Changeset 2876110

Timestamp:

03/07/2023 07:50:50 PM (17 months ago)

Author:

cfinke

Message:

Don't use the API key as a URL parameter for the stats iframes.

Instead, exchange the API key on the server-side for a token that is only valid for stats requests. This prevents any disclosure of API keys to users who have access to the stats pages but shouldn't have knowledge of the API key.

This is likely a very uncommon scenario but still worth addressing.

Location:

akismet/trunk

Files:

• akismet.php (modified) (2 diffs)
• class.akismet.php (modified) (1 diff)
• readme.txt (modified) (1 diff)
• views/config.php (modified) (1 diff)
• views/stats.php (modified) (1 diff)

akismet/trunk/akismet.php

@@ -7 +7 @@
 Plugin URI: https://akismet.com/
 Description: Used by millions, Akismet is quite possibly the best way in the world to <strong>protect your blog from spam</strong>. It keeps your site protected even while you sleep. To get started: activate the Akismet plugin and then go to your Akismet Settings page to set up your API key.
-Version: 5.1a1
+Version: 5.1a
 Requires at least: 5.0
 Requires PHP: 5.2
@@ -40 +40 @@
 }
 
-define( 'AKISMET_VERSION', '5.1a1' );
+define( 'AKISMET_VERSION', '5.1a' );
 define( 'AKISMET__MINIMUM_WP_VERSION', '5.0' );
 define( 'AKISMET__PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

akismet/trunk/class.akismet.php

@@ -85 +85 @@
     public static function get_api_key() {
         return apply_filters( 'akismet_get_api_key', defined('WPCOM_API_KEY') ? constant('WPCOM_API_KEY') : get_option('wordpress_api_key') );
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
     }
 

akismet/trunk/readme.txt

@@ -36 +36 @@
 * Removed unnecessary limit notices from admin page.
 * Improved spam detection by including post taxonomies in the comment-check call.
+
 
 = 5.0.2 =

akismet/trunk/views/config.php

@@ -38 +38 @@
 
                 <div class="akismet-new-snapshot">
-                    <iframe allowtransparency="true" scrolling="no" frameborder="0" style="width: 100%; height: 220px; overflow: hidden;" src="<?php echo esc_url( sprintf( 'https://tools.akismet.com/1.0/snapshot.php?blog=%s&api_key=%s&height=200&locale=%s', urlencode( get_option( 'home' ) ), Akismet::get_api_key(), get_locale() ) ); ?>"></iframe>
+                    <iframe allowtransparency="true" scrolling="no" frameborder="0" style="width: 100%; height: 220px; overflow: hidden;" src="<?php echo esc_url( sprintf( 'https://tools.akismet.com/1.0/snapshot.php?blog=%s&), get_locale() ) ); ?>"></iframe>
                     <ul>
                         <li>

akismet/trunk/views/stats.php

@@ -8 +8 @@
         </div>
     </div>
-    <iframe src="<?php echo esc_url( sprintf( 'https://tools.akismet.com/1.0/user-stats.php?blog=%s&api_key=%s&locale=%s', urlencode( get_option( 'home' ) ), esc_attr( Akismet::get_api_key() ), esc_attr( get_locale() ) ) ); ?>" width="100%" height="2500px" frameborder="0"></iframe>
+    <iframe src="<?php echo esc_url( sprintf( 'https://tools.akismet.com/1.0/user-stats.php?blog=%s&() ), esc_attr( get_locale() ) ) ); ?>" width="100%" height="2500px" frameborder="0"></iframe>
 </div>