Skip to content

fix: fail closed on registration nonce + safe redirect (CSRF session fixation) #1927

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arifulhoque7 wants to merge 1 commit into
base: develop
Choose a base branch
from
+5 −4
Open

fix: fail closed on registration nonce + safe redirect (CSRF session fixation) #1927

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions includes/Frontend/Registration.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,14 +56,14 @@
switch ( $action ) {
case 'register':
return $this->get_registration_url();
break;

Check warning on line 59 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Code after the RETURN statement on line 58 cannot be executed
default:
if ( empty( $redirect_to ) ) {
return $root_url;
}

return add_query_arg( [ 'redirect_to' => urlencode( $redirect_to ) ], $root_url );

Check warning on line 65 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

urlencode() should only be used when dealing with legacy applications rawurlencode() should now be used instead. See https://www.php.net/function.rawurlencode and http://www.faqs.org/rfcs/rfc3986.html
break;

Check warning on line 66 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Code after the RETURN statement on line 65 cannot be executed
}
}

Expand All @@ -72,7 +72,7 @@
*
* @return bool|string
*/
public function get_registration_url( $register_url = NULL ) {

Check failure on line 75 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

TRUE, FALSE and NULL must be lowercase; expected "null" but found "NULL"
$register_link_override = wpuf_get_option( 'register_link_override', 'wpuf_profile', false );
$page_id = wpuf_get_option( 'reg_override_page', 'wpuf_profile', false );
if ( $register_link_override === 'off' ) {
Expand Down Expand Up @@ -120,7 +120,7 @@
], $atts
);
$userrole = $atts['role'];
$user_nonce = base64_encode( random_bytes( Encryption_Helper::get_encryption_nonce_length() ) );

Check warning on line 123 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

base64_encode() can be used to obfuscate code which is strongly discouraged. Please verify that the function is used for benign reasons.
$roleencoded = wpuf_encryption( $userrole, $user_nonce );
$reg_page = $this->get_registration_url();

Expand All @@ -135,11 +135,11 @@
]
);
} else {
$queries = wp_unslash( $_GET );

Check warning on line 138 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Processing form data without nonce verification.
array_walk(
$queries, function( &$a ) {

Check failure on line 140 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Expected 1 space after FUNCTION keyword; 0 found
$a = sanitize_text_field( $a );

Check failure on line 141 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Line indented incorrectly; expected at least 5 tabs, found 4
}

Check failure on line 142 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Line indented incorrectly; expected 4 tabs, found 3

Check failure on line 142 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Multi-line function call not indented correctly; expected 16 spaces but found 12
);
$args = [
'action_url' => add_query_arg( $queries, $reg_page ),
Expand All @@ -161,9 +161,10 @@
if ( ! empty( $_POST['wpuf_registration'] ) && ! empty( $_POST['_wpnonce'] ) ) {
$userdata = [];
$user = '';
if ( isset( $_POST['_wpnonce'] ) ) {
$nonce = sanitize_key( wp_unslash( $_POST['_wpnonce'] ) );
wp_verify_nonce( $nonce, 'wpuf_registration_action' );
$nonce = isset( $_POST['_wpnonce'] ) ? sanitize_key( wp_unslash( $_POST['_wpnonce'] ) ) : '';

if ( ! wp_verify_nonce( $nonce, 'wpuf_registration_action' ) ) {
return;
}
$validation_error = new WP_Error();
$reg_fname = isset( $_POST['reg_fname'] ) ? sanitize_text_field( wp_unslash( $_POST['reg_fname'] ) ) : '';
Expand All @@ -182,21 +183,21 @@
);
if ( $validation_error->get_error_code() ) {
$this->registration_errors[] = '<strong>' . esc_html__(
'Error', 'wp-user-frontend'

Check failure on line 186 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Multi-line function call not indented correctly; expected 20 spaces but found 24
) . ':</strong> ' . $validation_error->get_error_message();

Check failure on line 187 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Multi-line function call not indented correctly; expected 16 spaces but found 20

return;
}
if ( empty( $reg_fname ) ) {
$this->registration_errors[] = '<strong>' . esc_html__(
'Error', 'wp-user-frontend'

Check failure on line 193 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Multi-line function call not indented correctly; expected 20 spaces but found 24
) . ':</strong> ' . esc_html__( 'First name is required.', 'wp-user-frontend' );

Check failure on line 194 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Multi-line function call not indented correctly; expected 16 spaces but found 20

return;
}
if ( empty( $reg_lname ) ) {
$this->registration_errors[] = '<strong>' . esc_html__(
'Error', 'wp-user-frontend'

Check failure on line 200 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Multi-line function call not indented correctly; expected 20 spaces but found 24
) . ':</strong> ' . esc_html__( 'Last name is required.', 'wp-user-frontend' );

return;
Expand Down Expand Up @@ -253,9 +254,9 @@
$this->registration_errors[] = '<strong>' . esc_html__(
'Error', 'wp-user-frontend'
) . ':</strong> ' . esc_html__(
'A user could not be found with this email address.',

Check warning on line 257 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Found precision alignment of 3 spaces.
'wp-user-frontend'

Check warning on line 258 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Found precision alignment of 3 spaces.
);

Check warning on line 259 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Found precision alignment of 3 spaces.

return;
}
Expand Down Expand Up @@ -284,8 +285,8 @@
$blogname = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
$message = sprintf(
/* translators: %s: site name */
esc_html__( 'New user registration on your site %s:', 'wp-user-frontend' ),

Check warning on line 288 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Found precision alignment of 3 spaces.
get_option( 'blogname' )

Check warning on line 289 in includes/Frontend/Registration.php

View workflow job for this annotation

GitHub Actions / Run PHPCS inspection 

Found precision alignment of 3 spaces.
) . "\r\n\r\n";
/* translators: %s: username */
$message .= sprintf( esc_html__( 'Username: %s', 'wp-user-frontend' ), $user_login ) . "\r\n\r\n";
Expand Down Expand Up @@ -336,7 +337,7 @@
} else {
$redirect = $this->get_registration_url() . '?success=yes';
}
wp_redirect( apply_filters( 'wpuf_registration_redirect', $redirect, $user ) );
wp_safe_redirect( apply_filters( 'wpuf_registration_redirect', $redirect, $user ) );
exit;
}
}
Expand Down
Loading