3 ms·
wow, they deleted 300 lines, many giving credit to others, just to replace it with > Security - ACF defined Post Type and Taxonomy metabox callbacks no longer
by grayhatter 2y ago
wow, they deleted 300 lines, many giving credit to others, just to replace it with
> Security - ACF defined Post Type and Taxonomy metabox callbacks no longer have access to $_POST data. (Thanks to the Automattic Security Team for the disclosure)
If I was on that security team, I would be livid they used my team's name on this behavior.
If this was done by that security team, their ethics are disgusting, and likely non-salvageable...
Still looking for the security exploit worthy of a plugin takeover though.
edit; best I can figure tonight is it's some concern over CSRF, but they don't even sanitize $_GET nor $_SESSION, only _POST and _REQUEST... so either it's more complicated than it looks on the surface, or this "fix" is partial at best, and wasn't written by someone from security. (It's also possible or likely that I'm missing some context, it's been a long time since I've had to work on php)
- luckylion 2y agoIt's extra funny when you consider all the recent acts where some plugin developer sells his plugin to some shady company, they go and add "functionality" to it that fundamentally changes the plugin, adds forced widgets to users' websites to promote their services etc, and the WP security team is like "they're allowed to do that, that's perfectly fine". I don't know how much overlap there is between the Automattic and WP security teams but I assume there's some like with most things in WP.
- maxloh 2y agoWieldy enough, that line likely came from the original developer (ACF/WP Engine) [0]. I believe WordPress.org backported the change and named it v6.3.6.1 at that time [1], before rebranding ACF in a later version (v6.3.6.2). [0]: https://www.advancedcustomfields.com/changelog/ https://www.advancedcustomfields.com/changelog/ [1]: https://plugins.trac.wordpress.org/changeset?new=3164480%40advanced-custom-fields&old=3143016%40advanced-custom-fields#diff-legend https://plugins.trac.wordpress.org/changeset?new=3164480%40a...
- Svip 2y agoAh, that would explain why those fixes are noted as "since 6.3.8".
- deleted 2y ago[deleted]
- cutemonster 2y agoYes, the whole changelog: gone. That's weird. And: `Author: WP Engine` is now `Author: WordPress.org` Is that even legal? If they had changed to "Maintained by" it would make more sense.
- maxloh 2y agoConfirmed: that patch was actually authored by ACF. https://x.com/WordPress/status/1845698272888811775 https://x.com/WordPress/status/1845698272888811775