1

I'm writing a plugin that modifies the default behavior when uploading a file for a post or to the media library. I'm setting $overrides in wp_handle_upload() with a custom $unique_filename_callback.

Once I added that, it tripped the following check inside wp_handle_upload(), because $_POST['action'] wasn't set. (I'm not sure why it wasn't, but it wasn't).

if ( $test_form && (!isset( $_POST['action'] ) || ($_POST['action'] != $action ) ) )
    return call_user_func($upload_error_handler, $file, __( 'Invalid form submission.' ));

So, I set $overrides['test_form'] = false, and now it's working. I'm wondering if that could be a potential security issue, though. Would that allow someone to post a form from a remote source or something?

It seems like it's normal to disable it when you're creating your own upload fields, but I'm using the built-in post upload form, so I want to make sure.

Improve this question

1 Answer 1

Reset to default
0

I wouldn't say security concern - since you're using this plugin within the admin (I presume after the user has been authenticated i.e. after admin_init), then already you've got protection against any Jon Doe posting a form to your script.

What it does provide, is an additional layer of authentication. All it really boils down to is sending a 'secret' along with the form, and then checking for it's existence (and that it matches) before continuing.

For an attacker, they'd need to know this secret in order to breach, for example, using CSRF or XSS.

This is the very nature of how WordPress nonces work. In fact you'd be a lot better off using these instead of test_form. They go one step better in that they're secrets that expire, so the window for an attacker is made even smaller.

Check out Jaquith's article on Nonces.

Improve this answer
3
  • I'm using the core media upload form and handler, though, so doesn't it already uses nonces? If it doesn't, wouldn't I have to mod the core files to add them?
    – Ian Dunn
    Commented Mar 13, 2011 at 2:43
  • If you're invoking wp_handle_upload() yourself, then you'll need to utilise nonces yourself. You don't need to mod core files, just use wp_nonce_field('my_action', 'my_name') in your form and wp_verify_nonce('my_name', 'my_action') to check the nonce. However, if your code is running off the back of a WordPress hook, and the operation that calls the hook uses a nonce itself, then you've already got the protection!
    – TheDeadMedic
    Commented Mar 13, 2011 at 2:52
  • Right, I'm just hooking into the standard upload process. Thanks for the help :)
    – Ian Dunn
    Commented Mar 13, 2011 at 5:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.