Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secure Custom Fields by WordPress.org

wordpress.org

Post reply on HN
Print view View original

31–40 of 210 posts

Re: Secure Custom Fields by WordPress.org

#31

Post by windsurfer »

CharlesW wrote: post #20

So WordPress-the-org — which is effectively Matt, as far as I can tell — just Sherlocked a developer's plug-in using the developer's own code, ostensibly as retribution for a security issue that the developer had already fixed. https://www.advancedcustomfields.com/blog/acf-6-3-8-security... What am I missing?

That ACF security update was not made available on WordPress.org due to ACF maintainers being blocked from accessing WordPress.org, according to WordPress.org's blog https://wordpress.org/news/2024/09/wp-engine-banned/

Re: Secure Custom Fields by WordPress.org

#32

Post by kristofferR »

righthand wrote: post #21

If anyone is interested in the extended controversy surrounding Wordpress, there is a site that has been tracking everything.[0] [0] https://bullenweg.com

Wow, I hadn't heard about the nosebleed incident. Absurd, even if he ain't snorting coke, it's deeply weird to continue an interview while profusely bleeding as if nothing is happening.

Re: Secure Custom Fields by WordPress.org

#34

Post by mananaysiempre »

smarx007 wrote: post #17
discostrings wrote: post #5

Blog post on wordpress.org concerning this: https://wordpress.org/news/2024/10/secure-custom-fields/

> This update is as minimal as possible to fix the security issue. What is the actual issue? CVE number?

I can’t find the actual number because Automattic’s tweet[1] announcing it has been deleted, but it’s the one mentioned in the ACF 6.3.8 release notes[2]. The authors of ACF can’t upload that version to wordpress.org themselves because Matt banned them from there before making the announcement.

ETA: Matt says[3] it’s a different vulnerability. Anybody willing to break out the almighty diff?

[1] Discussed at the time: https://news.ycombinator.com/item?id=41752289

[2] https://www.advancedcustomfields.com/blog/acf-6-3-8-security...

[3] https://news.ycombinator.com/item?id=41821829

Re: Secure Custom Fields by WordPress.org

#36

Post by bullenweg »

ivanmontillam wrote: post #24
bullenweg wrote: post #6

If anyone from Automattic is reading this and would like to confidentially leak any internal information about this behaviour from Matt, please email admin@bullenweg.com and I will publish it on bullenweg.com.

This is excellent! Is there a repo of this website? It would be good to have for preservation purposes.

https://github.com/bullenweg/bullenweg.github.io

Re: Secure Custom Fields by WordPress.org

#38

Post by photomatt »

CharlesW wrote: post #20

So WordPress-the-org — which is effectively Matt, as far as I can tell — just Sherlocked a developer's plug-in using the developer's own code, ostensibly as retribution for a security issue that the developer had already fixed. https://www.advancedcustomfields.com/blog/acf-6-3-8-security... What am I missing?

This release fixes a separate security vulnerability from the original update.

Re: Secure Custom Fields by WordPress.org

#39

Post by jorams »

smarx007 wrote: post #17
discostrings wrote: post #5

Blog post on wordpress.org concerning this: https://wordpress.org/news/2024/10/secure-custom-fields/

> This update is as minimal as possible to fix the security issue. What is the actual issue? CVE number?

The diff contains two (identical) changes that aren't just ripping out upgrade notices for the pro version: Two functions that stop callbacks from accessing $_POST now also stop them from accessing $_REQUEST, which also contains everything in $_POST. Also confirmed by WP Engine's update notice[1].

I honestly don't see why anyone would treat this as a security issue. Everything involved is PHP code that can do whatever it wants, not in any kind of sandbox.

Edit: And even if it were this update doesn't fix the problem. POST variables can still be accessed:

    filter_input(INPUT_POST, 'name');
[1]: https://www.advancedcustomfields.com/blog/acf-6-3-8-security...

Re: Secure Custom Fields by WordPress.org

#40

Post by xenago »

wkirby wrote: post #8

We no longer do custom WordPress work --- it turned out to never be worth the hassle --- but when we did, our company used ACF extensively. High quality plugin with responsive support and very fair licensing terms. This --- to me --- smacks of complete bullshit.

Forking it is whatever, but to take over their namespace and thus break trust across the ecosystem is a dealbreaker. All devs will have to move.
Post reply on HN