Missing form security

  • Jacob N. Breetvelt

    (@opajaap)


    11 years, 1 month ago

    To introduce form security the way the wp boys like to see it, i suggest the following code additions:

    In backend.php at line 81:

    (81):	if (isset($_REQUEST['action']) && $_REQUEST['action'] == 'add_item'  ){

// Start form security
require_once ABSPATH . 'wp-includes/pluggable.php'; // It looks like pluggable.php is loaded too late, so I'll do it
if ( ! wp_verify_nonce($_REQUEST['scabn-add'],'add_to_cart') ) {
	wp_die('Cheating?');
}
// End form security

    And in display.php right below the <form tag on line 164:

    (164):	$output .= "<form method='post' class='".$item_id."' action='".$action_url."'>\n";
	$output .= wp_nonce_field( 'add_to_cart', 'scabn-add', false, false );

    http://wordpress.org/extend/plugins/simple-cart-buy-now/

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author bluey80

    (@bluey80)

    11 years, 1 month ago

    Implemented in 1.9.10.

    I’m wondering if that same type of code should be added to the remove link in the shopping cart. It is ?variable=sometihng style in the URL instead of POST, but I don’t think that changes anything.

    Thread Starter Jacob N. Breetvelt

    (@opajaap)

    11 years, 1 month ago

    Thanx for this. Removing is not vulnerable. It was theoreticly possible to buy anything for a modified price. This is approx 100 times more difficult now. So, i am confident with how it is now, and will proceed publishing what we achieved on the wppa+ site. I will drop a link when its ready. Thanx for your support!

    Plugin Author bluey80

    (@bluey80)

    11 years, 1 month ago

    Good point. I wrote SCABN wanting to not let people alter the pricing of items, but what I did was have SCABN get the pricing from a db query and ignore the user-supplied price. This works fine, but isn’t enabled by default as the user needs to provide a function to look up pricing (see notes in templates/default.php). Using none is much better as it works out of the box. Thanks.

    Plugin Author bluey80

    (@bluey80)

    11 years, 1 month ago

    Actually, it is still very easy to buy at a modified price. (I just did it). If you just open up the page in developer tools (right click, inspect element in Chrome) and find the add-to-cart submit form, you can edit the price=”XX” line to whatever you want. The nonce stuff stops (makes harder) cross-site scripting running code as admin from sniffed packets, etc, but it only validates that the content came from the right user / right source recently.

    If you setup price lookups, this is prevented because the price=XX value gets overwritten by the price lookup. But my default this is disabled as the user has to write some kind of price lookup table / db query.

    I think the only solution is to do some encryption / decryption of at least the price field if not just sign the entire ‘add-to-cart’ submit form. I’ll look if WP has any hooks for this.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Missing form security’ is closed to new replies.