Skip to content

Security Fixes - #2944

Merged
shewa12 merged 8 commits into
devfrom
shewa
Aug 6, 2026
Merged

Security Fixes#2944
shewa12 merged 8 commits into
devfrom
shewa

Conversation

@shewa12

@shewa12 shewa12 commented Aug 4, 2026

Copy link
Copy Markdown
Collaborator

@shewa12
shewa12 requested a review from harunollyo August 4, 2026 04:37
@shewa12 shewa12 added the 4.0.5 Tutor v4.0.5 label Aug 4, 2026
@shewa12 shewa12 changed the title Fix: One instructor can read/edit other instructor content Security Fixes Aug 4, 2026
Comment thread classes/QuizBuilder.php

// Save sort order.
$answer_order++;
++$answer_order;

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The post-increment was changed to a pre-increment. Was this intentional?

Comment thread classes/QuizBuilder.php
foreach ( $questions as $question ) {
$data_status = isset( $question[ self::TRACKING_KEY ] ) ? $question[ self::TRACKING_KEY ] : self::FLAG_NO_CHANGE;
$question_order++;
++$question_order;

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

Comment thread classes/QuizBuilder.php Outdated
Comment thread classes/QuizBuilder.php Outdated
$quiz_id = wp_insert_post( $quiz_data );
do_action( ( $is_update ? 'tutor_quiz_updated' : 'tutor_initial_quiz_created' ), $quiz_id );

if ( $quiz_id ) {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please move all validation and authority check login inside validate_payload method

Comment thread classes/QuizBuilder.php Outdated
Comment thread classes/QuizBuilder.php Outdated
}

// Validate deleted answer ids are valid.
if ( $deleted_answer_ids ) {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

here

Comment thread classes/QuizBuilder.php
Comment thread classes/Tutor.php Outdated
'edit_others_tutor_courses',
'edit_others_tutor_lessons',
'edit_others_tutor_quizzes',
'edit_others_tutor_questions',

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add this

edit_others_tutor_assignments

Comment thread classes/Tutor.php Outdated
}

update_option( 'tutor_removed_edit_other_items_permission', true, false );
}

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove edit_others_tutor_assignments from method register_assignments_post_types

Comment thread classes/Tutor.php Outdated
}

update_option( 'tutor_removed_edit_other_items_permission', true, false );
}

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need remove edit_others_tutor_courses from CourseBundle.php file also.

Comment thread classes/QuizBuilder.php
if ( is_null( $this->current_quiz_question_ids ) && $this->current_quiz ) {
$questions = $this->current_quiz->questions;
if ( $questions ) {
$this->current_quiz_question_ids = wp_list_pluck( $questions, 'question_id' );

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add this line for type safety comparison later.

$this->current_quiz_question_ids = array_map( 'intval', $this->current_quiz_question_ids );

Comment thread classes/QuizBuilder.php
$quiz_details = $this->current_quiz->questions;

$quiz_question_answer = wp_list_pluck( $quiz_details, 'question_answers' );
$this->current_quiz_answer_ids = wp_list_pluck( array_merge( ...$quiz_question_answer ), 'answer_id' );

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same for this

$this->current_quiz_answer_ids = array_map( 'intval', $this->current_quiz_answer_ids );

Comment thread classes/QuizBuilder.php
@shewa12
shewa12 merged commit e9bf9d7 into dev Aug 6, 2026
10 of 13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

4.0.5 Tutor v4.0.5

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants