Conversation
…-idor-vulnarability
📝 WalkthroughWalkthroughVersion 3.6.1 patch release published to fix a "Class not found" error for GetUniverseDomainInterface. Updates include version bump in package.json and changelog documentation of the fix in readme.txt. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. 📜 Recent review detailsConfiguration used: defaults Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Fix all issues with AI agents
In @includes/calendars/views/default-calendar-grid.php:
- Around line 662-676: The conditional branches checking $post->post_status are
redundant because both 'private' and other non-'publish' statuses run the same
current_user_can('read_post', $id) check; simplify by replacing the entire
if/elseif/else block with a single check: if ($post->post_status !== 'publish')
{ if (! current_user_can('read_post', $id)) { wp_send_json_error('You do not
have permission to view this calendar.'); return; } } so you retain the same
security logic while removing duplicate code (referencing $post->post_status,
current_user_can('read_post', $id), and wp_send_json_error).
- Around line 652-676: Add a nonce check at the top of this AJAX handler (before
the post existence/type/permission checks) by calling
check_ajax_referer('simcal', 'security') to validate the incoming nonce; if it
fails, return wp_send_json_error('Invalid nonce') (or let WordPress handle it).
Then update the front-end AJAX call that requests this endpoint to include the
nonce field named "security" with the value from simcal_default_calendar.nonce
(provided by simcal_common_scripts_variables()) in the data payload. Ensure the
nonce check runs before any sensitive logic in this file so unauthenticated
requests cannot bypass the permission checks.
In @includes/calendars/views/default-calendar-list.php:
- Around line 788-803: The status check for $post->post_status is redundant:
both the 'private' and other branches perform the same permission check with
current_user_can('read_post', $id) and wp_send_json_error; simplify by replacing
the entire if/elseif/else block with a single conditional that only allows the
public case (if $post->post_status !== 'publish' then check
current_user_can('read_post', $id) and call wp_send_json_error('You do not have
permission to view this calendar.') and return if false), keeping $post,
post_status, current_user_can, wp_send_json_error and $id as the referenced
symbols.
- Around line 779-803: The AJAX handler lacks nonce verification and the
proposed fix used the wrong action name; update the PHP handler in
default-calendar-list.php to call check_ajax_referer('simcal', 'nonce') at the
start of the AJAX flow (before get_post/current_user_can checks) to validate the
nonce created by simcal_common_scripts_variables(), and update the corresponding
JavaScript AJAX call that triggers this handler to include the localized nonce
value (use the same object/property populated by
simcal_common_scripts_variables()) in the request payload under the key 'nonce'
so the server-side check_ajax_referer('simcal','nonce') succeeds.
In @readme.txt:
- Line 5: Update the PHP minimum requirement string "Requires PHP: 8.1" to
"Requires PHP: 7.4" in the readme; also search for and lower any matching PHP
constraints elsewhere (e.g., composer.json require/php entry like "php": ">=8.1"
-> ">=7.4" and CI workflow matrix keys such as php-version: 8.1 -> 7.4) so
documentation, dependency metadata, and CI all reflect the actual 7.4 minimum.
🧹 Nitpick comments (2)
includes/feeds/google.php (1)
611-622: Good defensive fix for the GetUniverseDomainInterface loading issue.The pre-load mechanism addresses the PR objective by ensuring the required interface is loaded before Google_Client instantiation. The multi-step approach (check without autoload → try autoload → manual require) is appropriately defensive.
💡 Optional: Add validation after manual require
Consider verifying the interface was successfully loaded after the manual require to catch configuration issues early:
if (!interface_exists($interface_name, false)) { $interface_file = SIMPLE_CALENDAR_PATH . 'third-party/google/auth/src/GetUniverseDomainInterface.php'; if (file_exists($interface_file)) { require_once $interface_file; + + if (!interface_exists($interface_name, false)) { + // Log or handle the case where the interface still doesn't exist + error_log('SimpleCalendar: Failed to load GetUniverseDomainInterface after requiring file.'); + } } }This would help diagnose potential file corruption or namespace mismatches.
readme.txt (1)
100-104: Minor inconsistency in changelog wording.The changelog states "Support for PHP versions below 8.0 has been discontinued" but the requirement is now PHP 8.1. Consider updating the wording for clarity:
📝 Suggested wording improvement
-* Dev: Breaking change: Support for PHP versions below 8.0 has been discontinued. +* Dev: Breaking change: Minimum PHP version is now 8.1. Support for PHP 8.0 and below has been discontinued.This makes it immediately clear that 8.0 is also no longer supported.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
composer.lockis excluded by!**/*.lock
📒 Files selected for processing (5)
includes/calendars/views/default-calendar-grid.phpincludes/calendars/views/default-calendar-list.phpincludes/feeds/google.phppackage.jsonreadme.txt
🔇 Additional comments (1)
package.json (1)
5-5: LGTM! Version bump aligns with the release.The version update to 3.6.0 is consistent with the changelog in readme.txt and reflects the security fixes, breaking PHP version change, and Google Calendar integration improvements included in this release.
|
@Akhill2020 looks like a duplicate of #643 |
…-error-after-library-update
I have take pull and push from main now there is only one change. please have a look |
2 participants
Description: Some user get error after google library update, the "GetUniverseDomainInterface" class was not found at the time of google client construction was created.
Clickup: https://app.clickup.com/t/86d1gxzb0
Summary by CodeRabbit
Chores
Bug Fixes
Documentation
✏️ Tip: You can customize this high-level summary in your review settings.