fix: Comprehensive CSRF vulnerability fix for CVE-2024-43338

[ovidiul]

Summary

This PR provides a comprehensive fix for the CSRF vulnerability (CVE-2024-43338) identified in PR #110, implementing multi-layered security measures to prevent unauthorized access to media upload functionality.

Security Issues Addressed

• CVE-2024-43338: CSRF vulnerability in polls media upload functionality
• Unauthorized Filter Registration: Prevents malicious registration of media upload filters
• Cross-User Attack Prevention: User-specific nonces prevent cross-user CSRF attacks

Changes Made

Backend Security (popups.php)

• ✅ Admin Context Verification: Only allows functionality in admin context
• ✅ User Capability Checks: Requires edit_posts capability
• ✅ User-Specific Nonce Verification: Implements CSRF protection with user-bound nonces
• ✅ Early Return Pattern: Fails securely by returning early when security checks fail

Frontend Security (polldaddy.js)

• ✅ Code Readability: Replaced minified JavaScript with maintainable code
• ✅ Secure URL Generation: New getSecureMediaURL() function appends nonces to all media upload URLs
• ✅ Comprehensive Coverage: Updated all media handlers (image, video, audio)
• ✅ Graceful Degradation: Handles cases where nonce data is unavailable

Nonce Integration (polldaddy.php)

• ✅ User-Specific Nonces: Generated per user to prevent cross-user attacks
• ✅ Scoped Generation: Only generates nonces for poll edit/create pages
• ✅ JavaScript Localization: Provides nonce data via pollsMediaSecurity object

Test Coverage (test-csrf-security.php)

• ✅ Comprehensive Test Suite: 8 test methods covering all security scenarios
• ✅ Security Validation: Tests early returns for all failure conditions
• ✅ Attack Simulation: Includes complete CSRF attack prevention test
• ✅ Edge Case Coverage: Tests missing parameters, invalid contexts, insufficient permissions

Security Design

Multi-Layer Protection

1. Admin Context Check: is_admin() verification
2. Capability Check: current_user_can('edit_posts') verification
3. CSRF Protection: User-specific nonce verification
4. Parameter Validation: Required parameter presence checks

User-Specific Nonces

$nonce_action = 'polls_media_' . $user_id;
$nonce = wp_create_nonce( $nonce_action );

Secure URL Generation

function getSecureMediaURL(type, mediaType) {
    var baseURL = "media-upload.php?type=" + type + "&polls_media=1";
    if (typeof pollsMediaSecurity !== 'undefined' && pollsMediaSecurity.nonce) {
        baseURL += "&_wpnonce=" + encodeURIComponent(pollsMediaSecurity.nonce);
    }
    return baseURL + "&TB_iframe=1";
}

Attack Prevention

This fix prevents:

• ✅ CSRF Attacks: User-specific nonces prevent cross-site request forgery
• ✅ Unauthorized Access: Capability checks ensure only authorized users can access functionality
• ✅ Cross-User Attacks: User-bound nonces prevent attacks between different authenticated users
• ✅ Non-Admin Context Abuse: Admin context verification prevents frontend exploitation

Testing

Test Coverage

• Unit Tests: 8 comprehensive test methods in test-csrf-security.php
• Security Scenarios: All attack vectors and edge cases covered
• Integration Testing: Tests complete request flow with all security layers

Test Results

✓ PASS: polldaddy_popups_init function should exist
✓ PASS: polldaddy_popups_init should be hooked to admin_init  
✓ PASS: Video filter should not be added without polls_media parameter
✓ PASS: Video filter should not be added outside admin context
✓ PASS: Video filter should not be added without edit_posts capability
✓ PASS: Video filter should not be added with invalid nonce
✓ PASS: Video filter should not be added without nonce
✓ PASS: Filters should be added with valid security context

Backward Compatibility

• ✅ Non-Breaking: All existing functionality preserved for legitimate users
• ✅ Graceful Degradation: JavaScript works even if nonce data unavailable
• ✅ User Experience: No impact on normal workflow for authorized users

Code Quality

• ✅ WordPress Standards: Follows WordPress coding standards and security best practices
• ✅ Readable Code: Replaced minified JavaScript with well-documented, maintainable code
• ✅ Comprehensive Documentation: Clear comments explaining security measures
• ✅ Test Coverage: Extensive test suite ensures reliability

Related Issues

• Addresses PR Security: Fix CSRF vulnerability CVE-2024-43338 with comprehensive nonce verification #110 requirements for CSRF vulnerability fix
• Based on testing framework from PR Add WordPress Testing Infrastructure & Coding Standards #116
• Implements WordPress security best practices

This comprehensive fix ensures that media upload functionality is completely protected against CSRF attacks while maintaining full functionality for legitimate users.

[ovidiul]

Closing this PR to create a clean version without unrelated files.