Changeset 55769

Timestamp:

05/16/2023 02:47:21 PM (3 years ago)

Author:

audrasjb

Message:

Media: Prevent CSRF setting attachment thumbnails.

Props martinkrcho, paulkevan, peterwilsoncc, xknown, peterwilsoncc.
Merges [55764] to branch 6.2.

Location:

branches/6.2

Files:

• src/js/media/views/frame/video-details.js (modified) (1 diff)
• src/wp-admin/includes/ajax-actions.php (modified) (1 diff)
• src/wp-includes/media.php (modified) (1 diff)
• tests/phpunit/tests/ajax/wpAjaxSendAttachmentToEditor.php (modified) (1 diff)

branches/6.2/src/js/media/views/frame/video-details.js

@@ -107 +107 @@
                         wp.ajax.send( 'set-attachment-thumbnail', {
                                 data : {
+                                        _ajax_nonce: wp.media.view.settings.nonce.setAttachmentThumbnail,
                                         urls: urls,
                                         thumbnail_id: attachment.get( 'id' )

branches/6.2/src/wp-admin/includes/ajax-actions.php

@@ -2772 +2772 @@
         }
 
+        if ( false === check_ajax_referer( 'set-attachment-thumbnail', '_ajax_nonce', false ) ) {
+                wp_send_json_error();
+        }
+
         $post_ids = array();
         // For each URL, try to find its corresponding post ID.

branches/6.2/src/wp-includes/media.php

@@ -4529 +4529 @@
                 'captions'          => ! apply_filters( 'disable_captions', '' ),
                 'nonce'             => array(
-                        'sendToEditor' => wp_create_nonce( 'media-send-to-editor' ),
+                        'sendToEditor'           => wp_create_nonce( 'media-send-to-editor' ),
+                        'setAttachmentThumbnail' => wp_create_nonce( 'set-attachment-thumbnail' ),
                 ),
                 'post'              => array(

branches/6.2/tests/phpunit/tests/ajax/wpAjaxSendAttachmentToEditor.php

@@ -102 +102 @@
                 $this->assertSame( $expected, $response['data'] );
         }
+
+        public function test_wp_ajax_set_attachment_thumbnail_success() {
+                // Become an administrator.
+                $post    = $_POST;
+                $user_id = self::factory()->user->create(
+                        array(
+                                'role'       => 'administrator',
+                                'user_login' => 'user_36578_administrator',
+                                'user_email' => 'user_36578_administrator@example.com',
+                        )
+                );
+                wp_set_current_user( $user_id );
+                $_POST = array_merge( $_POST, $post );
+
+                // Upload the attachment itself.
+                $filename = DIR_TESTDATA . '/uploads/small-audio.mp3';
+                $contents = file_get_contents( $filename );
+
+                $upload     = wp_upload_bits( wp_basename( $filename ), null, $contents );
+                $attachment = $this->_make_attachment( $upload );
+
+                // Upload the thumbnail.
+                $filename = DIR_TESTDATA . '/images/waffles.jpg';
+                $contents = file_get_contents( $filename );
+
+                $upload    = wp_upload_bits( wp_basename( $filename ), null, $contents );
+                $thumbnail = $this->_make_attachment( $upload );
+
+                // Set up a default request.
+                $_POST['_ajax_nonce']  = wp_create_nonce( 'set-attachment-thumbnail' );
+                $_POST['thumbnail_id'] = $thumbnail;
+                $_POST['urls']         = array( wp_get_attachment_url( $attachment ) );
+
+                // Make the request.
+                try {
+                        $this->_handleAjax( 'set-attachment-thumbnail' );
+                } catch ( WPAjaxDieContinueException $e ) {
+                        unset( $e );
+                }
+
+                // Get the response.
+                $response = json_decode( $this->_last_response, true );
+
+                // Ensure everything is correct.
+                $this->assertTrue( $response['success'] );
+        }
+
+        public function test_wp_ajax_set_attachment_thumbnail_missing_nonce() {
+                // Become an administrator.
+                $post    = $_POST;
+                $user_id = self::factory()->user->create(
+                        array(
+                                'role'       => 'administrator',
+                                'user_login' => 'user_36578_administrator',
+                                'user_email' => 'user_36578_administrator@example.com',
+                        )
+                );
+                wp_set_current_user( $user_id );
+                $_POST = array_merge( $_POST, $post );
+
+                // Upload the attachment itself.
+                $filename = DIR_TESTDATA . '/uploads/small-audio.mp3';
+                $contents = file_get_contents( $filename );
+
+                $upload     = wp_upload_bits( wp_basename( $filename ), null, $contents );
+                $attachment = $this->_make_attachment( $upload );
+
+                // Upload the thumbnail.
+                $filename = DIR_TESTDATA . '/images/waffles.jpg';
+                $contents = file_get_contents( $filename );
+
+                $upload    = wp_upload_bits( wp_basename( $filename ), null, $contents );
+                $thumbnail = $this->_make_attachment( $upload );
+
+                // Set up a default request.
+                $_POST['thumbnail_id'] = $thumbnail;
+                $_POST['urls']         = array( wp_get_attachment_url( $attachment ) );
+
+                // Make the request.
+                try {
+                        $this->_handleAjax( 'set-attachment-thumbnail' );
+                } catch ( WPAjaxDieContinueException $e ) {
+                        unset( $e );
+                }
+
+                // Get the response.
+                $response = json_decode( $this->_last_response, true );
+
+                // Check that success is false without sending nonce.
+                $this->assertFalse( $response['success'] );
+        }
 }