Skip to content

Feature/fix security issue #408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sumaisa-mou merged 5 commits into from
May 23, 2026
Merged

Feature/fix security issue #408

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c87c409
Merge branch 'release/2.1.0'
sumaisa-mou Mar 31, 2026
32d6921
Merge branch 'release/2.1.1'
sumaisa-mou Apr 28, 2026
67e78e4
Merge branch 'release/2.1.2'
sumaisa-mou May 13, 2026
f4e7e47
Merge branch 'master' into develop
sumaisa-mou May 22, 2026
ddcfd4c
Fix reflected XSS vulnerability in form preview AJAX handler
sumaisa-mou May 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion includes/Admin/FormPreview.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,8 @@

$this->add_action( 'wp_ajax_wemail_preview', 'render_form_component' );

if ( isset( $_GET['action'], $_GET['form_id'] ) ) {

Check warning on line 23 in includes/Admin/FormPreview.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Processing form data without nonce verification.

Check warning on line 23 in includes/Admin/FormPreview.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Processing form data without nonce verification.
$this->form_id = sanitize_text_field( wp_unslash( $_GET['form_id'] ) );

Check warning on line 24 in includes/Admin/FormPreview.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Processing form data without nonce verification.
}
}

Expand All @@ -33,6 +33,12 @@
* @return string
*/
public function render_form_component() {
if ( ! wemail()->user->can( 'view_form' ) ) {
wp_die( esc_html__( 'You do not have permission to access this page.', 'wemail' ), 403 );
}

check_ajax_referer( 'wemail_form_preview', 'nonce' );

global $wp_scripts;
$form = wemail_form( $this->form_id, true );
?>
Expand All @@ -52,7 +58,7 @@
</head>
<body>
<div>
<?php printf( '<div id="preview-wemail-form" data-form-type="%s"><wemail-form-preview id="%s"/></div>', $form['type'], $this->form_id ); ?>
<?php printf( '<div id="preview-wemail-form" data-form-type="%s"><wemail-form-preview id="%s"/></div>', esc_attr( $form['type'] ), esc_attr( $this->form_id ) ); ?>
</div>

<script src="<?php /** phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript */ echo get_site_url() . $wp_scripts->registered['jquery-core']->src; ?>"></script>
Expand Down
3 changes: 2 additions & 1 deletion includes/Admin/GutenbergBlock.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
$block_meta = require_once WEMAIL_PATH . '/assets/js/block/index.asset.php';

wp_register_style( 'wemail-block-style', WEMAIL_ASSETS . '/css/gutenberg.css', array(), WEMAIL_VERSION );
wp_register_script( 'wemail-block-script', WEMAIL_ASSETS . '/js/block/index.js', $block_meta['dependencies'], $block_meta['version'] );

Check warning on line 21 in includes/Admin/GutenbergBlock.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

In footer ($in_footer) is not set explicitly wp_register_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.

register_block_type(
'wemail/forms',
Expand All @@ -41,8 +41,9 @@
'wemail-block-script',
'weMailData',
array(
'forms' => $forms ? $forms : array(),
'forms' => $forms ? $forms : array(),
'siteUrl' => get_site_url(),
'previewNonce' => wp_create_nonce( 'wemail_form_preview' ),
)
);
}
Expand Down
2 changes: 1 addition & 1 deletion src/blocks/wemail-form/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ registerBlockType('wemail/forms', {
<div height="500px" className="wemail-block-form-preview">
<div className="wemail-block-overlay"/>
<iframe className={props.attributes.isLoading ? 'hide' : ''} onLoad={loadForm} width="100%"
src={`${window.weMailData.siteUrl}/wp-admin/admin-ajax.php?action=wemail_preview&form_id=${encodeURIComponent(formId)}`}
src={`${window.weMailData.siteUrl}/wp-admin/admin-ajax.php?action=wemail_preview&form_id=${encodeURIComponent(formId)}&nonce=${encodeURIComponent(window.weMailData.previewNonce)}`}
frameBorder="0" scrolling="no"/>
{
props.attributes.isLoading ?
Expand Down
Loading