Fixed: CSRF issue in custom Update Settings logic.

Dan0sz · Dec 12, 2023 · a891f46 · a891f46
1 parent 48ecb1c
commit a891f46
Showing 1 changed file with 15 additions and 9 deletions.
diff --git a/includes/class-caos.php b/includes/class-caos.php
@@ -88,7 +88,7 @@ private function do_setup() {
 	public static function set_file_alias( $alias, $write = false ) {
 		$file_aliases = self::get_file_aliases();
 
-		$file_aliases['gtag'] = $alias;
+		$file_aliases[ 'gtag' ] = $alias;
 
 		return self::set_file_aliases( $file_aliases, $write );
 	}
@@ -211,7 +211,7 @@ public static function get_file_alias() {
 			return '';
 		}
 
-		return $file_aliases['gtag'] ?? '';
+		return $file_aliases[ 'gtag' ] ?? '';
 	}
 
 	/**
@@ -338,8 +338,8 @@ public function trigger_cron_script() {
 	 * @return CAOS_Admin_UpdateFiles
 	 */
 	public function do_update_after_save() {
-		$settings_page    = $_GET['page'] ?? '';
-		$settings_updated = $_GET['settings-updated'] ?? '';
+		$settings_page    = $_GET[ 'page' ] ?? '';
+		$settings_updated = $_GET[ 'settings-updated' ] ?? '';
 
 		if ( CAOS_Admin_Settings::CAOS_ADMIN_PAGE !== $settings_page ) {
 			return;
@@ -369,8 +369,8 @@ public function do_update_after_save() {
 	 * @return void
 	 */
 	public function render_update_notice( $plugin, $response ) {
-		$current_version = $plugin['Version'];
-		$new_version     = $plugin['new_version'];
+		$current_version = $plugin[ 'Version' ];
+		$new_version     = $plugin[ 'new_version' ];
 
 		if ( version_compare( $current_version, $new_version, '<' ) ) {
 			$response = wp_remote_get( 'https://daan.dev/caos-update-notices.json' );
@@ -402,12 +402,18 @@ public function render_update_notice( $plugin, $response ) {
 	 * @since v4.6.0
 	 */
 	public function update_settings() {
-		// phpcs:ignore WordPress.Security
-		if ( empty( $_POST['action'] ) || $_POST['action'] !== 'caos-update' ) {
+		$action = $_GET[ 'tab' ] ?? 'caos-basic-settings';
+
+		wp_verify_nonce( $_POST[ '_wpnonce' ], $action );
+
+		if ( ! current_user_can( 'manage_options' ) ) {
+			return;
+		}
+
+		if ( empty( $_POST[ 'action' ] ) || $_POST[ 'action' ] !== 'caos-update' ) {
 			return;
 		}
 
-		// phpcs:ignore
 		$post_data = $this->clean( $_POST );
 
 		/**