• Resolved dimal

    (@dimalifragis)


    Hi,

    Recently i see many listings been moved to the pool to be cheched and re-enabled by me. Old ones.

    Closely checking the issie, i found the ANY one can deactivate a listing just by visiting a link like that (example)

    listings/elite-management-services/?notice=1&p=2609&post_id=2609&reviewed=yes&edited=no

    NO authentication asked, nothings.

    Thanks

Viewing 4 replies - 1 through 4 (of 4 total)
  • Thread Starter dimal

    (@dimalifragis)

    Question.

    Could this snippet help ??

    add_action('wp', 'block_unauthenticated_listing_moderation');
    function block_unauthenticated_listing_moderation() {
        // Check if the URL contains the specific parameters used to trigger moderation
        if (isset($_REQUEST['post_id']) && isset($_REQUEST['reviewed'])) {
            
            // If the visitor is NOT logged in, block them immediately
            if (!is_user_logged_in()) {
                wp_die('You do not have permission to modify this listing.', 'Access Denied', array('response' => 403));
            }
        }
    }
    Plugin Support Mahfuzul Alam

    (@mahfuz87)

    Hello @dimalifragis

    Thank you for reaching out. We have solved this issue in version 8.7.1. Would you please check and update the Directorist to its latest version?

    If you still face the same issue, please contact our support channel. We will try to help you fix this issue on your live site.

    Kind Regards

    Thread Starter dimal

    (@dimalifragis)

    Thanks for the reply.

    I can’t upgrade, unfortunately. For meny reasons. So i’m stuck with 7.x.

    I applies the snippet and seems to work with no issue.

    Plugin Support Mahfuzul Alam

    (@mahfuz87)

    Hello @dimalifragis

    Thank you for letting us know. I think it would be best to resolve those issues and upgrade Directorist, as version 8 includes many major security updates. Staying on an older version can be very risky.

    Kind Regards

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.