{"id":4861121,"date":"2014-04-29T12:58:06","date_gmt":"2014-04-29T12:58:06","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/output-csv-security-issue\/"},"modified":"2016-08-21T19:51:18","modified_gmt":"2016-08-21T19:51:18","slug":"output-csv-security-issue","status":"closed","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/output-csv-security-issue\/","title":{"rendered":"Output CSV security issue"},"content":{"rendered":"<p>Hi, I realized that only the generation of the output csv form has security check, in PDb_List_Admin.class.php:<\/p>\n<pre><code>if (current_user_can(Participants_Db::$plugin_options[&#039;plugin_admin_capability&#039;]))\n  self::_print_export_form();<\/code><\/pre>\n<p>The problem is that the post action doesn&#8217;t, so someone could copy the export form, and post that action to a website using the plugin. As a possible solution, one could protect the post action with the plugin_admin_capability, on participants-database.php:<\/p>\n<pre><code>case &#039;output CSV&#039;:\n        \/\/this line of code.\n        if (!current_user_can(Participants_Db::$plugin_options[&#039;plugin_admin_capability&#039;])) die();\n        $header_row = array();\n        \/\/...<\/code><\/pre>\n<p>Could you include this (or something similar) for future updates? Thanks a lot.<br \/>\nhttps:\/\/wordpress.org\/plugins\/participants-database\/<\/p>\n","protected":false},"template":"","class_list":["post-4861121","topic","type-topic","status-closed","hentry","topic-tag-csv","topic-tag-export"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/4861121","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/4861121\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=4861121"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}