Check for caps before loading alert settings #1432

schlessera · 2023-04-21T01:12:05Z

This PR includes the following changes:

adds tests to trigger and assert the vulnerability described in CVE-2022-43450, props @Lucisu via Patchstack
fixes CVE-2022-43450 by adding a capability check to the 'wp_ajax_load_alerts_settings ' AJAX action.

Checklist

Project documentation has been updated to reflect the changes in this pull request, if applicable.
I have tested the changes in the local development environment (see contributing.md).
I have added phpunit tests.

schlessera · 2023-04-21T01:13:12Z

tests/tests/test-class-alerts.php

 		}

+		// TODO: This returns an empty 'success => true' response. It should probably return a failure response instead - 400 Bad Request?


I think a borked request should return an HTTP 400 - Bad Request instead of a 200 with a success => true message.

kasparsd

This looks great, thanks!

Check for caps before loading alert settings

b8634a4

schlessera added the vulnerability label Apr 21, 2023

schlessera added this to the 3.9.3 milestone Apr 21, 2023

schlessera requested a review from kasparsd April 21, 2023 01:12

schlessera commented Apr 21, 2023

View reviewed changes

kasparsd approved these changes Apr 21, 2023

View reviewed changes

kasparsd changed the base branch from develop to master April 21, 2023 03:47

kasparsd merged commit ea4a1fa into master Apr 21, 2023
2 checks passed

kasparsd deleted the fix/cve-2022-43450 branch April 21, 2023 03:49

		}

		// TODO: This returns an empty 'success => true' response. It should probably return a failure response instead - 400 Bad Request?