Title: Output CSV security issue
Last modified: August 21, 2016

---

# Output CSV security issue

 *  [matias.castro](https://wordpress.org/support/users/matiascastro/)
 * (@matiascastro)
 * [12 years, 5 months ago](https://wordpress.org/support/topic/output-csv-security-issue/)
 * Hi, I realized that only the generation of the output csv form has security check,
   in PDb_List_Admin.class.php:
 *     ```
       if (current_user_can(Participants_Db::$plugin_options['plugin_admin_capability']))
         self::_print_export_form();
       ```
   
 * The problem is that the post action doesn’t, so someone could copy the export
   form, and post that action to a website using the plugin. As a possible solution,
   one could protect the post action with the plugin_admin_capability, on participants-
   database.php:
 *     ```
       case 'output CSV':
               //this line of code.
               if (!current_user_can(Participants_Db::$plugin_options['plugin_admin_capability'])) die();
               $header_row = array();
               //...
       ```
   
 * Could you include this (or something similar) for future updates? Thanks a lot.
   
   [https://wordpress.org/plugins/participants-database/](https://wordpress.org/plugins/participants-database/)

Viewing 1 replies (of 1 total)

 *  Plugin Author [Roland Barker](https://wordpress.org/support/users/xnau/)
 * (@xnau)
 * [12 years, 5 months ago](https://wordpress.org/support/topic/output-csv-security-issue/#post-4861236)
 * Thanks for that, I hadn’t considered that this would be possible, but I do want
   to do what I can to make the plugin secure.

Viewing 1 replies (of 1 total)

 The topic ‘Output CSV security issue’ is closed to new replies.

 * ![](https://ps.w.org/participants-database/assets/icon-256x256.jpg?rev=1389807)
 * [Participants Database](https://wordpress.org/plugins/participants-database/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/participants-database/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/participants-database/)
 * [Active Topics](https://wordpress.org/support/plugin/participants-database/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/participants-database/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/participants-database/reviews/)

## Tags

 * [csv](https://wordpress.org/support/topic-tag/csv/)
 * [export](https://wordpress.org/support/topic-tag/export/)

 * 1 reply
 * 2 participants
 * Last reply from: [Roland Barker](https://wordpress.org/support/users/xnau/)
 * Last activity: [12 years, 5 months ago](https://wordpress.org/support/topic/output-csv-security-issue/#post-4861236)
 * Status: not resolved