Update class-sensei-messages.php #7811

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

V35HR4J wants to merge 1 commit into Automattic:trunk from V35HR4J:patch-1

V35HR4J commented Apr 11, 2025

Resolves https://hackerone.com/reports/2904382

Proposed Changes

Add early template_redirect hook to prevent message URL leaks
Remove canonical redirect for message posts
Add proper permission checks before redirects
Redirect unauthorized users to home page

Testing Instructions

Try accessing a message URL directly (e.g. /?p=92)
Verify you are redirected to home page instead of seeing the message URL in Location header

New/Updated Hooks

Added template_redirect hook with priority 1 to catch requests before canonical redirect
Removed default redirect_canonical action for message posts

Pre-Merge Checklist

PR title and description contain sufficient detail and accurately describe the changes
Adheres to coding standards
All strings are translatable
Follows our naming conventions
Hooks and functions are documented
Code is tested on the minimum supported PHP and WordPress versions


          Update class-sensei-messages.php

53e7b6f

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet