← All changes | includes/class-mxchat-word-handler.php +5 -4 3.2.2 → 3.0.7 View file →

		@@ -35,14 +35,15 @@
35	35	$file = $_FILES['word_file'];
36	36	$session_id = sanitize_text_field($_POST['session_id']);
37	37	$original_filename = sanitize_text_field($file['name']);
38	38
39		- // Update session owner if it changed (e.g. IP changed due to network switch)
	39	+ // SECURITY FIX: Verify session ownership before allowing upload
40	40	$current_user_identifier = MxChat_User::mxchat_get_user_identifier();
41	41	$session_owner = get_option("mxchat_session_owner_{$session_id}");
42		-
43		- if (!$session_owner || $session_owner !== $current_user_identifier) {
44		- update_option("mxchat_session_owner_{$session_id}", $current_user_identifier, 'no');
	42	+
	43	+ if ($session_owner && $session_owner !== $current_user_identifier) {
	44	+ wp_send_json_error(esc_html__('Unauthorized access.', 'mxchat'));
	45	+ return;
45	46	}
46	47
47	48	// Check file type
48	49	$allowed_types = array(