fix: Add request validation to prevent untrusted access in category and plugin scripts

GHSA-ffw8-fwxp-h64w

Author: Daniel Neto

objects/categoryAddNew.json.php

@@ -19,6 +19,7 @@
     $obj->msg = __("Permission denied");
     die(json_encode($obj));
 }
+forbidIfIsUntrustedRequest('categoryAddNew');
 
 $objCat = new Category(intval(@$_POST['id']));
 $objCat->setName($_POST['name']);

objects/categoryDelete.json.php

@@ -10,6 +10,7 @@
 if (!Category::canCreateCategory()) {
     die('{"error":"' . __("Permission denied") . '"}');
 }
+forbidIfIsUntrustedRequest('categoryDelete');
 require_once 'category.php';
 $obj = new Category($_POST['id']);
 

objects/configurationClearCache.json.php

@@ -11,6 +11,7 @@
 $obj->clearCache = false;
 $obj->deleteALLCache = false;
 $obj->deleteAllSessionCache = false;
+forbidIfIsUntrustedRequest('configurationClearCache');
 $_SESSION['user']['sessionCache']['getAllCategoriesClearCache'] = 1;
 
 if (!Permissions::canClearCache() || !empty($_REQUEST['sessionOnly'])) {

objects/configurationGenerateSiteMap.json.php

@@ -16,6 +16,7 @@
     $obj->msg = __("Permission denied");
     die(json_encode($obj));
 }
+forbidIfIsUntrustedRequest('configurationGenerateSiteMap');
 $sitemap = siteMap();
 
 if (empty($sitemap)) {

objects/notifySubscribers.json.php

@@ -10,6 +10,7 @@
 if (!User::canUpload()) {
     forbiddenPage('You can not notify');
 }
+forbidIfIsUntrustedRequest('notifySubscribers');
 $user_id = User::getId();
 // if admin bring all subscribers
 if (User::isAdmin()) {

objects/pluginAddDataObject.json.php

@@ -9,6 +9,7 @@
 if (!User::isAdmin()) {
     die('{"error":"'.__("Permission denied").'"}');
 }
+forbidIfIsUntrustedRequest('pluginAddDataObject');
 if (empty($_POST['id'])) {
     die('{"error":"'.__("ID can't be blank").'"}');
 }

objects/pluginRunUpdateScript.json.php

@@ -9,6 +9,7 @@
 if (!User::isAdmin()) {
     forbiddenPage('Permission denied');
 }
+forbidIfIsUntrustedRequest('pluginRunUpdateScript');
 if (empty($_POST['name'])) {
     forbiddenPage('Name can\'t be blank');
 }

objects/userDelete.json.php

@@ -9,5 +9,6 @@
 if (!User::isAdmin() || empty($_POST['id'])) {
     die('{"error":"'.__("Permission denied").'"}');
 }
+forbidIfIsUntrustedRequest('userDelete');
 $item = new UserGroups($_POST['id']);
 echo '{"status":"'.$item->delete().'"}';

objects/userGroupsAddNew.json.php

@@ -8,6 +8,7 @@
 if (!Permissions::canAdminUserGroups()) {
     die('{"error":"' . __("Permission denied") . '"}');
 }
+forbidIfIsUntrustedRequest('userGroupsAddNew');
 
 require_once 'userGroups.php';
 $obj = new UserGroups(@$_POST['id']);

objects/userGroupsDelete.json.php

@@ -8,6 +8,7 @@
 if (!User::isAdmin() || empty($_POST['id'])) {
     die('{"error":"'.__("Permission denied").'"}');
 }
+forbidIfIsUntrustedRequest('userGroupsDelete');
 require_once 'userGroups.php';
 $obj = new UserGroups($_POST['id']);
 echo '{"status":"'.$obj->delete().'"}';