Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable Signed URLs when Entry ID taken from URL Param #1509

Merged
merged 1 commit into from
Mar 21, 2024
Merged

Disable Signed URLs when Entry ID taken from URL Param #1509

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions README.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,9 @@ Gravity PDF can be run on most modern shared web hosting without any issues. It

== Changelog ==

= 6.9.1 =
* Security: Disable the Signed URL feature in the [gravitypdf] shortcode when a URL parameter provides the entry ID (e.g. Page Confirmations)

= 6.9.0 =
* Feature: Add new conditional logic options to PDFs eg. Payment Status, Date Created, Starred (props: Gravity Wiz)
* Feature: Add support for Show HTML Fields, Show Empty Fields, Show Section Break Description, and Enable Conditional Logic PDF settings when displaying Gravity Wiz Nested Forms field
Expand Down
5 changes: 3 additions & 2 deletions src/Model/Model_Shortcodes.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,8 @@ public function process( $attributes ) {
$attributes = apply_filters( 'gfpdf_gravityforms_shortcode_attributes', $attributes );

try {
$attributes['entry'] = $this->get_entry_id_if_empty( $attributes['entry'] );
$original_entry_id = $attributes['entry'];
$attributes['entry'] = $this->get_entry_id_if_empty( $original_entry_id );

/* Do PDF validation */
$this->get_pdf_config( $attributes['entry'], $attributes['id'] );
Expand All @@ -103,7 +104,7 @@ public function process( $attributes ) {
$attributes['url'] = $pdf->get_pdf_url( $attributes['id'], $attributes['entry'], $download, $print );

/* Sign the URL to allow direct access to the PDF until it expires */
if ( ! empty( $attributes['signed'] ) ) {
if ( ! empty( $attributes['signed'] ) && ! empty( $original_entry_id ) ) {
$attributes['url'] = $this->url_signer->sign( $attributes['url'], $attributes['expires'] );
}

Expand Down
20 changes: 19 additions & 1 deletion tests/phpunit/unit-tests/test-shortcodes.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,7 +229,7 @@ public function test_gravitypdf_shortcode() {
);

$this->assertStringContainsString( '?gpdf=1&pid=556690c67856b&lid=1&action=download', $url );
$this->assertStringNotContainsString( '<a href=', $url );
$this->assertStringNotContainsString( 'href=', $url );
$this->assertStringNotContainsString( 'Download PDF', $url );

/* Test for signed URL */
Expand Down Expand Up @@ -286,6 +286,24 @@ public function test_gravitypdf_shortcode() {
$_GET['lid'] = $entry['id'];
$this->assertStringContainsString( 'Download PDF', $this->model->process( [ 'id' => '556690c67856b' ] ) );

unset( $_GET['lid'] );
$_GET['entry'] = $entry['id'];
$this->assertStringContainsString( 'Download PDF', $this->model->process( [ 'id' => '556690c67856b' ] ) );

/* Test we ignore the signed feature if the entry ID is taken from a URL parameter */
$url2 = $this->model->process(
[
'id' => '556690c67856b',
'signed' => '1',
]
);

$this->assertStringContainsString( 'Download PDF', $url2 );
$this->assertStringContainsString( 'href=', $url2 );
$this->assertStringNotContainsString( '&#038;signature=', $url2 );
$this->assertStringNotContainsString( '&#038;expires=', $url2 );

/* Test for errors */
$_GET['lid'] = '5000';
$this->assertStringContainsString( '<pre class="gravitypdf-error">', $this->model->process( [ 'id' => '556690c67856b' ] ) );

Expand Down
Loading