0

I'm developing a plugin in which a user can upload, view and delete some private files. Obviously, a user should always only be able to work with his own files, not those of other users.

I'm wondering if it is unwise to do any of these actions with ajax for security reasons. Mainly because https://codex.wordpress.org/AJAX_in_Plugins#Ajax_on_the_Viewer-Facing_Side states that everything executed through admin-ajax.php is executed 'with elevated rights' (under 'Note 2'). Can I still achieve secure differentiation between users and only allow access to the respective AJAX functions for the owner of the file (certainly identify user and his ID for DB selection of files) and for the admin (certainly ensure user has admin rights and grant access to all files)?

Also, how can Nonces increase security in this case? As far as I understand they are only useful if you want to restrict executing an action to a limited number or time, yet their use is highly encouraged in any article about wordpress and ajax regardless of use.

Improve this question
3
  • note 2 says nothing about "elevated rights", it is just your interpretation of it.
    – Mark Kaplun
    Commented Dec 28, 2016 at 5:56
  • Sorry, I was unprecise. It's actually the paragraph below 'Note 2' which states something about 'elevated permissions'.
    – kot
    Commented Dec 29, 2016 at 19:19
  • ok, will try to clarify. Just being in admin context is not by itself a privilege. Some core code and plugin code did used to take that as some indication as to the level of privilege, but that stopped at version 2.3 IIRC which was probably 8 years ago. No code in core, themes or plugins use that as an indication of privilege for a long long time.
    – Mark Kaplun
    Commented Dec 29, 2016 at 22:08

1 Answer 1

Reset to default
1

The note is about the use of is_admin() to determine if a user has privileges to do something, because in every other context except admin-ajax.php, that will only be true for a logged in user. You can still use the API to determine if a user is logged in and who they are, and as long as you do that, and operate on that data, it is as safe as any other type of request.

Nonces can increase security by enforcing intent to invoke an action. Links that trigger AJAX requests can be forged by others, and if someone gets a logged in user to unknowingly click one of those links, it can invoke an action the user did not intend to. Nonces aim to prevent this by adding a unique identifier that is only good for a specific action, and expires. By checking that nonce, you can be more confident that the user intended to invoke that action and the request is not forged.

Improve this answer
4
  • Thanks for the reply. Can you be more precise about is_admin() beeing true here? Why would it be true for every logged in user in another context? Can I still determine if a user is an admin in this context?
    – kot
    Commented Dec 29, 2016 at 19:22
  • is_admin is true when you are on an administration page, it has nothing to do with having an administrator role. it's about context of page, not capabilities of the user. use current_user_can to know if the user has permission to do something.
    – Milo
    Commented Dec 29, 2016 at 19:54
  • Thanks again. Any idea then why the documentation explicitly states 'Carefully review the actions you are performing in your code since unprivileged users or visitors will be able to trigger requests with elevated permissions that they may not be authorized for.'?
    – kot
    Commented Dec 29, 2016 at 22:02
  • Not sure. The great and terrible thing about the documentation is that it can be edited by anyone.
    – Milo
    Commented Dec 30, 2016 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.