WordPress.org
Get WordPress

Plugin Directory

Changeset 3459181


Ignore:
Timestamp:
02/11/2026 05:51:25 PM (11 days ago)
Author:
sided
Message:

Ship a security hotfix to the current WordPress plugin this week. It's a focused fix — add wp_verify_nonce() to all AJAX handlers, add current_user_can() checks, sanitize the $_POSTjsonObj? storage, and escape output.

Location:
sided/trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • sided/trunk/includes/block-editor/index.js

    r2976952 r3459181  
    5353                    data: {
    5454                        action: 'wpa_fetch_debates',
     55                        sided_ajax_nonce: (typeof sidedBlockEditor !== 'undefined' && sidedBlockEditor.ajaxNonce) ? sidedBlockEditor.ajaxNonce : '',
    5556                        searchText: event.target.value,
    5657                        results_per_page: event.target.value.length === 0 ? 10 : 999
    … …  
    107108                    data: {
    108109                        action: 'wpa_fetch_current_debate',
     110                        sided_ajax_nonce: (typeof sidedBlockEditor !== 'undefined' && sidedBlockEditor.ajaxNonce) ? sidedBlockEditor.ajaxNonce : '',
    109111                        debateId: debateId
    110112                    },
    … …  
    471473                    data: {
    472474                        action: 'wpa_fetch_current_debate',
     475                        sided_ajax_nonce: (typeof sidedBlockEditor !== 'undefined' && sidedBlockEditor.ajaxNonce) ? sidedBlockEditor.ajaxNonce : '',
    473476                        debateId: debateId
    474477                    },

  • sided/trunk/includes/block-editor/sided-block-editor.php

    r2976952 r3459181  
    2323    );
    2424
     25    wp_localize_script(
     26        'embed-sided-debates-block-editor',
     27        'sidedBlockEditor',
     28        array(
     29            'ajaxNonce' => wp_create_nonce( 'sided_ajax' ),
     30        )
     31    );
     32
    2533    register_block_type(
    2634        'sided/sided-debate-selector',

  • sided/trunk/partials/functions.php

    r3379194 r3459181  
    111111                if ($embed_placement_option['active'] == 'true' && $embed_placement_option['embed_location_on_page'] !== 'sidebar') {
    112112                    return sprintf(
    113                         '%s<div class="sided-widget" clientId="%d" placementId="%d"></div>',
     113                        '%s<div class="sided-widget" clientId="%s" placementId="%s"></div>',
    114114                        $content,
    115                         $sided_selected_network,
    116                         $embed_placement_option['placement_id']
     115                        esc_attr( (string) $sided_selected_network ),
     116                        esc_attr( (string) $embed_placement_option['placement_id'] )
    117117                    );
    118118                }
    … …  
    166166
    167167add_action('wp_ajax_wpa_sided_initiate_script', 'sided_wpa_sided_initiate_script_callback');
    168 add_action('wp_ajax_nopriv_wpa_sided_initiate_script', 'sided_wpa_sided_initiate_script_callback');
    169168function sided_wpa_sided_initiate_script_callback()
    170169{
     170    if ( ! isset( $_REQUEST['sided_ajax_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['sided_ajax_nonce'] ) ), 'sided_ajax' ) ) {
     171        wp_send_json_error( array( 'message' => __( 'Security check failed.', 'sided' ) ), 403 );
     172    }
     173    if ( ! current_user_can( 'manage_options' ) ) {
     174        wp_send_json_error( array( 'message' => __( 'You do not have permission to perform this action.', 'sided' ) ), 403 );
     175    }
    171176    echo esc_js(update_option('sided_sided_initiate_script', sanitize_text_field($_POST['checked'])));
    172177    wp_die();
    … …  
    174179
    175180add_action('wp_ajax_wpa_send_cats_to_sided', 'sided_wpa_send_cats_to_sided_callback');
    176 add_action('wp_ajax_nopriv_wpa_send_cats_to_sided', 'sided_wpa_send_cats_to_sided_callback');
    177181function sided_wpa_send_cats_to_sided_callback()
    178182{
     183    if ( ! isset( $_REQUEST['sided_ajax_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['sided_ajax_nonce'] ) ), 'sided_ajax' ) ) {
     184        wp_send_json_error( array( 'message' => __( 'Security check failed.', 'sided' ) ), 403 );
     185    }
     186    if ( ! current_user_can( 'manage_options' ) ) {
     187        wp_send_json_error( array( 'message' => __( 'You do not have permission to perform this action.', 'sided' ) ), 403 );
     188    }
    179189    echo esc_js(update_option('send_cats_to_sided', sanitize_text_field($_POST['checked'])));
    180190    wp_die();
    … …  
    182192
    183193add_action('wp_ajax_wpa_send_tags_to_sided', 'sided_wpa_send_tags_to_sided_callback');
    184 add_action('wp_ajax_nopriv_wpa_send_tags_to_sided', 'sided_wpa_send_tags_to_sided_callback');
    185194function sided_wpa_send_tags_to_sided_callback()
    186195{
     196    if ( ! isset( $_REQUEST['sided_ajax_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['sided_ajax_nonce'] ) ), 'sided_ajax' ) ) {
     197        wp_send_json_error( array( 'message' => __( 'Security check failed.', 'sided' ) ), 403 );
     198    }
     199    if ( ! current_user_can( 'manage_options' ) ) {
     200        wp_send_json_error( array( 'message' => __( 'You do not have permission to perform this action.', 'sided' ) ), 403 );
     201    }
    187202    echo esc_js(update_option('send_tags_to_sided', sanitize_text_field($_POST['checked'])));
    188203    wp_die();
    189204}
    190205
    191 add_action('wp_ajax_nopriv_wpa_fetch_embed_placements', 'sided_wpa_fetch_embed_placements_callback');
    192206add_action('wp_ajax_wpa_fetch_embed_placements', 'sided_wpa_fetch_embed_placements_callback');
    193207function sided_wpa_fetch_embed_placements_callback()
    194208{
     209    if ( ! isset( $_REQUEST['sided_ajax_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['sided_ajax_nonce'] ) ), 'sided_ajax' ) ) {
     210        wp_send_json_error( array( 'message' => __( 'Security check failed.', 'sided' ) ), 403 );
     211    }
     212    if ( ! current_user_can( 'manage_options' ) ) {
     213        wp_send_json_error( array( 'message' => __( 'You do not have permission to perform this action.', 'sided' ) ), 403 );
     214    }
    195215    update_option('sided_sided_selected_network', sanitize_text_field($_POST['selectedValue']));
    196216    delete_option('sided_sided_embed_placement_options');
    … …  
    213233}
    214234
    215 add_action('wp_ajax_nopriv_wpa_sided_generate_smart_poll', 'sided_wpa_sided_generate_smart_poll_callback');
    216235add_action('wp_ajax_wpa_sided_generate_smart_poll', 'sided_wpa_sided_generate_smart_poll_callback');
    217236function sided_wpa_sided_generate_smart_poll_callback()
    218237{
     238    if ( ! isset( $_REQUEST['sided_ajax_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['sided_ajax_nonce'] ) ), 'sided_ajax' ) ) {
     239        wp_send_json_error( array( 'message' => __( 'Security check failed.', 'sided' ) ), 403 );
     240    }
     241    if ( ! current_user_can( 'manage_options' ) ) {
     242        wp_send_json_error( array( 'message' => __( 'You do not have permission to perform this action.', 'sided' ) ), 403 );
     243    }
    219244    //print_r($_POST['SPC_keyword_val']);
    220245    $url = SIDED_API_URL . '/admin/debate/generateDebates?count=4&url=' . sanitize_text_field($_POST['SPC_keyword_val']);
    … …  
    239264
    240265add_action('wp_ajax_wpa_save_embed_options', 'wpa_save_embed_options_callback');
    241 add_action('wp_ajax_nopriv_wpa_save_embed_options', 'wpa_save_embed_options_callback');
    242266function wpa_save_embed_options_callback()
    243267{
    244     $_POST['jsonObj']['updated_at'] = current_datetime();
    245     // commented on 2024-10-16, it was not saving embed placement options
    246     // echo esc_js(update_option('sided_sided_embed_placement_options', esc_js($_POST['jsonObj'])));
    247    
    248     // changes made on 2024-10-16 to save embed placement options
    249     if (get_option('sided_sided_embed_placement_options') == false) {
    250         add_option('sided_sided_embed_placement_options', $_POST['jsonObj']);
     268    if ( ! isset( $_REQUEST['sided_ajax_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['sided_ajax_nonce'] ) ), 'sided_ajax' ) ) {
     269        wp_send_json_error( array( 'message' => __( 'Security check failed.', 'sided' ) ), 403 );
     270    }
     271    if ( ! current_user_can( 'manage_options' ) ) {
     272        wp_send_json_error( array( 'message' => __( 'You do not have permission to perform this action.', 'sided' ) ), 403 );
     273    }
     274    $raw = isset( $_POST['jsonObj'] ) && is_array( $_POST['jsonObj'] ) ? wp_unslash( $_POST['jsonObj'] ) : array();
     275    $allowed_locations = array( 'bottom_of_every_post', 'sidebar' );
     276    $sanitized = array();
     277    foreach ( $raw as $index => $item ) {
     278        if ( ! is_array( $item ) ) {
     279            continue;
     280        }
     281        $placement_id = isset( $item['placement_id'] ) ? absint( $item['placement_id'] ) : 0;
     282        $embed_location = isset( $item['embed_location_on_page'] ) && in_array( $item['embed_location_on_page'], $allowed_locations, true )
     283            ? $item['embed_location_on_page']
     284            : 'bottom_of_every_post';
     285        $sanitized[ $index ] = array(
     286            'active'       => ! empty( $item['active'] ) && $item['active'] !== 'false' ? 'true' : 'false',
     287            'placement_id' => $placement_id,
     288            'placement_text' => isset( $item['placement_text'] ) ? sanitize_text_field( $item['placement_text'] ) : '',
     289            'embed_location_on_page' => $embed_location,
     290        );
     291    }
     292    $sanitized['updated_at'] = current_datetime();
     293    if ( get_option( 'sided_sided_embed_placement_options' ) == false ) {
     294        add_option( 'sided_sided_embed_placement_options', $sanitized );
    251295    } else {
    252         update_option('sided_sided_embed_placement_options', $_POST['jsonObj']);
    253     }
    254     // changes made on 2024-10-16 to save embed placement options end
     296        update_option( 'sided_sided_embed_placement_options', $sanitized );
     297    }
    255298    wp_die();
    256299}
    … …  
    300343}
    301344
    302 add_action('wp_ajax_nopriv_wpa_fetch_debates', 'wpa_fetch_debates_callback');
    303345add_action('wp_ajax_wpa_fetch_debates', 'wpa_fetch_debates_callback');
    304346function wpa_fetch_debates_callback()
    305347{
     348    if ( ! isset( $_REQUEST['sided_ajax_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['sided_ajax_nonce'] ) ), 'sided_ajax' ) ) {
     349        wp_send_json_error( array( 'message' => __( 'Security check failed.', 'sided' ) ), 403 );
     350    }
     351    if ( ! current_user_can( 'manage_options' ) ) {
     352        wp_send_json_error( array( 'message' => __( 'You do not have permission to perform this action.', 'sided' ) ), 403 );
     353    }
    306354    $selected_network = get_option('sided_sided_selected_network') ? get_option('sided_sided_selected_network') : 1;
    307355    //$selected_network = array_key_exists('selected_network', $_SESSION) ? $_SESSION['selected_network'] : 1;
    … …  
    328376}
    329377
    330 add_action('wp_ajax_nopriv_wpa_fetch_current_debate', 'wpa_fetch_current_debate_callback');
    331378add_action('wp_ajax_wpa_fetch_current_debate', 'wpa_fetch_current_debate_callback');
    332379function wpa_fetch_current_debate_callback()
    333380{
    334    
     381    if ( ! isset( $_REQUEST['sided_ajax_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['sided_ajax_nonce'] ) ), 'sided_ajax' ) ) {
     382        wp_send_json_error( array( 'message' => __( 'Security check failed.', 'sided' ) ), 403 );
     383    }
     384    if ( ! current_user_can( 'manage_options' ) ) {
     385        wp_send_json_error( array( 'message' => __( 'You do not have permission to perform this action.', 'sided' ) ), 403 );
     386    }
    335387    $debateId = isset($_GET['debateId']) ? sanitize_text_field($_GET['debateId']) : '';
    336388    $url = SIDED_API_URL . '/debate/'.$debateId.'?deviceId='.$debateId;

  • sided/trunk/partials/sided-create-debate-from-block.php

    r3194244 r3459181  
    330330        data: {
    331331          action: 'wpa_sided_generate_smart_poll',
     332          sided_ajax_nonce: '<?php echo esc_js( wp_create_nonce( 'sided_ajax' ) ); ?>',
    332333          SPC_keyword_val: SPC_keyword.val(),
    333334        },

  • sided/trunk/partials/sided-create-debate.php

    r3194244 r3459181  
    316316        data: {
    317317          action: 'wpa_sided_generate_smart_poll',
     318          sided_ajax_nonce: '<?php echo esc_js( wp_create_nonce( 'sided_ajax' ) ); ?>',
    318319          SPC_keyword_val: SPC_keyword.val(),
    319320        },

  • sided/trunk/partials/sided-settings.php

    r3369836 r3459181  
    121121<?php
    122122$placement_options_array = get_option('sided_sided_embed_placement_options');
    123 if (isset($placement_options_array['updated_at'])) {
    124     unset($placement_options_array['updated_at']);
     123if ( ! is_array( $placement_options_array ) ) {
     124    $placement_options_array = array();
     125}
     126if ( isset( $placement_options_array['updated_at'] ) ) {
     127    unset( $placement_options_array['updated_at'] );
     128}
     129$placement_options_safe = array();
     130foreach ( $placement_options_array as $key => $item ) {
     131    if ( ! is_array( $item ) ) {
     132        continue;
     133    }
     134    $placement_options_safe[ $key ] = array(
     135        'active'                  => isset( $item['active'] ) ? $item['active'] : 'false',
     136        'placement_id'            => isset( $item['placement_id'] ) ? (int) $item['placement_id'] : 0,
     137        'placement_text'          => isset( $item['placement_text'] ) ? esc_html( $item['placement_text'] ) : '',
     138        'embed_location_on_page'  => isset( $item['embed_location_on_page'] ) ? esc_attr( $item['embed_location_on_page'] ) : 'bottom_of_every_post',
     139    );
    125140}
    126141
    127142?>
    128143<script type="text/javascript">
     144var sided_ajax_nonce = '<?php echo esc_js( wp_create_nonce( 'sided_ajax' ) ); ?>';
    129145(function ($) {
    130146    $('input[name="sided_initiate_script"]').change(function() {
    131147        var data = {
    132148            action: 'wpa_sided_initiate_script',
     149            sided_ajax_nonce: sided_ajax_nonce,
    133150            checked: $(this).is(":checked") ? true : false,
    134151        };
    … …  
    141158        var data = {
    142159            action: 'wpa_send_cats_to_sided',
     160            sided_ajax_nonce: sided_ajax_nonce,
    143161            checked: $(this).is(":checked") ? true : false,
    144162        };
    … …  
    151169        var data = {
    152170            action: 'wpa_send_tags_to_sided',
     171            sided_ajax_nonce: sided_ajax_nonce,
    153172            checked: $(this).is(":checked") ? true : false,
    154173        };
    … …  
    167186          data: {
    168187            action: 'wpa_fetch_embed_placements',
     188            sided_ajax_nonce: sided_ajax_nonce,
    169189            selectedValue: selectedValue
    170190          },
    … …  
    186206    function fetch_selected_placements(){
    187207        $('#placement-option-wrapper').html('');
    188         var dataArray = $.parseJSON('<?php echo wp_json_encode($placement_options_array); ?>');
    189         if(dataArray == ''){ $(".select_network").trigger("change"); }
     208        var dataArray = <?php echo wp_json_encode( $placement_options_safe ); ?>;
     209        if ( ! dataArray || dataArray.length === 0 ) { $(".select_network").trigger("change"); }
    190210        $.each(dataArray , function(key, value){
    191211            var checked = value['active'] == 'true' ? 'checked' : '';
    … …  
    204224        var data = {
    205225            action: 'wpa_save_embed_options',
     226            sided_ajax_nonce: sided_ajax_nonce,
    206227            jsonObj: jsonObj,
    207228        };

  • sided/trunk/readme.txt

    r3439973 r3459181  
    55Requires at least: 4.7
    66Tested up to: 6.5.3
    7 Stable tag: 1.4.11
     7Stable tag: 1.4.12
    88Requires PHP: 7.0
    99License: GPLv2 or later

  • sided/trunk/sided.php

    r3439973 r3459181  
    11<?php
    22/**
    3 * Plugin Name: Sided
    4 * Plugin URI: https://sided.co/
    5 * Description: It is a wordpress plugin to embed sided polls in your Wordpress website.
    6 * Version: 1.4.11
    7 * Author: Sided
    8 **/
     3 * Plugin Name: Sided
     4 * Plugin URI: https://sided.co/
     5 * Description: It is a wordpress plugin to embed sided polls in your Wordpress website.
     6 * Version: 1.4.12
     7 * Author: Sided
     8 * Author URI: https://sided.co/
     9 * License: GPLv2 or later
     10 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
     11 * Text Domain: sided
     12 */
    913
    10 define( 'SIDED_VERSION', '1.4.11' );
     14define( 'SIDED_VERSION', '1.4.12' );
    1115define( 'SIDED_PLUGIN', __FILE__ );
    1216define( 'SIDED_PLUGIN_DIR', untrailingslashit( dirname( SIDED_PLUGIN ) ) );
Note: See TracChangeset for help on using the changeset viewer.