WordPress.org
Get WordPress

Plugin Directory

Changeset 3436302


Ignore:
Timestamp:
01/09/2026 09:11:29 PM (3 months ago)
Author:
eemitch
Message:
  • Security Fix: Fixed broken access control vulnerability (CVE-2025-68591) in file management operations.

Added back-end capability checks to help prevent malicious back-end users from circumventing the Back-End Access setting.

Location:
simple-file-list
Files:
132 added
4 deleted
2 edited

Legend:

Unmodified
Added
Removed

  • simple-file-list/trunk/ee-simple-file-list.php

    r3427454 r3436302  
    99Description: A Basic File List Manager with File Uploader
    1010Author: Mitchell Bennis
    11 Version: 6.1.16
     11Version: 6.1.17
    1212Author URI: http://simplefilelist.com
    1313License: GPLv2 or later
    … …  
    2020// CONSTANTS
    2121define('eeSFL_BASE_DevMode', FALSE);
    22 define('eeSFL_BASE_Version', '6.1.16'); // Plugin version
     22define('eeSFL_BASE_Version', '6.1.17'); // Plugin version
    2323define('eeSFL_BASE_PluginName', 'Simple File List');
    2424define('eeSFL_BASE_PluginSlug', 'simple-file-list');
    … …  
    515515    $eeReferer = wp_get_referer();
    516516    if( strpos($eeReferer, '/wp-admin/') OR $eeSFL_BASE->eeListSettings['AllowFrontManage'] == 'YES') {
     517
     518        // Verify user has proper capabilities for file management
     519        // Back-end requests must respect the AdminRole setting
     520        if( strpos($eeReferer, '/wp-admin/') ) {
     521            // Map AdminRole to capability (same as admin menu access control)
     522            $eeRequiredCapability = 'activate_plugins'; // Default to admin
     523            if(isset($eeSFL_BASE->eeListSettings['AdminRole'])) {
     524                switch ($eeSFL_BASE->eeListSettings['AdminRole']) {
     525                    case 1:
     526                        $eeRequiredCapability = 'read'; // Subscriber
     527                        break;
     528                    case 2:
     529                        $eeRequiredCapability = 'edit_posts'; // Contributor
     530                        break;
     531                    case 3:
     532                        $eeRequiredCapability = 'publish_posts'; // Author
     533                        break;
     534                    case 4:
     535                        $eeRequiredCapability = 'edit_others_pages'; // Editor
     536                        break;
     537                    case 5:
     538                        $eeRequiredCapability = 'activate_plugins'; // Admin
     539                        break;
     540                }
     541            }
     542            if( !current_user_can($eeRequiredCapability) ) {
     543                return 'ERROR 97'; // Insufficient permissions
     544            }
     545        }
     546        // Front-end management: AllowFrontManage == 'YES' allows editing without additional capability check
     547        // (The setting itself controls access)
    517548
    518549        // The Action

  • simple-file-list/trunk/readme.txt

    r3427454 r3436302  
    66Requires PHP: 7.4
    77Tested up to: 6.9
    8 Stable tag: 6.1.16
     8Stable tag: 6.1.17
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    236236
    237237== Changelog ==
     238
     239= 6.1.17 =
     240* Security Fix: Fixed broken access control vulnerability (CVE-2025-68591) in file management operations.
     241** Added back-end capability checks to help prevent malicious back-end users from circumventing the Back-End Access setting.
    238242
    239243= 6.1.16 =
Note: See TracChangeset for help on using the changeset viewer.