search

impress-org / givewp

GiveWP - The #1 Donation Plugin for WordPress. Easily accept donations and fundraise using your WordPress website.
https://givewp.com/
GNU General Public License v3.0
345 stars 191 forks source link

The Donor Wall API endpoint should only be accessible from authenticated requests. #6374

Closed canny[bot] closed 2 years ago

canny[bot] commented 2 years ago

Currently, the donor wall is available via a public API endpoint. It should not be. Ideally, only authenticated requests from the front end of WordPress should ahve access to that endpoint. Though this is not a security issue since none of the data on the endpoint would be qualified as sensitive information, but can be Personally Identifiable Information (PII). Donors who select to be anonymous are not displayed on the Donor wall. All of that to say, it still would make sense to resritct access to that endpoint, because some organizations may not use the Donor Wall at all, and currently that endpoint is publicly available regardless.

https://givewp.canny.io/admin/board/bug-reports/p/the-donor-wall-api-endpoint-should-only-be-accessible-from-authenticated-request

canny[bot] commented 2 years ago

This issue has been linked to a Canny post: The Donor Wall API endpoint should only be accessible from authenticated requests. :tada: