WordPress.org
Get WordPress

Plugin Directory

Changeset 3494684


Ignore:
Timestamp:
03/30/2026 02:26:20 PM (2 days ago)
Author:
lwsdevelopers
Message:

Fix "Arbitrary Content Deletion in MyRewards" ticket ID: ad9d6479-7107-4663-994c-4a07b91e0d99.

Location:
woorewards/trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • woorewards/trunk/assets/lws-adminpanel/include/internal/pages.php

    r3463447 r3494684  
    482482                exit(0);
    483483
     484            $nonce = sanitize_text_field(wp_unslash($data['lws_adminpanel_triggerable_button_nonce'] ?? ''));
     485            if (!\wp_verify_nonce($nonce, 'lws_adminpanel_triggerable_button_nonce')) {
     486                \wp_send_json_error(__("Token expired. Please reload the page and retry.", 'lws-adminpanel'));
     487            }
     488
    484489            $response = $this->trigAjaxButton($this->pages, $button, $data);
    485490            if( !is_null($response) )
    … …  
    496501        foreach( $tree as $node )
    497502        {
     503            $rights = $node['rights'] ?? '';
     504            if ($rights && !\current_user_can($rights)) {
     505                continue;
     506            }
     507
    498508            if( is_array($node) )
    499509            {

  • woorewards/trunk/assets/lws-adminpanel/include/pages/field/button.php

    r3458815 r3494684  
    7777                $attrs['data-action'] = $submit;
    7878            }
     79
     80            $nonce = $this->getExtraValue('nonce', false);
     81            if ($nonce) {
     82                $attrs['data-adm-btn-nonce'] = \wp_create_nonce( $nonce );
     83            }
    7984        }
    8085        if ($this->getExtraValue('disabled', false))
    … …  
    101106        }
    102107
     108        if( $triggable ) {
     109            // security
     110            $out .= sprintf(
     111                '<input type="hidden" value="%s" name="lws_adminpanel_triggerable_button_nonce"/>',
     112                \esc_attr(\wp_create_nonce('lws_adminpanel_triggerable_button_nonce'))
     113            );
     114        }
     115
    103116        $attrs = $this->getDomAttributes($attrs);
    104117        $out .= "<div class='lws-adm-btn$class' id='{$this->m_Id}' type='button'{$attrs}>$text</div>";
    105         if( $triggable || $submit ) // answer zone
     118        if( $triggable || $submit ) {
     119            // answer zone
    106120            $out .= "<div class='lws-adm-btn-trigger-response'></div>";
     121        }
    107122
    108123        if( isset($this->extra['container']) )

  • woorewards/trunk/assets/lws-adminpanel/js/fields.js

    r3350120 r3494684  
    2020main.next(".lws-adm-btn-trigger-response").html(response.data);}else{alert(lws_adminpanel.triggerError)}}}).fail(function(d,textStatus,error){main.removeClass('disabled');main.find('.lws-loader').remove();main.replaceWith("<p class='lws-error'>Trigger error, status: "+textStatus+", error: "+error+"</p>").show()});return!1});$('body').on('click','.lws_adm_btn_group_submit',function(e){e.preventDefault();var main=$(this);if(main.hasClass('disabled'))return!1;main.addClass('disabled');if(!main.find('.lws-loader').length)
    2121main.append($("<div>",{'class':'lws-loader'}).append($("<div>",{'class':'animation'})));setTimeout(function(){main.removeClass('disabled');main.find('.lws-loader').remove()},5000);var form=$('<form>',{'method':main.data('method'),'action':'get'==main.data('method')?lws_ajax.url:main.data('action'),'style':'display: none;'});if('get'==main.data('method'))
    22 form.append($('<input>',{'name':'action','value':main.data('action')}));form.append($(this).closest('.lws-form-div').clone());form.appendTo('body').trigger('submit');setTimeout(function(){form.remove()},1000);return!1});$(document).on('click',function(e){if($(e.target).closest(".lwss-disable-on-clic-out").length==0){if($(e.target).closest(".lwss-hide-on-clic-out").length==0)
     22form.append($('<input>',{'name':'action','value':main.data('action')}));let n=main.data('adm-btn-nonce');if(n){form.append($('<input>',{'name':'lws_btn_nonce','value':n}))}
     23form.append($(this).closest('.lws-form-div').clone());form.appendTo('body').trigger('submit');setTimeout(function(){form.remove()},1000);return!1});$(document).on('click',function(e){if($(e.target).closest(".lwss-disable-on-clic-out").length==0){if($(e.target).closest(".lwss-hide-on-clic-out").length==0)
    2324$(".lwss-hide-on-clic-out").fadeOut();if($(e.target).closest(".lwss-fold-on-clic-out").length==0)
    2425$(".lwss-fold-on-clic-out").slideUp();}});$(document).on('keyup',function(e){if((e.keyCode||e.which||e.charCode||0)===27){$(".lwss-hide-on-clic-out").fadeOut();$(".lwss-fold-on-clic-out").slideUp()}});$('form').on('change',"input, textarea, select, .gizmo",function(event,internal){if(undefined!=internal&&'ignore'==internal)

  • woorewards/trunk/assets/lws-adminpanel/lws-adminpanel.php

    r3487131 r3494684  
    66 * Author: Long Watch Studio
    77 * Author URI: https://longwatchstudio.com
    8  * Version: 5.7.4
     8 * Version: 5.7.5
    99 * Text Domain: lws-adminpanel
    1010 *
    … …  
    5656
    5757add_filter('lws_adminpanel_versions', function($versions){
    58     $versions['5.7.4'] = __FILE__;
     58    $versions['5.7.5'] = __FILE__;
    5959    return $versions;
    6060});

  • woorewards/trunk/include/pointsflow/action.php

    r3463447 r3494684  
    209209    function exportWR()
    210210    {
     211        if (!\wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['lws_btn_nonce'] ?? '')), 'woorewards-lite' . '-export-wr')) {
     212            \wp_die('forbidden', 403);
     213        }
    211214        if( !\current_user_can('manage_options') )
    212215            \wp_die('forbidden', 403);
    … …  
    226229    function exportPoints()
    227230    {
     231        if (!\wp_verify_nonce(sanitize_text_field(wp_unslash($_REQUEST['lws_btn_nonce'] ?? '')), 'woorewards-lite' . '-export-points')) {
     232            \wp_die('forbidden', 403);
     233        }
    228234        if( !\current_user_can('manage_options') )
    229235            \wp_die('forbidden', 403);

  • woorewards/trunk/include/ui/adminscreens/pointsmanagement.php

    r3463447 r3494684  
    4141                        'extra' => array(
    4242                            'link' => array('ajax' => 'woorewards-lite' . '-export-wr'),
     43                            'nonce' => 'woorewards-lite' . '-export-wr',
    4344                        )
    4445                    ),
    … …  
    9091                        'extra' => array(
    9192                            'link' => array('ajax' => 'woorewards-lite' . '-export-points'),
     93                            'nonce' => 'woorewards-lite' . '-export-points',
    9294                        )
    9395                    ),

  • woorewards/trunk/readme.txt

    r3487131 r3494684  
    55Tested up to: 6.9
    66Requires PHP: 7.3.0
    7 Stable tag: 5.7.3.1
     7Stable tag: 5.7.4
    88License: GPLv2 or later
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    110110== Changelog ==
    111111
     112= 5.7.4 =
     113* Fix - Vulnerability ad9d6479-7107-4663-994c-4a07b91e0d99 — Arbitrary Content Deletion in MyRewards
     114
    112115= 5.7.3.1 =
    113116* Tag - WooCommerce 10.6

  • woorewards/trunk/woorewards.php

    r3487131 r3494684  
    77 * Author: Long Watch Studio
    88 * Author URI: https://longwatchstudio.com
    9  * Version: 5.7.3.1
     9 * Version: 5.7.4
    1010 * License: GPLv2 or later
    1111 * Text Domain: woorewards-lite
    … …  
    110110    private function defineConstants()
    111111    {
    112         define('LWS_WOOREWARDS_VERSION', '5.7.3.1');
     112        define('LWS_WOOREWARDS_VERSION', '5.7.4');
    113113        define('LWS_WOOREWARDS_FILE', __FILE__);
    114114        define('LWS_WOOREWARDS_DOMAIN', 'woorewards-lite');
    … …  
    148148    public function addPluginVersion($url)
    149149    {
    150         return '5.7.3.1';
     150        return '5.7.4';
    151151    }
    152152
Note: See TracChangeset for help on using the changeset viewer.