Check authorization on 'save_new_alert' AJAX action #1391
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
schlessera
commented
Jan 9, 2023
| @@ -509,6 +509,7 @@ public function change_menu_link_url() { | |||
| * @return void | |||
| */ | |||
| public function display_notification_box( $post = array() ) { | |||
| $alert = null; | |||
There was a problem hiding this comment.
This was added to avoid PHP notices for the use of a non-initialized variable.
kasparsd
approved these changes
Jan 9, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The logic in
save_new_alertAJAX action does only check for a valid nonce, but not for authorization. This makes it possible to reuse a valid nonce and trigger thesave_new_alertwith an unauthorized or unauthenticated user.This PR adds an authorization check to
save_new_alert(as well as toget_new_alert_triggers_notifications, which could be used to retrieve a nonce as an authenticated but unauthorized user), and adds corresponding tests to ensure both wanted and unwanted requests behave as expected with regards to alert creation.Props to @marcS0H for the report.
Checklist
contributing.md).