Merge pull request #651 from ProgressPlanner/filip/add-permission-check

v1.8.1

Author: jdevalk

CHANGELOG.md

@@ -1,3 +1,9 @@
+= 1.8.1 =
+
+Bugs we fixed:
+
+* Fix vulnerability with arbitrary option update.
+
 = 1.8.0 =
 
 Enhancements:

classes/actions/class-content-scan.php

@@ -45,6 +45,11 @@ public function register_hooks() {
 	 * @return void
 	 */
 	public function ajax_scan() {
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to scan posts.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );
@@ -71,6 +76,11 @@ public function ajax_scan() {
 	 * @return void
 	 */
 	public function ajax_reset_posts_data() {
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to reset posts data.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/admin/class-page-settings.php

@@ -128,6 +128,11 @@ public function should_show_setting( $page_type ) {
 	 * @return void
 	 */
 	public function store_settings_form_options() {
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		\check_admin_referer( 'progress_planner' );
 

classes/class-suggested-tasks.php

@@ -232,6 +232,16 @@ public function suggested_task_action() {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Task not found.', 'progress-planner' ) ] );
 		}
 
+		$provider = \progress_planner()->get_suggested_tasks()->get_tasks_manager()->get_task_provider( $task->get_provider_id() );
+
+		if ( ! $provider ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'Provider not found.', 'progress-planner' ) ] );
+		}
+
+		if ( ! $provider->capability_required() ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to complete this task.', 'progress-planner' ) ] );
+		}
+
 		$updated = false;
 
 		switch ( $action ) {

classes/suggested-tasks/providers/class-email-sending.php

@@ -255,6 +255,11 @@ protected function is_there_sending_email_override() {
 	 * @return void
 	 */
 	public function ajax_test_email_sending() {
+
+		if ( ! $this->capability_required() ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to test email sending.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		\check_admin_referer( 'progress_planner' );
 

classes/suggested-tasks/providers/class-select-locale.php

@@ -243,6 +243,12 @@ public function print_popover_form_contents() {
 	 * @return void
 	 */
 	public function handle_interactive_task_specific_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/suggested-tasks/providers/class-select-timezone.php

@@ -158,6 +158,12 @@ public function print_popover_form_contents() {
 	 * @return void
 	 */
 	public function handle_interactive_task_specific_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/suggested-tasks/providers/class-set-date-format.php

@@ -253,6 +253,12 @@ public function print_popover_form_contents() {
 	 * @return void
 	 */
 	public function handle_interactive_task_specific_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/suggested-tasks/providers/class-tasks-interactive.php

@@ -61,6 +61,12 @@ public function get_task_details( $task_data = [] ) {
 	 * @return void
 	 */
 	public function handle_interactive_task_submit() {
+
+		// Check if the user has the necessary capabilities.
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/utils/class-onboard.php

@@ -58,6 +58,11 @@ public function on_activate_plugin( $plugin ) {
 	 * @return void
 	 */
 	public function save_onboard_response() {
+
+		if ( ! \current_user_can( 'manage_options' ) ) {
+			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
+		}
+
 		// Check the nonce.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );