Skip to content

Enhance security checks and improve I18N handling #160

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alimuzzaman wants to merge 23 commits into
base: master
Choose a base branch
from
Open

Enhance security checks and improve I18N handling #160

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
95e00ff
Improve I18N Issue based on 2.5.3
alexclassroom Sep 15, 2025
a60017c
Merge branch 'WPDevelopers:master' into master
alexclassroom Nov 5, 2025
e6fd88a
Merge branch 'WPDevelopers:master' into master
alexclassroom Dec 3, 2025
24752f0
Merge branch 'WPDevelopers:master' into master
alexclassroom Jan 26, 2026
c6714a3
Security: remove HTTP_REFERER trust from is_network_admin() #4
alimuzzaman Mar 29, 2026
e3ed4b9
Security: add capability check to disable_comments_settings() #1
alimuzzaman Mar 29, 2026
8921f5d
Security: add capability and per-blog auth checks to delete_comments_…
alimuzzaman Mar 29, 2026
854eb86
Security: escape role names to prevent DOM XSS in role exclusion UI #3
alimuzzaman Mar 29, 2026
6cd801a
Security: add capability check to get_sub_sites() to prevent subsite …
alimuzzaman Mar 29, 2026
60bd5f3
Exclude .claude/ worktrees from git tracking and distribution zips
alimuzzaman Mar 29, 2026
c9b578a
Security: derive network context from POST data, not is_network_admin()
alimuzzaman Mar 29, 2026
9e9fe6d
Exclude pnpm-lock.yaml from distribution
alimuzzaman Mar 29, 2026
6f54eea
Merge pull request #156 from alexclassroom/master
alimuzzaman Mar 29, 2026
9fa11c9
Fix esc_html__ stripping HTML tags in admin notice
alimuzzaman Mar 29, 2026
b996182
Security: gate update_site_option on network action capability check
alimuzzaman Mar 29, 2026
6e5a776
Fix is_network_admin() AJAX context and unify network action detection
alimuzzaman Mar 29, 2026
78478d0
Address Copilot review suggestions from PR #160
alimuzzaman Mar 29, 2026
2c86f7f
Fix UI error handling and double-encoding in role names
alimuzzaman Mar 29, 2026
5e6657a
Handle new server error responses in JS
alimuzzaman Mar 29, 2026
e41335c
Fix nonce failure silently returning success in delete_comments_setti…
alimuzzaman Mar 30, 2026
8693705
Fix nonce failure silently returning success in disable_comments_sett…
Copilot Mar 30, 2026
7cab84b
Merge master and retain security hardening
alimuzzaman Aug 30, 2026
94843b1
fix(security): guard subsite AJAX on single-site
alimuzzaman Aug 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 32 additions & 6 deletions assets/js/disable-comments-settings-scripts.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,12 @@ jQuery(document).ready(function ($) {
},
};
},
formatAjaxError: function(jqXHR) {
var msg = jqXHR.responseJSON && jqXHR.responseJSON.data && jqXHR.responseJSON.data.message
? jqXHR.responseJSON.data.message
: __('Something went wrong!', 'disable-comments');
Swal.fire({ icon: 'error', title: __('Oops...', 'disable-comments'), text: msg });
},
callback : function(data, pagination) {
var pageNumber = pagination.pageNumber;
addSites($sites_list, data, type);
Expand Down Expand Up @@ -319,14 +325,24 @@ jQuery(document).ready(function ($) {
});
saveBtn.removeClass('form-dirty').prop('disabled', true);
savedData = $form.serialize();
} else {
saveBtn.html(__("Save Settings", "disable-comments"));
Swal.fire({
icon: "error",
title: __("Oops...", "disable-comments"),
text: response.data && response.data.message ? response.data.message : __("Something went wrong!", "disable-comments"),
});
}
},
error: function () {
saveBtn.html("Save Settings");
error: function (jqXHR) {
saveBtn.html(__("Save Settings", "disable-comments"));
var msg = jqXHR.responseJSON && jqXHR.responseJSON.data && jqXHR.responseJSON.data.message
? jqXHR.responseJSON.data.message
: __("Something went wrong!", "disable-comments");
Swal.fire({
type: "error",
icon: "error",
title: __("Oops...", "disable-comments"),
text: __("Something went wrong!", "disable-comments"),
text: msg,
});
},
});
Expand Down Expand Up @@ -369,18 +385,28 @@ jQuery(document).ready(function ($) {
Swal.fire({
icon: "success",
title: __("Deleted", "disable-comments"),
html: response.data.message,
text: response.data.message,
timer: 3000,
showConfirmButton: false,
});
} else {
Swal.fire({
icon: "error",
title: __("Oops...", "disable-comments"),
html: response.data.message,
text: response.data && response.data.message ? response.data.message : __("Something went wrong!", "disable-comments"),
showConfirmButton: true,
});
}
}).fail(function (jqXHR) {
deleteBtn.html(__("Delete Comments", "disable-comments"));
var msg = jqXHR.responseJSON && jqXHR.responseJSON.data && jqXHR.responseJSON.data.message
? jqXHR.responseJSON.data.message
: __("Something went wrong!", "disable-comments");
Swal.fire({
icon: "error",
title: __("Oops...", "disable-comments"),
text: msg,
});
});
}
});
Expand Down
26 changes: 18 additions & 8 deletions disable-comments.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1519,15 +1519,17 @@ public function settings_page() {
public function get_sub_sites() {
$nonce = (isset($_REQUEST['nonce']) ? sanitize_text_field(wp_unslash($_REQUEST['nonce'])) : '');
if (!wp_verify_nonce($nonce, 'disable_comments_save_settings')) {
wp_send_json(['data' => [], 'totalNumber' => 0]);
wp_send_json_error(['message' => __('Invalid request. Please refresh the page and try again.', 'disable-comments')], 403);
}
if (!is_multisite() || !function_exists('get_sites')) {
wp_send_json_error(['message' => __('Subsite listing is only available on multisite.', 'disable-comments')], 400);
}
// Listing subsites is always a network-level operation on multisite —
// require manage_network_plugins regardless of how the plugin is activated
// (network-wide or per-site). A per-site admin must never enumerate all
// network sites. On single-site installs manage_options suffices.
$required_cap = is_multisite() ? 'manage_network_plugins' : 'manage_options';
if (!current_user_can($required_cap)) {
wp_send_json(['data' => [], 'totalNumber' => 0]);
if (!current_user_can('manage_network_plugins')) {
wp_send_json_error(['message' => __('Sorry, you are not allowed to access this resource.', 'disable-comments')], 403);
}

$_sub_sites = [];
Expand Down Expand Up @@ -1584,7 +1586,11 @@ public function get_form_array_escaped($_args = array()) {

public function disable_comments_settings($_args = array()) {
$nonce = (isset($_POST['nonce']) ? sanitize_text_field(wp_unslash($_POST['nonce'])) : '');
if (($this->is_CLI && !empty($_args)) || wp_verify_nonce($nonce, 'disable_comments_save_settings')) {
if (!$this->is_CLI && !wp_verify_nonce($nonce, 'disable_comments_save_settings')) {
wp_send_json_error(['message' => __('Nonce verification failed.', 'disable-comments')], 403);
}

if (($this->is_CLI && !empty($_args)) || !$this->is_CLI) {
// Resolve context ONCE — used for both cap check and save routing.
$is_network_ctx = $this->is_network_admin_ajax_context();

Expand All @@ -1600,7 +1606,7 @@ public function disable_comments_settings($_args = array()) {
$required_cap = 'manage_options';
}
if (!current_user_can($required_cap)) {
wp_send_json_error(['message' => 'Insufficient permissions.'], 403);
wp_send_json_error(['message' => __('Insufficient permissions.', 'disable-comments')], 403);
}
}

Expand Down Expand Up @@ -1715,7 +1721,11 @@ public function delete_comments_settings($_args = array()) {
$log = '';
$nonce = (isset($_POST['nonce']) ? sanitize_text_field(wp_unslash($_POST['nonce'])) : '');

if (($this->is_CLI && !empty($_args)) || wp_verify_nonce($nonce, 'disable_comments_save_settings')) {
if (!$this->is_CLI && !wp_verify_nonce($nonce, 'disable_comments_save_settings')) {
wp_send_json_error(['message' => __('Nonce verification failed.', 'disable-comments')], 403);
}

if (($this->is_CLI && !empty($_args)) || !$this->is_CLI) {
// Resolve context ONCE — used for both cap check and deletion routing.
$is_network_ctx = $this->is_network_admin_ajax_context();

Expand All @@ -1728,7 +1738,7 @@ public function delete_comments_settings($_args = array()) {
$required_cap = 'manage_options';
}
if (!current_user_can($required_cap)) {
wp_send_json_error(['message' => 'Insufficient permissions.'], 403);
wp_send_json_error(['message' => __('Insufficient permissions.', 'disable-comments')], 403);
}
}

Expand Down
Loading
Loading