WordPress.org
Get WordPress

Plugin Directory

Changeset 3077508


Ignore:
Timestamp:
04/26/2024 09:56:57 AM (2 years ago)
Author:
kohashi
Message:

Update 2.0.1 Patched CVE-2023-49844

Location:
wpperformancetester/trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • wpperformancetester/trunk/README.md

    r2665429 r3077508  
    4444Changelog
    4545-------------
     46** 2.0.1 **
     47
     48(April 23, 2024) Minor security update.
     49
     50Patched CVE-2023-49844. This vulnerability allowed a CSRF which could have let an attacker make an admin to run benchmark unknowingly.
     51
    4652** 2.0.0 **
    4753

  • wpperformancetester/trunk/WPPerformanceTester_Plugin.php

    r2665429 r3077508  
    1515        $performTest = false;
    1616        if ( !empty( $_POST['performTest'] ) && ( $_POST['performTest'] == true ) ) {
    17             $performTest=true;
     17            //verify nonce
     18            if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST[ '_wpnonce' ] ) ) ) ) {
     19                wp_die( 'Invalid Request. Reload to try again.' );
     20            }else{
     21                $performTest=true;
     22            }
    1823        }
    1924        ?>
    … …  
    2429            <form method="post" action="<?php echo esc_url( admin_url('tools.php?page=WPPerformanceTester_PluginSettings') ); ?>">
    2530                <input type="hidden" name="performTest" value="true">
     31                <?php wp_nonce_field(); ?>
    2632                <input type="submit" value="Begin Performance Test" onclick="this.value='This may take a minute...'">
    2733            </form>

  • wpperformancetester/trunk/readme.txt

    r2665429 r3077508  
    33Tags: performance, admin, benchmark
    44Requires at least: 3.5
    5 Tested up to: 5.9
    6 Stable tag: 2.0.0
     5Tested up to: 6.5.2
     6Stable tag: 2.0.1
    77License: GPLv3
    88License URI: http://www.gnu.org/licenses/gpl-3.0.html
    … …  
    3030
    3131== Changelog ==
     32
     33= 2.0.1 =
     34
     35(April 23, 2024) Minor security update.
     36
     37Patched CVE-2023-49844. This vulnerability allowed a CSRF which could have let an attacker make an admin to run benchmark unknowingly.
     38
    3239= 2.0.0 =
    3340
Note: See TracChangeset for help on using the changeset viewer.