BuddyPress/buddypress
1
0
Fork 0
mirror of https://github.com/buddypress/buddypress.git synced 2026-07-22 20:56:55 +08:00
Code Packages Activity Actions
buddypress/tests/phpunit/testcases/messages
History
Exact
David Cavins 27d41e9749 Improve security of messages endpoint. 
In messages endpoint, sanitize the incoming user_id parameter value to avoid user spoofing.

Special thanks to trihedron who first reported this issue responsibly.

Props emaralive, johnjamesjacoby, espellcaste, trihedron, substitute99, j2k14a, g_r_i_n_n, pythonime, dizconnect (Sanjorn Keeratirungsan), eneednar19, bb-hunter (Mustafa Ahmed), yhalo (Yaohui Wang), Ngo Anh Duc, ekbreks, jeromewincek (Jerome Wincek), taylsec, ajaah-254, izumi_hyun, mickey_cyberkid (Michael Okyere), underdog_theori, duyytrann (Duy Tran), safe-us (Safe Us Team), miauuu, daupaul (Dau-Po Yu).

git-svn-id: https://buddypress.svn.wordpress.org/trunk@14213 cdf35c40-ae34-48e0-9cc9-0c9da1808c22
2026-07-07 20:02:20 +00:00
..
cache.php A user is no longer de-authenticated when making REST API requests. 2024-11-03 18:19:06 +00:00
class.bp-messages-notice.php A user is no longer de-authenticated when making REST API requests. 2024-11-03 18:19:06 +00:00
class.bp-messages-thread.php A user is no longer de-authenticated when making REST API requests. 2024-11-03 18:19:06 +00:00
functions.php A user is no longer de-authenticated when making REST API requests. 2024-11-03 18:19:06 +00:00
notifications.php A user is no longer de-authenticated when making REST API requests. 2024-11-03 18:19:06 +00:00
star.php A user is no longer de-authenticated when making REST API requests. 2024-11-03 18:19:06 +00:00
template.php A user is no longer de-authenticated when making REST API requests. 2024-11-03 18:19:06 +00:00
test-controller.php Improve security of messages endpoint. 2026-07-07 20:02:20 +00:00
test-sidewide-notices-controller.php A user is no longer de-authenticated when making REST API requests. 2024-11-03 18:19:06 +00:00