← All changes | includes/class-mxchat-word-handler.php +7 -11 3.2.11 → 3.0.7 View file →

		@@ -15,15 +15,10 @@
15	15	/**
16	16	* Handle Word document upload and processing
17	17	*/
18	18	public function mxchat_handle_word_upload() {
19		- // Match the PDF handler's nonce verification: the widget sends the chat-send
20		- // nonce (action 'mxchat_chat_send'), which the old check_ajax_referer('mxchat_chat_nonce')
21		- // rejected with -1. mxchat_verify_chat_send_nonce accepts both chat-send and chat nonces.
22		- if (!isset($_POST['nonce']) || !MxChat_Integrator::mxchat_verify_chat_send_nonce(wp_unslash((string) $_POST['nonce']))) {
23		- wp_send_json_error(array('message' => esc_html__('Invalid nonce.', 'mxchat')), 403);
24		- }
25		-
	19	+ check_ajax_referer('mxchat_chat_nonce', 'nonce');
	20	+
26	21	if (!isset($_FILES['word_file']) || !isset($_POST['session_id'])) {
27	22	wp_send_json_error(esc_html__('Missing required parameters.', 'mxchat'));
28	23	return;
29	24	}
		@@ -40,14 +35,15 @@
40	35	$file = $_FILES['word_file'];
41	36	$session_id = sanitize_text_field($_POST['session_id']);
42	37	$original_filename = sanitize_text_field($file['name']);
43	38
44		- // Update session owner if it changed (e.g. IP changed due to network switch)
	39	+ // SECURITY FIX: Verify session ownership before allowing upload
45	40	$current_user_identifier = MxChat_User::mxchat_get_user_identifier();
46	41	$session_owner = get_option("mxchat_session_owner_{$session_id}");
47		-
48		- if (!$session_owner || $session_owner !== $current_user_identifier) {
49		- update_option("mxchat_session_owner_{$session_id}", $current_user_identifier, 'no');
	42	+
	43	+ if ($session_owner && $session_owner !== $current_user_identifier) {
	44	+ wp_send_json_error(esc_html__('Unauthorized access.', 'mxchat'));
	45	+ return;
50	46	}
51	47
52	48	// Check file type
53	49	$allowed_types = array(