Changeset 38168 for trunk/src/wp-admin/includes/ajax-actions.php

Timestamp:

07/27/2016 05:42:01 PM (8 years ago)

Author:

ocean90

Message:

Plugins: Move capability checks further up in wp_ajax_update_plugin() and wp_ajax_delete_plugin().

Add tests for both Ajax handlers.

Props Yorick Koster, swissspidy.
Fixes #37490.

File:

• trunk/src/wp-admin/includes/ajax-actions.php (modified) (2 diffs)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -3654 +3654 @@
     }
 
-    $plugin      = plugin_basename( sanitize_text_field( wp_unslash( $_POST['plugin'] ) ) );
-    $plugin_data = get_plugin_data( WP_PLUGIN_DIR . '/' . $plugin );
+    $plugin = plugin_basename( sanitize_text_field( wp_unslash( $_POST['plugin'] ) ) );
 
     $status = array(
         'update'     => 'plugin',
-        'plugin'     => $plugin,
         'slug'       => sanitize_key( wp_unslash( $_POST['slug'] ) ),
-        'pluginName' => $plugin_data['Name'],
         'oldVersion' => '',
         'newVersion' => '',
     );
 
+    if ( ! current_user_can( 'update_plugins' ) || 0 !== validate_file( $plugin ) ) {
+        $status['errorMessage'] = __( 'Sorry, you are not allowed to update plugins for this site.' );
+        wp_send_json_error( $status );
+    }
+
+    $plugin_data          = get_plugin_data( WP_PLUGIN_DIR . '/' . $plugin );
+    $status['plugin']     = $plugin;
+    $status['pluginName'] = $plugin_data['Name'];
+
     if ( $plugin_data['Version'] ) {
         /* translators: %s: Plugin version */
         $status['oldVersion'] = sprintf( __( 'Version %s' ), $plugin_data['Version'] );
-    }
-
-    if ( ! current_user_can( 'update_plugins' ) ) {
-        $status['errorMessage'] = __( 'Sorry, you are not allowed to update plugins for this site.' );
-        wp_send_json_error( $status );
     }
 
@@ -3749 +3750 @@
 
     if ( empty( $_POST['slug'] ) || empty( $_POST['plugin'] ) ) {
-        wp_send_json_error( array( 'errorCode' => 'no_plugin_specified' ) );
-    }
-
-    $plugin      = plugin_basename( sanitize_text_field( wp_unslash( $_POST['plugin'] ) ) );
-    $plugin_data = get_plugin_data( WP_PLUGIN_DIR . '/' . $plugin );
+        wp_send_json_error( array(
+            'slug'         => '',
+            'errorCode'    => 'no_plugin_specified',
+            'errorMessage' => __( 'No plugin specified.' ),
+        ) );
+    }
+
+    $plugin = plugin_basename( sanitize_text_field( wp_unslash( $_POST['plugin'] ) ) );
 
     $status = array(
-        'delete'     => 'plugin',
-        'slug'       => sanitize_key( wp_unslash( $_POST['slug'] ) ),
-        'plugin'     => $plugin,
-        'pluginName' => $plugin_data['Name'],
+        'delete' => 'plugin',
+        'slug'   => sanitize_key( wp_unslash( $_POST['slug'] ) ),
     );
 
-    if ( ! current_user_can( 'delete_plugins' ) ) {
+    if ( ! current_user_can( 'delete_plugins' ) || 0 !== validate_file( $plugin ) ) {
         $status['errorMessage'] = __( 'Sorry, you are not allowed to delete plugins for this site.' );
         wp_send_json_error( $status );
     }
+
+    $plugin_data          = get_plugin_data( WP_PLUGIN_DIR . '/' . $plugin );
+    $status['plugin']     = $plugin;
+    $status['pluginName'] = $plugin_data['Name'];
 
     if ( is_plugin_active( $plugin ) ) {