Added nonce for reviews and checking user limits. #2592
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Coverage report
Test suite run success169 tests passing in 22 suites. Report generated by 🧪jest coverage report action from 129264c |
![codeclimate[bot]](https://avatars.githubusercontent.com/in/9403?s=60&v=4){kind=small}
|
Code Climate has analyzed commit 129264c and detected 3 issues on this pull request. Here's the issue category breakdown:
The test coverage on the diff in this pull request is 1.5% (50% is the threshold). This pull request will bring the total coverage in the repository to 56.3%. View more on Code Climate. |
brianhogg
requested changes
Feb 5, 2024
ideadude
commented
Feb 12, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
The reviews form did not have a nonce. Adding one makes sure people are on the site when submitting a review.
Further, while the form was hidden if the one review per person setting was enabled and the user already submitted a review, the code that processed the AJAX calls did not also check this setting or the user limits.
Together, the above could allow someone to create unlimited reviews from offsite by posting to the admin-ajax.php with the correct values.
This PR adds the nonce and also abstracts the limit check into it's own method and then uses that to see if the form should be shown AND uses it again on the backend before creating the review posts.
How has this been tested?
Make sure to build llms.js or the nonce check will not work.
This has been tested locally by creating a course and enabling reviews and the prevent multiple reviews setting. You can open the course page in multiple tabs before submitting a review. Then submit a review in the first tab. A review should show up in the dashboard. Then submit a review in the second tab. While it still says "Thanks" on the frontend, there will be no review in the backend.
I also tested using Postman and sending authenticated POST requests directly to admin-ajax to create reviews. They do not work without the nonce.
We could consider showing better error messages when the limit is hit, but I don't think this is important in these edge cases.
Screenshots
Types of changes
Checklist: