Skip to content

Hardening #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
afragen merged 4 commits into from
Nov 20, 2025
Merged

Hardening #68

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5212fe9
set guard on `handle_action()` to administrator
afragen Nov 20, 2025
bc89a2d
don't show 'plc_did' post type in REST, consider setting export to false
afragen Nov 20, 2025
98414f1
move guard to each function
afragen Nov 20, 2025
f6fc7fb
move after nonce check and use uniform wp_die message
afragen Nov 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions inc/admin/namespace.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -333,6 +333,11 @@ function handle_action( int $post_id ) {
function on_sync( DID $did ) {
check_admin_referer( NONCE_PREFIX . ACTION_SYNC );

// Check user permissions.
if ( ! current_user_can( 'manage_options' ) ) {
wp_die( __( 'You do not have sufficient permissions to access this page.', 'mini-fair' ) );
}

try {
$did->update();
wp_redirect( get_edit_post_link( $did->get_internal_post_id(), 'raw' ) );
Expand All @@ -351,6 +356,11 @@ function on_sync( DID $did ) {
function on_resign( DID $did ) {
check_admin_referer( NONCE_PREFIX . ACTION_RESIGN );

// Check user permissions.
if ( ! current_user_can( 'manage_options' ) ) {
wp_die( __( 'You do not have sufficient permissions to access this page.', 'mini-fair' ) );
}

try {
MiniFAIR\update_metadata( $did, true );
wp_redirect( get_edit_post_link( $did->get_internal_post_id(), 'raw' ) );
Expand All @@ -367,6 +377,11 @@ function on_resign( DID $did ) {
* @return void
*/
function on_add_key( DID $did ) {
// Check user permissions.
if ( ! current_user_can( 'manage_options' ) ) {
wp_die( __( 'You do not have sufficient permissions to access this page.', 'mini-fair' ) );
}

// Handle adding a new verification key.
$did->generate_verification_key();

Expand All @@ -387,6 +402,11 @@ function on_add_key( DID $did ) {
* @param DID $did The DID.
*/
function on_revoke_key( DID $did ) {
// Check user permissions.
if ( ! current_user_can( 'manage_options' ) ) {
wp_die( __( 'You do not have sufficient permissions to access this page.', 'mini-fair' ) );
}

// phpcs:ignore HM.Security.NonceVerification.Missing -- Nonce verification has already been performed.
$key_id = sanitize_text_field( wp_unslash( $_POST['key_id'] ?? '' ) );
if ( empty( $key_id ) ) {
Expand Down
2 changes: 2 additions & 0 deletions inc/plc/namespace.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,8 @@ function register_types() : void {
'public' => true,
'show_ui' => true,
'show_in_menu' => Admin\PAGE_SLUG,
'show_in_rest' => false,
// 'can_export' => false,
'supports' => [ 'title', 'editor', 'custom-fields' ],
'label' => __( 'PLC DIDs', 'mini-fair' ),
'labels' => [
Expand Down