WordPress.org

Ready to get started?Download WordPress

Forums

WP-FB-AutoConnect
nonce control [Bug and Fix] (3 posts)

  1. Gbellucci
    Member
    Posted 2 years ago #

    I am using the wp-fb-autoconnect [with the Premium add-on] in a BuddyPress [1.5.2] installation. I found that I encountered problems managing BuddyPress Groups. For example, I could not change the group name or change the group avatar without encountering a 403 Forbidden Page Error. These types of errors are the result of a mismatched nonce/action pair or a bad referring url.

    After troublshooting the BuddyPress plugin, I found two instances of a hidden control named _wp_nonce had been added to the Group Admin form.

    One of the controls had been added by the BuddyPress code; the other was added to the page footer by the wp-fb-autoconnect plugin. Whenever the page was submitted for processing by BuddyPress the function check_admin_referer() would fail because the action was a BuddyPress action but the nonce value was generated from the plugin action value.

    The solution is to make sure the nonce control name used by wp-fb-autoconnect differs from the standard nonce control name used by Buddypress [_wp_nonce].

    Two lines of code are affected in the plugin:

    1. Main.php line 214
    2. _process_login.php line 37

    In Main.php

    I changed the line from:
    wp_nonce_field ($jfb_nonce_name);
    to:
    wp_nonce_field ('fb_login', $jfb_nonce_name);

    The first argument of the wp_nonce_field function is the action used to generate the nonce value, the second argument is the name of the hidden nonce control. The original line of code used the value of $jfb_nonce_name as the action and allowed the name of the control to default to _wp_nonce. The altered line of code sets the action to fb_login and sets the name of the control to the value of $jfb_nonce_name.

    In _process_login.php

    I changed the line from:
    if( wp_verify_nonce ($_REQUEST['_wp_nonce'], $jfb_nonce_name) != 1 )
    to:
    if( wp_verify_nonce ($_REQUEST[$jfb_nonce_name], 'fb_login') != 1 )

    The change above instructs the function call wp_verify_nonce() to look for the nonce value in the control named by the value of $jfb_nonce_name and sets the action to fb_login. The value of the action is used to regenerate the nonce value for comparison.

    http://wordpress.org/extend/plugins/wp-fb-autoconnect/

  2. metal450
    Member
    Posted 2 years ago #

    Excellent find - and thanks for the fix! Will submit in an update shortly.

    (For future reference though, please post support inquiries/messages on the plugin's actual support page - I only check this forum periodically, it just so happened that I checked RIGHT after you posted this ;))

  3. Gbellucci
    Member
    Posted 2 years ago #

    Sorry, I thought I had posted it to the plugins support page. It's been awhile since I've posted a bug fix for a plugin.

Topic Closed

This topic has been closed to new replies.

About this Plugin

About this Topic