Repository navigation
Add additional nonce & capability checks - #869
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Two newly introduced methods use snake_case instead of the framework’s newer camelCase convention and need renaming along with updates to their call sites.
2 open issues
What changed in this PR
This PR hardens AJAX operations in the WooCommerce plugin framework by adding nonce validation and capability checks for notice dismissal and job handling.
Changes:
- Add plugin-specific dismissal nonces, POST requests, input validation, and permission checks for admin notices.
- Require an overridable capability, defaulting to
manage_woocommerce, to process or cancel jobs. - Document the security hardening in the 6.2.5 changelog.
| File | Description |
|---|---|
woocommerce/utilities/class-sv-wp-job-batch-handler.php |
Add capability checks to job-processing and cancellation endpoints. |
woocommerce/class-sv-wc-admin-notice-handler.php |
Validate nonces, permissions, and input for notice dismissal. |
woocommerce/changelog.txt |
Record the additional nonce and permission checks. |
Review effort: Balanced
| * | ||
| * @return string | ||
| */ | ||
| protected function get_dismiss_notice_nonce_action() : string { |
| * | ||
| * @return string | ||
| */ | ||
| protected function get_required_capability() : string { |
agibson-godaddy
added a commit
that referenced
this pull request
Oct 30, 2026
* Version 6.2.5 * Fix "event is not a function" error on My Payment Methods page (#867) * Fix event handler syntax error on My Payment Methods page (MWC-20379) * Update changelog --------- Co-authored-by: Ashley Gibson <agibson@godaddy.com> * Add additional nonce & capability checks (#869) * Add nonce checks to notice dismissal * Add capaiblity check to batch handling * Add changelog entry * Change since version * Fix false _doing_it_wrong in ScriptHelper::addInlineScript() on WP 6.9+ block editor (#864) * Update class-sv-wc-admin-notice-handler.php * Add fallback for wp_print_inline_script_tag function Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Updated Tests * Code updates to address Ashely's comment * Update ScriptHelperTest to correct failing tests * Update namespace * Customize messaging based on required hook * Update changelog --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ashley Gibson <agibson@godaddy.com> --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: smoen-godaddy <76167060+smoen-godaddy@users.noreply.github.com> Co-authored-by: Ashley Gibson <agibson@godaddy.com> Co-authored-by: Ashley Gibson <99189195+agibson-godaddy@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds additional nonce and capability checks.
Story: https://godaddy-corp.atlassian.net/browse/DEVX-1263
Release: #868
Before merge