WordPress.org
Get WordPress

Plugin Directory

Changeset 3426272


Ignore:
Timestamp:
12/23/2025 02:35:01 PM (3 months ago)
Author:
NicolasKulka
Message:

Fix vulnerability (Thanks Legion Hunter - Patchstack) : Subscriber level user can inject any option field for option name "wps_display" via AJAX.

Location:
wps-bidouille
Files:
112 added
5 edited

Legend:

Unmodified
Added
Removed

  • wps-bidouille/trunk/admin_page/plugin.php

    r3099121 r3426272  
    55} ?>
    66
    7 <div id="plugin-filter" class="wrap">
     7<div id="plugin-filter" class="wrap" data-nonce="<?php echo wp_create_nonce('wps_bidouille_display'); ?>">
    88    <?php
    99    include( WPS_BIDOUILLE_DIR . 'blocks/title.php' );

  • wps-bidouille/trunk/assets/js/functions.js

    r2360339 r3426272  
    147147        var h2 = $(this).parent().find('h2');
    148148        var option_name = $(this).parent().attr('id');
     149        var nonce = $(this).parent().parent().parent().data('nonce');
    149150        if (elem.hasClass('wps-hide')) {
    150151            elem.removeClass('wps-hide').addClass('wps-view');
    … …  
    152153            data = {
    153154                'action': 'delete_option_wps_display',
     155                'wps-nonce': nonce,
    154156                'option_name': option_name
    155157            };
    … …  
    162164            data = {
    163165                'action': 'add_option_wps_display',
     166                'wps-nonce': nonce,
    164167                'option_name': option_name
    165168            };

  • wps-bidouille/trunk/classes/plugin.php

    r2659149 r3426272  
    214214            'jquery',
    215215            'select2'
    216         ), false, true );
     216        ), WPS_BIDOUILLE_VERSION, true );
    217217
    218218        wp_localize_script(
    … …  
    393393
    394394    public static function add_option_wps_display() {
     395        if ( ! isset( $_POST['wps-nonce'] ) || ! wp_verify_nonce( $_POST['wps-nonce'], 'wps_bidouille_display' ) ) {
     396            return false;
     397        }
     398
    395399        $option_name = sanitize_text_field( $_POST['option_name'] );
    396400        if ( is_multisite() ) {
    … …  
    411415
    412416    public static function delete_option_wps_display() {
     417        if ( ! isset( $_POST['wps-nonce'] ) || ! wp_verify_nonce( $_POST['wps-nonce'], 'wps_bidouille_display' ) ) {
     418            return false;
     419        }
     420
    413421        $option_name = sanitize_text_field( $_POST['option_name'] );
    414422        if ( is_multisite() ) {

  • wps-bidouille/trunk/readme.txt

    r3316782 r3426272  
    55Requires at least: 4.2
    66Tested up to: 6.8
    7 Stable tag: 1.33.1
     7Stable tag: 1.33.2
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    132132== Changelog ==
    133133
     134= 1.33.2 =
     135* Fix vulnerability (Thanks Legion Hunter - Patchstack) : Subscriber level user can inject any option field for option name "wps_display" via AJAX.
     136
    134137= 1.33.1 =
    135138* Tested up to 6.8

  • wps-bidouille/trunk/wps-bidouille.php

    r3316782 r3426272  
    66Author: WPServeur, NicolasKulka, Benoti, wpformation
    77Author URI: https://wpserveur.net
    8 Version: 1.33.1
     8Version: 1.33.2
    99Requires at least: 4.2
    1010Tested up to: 6.8
    … …  
    2121
    2222// Plugin constants
    23 define( 'WPS_BIDOUILLE_VERSION', '1.33.1' );
     23define( 'WPS_BIDOUILLE_VERSION', '1.33.2' );
    2424define( 'WPS_BIDOUILLE_FOLDER', 'wps-bidouille' );
    2525define( 'WPS_BIDOUILLE_BASENAME', plugin_basename( __FILE__ ) );
Note: See TracChangeset for help on using the changeset viewer.