Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/ar-for-wordpress/ar-wordpress.php
+++ b/ar-for-wordpress/ar-wordpress.php
@@ -3,7 +3,7 @@
* Plugin Name: AR for WordPress
* Plugin URI: https://augmentedrealityplugins.com
* Description: AR for WordPress Augmented Reality plugin.
- * Version: 8.40
+ * Version: 8.41
* Requires at least: 5.5
* Requires PHP: 7.4
* Author: Web and Print Design
--- a/ar-for-wordpress/includes/ar-secure-download.php
+++ b/ar-for-wordpress/includes/ar-secure-download.php
@@ -17,6 +17,19 @@
}
/************* Function to decrypt the file path *******************/
+if (!function_exists('ar_get_secure_download_secret')){
+ function ar_get_secure_download_secret() {
+ $secret = get_option('ar_secure_download_secret');
+
+ if (!is_string($secret) || strlen($secret) < 32) {
+ $secret = wp_generate_password(64, true, true);
+ update_option('ar_secure_download_secret', $secret, false);
+ }
+
+ return $secret;
+ }
+}
+
if (!function_exists('ar_decrypt_file_path')){
// Function to decrypt the file path
function ar_decrypt_file_path($encrypted_data, $key) {
@@ -24,7 +37,11 @@
$key = substr(hash('sha256', $key, true), 0, 32);
// Decode the encrypted data
- $data = base64_decode($encrypted_data);
+ $data = base64_decode($encrypted_data, true);
+ if ($data === false) {
+ return false;
+ }
+
$parts = explode('::', $data, 2);
if (count($parts) < 2) {
@@ -33,41 +50,72 @@
$iv = $parts[0];
$encrypted = $parts[1];
+
+ if (strlen($iv) !== openssl_cipher_iv_length('AES-256-CBC')) {
+ return false;
+ }
// Decrypt the file path
return openssl_decrypt($encrypted, 'AES-256-CBC', $key, 0, $iv);
}
}
+/************* Function to validate a decrypted uploads path *******************/
+if (!function_exists('ar_validate_secure_download_path')){
+ function ar_validate_secure_download_path($file_path, $allowed_directory) {
+ if (!is_string($file_path) || $file_path === '' || strpos($file_path, " ") !== false) {
+ return false;
+ }
+
+ $file_path = str_replace('\', '/', $file_path);
+
+ if (preg_match('#(^/|^[A-Za-z]:|://)#', $file_path) || preg_match('#(^|/)..(/|$)#', $file_path)) {
+ return false;
+ }
+
+ $valid_extensions = array('gltf', 'glb', 'usdz');
+ $ext = strtolower(pathinfo($file_path, PATHINFO_EXTENSION));
+ if (!in_array($ext, $valid_extensions, true)) {
+ return false;
+ }
+
+ $allowed_directory = realpath($allowed_directory);
+ if (!$allowed_directory) {
+ return false;
+ }
+
+ $full_file_path = realpath($allowed_directory . '/' . ltrim($file_path, '/'));
+ if (!$full_file_path || !is_readable($full_file_path)) {
+ return false;
+ }
+
+ $allowed_directory = rtrim(wp_normalize_path($allowed_directory), '/') . '/';
+ $full_file_path_normalized = wp_normalize_path($full_file_path);
+
+ if (strpos($full_file_path_normalized, $allowed_directory) !== 0) {
+ return false;
+ }
+
+ return $full_file_path;
+ }
+}
/************* Function to validate and serve the request *******************/
if (!function_exists('ar_validate_and_serve_file')){
function ar_validate_and_serve_file($encrypted_file_path) {
// Define the secret key for encryption/decryption
- $secret_key = get_option('ar_licence_key'); // Change this to a secure key
+ $secret_key = ar_get_secure_download_secret();
// Decrypt the file path
$file_path = ar_decrypt_file_path($encrypted_file_path, $secret_key);
+ if ($file_path === false) {
+ wp_die('Invalid file request.');
+ }
// Get the uploads directory path dynamically
$uploads_dir = wp_upload_dir(); // Get the upload directory information
$allowed_directory = $uploads_dir['basedir']; // Base directory for uploads
- $full_file_path = $allowed_directory . '/' . $file_path;
-
- // Referrer Check: Ensure the request is coming from a valid source
- $referer = isset($_SERVER['HTTP_REFERER']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_REFERER'])) : '';
- $valid_referer = home_url(); // You can set this to your site's URL or specific referrers
-
- if (strpos($referer, $valid_referer) !== 0) {
- wp_die('Unauthorized access');
- }
- if (file_exists($full_file_path)) {
- // Sanitize the file path to ensure it's safe.
- $full_file_path = realpath($full_file_path);
-
- // Check if the file exists and is readable before proceeding
- if (!$full_file_path || !is_readable($full_file_path)) {
- wp_die('File not found or inaccessible.');
- }
+ $full_file_path = ar_validate_secure_download_path($file_path, $allowed_directory);
+ if ($full_file_path) {
// Prevent caching
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
@@ -80,10 +128,11 @@
header('Content-Disposition: attachment; filename="' . esc_attr(basename($file_path)) . '"'); // Escape the filename
// Use a secure file read function to output the file contents.
- if (ar_wp_readfile($full_file_path) === false) {
+ $file_contents = ar_wp_readfile($full_file_path);
+ if ($file_contents === false) {
wp_die('Error reading the file.');
}
- ar_return_file( ar_wp_readfile($full_file_path));
+ ar_return_file($file_contents);
exit;
} else {
wp_die('File not found');
@@ -91,7 +140,7 @@
}
}
// Verify the nonce before processing
-if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'ar_secure_nonce' ) ) {
+if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'ar_secure_download_nonce' ) ) {
wp_die( __( 'Security check failed.', 'ar-for-wordpress' ) );
}
// Get the encrypted file path from the query string
--- a/ar-for-wordpress/includes/ar-secure-url-generate.php
+++ b/ar-for-wordpress/includes/ar-secure-url-generate.php
@@ -7,6 +7,19 @@
/************* Encrypt the file path *******************/
+if (!function_exists('ar_get_secure_download_secret')){
+ function ar_get_secure_download_secret() {
+ $secret = get_option('ar_secure_download_secret');
+
+ if (!is_string($secret) || strlen($secret) < 32) {
+ $secret = wp_generate_password(64, true, true);
+ update_option('ar_secure_download_secret', $secret, false);
+ }
+
+ return $secret;
+ }
+}
+
if (!function_exists('ar_encrypt_file_path')){
// Function to encrypt the file path
function ar_encrypt_file_path($file_path, $key) {
@@ -28,11 +41,10 @@
/************* Check if the URL is within the WordPress installation *******************/
if (!function_exists('ar_is_within_wordpress_install')){
function ar_is_within_wordpress_install($url) {
- $home_url = home_url(); // Get the base URL of the WordPress installation
$upload_dir = wp_upload_dir(); // Get the upload directory path
$upload_base_url = $upload_dir['baseurl']; // Base URL of the uploads directory
- // Check if the URL starts with the base URL or uploads base URL
- return strpos($url, $home_url) === 0 || strpos($url, $upload_base_url) === 0;
+ // Secure downloads only serve files from the uploads directory.
+ return strpos($url, trailingslashit($upload_base_url)) === 0;
}
}
@@ -40,7 +52,7 @@
if (!function_exists('ar_is_valid_file_extension')){
function ar_is_valid_file_extension($file_path) {
$valid_extensions = array('gltf', 'glb', 'usdz');
- $ext = pathinfo($file_path, PATHINFO_EXTENSION);
+ $ext = strtolower(pathinfo($file_path, PATHINFO_EXTENSION));
return in_array($ext, $valid_extensions);
}
}
@@ -50,11 +62,11 @@
function ar_get_secure_model_url($file_url) {
global $ar_plugin_id;
if ((get_option('ar_licence_valid')=='Valid') AND (get_option('ar_secure_model_urls')==1)){
- $secret_key = get_option('ar_licence_key');
+ $secret_key = ar_get_secure_download_secret();
// Check if the URL is within the WordPress installation and encrypt it
if (ar_is_within_wordpress_install($file_url)) {
$uploads_dir = wp_upload_dir();
- $uploads_url = $uploads_dir['baseurl'].'/';
+ $uploads_url = trailingslashit($uploads_dir['baseurl']);
// Extract the upload path from the URL
$file_path = str_replace($uploads_url, '', $file_url);
// Check if the file is from galllery builder
@@ -64,7 +76,7 @@
}elseif (ar_is_valid_file_extension($file_path)) {
// Check if the file extension is valid
$encrypted_file_path = ar_encrypt_file_path($file_path, $secret_key);
- $nonce = wp_create_nonce('ar_secure_nonce');
+ $nonce = wp_create_nonce('ar_secure_download_nonce');
$secure_url = site_url('/wp-content/plugins/'.$ar_plugin_id.'/includes/ar-secure-download.php?file=' . urlencode($encrypted_file_path) . '&_wpnonce=' . $nonce);
} else {
// Use the original URL if the file type is not valid
