WordPress.org
Get WordPress

Plugin Directory

Changeset 3453549


Ignore:
Timestamp:
02/04/2026 07:02:18 AM (7 weeks ago)
Author:
teamzt
Message:

Fixed CSRF vulnerability, improved security checks, and updated coding standards.

Location:
zt-captcha
Files:
27 added
6 edited

Legend:

Unmodified
Added
Removed

  • zt-captcha/trunk/captcha_settings.php

    r2959830 r3453549  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) {
     3    exit;
     4}
     5
    26function ztcpt_captcha_settings(){
    37   echo '<br>';

  • zt-captcha/trunk/inc/Zt_Captcha.php

    r2959830 r3453549  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) {
     3    exit;
     4}
     5
    26if(!class_exists('ZTCPT_Captcha') ):
    37class ZTCPT_Captcha

  • zt-captcha/trunk/inc/template.php

    r2856982 r3453549  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) {
     3    exit;
     4}
     5
    26function ztcpt_captcha_image_template($place){
    37    wp_enqueue_script("ztcpt_captcha_app_js",array('jquery') , '1.0', true);

  • zt-captcha/trunk/readme.txt

    r3213802 r3453549  
    33Requires at least: 4.4
    44Contributors: teamzt
    5 Tested up to: 6.7.1
    6 Stable tag: 1.0.4
     5Tested up to: 6.9
     6Stable tag: 1.0.5
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    99Requires PHP: 7.1
    10 Last Update: 2023-08-29
    1110
    1211The captcha plugin keeps WordPress sites safe from spam and password hacks by requiring a simple test to prove you're human, not a computer.
    … …  
    8180 First Release
    8281
    83  = 1.0.1 =
     82= 1.0.1 =
    8483
    8584*  New: Added Captcha for woocommerce lost password form.
    8685*  Update: All functionality was updated for WordPress 6.3.
    8786
    88  = 1.0.2 =
     87= 1.0.2 =
    8988
    9089*   Addressed comment form redirect issue, when captcha not verified, ensuring error messages are presented within the same page for a smoother user flow.
    … …  
    9291*  Update: All functionality was updated for WordPress 6.4.2
    9392
    94  = 1.0.3 =
     93= 1.0.3 =
    9594
    9695*  Update: All functionality was updated for WordPress 6.5.2
    9796
    98  = 1.0.4 =
     97= 1.0.4 =
    9998
    10099*  Update: All functionality was updated for WordPress 6.5.4
     100
     101= 1.0.5 =
     102
     103* Security: Fixed Cross-Site Request Forgery (CSRF) vulnerability in settings save action.
     104* Security: Added strict nonce verification and user capability checks.
     105* Compatibility: Tested with the latest WordPress version.

  • zt-captcha/trunk/request/CaptchaRequest.php

    r2856982 r3453549  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) {
     3    exit;
     4}
    25
    36if(!class_exists('ZTCPT_CaptchaRequest') ):
    … …  
    3538        function save_ztcpt_captcha_settings(){
    3639        /*Validate the the request*/
    37             if($_POST['token']){
    38                 $token = sanitize_text_field($_POST['token']);
    39                 if ( ! isset($token) || ! wp_verify_nonce($token, 'save_ztcpt_captcha_settings' ) ){
    40                     echo  esc_html_e( __( 'Sorry, your nonce did not verify.', ZTCPT_TEXT_DOMAIN ) );
    41                     die;
    42                 }
     40
     41            if (
     42                ! isset( $_POST['token'] ) ||
     43                ! wp_verify_nonce( $_POST['token'], 'save_ztcpt_captcha_settings' )
     44            ) {
     45                wp_die(
     46                    esc_html__( 'Sorry, your nonce did not verify.', ZTCPT_TEXT_DOMAIN ),
     47                    403
     48                );
    4349            }
    4450           
    45             if($_POST['zt_captcha_selected_captcha']){
     51            if ( ! current_user_can( 'manage_options' ) ) {
     52                wp_die(
     53                    esc_html__( 'Unauthorized request.', ZTCPT_TEXT_DOMAIN ),
     54                    403
     55                );
     56            }
     57
     58            if(isset($_POST['zt_captcha_selected_captcha'])){
    4659                $zt_captcha_selected_captcha = sanitize_text_field($_POST['zt_captcha_selected_captcha']);
    47                 update_option(sanitize_key('zt_captcha_selected_captcha'),sanitize_text_field($zt_captcha_selected_captcha));
     60                update_option(sanitize_key('zt_captcha_selected_captcha'),$zt_captcha_selected_captcha);
    4861            }
    4962
    … …  
    5669            $this->ztcpt_save_mathematics_captcha_setting();
    5770            $this->ztcpt_save_image_captcha_setting();
    58             wp_redirect(admin_url('/admin.php?page=ztcpt_captcha_settings&success=1'));
     71            wp_safe_redirect(admin_url( 'admin.php?page=ztcpt_captcha_settings&success=1' ));
     72            exit;
    5973        }
    6074       

  • zt-captcha/trunk/zt-captcha.php

    r3101696 r3453549  
    11<?php
    22/*
    3 Plugin Name: ZT Captcha
    4 Description: The simple captcha plugin was developed to keep the WordPress website safe. Captcha helps protect you from spam and password decryption by asking you to complete a simple test that proves you are human and not a computer trying to break into a password-protected account.
    5 Version: 1.0.4
    6 Author: Webcresty
    7 Author URI: https://www.webcresty.com/
    8 Text Domain: zt-captcha
     3* Plugin Name: ZT Captcha
     4* Description: The simple captcha plugin was developed to keep the WordPress website safe. Captcha helps protect you from spam and password decryption by asking you to complete a simple test that proves you are human and not a computer trying to break into a password-protected account.
     5* Version: 1.0.5
     6* Author: Webcresty
     7* Author URI: https://www.webcresty.com/
     8* License: GPLv2 or later
     9* License URI: https://www.gnu.org/licenses/gpl-2.0.html
     10* Text Domain: zt-captcha
    911*/
    1012
    … …  
    1214define('ZTCPT_CAPTCHA_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
    1315define('ZTCPT_CAPTCHA_URL_DIR',plugin_dir_url( __FILE__ ) );
    14 define('ZTCPT_CAPTCHA_VERSION','1.0.2');
     16define('ZTCPT_CAPTCHA_VERSION','1.0.5');
    1517define('ZTCPT_VALIDATE_REQ','a_c_validate');
    1618define('ZTCPT_SESSION_STORAGE','a_security_code');
Note: See TracChangeset for help on using the changeset viewer.