Changeset 2969456

Timestamp:

09/20/2023 09:33:45 PM (3 years ago)

Author:

checkfront

Message:

Fix CSRF vulnerability

Location:

checkfront-wp-booking/trunk

Files:

• checkfront.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• setup.php (modified) (2 diffs)

checkfront-wp-booking/trunk/checkfront.php

@@ -5 +5 @@
 Plugin URI: https://www.checkfront.com/wordpress
 Description: Connects Wordpress to the Checkfront Online Booking System.  Checkfront allows Tour, Activity, Accommodation, and Rental businesses to manage their availability, track inventories, centralize reservations, and process online payments. This plugin connects your WordPress site to your Checkfront account, and provides a powerful real-time booking interface – right within your existing website.
-Version: 3.6
+Version: 3.7
 Author: Checkfront Inc.
 Author URI: https://www.checkfront.com/
-Copyright: 2008 - 2022 Checkfront Inc
+Copyright: 2008 - 2023 Checkfront Inc
 */
 

checkfront-wp-booking/trunk/readme.txt

@@ -2 +2 @@
 
 Contributors: checkfront
-Stable tag: 3.6
+Stable tag: 3.7
 Tags: Booking, Booking System, Reservation, Reservation System, Online Booking, Booking Engine, Tours, Tour Operator, Booking Plugin, Reservation Plugin, Booking Software, Reservation Payment System, Activity Booking, Rental Booking, Reservation Payments, Tour Booking, Passbook, Availability, Payments, Bookings
 Requires at least: 2.0
 License: GPLv2 or later
-Tested up to: 6.1
+Tested up to: 6.3.1
 
 The Premier Wordpress Plugin for Easy Online Booking of Tours, Activities, Rentals & Accommodations.
@@ -73 +73 @@
 ### Changelog
 
+* *September 19th 2023:*
+  * Fixed CSRF vulnerability
 * *November 2nd 2022:*
   * Wordpress 6.1 compatibility

checkfront-wp-booking/trunk/setup.php

@@ -1 +1 @@
 <?php
-if (!empty($_POST['checkfront_host'])) {
+if (!empty($_POST['checkfront_host']) && !empty($_POST['_wpnonce'])) {
+    //prevent CSRF attacks
+    if (!wp_verify_nonce($_POST['_wpnonce'], 'update_checkfront_host')) {
+        exit;
+    }
+
     if ($host = $Checkfront->valid_host($_POST['checkfront_host'])) {
         update_option('checkfront_host', trim($host));
@@ -37 +42 @@
     <br style="clear: both" />
     <form method="post" action="">
+        <?php wp_nonce_field('update_checkfront_host'); ?>
         <div class="metabox-holder meta-box-sortables pointer">
             <div class="postbox">