Changeset 3737477

Timestamp:

10/10/2026 01:03:33 AM (7 days ago)

Author:

TigrouMeow

Message:

Version 6.5.7.

Location:

wplr-sync/trunk

Files:

• classes/api.php (modified) (11 diffs)
• classes/core.php (modified) (2 diffs)
• readme.txt (modified) (2 diffs)
• wplr-sync.php (modified) (2 diffs)

wplr-sync/trunk/classes/api.php

@@ -40 +40 @@
                 // Upload
                 else if ( isset( $_POST['action'] ) && $_POST['action'] === 'sync' ) {
-                        if ( !$user = $this->auth( $_POST['token'] ) ) {
+                        if ( !$user = $this->auth( isset( $_POST['token'] ) ? wp_unslash( $_POST['token'] ) : null ) ) {
                                 $this->response( null, false, $this->error );
                                 $this->finalize();
@@ -51 +51 @@
                         $body = file_get_contents('php://input');
                         $args = json_decode( $body );
-                        if ( !$user = $this->auth( $args->token ) ) {
+                        if ( !is_object( $args ) || !isset( $args->action ) ) {
+                                $this->response( null, false, "Invalid request." );
+                                $this->finalize();
+                        }
+                        if ( !$user = $this->auth( isset( $args->token ) ? $args->token : null ) ) {
                                 $this->response( null, false, $this->error );
                                 $this->finalize();
                         }
                         $wplr->log( "Action: " . $args->action );
-                        if ( !$user = $this->auth( $args->token ) )
-                                $this->response( null, false, $this->error );
-                        else if ( $args->action === 'presync' )
+                        if ( $args->action === 'presync' )
                                 $this->presync( $args );
                         else if ( $args->action === 'sync_collection' )
@@ -117 +119 @@
                 global $wplr, $wpdb;
 
-
-                if ( empty( $token ) ) {
+                // Failed attempts are counted per IP: a token can't be guessed by hammering the endpoint.
+                $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
+                $fail_key = 'wplr_api_fail_' . md5( $ip );
+                $fails = (int) get_transient( $fail_key );
+                if ( $fails >= 20 ) {
+                        $this->error = "Too many failed attempts. Please try again in 15 minutes.";
+                        $wplr->log( $this->error );
+                        return false;
+                }
+
+                if ( !is_string( $token ) || strlen( $token ) < 12 || strlen( $token ) > 128 ) {
                         $this->error = "Authentification is missing.";
                         $wplr->log( $this->error );
+                        set_transient( $fail_key, $fails + 1, 15 * MINUTE_IN_SECONDS );
                         return false;
                 }
-                
-                //* DEBUG: allow to authenticate as admin with a hardcoded token (for testing purposes only)
-                // if ( $token == "MEOW_TOKEN" ) {
-
-                //      $this->user = get_userdata( 1 );
-                //      if ( empty( $this->user ) ) {
-                //              $this->error = "User admin does not exist.";
-                //              $wplr->log( $this->error );
-                //              return false;
-                //      }
-
-                //      $wplr->log( "Authenticated as admin" );
-                //      return $this->user;
-                // }
 
                 $prefix = defined( 'BLOG_ID_CURRENT_SITE' ) ? $wpdb->get_blog_prefix( BLOG_ID_CURRENT_SITE ) : $wpdb->prefix;
                 $tbl_meta = defined('CUSTOM_USER_META_TABLE' ) ? CUSTOM_USER_META_TABLE : $prefix . "usermeta";
-                $userId = $wpdb->get_var( $wpdb->prepare( "SELECT user_id FROM $tbl_meta
+                $row = $wpdb->get_row( $wpdb->prepare( "SELECT user_id, meta_value FROM $tbl_meta
                         WHERE meta_value = %s AND meta_key = %s", $token, 'wplr_auth_token' ) );
-                if ( empty( $userId ) ) {
-                        $this->error = "Token '$token' seems to be invalid.";
+                // The SQL match can be case-insensitive (collation): the token must match exactly.
+                if ( empty( $row ) || !is_string( $row->meta_value ) || !hash_equals( $row->meta_value, $token ) ) {
+                        $this->error = "This token seems to be invalid.";
                         $wplr->log( $this->error );
+                        set_transient( $fail_key, $fails + 1, 15 * MINUTE_IN_SECONDS );
                         return false;
                 }
-                $this->user = get_userdata( $userId );
+                $this->user = get_userdata( $row->user_id );
                 if ( empty( $this->user ) ) {
                         $this->error = 'User does not exist.';
@@ -153 +153 @@
                         return false;
                 }
+
+                // Act as this user, so every capability check below applies to them.
+                wp_set_current_user( $this->user->ID );
+                if ( !current_user_can( 'upload_files' ) ) {
+                        $this->error = 'This user is not allowed to upload files.';
+                        $wplr->log( $this->error );
+                        $this->user = null;
+                        return false;
+                }
                 $wplr->log( "Authenticated as " . $this->user->user_login );
                 return $this->user;
+        }
+
+        // The attachment(s) behind a Lightroom ID must be editable (or deletable) by the authenticated user.
+        function can_on_lr_id( $lr_id, $cap ) {
+                global $wplr;
+                foreach ( (array) $wplr->list_wpids( (int) $lr_id ) as $row ) {
+                        if ( !empty( $row->wp_id ) && !current_user_can( $cap, (int) $row->wp_id ) ) {
+                                return false;
+                        }
+                }
+                return true;
+        }
+
+        function can_on_wp_id( $wp_id, $cap ) {
+                $wp_id = (int) $wp_id;
+                return $wp_id > 0 && get_post_type( $wp_id ) === 'attachment' && current_user_can( $cap, $wp_id );
         }
 
@@ -237 +262 @@
                 $file = $_FILES['file']['tmp_name'];
 
+                // Syncing over an existing photo replaces its file: the user must be allowed to edit it.
+                if ( !$this->can_on_lr_id( $args["id"], 'edit_post' ) ) {
+                        return $this->response( null, false, 'You are not allowed to edit this media.' );
+                }
+
                 if ( !isset( $args["wp_col_id"] ) || $args["wp_col_id"] == null )
                         $args["wp_col_id"] = -1;
@@ -301 +331 @@
                 global $wplr;
                 $res = false;
+                // Deleting a collection also deletes its photos, which may belong to anyone.
+                if ( !current_user_can( 'delete_others_posts' ) ) {
+                        return $this->response( null, false, 'You are not allowed to delete collections.' );
+                }
                 if ( property_exists( $args, 'remoteId' ) )
                         $res = $wplr->delete_collection( $args->remoteId );
@@ -312 +346 @@
                 if ( property_exists( $args, 'collection_id' ) )
                         $collectionId = $args->collection_id;
-                $list = $wplr->delete_media( $args->lr_id, $collectionId );
+                if ( !property_exists( $args, 'lr_id' ) || !$this->can_on_lr_id( $args->lr_id, 'delete_post' ) ) {
+                        return $this->response( null, false, 'You are not allowed to delete this media.' );
+                }
+                $list = $wplr->delete_media( (int) $args->lr_id, $collectionId );
                 return $this->response( $list );
         }
@@ -335 +372 @@
         function unlink( $args ) {
                 global $wplr;
-                $res = $wplr->unlink_media( $args->lr_id, $args->wp_id );
+                $wp_id = property_exists( $args, 'wp_id' ) ? (int) $args->wp_id : 0;
+                $lr_id = property_exists( $args, 'lr_id' ) ? (int) $args->lr_id : 0;
+                if ( $wp_id ? !$this->can_on_wp_id( $wp_id, 'edit_post' ) : !$this->can_on_lr_id( $lr_id, 'edit_post' ) ) {
+                        return $this->response( null, false, 'You are not allowed to edit this media.' );
+                }
+                $res = $wplr->unlink_media( $lr_id, $wp_id );
                 return $this->response( $res );
         }
@@ -342 +384 @@
         function link( $args ) {
                 global $wplr;
-                $res = $wplr->link_media( $args->lr_id, $args->wp_id );
+                // Linking decides which attachment a later sync or delete will touch.
+                $wp_id = property_exists( $args, 'wp_id' ) ? (int) $args->wp_id : 0;
+                if ( !$this->can_on_wp_id( $wp_id, 'edit_post' ) ) {
+                        return $this->response( null, false, 'You are not allowed to link this media.' );
+                }
+                $res = $wplr->link_media( (int) $args->lr_id, $wp_id );
                 return $this->response( $res );
         }
@@ -357 +404 @@
         function linkinfo( $args ) {
                 global $wplr;
-                $linkinfo = $wplr->linkinfo_media( $args->wp_id );
+                if ( !$this->can_on_wp_id( property_exists( $args, 'wp_id' ) ? $args->wp_id : 0, 'edit_post' ) ) {
+                        return $this->response( null, false, 'You are not allowed to access this media.' );
+                }
+                $linkinfo = $wplr->linkinfo_media( (int) $args->wp_id );
                 return $this->response( $linkinfo );
         }
@@ -365 +415 @@
                 global $wplr;
                 $wp_ids = isset( $args->wp_ids ) ? (array)$args->wp_ids : array();
+                $wp_ids = array_values( array_filter( array_map( 'intval', $wp_ids ), function ( $id ) {
+                        return $this->can_on_wp_id( $id, 'edit_post' );
+                } ) );
                 $list = $wplr->linkinfo_bulk( $wp_ids );
                 return $this->response( $list );

wplr-sync/trunk/classes/core.php

@@ -260 +260 @@
 
         function profile_update( $user_id ) {
+                // Only users who can upload get a Lightroom token; the others have no use for one.
+                if ( !user_can( $user_id, 'upload_files' ) ) {
+                        return;
+                }
                 $token = get_user_meta( $user_id, 'wplr_auth_token', true );
                 if ( empty( $token ) ) {
@@ -272 +276 @@
          */
         function generate_auth_token( $userId ) {
-                static $MIN_LENGTH = 24;
-                static $MAX_LENGTH = 32;
-
-                // Seed
-                list( $usec, $sec ) = explode( ' ', microtime() );
-                $seed = $sec + $usec * 1000000;
-                srand( $seed );
-
-                // Compose
-                $r = '';
-                $chars = str_split( '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ' );
-                $nChars = count( $chars );
-                $length = rand( $MIN_LENGTH, $MAX_LENGTH );
-                for ( $i = 0; $i < $length; $i++ ) $r .= $chars[rand( 0, $nChars - 1 )];
+                // A cryptographically secure token. It used to come from rand() seeded with the time,
+                // which made it guessable from the moment it was created.
+                $r = wp_generate_password( 32, false, false );
 
                 // Save

wplr-sync/trunk/readme.txt

@@ -7 +7 @@
 Tested up to: 7.1
 Requires PHP: 8.1
-Stable tag: 6.5.6
+Stable tag: 6.5.7
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -63 +63 @@
 
 == Changelog ==
+
+= 6.5.7 (2026/10/10) =
+* Fix: Security: The Lightroom sync API now requires a user who can upload files and checks their rights on every photo it edits, links or deletes.
+* Fix: Security: Lightroom sync tokens are now unguessable and repeated failed attempts are blocked.
+* 🎵 Discuss with others about Wplr Sync on [the Discord](https://discord.gg/bHDGh38).
+* 🌴 Keep us motivated with [a little review here](https://wordpress.org/support/plugin/wplr-sync/reviews/). Thank you!
+* 🥰 If you want to help us, check our [Patreon](https://www.patreon.com/meowapps). Thank you!
 
 = 6.5.6 (2026/09/26) =

wplr-sync/trunk/wplr-sync.php

@@ -4 +4 @@
 Plugin URI: https://meowapps.com
 Description: Synchronize and maintain your photos, collections, keywords and metadata between Lightroom and WordPress.
-Version: 6.5.6
+Version: 6.5.7
 Author: Jordy Meow
 Author URI: https://meowapps.com
@@ -15 +15 @@
 */
 
-define( 'WPLR_SYNC_VERSION', '6.5.6' );
+define( 'WPLR_SYNC_VERSION', '6.5.7' );
 define( 'WPLR_SYNC_PREFIX', 'wplr_sync' );
 define( 'WPLR_SYNC_DOMAIN', 'wplr-sync' );