Skip to content

fix(security): harden the front-end AJAX handlers and reset template #150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eleshar merged 4 commits into from
Sep 8, 2026
Merged

fix(security): harden the front-end AJAX handlers and reset template #150

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6b85561
fix(security): harden the password reset AJAX response
eleshar Sep 8, 2026
4d4a701
fix(security): add nonce verification, throttling and output escaping
eleshar Sep 8, 2026
d92a78e
docs(changelog): record the AJAX hardening under 1.1.3
eleshar Sep 8, 2026
fa52377
fix(security): address CodeRabbit review findings
eleshar Sep 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion assets/js/lsx-login.min.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions assets/js/src/lsx-login.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ jQuery(document).ready(function($) {
var redirect = $(this).find('input[name="redirect_to"]' ).val();
var params = {
action: 'lsx_login',
nonce: lsx_login_params.nonce,
log: username,
pwd: password,
rememberme: remember,
Expand Down Expand Up @@ -130,6 +131,7 @@ jQuery(document).ready(function($) {

var params = {
action: 'lsx_reset',
nonce: lsx_login_params.nonce,
log: username,
method: 'reset'
};
Expand Down Expand Up @@ -213,6 +215,7 @@ jQuery(document).ready(function($) {

var params = {
action: 'lsx_reset_confirmed',
nonce: lsx_login_params.nonce,
pass1: pass1,
pass2: pass2,
key: key,
Expand Down
2 changes: 2 additions & 0 deletions changelog.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@
* Dev - lsx-login.css and lsx-login-rtl.css are now compiled compressed rather than compact; dart-sass does not support the compact output style. The rules themselves are unchanged.
* Dev - The plugin header and LSX_LOGIN_VER were still on 1.0.5 while this changelog had already shipped 1.1.2. Both now read 1.1.3.
* Dev - Cleared all 13 Dependabot alerts on the repository.
* Security - Hardened the front-end AJAX handlers: nonce verification on all three, rate limiting on the password reset request, and a server-side confirmation that the two password fields match.
* Security - Escaped output in the password reset template and in the login response message.

### 1.1.2
* Fix - Fixed the saving of the password expire time to the DB, allowing the plugin to work with WP expiration times.
Expand Down
Loading