Contact Form: improve security of the form endpoint (#39759)

* Contact Form: improve security of the form endpoint Ensure that submitted forms can only be accessed by logged in users with the necessary capabilities. Reference: p9dueE-8ng-p2 Co-authored-by: Chris Jean <[email protected]> * changelog --------- Co-authored-by: Chris Jean <[email protected]>
Automattic · Oct 14, 2024 · 1a544bc · 1a544bc
1 parent 8af02a6
commit 1a544bc
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 0 deletions.
diff --git a/projects/packages/forms/changelog/fix-vulnerable-forms-feedback-api-endpoint b/projects/packages/forms/changelog/fix-vulnerable-forms-feedback-api-endpoint
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fixed
+
+Improve security of the form endpoint
diff --git a/projects/packages/forms/src/contact-form/class-contact-form-endpoint.php b/projects/packages/forms/src/contact-form/class-contact-form-endpoint.php
@@ -22,6 +22,9 @@ class Contact_Form_Endpoint extends \WP_REST_Posts_Controller {
 	 * @return WP_Error|boolean
 	 */
 	public function get_items_permissions_check( $request ) { //phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
+		if ( ! current_user_can( 'edit_pages' ) ) {
+			return false;
+		}
 		if ( ! is_user_member_of_blog( get_current_user_id(), get_current_blog_id() ) ) {
 			return new WP_Error(
 				'rest_cannot_view',
@@ -40,6 +43,9 @@ public function get_items_permissions_check( $request ) { //phpcs:ignore Variabl
 	 * @return WP_Error|boolean
 	 */
 	public function get_item_permissions_check( $request ) { //phpcs:ignore VariableAnalysis.CodeAnalysis.VariableAnalysis.UnusedVariable
+		if ( ! current_user_can( 'edit_pages' ) ) {
+			return false;
+		}
 		if ( ! is_user_member_of_blog( get_current_user_id(), get_current_blog_id() ) ) {
 			return new WP_Error(
 				'rest_cannot_view',

diff --git a/projects/plugins/jetpack/changelog/fix-vulnerable-forms-feedback-api-endpoint b/projects/plugins/jetpack/changelog/fix-vulnerable-forms-feedback-api-endpoint
@@ -0,0 +1,4 @@
+Significance: patch
+Type: bugfix
+
+Contact Form: ensure that submitted forms can only be accessed by logged in users allowed to view form submissions.