fix: 评论私密接口未授权风险和无法切换私密状态 - #75
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
本 PR 旨在修复评论“切换私密状态”功能的安全风险与交互问题：前端请求增加 nonce 参数，并调整确认提示与切换逻辑，以支持重复切换而非只能设为私密一次。
Changes:
- 更新确认文案为“您确定要切换私密状态吗？”
- 从按钮读取
data-noncep并在 AJAX 请求中追加_wpnonce - 移除
private_now的前端拦截逻辑，允许再次点击触发切换
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
241
to
+245
| let idp = list.getAttribute("data-idp"), | ||
| actionp = list.getAttribute("data-actionp"), | ||
| rateHolderp = list.getElementsByClassName('has_set_private')[0]; | ||
| let ajax_data = "action=siren_private&p_id=" + idp + "&p_action=" + actionp; | ||
| rateHolderp = list.getElementsByClassName('has_set_private')[0], | ||
| noncep = list.getAttribute("data-noncep"); | ||
| let ajax_data = "action=siren_private&p_id=" + idp + "&p_action=" + actionp + "&_wpnonce=" + noncep; |
Contributor
Author
There was a problem hiding this comment.
后端校验的是绑定评论 ID 的 siren_private_{comment_id} nonce，不是全局 nonce
| let ajax_data = "action=siren_private&p_id=" + idp + "&p_action=" + actionp; | ||
| rateHolderp = list.getElementsByClassName('has_set_private')[0], | ||
| noncep = list.getAttribute("data-noncep"); | ||
| let ajax_data = "action=siren_private&p_id=" + idp + "&p_action=" + actionp + "&_wpnonce=" + noncep; |
Shiroiame-Kusu
added a commit
to ranfey/Sakurairo
that referenced
this pull request
Aug 16, 2026
- zh_CN/zh_TW/ja/fr 补充 "Are you sure you want to toggle private status?" 翻译并重新编译 .mo - 移除已废弃的 "Are you sure you want set it private?" 与 "You had set private comment before" - 还原 js/page.js 与 js/page.js.map：构建产物由 Fuukei/Sakurairo_Scripts#75 经同步流程生成，不在本仓库手动提交
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
演示
1. 评论私密接口未授权风险
所有评论的私密状态可以随意被更改
评论私密切换接口同时注册了未登录 AJAX 入口，并且请求不需要 nonce：
REST API 获取最近评论 ID：
返回第一项里的
id即为后续 AJAX 请求的p_id：可构造请求：
2. 评论私密状态无法正确切换
只会写入私密状态：
评论只能被设为私密，不能再次点击恢复公开
修复内容
对应
mirai-mamori/Sakurairo#1422
src/page/index.js从按钮读取
data-noncep：AJAX 请求追加
_wpnonce：private_now判断验证
修复后