Security: require capability checks on privileged network-admin AJAX endpoints#1371
Security: require capability checks on privileged network-admin AJAX endpoints#1371vuckro wants to merge 2 commits into
Conversation
… endpoints Several network-admin AJAX endpoints were registered on wp_ajax_* with no capability check, so any authenticated user (including a subscriber on a sub-site) could reach them. None of these are wired to customer-facing UI; they all back network-admin tools. This enforces manage_network on: - Ajax::search_models / search_all_models — returned network-wide objects and, for the 'user' model, WordPress logins and email addresses (user/email enumeration). - View_Logs_Admin_Page::handle_view_logs — also replaces the substring "is it under the logs folder?" check with realpath() containment so a crafted path can no longer traverse out of the logs directory and read arbitrary files (e.g. wp-config.php). - System_Info_Admin_Page::generate_text_file_system_info — system report. - Dashboard_Widgets::process_ajax_fetch_rss — also pins the outbound feed URL to the plugin's own community feed (filterable) so the endpoint can no longer be used as an SSRF probe; and handle_table_csv. - Domain_Manager::get_dns_records and ::test_integration — DNS lookups and hosting-provider connection tests. - Site_Manager::get_site_screenshot — screenshot scraper. - Template_Placeholders::save_placeholders / serve_placeholders_via_ajax. - Base_Customer_Facing_Admin_Page customize form: capability 'exist' (any logged-in user) raised to 'manage_network'. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 3 minutes and 8 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
2 participants
Summary
Several
wp_ajax_*endpoints that back network-admin tools were registeredwith no capability check, so any authenticated user (including a subscriber on a
sub-site) could reach them. None of these are wired to customer-facing UI.
This enforces
manage_networkon each, and adds two endpoint-specific hardenings.Changes
Ajax::search_models/search_all_models— returned network-wide objectsand, for the
usermodel, WordPress logins and email addresses(user/email enumeration). Restricted to network admins.
View_Logs_Admin_Page::handle_view_logs— capability check and the"is this under the logs folder?" substring test replaced with
realpath()containment so a crafted path can no longer traverse out of the logs
directory (arbitrary file read).
Dashboard_Widgets::process_ajax_fetch_rss— capability check and theoutbound feed URL is now pinned to the plugin's own community feed
(filterable), removing an SSRF vector; plus
handle_table_csv.System_Info_Admin_Page::generate_text_file_system_info— system report.Domain_Manager::get_dns_records/test_integration— DNS lookups andhosting-provider connection tests.
Site_Manager::get_site_screenshot— screenshot scraper.Template_Placeholders::save_placeholders/serve_placeholders_via_ajax.Base_Customer_Facing_Admin_Pagecustomize form: capabilityexistraised to
manage_network.Compatibility
These endpoints are only ever invoked from network-admin screens, so legitimate
use is unaffected. The customer-facing DNS flow uses a different action
(
wu_get_dns_records_for_domain) and is not touched.Part of a small series of focused security hardening PRs. Full technical detail
is available privately to the maintainers on request (coordinated disclosure).