Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 6 commits
- 10 files changed
- 5 contributors
Commits on Jul 8, 2026
-
fix: prevent SSRF via JSON import handlers
The `getJsonRoots()` and `getJsonData()` AJAX handlers verified only a nonce before fetching a user-supplied URL server-side, and the fetch used the unsafe `wp_remote_request()`. A Contributor (edit_posts) could read the nonce from the chart editor and make WordPress fetch arbitrary internal URLs, with the response reflected back (non-blind SSRF). - Add a `current_user_can( 'edit_posts' )` guard to both handlers, matching the sibling AJAX handlers in the file. - Switch `Visualizer_Source_Json::connect()` to `wp_safe_remote_request()`, matching the SSRF-safe transport already used by the CSV/remote path. - Add regression tests covering the capability guard and safe transport. Fixes Codeinwp/visualizer-pro#591 Co-Authored-By: Claude Fable 5 <[email protected]>
Commits on Jul 10, 2026
-
Merge pull request #1331 from Codeinwp/fix/json-import
fix: prevent SSRF via JSON import handlers
-
##### [Version 4.0.5](v4.0.4...v4.0.5) (2026-07-10) - Enhanced security
Loading
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff v4.0.4...v4.0.5