    242234        $user = get_user_by( 'id', $user_id );
    243         if( $user && user_can($user, 'manage_credit_balance')){
     235        if( $user && user_can($user, 'manage_credit_balance') && ($server_secret == $client_secret)){
    244236            return true;
    245237        }
Note: See TracChangeset for help on using the changeset viewer.