1

I am allowing WordPress to load Magento widgets by overriding Mage_Widget_Adminhtml_Widgetcontroller as shown below. I'm ensuring that a user is logged in as admin, but am I opening up myself to security issues?

/**
 * Widgets management controller
 *
 * @category    Mage
 * @package     Mage_Widget
 * @author      Magento Core Team <core@magentocommerce.com>
 */
require_once("app/code/core/Mage/Widget/controllers/Adminhtml/WidgetController.php");

class Etre_WordPress_Adminhtml_WidgetController extends Mage_Widget_Adminhtml_WidgetController
{

    /**
     * Validate Form Key
     *
     * @return bool
     */
    protected function _validateFormKey()
    {
        if ($this->_isWordPressRequestAndLoggedIn()) return true;
        return parent::_validateFormKey();
    }

    /**
     * Validate Secret Key
     *
     * @return bool
     */
    protected function _validateSecretKey()
    {
        if ($this->_isWordPressRequestAndLoggedIn()) return true;
        return parent::_validateSecretKey();
    }

    protected function _isWordPressRequestAndLoggedIn()
    {
        /* We're note verifying _wpnonce with WordPress, so we can't be sure that
          the request is actually coming from WordPress. But it is a start. */
        if ($this->getRequest()->getParam('isAjax', true) && $this->getRequest()->getParam('_wpnonce', true) && Mage::getSingleton('admin/session')->isLoggedIn()):
            return true;
        elseif ($this->getRequest()->getParam('isAjax', true) && $this->getRequest()->getParam('_wpnonce', true)):
            /*The request is likely coming from wordpress but the admin is not logged in */
            Mage::getSingleton("admin/session")->addError($this->__("You must be logged into Magento to perform this action."));
            return false;
        endif;
    }
}
1

In my opinion you are opening yourself up. However the steps you are trying to use should work. I Would see if Wordpress can create a nonce that magento can verify somehow. But if that does not exist your first level here seems to be a good first step. Maybe in the Ajax pass a parameter that you can rotate to verify its a trusted source. Good luck!

  • What I've done, until I can come up with an improved security solution, is require that the request come from the same domain, that the request is being made to a list of core widget controllers, more can be added in settings and set a session variable that states that the user can only bypass validateFormKey for x minutes after initiating the request from WordPress - after that the widget button must be clicked again to refresh the bypass session. – TylersSN Jan 9 '16 at 22:17
  • That's not too bad. You may want to consider providing a form key to Wordpress and pass that along instead. You could then extend the original form key check, and if it fails (because it's from your wordpress side) you can make sure that this special form key is legitimate. You could encode a message or string that would be gibberish but decoded properly would validate its legitimate. I would hate to see you simply rely on same domain. I could spoof that pretty easily. Good luck! I know you will figure something out. – RussellAlbin Jan 10 '16 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.