Skip to content

Improve security and back-slash issue resolved #2896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shewa12 merged 5 commits into from
Jul 10, 2026
+98 −36
Merged

Improve security and back-slash issue resolved #2896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3076845
refactor: unify answer ID retrieval in REST API and fix quiz answer s…
harunollyo Jul 8, 2026
2e9f0b2
refactor: replace hardcoded question type strings with QuizModel cons…
harunollyo Jul 8, 2026
f5000b3
refactor: use get_manual_review_types for quiz question validation an…
harunollyo Jul 8, 2026
9af300a
fix: backslash showing for image answering
harunollyo Jul 10, 2026
d8446a8
rest api security imporved
harunollyo Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions classes/Quiz.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -793,7 +793,7 @@ public static function manage_attempt_answers( $attempt_answers, $attempt, $atte
$is_answer_was_correct = false;
$given_answer = '';

if ( 'true_false' === $question_type || 'single_choice' === $question_type ) {
if ( QuizModel::QUESTION_TYPE_TRUE_FALSE === $question_type || QuizModel::QUESTION_TYPE_SINGLE_CHOICE === $question_type ) {
$given_answer = $answers;
$is_answer_was_correct = (bool) $wpdb->get_var(
$wpdb->prepare(
Expand All @@ -805,7 +805,7 @@ public static function manage_attempt_answers( $attempt_answers, $attempt, $atte
)
);

} elseif ( 'multiple_choice' === $question_type ) {
} elseif ( QuizModel::QUESTION_TYPE_MULTIPLE_CHOICE === $question_type ) {

$given_answer = (array) ( $answers );
$given_answer = array_filter( $given_answer, fn ( $id ) => is_numeric( $id ) && intval( $id ) > 0 );
Expand All @@ -828,9 +828,10 @@ public static function manage_attempt_answers( $attempt_answers, $attempt, $atte
if ( count( array_diff( $get_original_answers, $given_answer ) ) === 0 && count( $get_original_answers ) === count( $given_answer ) ) {
$is_answer_was_correct = true;
}
$given_answer = maybe_serialize( $answers );

} elseif ( 'fill_in_the_blank' === $question_type ) {
$given_answer = maybe_serialize( $given_answer );

} elseif ( QuizModel::QUESTION_TYPE_FILL_IN_THE_BLANK === $question_type ) {

$get_original_answer = $wpdb->get_row(
$wpdb->prepare(
Expand Down Expand Up @@ -869,11 +870,11 @@ function ( $ans ) {
if ( strtolower( $given_answer ) === strtolower( $gap_answer ) ) {
$is_answer_was_correct = true;
}
} elseif ( 'open_ended' === $question_type || 'short_answer' === $question_type ) {
} elseif ( QuizModel::QUESTION_TYPE_OPEN_ENDED === $question_type || QuizModel::QUESTION_TYPE_SHORT_ANSWER === $question_type ) {
$review_required = true;
$given_answer = wp_kses_post( $answers );

} elseif ( 'ordering' === $question_type || 'matching' === $question_type || 'image_matching' === $question_type ) {
} elseif ( QuizModel::QUESTION_TYPE_ORDERING === $question_type || QuizModel::QUESTION_TYPE_MATCHING === $question_type || QuizModel::QUESTION_TYPE_IMAGE_MATCHING === $question_type ) {
$answers = (array) tutor_utils()->avalue_dot( 'answers', $answers );

$given_answer = (array) array_map( 'sanitize_text_field', $answers );
Expand All @@ -897,7 +898,7 @@ function ( $ans ) {
if ( maybe_serialize( $get_original_answers ) == $given_answer ) {
$is_answer_was_correct = true;
}
} elseif ( 'image_answering' === $question_type ) {
} elseif ( QuizModel::QUESTION_TYPE_IMAGE_ANSWERING === $question_type ) {
$image_inputs = tutor_utils()->avalue_dot( 'answer_id', $answers );
$image_inputs = (array) array_map( 'sanitize_text_field', $image_inputs );
$given_answer = maybe_serialize( $image_inputs );
Expand Down Expand Up @@ -963,7 +964,7 @@ function ( $ans ) {
* Check if question_type open ended or short ans the set
* is_correct default value null before saving
*/
if ( in_array( $question_type, array( 'open_ended', 'short_answer', 'image_answering' ) ) ) {
if ( in_array( $question_type, QuizModel::get_manual_review_types(), true ) ) {
$answers_data['is_correct'] = null;
$review_required = true;
}
Expand Down
60 changes: 60 additions & 0 deletions classes/RestAPI.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,66 @@ public function __construct() {
$this->rating_obj = new REST_Rating();

add_action( 'rest_api_init', array( $this, 'init_routes' ) );
add_filter( 'rest_request_before_callbacks', array( $this, 'check_permission' ), 10, 3 );
}

/**
* Check permission before dispatching REST request.
*
* @todo will remove and prevent by capability where needed.
*
* @since 4.0.1
*
* @param mixed $response response.
* @param mixed $handler handler.
* @param \WP_REST_Request $request request.
*
* @return mixed|\WP_Error
*/
public function check_permission( $response, $handler, $request ) {
$id = absint( $request['id'] );
$method = $request->get_method();
$write_methods = array( 'POST', 'PUT', 'PATCH', 'DELETE' );
$is_write = in_array( $method, $write_methods, true );

if ( ! $id ) {
return $response;
}

$post = get_post( $id );

if ( ! $post ) {
return $response;
}

$post_types = array(
tutor()->course_post_type,
tutor()->bundle_post_type,
);

if ( ! in_array( $post->post_type, $post_types, true ) ) {
return $response;
}

// Prevent write actions which are only allowed for author.
if ( $is_write && ! current_user_can( 'edit_post', $id ) ) {
return new \WP_Error(
'rest_forbidden',
tutor_utils()->error_message(),
array( 'status' => rest_authorization_required_code() )
);
}

// Prevent access to non-publish posts, only author can access.
if ( 'publish' !== $post->post_status && ! current_user_can( 'edit_post', $id ) ) {
return new \WP_Error(
'rest_forbidden',
tutor_utils()->error_message(),
array( 'status' => rest_authorization_required_code() )
);
}

return $response;
}

/**
Expand Down
6 changes: 5 additions & 1 deletion models/QuizModel.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,7 +193,11 @@ public static function get_question_types( $type = '' ) {
* @return array
*/
public static function get_manual_review_types() {
return array( 'open_ended', 'short_answer' );
return array(
self::QUESTION_TYPE_OPEN_ENDED,
self::QUESTION_TYPE_SHORT_ANSWER,
self::QUESTION_TYPE_IMAGE_ANSWERING,
);
}


Expand Down
35 changes: 14 additions & 21 deletions restapi/REST_Quiz.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -396,36 +396,29 @@ protected function get_quiz_attempt_ans( $quiz_id ) {
*
* @since 1.7.1
*
* @param int $id answer id.
* @param int|int[] $id answer id or array of answer id.
*
* @return mixed
*/
protected function answer_titles_by_id( $id ) {
global $wpdb;
$wpdb->t_quiz_ques_ans = $wpdb->prefix . $this->t_quiz_ques_ans;

if ( is_array( $id ) ) {
$array = QueryHelper::prepare_in_clause( $id );

$results = $wpdb->get_results(
"SELECT
answer_title
FROM {$wpdb->t_quiz_ques_ans}
WHERE
answer_id IN ('" . $array . "')"//phpcs:ignore
);
} else {
$results = $wpdb->get_results(
$wpdb->prepare(
"SELECT
answer_title
FROM {$wpdb->t_quiz_ques_ans}
WHERE answer_id = %d",
$id
)
);
$ids = array_filter( array_map( 'absint', (array) $id ) );
if ( empty( $ids ) ) {
return array();
}

$array = QueryHelper::prepare_in_clause( $ids );

$results = $wpdb->get_results(
"SELECT
answer_title
FROM {$wpdb->t_quiz_ques_ans}
WHERE
answer_id IN ({$array})" //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
);

return $results;
}
}
16 changes: 10 additions & 6 deletions templates/shared/components/quiz/attempt-details/questions/review-answer-dnd.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,19 +109,23 @@
</div>

<div class="tutor-quiz-review-dnd-rows">
<?php foreach ( $rows as $row ) : ?>
<?php
foreach ( $rows as $row ) :
$given_text = isset( $row['given_text'] ) ? wp_unslash( $row['given_text'] ) : '';
$correct_text = isset( $row['correct_text'] ) ? wp_unslash( $row['correct_text'] ) : '';
?>
<div class="tutor-quiz-review-dnd-row">
<div class="tutor-quiz-review-item tutor-quiz-review-given" data-option="<?php echo esc_attr( $row['given_status'] ); ?>">
<div class="tutor-quiz-review-item tutor-quiz-review-given" data-option="<?php echo esc_attr( $given_text ); ?>">
<?php if ( ! empty( $row['given_image'] ) ) : ?>
<img src="<?php echo esc_url( $row['given_image'] ); ?>" alt="<?php echo esc_attr( $row['given_text'] ); ?>">
<img src="<?php echo esc_url( $row['given_image'] ); ?>" alt="<?php echo esc_attr( $given_text ); ?>">
<?php endif; ?>
<span><?php echo esc_html( $row['given_text'] ); ?></span>
<span><?php echo esc_html( $given_text ); ?></span>
</div>
<div class="tutor-quiz-review-item tutor-quiz-review-correct" data-option="neutral">
<?php if ( ! empty( $row['correct_image'] ) ) : ?>
<img src="<?php echo esc_url( $row['correct_image'] ); ?>" alt="<?php echo esc_attr( $row['correct_text'] ); ?>">
<img src="<?php echo esc_url( $row['correct_image'] ); ?>" alt="<?php echo esc_attr( $correct_text ); ?>">
<?php endif; ?>
<span><?php echo esc_html( $row['correct_text'] ); ?></span>
<span><?php echo esc_html( $correct_text ); ?></span>
</div>
</div>
<?php endforeach; ?>
Expand Down
Loading