Bug in job submission process

  • Resolved James Jones

    (@jamesjonesphoenix)


    10 years, 6 months ago

    While testing my site I realised that you can find yourself editing another user’s preview job. To reproduce:

    • Allow account creation
    • Follow the submit form process not logged in as anyone.
    • Get to the preview step and then abort the process. A user and preview job is created
    • Log Out
    • Start the process again either logged in as a different user or not logged in as anyone. By the time you get to the preview step you’ll have made db changes to the first user’s job and not created your own job.

      • It seems the WP_Job_Manager_Form_Submit_Job class is collecting information from the $_COOKIE and using it without taking into account the user_id owner of the preview job in any way.

    https://wordpress.org/plugins/wp-job-manager/

Viewing 3 replies - 1 through 3 (of 3 total)
Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Bug in job submission process’ is closed to new replies.