daithi-coombes / api-connection-manager

Manages connections and requests to 3rd party providers or services
0 stars 1 forks source link

Security: File location in login uri #67

Open daithi-coombes opened 11 years ago

daithi-coombes commented 11 years ago

moved from https://github.com/cityindex/labs.cityindex.com/issues/104

The file location for callbacks are displayed in the uri. eg:

http://cityindex.loc/wp-admin/admin-ajax.php?action=api_con_mngr&login=true&slug=github%2Findex.php&file=%2Fvar%2Fwww%2Fcityindex.loc%2Flabs.cityindex.com%2Fhttpdocs%2Fwp-content%2Fplugins%2Fapi-connection-manager%2Fclass-api-connection-manager-user.php&callback=a%3A2%3A%7Bi%3A0%3Bs%3A27%3A%22API_Connection_Manager_User%22%3Bi%3A1%3Bs%3A12%3A%22connect_user%22%3B%7D The above link makes public the path /var/www/cityindex.loc/labs.cityindex.com/httpdocs/wp-content/plugins/api-connection-manager/class-api-connection-manager-user.php

Instead use $_SESSIONs/db for storing callback functions