Changeset 12602 for sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php

Timestamp:

05/24/2023 06:05:43 AM (3 years ago)

Author:

dd32

Message:

Plugin Directory: Switch release confirmation from using a wp nonce to using a stored token for access.

Fixes #7007.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php (modified) (3 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/shortcodes/class-release-confirmation.php

@@ -15 +15 @@
         const SHORTCODE = 'release-confirmation';
         const COOKIE    = 'release_confirmation_access_token';
-        const NONCE     = 'plugins-developers-releases-page';
+        const META_KEY  = '_release_confirmation_access_token';
         const URL_PARAM = 'access_token';
 
@@ -273 +273 @@
                 }
 
-                if ( false !== wp_verify_nonce( $_COOKIE[ self::COOKIE ], self::NONCE ) ) {
+                // ...and it be valid..
+                $token = get_user_meta( get_current_user_id(), self::META_KEY, true );
+                if (
+                        $token &&
+                        $token['time'] > ( time() - DAY_IN_SECONDS ) &&
+                        wp_check_password( $_COOKIE[ self::COOKIE ], $token['token'] )
+                ) {
                         return true;
                 }
@@ -288 +294 @@
                 }
 
-                $current_user = wp_get_current_user()->ID;
-                wp_set_current_user( $user->ID );
-
-                $url = wp_nonce_url(
-                        home_url( '/developers/releases/' ), // TODO: Hardcoded url.
-                        self::NONCE,
-                        self::URL_PARAM
+                $time      = time();
+                $plaintext = wp_generate_password( 24, false );
+                $token     = wp_hash_password( $plaintext );
+                update_user_meta( $user->ID, self::META_KEY, compact( 'token', 'time' ) );
+
+                $url = add_query_arg(
+                        self::URL_PARAM,
+                        urlencode( $plaintext ),
+                        home_url( '/developers/releases/' )
                 );
-
-                wp_set_current_user( $current_user );
 
                 return $url;