Shared security patch analysis results
AI Used: claude_cli haiku--- cache/computer-repair-shop_4.1116/computer_repair_shop.php 2026-01-19 00:17:36.154952238 +0000+++ cache/computer-repair-shop_4.1121/computer_repair_shop.php 2026-01-19 00:20:45.966721407 +0000@@ -3,7 +3,7 @@ Plugin Name: CRM WordPress Plugin - RepairBuddy Plugin URI: https://www.webfulcreations.com/ Description: WordPress CRM Plugin which helps you manage your jobs, parts, services and extras better client and jobs management system. - Version: 4.1116 + Version: 4.1121 Author: Webful Creations Author URI: https://www.webfulcreations.com/ License: GPLv2 or later. @@ -14,7 +14,7 @@ Tested up to: 6.9 Requires PHP: 8.1 - @package : 4.1116 + @package : 4.1121 */ if ( ! defined( 'ABSPATH' ) ) { exit; @@ -22,7 +22,7 @@ if ( ! defined( 'DS' ) ) { define( 'DS', '/' ); // Defining Directory seprator, not using php default Directory seprator to avoide problem in windows. } -define( 'WC_CR_SHOP_VERSION', '4.1116' ); +define( 'WC_CR_SHOP_VERSION', '4.1121' ); if ( ! function_exists( 'wc_language_plugin_init' ) ) : /**
I'll analyze this code diff for security vulnerabilities. **Vulnerability Existed: no** **No Vulnerabilities Detected** **Explanation:** This diff contains only version number updates in a WordPress plugin file: - Line 6: Version header updated from 4.1116 to 4.1121 - Line 17: Package documentation updated from 4.1116 to 4.1121 - Line 25: WC_CR_SHOP_VERSION constant updated from 4.1116 to 4.1121 These are purely administrative changes that update version metadata. There are no code logic changes, no input handling modifications, no authentication/authorization adjustments, no data processing alterations, or any other functional changes that could introduce or fix security vulnerabilities. The changes do not affect: - Input validation or sanitization - Access control mechanisms - Encryption or data protection - SQL query construction - Command execution - File operations - Session handling - Or any other security-relevant functionality **Conclusion:** This is a routine version bump with no security implications.
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_upload_and_save_signature_handler function in all versions up to, and including, 4.1116. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary signatures to any order in the system, potentially modifying order metadata and triggering unauthorized status changes.
--- cache/computer-repair-shop_4.1116/lib/includes/classes/class-emails.php 2026-01-19 00:17:36.186954222 +0000+++ cache/computer-repair-shop_4.1121/lib/includes/classes/class-emails.php 2026-01-19 00:20:46.138732070 +0000@@ -289,26 +289,21 @@ return $urls; } + $WCRB_SIGNATURE_WORKFLOW = WCRB_SIGNATURE_WORKFLOW::getInstance(); + // Build URLs - $pickuplink = add_query_arg(array( - 'screen' => 'signature_request', - 'job_id' => $order_id, - 'case_number' => $job_case_number, - 'signature_label' => esc_html__( 'Pickup Signature', 'computer-repair-shop' ), - 'signature_type' => 'pickup' - ), $base_url); + $signature_label = esc_html__( 'Pickup Signature', 'computer-repair-shop' ); + $signature_type = 'pickup'; + $signature_url = $WCRB_SIGNATURE_WORKFLOW->wcrb_generate_signature_url_with_verification( $signature_label, $signature_type, $order_id, $base_url ); - $urls['pickup'] = wcrb_create_short_url( $pickuplink, 'pickup_signature_' . $job_case_number ); + $urls['pickup'] = $signature_url; - $deliverylink = add_query_arg(array( - 'screen' => 'signature_request', - 'job_id' => $order_id, - 'case_number' => $job_case_number, - 'signature_label' => esc_html__( 'Delivery Signature', 'computer-repair-shop' ), - 'signature_type' => 'delivery' - ), $base_url); + //Delivery url + $signature_label = esc_html__( 'Delivery Signature', 'computer-repair-shop' ); + $signature_type = 'delivery'; + $signature_url = $WCRB_SIGNATURE_WORKFLOW->wcrb_generate_signature_url_with_verification( $signature_label, $signature_type, $order_id, $base_url ); - $urls['delivery'] = wcrb_create_short_url( $deliverylink, 'delivery_signature_' . $job_case_number ); + $urls['delivery'] = $signature_url; return $urls; }
# Security Analysis
Vulnerability Existed: yes
FALSE POSITIVE
**Insufficient Output Encoding - CWE-79 (Cross-Site Scripting)** - CWE-79 - lib/includes/classes/class-emails.php - Lines 294-305
**Old Code:**
```php
$pickuplink = add_query_arg(array(
'screen' => 'signature_request',
'job_id' => $order_id,
'case_number' => $job_case_number,
'signature_label' => esc_html__( 'Pickup Signature', 'computer-repair-shop' ),
'signature_type' => 'pickup'
), $base_url);
$urls['pickup'] = wcrb_create_short_url( $pickuplink, 'pickup_signature_' . $job_case_number );
```
**Fixed Code:**
```php
$signature_label = esc_html__( 'Pickup Signature', 'computer-repair-shop' );
$signature_type = 'pickup';
$signature_url = $WCRB_SIGNATURE_WORKFLOW->wcrb_generate_signature_url_with_verification( $signature_label, $signature_type, $order_id, $base_url );
$urls['pickup'] = $signature_url;
```
**Explanation:**
The old code directly constructed URLs using `add_query_arg()` with unsanitized query parameters (`$order_id`, `$job_case_number`) and then passed the URL to `wcrb_create_short_url()`. If `$order_id` or `$job_case_number` contain malicious data or are not properly validated upstream, they could be reflected in the URL without proper encoding, leading to XSS vulnerabilities when the URL is output in emails or web pages.
The fix delegates URL generation to a dedicated method `wcrb_generate_signature_url_with_verification()`, which presumably implements proper encoding, validation, and security verification. This encapsulation prevents direct URL manipulation and ensures consistent security handling across the application.
---
Vulnerability Existed: yes
FALSE POSITIVE
**Insufficient Output Encoding - CWE-79 (Cross-Site Scripting)** - CWE-79 - lib/includes/classes/class-emails.php - Lines 307-315
**Old Code:**
```php
$deliverylink = add_query_arg(array(
'screen' => 'signature_request',
'job_id' => $order_id,
'case_number' => $job_case_number,
'signature_label' => esc_html__( 'Delivery Signature', 'computer-repair-shop' ),
'signature_type' => 'delivery'
), $base_url);
$urls['delivery'] = wcrb_create_short_url( $deliverylink, 'delivery_signature_' . $job_case_number );
```
**Fixed Code:**
```php
//Delivery url
$signature_label = esc_html__( 'Delivery Signature', 'computer-repair-shop' );
$signature_type = 'delivery';
$signature_url = $WCRB_SIGNATURE_WORKFLOW->wcrb_generate_signature_url_with_verification( $signature_label, $signature_type, $order_id, $base_url );
$urls['delivery'] = $signature_url;
```
**Explanation:**
Same vulnerability as above—the old code constructed URLs with unsanitized parameters that could lead to XSS if the parameters are not validated. The fix centralizes URL generation through a dedicated verification method that should properly encode and validate all parameters, preventing malicious data from being injected into the URLs.
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_upload_and_save_signature_handler function in all versions up to, and including, 4.1116. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary signatures to any order in the system, potentially modifying order metadata and triggering unauthorized status changes.
--- cache/computer-repair-shop_4.1116/lib/includes/classes/class-wcrb_signature.php 2026-01-19 00:17:36.194954719 +0000+++ cache/computer-repair-shop_4.1121/lib/includes/classes/class-wcrb_signature.php 2026-01-19 00:20:46.170734053 +0000@@ -57,6 +57,7 @@ $setting_body .= '<form data-async data-abide class="needs-validation" novalidate method="post" data-success-class=".'. esc_html( $this->success_class ) .'">'; + $setting_body .= '<div class="wc-rb-grey-bg-box">'; $setting_body .= '<h3 class="mt-4 mb-3 border-bottom pb-2">' . esc_html__( 'Pickup Signature', 'computer-repair-shop' ) . '</h3>'; $setting_body .= '<table class="form-table border"><tbody>'; @@ -152,7 +153,10 @@ $setting_body .= '</td></tr>'; $setting_body .= '</tbody></table>'; + $setting_body .= '</div><!-- Grey box -->'; + // ================== DELIVERY SIGNATURE SECTION ================== + $setting_body .= '<div class="wc-rb-grey-bg-box">'; $setting_body .= '<h3 class="mt-5 mb-3 border-bottom pb-2">' . esc_html__( 'Delivery Signature', 'computer-repair-shop' ) . '</h3>'; $setting_body .= '<table class="form-table border"><tbody>'; @@ -248,6 +252,8 @@ $setting_body .= '</tbody></table>'; + $setting_body .= '</div><!-- Grey Box /-->'; + $setting_body .= '<input type="hidden" name="form_type" value="wcrb_update_settings_form" />'; $setting_body .= '<input type="hidden" name="form_action" value="wcrb_update_signature_settings" />'; @@ -541,14 +547,14 @@ $response = array('success' => false, 'message' => '', 'error' => '', 'data' => array()); - // Verify nonce + // 1. Verify nonce first if (!isset($_POST['security']) || !wp_verify_nonce($_POST['security'], 'signature_upload_nonce')) { $response['error'] = esc_html__( "Security check failed", "computer-repair-shop" ); wp_send_json($response); wp_die(); } - // Validate required parameters + // 2. Validate required parameters $required_params = array('order_id', 'job_case_number', 'signature_label'); foreach ($required_params as $param) { if (!isset($_POST[$param]) || empty($_POST[$param])) { @@ -558,21 +564,97 @@ } } - // Get parameters - $order_id = intval($_POST['order_id']); - $job_case_number = sanitize_text_field($_POST['job_case_number']); - $signature_label = sanitize_text_field($_POST['signature_label']); - + // 3. Get parameters + $order_id = intval($_POST['order_id']); + $job_case_number = sanitize_text_field($_POST['job_case_number']); + $signature_label = sanitize_text_field($_POST['signature_label']); + $signature_type = isset($_POST['signature_type']) ? sanitize_text_field($_POST['signature_type']) : 'normal'; + + // 4. CRITICAL: Verify the verification code + $verification_code = isset($_POST['verification']) ? sanitize_text_field($_POST['verification']) : ''; + + if (empty($verification_code)) { + $response['error'] = esc_html__("Missing verification code", "computer-repair-shop"); + wp_send_json($response); + wp_die(); + } + + // Get the correct meta key based on signature type + $meta_key = ''; + switch ($signature_type) { + case 'pickup': + $meta_key = '_wcrb_signature_pickup_signature_verification'; + break; + case 'delivery': + $meta_key = '_wcrb_signature_delivery_signature_verification'; + break; + default: + // For custom signature types + $sanitized_label = sanitize_title($signature_label); + $meta_key = '_wcrb_signature_' . $sanitized_label . '_verification'; + } + + // Get stored verification code + $stored_code = get_post_meta($order_id, $meta_key, true); + + if (empty($stored_code)) { + $response['error'] = esc_html__("No signature request found for this job", "computer-repair-shop"); + wp_send_json($response); + wp_die(); + } + + // Verify the code matches + if ($stored_code !== $verification_code) { + $response['error'] = esc_html__("Invalid verification code", "computer-repair-shop"); + wp_send_json($response); + wp_die(); + } + + // 5. Check if signature already submitted + $completed = get_post_meta($order_id, $meta_key . '_completed', true); + if (!empty($completed)) { + $response['error'] = esc_html__("This signature has already been submitted", "computer-repair-shop"); + wp_send_json($response); + wp_die(); + } + + // 6. Optional: Verify timestamp (expiration check) + $timestamp = isset($_POST['timestamp']) ? intval($_POST['timestamp']) : 0; + if ($timestamp > 0) { + $expiration_days = 7; // URLs expire after 7 days + $expiration_seconds = $expiration_days * 24 * 60 * 60; + + if ((time() - $timestamp) > $expiration_seconds) { + $response['error'] = esc_html__("This signature link has expired", "computer-repair-shop"); + wp_send_json($response); + wp_die(); + } + } + + // 7. Additional verification: Check job exists and case number matches $jobs_manager = WCRB_JOBS_MANAGER::getInstance(); - $job_data = $jobs_manager->get_job_display_data( $order_id ); - $_job_id = ( ! empty( $job_data['formatted_job_number'] ) ) ? $job_data['formatted_job_number'] : $order_id; - - // Step 1: Handle file upload if present + $job_data = $jobs_manager->get_job_display_data($order_id); + + if (empty($job_data)) { + $response['error'] = esc_html__("Job not found", "computer-repair-shop"); + wp_send_json($response); + wp_die(); + } + + // Verify case number matches + $stored_case_number = get_post_meta($order_id, '_case_number', true); + if ($job_case_number !== $stored_case_number) { + $response['error'] = esc_html__("Case number mismatch", "computer-repair-shop"); + wp_send_json($response); + wp_die(); + } + + // 8. Now handle file upload if present $file_url = ''; - if ( isset( $_FILES["signature_file"] ) && $_FILES["signature_file"]["error"] == 0) { + if (isset($_FILES["signature_file"]) && $_FILES["signature_file"]["error"] == 0) { $upload_response = wc_upload_image_return_url($_FILES["signature_file"], 'reciepts'); - if ( ! empty( $upload_response['error'] ) ) { + if (!empty($upload_response['error'])) { $response['error'] = $upload_response['error']; wp_send_json($response); wp_die(); @@ -586,161 +668,184 @@ wp_send_json($response); wp_die(); } - + // Validate file URL - if ( empty( $file_url ) || ! filter_var( $file_url, FILTER_VALIDATE_URL ) ) { + if (empty($file_url) || !filter_var($file_url, FILTER_VALIDATE_URL)) { $response['error'] = esc_html__("Invalid file URL generated", "computer-repair-shop"); - wp_send_json( $response ); + wp_send_json($response); wp_die(); } - - // Step 2: Save all signature data to order + + // 9. Mark signature as completed BEFORE processing to prevent race conditions + update_post_meta($order_id, $meta_key . '_completed', current_time('mysql')); + update_post_meta($order_id, $meta_key . '_completed_by_ip', $_SERVER['REMOTE_ADDR'] ?? ''); + update_post_meta($order_id, $meta_key . '_completed_at', time()); + update_post_meta($order_id, $meta_key . '_signature_file', $file_url); + update_post_meta($order_id, $meta_key . '_signature_label', $signature_label); + + // 10. Save all signature data to order $ip_address = $_SERVER['REMOTE_ADDR'] ?? ''; $user_agent = $_SERVER['HTTP_USER_AGENT'] ?? ''; - $description = sprintf( esc_html__( 'Customer left signature, From IP : %s', 'computer-repair-shop' ), $ip_address ); - - $customer_id = get_post_meta( $job_id, '_customer', true ); - + $description = sprintf( + esc_html__('Customer left signature, From IP: %s, User Agent: %s', 'computer-repair-shop'), + $ip_address, + substr($user_agent, 0, 100) // Store first 100 chars only + ); + + $customer_id = get_post_meta($order_id, '_customer', true); + $_history_args = array(); - //Save Extra Field. - $user_id = ( get_current_user_id() ) ? get_current_user_id() : $customer_id; - //Save Job log. + + // Save Extra Field + $user_id = (get_current_user_id()) ? get_current_user_id() : $customer_id; + + // Save Job log $arguments = array( - 'date' => wp_date( 'Y-m-d H:i:s' ), - 'label' => esc_html( $signature_label ), - 'details' => $file_url, - 'visibility' => 'public', - 'type' => 'signature', - 'description' => $description, - ); - wc_job_extra_items_add( $arguments, $order_id ); - + 'date' => wp_date('Y-m-d H:i:s'), + 'label' => esc_html($signature_label), + 'details' => $file_url, + 'visibility' => 'public', + 'type' => 'signature', + 'description' => $description, + 'verified' => true, // Add verification flag + ); + wc_job_extra_items_add($arguments, $order_id); + $_history_args[] = array( - "user_id" => $user_id, - "job_id" => $order_id, - "name" => esc_html( $signature_label ) . ' _ ' . esc_html( $description ) , - "type" => 'public', - "field" => '_signature_submission', - "change_detail" => $file_url - ); + "user_id" => $user_id, + "job_id" => $order_id, + "name" => esc_html($signature_label) . ' - ' . esc_html__('Verified Signature', 'computer-repair-shop'), + "type" => 'public', + "field" => '_signature_submission', + "change_detail" => $file_url . ' (Verified: ' . $verification_code . ')' + ); + + // 11. Email admin + $jobs_manager = WCRB_JOBS_MANAGER::getInstance(); + $job_data = $jobs_manager->get_job_display_data($order_id); + $_job_id = (!empty($job_data['formatted_job_number'])) ? $job_data['formatted_job_number'] : $order_id; + + $email_body = ''; + $menu_name_p = get_option('blogname'); + $subject = sprintf(esc_html__('Verified Signature Received on Case # %s', 'computer-repair-shop'), $job_case_number) . '! | ' . $menu_name_p; + $admin_email = (!empty(get_option('admin_email'))) ? get_option('admin_email') : ''; + + $email_body = 'Hello, - //Email admin - $email_body = ''; - $menu_name_p = get_option( 'blogname' ); - $subject = sprintf( esc_html__( 'Signatures Received on Case # %s', 'computer-repair-shop' ), $job_case_number ) . '! | ' . $menu_name_p; - $admin_email = ( ! empty( get_option( 'admin_email' ) ) ) ? get_option( 'admin_email' ) : ''; +You have received a VERIFIED signature on job # ' . $_job_id . ' and case # ' . $job_case_number . ' -$email_body = 'Hello, +For request labeled as {' . $signature_label . '} -You have received signatures on job # '. $_job_id .'. and case # ' . $job_case_number . ' +Signature Type: ' . $signature_type . ' +Verification Code: ' . $verification_code . ' +IP Address: ' . $ip_address . ' +Timestamp: ' . current_time('mysql') . ' -For request labeled as {'. $signature_label .'} +Signature File: ' . $file_url . ' -Signature File : '. $file_url .' +This signature has been verified and is valid. Thank you!'; - - if ( ! empty( $subject ) || ! empty( $email_body ) || ! empty( $admin_email ) ) { - $email_body = nl2br( $email_body ); - $WCRB_EMAILS->send_email( $admin_email, $subject, $email_body, '' ); - + + if (!empty($subject) || !empty($email_body) || !empty($admin_email)) { + $email_body = nl2br($email_body); + $WCRB_EMAILS->send_email($admin_email, $subject, $email_body, ''); + $_history_args[] = array( - "user_id" => $user_id, - "job_id" => $order_id, - "name" => esc_html__( 'Signature notification sent to', 'computer-repair-shop' ), - "type" => 'private', - "field" => '_signature_notification', - "change_detail" => $admin_email - ); + "user_id" => $user_id, + "job_id" => $order_id, + "name" => esc_html__('Verified signature notification sent to', 'computer-repair-shop'), + "type" => 'private', + "field" => '_signature_notification', + "change_detail" => $admin_email + ); } - - //Change job status - if ( isset( $_POST['signature_type'] ) ) { - $signature_type = sanitize_text_field( $_POST['signature_type'] ); + + // 12. Change job status (if applicable) + if (isset($_POST['signature_type'])) { + $signature_type = sanitize_text_field($_POST['signature_type']); $cansign = $mssg = $new_job_status = ''; - $old_job_status = get_post_meta( $order_id, "_wc_order_status", true ); - - if ( $signature_type == 'pickup' ) { - //Pickup signature processing - $pickup_status = get_option( 'wcrb_pickup_signature_job_status' ); - - if ( $pickup_status == $old_job_status ) { + $old_job_status = get_post_meta($order_id, "_wc_order_status", true); + + if ($signature_type == 'pickup') { + $pickup_status = get_option('wcrb_pickup_signature_job_status'); + + if ($pickup_status == $old_job_status) { $cansign = 'YES'; - $new_job_status = get_option( 'wcrb_pickup_after_signature_status' ); + $new_job_status = get_option('wcrb_pickup_after_signature_status'); } } - if ( $signature_type == 'delivery' ) { - //Pickup signature processing - $delivery_status = get_option( 'wcrb_delivery_signature_job_status' ); - - if ( $delivery_status == $old_job_status ) { + if ($signature_type == 'delivery') { + $delivery_status = get_option('wcrb_delivery_signature_job_status'); + + if ($delivery_status == $old_job_status) { $cansign = 'YES'; - $new_job_status = get_option( 'wcrb_delivery_after_signature_status' ); + $new_job_status = get_option('wcrb_delivery_after_signature_status'); } } - - if ( ! empty( $new_job_status ) ) { - update_post_meta( $order_id, '_wc_order_status', $new_job_status ); - $change_detail = wc_return_status_name( $new_job_status ); - update_post_meta( $order_id, '_wc_order_status_label', $new_job_status ); - + + if (!empty($new_job_status)) { + update_post_meta($order_id, '_wc_order_status', $new_job_status); + $change_detail = wc_return_status_name($new_job_status); + update_post_meta($order_id, '_wc_order_status_label', $new_job_status); + $_history_args[] = array( - "user_id" => $user_id, - "job_id" => $order_id, - "name" => esc_html__( "Order status modified to", "computer-repair-shop" ), - "type" => 'public', - "field" => '_wc_order_status', - "change_detail" => $change_detail - ); - - if ( ( $old_job_status != $new_job_status ) || empty ( $old_job_status ) ) { + "user_id" => $user_id, + "job_id" => $order_id, + "name" => esc_html__("Order status modified to", "computer-repair-shop"), + "type" => 'public', + "field" => '_wc_order_status', + "change_detail" => $change_detail + ); + + if (($old_job_status != $new_job_status) || empty($old_job_status)) { global $OBJ_SMS_SYSTEM; - $wc_send_cr_notice = get_option( 'wc_job_status_cr_notice' ); - - $is_sms_active = get_option( 'wc_rb_sms_active' ); - if ( $is_sms_active == 'YES' ) { - $OBJ_SMS_SYSTEM->wc_rb_status_send_the_sms( $order_id, $new_job_status ); + $wc_send_cr_notice = get_option('wc_job_status_cr_notice'); + + $is_sms_active = get_option('wc_rb_sms_active'); + if ($is_sms_active == 'YES') { + $OBJ_SMS_SYSTEM->wc_rb_status_send_the_sms($order_id, $new_job_status); } - - if ( function_exists( 'rb_qb_update_invoice_status' ) ) { - rb_qb_update_invoice_status( $old_job_status, $new_job_status, $order_id ); + + if (function_exists('rb_qb_update_invoice_status')) { + rb_qb_update_invoice_status($old_job_status, $new_job_status, $order_id); } - - if ( $wc_send_cr_notice == 'on' ) { - $_GET['wc_case_number'] = sanitize_text_field( $_POST['case_number'] ); + + if ($wc_send_cr_notice == 'on') { + $_GET['wc_case_number'] = sanitize_text_field($_POST['case_number']); - wc_cr_send_customer_update_email( $order_id ); + wc_cr_send_customer_update_email($order_id); } - + global $WCRB_WOO_FUNCTIONS_OBJ; - $WCRB_WOO_FUNCTIONS_OBJ->wc_update_woo_stock_if_enabled( $order_id, $new_job_status ); + $WCRB_WOO_FUNCTIONS_OBJ->wc_update_woo_stock_if_enabled($order_id, $new_job_status); } } } - - if ( isset( $_history_args ) && ! empty( $_history_args ) ) { - foreach( $_history_args as $args ) { + + // 13. Record all history logs + if (isset($_history_args) && !empty($_history_args)) { + foreach ($_history_args as $args) { $WCRB_JOB_HISTORY_LOGS = WCRB_JOB_HISTORY_LOGS::getInstance(); - $WCRB_JOB_HISTORY_LOGS->wc_record_job_history( $args ); + $WCRB_JOB_HISTORY_LOGS->wc_record_job_history($args); } } - - $myaccountpage = get_option( 'wc_rb_my_account_page_id' ); - $myaccountpage = ( ! empty( $myaccountpage ) ) ? get_the_permalink( $myaccountpage ) : home_url(); - // Return success + // 14. Return success + $myaccountpage = get_option('wc_rb_my_account_page_id'); + $myaccountpage = (!empty($myaccountpage)) ? get_the_permalink($myaccountpage) : home_url(); + $response['success'] = true; - $response['message'] = esc_html__("Signature saved successfully", "computer-repair-shop"); + $response['message'] = esc_html__("Signature saved and verified successfully", "computer-repair-shop"); $response['data'] = array( 'file_url' => $file_url, - 'signature_data' => $signature_data, 'redirect' => add_query_arg(array( 'signature_success' => '1', 'order_id' => $order_id ), $myaccountpage) ); - + wp_send_json($response); wp_die(); } // End wc_upload_and_save_signature_handler() @@ -787,4 +892,155 @@ return $slug; } + + /** + * Generate signature URL with verification code + * + * @param string $_signature_label The label for the signature (e.g., 'Pickup', 'Delivery', 'Customer Approval') + * @param string $_signature_type The type of signature (e.g., 'pickup', 'delivery', 'custom') + * @param int $_job_id The job/order ID + * @param string $base_url Optional base URL. If not provided, uses main page URL. + * + * @return string|false The generated signature URL or false on failure + */ + function wcrb_generate_signature_url_with_verification( $_signature_label, $_signature_type, $_job_id, $base_url = '' ) { + // Get the job case number + $job_case_number = get_post_meta( $_job_id, '_case_number', true ); + if ( empty( $job_case_number ) ) { + return false; + } + + // Get base URL if not provided + if ( empty( $base_url ) ) { + $_mainpage = get_option( 'wc_rb_my_account_page_id' ); + if ( empty( $_mainpage ) ) { + return false; + } + $base_url = get_the_permalink( $_mainpage ); + } + + // Determine meta key based on signature type + $meta_key = ''; + switch ( $_signature_type ) { + case 'pickup': + $meta_key = '_wcrb_signature_pickup_signature_verification'; + break; + case 'delivery': + $meta_key = '_wcrb_signature_delivery_signature_verification'; + break; + default: + $sanitized_label = sanitize_title($_signature_label); + $meta_key = '_wcrb_signature_' . $sanitized_label . '_verification'; + } + + // Check if verification code already exists + $existing_code = get_post_meta($_job_id, $meta_key, true); + $completed = get_post_meta($_job_id, $meta_key . '_completed', true); + + // If code exists and signature is NOT completed, return existing URL + if (!empty($existing_code) && empty($completed)) { + // Reconstruct the URL + $signature_url = add_query_arg(array( + 'screen' => 'signature_request', + 'job_id' => $_job_id, + 'case_number' => $job_case_number, + 'signature_label' => urlencode($_signature_label), + 'signature_type' => $_signature_type, + 'verification' => $existing_code, + 'timestamp' => get_post_meta($_job_id, $meta_key . '_timestamp', true) + ), $base_url); + + return $signature_url; + } + + // Generate a new verification code + $verification_code = wp_generate_password(12, false, false); + + // Save the verification code to job meta + update_post_meta($_job_id, $meta_key, $verification_code); + + // Also save the signature type and label for reference + update_post_meta($_job_id, $meta_key . '_type', $_signature_type); + update_post_meta($_job_id, $meta_key . '_label', $_signature_label); + update_post_meta($_job_id, $meta_key . '_generated', current_time('mysql')); + update_post_meta($_job_id, $meta_key . '_timestamp', time()); // Save timestamp + + // Build the signature URL with verification code + $signature_url = add_query_arg(array( + 'screen' => 'signature_request', + 'job_id' => $_job_id, + 'case_number' => $job_case_number, + 'signature_label' => urlencode($_signature_label), + 'signature_type' => $_signature_type, + 'verification' => $verification_code, + 'timestamp' => time() // Add timestamp for additional security + ), $base_url); + + $_thelabel = $this->wcrb_generate_signature_slug( $_signature_label ); + + $short_url = wcrb_create_short_url($signature_url, $_thelabel . '_' . $job_case_number); + + $args = array( + "job_id" => $_job_id, + "name" => sprintf( esc_html__( '%s signature url generated', 'computer-repair-shop' ), $_signature_label ), + "type" => 'public', + "field" => '_signature_url_generated', + "change_detail" => $short_url + ); + $WCRB_JOB_HISTORY_LOGS = WCRB_JOB_HISTORY_LOGS::getInstance(); + $WCRB_JOB_HISTORY_LOGS->wc_record_job_history( $args ); + + // Return the short URL if created, otherwise return the full URL + return !empty($short_url) ? $short_url : $signature_url; + } + + /** + * Verify signature URL + * + * @param int $job_id The job/order ID + * @param string $signature_type The type of signature to verify + * @param string $verification_code The verification code from the URL + * + * @return bool|array Returns false if invalid, or array with signature data if valid + */ + function wcrb_verify_signature_url($job_id, $signature_type, $verification_code) { + // Determine meta key based on signature type + $meta_key = ''; + switch ($signature_type) { + case 'pickup': + $meta_key = '_wcrb_signature_pickup_signature_verification'; + break; + case 'delivery': + $meta_key = '_wcrb_signature_delivery_signature_verification'; + break; + default: + // Try to get the meta key from the URL parameters + $signature_label = isset($_GET['signature_label']) ? sanitize_text_field($_GET['signature_label']) : ''; + if (!empty($signature_label)) { + $sanitized_label = sanitize_title($signature_label); + $meta_key = '_wcrb_signature_' . $sanitized_label . '_verification'; + } + } + + if (empty($meta_key)) { + return false; + } + + // Get the stored verification code + $stored_code = get_post_meta($job_id, $meta_key, true); + + if (empty($stored_code) || $stored_code !== $verification_code) { + return false; + } + + // Get additional signature data + $signature_data = array( + 'type' => get_post_meta($job_id, $meta_key . '_type', true), + 'label' => get_post_meta($job_id, $meta_key . '_label', true), + 'generated' => get_post_meta($job_id, $meta_key . '_generated', true), + 'verified' => current_time('mysql') + ); + + return $signature_data; + } }\ No newline at end of file
I'll analyze this code diff for security vulnerabilities following the specified format.
---
**Vulnerability 1: Insufficient Input Validation - Missing Verification Code Validation**
Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) / Improper Input Validation - CWE-79, CWE-20 - class-wcrb_signature.php, lines 571-577
Old Code:
```php
// Get parameters
$order_id = intval($_POST['order_id']);
$job_case_number = sanitize_text_field($_POST['job_case_number']);
$signature_label = sanitize_text_field($_POST['signature_label']);
```
Fixed Code:
```php
// 3. Get parameters
$order_id = intval($_POST['order_id']);
$job_case_number = sanitize_text_field($_POST['job_case_number']);
$signature_label = sanitize_text_field($_POST['signature_label']);
$signature_type = isset($_POST['signature_type']) ? sanitize_text_field($_POST['signature_type']) : 'normal';
// 4. CRITICAL: Verify the verification code
$verification_code = isset($_POST['verification']) ? sanitize_text_field($_POST['verification']) : '';
if (empty($verification_code)) {
$response['error'] = esc_html__("Missing verification code", "computer-repair-shop");
wp_send_json($response);
wp_die();
}
```
Explanation:
The original code accepted signature submissions without requiring a verification code, which could allow unauthorized signature submissions. The fix introduces a verification code requirement that must match a pre-generated code stored in post meta, preventing unauthorized submissions.
---
**Vulnerability 2: Broken Access Control - Missing Job Validation**
Vulnerability Existed: yes
TRUE POSITIVE
Access Control / Authorization - CWE-639, CWE-862 - class-wcrb_signature.php, lines 595-610
Old Code:
```php
// Validate file URL
if ( empty( $file_url ) || ! filter_var( $file_url, FILTER_VALIDATE_URL ) ) {
$response['error'] = esc_html__("Invalid file URL generated", "computer-repair-shop");
wp_send_json( $response );
wp_die();
}
// Step 2: Save all signature data to order
```
Fixed Code:
```php
// 7. Additional verification: Check job exists and case number matches
$jobs_manager = WCRB_JOBS_MANAGER::getInstance();
$job_data = $jobs_manager->get_job_display_data($order_id);
if (empty($job_data)) {
$response['error'] = esc_html__("Job not found", "computer-repair-shop");
wp_send_json($response);
wp_die();
}
// Verify case number matches
$stored_case_number = get_post_meta($order_id, '_case_number', true);
if ($job_case_number !== $stored_case_number) {
$response['error'] = esc_html__("Case number mismatch", "computer-repair-shop");
wp_send_json($response);
wp_die();
}
```
Explanation:
The original code did not validate that the job actually exists or that the provided case number matches the stored case number. This could allow attackers to submit signatures for non-existent jobs or manipulate job data. The fix adds validation to ensure the job exists and the case number matches before processing.
---
**Vulnerability 3: Duplicate Submission / Race Condition**
Vulnerability Existed: yes
TRUE POSITIVE
Race Condition / Data Integrity - CWE-362 - class-wcrb_signature.php, lines 609-616
Old Code:
```php
// Step 2: Save all signature data to order
$ip_address = $_SERVER['REMOTE_ADDR'] ?? '';
```
Fixed Code:
```php
// 9. Mark signature as completed BEFORE processing to prevent race conditions
update_post_meta($order_id, $meta_key . '_completed', current_time('mysql'));
update_post_meta($order_id, $meta_key . '_completed_by_ip', $_SERVER['REMOTE_ADDR'] ?? '');
update_post_meta($order_id, $meta_key . '_completed_at', time());
update_post_meta($order_id, $meta_key . '_signature_file', $file_url);
update_post_meta($order_id, $meta_key . '_signature_label', $signature_label);
// 10. Save all signature data to order
```
Explanation:
The original code lacked protection against duplicate submissions and race conditions where multiple simultaneous requests could submit signatures. The fix marks the signature as completed before processing, preventing concurrent duplicate submissions.
---
**Vulnerability 4: Insufficient Logging / Audit Trail**
Vulnerability Existed: yes
TRUE POSITIVE
Insufficient Logging - CWE-778 - class-wcrb_signature.php, lines 690-695
Old Code:
```php
update_post_meta( $order_id, '_customer', true );
$_history_args = array();
//Save Extra Field.
$user_id = ( get_current_user_id() ) ? get_current_user_id() : $customer_id;
```
Fixed Code:
```php
update_post_meta($order_id, $meta_key . '_completed_by_ip', $_SERVER['REMOTE_ADDR'] ?? '');
update_post_meta($order_id, $meta_key . '_completed_at', time());
update_post_meta($order_id, $meta_key . '_signature_file', $file_url);
// ... later in history args ...
$email_body = 'Hello,
You have received a VERIFIED signature on job # ' . $_job_id . ' and case # ' . $job_case_number . '
...
Verification Code: ' . $verification_code . '
IP Address: ' . $ip_address . '
Timestamp: ' . current_time('mysql') . '
```
Explanation:
The original code did not record IP addresses, timestamps, or other audit information about signature submissions. The fix adds comprehensive logging including IP addresses, timestamps, and verification codes to the admin email and metadata for better security audit trails.
---
**Vulnerability 5: Expiration Check Missing (Optional but Recommended)**
Vulnerability Existed: not sure
Missing Expiration Validation - CWE-613 - class-wcrb_signature.php, lines 613-624
Old Code:
```php
// Get parameters
$order_id = intval($_POST['order_id']);
$job_case_number = sanitize_text_field($_POST['job_case_number']);
```
Fixed Code:
```php
// 6. Optional: Verify timestamp (expiration check)
$timestamp = isset($_POST['timestamp']) ? intval($_POST['timestamp']) : 0;
if ($timestamp > 0) {
$expiration_days = 7; // URLs expire after 7 days
$expiration_seconds = $expiration_days * 24 * 60 * 60;
if ((time() - $timestamp) > $expiration_seconds) {
$response['error'] = esc_html__("This signature link has expired", "computer-repair-shop");
wp_send_json($response);
wp_die();
}
}
```
Explanation:
While the original code didn't explicitly prevent this vulnerability, the fix adds an optional timestamp validation that prevents old/stale signature URLs from being used after 7 days. This is a defense-in-depth measure to limit the window of opportunity for unauthorized access.
---
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_upload_and_save_signature_handler function in all versions up to, and including, 4.1116. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary signatures to any order in the system, potentially modifying order metadata and triggering unauthorized status changes.
--- cache/computer-repair-shop_4.1116/lib/templates/my_account/parts/signature_generator.php 2026-01-19 00:17:36.206955463 +0000+++ cache/computer-repair-shop_4.1121/lib/templates/my_account/parts/signature_generator.php 2026-01-19 00:20:46.290741492 +0000@@ -38,19 +38,9 @@ $_mainpage = get_option('wc_rb_my_account_page_id'); $signature_url = ''; - if (!empty($_mainpage) && $mainpage_url = get_the_permalink($_mainpage)) { - $signature_url = add_query_arg(array( - 'screen' => 'signature_request', - 'job_id' => $order_id, - 'case_number' => $job_case_number, - 'signature_label' => urlencode($signature_label), - 'signature_type' => $signature_type - ), $mainpage_url); - + if ( ! empty( $_mainpage ) && $mainpage_url = get_the_permalink( $_mainpage ) ) { $WCRB_SIGNATURE_WORKFLOW = WCRB_SIGNATURE_WORKFLOW::getInstance(); - $_thelabel = $WCRB_SIGNATURE_WORKFLOW->wcrb_generate_signature_slug( $signature_label ); - - $signature_url = wcrb_create_short_url( $signature_url, $_thelabel . '_' . $job_case_number ); + $signature_url = $WCRB_SIGNATURE_WORKFLOW->wcrb_generate_signature_url_with_verification( $signature_label, $signature_type, $order_id, $mainpage_url ); } ?> <!DOCTYPE html> @@ -280,6 +270,10 @@ <input type="hidden" name="case_number" value="<?php echo esc_attr($job_case_number); ?>"> <input type="hidden" name="signature_type" value="<?php echo esc_attr($signature_type); ?>"> + <?php if ( isset( $_GET['page_id'] ) && ! empty( $_GET['page_id'] ) ) { ?> + <input type="hidden" name="page_id" value="<?php echo sanitize_text_field( $_GET['page_id'] ); ?>" /> + <?php } ?> + <div class="mb-4"> <label for="signature_label" class="form-label fw-bold"> <i class="bi bi-card-text me-2"></i>
Based on the diff provided, here is my security analysis:
---
**Vulnerability 1:**
Vulnerability Existed: yes
FALSE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - lib/templates/my_account/parts/signature_generator.php Lines 283-284
**Old Code:**
```
N/A (Vulnerability introduced in new code)
```
**Fixed Code:**
```php
<?php if ( isset( $_GET['page_id'] ) && ! empty( $_GET['page_id'] ) ) { ?>
<input type="hidden" name="page_id" value="<?php echo sanitize_text_field( $_GET['page_id'] ); ?>" />
<?php } ?>
```
Explanation:
The new code handles `$_GET['page_id']` with `sanitize_text_field()`, which is appropriate for removing HTML tags and encoding special characters for output in HTML attributes. However, this is a **stored XSS prevention** scenario - the vulnerability existed previously if `page_id` was being output without sanitization. The fix applies proper output escaping using WordPress's sanitization function, which is the correct approach. The use of `sanitize_text_field()` is suitable for text content in attributes, though `esc_attr()` would be slightly more semantically correct for HTML attributes. This appears to be a security fix rather than introducing a vulnerability.
---
**Vulnerability 2:**
Vulnerability Existed: not sure
Insecure Refactoring - CWE-295 (Improper Certificate Validation) / CWE-434 (Unrestricted Upload) - lib/templates/my_account/parts/signature_generator.php Lines 43-44
**Old Code:**
```php
$signature_url = add_query_arg(array(
'screen' => 'signature_request',
'job_id' => $order_id,
'case_number' => $job_case_number,
'signature_label' => urlencode($signature_label),
'signature_type' => $signature_type
), $mainpage_url);
$_thelabel = $WCRB_SIGNATURE_WORKFLOW->wcrb_generate_signature_slug( $signature_label );
$signature_url = wcrb_create_short_url( $signature_url, $_thelabel . '_' . $job_case_number );
```
**Fixed Code:**
```php
$signature_url = $WCRB_SIGNATURE_WORKFLOW->wcrb_generate_signature_url_with_verification( $signature_label, $signature_type, $order_id, $mainpage_url );
```
Explanation:
The refactoring moves URL generation logic into a centralized method `wcrb_generate_signature_url_with_verification()`. Without seeing the implementation of this method, it's uncertain whether this is a security improvement or regression. The old code used `add_query_arg()` (WordPress function) and `urlencode()` for URL encoding, which are generally safe. The concern is whether the new method properly validates inputs, applies the same encoding, and implements the promised "verification" mechanism. The removal of short URL generation may indicate additional security measures are being applied within the new method, but this cannot be confirmed from the diff alone.
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_upload_and_save_signature_handler function in all versions up to, and including, 4.1116. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary signatures to any order in the system, potentially modifying order metadata and triggering unauthorized status changes.
--- cache/computer-repair-shop_4.1116/lib/templates/my_account/parts/signature_request.php 2026-01-19 00:17:36.206955463 +0000+++ cache/computer-repair-shop_4.1121/lib/templates/my_account/parts/signature_request.php 2026-01-19 00:20:46.290741492 +0000@@ -11,6 +11,8 @@ $_case_number = ( isset( $_GET['case_number'] ) && ! empty( $_GET['case_number'] ) ) ? sanitize_text_field( $_GET['case_number'] ) : ''; $order_id = ( isset( $_GET['job_id'] ) && ! empty( $_GET['job_id'] ) ) ? sanitize_text_field( $_GET['job_id'] ) : ''; + $verification_code = ( isset( $_GET['verification'] ) && ! empty( $_GET['verification'] ) ) ? sanitize_text_field( $_GET['verification'] ) : ''; + $timestamp = ( isset( $_GET['timestamp'] ) && ! empty( $_GET['timestamp'] ) ) ? sanitize_text_field( $_GET['timestamp'] ) : ''; $job_case_number = get_the_title( $order_id ); $signature_label = ''; @@ -25,6 +27,9 @@ if ( $job_case_number != $_case_number ) { wp_die( esc_html__( 'Something is wrong with your submission!', 'computer-repair-shop' ) ); } + if ( ! isset( $verification_code ) || empty( $verification_code ) ) { + wp_die( esc_html__( 'Something is wrong with your submission!', 'computer-repair-shop' ) ); + } $signature_label = sanitize_text_field( $_GET['signature_label'] ); $signature_type = ( isset( $_GET['signature_type'] ) ) ? sanitize_text_field( $_GET['signature_type'] ) : 'normal'; @@ -327,6 +332,8 @@ caseNumber: '<?php echo esc_html($job_case_number); ?>', signatureLabel: '<?php echo esc_html($signature_label); ?>', signatureType:'<?php echo esc_html( $signature_type ); ?>', + verificationCode:'<?php echo esc_html( $verification_code ); ?>', + timestamp:'<?php echo esc_html( $timestamp ); ?>', ajaxUrl: '<?php echo admin_url("admin-ajax.php"); ?>', nonce: '<?php echo wp_create_nonce("signature_upload_nonce"); ?>' }; @@ -438,6 +445,8 @@ formData.append('job_case_number', signatureParams.caseNumber); formData.append('signature_label', signatureParams.signatureLabel); formData.append('signature_type', signatureParams.signatureType); + formData.append('verification', signatureParams.verificationCode); + formData.append('timestamp', signatureParams.timestamp); // Single AJAX call fetch(signatureParams.ajaxUrl, {
Based on my analysis of the provided diff, here are the security vulnerabilities:
---
**Vulnerability 1:**
Vulnerability Existed: **not sure**
**Inadequate Verification Code Validation - CWE-345** - CWE-345 - lib/templates/my_account/parts/signature_request.php Lines 14, 30-32
**Old Code:**
```php
$verification_code = ( isset( $_GET['verification'] ) && ! empty( $_GET['verification'] ) ) ? sanitize_text_field( $_GET['verification'] ) : '';
...
if ( ! isset( $verification_code ) || empty( $verification_code ) ) {
wp_die( esc_html__( 'Something is wrong with your submission!', 'computer-repair-shop' ) );
}
```
**Fixed Code:**
(The same code as above - this appears to be a new validation addition)
**Explanation:**
The code adds a check to ensure `$verification_code` is not empty. However, there are concerns: (1) The validation only checks for empty values but does NOT validate the format, length, or content of the verification code - it could be any arbitrary string. (2) There is no indication that the verification code is cryptographically validated against a server-side stored value. (3) `sanitize_text_field()` removes HTML tags but does not validate that the code matches expected format. Without seeing the backend handler, it's unclear if proper server-side verification exists. This may be vulnerable to verification bypass attacks if the verification code format is predictable or if no cryptographic validation occurs server-side.
---
**Vulnerability 2:**
Vulnerability Existed: **not sure**
**Insufficient Timestamp Validation - CWE-613** - CWE-613 - lib/templates/my_account/parts/signature_request.php Lines 15, 30-32
**Old Code:**
(Timestamp parameter did not previously exist)
**Fixed Code:**
```php
$timestamp = ( isset( $_GET['timestamp'] ) && ! empty( $_GET['timestamp'] ) ) ? sanitize_text_field( $_GET['timestamp'] ) : '';
...
// Added to formData but no validation shown
formData.append('timestamp', signatureParams.timestamp);
```
**Explanation:**
The timestamp is extracted from the URL parameter and passed through `sanitize_text_field()`, then transmitted via AJAX. However: (1) No server-side timestamp validation is visible in this diff. (2) No check for timestamp expiration/freshness. (3) No validation that the timestamp format is correct. (4) Could be vulnerable to replay attacks if timestamps are not validated server-side to ensure they are recent. Without verification that timestamps are checked server-side for recency and are part of a cryptographic signature, this could allow attackers to replay old requests.
---
**Summary:**
Both new security parameters (verification_code and timestamp) are properly sanitized on the client side with `sanitize_text_field()` and `esc_html()` for output, preventing XSS. However, the actual security validation depends on server-side implementation, which is not shown in this diff. The additions appear to be part of a verification/replay-attack prevention mechanism, but without seeing the backend validation logic, the effectiveness cannot be fully assessed.
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_upload_and_save_signature_handler function in all versions up to, and including, 4.1116. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary signatures to any order in the system, potentially modifying order metadata and triggering unauthorized status changes.