add current_user_can() check

Author: ilicfilip

CHANGELOG.md

@@ -1,3 +1,9 @@
+= 1.8.1 =
+
+Bugs we fixed:
+
+* Fix vulnerbility with arbitrary option update.
+
 = 1.8.0 =
 
 Enhancements:

classes/suggested-tasks/providers/class-select-locale.php

@@ -243,6 +243,12 @@ public function print_popover_form_contents() {
 	 * @return void
 	 */
 	public function handle_interactive_task_specific_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/suggested-tasks/providers/class-select-timezone.php

@@ -158,6 +158,12 @@ public function print_popover_form_contents() {
 	 * @return void
 	 */
 	public function handle_interactive_task_specific_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/suggested-tasks/providers/class-set-date-format.php

@@ -253,6 +253,12 @@ public function print_popover_form_contents() {
 	 * @return void
 	 */
 	public function handle_interactive_task_specific_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/suggested-tasks/providers/class-tasks-interactive.php

@@ -61,6 +61,12 @@ public function get_task_details( $task_data = [] ) {
 	 * @return void
 	 */
 	public function handle_interactive_task_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );