Beschrijving
Deze plugin is niet getest met de laatste 3 grotere versies van WordPress. Mogelijk wordt het niet meer onderhouden of ondersteund. Ook kunnen er compatibiliteitsproblemen ontstaan wanneer het wordt gebruikt met recentere versies van WordPress.
Comment Form CSRF Protection
Beschrijving
WordPress has a 12-year-old unfixed security vulnerability that it does not properly validate incoming comments.
An attacker can trick both anonymous and logged-in users to post comments on a victim site without them realizing, while using their own credentials.
See this issue for more information: https://core.trac.wordpress.org/ticket/10931
This is a tiny (fewer than 40 effect lines of code) module that adds a secure token to the comment form and validate it before accepting any comment, thus making your comment forms secure as they should\’ve been for all these years!
It provides no UI – just install it, and you are all set!
- This plugin adds a secret cryptographically-secure token to the comment form. This is a unique value and is computationally impractical to guess it.
- Upon comment submission, the comment is rejected if the secret tokens are not present or computationally invalid.
Schermafbeeldingen
Installatie
- Upload the plugin files to the
/wp-content/plugins/directory, or install the plugin through the WordPress plugins screen directly. - Activate the plugin through the ‘Plugins’ screen in WordPress.
- You are all set! There is nothing to configure. Your comment forms will contain the hidden token fields that will be properly validated upon submission.
Beoordelingen
Bijdragers & ontwikkelaars
“Comment Form CSRF Protection” is open source software. De volgende personen hebben bijgedragen aan deze plugin.
Bijdragers
Vertaal “Comment Form CSRF Protection” in je eigen taal.
Interesse in ontwikkeling?
Bekijk de code, haal de SVN repository op, of abonneer je op het ontwikkellog via RSS.
Changelog
1.0
- Initial release.
1.1
This is a minor release that contains minimal changes.
- Marks the plugin as tested up-to WordPress 5.3
- Fix in
composer.jsonfile that it required PHP^7.2 instead of intended ^7.1 - A micro optimization in the plugin to call the lambda function directly within the CSRF check.
1.4
Minor release that contains several typo fixes and WordPress 6.3 compatibility
