Skip to content

Fix: add per-post capability check to add_ignore AJAX handler #1712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SteveJonesDev merged 10 commits into from
May 20, 2026
Merged

Fix: add per-post capability check to add_ignore AJAX handler #1712

Changes from 3 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
8c362f7
Merge pull request #1707 from equalizedigital/release/1.42.0
pattonwebz May 19, 2026
2912ade
Fix missing capability check in add_ignore AJAX handler
SteveJonesDev May 20, 2026
e484363
Expand add_ignore capability check to all affected posts
SteveJonesDev May 20, 2026
9fb22d2
Eliminate duplicate object lookup in largeBatch capability check
SteveJonesDev May 20, 2026
81d3b40
Address CodeRabbit and Gemini review feedback
SteveJonesDev May 20, 2026
e919d7d
Bump version to 1.42.1 and update changelog
SteveJonesDev May 20, 2026
719272c
Update changelog to standardize terminology for ignore feature
SteveJonesDev May 20, 2026
ff6109e
Tests: use real WP_Screen in screen mocks for WP 7.0 compatibility
Copilot May 20, 2026
2a7b569
Tests: use WP_Screen::get() over set_current_screen() to avoid global…
pattonwebz May 20, 2026
f5ee5d7
Merge pull request #1713 from pattonwebz/fix/wp-7-screen-mocks
pattonwebz May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 38 additions & 6 deletions admin/class-ajax.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -819,17 +819,49 @@ public function add_ignore() {
}

global $wpdb;
$table_name = $wpdb->prefix . 'accessibility_checker';
$raw_ids = isset( $_REQUEST['ids'] ) ? (array) wp_unslash( $_REQUEST['ids'] ) : []; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitization handled below.
$ids = array_map(
$table_name = $wpdb->prefix . 'accessibility_checker';
$raw_ids = isset( $_REQUEST['ids'] ) ? (array) wp_unslash( $_REQUEST['ids'] ) : []; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitization handled below.
$ids = array_map(
function ( $value ) {
return (int) $value;
},
$raw_ids
); // Sanitizing array elements to integers.
$action = isset( $_REQUEST['ignore_action'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['ignore_action'] ) ) : '';
$type = isset( $_REQUEST['ignore_type'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['ignore_type'] ) ) : '';
$siteid = get_current_blog_id();
$action = isset( $_REQUEST['ignore_action'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['ignore_action'] ) ) : '';
$type = isset( $_REQUEST['ignore_type'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['ignore_type'] ) ) : '';
$siteid = get_current_blog_id();

// Capability check: verify edit_post on every post affected by this request.
$first_id = reset( $ids );
$valid_table = edac_get_valid_table_name( $table_name );

if ( ! $first_id || ! $valid_table ) {
wp_send_json_error( new \WP_Error( '-2', __( 'No ignore data to return', 'accessibility-checker' ) ) );
}

if ( isset( $_REQUEST['largeBatch'] ) && 'true' === $_REQUEST['largeBatch'] ) {
// largeBatch updates every row sharing the same object string across the site;
// collect all distinct postids that would be affected and check each one.
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Permission check requires direct lookup.
$batch_object = $wpdb->get_var( $wpdb->prepare( 'SELECT object FROM %i WHERE id = %d', $valid_table, $first_id ) );
if ( ! $batch_object ) {
wp_send_json_error( new \WP_Error( '-2', __( 'No ignore data to return', 'accessibility-checker' ) ) );
}
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Permission check requires direct lookup.
$affected_post_ids = $wpdb->get_col( $wpdb->prepare( 'SELECT DISTINCT postid FROM %i WHERE siteid = %d AND object = %s', $valid_table, $siteid, $batch_object ) );
Comment thread
coderabbitai[bot] marked this conversation as resolved.
} else {
// Small batch: look up the post for every supplied ID in one query.
$id_placeholders = implode( ', ', array_fill( 0, count( $ids ), '%d' ) );
$query_args = array_merge( [ $valid_table ], $ids );
$affected_post_ids = $wpdb->get_col( $wpdb->prepare( "SELECT DISTINCT postid FROM %i WHERE id IN ({$id_placeholders})", $query_args ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder -- Permission check requires direct lookup.
}

foreach ( (array) $affected_post_ids as $affected_post_id ) {
Comment thread
SteveJonesDev marked this conversation as resolved.
Outdated
if ( ! current_user_can( 'edit_post', (int) $affected_post_id ) ) {
wp_send_json_error( new \WP_Error( '-5', __( 'Permission Denied', 'accessibility-checker' ) ) );
}
}
Comment thread
coderabbitai[bot] marked this conversation as resolved.

$ignre = ( 'enable' === $action ) ? 1 : 0;
$ignre_user = ( 'enable' === $action ) ? get_current_user_id() : null;
$ignre_user_info = ( 'enable' === $action ) ? get_userdata( $ignre_user ) : '';
Expand Down
Loading