Just a quick note to let you all know that I have released v1.9.1 of my Email Log WordPress plugin that allows you to log every email that is sent from WordPress.
This released fixed a minor security bug that allows logged-in unprivileged users to view content of the logged email.
Since it is a security fix, it is a mandatory update.
Security Issue
I thought of explaining the security issue from a developer perspective as well so that it might help other developers to fix similar issues.
The plugin makes an ajax call to retrieve the contents of a logged email that is displayed in a pop-up. The callback for this ajax request was not checking whether the user has the capability to view this logged email.
This means that any logged-in user (even if he doesn’t have access to view the emails) will still be able to view the content of the email if he knows the id of that email in the email log table by making a special url that mimics the url made by the ajax request.
I fixed it by adding an if condition to check whether the user has the required capability by calling the current_user_can function.
So the lesson learnt is that you have to check the user capabilities in all ajax request that you make 🙂
Download
The easiest way to update the plugin is to automatically update it from the WordPress admin console.
If for some reason you don’t want to automatically update the plugin or would prefer to download the plugin then you can download it from WordPress plugin repo as a zip file.
Try out the latest release and let me know if you have any feedback or comments.
Hello,
I ran into an incompatibility between the Email Log plugin and the ACF Frontend Pro plugin. How can I contact you to provide you details?
Thank you