Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GH-179 : Implement nonce verification for Ajax calls #285

Merged
merged 10 commits into from
Feb 26, 2024
Merged

Conversation

SohamPatel46
Copy link
Contributor

@SohamPatel46 SohamPatel46 commented Feb 21, 2024

Description

  • This PR adds WordPress Nonce fields to forms and check_ajax_referer for AJAX callbacks to ensure the security of requests.

@SohamPatel46 SohamPatel46 marked this pull request as ready for review February 21, 2024 10:51
rtBot

This comment was marked as resolved.

@rtBot rtBot dismissed their stale review February 21, 2024 10:54

Dismissing review as all inline comments are obsolete by now

Copy link
Member

@AnuragVasanwala AnuragVasanwala left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM ✅

Let's wait for @gagan0123's review.

@gagan0123
Copy link
Member

@SohamPatel46

Can you please check why "End-to-End Tests / Playwright Tests (pull_request) " is failing and fix that before the PR is merged?

admin/js/rt-transcoder-admin.js Outdated Show resolved Hide resolved
admin/rt-transcoder-admin.php Outdated Show resolved Hide resolved
package-lock.json Outdated Show resolved Hide resolved
admin/js/build/rt-transcoder-block-editor-support.build.js Outdated Show resolved Hide resolved
admin/rt-transcoder-admin.php Outdated Show resolved Hide resolved
admin/js/rt-transcoder-admin.js Outdated Show resolved Hide resolved
@SohamPatel46
Copy link
Contributor Author

@gagan0123 Implemented specific nonce creation for every action.

Still there are 2 ajax callbacks whose action can't be located in the codebase - https://github.com/rtCamp/transcoder/blob/master/admin/rt-transcoder-handler.php#L183-#L184
Should we skip this or is there any way to tackle it ?

@gagan0123
Copy link
Member

@gagan0123 Implemented specific nonce creation for every action.

Still there are 2 ajax callbacks whose action can't be located in the codebase - https://github.com/rtCamp/transcoder/blob/master/admin/rt-transcoder-handler.php#L183-#L184 Should we skip this or is there any way to tackle it ?

@SohamPatel46 You can remove that part of code, I've verified that it was used before, but later the functionality was removed without removing the WP AJAX endpoints.
So remove both ensuring:

  • The add_action for the two WP AJAX requests are removed as well
  • The callback functions are also removed, after verifying they are not used anywhere else in the code

@SohamPatel46
Copy link
Contributor Author

@gagan0123 Removed unused AJAX actions and callback. Can you re-review it ?

@gagan0123
Copy link
Member

Thanks @SohamPatel46 for the PR 👍

@pavanpatil1 can you please test this branch to ensure the functionality is not impacted. Code looks good to me.

@SohamPatel46 SohamPatel46 merged commit 064fd5a into master Feb 26, 2024
3 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants