Calendar widget: Cache contents using user ID as well #521
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello,
Thank you for the work on developing this plugin!
I've stumbled upon a slight security issue in the calendar widget, which might leak a user's private events.
In order to reproduce:
test
) without theread_private_events
capacity.The expected behavior is that the private event shouldn't be displayed here: only
test
and users with theread_private_events
should be able to see it.It seems to me that this is because the caching mechanism for the calendar widget is a bit too lax: even when
read_private_events
isn't set for the current user, the calendar widget will still show their private events (which is expected), but they will then be cached for any user who doesn't have theread_private_events
capacity.This tiny PR intends to fix this by using the current user's ID in the caching key instead of the
read_private_events
capacity. (Also, since the_priv
key in the$args
array then becomes useless, it is removed.)From the tests I could run, this was enough to fix the issue.
Thanks!
Zosterops