OAuth nonce verification bug

  • Resolved Saul

    (@slightlyfaulty)


    3 years, 12 months ago

    You have a bug in your OAuth verification code that’s causing conflicts with other plugins using OAuth.

    In RankMath\Admin::process_oauth() you’re verifying the nonce for rank_math_oauth_token for ANY OAuth return URL in WordPress. You need to make this specific to your plugin, instead of just looking for process_oauth and access_token URL params.

    Please fix this issue as soon as possible, as currently it causes OAuth to fail for any other plugin that isn’t Rank Math SEO.

Viewing 7 replies - 1 through 7 (of 7 total)
  • Plugin Author Rank Math

    (@rankmath)

    Hello @slightlyfaulty

    Thank you for contacting the support and sorry for not following up quickly and any inconvenience that might have been caused due to that.

    The issue was resolved in one of the last updates.

    Please let us know if you are still facing the issue.

    We are here to help.

    Thread Starter Saul

    (@slightlyfaulty)

    I assumed you guys actually fixed this, but I just had another user run into the same issue with your plugin.

    I checked and you haven’t updated the code I was referring to at all. You still have the same bug that causes an error to show when using OAuth params in the URL.

    If my explanation of the problem wasn’t clear enough, go to your WordPress admin (with Rank Math activated) and add an access_token param to your URL like this:

    https://example.com/wp-admin/?access_token=123

    See how it says The link you followed has expired.? Now imagine another plugin needs to use access_token in the URL. Well they can’t because you’re basically blocking it for any other plugin but your own.

    Get this fixed asap or I’m reporting this blatant disregard for other plugins to the WP plugin directory moderators.

    Plugin Author Rank Math

    (@rankmath)

    Hello @slightlyfaulty

    Sorry for any inconvenience that might have been caused due to that.

    It seems like the issue was not completely fixed in our plugin.

    We have reported it internally and in the upcoming update, the issue should be fixed.

    We will let you know as soon as an update is available.

    In the meantime, if there’s anything else we can help you with, please let us know.

    We are here to assist.

    Thank you for finally fixing this issue ??

    Plugin Author Rank Math

    (@rankmath)

    Hello @mewz

    Sorry that it took us long and glad it helped you.

    If it isn’t too much to ask for – would you mind leaving us a review here?
    https://www.ads-software.com/support/plugin/seo-by-rank-math/reviews/#new-post

    It only takes a couple of minutes but helps us tremendously.

    It would mean so much to us and would go a really long way.

    Thank you.??

    @rankmath Since it took over 3 months to fix something that should have never made it to production code to begin with, it’s probably best that I don’t leave you a review.

    All the best.

    Plugin Author Rank Math

    (@rankmath)

    Hello @mewz

    That’s fair and we are extremely sorry for the unwanted delay.

    We will take this as a feedback and will try our best to keep up with any issues in the future.

    Appreciate your support and the feedback.

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘OAuth nonce verification bug’ is closed to new replies.