Verify nonce before saving ef post subs

Automattic · Jun 14, 2024 · 8c0adc7 · 8c0adc7
1 parent 0d6ddf2
commit 8c0adc7
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/modules/notifications/notifications.php b/modules/notifications/notifications.php
@@ -516,6 +516,11 @@ public function handle_user_post_subscription() {
 		 */
 		public function save_post_subscriptions( $new_status, $old_status, $post ) {
 			global $edit_flow;
+
+			if ( ! empty( $_GET['_wpnonce'] ) && ! wp_verify_nonce( $_GET['_wpnonce'], 'editpost' ) ) {
+				$this->print_ajax_response( 'error', $this->module->messages['nonce-failed'] );
+			}
+
 			// only if has edit_post_subscriptions cap
 			if ( ( ! wp_is_post_revision( $post ) && ! wp_is_post_autosave( $post ) ) && isset( $_POST['ef-save_followers'] ) && current_user_can( $this->edit_post_subscriptions_cap ) ) {
 				$users      = isset( $_POST['ef-selected-users'] ) ? $_POST['ef-selected-users'] : array();