WordPress.org
Get WordPress

Plugin Directory

Changeset 3142505


Ignore:
Timestamp:
08/27/2024 11:19:36 PM (19 months ago)
Author:
ignitionwp
Message:

Added more capability checks for security purposes.

Location:
ignitiondeck/trunk
Files:
13 edited

Legend:

Unmodified
Added
Removed

  • ignitiondeck/trunk/classes/class-idf-wizard.php

    r3134431 r3142505  
    9494        // Verify the nonce
    9595        check_ajax_referer('idf-activate-plugins-nonce', 'security');
     96
     97        // Check user capabilities.
     98        if ( ! current_user_can( 'manage_options' ) ) {
     99            wp_die( 'You don\'t have sufficient permissions to manage options.' );
     100        }
    96101
    97102        $list_id = '500a881df9';
    … …  
    161166        check_ajax_referer('idf-activate-plugins-nonce', 'security');
    162167
     168        // Check user capabilities.
     169        if ( ! current_user_can( 'install_plugins' ) ) {
     170            wp_die( 'You don\'t have sufficient permissions to install plugins.' );
     171        }
    163172        $plugin = array(
    164173            'name' => $_POST['name'],
    … …  
    279288        check_ajax_referer('idf-activate-plugins-nonce', 'security');
    280289
     290        // Check user capabilities.
     291        if ( ! current_user_can( 'manage_options' ) ) {
     292            wp_die( 'You don\'t have sufficient permissions to manage options.' );
     293        }
     294
    281295        $key = sanitize_text_field( $_POST['license'] );
    282296        idcf_license_update( $key );
    … …  
    297311        // Verify the nonce
    298312        check_ajax_referer('idf-activate-plugins-nonce', 'security');
     313
     314        // Check user capabilities.
     315        if ( ! current_user_can( 'manage_options' ) ) {
     316            wp_die( 'You don\'t have sufficient permissions to manage options.' );
     317        }
    299318
    300319        $save_payment = sanitize_text_field( $_POST['payment'] );
    … …  
    318337        // Verify the nonce
    319338        check_ajax_referer('idf-activate-plugins-nonce', 'security');
     339
     340        // Check user capabilities.
     341        if ( ! current_user_can( 'install_themes' ) ) {
     342            wp_die( 'You don\'t have sufficient permissions to install themes.' );
     343        }
    320344
    321345        $status = __( 'Installed' );
    … …  
    449473            update_option( 'wiz-configure', $config );
    450474        } else {
     475            // Check user capabilities.
     476            if ( ! current_user_can( 'publish_posts' ) ) {
     477                wp_die( 'You don\'t have sufficient permissions to access this feature.' );
     478            }
    451479            $my_post = array(
    452480                'post_type'    => 'page',
    … …  
    518546            update_option( 'wiz-configure', $config );
    519547        } else {
     548            // Check user capabilities.
     549            if ( ! current_user_can( 'publish_posts' ) ) {
     550                wp_die( 'You don\'t have sufficient permissions to access this feature.' );
     551            }
    520552            $my_post = array(
    521553                'post_type'    => 'page',
    … …  
    585617        check_ajax_referer('idf-activate-plugins-nonce', 'security');
    586618
     619        // Check user capabilities.
     620        if ( ! current_user_can( 'manage_options' ) ) {
     621            wp_die( 'You don\'t have sufficient permissions to manage options.' );
     622        }
     623
    587624        $return = array(
    588625            'success' => true,
    … …  
    693730        check_ajax_referer('idf-activate-plugins-nonce', 'security');
    694731
     732        // Check user capabilities.
     733        if ( ! current_user_can( 'manage_options' ) ) {
     734            wp_die( 'You don\'t have sufficient permissions to manage options.' );
     735        }
     736
    695737        $return = array(
    696738            'success' => true,
    … …  
    809851        // Verify the nonce
    810852        check_ajax_referer('idf-activate-plugins-nonce', 'security');
     853       
     854        // Check user capabilities.
     855        if ( ! current_user_can( 'manage_options' ) ) {
     856            wp_die( 'You don\'t have sufficient permissions to manage options.' );
     857        }
    811858       
    812859        $return = array(
    … …  
    906953            );
    907954        } else {
     955            // Check user capabilities.
     956            if ( ! current_user_can( 'publish_posts' ) ) {
     957                wp_die( 'You don\'t have sufficient permissions to access this feature.' );
     958            }
    908959            $post_id = wp_insert_post( $new_page );
    909960            update_post_meta( $post_id, '_wp_page_template', 'page-fullwidth.php' );
    … …  
    9921043            );
    9931044        } else {
     1045            // Check user capabilities.
     1046            if ( ! current_user_can( 'publish_posts' ) ) {
     1047                wp_die( 'You don\'t have sufficient permissions to access this feature.' );
     1048            }
    9941049            $post_id = wp_insert_post( $new_page );
    9951050            update_post_meta( $post_id, '_wp_page_template', 'page-fullwidth.php' );
    … …  
    10271082     */
    10281083    function create_sample_project() {
     1084        // Check user capabilities.
     1085        if ( ! current_user_can( 'publish_posts' ) ) {
     1086            wp_die( 'You don\'t have sufficient permissions to access this feature.' );
     1087        }
     1088
    10291089        // Create Sample ID Project
    10301090        $sample_project['post_title']  = 'Sample Project';
    … …  
    12241284    function delete_sample_project() {
    12251285        global $wpdb;
    1226 
     1286       
     1287        // Check user capabilities.
     1288        if ( ! current_user_can( 'delete_posts' ) ) {
     1289            wp_die( 'You don\'t have sufficient permissions to access this feature.' );
     1290        }
    12271291        $config          = get_option( 'wiz-configure' );
    12281292        $project_post_id = $config['sample'];
    … …  
    13171381}
    13181382new IDF_wizard();
    1319 

  • ignitiondeck/trunk/classes/class-tgm-plugin-activation.php

    r3134431 r3142505  
    640640            }
    641641
     642            // Check user capabilities.
     643            if ( ! current_user_can( 'manage_options' ) ) {
     644                wp_die( 'You don\'t have sufficient permissions to manage options.' );
     645            }
     646
    642647            if (isset($_GET['wp_id_nonce'])) {
    643648                check_admin_referer('wp_id_nonce', 'wp_id_nonce');
    … …  
    801806         */
    802807        protected function do_plugin_install() {
     808            // Check user capabilities.
     809            if ( ! current_user_can( 'install_plugins' ) ) {
     810                wp_die( 'You don\'t have sufficient permissions to install plugins.' );
     811            }
     812
    803813            if (isset($_GET['wp_id_nonce'])) {
    804814                check_admin_referer('wp_id_nonce', 'wp_id_nonce');
    … …  
    10541064         */
    10551065        protected function activate_single_plugin( $file_path, $slug, $automatic = false ) {
     1066            // Check user capabilities.
     1067            if ( ! current_user_can( 'activate_plugins' ) ) {
     1068                wp_die( 'You don\'t have sufficient permissions to access this feature.' );
     1069            }
     1070
    10561071            if (isset($_GET['wp_id_nonce'])) {
    10571072                check_admin_referer('wp_id_nonce', 'wp_id_nonce');
    … …  
    13591374         */
    13601375        public function dismiss() {
     1376            // Check if the user has the required capability
     1377            if (!current_user_can('edit_posts')) {
     1378                wp_die(esc_html__('You do not have sufficient permissions to perform this action.', 'memberdeck'));
     1379                exit;
     1380            }
    13611381            if ( isset( $_GET['tgmpa-dismiss'] ) && check_admin_referer( 'tgmpa-dismiss-' . get_current_user_id() ) ) {
    13621382                update_user_meta( get_current_user_id(), 'tgmpa_dismissed_notice_' . $this->id, 1 );
    … …  
    17491769
    17501770            if ( 'update-core' === $screen->base ) {
     1771                // Check user capabilities.
     1772                if ( ! current_user_can( 'manage_options' ) ) {
     1773                    wp_die( 'You don\'t have sufficient permissions to manage options.' );
     1774                }
    17511775                // Core update screen.
    17521776                if ( isset( $_POST['_wpnonce'] ) && ! wp_verify_nonce( $_POST['_wpnonce'], 'upgrade-core' ) ) {
    … …  
    17541778                }
    17551779                return true;
    1756             } elseif ( 'plugins' === $screen->base && ! empty( $_POST['action'] ) ) { // WPCS: CSRF ok.             
     1780            } elseif ( 'plugins' === $screen->base && ! empty( $_POST['action'] ) ) { // WPCS: CSRF ok.
     1781                // Check user capabilities.
     1782                if ( ! current_user_can( 'manage_options' ) ) {
     1783                    wp_die( 'You don\'t have sufficient permissions to manage options.' );
     1784                }           
    17571785                return true;
    1758             } elseif ( 'update' === $screen->base && ! empty( $_POST['action'] ) ) { // WPCS: CSRF ok.             
     1786            } elseif ( 'update' === $screen->base && ! empty( $_POST['action'] ) ) { // WPCS: CSRF ok.
     1787                // Check user capabilities.
     1788                if ( ! current_user_can( 'manage_options' ) ) {
     1789                    wp_die( 'You don\'t have sufficient permissions to manage options.' );
     1790                }               
    17591791                return true;
    17601792            }
    … …  
    22402272         */
    22412273        public function __construct() {
     2274            // Check if the user has the required capability
     2275            if (!current_user_can('edit_posts')) {
     2276                wp_die(esc_html__('You do not have sufficient permissions to perform this action.', 'memberdeck'));
     2277                exit;
     2278            }
     2279
    22422280            if (isset($_GET['wp_id_nonce'])) {
    22432281                check_admin_referer('wp_id_nonce', 'wp_id_nonce');
    … …  
    28562894         */
    28572895        public function process_bulk_actions() {
     2896            // Check if the user has the required capability
     2897            if (!current_user_can('manage_options')) {
     2898                wp_die(esc_html__('You do not have sufficient permissions to perform this action.', 'memberdeck'));
     2899                exit;
     2900            }
     2901
    28582902            // Bulk installation process.
    28592903            if ( 'tgmpa-bulk-install' === $this->current_action() || 'tgmpa-bulk-update' === $this->current_action() ) {

  • ignitiondeck/trunk/classes/modules/helix/helix-admin.php

    r3134431 r3142505  
    99
    1010function helix_menu() {
     11    // Check if the user has the required capability
     12    if (!current_user_can('manage_options')) {
     13        wp_die(esc_html__('You do not have sufficient permissions to perform this action.', 'memberdeck'));
     14        exit;
     15    }
     16   
    1117    $settings = get_option('helix_settings');   
    1218    if (isset($_POST['submit_helix_settings'])) {

  • ignitiondeck/trunk/classes/modules/helix/helix-idcom.php

    r3134431 r3142505  
    5151
    5252function helix_join_waitlist_ajax() {
     53    // Check if the user has the required capability
     54    if (!current_user_can('manage_options')) {
     55        wp_die(esc_html__('You do not have sufficient permissions to perform this action.', 'memberdeck'));
     56        exit;
     57    }
     58   
    5359    if (isset($_GET['wp_id_nonce'])) {
    5460        check_admin_referer('wp_id_nonce', 'wp_id_nonce');

  • ignitiondeck/trunk/classes/modules/maven/class-maven_msg.php

    r1614461 r3142505  
    2121
    2222    function save_message() {
     23        // Check user capabilities.
     24        if ( ! current_user_can( 'publish_posts' ) ) {
     25            wp_die( 'You don\'t have sufficient permissions to access this feature.' );
     26        }
     27       
    2328        $id = wp_insert_post($this->msg);
    2429        if (!is_wp_error($send)) {

  • ignitiondeck/trunk/classes/modules/recaptcha/class-recaptcha.php

    r3134431 r3142505  
    8181     */
    8282    function admin_menu() {     
     83        // Check if the user has the required capability
     84        if (!current_user_can('manage_options')) {
     85            wp_die(esc_html__('You do not have sufficient permissions to perform this action.', 'memberdeck'));
     86            exit;
     87        }
    8388        $settings = get_option('id_recaptcha_settings');
    8489        if (isset($_POST['submit_id_recaptcha_settings'])) {

  • ignitiondeck/trunk/idf-admin.php

    r3134431 r3142505  
    9191        return false;
    9292    }
     93    // Check user capabilities.
     94    if ( ! current_user_can( 'manage_options' ) ) {
     95        wp_die( 'You don\'t have sufficient permissions to manage options.' );
     96    }
    9397
    9498    $requirements = new IDF_Requirements;
    … …  
    494498        check_admin_referer('wp_id_nonce', 'wp_id_nonce');
    495499    }
     500
     501    // Check user capabilities.
     502    if ( ! current_user_can( 'manage_options' ) ) {
     503        wp_die( 'You don\'t have sufficient permissions to manage options.' );
     504    }
    496505   
    497506    // #devnote create a function for this

  • ignitiondeck/trunk/idf-cache.php

    r3134431 r3142505  
    5252 */
    5353function idf_flush_object_ajax() {
     54    // Check if the user has the required capability
     55    if (!current_user_can('manage_options')) {
     56        wp_send_json_error(__('You do not have sufficient permissions to perform this action.', 'memberdeck'));
     57        exit;
     58    }
     59
    5460    if (isset($_GET['wp_id_nonce'])) {
    5561        check_admin_referer('wp_id_nonce', 'wp_id_nonce');

  • ignitiondeck/trunk/idf-functions.php

    r3134431 r3142505  
    825825 */
    826826function idf_do_register() {
     827    // Check if the user has the required capability
     828    if (!current_user_can('manage_options')) {
     829        wp_send_json_error(__('You do not have sufficient permissions to perform this action.', 'memberdeck'));
     830        exit;
     831    }
     832   
    827833    if (isset($_GET['wp_id_nonce'])) {
    828834        check_admin_referer('wp_id_nonce', 'wp_id_nonce');

  • ignitiondeck/trunk/idf-stock-browser.php

    r3134431 r3142505  
    8585 */
    8686function idf_stock_item_click() {
     87    // Check if the user has the required capability
     88    if (!current_user_can('read')) {
     89        wp_send_json_error(__('You do not have sufficient permissions to perform this action.', 'memberdeck'));
     90        exit;
     91    }
    8792    if (isset($_GET['wp_id_nonce'])) {
    8893        check_admin_referer('wp_id_nonce', 'wp_id_nonce');

  • ignitiondeck/trunk/idf.php

    r3134431 r3142505  
    88URI: https://IgnitionDeck.com
    99Description: A crowdfunding and ecommerce plugin for WordPress that helps you crowdfund, pre-order, and sell goods online.
    10 Version: 1.10.0
     10Version: 1.10.1
    1111Author: IgnitionDeck
    1212Author URI: https://IgnitionDeck.com
    … …  
    1818require_once 'idf-globals.php';
    1919global $active_plugins, $idf_current_version;
    20 $idf_current_version = '1.10.0';
     20$idf_current_version = '1.10.1';
    2121require_once 'idf-update.php';
    2222require_once 'classes/class-idf_requirements.php';

  • ignitiondeck/trunk/languages_default/idf.pot

    r3134431 r3142505  
    33msgstr ""
    44"Project-Id-Version: IgnitionDeck Framework\n"
    5 "POT-Creation-Date: 2024-08-06 08:39-0800\n"
     5"POT-Creation-Date: 2024-08-27 13:44-0800\n"
    66"PO-Revision-Date: 2016-10-05 20:02-0400\n"
    77"Last-Translator: Ignition WP LLC <support@ignitionwp.com>\n"

  • ignitiondeck/trunk/readme.txt

    r3134431 r3142505  
    55Requires at least: 4.9
    66Tested up to: 6.6
    7 Stable tag: 1.10.0
     7Stable tag: 1.10.1
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    139139== Changelog ==
    140140
     141= 1.10.1 =
     142
     143* Added more capability checks for security purposes.
     144
    141145= 1.10.0 =
    142146
Note: See TracChangeset for help on using the changeset viewer.