Security: require capability checks on privileged network-admin AJAX endpoints#1371
Security: require capability checks on privileged network-admin AJAX endpoints#1371vuckro wants to merge 1 commit into
Conversation
… endpoints Several network-admin AJAX endpoints were registered on wp_ajax_* with no capability check, so any authenticated user (including a subscriber on a sub-site) could reach them. None of these are wired to customer-facing UI; they all back network-admin tools. This enforces manage_network on: - Ajax::search_models / search_all_models — returned network-wide objects and, for the 'user' model, WordPress logins and email addresses (user/email enumeration). - View_Logs_Admin_Page::handle_view_logs — also replaces the substring "is it under the logs folder?" check with realpath() containment so a crafted path can no longer traverse out of the logs directory and read arbitrary files (e.g. wp-config.php). - System_Info_Admin_Page::generate_text_file_system_info — system report. - Dashboard_Widgets::process_ajax_fetch_rss — also pins the outbound feed URL to the plugin's own community feed (filterable) so the endpoint can no longer be used as an SSRF probe; and handle_table_csv. - Domain_Manager::get_dns_records and ::test_integration — DNS lookups and hosting-provider connection tests. - Site_Manager::get_site_screenshot — screenshot scraper. - Template_Placeholders::save_placeholders / serve_placeholders_via_ajax. - Base_Customer_Facing_Admin_Page customize form: capability 'exist' (any logged-in user) raised to 'manage_network'. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 29 minutes and 20 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Several
wp_ajax_*endpoints that back network-admin tools were registeredwith no capability check, so any authenticated user (including a subscriber on a
sub-site) could reach them. None of these are wired to customer-facing UI.
This enforces
manage_networkon each, and adds two endpoint-specific hardenings.Changes
Ajax::search_models/search_all_models— returned network-wide objectsand, for the
usermodel, WordPress logins and email addresses(user/email enumeration). Restricted to network admins.
View_Logs_Admin_Page::handle_view_logs— capability check and the"is this under the logs folder?" substring test replaced with
realpath()containment so a crafted path can no longer traverse out of the logs
directory (arbitrary file read).
Dashboard_Widgets::process_ajax_fetch_rss— capability check and theoutbound feed URL is now pinned to the plugin's own community feed
(filterable), removing an SSRF vector; plus
handle_table_csv.System_Info_Admin_Page::generate_text_file_system_info— system report.Domain_Manager::get_dns_records/test_integration— DNS lookups andhosting-provider connection tests.
Site_Manager::get_site_screenshot— screenshot scraper.Template_Placeholders::save_placeholders/serve_placeholders_via_ajax.Base_Customer_Facing_Admin_Pagecustomize form: capabilityexistraised to
manage_network.Compatibility
These endpoints are only ever invoked from network-admin screens, so legitimate
use is unaffected. The customer-facing DNS flow uses a different action
(
wu_get_dns_records_for_domain) and is not touched.Part of a small series of focused security hardening PRs. Full technical detail
is available privately to the maintainers on request (coordinated disclosure).