Repository navigation
Fix. FSW. Restriction of access to FSW, edits for wpms, restriction for file actions - #762
Merged
Merged
Conversation
AntonV1211
changed the title
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The cross-cutting authorization changes require human validation across multisite roles and AJAX entry points, with an unresolved access-control gap.
1 open issue
What changed in this PR
This PR tightens access to shared filesystem operations on WordPress multisite and strengthens FSWatcher file-view validation.
Changes:
- Adds Super Admin restrictions to network-wide AJAX actions and related settings controls.
- Validates FSWatcher file access against exact resolved paths in journal differences and protects
wp-config.php. - Adds file-view regression tests and ignores the local skills directory.
| File | Description |
|---|---|
| tests/lib/CleantalkSP/SpbctWP/FSWatcher/AnalyzerViewFileTest.php | Adds file-view access and journal-matching tests. |
| security-malware-firewall.php | Adds optional network-wide AJAX authorization. |
| lib/CleantalkSP/SpbctWP/Views/Settings.php | Gates FSWatcher visibility by network permissions. |
| lib/CleantalkSP/SpbctWP/Settings/SettingsGeneralReact.php | Restricts the salt-shuffling control. |
| lib/CleantalkSP/SpbctWP/Scanner/ScannerAjaxEndpoints.php | Restricts scanner file actions. |
| lib/CleantalkSP/SpbctWP/Scanner/ScannerActions/BackupsActions.php | Restricts backup AJAX actions. |
| lib/CleantalkSP/SpbctWP/Scanner/Helper.php | Centralizes network-wide permission checks. |
| lib/CleantalkSP/SpbctWP/Scanner/Cure.php | Restricts bulk cure and restore actions. |
| lib/CleantalkSP/SpbctWP/ListTable.php | Guards selected network-wide row actions. |
| lib/CleantalkSP/SpbctWP/FSWatcher/Controller.php | Restricts FSWatcher AJAX endpoints. |
| lib/CleantalkSP/SpbctWP/FSWatcher/Analyzer/Analyzer.php | Enforces resolved-path matching and configuration protection. |
| inc/spbc-admin.php | Restricts the salt-shuffling endpoint. |
| .gitignore | Ignores /skills/. |
Review effort: Balanced
AntonV1211
requested review from
Glomberg,
svedge and
svfcode
and removed request for
svfcode
October 26, 2026 10:29
Glomberg
requested changes
Oct 26, 2026
Glomberg
approved these changes
Oct 26, 2026
svedge
approved these changes
Oct 26, 2026
AntonV1211
added a commit
that referenced
this pull request
Oct 27, 2026
…or file actions (#762) * Dev. Git. Added the Skills folder to .gitignore * Fix. FSW. Restriction of access to FSW, edits for wpms, restriction for file actions * Fix. FSW. Limitation for actions of oscron and delete-trigger * Dev. Code. Review corrections * Dev. Activator. Switching to the wp_initialize_site hook when adding a new blog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://app.doboard.com/1/task/60667