WordPress.org
Get WordPress

Plugin Directory

Changeset 3371428


Ignore:
Timestamp:
10/01/2025 09:49:59 PM (6 months ago)
Author:
originalityai
Message:

Add security checks

Location:
originality-ai/trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • originality-ai/trunk/OriginalityAI.php

    r3370051 r3371428  
    562562        check_ajax_referer('originalityai_delete_scan_nonce', 'nonce');
    563563
     564        // Check user permissions.
     565        if (! current_user_can('manage_options')) {
     566            wp_send_json_error(['message' => esc_html__('You do not have permission to perform this action.', 'originality-ai')], 403);
     567        }
     568
    564569        // Validate and sanitize scan ID.
    565570        $scan_id = isset($_POST['id']) ? intval($_POST['id']) : 0;
    … …  
    577582        if (! $scan_entry) {
    578583            wp_send_json_error(['message' => esc_html__('Scan result not found.', 'originality-ai')], 404);
     584        }
     585
     586        // Additional check: verify user can edit the post associated with this scan
     587        if (isset($scan_entry['post_id']) && ! current_user_can('edit_post', $scan_entry['post_id'])) {
     588            wp_send_json_error(['message' => esc_html__('You do not have permission to delete this scan result.', 'originality-ai')], 403);
    579589        }
    580590

  • originality-ai/trunk/OriginalityAIAdminUI.php

    r3370051 r3371428  
    780780        check_ajax_referer('bulk_scan_nonce', 'bulk_scan_nonce');
    781781
    782         // Check if the user has the capability to manage options.
    783         if (! current_user_can('manage_options')) {
     782        // Check if the user has the capability to edit posts.
     783        if (! current_user_can('edit_posts')) {
    784784            wp_send_json_error(['message' => 'You do not have sufficient permissions to access this page.']);
    785785        }
    … …  
    11031103    public static function ai_get_table_data()
    11041104    {
     1105        // Check if user is logged in.
     1106        if (! is_user_logged_in()) {
     1107            wp_send_json_error(['message' => 'Authentication required.'], 401);
     1108        }
     1109
     1110        // Check user permissions - only users who can edit posts can view scan data.
     1111        if (! current_user_can('edit_posts')) {
     1112            wp_send_json_error(['message' => 'You do not have sufficient permissions.']);
     1113        }
     1114
    11051115        $table_data = OriginalityAILogger::ai_get_table();
    11061116        wp_send_json($table_data);

  • originality-ai/trunk/originality-ai.php

    r3370051 r3371428  
    55 * Plugin URI: https://originality.ai/wordpress-plugin
    66 * Description: Publish your content with integrity using Originality.ai - accurate AI Checker plugin!
    7  * Version: 1.0.13
     7 * Version: 1.0.14
    88 * Author: Originality.ai
    99 * Author URI: https://originality.ai/
    1010 * Text Domain: originality-ai
    11  * Stable tag: 1.0.13
     11 * Stable tag: 1.0.14
    1212 * License: GPLv2 or later
    1313
    … …  
    2323 * Globals constants.
    2424 */
    25 define('ORIGINALITYAI_PLUGIN_VERSION', '1.0.13');
     25define('ORIGINALITYAI_PLUGIN_VERSION', '1.0.14');
    2626define('ORIGINALITYAI_ROOT_PATH', plugin_dir_path(__FILE__));
    2727define('ORIGINALITYAI_ROOT_URL', plugin_dir_url(__FILE__));

  • originality-ai/trunk/readme.txt

    r3370053 r3371428  
    44Requires at least: 6.1
    55Tested up to: 6.8
    6 version: 1.0.13
    7 Stable tag: 1.0.13
     6version: 1.0.14
     7Stable tag: 1.0.14
    88Requires PHP: 7.4
    99Languages: English, Spanish, French, German, Portuguese, Italian, Russian, Chinese (Mandarin), Japanese, Turkish, Dutch, Greek, Polish, Vietnamese, Persian
Note: See TracChangeset for help on using the changeset viewer.