WordPress.org
Get WordPress

Plugin Directory

Changeset 3162315


Ignore:
Timestamp:
10/03/2024 05:51:00 PM (18 months ago)
Author:
NicolasKulka
Message:

Fix vulnerabilty

Location:
wpdash-notes
Files:
59 added
4 edited

Legend:

Unmodified
Added
Removed

  • wpdash-notes/trunk/assets/js/checklist_in_post_frontend.js

    r2422139 r3162315  
    106106                    var params = {};
    107107                    params.post_id = response.post_id;
     108                    params._wpnonce = response.nonce;
    108109                    wp.ajax.post('postitlistcomment', params).done(function (response) {
    109110                        var parent = $('#wpf-post-it-' + response.post_id);

  • wpdash-notes/trunk/classes/plugin.php

    r3100718 r3162315  
    2525    }
    2626
    27     public static function admin_notices() {
    28         $screen = get_current_screen();
    29         if ( $screen && 'edit-wpf_post_it' === $screen->id ) {
    30             include( WPDASH_NOTES_DIR . '/blocks/pub_wpboutik.php' );
    31         }
    32     }
     27    public static function admin_notices() {
     28        $screen = get_current_screen();
     29        if ( $screen && 'edit-wpf_post_it' === $screen->id ) {
     30            include( WPDASH_NOTES_DIR . '/blocks/pub_wpboutik.php' );
     31        }
     32    }
    3333
    3434    public static function install() {
    … …  
    205205        wp_insert_comment( $data );
    206206
    207         wp_send_json_success( [ 'post_id' => $postid ] );
     207        wp_send_json_success( [ 'post_id' => $postid, 'nonce' => wp_create_nonce( 'nonce_list_comment' ) ] );
    208208    }
    209209
    210210    public static function wp_ajax_post_it_list_comment() {
     211        check_ajax_referer( 'nonce_list_comment' );
     212
    211213        $post_id = isset( $_POST['post_id'] ) ? sanitize_text_field( $_POST['post_id'] ) : '';
    212214
    213         $comments = get_comments(
    214             array(
    215                 'post_id' => $post_id,
    216                 'order'   => 'ASC'
    217             )
    218         );
    219 
    220         $html = '';
    221 
    222         if ( ! empty ( $comments ) ) {
    223             $texthtml = ( count( $comments ) > 1 ) ? __( 'Comments :', 'wpdash-notes' ) : __( 'Comment :', 'wpdash-notes' );
    224             $html     .= $texthtml . '<br>';
    225             foreach ( $comments as $comment ) {
    226                 $html .= '<b>' . $comment->comment_author . '</b> : ' . $comment->comment_content . '<br>';
     215        if ( $post_id ) {
     216            $post = get_post( $post_id );
     217            if ( 'wpf_post_it' === $post->post_type ) {
     218                $comments = get_comments(
     219                    array(
     220                        'post_id' => $post_id,
     221                        'order'   => 'ASC'
     222                    )
     223                );
     224
     225                $html = '';
     226
     227                if ( ! empty ( $comments ) ) {
     228                    $texthtml = ( count( $comments ) > 1 ) ? __( 'Comments :', 'wpdash-notes' ) : __( 'Comment :', 'wpdash-notes' );
     229                    $html     .= $texthtml . '<br>';
     230                    foreach ( $comments as $comment ) {
     231                        $html .= '<b>' . $comment->comment_author . '</b> : ' . $comment->comment_content . '<br>';
     232                    }
     233                }
     234
     235                wp_send_json_success( array( 'html' => $html, 'post_id' => $post_id ) );
    227236            }
    228237        }
    229 
    230         wp_send_json_success( array( 'html' => $html, 'post_id' => $post_id ) );
    231238    }
    232239

  • wpdash-notes/trunk/readme.txt

    r3100718 r3162315  
    44Requires at least: 4.2
    55Tested up to: 6.5
    6 Stable tag: 1.3.4.1
     6Stable tag: 1.3.5
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    7272== Changelog ==
    7373
     74= 1.3.5 =
     75* Fix Vulenrability : Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (Thanks Wordfence)
     76
    7477= 1.3.4.1 =
    7578* Fix screen admin notices

  • wpdash-notes/trunk/wpdash-notes.php

    r3100718 r3162315  
    33Plugin Name: WPDash Notes
    44Description: WPDash Notes est un plugin qui vous permet de créer des notes sur votre tableau de bord WordPress et sur ceux des autres utilisateurs.
    5 Version: 1.3.4.1
     5Version: 1.3.5
    66Author: WPFormation, NicolasKulka, WPServeur
    77Author URI: https://wpformation.com/
    … …  
    1818
    1919// Plugin constants
    20 define( 'WPDASH_NOTES_VERSION', '1.3.4.1' );
     20define( 'WPDASH_NOTES_VERSION', '1.3.5' );
    2121define( 'WPDASH_NOTES_FOLDER', 'wpdash-notes' );
    2222define( 'WPDASH_NOTES_BASENAME', plugin_basename( __FILE__ ) );
Note: See TracChangeset for help on using the changeset viewer.