Changeset 61838 for trunk/src/wp-includes/collaboration/class-wp-http-polling-sync-server.php

Timestamp:

03/05/2026 09:22:05 AM (3 months ago)

Author:

ellatrix

Message:

Real-time collaboration: check wp_user_id before accepting awareness update.

Using the built-in HTTP polling sync server, awareness state is accepted and stored after the user is authorized. This state is keyed against their sync client ID, which is randomly generated.

However, nothing prevents a user from spoofing another client's client ID, which is discoverable by inspecting network responses. By replaying a sync request with a different client ID, they could temporarily overwrite another client's awareness state.

This change prevents this spoofing by storing and checking the user's WordPress user ID to ensure it matches the initial update.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/11120.
Syncs: ​https://github.com/WordPress/gutenberg/pull/76056.

Fixes #64782.
Props czarate.

File:

• trunk/src/wp-includes/collaboration/class-wp-http-polling-sync-server.php (modified) (2 diffs)

trunk/src/wp-includes/collaboration/class-wp-http-polling-sync-server.php

@@ -182 +182 @@
         }
 
-        $rooms = $request['rooms'];
+        $rooms      = $request['rooms'];
+        $wp_user_id = get_current_user_id();
 
         foreach ( $rooms as $room ) {
-            $room         = $room['room'];
+            $client_id = $room['client_id'];
+            $room      = $room['room'];
+
+            // Check that the client_id is not already owned by another user.
+            $existing_awareness = $this->storage->get_awareness_state( $room );
+            foreach ( $existing_awareness as $entry ) {
+                if ( $client_id === $entry['client_id'] && $wp_user_id !== $entry['wp_user_id'] ) {
+                    return new WP_Error(
+                        'rest_cannot_edit',
+                        __( 'Client ID is already in use by another user.' ),
+                        array( 'status' => rest_authorization_required_code() )
+                    );
+                }
+            }
+
             $type_parts   = explode( '/', $room, 2 );
             $object_parts = explode( ':', $type_parts[1] ?? '', 2 );
@@ -347 +362 @@
                 'state'      => $awareness_update,
                 'updated_at' => $current_time,
+                'wp_user_id' => get_current_user_id(),
             );
         }