[Plugin: Download Shortcode] Security issue | WordPress.org

Resolved Julio Potier
(@juliobox)

10 years, 9 months ago

Hello

So, what happen if i do this : “http://www.example.com/wp-content/plugins/download-shortcode/force-download.php?file=../../../wp-config.php ?

…

Ok

Can you fix this asap and warn users ? Thank you

http://wordpress.org/extend/plugins/download-shortcode/

Viewing 6 replies - 1 through 6 (of 6 total)

bibo_m16
(@bibo_m16)

10 years, 9 months ago

The force-download.php should be in the root folder. To the plugin creator: you might want to encrypt the file path (md5?)

Plugin Author Drew Jaynes
(@drewapicture)

10 years, 7 months ago

This issue was addressed and (in my testing) handled in v0.2.

WPSpeak
(@devplus)

10 years, 5 months ago

Is this issue has been fixed? Feel insecure to use this plugin

Plugin Author Drew Jaynes
(@drewapicture)

10 years, 4 months ago

Hi Devplus,

Version 1.0 which was just released adds more robust security for protecting against things like directory traversal and unauthorized file access. It also introduced URL rewrites which have the ability to completely mask the endpoint.

Kariko1975
(@kariko1975)

10 years, 4 months ago

Hi, please help, all did as you wrote, but jpg file opened in new window…
http://www.barior.com/?p=1715

Plugin Author Drew Jaynes
(@drewapicture)

10 years, 4 months ago

Kariko1975: Please create your own topic so I can better help you solve your issue. Also, I’m receiving a 404 at the URL you supplied.

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘[Plugin: Download Shortcode] Security issue’ is closed to new replies.

In: Plugins
6 replies
5 participants
Last reply from: Drew Jaynes
Last activity: 10 years, 4 months ago
Status: resolved

Views