Changeset 3139815

Timestamp:

08/22/2024 02:18:07 PM (7 months ago)

Author:

delawski

Message:

Update to version 4.0.2 from GitHub

Location:

stream

Files:

• tags/4.0.2 (copied) (copied from stream/trunk)
• tags/4.0.2/classes/class-network.php (modified) (3 diffs)
• tags/4.0.2/classes/class-plugin.php (modified) (1 diff)
• tags/4.0.2/classes/class-settings.php (modified) (1 diff)
• tags/4.0.2/readme.txt (modified) (2 diffs)
• tags/4.0.2/stream.php (modified) (1 diff)
• tags/4.0.2/vendor/composer/installed.php (modified) (2 diffs)
• trunk/classes/class-network.php (modified) (3 diffs)
• trunk/classes/class-plugin.php (modified) (1 diff)
• trunk/classes/class-settings.php (modified) (1 diff)
• trunk/readme.txt (modified) (2 diffs)
• trunk/stream.php (modified) (1 diff)
• trunk/vendor/composer/installed.php (modified) (2 diffs)

stream/tags/4.0.2/classes/class-network.php

@@ -28 +28 @@
 
     /**
-     * Default setting page slug
+     * The option name for the network settings.
      *
      * @var string
      */
-    public $default_settings_page_slug = 'wp_stream_default_settings';
+    public $network_settings_option = 'wp_stream_network';
 
     /**
@@ -226 +226 @@
         $current_page = wp_stream_filter_input( INPUT_GET, 'page' );
 
-        switch ( $current_page ) {
-            case $this->network_settings_page_slug:
-                $description = __( 'These settings apply to all sites on the network.', 'stream' );
-                break;
-            case $this->default_settings_page_slug:
-                $description = __( 'These default settings will apply to new sites created on the network. These settings do not alter existing sites.', 'stream' );
-                break;
+        if ( $this->network_settings_page_slug === $current_page ) {
+            $description = __( 'These settings apply to all sites on the network.', 'stream' );
         }
 
@@ -352 +347 @@
      */
     public function network_options_action() {
-        $allowed_referrers = array(
-            $this->network_settings_page_slug,
-            $this->default_settings_page_slug,
-        );
-
-        // @codingStandardsIgnoreLine
-        if ( ! isset( $_GET['action'] ) || ! in_array( $_GET['action'], $allowed_referrers, true ) ) {
+
+        // Check the nonce.
+        if ( empty( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], sprintf( '%s-options', $this->network_settings_option ) ) ) {
             return;
         }
 
-        // @codingStandardsIgnoreLine
-        $options = isset( $_POST['option_page'] ) ? explode( ',', stripslashes( $_POST['option_page'] ) ) : null;
-
-        if ( $options ) {
-
-            foreach ( $options as $option ) {
-                $option   = trim( $option );
-                $value    = null;
-                $sections = $this->plugin->settings->get_fields();
-
-                foreach ( $sections as $section_name => $section ) {
-                    foreach ( $section['fields'] as $field_idx => $field ) {
-                        $option_key = $section_name . '_' . $field['name'];
-
-                        // @codingStandardsIgnoreStart
-                        if ( isset( $_POST[ $option ][ $option_key ] ) ) {
-                            $value[ $option_key ] = $_POST[ $option ][ $option_key ];
-                        } else {
-                            $value[ $option_key ] = false;
-                        }
-                        // @codingStandardsIgnoreEnd
+        // Check the user capability.
+        if ( ! current_user_can( $this->plugin->admin->settings_cap ) ) {
+            return;
+        }
+
+        // Check the action.
+        if ( ! isset( $_GET['action'] ) || $this->network_settings_page_slug !== $_GET['action'] ) {
+            return;
+        }
+
+        $option = ! empty( $_POST['option_page'] ) ? $_POST['option_page'] : false;
+
+        if ( $option && $this->network_settings_option === $option ) {
+
+            $value    = array();
+            $sections = $this->plugin->settings->get_fields();
+
+            foreach ( $sections as $section_name => $section ) {
+                foreach ( $section['fields'] as $field_idx => $field ) {
+                    $option_key = $section_name . '_' . $field['name'];
+
+                    if ( isset( $_POST[ $option ][ $option_key ] ) ) {
+                        $value[ $option_key ] = $this->plugin->settings->sanitize_setting_by_field_type( $_POST[ $option ][ $option_key ], $field['type'] );
+                    } else {
+                        $value[ $option_key ] = false;
                     }
                 }
-
-                if ( ! is_array( $value ) ) {
-                    $value = trim( $value );
-                }
-
-                update_site_option( $option, $value );
             }
+
+            update_site_option( $this->network_settings_option, $value );
         }
 

stream/tags/4.0.2/classes/class-plugin.php

@@ -19 +19 @@
      * @const string
      */
-    const VERSION = '4.0.1';
+    const VERSION = '4.0.2';
 
     /**

stream/tags/4.0.2/classes/class-settings.php

@@ -545 +545 @@
                 }
 
-                // Sanitize depending on the type of field.
-                switch ( $type ) {
-                    case 'number':
-                        $output[ $name ] = is_numeric( $input[ $name ] ) ? intval( trim( $input[ $name ] ) ) : '';
-                        break;
-                    case 'checkbox':
-                        $output[ $name ] = is_numeric( $input[ $name ] ) ? absint( trim( $input[ $name ] ) ) : '';
-                        break;
-                    default:
-                        if ( is_array( $input[ $name ] ) ) {
-                            $output[ $name ] = $input[ $name ];
-
-                            // Support all values in multidimentional arrays too.
-                            array_walk_recursive(
-                                $output[ $name ],
-                                function ( &$v ) {
-                                    $v = sanitize_text_field( trim( $v ) );
-                                }
-                            );
-                        } else {
-                            $output[ $name ] = sanitize_text_field( trim( $input[ $name ] ) );
+                $output[ $name ] = $this->sanitize_setting_by_field_type( $input[ $name ], $type );
+            }
+        }
+
+        return $output;
+    }
+
+    /**
+     * Sanitizes a setting value based on the field type.
+     *
+     * @param mixed  $value      The value to be sanitized.
+     * @param string $field_type The type of field.
+     *
+     * @return mixed The sanitized value.
+     */
+    public function sanitize_setting_by_field_type( $value, $field_type ) {
+
+        // Sanitize depending on the type of field.
+        switch ( $field_type ) {
+            case 'number':
+                $sanitized_value = is_numeric( $value ) ? intval( trim( $value ) ) : '';
+                break;
+            case 'checkbox':
+                $sanitized_value = is_numeric( $value ) ? absint( trim( $value ) ) : '';
+                break;
+            default:
+                if ( is_array( $value ) ) {
+                    $sanitized_value = $value;
+
+                    // Support all values in multidimentional arrays too.
+                    array_walk_recursive(
+                        $sanitized_value,
+                        function ( &$v ) {
+                            $v = sanitize_text_field( trim( $v ) );
                         }
-                }
-            }
-        }
-
-        return $output;
+                    );
+                } else {
+                    $sanitized_value = sanitize_text_field( trim( $value ) );
+                }
+        }
+
+        return $sanitized_value;
     }
 

stream/tags/4.0.2/readme.txt

@@ -4 +4 @@
 Requires at least: 4.6
 Tested up to: 6.6
-Stable tag: 4.0.1
+Stable tag: 4.0.2
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -135 +135 @@
 == Changelog ==
 
+= 4.0.2 - August 22, 2024 =
+
+**Security update**
+
+- Fix vulnerability which allowed logged in users to update some site options in certain configurations. Props to [@sybrew](https://github.com/sybrew) for responsibly disclosing this issue.
+
 = 4.0.1 - July 30, 2024 =
 

stream/tags/4.0.2/stream.php

@@ -4 +4 @@
  * Plugin URI: https://xwp.co/work/stream/
  * Description: Stream tracks logged-in user activity so you can monitor every change made on your WordPress site in beautifully organized detail. All activity is organized by context, action and IP address for easy filtering. Developers can extend Stream with custom connectors to log any kind of action.
- * Version: 4.0.1
+ * Version: 4.0.2
  * Author: XWP
  * Author URI: https://xwp.co

stream/tags/4.0.2/vendor/composer/installed.php

@@ -2 +2 @@
     'root' => array(
         'name' => 'xwp/stream',
-        'pretty_version' => 'v4.0.1',
-        'version' => '4.0.1.0',
-        'reference' => 'abc53ab8397dae1a70b883d7f5ecee019e595c03',
+        'pretty_version' => 'v4.0.2',
+        'version' => '4.0.2.0',
+        'reference' => 'e61210f3529a19ef235805d34e82f100282aec7a',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
@@ -33 +33 @@
         ),
         'xwp/stream' => array(
-            'pretty_version' => 'v4.0.1',
-            'version' => '4.0.1.0',
-            'reference' => 'abc53ab8397dae1a70b883d7f5ecee019e595c03',
+            'pretty_version' => 'v4.0.2',
+            'version' => '4.0.2.0',
+            'reference' => 'e61210f3529a19ef235805d34e82f100282aec7a',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',

stream/trunk/classes/class-network.php

@@ -28 +28 @@
 
     /**
-     * Default setting page slug
+     * The option name for the network settings.
      *
      * @var string
      */
-    public $default_settings_page_slug = 'wp_stream_default_settings';
+    public $network_settings_option = 'wp_stream_network';
 
     /**
@@ -226 +226 @@
         $current_page = wp_stream_filter_input( INPUT_GET, 'page' );
 
-        switch ( $current_page ) {
-            case $this->network_settings_page_slug:
-                $description = __( 'These settings apply to all sites on the network.', 'stream' );
-                break;
-            case $this->default_settings_page_slug:
-                $description = __( 'These default settings will apply to new sites created on the network. These settings do not alter existing sites.', 'stream' );
-                break;
+        if ( $this->network_settings_page_slug === $current_page ) {
+            $description = __( 'These settings apply to all sites on the network.', 'stream' );
         }
 
@@ -352 +347 @@
      */
     public function network_options_action() {
-        $allowed_referrers = array(
-            $this->network_settings_page_slug,
-            $this->default_settings_page_slug,
-        );
-
-        // @codingStandardsIgnoreLine
-        if ( ! isset( $_GET['action'] ) || ! in_array( $_GET['action'], $allowed_referrers, true ) ) {
+
+        // Check the nonce.
+        if ( empty( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], sprintf( '%s-options', $this->network_settings_option ) ) ) {
             return;
         }
 
-        // @codingStandardsIgnoreLine
-        $options = isset( $_POST['option_page'] ) ? explode( ',', stripslashes( $_POST['option_page'] ) ) : null;
-
-        if ( $options ) {
-
-            foreach ( $options as $option ) {
-                $option   = trim( $option );
-                $value    = null;
-                $sections = $this->plugin->settings->get_fields();
-
-                foreach ( $sections as $section_name => $section ) {
-                    foreach ( $section['fields'] as $field_idx => $field ) {
-                        $option_key = $section_name . '_' . $field['name'];
-
-                        // @codingStandardsIgnoreStart
-                        if ( isset( $_POST[ $option ][ $option_key ] ) ) {
-                            $value[ $option_key ] = $_POST[ $option ][ $option_key ];
-                        } else {
-                            $value[ $option_key ] = false;
-                        }
-                        // @codingStandardsIgnoreEnd
+        // Check the user capability.
+        if ( ! current_user_can( $this->plugin->admin->settings_cap ) ) {
+            return;
+        }
+
+        // Check the action.
+        if ( ! isset( $_GET['action'] ) || $this->network_settings_page_slug !== $_GET['action'] ) {
+            return;
+        }
+
+        $option = ! empty( $_POST['option_page'] ) ? $_POST['option_page'] : false;
+
+        if ( $option && $this->network_settings_option === $option ) {
+
+            $value    = array();
+            $sections = $this->plugin->settings->get_fields();
+
+            foreach ( $sections as $section_name => $section ) {
+                foreach ( $section['fields'] as $field_idx => $field ) {
+                    $option_key = $section_name . '_' . $field['name'];
+
+                    if ( isset( $_POST[ $option ][ $option_key ] ) ) {
+                        $value[ $option_key ] = $this->plugin->settings->sanitize_setting_by_field_type( $_POST[ $option ][ $option_key ], $field['type'] );
+                    } else {
+                        $value[ $option_key ] = false;
                     }
                 }
-
-                if ( ! is_array( $value ) ) {
-                    $value = trim( $value );
-                }
-
-                update_site_option( $option, $value );
             }
+
+            update_site_option( $this->network_settings_option, $value );
         }
 

stream/trunk/classes/class-plugin.php

@@ -19 +19 @@
      * @const string
      */
-    const VERSION = '4.0.1';
+    const VERSION = '4.0.2';
 
     /**

stream/trunk/classes/class-settings.php

@@ -545 +545 @@
                 }
 
-                // Sanitize depending on the type of field.
-                switch ( $type ) {
-                    case 'number':
-                        $output[ $name ] = is_numeric( $input[ $name ] ) ? intval( trim( $input[ $name ] ) ) : '';
-                        break;
-                    case 'checkbox':
-                        $output[ $name ] = is_numeric( $input[ $name ] ) ? absint( trim( $input[ $name ] ) ) : '';
-                        break;
-                    default:
-                        if ( is_array( $input[ $name ] ) ) {
-                            $output[ $name ] = $input[ $name ];
-
-                            // Support all values in multidimentional arrays too.
-                            array_walk_recursive(
-                                $output[ $name ],
-                                function ( &$v ) {
-                                    $v = sanitize_text_field( trim( $v ) );
-                                }
-                            );
-                        } else {
-                            $output[ $name ] = sanitize_text_field( trim( $input[ $name ] ) );
+                $output[ $name ] = $this->sanitize_setting_by_field_type( $input[ $name ], $type );
+            }
+        }
+
+        return $output;
+    }
+
+    /**
+     * Sanitizes a setting value based on the field type.
+     *
+     * @param mixed  $value      The value to be sanitized.
+     * @param string $field_type The type of field.
+     *
+     * @return mixed The sanitized value.
+     */
+    public function sanitize_setting_by_field_type( $value, $field_type ) {
+
+        // Sanitize depending on the type of field.
+        switch ( $field_type ) {
+            case 'number':
+                $sanitized_value = is_numeric( $value ) ? intval( trim( $value ) ) : '';
+                break;
+            case 'checkbox':
+                $sanitized_value = is_numeric( $value ) ? absint( trim( $value ) ) : '';
+                break;
+            default:
+                if ( is_array( $value ) ) {
+                    $sanitized_value = $value;
+
+                    // Support all values in multidimentional arrays too.
+                    array_walk_recursive(
+                        $sanitized_value,
+                        function ( &$v ) {
+                            $v = sanitize_text_field( trim( $v ) );
                         }
-                }
-            }
-        }
-
-        return $output;
+                    );
+                } else {
+                    $sanitized_value = sanitize_text_field( trim( $value ) );
+                }
+        }
+
+        return $sanitized_value;
     }
 

stream/trunk/readme.txt

@@ -4 +4 @@
 Requires at least: 4.6
 Tested up to: 6.6
-Stable tag: 4.0.1
+Stable tag: 4.0.2
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -135 +135 @@
 == Changelog ==
 
+= 4.0.2 - August 22, 2024 =
+
+**Security update**
+
+- Fix vulnerability which allowed logged in users to update some site options in certain configurations. Props to [@sybrew](https://github.com/sybrew) for responsibly disclosing this issue.
+
 = 4.0.1 - July 30, 2024 =
 

stream/trunk/stream.php

@@ -4 +4 @@
  * Plugin URI: https://xwp.co/work/stream/
  * Description: Stream tracks logged-in user activity so you can monitor every change made on your WordPress site in beautifully organized detail. All activity is organized by context, action and IP address for easy filtering. Developers can extend Stream with custom connectors to log any kind of action.
- * Version: 4.0.1
+ * Version: 4.0.2
  * Author: XWP
  * Author URI: https://xwp.co

stream/trunk/vendor/composer/installed.php

@@ -2 +2 @@
     'root' => array(
         'name' => 'xwp/stream',
-        'pretty_version' => 'v4.0.1',
-        'version' => '4.0.1.0',
-        'reference' => 'abc53ab8397dae1a70b883d7f5ecee019e595c03',
+        'pretty_version' => 'v4.0.2',
+        'version' => '4.0.2.0',
+        'reference' => 'e61210f3529a19ef235805d34e82f100282aec7a',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
@@ -33 +33 @@
         ),
         'xwp/stream' => array(
-            'pretty_version' => 'v4.0.1',
-            'version' => '4.0.1.0',
-            'reference' => 'abc53ab8397dae1a70b883d7f5ecee019e595c03',
+            'pretty_version' => 'v4.0.2',
+            'version' => '4.0.2.0',
+            'reference' => 'e61210f3529a19ef235805d34e82f100282aec7a',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',