Store invite tokens hashed at rest #41

New Issue

2026-06-10T18:50:52Z

thatguygriff commented

2026-06-10 18:50:52 +00:00

Finding (security review — Low)

InviteRepository (src/Auth/InviteRepository.php) stores and looks up raw invite tokens. The token is generated well (wp_generate_password(32, false) is CSPRNG-backed) and pending invites expire after 14 days, but anyone with read access to the database (backup leak, SQL injection in an unrelated plugin) can redeem pending invites and mint student accounts.

Fix

Store hash('sha256', $token) instead of the raw token; hash the incoming token before lookup in the registration flow.
The admin Invites page (templates/admin/invites.php) currently reconstructs registration links from the stored token, which no longer works once only the hash is stored. Show the full link once, in a notice right after the invite is created; the pending list keeps email/expiry/revoke. To re-send a lost link: revoke and re-invite.
Existing plaintext pending invites will stop matching (pre-1.0 plugin, acceptable); they can be revoked and re-issued.

## Finding (security review — Low) `InviteRepository` (src/Auth/InviteRepository.php) stores and looks up raw invite tokens. The token is generated well (`wp_generate_password(32, false)` is CSPRNG-backed) and pending invites expire after 14 days, but anyone with read access to the database (backup leak, SQL injection in an unrelated plugin) can redeem pending invites and mint student accounts. ## Fix - Store `hash('sha256', $token)` instead of the raw token; hash the incoming token before lookup in the registration flow. - The admin Invites page (templates/admin/invites.php) currently reconstructs registration links from the stored token, which no longer works once only the hash is stored. Show the full link **once**, in a notice right after the invite is created; the pending list keeps email/expiry/revoke. To re-send a lost link: revoke and re-invite. - Existing plaintext pending invites will stop matching (pre-1.0 plugin, acceptable); they can be revoked and re-issued.

thatguygriff added the security label 2026-06-10 18:50:52 +00:00

thatguygriff referenced this issue from a commit

2026-06-10 19:36:30 +00:00

Security fixes: CSV injection, policy body output, invite hashing, slot datetimes

thatguygriff referenced this issue

2026-06-10 19:39:33 +00:00

Security fixes: CSV injection, policy body output, invite token hashing, slot datetime validation #43

thatguygriff closed this issue

2026-06-10 19:51:22 +00:00

thatguygriff referenced this issue

2026-06-10 20:17:52 +00:00

Invites never expire (no TTL on pending tokens) #37