WooMinecraft / WooMinecraft

A FREE Minecraft Donation Plugin that leverages the flexibility of WordPress and the WooCommerce plugin to provide a truely free self-hosted donation system for Minecraft Servers.
http://plugish.com
GNU General Public License v2.0
71 stars 59 forks source link

Security risk - printing raw server key #235

Open YouHaveTrouble opened 3 years ago

YouHaveTrouble commented 3 years ago

There is currently security risk with WooMinecraft logging connection url when it gets unexpected response.

There isn't a given that all people having access to console have access to the woocommerce shop key. This can result in possible sabotage where someone would set up a server with the key and redeemed the purchases there instead of the server it's supposed to.

Best way to fix this is to send the server key in a header instead of in the url and display the data based on header rather than raw url on wp plugin side.

JayWood commented 3 years ago

Valid point, this seems like a regression as I was originally replacing the server key, not sure what happened.