Skip to content
This repository was archived by the owner on Aug 22, 2025. It is now read-only.

GH-179 : Implement nonce verification for Ajax calls#285

Merged
SohamPatel46 merged 10 commits intomasterfrom
fix/GH-179
Feb 26, 2024
Merged

GH-179 : Implement nonce verification for Ajax calls#285
SohamPatel46 merged 10 commits intomasterfrom
fix/GH-179

Conversation

@SohamPatel46
Copy link
Copy Markdown
Contributor

@SohamPatel46 SohamPatel46 commented Feb 21, 2024

Description

  • This PR adds WordPress Nonce fields to forms and check_ajax_referer for AJAX callbacks to ensure the security of requests.

@SohamPatel46 SohamPatel46 marked this pull request as ready for review February 21, 2024 10:51
rtBot

This comment was marked as resolved.

@rtBot rtBot dismissed their stale review February 21, 2024 10:54

Dismissing review as all inline comments are obsolete by now

Copy link
Copy Markdown
Member

@AnuragVasanwala AnuragVasanwala left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM ✅

Let's wait for @gagan0123's review.

@gagan0123
Copy link
Copy Markdown
Member

@SohamPatel46

Can you please check why "End-to-End Tests / Playwright Tests (pull_request) " is failing and fix that before the PR is merged?

Comment thread admin/js/rt-transcoder-admin.js Outdated
Comment thread admin/rt-transcoder-admin.php Outdated
Comment thread package-lock.json Outdated
Comment thread admin/js/build/rt-transcoder-block-editor-support.build.js
Comment thread admin/rt-transcoder-admin.php Outdated
Comment thread admin/js/rt-transcoder-admin.js Outdated
Comment thread admin/js/build/rt-transcoder-block-editor-support.build.js
@SohamPatel46
Copy link
Copy Markdown
Contributor Author

@gagan0123 Implemented specific nonce creation for every action.

Still there are 2 ajax callbacks whose action can't be located in the codebase - https://github.com/rtCamp/transcoder/blob/master/admin/rt-transcoder-handler.php#L183-#L184
Should we skip this or is there any way to tackle it ?

@gagan0123
Copy link
Copy Markdown
Member

@gagan0123 Implemented specific nonce creation for every action.

Still there are 2 ajax callbacks whose action can't be located in the codebase - https://github.com/rtCamp/transcoder/blob/master/admin/rt-transcoder-handler.php#L183-#L184 Should we skip this or is there any way to tackle it ?

@SohamPatel46 You can remove that part of code, I've verified that it was used before, but later the functionality was removed without removing the WP AJAX endpoints.
So remove both ensuring:

  • The add_action for the two WP AJAX requests are removed as well
  • The callback functions are also removed, after verifying they are not used anywhere else in the code

@SohamPatel46
Copy link
Copy Markdown
Contributor Author

@gagan0123 Removed unused AJAX actions and callback. Can you re-review it ?

@gagan0123
Copy link
Copy Markdown
Member

Thanks @SohamPatel46 for the PR 👍

@pavanpatil1 can you please test this branch to ensure the functionality is not impacted. Code looks good to me.

@SohamPatel46 SohamPatel46 merged commit 064fd5a into master Feb 26, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants