WordPress.org
Get WordPress

Plugin Directory

Changeset 3444816


Ignore:
Timestamp:
01/22/2026 12:20:42 PM (2 months ago)
Author:
wpmessiah
Message:

Fix BAC security vulnerabilities and upgrade version to 1.4.0

Location:
top-table-of-contents
Files:
532 added
5 edited

Legend:

Unmodified
Added
Removed

  • top-table-of-contents/trunk/README.txt

    r3389656 r3444816  
    33Tags: table-of-contents, toc , navigation, seo, indexes
    44Requires at least: 5.0
    5 Tested up to: 6.8
    6 Stable tag: 1.3.31
     5Tested up to: 6.9
     6Stable tag: 1.4.0
    77Requires PHP: 7.0
    88License: GPLv2 or later
    … …  
    318318= 1.3.31 - 04 November 2025 =
    319319Fix: some minor issues
     320
     321= 1.4.0 - 22 January 2026 =
     322* Fix: Critical Broken Access Control (BAC) vulnerability in plugin installation AJAX handler.
     323* Fix: Broken Access Control (BAC) vulnerability in skin import AJAX handler.
     324* Security: Removed unauthenticated access and added capability checks to administrative AJAX actions.
     325* Compatibility: Enhanced compatibility with WordPress 6.9.

  • top-table-of-contents/trunk/admin/class-boomdevs-toc-admin.php

    r3300436 r3444816  
    5353        $this->version     = $version;
    5454        add_action('wp_ajax_Boomdevs_Toc_custom_plugin_install', [$this, 'Boomdevs_Toc_custom_plugin_install']);
    55         add_action( 'wp_ajax_nopriv_Boomdevs_Toc_custom_plugin_install', [$this, 'Boomdevs_Toc_custom_plugin_install'] );
    5655
    5756    }
    … …  
    159158    public function Boomdevs_Toc_custom_plugin_install() {
    160159
     160        if ( ! current_user_can( 'install_plugins' ) ) {
     161            wp_send_json_error( array( 'message' => __( 'You do not have permission to install plugins.', 'boomdevs-toc' ) ), 403 );
     162        }
     163
    161164        check_ajax_referer('Boomdevs_Toc_custom_plugin_install_nonce', 'security');
    162165   

  • top-table-of-contents/trunk/boomdevs-toc.php

    r3389656 r3444816  
    1717 * Plugin URI:        https://wpmessiah.com/products/wordpress-table-of-contents/
    1818 * Description:       Easily creates an SEO-friendly table of contents for your blog posts and pages. Offers both Auto and Manual Insert with highly customization options.
    19  * Version:           1.3.31
     19 * Version:           1.4.0
    2020 * Author:            WP Messiah
    2121 * Author URI:        https://wpmessiah.com/
    … …  
    3535 * Plugin basic information.
    3636 */
    37 define( 'BOOMDEVS_TOC_VERSION', '1.3.31' );
     37define( 'BOOMDEVS_TOC_VERSION', '1.4.0' );
    3838define( 'BOOMDEVS_TOC_PATH', plugin_dir_path( __FILE__ ) );
    3939define( 'BOOMDEVS_TOC_URL', plugin_dir_url( __FILE__ ) );

  • top-table-of-contents/trunk/includes/class-boomdevs-toc-ajax.php

    r3300436 r3444816  
    1616    public function get_premade_layout() {
    1717       
     18        if ( ! current_user_can( 'manage_options' ) ) {
     19            wp_send_json_error( array( 'message' => __( 'You do not have permission to perform this action.', 'boomdevs-toc' ) ), 403 );
     20        }
     21
    1822        check_ajax_referer( 'layout_content', 'nonce' );
    1923

  • top-table-of-contents/trunk/includes/class-boomdevs-toc.php

    r3389656 r3444816  
    8080            $this->version = BOOMDEVS_TOC_VERSION;
    8181        } else {
    82             $this->version = '1.3.31';
     82            $this->version = '1.4.0';
    8383        }
    8484       
    … …  
    255255
    256256        $plugin_ajax = new Boomdevs_Toc_Ajax();
    257         $this->loader->add_action('wp_ajax_nopriv_get_premade_layout', $plugin_ajax, 'get_premade_layout');
    258257        $this->loader->add_action('wp_ajax_get_premade_layout', $plugin_ajax, 'get_premade_layout');
    259258    }
Note: See TracChangeset for help on using the changeset viewer.