WordPress.org
Get WordPress

Plugin Directory

Changeset 3005263


Ignore:
Timestamp:
12/04/2023 06:51:11 PM (2 years ago)
Author:
deryck
Message:

Addressed a security issue in the login failure process, preventing a potential exploit that could harm the website. This fix significantly enhances the overall safety and reliability of the plugin.

Location:
logdash-activity-log
Files:
165 added
3 edited

Legend:

Unmodified
Added
Removed

  • logdash-activity-log/trunk/README.txt

    r2940115 r3005263  
    44Tags: Activity Log, User Activity, User Log, Audit Log, Security, Tracking, WooCommerce, bbPress, GDPR,
    55Requires at least: 5.9.5
    6 Tested up to: 6.2
     6Tested up to: 6.4.1
    77Requires PHP: 7.4
    88Stable tag: 1.1.3
    … …  
    7676== Changelog ==
    7777
     78= 1.1.4 =
     79* Addressed a security issue in the login failure process, preventing a potential exploit that could harm the website. This fix significantly enhances the overall safety and reliability of the plugin.
     80* Fixed some minor bugs that generated warnings in the logs.
     81
    7882= 1.1.3 =
    7983* Performance improved while deleting old events

  • logdash-activity-log/trunk/logdash-activity-log.php

    r2940115 r3005263  
    99 * Plugin URI:        https://deryckoe.com/logdash-activity-log
    1010 * Description:       The ultimate solution for tracking activities and security issues on your WordPress site.
    11  * Version:           1.1.3
     11 * Version:           1.1.4
    1212 * Author:            Deryck Oñate
    1313 * Author URI:        http://deryckoe.com
    … …  
    2727 * Currently plugin version.
    2828 */
    29 define( 'LOGDASH_VERSION', '1.1.3' );
     29define( 'LOGDASH_VERSION', '1.1.4' );
    3030
    3131/**

  • logdash-activity-log/trunk/src/Hooks/Users.php

    r2916051 r3005263  
    181181        global $wpdb;
    182182
    183         $log_table = DB::log_table();
     183        $log_table  = DB::log_table();
    184184        $meta_table = DB::meta_table();
    185185
    186         $user_query = "SELECT log.ID FROM {$log_table} AS log
    187                         LEFT JOIN {$meta_table} AS meta ON meta.event_id = log.ID
    188                         WHERE log.event_type = '{$failed_login}'
    189                         AND meta.name = 'userLogin'
    190                         AND meta.value = '{$user_login}'
    191                         AND FROM_UNIXTIME(created, '%Y-%m-%d') = CURRENT_DATE()
    192                         ORDER BY log.ID DESC LIMIT 1;";
     186        $user_query = $wpdb->prepare( "SELECT log.ID FROM {$log_table} AS log
     187                               LEFT JOIN {$meta_table} AS meta ON meta.event_id = log.ID
     188                               WHERE log.event_type = %s
     189                               AND meta.name = 'userLogin'
     190                               AND meta.value = %s
     191                               AND FROM_UNIXTIME(created, '%%Y-%%m-%%d') = CURRENT_DATE()
     192                               ORDER BY log.ID DESC LIMIT 1;",
     193            $failed_login, $user_login );
    193194
    194195        $event_id = $wpdb->get_var( $user_query );
    … …  
    217218
    218219            if ( false === $user ) {
    219 
    220220                $this->event
    221221                    ->insert( EventTypes::FAILED_LOGIN, EventCodes::USER_LOGIN_FAIL, self::$object_type, self::$object_type, 0, 0, null )
    … …  
    261261        }
    262262
     263        if ( is_int( $meta_value ) ) {
     264            $meta_value = (string) $meta_value;
     265        }
    263266
    264267        $this->event
    … …  
    267270                new EventMeta( 'fieldName', $meta_key ),
    268271                new EventMeta( 'oldValue', $this->old_meta[ $meta_key ] ),
    269                 new EventMeta( 'newValue', $meta_value ),
     272                new EventMeta( 'newValue',  $meta_value ),
    270273                new EventMeta( 'userLogin', $event_user->user_login ),
    271274                new EventMeta( 'firstName', $event_user->first_name ),
Note: See TracChangeset for help on using the changeset viewer.