| @@ -123,8 +123,21 @@ | ||
| 123 | 123 | if( is_array( $topic_args ) ) { |
| 124 | 124 | // Remove dangerous 'where' parameter |
| 125 | 125 | unset( $topic_args['where'] ); |
| 126 | 126 | |
| 127 | + // SECURITY: Strip parameters that bypass access controls | |
| 128 | + // access_filter=false skips all permission checks (intended for admin backend only) | |
| 129 | + // permgroup allows impersonating another usergroup's permissions | |
| 130 | + // forumid (singular) bypasses access_filter() which only runs when forumid is null | |
| 131 | + unset( $topic_args['access_filter'] ); | |
| 132 | + unset( $topic_args['permgroup'] ); | |
| 133 | + unset( $topic_args['forumid'] ); | |
| 134 | + | |
| 135 | + // Cap row_count to prevent resource exhaustion | |
| 136 | + if( isset( $topic_args['row_count'] ) ) { | |
| 137 | + $topic_args['row_count'] = min( 50, max( 1, intval( $topic_args['row_count'] ) ) ); | |
| 138 | + } | |
| 139 | + | |
| 127 | 140 | // Validate 'orderby' parameter against whitelist |
| 128 | 141 | if( isset( $topic_args['orderby'] ) ) { |
| 129 | 142 | if( ! key_exists( $topic_args['orderby'], $this->orderby_fields ) ) { |
| 130 | 143 | $topic_args['orderby'] = $this->default_instance['orderby']; |
| @@ -134,8 +147,20 @@ | ||
| 134 | 147 | // Validate 'order' parameter against whitelist |
| 135 | 148 | if( isset( $topic_args['order'] ) ) { |
| 136 | 149 | if( ! key_exists( $topic_args['order'], $this->order_fields ) ) { |
| 137 | 150 | $topic_args['order'] = $this->default_instance['order']; |
| 151 | + } | |
| 152 | + } | |
| 153 | + | |
| 154 | + // SECURITY: coerce id-list fields to integer arrays so a serialized | |
| 155 | + // payload from an unauthenticated POST can never reach | |
| 156 | + // wpforo_parse_args() / unserialize() downstream. Defense in depth | |
| 157 | + // alongside the allowed_classes=>false hardening in wpforo_parse_args. | |
| 158 | + foreach( [ 'forumids', 'include', 'exclude' ] as $idfield ) { | |
| 159 | + if( isset( $topic_args[ $idfield ] ) ) { | |
| 160 | + $topic_args[ $idfield ] = is_array( $topic_args[ $idfield ] ) | |
| 161 | + ? array_map( 'intval', $topic_args[ $idfield ] ) | |
| 162 | + : []; | |
| 138 | 163 | } |
| 139 | 164 | } |
| 140 | 165 | } |
| 141 | 166 | |
