Merge pull request #656 from ProgressPlanner/filip/merge-main

Merge v1.8.1 into develop

Author: ilicfilip

CHANGELOG.md

@@ -9,6 +9,11 @@ Bugs we fixed:
 * Fix missing content and streak badges after they are all completed.
 * Fix issue when point is sometimes not awarded for completing "Remove term without posts" task.
 
+= 1.8.1 =
+
+- Security fix: Privilege escalation via an AJAX call where authenticated users could update arbitrary site options.
+- Added capability checks.
+- Thanks to [NumeX](https://github.com/NumeXx) for responsibly disclosing via the Patchstack Bug Bounty Program.
 
 = 1.8.0 =
 

classes/admin/class-page-settings.php

@@ -128,6 +128,11 @@ public function should_show_setting( $page_type ) {
 	 * @return void
 	 */
 	public function store_settings_form_options() {
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		\check_admin_referer( 'progress_planner' );
 

classes/class-suggested-tasks.php

@@ -235,6 +235,16 @@ public function suggested_task_action() {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Task not found.', 'progress-planner' ) ] );
 		}
 
+		$provider = \progress_planner()->get_suggested_tasks()->get_tasks_manager()->get_task_provider( $task->get_provider_id() );
+
+		if ( ! $provider ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'Provider not found.', 'progress-planner' ) ] );
+		}
+
+		if ( ! $provider->capability_required() ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to complete this task.', 'progress-planner' ) ] );
+		}
+
 		$updated = false;
 
 		switch ( $action ) {

classes/suggested-tasks/providers/class-email-sending.php

@@ -258,6 +258,11 @@ protected function is_there_sending_email_override() {
 	 * @return void
 	 */
 	public function ajax_test_email_sending() {
+
+		if ( ! $this->capability_required() ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to test email sending.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		\check_admin_referer( 'progress_planner' );
 

classes/suggested-tasks/providers/class-select-locale.php

@@ -241,6 +241,12 @@ public function print_popover_form_contents() {
 	 * @return void
 	 */
 	public function handle_interactive_task_specific_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/suggested-tasks/providers/class-select-timezone.php

@@ -158,6 +158,12 @@ public function print_popover_form_contents() {
 	 * @return void
 	 */
 	public function handle_interactive_task_specific_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/suggested-tasks/providers/class-set-date-format.php

@@ -253,6 +253,12 @@ public function print_popover_form_contents() {
 	 * @return void
 	 */
 	public function handle_interactive_task_specific_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/suggested-tasks/providers/class-tasks-interactive.php

@@ -61,6 +61,12 @@ public function get_task_details( $task_data = [] ) {
 	 * @return void
 	 */
 	public function handle_interactive_task_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/utils/class-onboard.php

@@ -58,6 +58,11 @@ public function on_activate_plugin( $plugin ) {
 	 * @return void
 	 */
 	public function save_onboard_response() {
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

progress-planner.php

@@ -9,7 +9,7 @@
  * Description:       A plugin to help you fight procrastination and get things done.
  * Requires at least: 6.6
  * Requires PHP:      7.4
- * Version:           1.8.0
+ * Version:           1.8.1
  * Author:            Team Emilia Projects
  * Author URI:        https://prpl.fyi/about
  * License:           GPL-3.0+