Hacker News Reader

Comment by CommitSyn | Hacker News Reader

Ask him for a demo URL where he tests his plugin, send him a message to grab his admin cookie (don't make it complicated, just make it ping your server with with a 1px '/xss.jpg + document.cookie' and check your web logs), set your cookie as his to open his wp-admin and change something. Demonstrate why it's such a big deal since he is clearly a security novice.

And yes, if there's anything I've learned about WooCommerce plugins and WordPress plugins in general, it's to be very careful.

View on HN

Thank you. I didn’t even think of something as simple as cookie stealing.

Here’s what he wrote to me (and his talk of manners would be fair if it were justified - he went on the attack as soon as I said there was XSS in his plugin).

“ok

Thank for the advice i will try to follow it.

well there is noting about haking your site with some text well that is a joke i will suggest you to change your university and most importantly learn some manners for talking with unknowns, seniors and any one in this world

Education doesn't teach us to earn from it. it teaches us how to behave and live a life without hurting anyone.

I'm a developer and having years of experience but you are a student and it's your learning stage, not for coding or anything like it but most importantly manners

coming back to your words. no one in this world can hack your site through the order notes nor any one wants today you are saying me joke of coding without knowing anything tomorrow you will be the joker of coding even the joker of computer science

i have developed you what you wanted and at that time you were agreed on it and now after month you learn something new and come back to me to misbehave with me and i think after 10 years you will again come and say to me somethink new that will be more interesting ”

To be blunt, that guy sounds like a dick.

This should have been a great learning opportunity, instead he took it as a personal attack.

I'm doubting his claim of 10 years experience. Someone with that much experience writing any sort of web code should know what a cross-site scripting vulnerability is, what can be done with it, and how to make sure it doesn't happen.

I've never used Fiverr before, but does it allow you to rate them? I'd drop a 1-star and comment that he reacted aggressively when you told him about a security vulnerability found in his code.

It’s too late for me. Basically I had this coded a month ago and as soon as it worked, I 5-starred and I was far too quick to say thank you (and tip him).

From this guys response, I’m thinking that I need someone to evaluate all of the code - I don’t have faith in and don’t understand it all.

Maybe Fiverr isn’t the best place for WooCommerce work after all!

Now's a great time to learn how to read basic PHP and how to modify code to sanitize input. It's low-hanging knowledge that won't take much time. You're not going to prevent the OWASP top30, but you can stop SQLi and XSS and maybe get more into webappsec.

Input going into DB: https://wordpress.stackexchange.com/questions/114344/how-to-...

Input being displayed from DB: https://developer.wordpress.org/reference/functions/sanitize...

But also, steal his cookie. Allow the student to become the teacher and see if he takes it as a humble learning experience.

Reply on news.ycombinator.com