peptide-repo/peptide-news-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: require token as query param on GET /worker/pending to close LiteSpeed cache bypass

Browse Source
This commit is contained in:
opencode
2026-08-03 21:38:33 +08:00
parent b1b575e634
commit 42833e96b2
1 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
includes/class-peptide-news-rest-worker.php
View File

@@ -32,23 +32,27 @@ class Peptide_News_Rest_Worker {
nocache_headers(); nocache_headers();
header( 'X-LiteSpeed-Cache-Control: no-cache' ); header( 'X-LiteSpeed-Cache-Control: no-cache' );
if ( current_user_can( 'manage_options' ) ) { $token = get_option( 'peptide_news_vps_token', '' );
return true;
}
$token = get_option( 'peptide_news_vps_token', '' );
if ( ! empty( $token ) && class_exists( 'Peptide_News_Encryption' ) ) { if ( ! empty( $token ) && class_exists( 'Peptide_News_Encryption' ) ) {
$decrypted = Peptide_News_Encryption::decrypt( (string) $token ); $decrypted = Peptide_News_Encryption::decrypt( (string) $token );
if ( ! empty( $decrypted ) ) { if ( ! empty( $decrypted ) ) {
$token = $decrypted; $token = $decrypted;
} }
} }
$header_auth = $request->get_header( 'x_peptide_news_token' );
if ( empty( $header_auth ) ) { if ( WP_REST_Server::READABLE === $request->get_method() ) {
$header_auth = $request->get_param( 'token' ); $auth_token = (string) $request->get_param( 'token' );
} else {
if ( current_user_can( 'manage_options' ) ) {
return true;
}
$auth_token = (string) $request->get_header( 'x_peptide_news_token' );
if ( empty( $auth_token ) ) {
$auth_token = (string) $request->get_param( 'token' );
}
} }
if ( ! empty( $token ) && ! empty( $header_auth ) && hash_equals( (string) $token, (string) $header_auth ) ) { if ( ! empty( $token ) && ! empty( $auth_token ) && hash_equals( (string) $token, $auth_token ) ) {
return true; return true;
} }