Skip to content
This repository was archived by the owner on Sep 28, 2023. It is now read-only.

patched security issue and look for same referer for AJAX calls when editing posts #18

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

patched security issue and look for same referer for AJAX calls when editing posts #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion edit.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
var optly = new OptimizelyAPI( $( '#optimizely_token' ).val() );

if ( !! $( '#optimizely_experiment_id' ).val() ) {
optly.get( 'experiments/' + $( '#optimizely_experiment_id' ).val(), function( response ) {
optly.get(f 'experiments/' + $( '#optimizely_experiment_id' ).val(), function( response ) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is there an 'f' here?

optly.experiment = response;
showExperiment( optly.experiment );
});
Expand Down Expand Up @@ -56,6 +56,7 @@
var data = {
action: 'update_experiment_meta',
post_id: $( '#post_ID' ).val(),
optimizely_experiment_nonce: $( '#optimizely_experiment_nonce' ).val(),
optimizely_experiment_id: experiment.id,
optimizely_experiment_status: experiment.status
};
Expand Down
9 changes: 9 additions & 0 deletions edit.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ function optimizely_title_variations_render( $post ) {
<input type="hidden" id="optimizely_token" value="<?php echo esc_attr( get_option( 'optimizely_token' ) )?>" />
<input type="hidden" id="optimizely_project_id" value="<?php echo esc_attr( get_option('optimizely_project_id') ) ?>" />
<input type="hidden" id="optimizely_experiment_id" name="optimizely_experiment_id" value="<?php echo esc_attr( get_post_meta( $post->ID, 'optimizely_experiment_id', true ) ) ?>" />
<?php wp_nonce_field( OPTIMIZELY_NONCE, 'optimizely_experiment_nonce' ); ?>
<input type="hidden" id="optimizely_experiment_status" name="optimizely_experiment_status" value="<?php echo esc_attr( get_post_meta( $post->ID, 'optimizely_experiment_status', true ) ) ?>" />
<input type="hidden" id="optimizely_experiment_url" name="optimizely_experiment_url" value="<?php echo esc_url( get_full_permalink() ) ?>" />
<input type="hidden" id="optimizely_url_targeting" name="optimizely_url_targeting" value="<?php echo esc_attr( get_option( 'optimizely_url_targeting' ) ) ?>" />
Expand Down Expand Up @@ -128,6 +129,14 @@ function optimizely_title_variations_save( $post_id ) {
* @param int $post_id
*/
function optimizely_update_experiment_meta() {
// Make sure this is a valid request.
check_ajax_referer( OPTIMIZELY_NONCE, 'optimizely_experiment_nonce' );

// See if the current user has permissions to edit posts.
if ( ! current_user_can( 'edit_post', absint( $_POST['post_id'] ) ) ) {
die( 'You do not have permission to edit posts.' );
}

if ( isset( $_POST['post_id'] ) ) {
optimizely_title_variations_save( absint( $_POST['post_id'] ) );
}
Expand Down