search

rtCamp / rtMedia

rtMedia (formerly Buddypress Media) adds advanced multimedia functionality to WordPress, BuddyPress and bbPress
https://rtmedia.io/
122 stars 111 forks source link

Expose License Key at rtmedia.io #2036

Closed MiteshShah closed 6 months ago

MiteshShah commented 6 months ago 
104.198.7.79 BYPASS [10/Jan/2024:08:43:28 +0000] rtmedia.io "GET /?edd_action=activate_license&license=XXXXXXXXXXXXXXXXX&item_name=rtMedia%20Docs%20and%20Other%20files&url=https://www.inblf.com HTTP/1.1" 200 134 "-" "WordPress/6.4.2; https://example.com"0.254 0.255
104.236.212.59 BYPASS [10/Jan/2024:08:44:12 +0000] rtmedia.io "GET /rt-eddsl-api?rt-eddsl-license-key=XXXXXXXXXXXXXXX HTTP/1.1" 200 330 "-" "GuzzleHttp/7"0.464 0.464

Sending sensitive information (API or License key) in query parameters is generally not recommended for security reasons. URLs are often logged in various places, such as browser history, server logs, and can be exposed in shared links, posing a security risk.

@gagan0123

Utsav-Ladani commented 6 months ago

Hi @MiteshShah

This issue is resolved with this PR. We will add it in the next release.

Thanks

CC: @gagan0123

MiteshShah commented 6 months ago

@Utsav-Ladani I can see PR is merged already. Do we close this issue if we released a fix already ?

Utsav-Ladani commented 6 months ago

@MiteshShah, the fix has been added in the pre-release branch but has yet to be released.

It is added in milestone v4.6.18. So, we have to keep this PR open until milestone v4.6.18 is released. Will let you know once the plugin is released.

pavanpatil1 commented 6 months ago

It is fixed, Hence closing this issue