Context Navigation

Changeset 2875024

Timestamp:

03/05/2023 06:18:08 PM (3 years ago)

Author:

bgermann

Message:

import version 15.0.5

Location:

cforms2/trunk

Files:

-                      r2353696
+                      r2875024
 cforms2_check_access_priv();
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    if (!check_admin_referer("corruptedsettings"))
+        return;
+}
 ?>
 <div class="wrap">
 …
     <form name="corruptedsettings" class="corruptedsettings" method="POST">
+        <?php wp_nonce_field("corruptedsettings"); ?>
         <h3><?php _e('Corrupted cforms settings detected', 'cforms2'); ?></h3>
         <table class="form-table">

-                      r2353696
+                      r2875024
     return;
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    if (!check_admin_referer("cformsglobal"))
+        return;
+}
 $style = $cformsSettings['global']['cforms_css'];
 …
     <form enctype="multipart/form-data" id="cformsdata" name="mainform" method="post">
         <?php
+        wp_nonce_field("cformsglobal");
         if (isset($_POST['showinfo'])) {
             echo '<p>' . __('All the global and per form settings are listed here as JSON. You can use this as a backup tool if you like.', 'cforms2') . '</p>';
 …
     <fieldset class="cf_ed_main">
         <form name="deleteform" method="post">
+            <?php wp_nonce_field("cformsglobal"); ?>
             <div id="cf_target_del"><?php _e('Warning!', 'cforms2'); ?></div>
             <div class="controls">

-                      r2353696
+                      r2875024
     return;
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    if (!check_admin_referer("cformsdata"))
+        return;
+}
 $formcount = count(Cforms2\FormSettings::forms());
 …
         <input type="hidden" name="no" value="<?php echo $no_disp; ?>"/>
         <input type="hidden" name="noSub" value="<?php echo $no_disp; ?>" />
+        <?php wp_nonce_field("cformsdata"); ?>
         <p>

-                      r2353696
+                      r2875024
  * Description: cformsII is a customizable, flexible and powerful form plugin including simple spam protection, multi-step forms, role manager support and custom themes.
  * Author: Oliver Seidel, Bastian Germann
  * Version: 15.0.4
+ * Version: 15.0.5
  * Text Domain: cforms2
  */
 namespace Cforms2;
 define('CFORMS2_VERSION', '15.0.4');
+define('CFORMS2_VERSION', '15.0.5');
 // Debug message handling.

-                      r2729745
+                      r2875024
 If you want to use plugin versions older than 14.6.3, you should rename the directory containing the plugin from "cforms2" to "cforms". But bear in mind that old versions should not be used in public systems, because they contain [known serious vulnerabilities](https://wpvulndb.com/plugins/cforms) that are exploited in the wild.
 The [current security baseline version](https://wpvulndb.com/plugins/cforms2) is 15.0.3.
+The [current security baseline version](https://wpvulndb.com/plugins/cforms2) is 15.0.5.
 …
 == Upgrade Notice ==
 = 15.0.4 =
+= 15.0.5 =
 The tracking database feature and its view are removed with cformsII 15.0+. Your data still exists in the database. Please have a look at CFDB plugin as a replacement.
 == Changelog ==
+= 15.0.5 =
+* Fix CSRF by introducing nonces to admin forms (CVE-2023-25449)
 = 15.0.4 =

Note: See TracChangeset for help on using the changeset viewer.