Background Problem
The site I'm working right now uses custom front-end forms for content, terms and user editing and creation. Access to wp-admin is blocked for non administrator.
All of them uses basic wp_ajax functionality.
On the user editing form, the function updates the user data using wp_update_user()
and saves the meta field using update_user_meta()
.
Just now i found out that one of the saved meta field is saved to another user ID (mine, administrator) by someone else.
The code wasn't changed because it works, even after I updated the overwritten user meta, using the same function.
Code
Here is the stripped code that saves the meta field.
add_action('wp_ajax_edit-author', 'process_edit_author');
function process_edit_author() {
global $current_user;
if ( empty($_POST) || !wp_verify_nonce($_POST[$current_user->user_login],'edit-author') ) {
echo 'You targeted the right function, but sorry, your nonce did not verify.';
die();
} else {
$profile_upload = $_FILES['profile-picture'];
if ($profile_upload['name'][0]) {
$profile_picture = attach_uploads($profile_upload);
update_user_meta( $current_user->ID, 'profile-picture', $profile_picture[0]);
}
wp_redirect($return);
exit;
die();
}
}
The attach_uploads()
saves the uploaded file as attachment.
The first file attachment ID then is saved to the user meta.
Analysist
So far I can only tell that the image is uploaded by someone else's account, because the author of the attachment is not me.
Need Help
Does anyone have found this problem? Where and how should I debug this problem? How can I prevent this to happen again?
Thank you in advance .