Prevent usage of cloudflare_proxy action on /admin-ajax endpoint for non-Administrator users
#529
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
aseure
force-pushed
the
limit-proxy-usage-to-administrator
branch
2 times, most recently
from
cbc9aae
to
258fe4c
Compare
jacobbednarz
approved these changes
Jan 3, 2024
aseure
force-pushed
the
limit-proxy-usage-to-administrator
branch
from
258fe4c
to
ee2b876
Compare
aseure
changed the title
cloudflare_proxy action on /admin-ajax endpoint for non-Administrator users
…r non-Administrator users **🔖 Summary** The implementation of this plugin is hidden behind a [`is_admin()` WordPress function](https://developer.wordpress.org/reference/functions/is_admin/). However, as stated in the documentation: > Does not check if the user is an administrator; use current_user_can() > for checking roles and capabilities. This commit is about ensuring that the `cloudflare_proxy` action on the /admin-ajax endpoint is correctly limited to Administrator users only before making any call via the Proxy to Cloudflare. **✅ Testing plan** Update the mocked tests which were rightfully failing due to non-Administrator calls.
aseure
force-pushed
the
limit-proxy-usage-to-administrator
branch
from
ee2b876
to
f3e8f74
Compare
aseure
added a commit
to aseure/Cloudflare-WordPress
that referenced
this pull request
Jan 4, 2024
This release deploys the following fix cloudflare#529.
Merged
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🔖 Summary
The implementation of this plugin is hidden behind a
is_admin()WordPress function.However, as stated in the documentation:
This commit is about ensuring that the
cloudflare_proxyaction on the/admin-ajax endpoint is correctly limited to Administrator users only
before making any call via the Proxy to Cloudflare.
✅ Testing plan
Update the mocked tests which were rightfully failing due to non-Administrator
calls.