Changeset 7737

Timestamp:

10/17/2018 11:01:37 PM (6 years ago)

Author:

iandunn

Message:

WordCamp Payments: Hide other users' payment files from non-admins.

See #3244

Location:

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wordcamp-payments

Files:

• includes/privacy.php (modified) (1 diff)
• includes/wordcamp-budgets.php (modified) (1 diff)
• views/wordcamp-budgets/field-attached-files.php (modified) (1 diff)

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wordcamp-payments/includes/privacy.php

@@ -3 +3 @@
 namespace WordCamp\Budgets\Privacy;
 
-use WP_Query;
+use WP_Query, WP_Post;
 use WordCamp\Budgets\Reimbursement_Requests;
+use WCP_Payment_Request;
 
 defined( 'WPINC' ) || die();
 
 
+add_filter( 'the_posts',                          __NAMESPACE__ . '\hide_others_payment_files', 10, 2 );
 add_filter( 'wp_privacy_personal_data_exporters', __NAMESPACE__ . '\register_personal_data_exporters' );
 add_filter( 'wp_privacy_personal_data_erasers', __NAMESPACE__ . '\register_personal_data_erasers' );
+
+
+/**
+ * Prevent non-admins from viewing payment files uploaded by other users.
+ *
+ * The files sometimes have sensitive information, like account numbers etc. `the_posts` was chosen over
+ * `ajax_query_attachments_args`, `pre_get_posts`, and other techniques, because it is the most comprehensive
+ * and flexible solution. It will remove things from the Media Library, but also REST API endpoints, XML-RPC,
+ * RSS, etc. It also allows the chance the to only apply the conditions to certain post types, whereas setting
+ * query vars is much more limited.
+ *
+ * SECURITY WARNING: When querying attachments `get_posts()`, make sure you pass `suppress_filters => false`,
+ * otherwise this will not run.
+ *
+ * @param WP_Post[] $attachments
+ * @param WP_Query  $wp_query
+ *
+ * @return array
+ */
+function hide_others_payment_files( $attachments, $wp_query ) {
+    $user = wp_get_current_user();
+
+    if ( 'attachment' !== $wp_query->get( 'post_type' ) || in_array( 'administrator', $user->roles, true ) ) {
+        return $attachments;
+    }
+
+    $payment_posts_ids = get_payment_file_parent_ids( $attachments );
+
+    foreach ( $attachments as $index => $attachment ) {
+        if ( ! in_array( $attachment->post_parent, $payment_posts_ids, true ) ) {
+            continue;
+        }
+
+        if ( $attachment->post_author === $user->ID ) {
+            continue;
+        }
+
+        /*
+         * The post is already cached from the request in `get_payment_file_parent_ids()`, so this doesn't create
+         * a new database query, it's just a way to access the individual post directly instead of iterating through
+         * `$payment_posts_with_attachments`.
+         */
+        $parent_author = (int) get_post( $attachment->post_parent )->post_author;
+
+        if ( $parent_author === $user->ID ) {
+            continue;
+        }
+
+        unset( $attachments[ $index ] );
+    }
+
+    // Re-index the array, because WP_Query functions will assume there are no gaps.
+    return array_values( $attachments );
+}
+
+/**
+ * Get the Reimbursement/Vendor Payment posts that are attached to the given media items.
+ *
+ * @param WP_Post[] $attachments
+ *
+ * @return int[]
+ */
+function get_payment_file_parent_ids( $attachments ) {
+    $parent_ids     = array_unique( wp_list_pluck( $attachments, 'post_parent' ) );
+    $orphaned_index = array_search( 0, $parent_ids, true );
+
+    // All payment files should be attached to a post, so unattached files can be removed.
+    if ( false !== $orphaned_index ) {
+        unset( $parent_ids[ $orphaned_index ] );
+    }
+
+    $payment_posts_with_attachments = get_posts( array(
+        'post__in'    => $parent_ids,
+        'post_status' => 'any',
+        'numberposts' => 1000,
+        'post_type'   => array(
+            Reimbursement_Requests\POST_TYPE,
+            WCP_Payment_Request::POST_TYPE
+        ),
+    ) );
+
+    return wp_list_pluck( $payment_posts_with_attachments, 'ID' );
+}
 
 /**

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wordcamp-payments/includes/wordcamp-budgets.php

@@ -956 +956 @@
             'orderby'        => 'title',
             'order'          => 'ASC',
+
+            // Make sure that `WordCamp\Budgets\Privacy\hide_others_payment_files()` runs.
+            'suppress_filters' => false,
         ) );
 

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wordcamp-payments/views/wordcamp-budgets/field-attached-files.php

@@ -17 +17 @@
 </h4>
 
+<?php if ( ! current_user_can( 'manage_options' ) ) : ?>
+    <p>
+        <em><?php _e( 'Note: Files uploaded by other users are hidden to protect privacy.', 'wordcamporg' ); ?></em>
+    </p>
+<?php endif; ?>
+
 <ul class="wcb_files_list loading-content">
     <li>