Fix: Add authorization checks to ajax_form_submission and get_form_update_nonce - #1576
Open
Yunkaiwjs wants to merge 1135 commits into
Open
Fix: Add authorization checks to ajax_form_submission and get_form_update_nonce#1576Yunkaiwjs wants to merge 1135 commits into
Yunkaiwjs wants to merge 1135 commits into
Conversation
…rrency symbol in CSV export of entries. (wpeverest#1484) * Fix - HTML entities value for currency is displayed instead of the currency symbol in CSV export of entries * Fix - Sanitize the value * Changelog updated --------- Co-authored-by: Niraj Chaudhary <nirajchy2000@gmail.com>
* Fix - Security issue * Changelog updated --------- Co-authored-by: Niraj Chaudhary <nirajchy2000@gmail.com>
* Remove - Unused fields js when fields not used * Changelog updated --------- Co-authored-by: Niraj Chaudhary <nirajchy2000@gmail.com>
The vendor directory is already in .gitignore but was previously committed. Dependencies should be installed via composer install. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…re-and-package-fixes Added missing package, JS/CSS format rules, vscode local settings json.
Fix - IP Address & Details Handling
Dev - Add filters for form submit error messages
Divi Integration support for child theme added
* Fix - Popup draggable * fix: dragable issue for alert * changelog updated
* fix - parsing issue for file upload and render escaped html * fix - Parsing issue on the view entry * Fix - parsing issue on entry table * Fix - Parsing issue for the repeater field * fix: address field not parsing * fix: parsing address * added: more escaping for address and file upload * fix: changelog updated
* Fix - arbitary fiel upload issue * fix: warning when form is submitted when form has disable entries * changelog updated --------- Co-authored-by: Niraj Chaudhary <nirajchy2000@gmail.com>
* Update Settings.php * Update class-evf-form-fields.php --------- Co-authored-by: Niraj Chaudhary <nirajchy2000@gmail.com>
…_Reporting instantiation
* Enhancement - Option to copy and download log (wpeverest#1539) * add option to download and copy the logs * fix: log button responsive with issue * update:review comment * Enhancement - Integrations and Payments tab UI (wpeverest#1541) * add: integrations and payments tab * sidebar design update * update: integration design * update: opacity and icon * remove unwanted class * remove unwanted class * fix text domain * fix class issue * fix class exist * fix duplicate class issue * Fix - Email summaries support only one recipient and no test report flexibility. (wpeverest#1542) * option to send form static reporting at a time * fix send test report email address update issue * remove: nps * fix two time mail send while sending report mail * update: review report * update: review report * Dev - Coupon limit, stackable coupon (wpeverest#1546) * Fix - Coupon limit validation * fix: coupons not applied issue * pass: coupon data for coupon calculation on backend * pass: all coupon data for the coupon validation * merge pre-develop into EVF-2293-enhance/coupons * Dev - Payment Summary Field. (wpeverest#1545) * added: payment sumary description * fix: show payment history field on pro version * fix: saving the form due to the payment summary * added: show hide button for the payment history * fix: class not found issue * changelog updated * changelog updated * Enhancement - Form Builder UI/UX (wpeverest#1537) * Initial Commit * UI updates for field adding popover * Placement updates for fields popover * Popover added for row add button too * Ui updates for popover trigger button * Popover arrow UI added * Removed non-important comments * Layout options such as one-column container, two-column container, etc. * Enable grouping feature for fields. * fix : Field still hoverable after Selected * fix : Field popover placement issue fixed * fix: popup clipping issue * update: update selected count while duplicate * update:on group delete redirect to add field --------- Co-authored-by: som3669 <somshrestha3669@gmail.com> * change log update * change log update * fix: warning issue * fix: multipart issue in builder * remove error log * remove error log * fix: repeater field appending on next part when repeater field is used * fix: add button not showing on the repeater field when added * Enhancement - Performance Optimization (wpeverest#1551) * Fix:Style enqueque in other area * Fix:quires of intergration * Fix:Plugin optimization * merge pre-develop --------- Co-authored-by: Niraj Chaudhary <nirajchy2000@gmail.com> Co-authored-by: Niraj Chaudhary <99162269+NirajChaudhary143@users.noreply.github.com> * Revert "Fix - Email authorization." (wpeverest#1554) * fix: method exist function undefined * Fixed Text Domain in two files (wpeverest#1549) * Update Settings.php * Update class-evf-form-fields.php --------- Co-authored-by: Niraj Chaudhary <nirajchy2000@gmail.com> * Fix duplicate entries summary report emails by removing redundant EVF_Reporting instantiation * Revert "Fix - Email authorization. (wpeverest#1552)" This reverts commit c84d7d2. * changelog updated --------- Co-authored-by: DAnn2012 <dannunziata@hotmail.it> Co-authored-by: Deependra Chaudhary <elendoff11@gmail.com> * added: icon for the payment summary field * fix: coupons data not showing on the view entry * fix: design for the table * fix: text color * Evf design issue fixes (wpeverest#1555) * minor css fixes * updated fields css fixes * fixed builder issues --------- Co-authored-by: Niraj Chaudhary <nirajchy2000@gmail.com> * fix: design issue on the roles and permission * fix: design for the form field * fix: design issue on form templates * fixed form builder popup css issues * fix: ignore the payment summary to save * form builder design issues fixes * form builder desigh issue fixes * fix: analytics tab empty on free version * fix: design issue on form template * fix: undefined issue while exporting when form contains payment summary field * layout drag and drop (wpeverest#1557) * fix: array to string issue for the coupon * fix: design for the coupon header * fic: design for the coupon * minor css fixes * entries view page icon and title design issue * Evf 2329 new settings enhancement (wpeverest#1560) * css udpdate * css udpdate * css udpdate * update - setting design * fixed table dropdown alignment issue * design fixes on entries view page * design fixes on entries view page * design issue of builder settings * fix: payment checkbox parsing issue * Dev - User id not updating on entry when auto login (wpeverest#1559) * added: user registration logic hook * changelog updated * responsive issue on form builder tabs * fixed tooltip and responsive issue on builder * fix: payment checkbox parsing issue * changelog updted * form builder edit title box issue fixed * added: notification when fields reach the moving limit * css issues in entries table * form builder popover field issue fixed * fixed embed popup and popover field issue * fixed confitional logic hover issue * fixed badge issue * merge payment badge issue --------- Co-authored-by: Niraj Chaudhary <99162269+NirajChaudhary143@users.noreply.github.com> Co-authored-by: Rajat Gautam <83450756+rajatgautam755421@users.noreply.github.com> Co-authored-by: Niraj Chaudhary <nirajchy2000@gmail.com> Co-authored-by: Deependra Chaudhary <elendoff11@gmail.com> Co-authored-by: DAnn2012 <dannunziata@hotmail.it> Co-authored-by: sagun88 <124674480+sagun88@users.noreply.github.com> Co-authored-by: sagun88 <sagun.poudel@themegrill.com>
…date_nonce Restore check_ajax_referer() in ajax_form_submission() that was commented out, allowing unauthenticated form submissions. Replace the forgeable Referer header check in get_form_update_nonce() with proper is_user_logged_in() + current_user_can() checks. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR fixes an authorization bypass vulnerability (CWE-862) that allows unauthenticated attackers to submit arbitrary form data.
Vulnerability Details
Two code defects combine into the bypass:
Security check commented out in
ajax_form_submission()(line 670):check_ajax_referer()was commented out, removing the first layer of nonce verification for unauthenticated form submissionsWeak Referer-only check in
get_form_update_nonce()(lines 2289-2296):wp_get_referer()which is trivially forgeableeverest-forms_process_submit) matches the action name checked inclass-evf-form-task.php, enabling attackers to obtain valid submission nonces without authenticationFix
check_ajax_referer( "everest_forms_ajax_form_submission", "security" )inajax_form_submission()get_form_update_nonce()withis_user_logged_in()+current_user_can("edit_posts")Impact
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N(5.3 Medium)