From 752dd9112033fff2ea0ebc62db9b7e960143d88b Mon Sep 17 00:00:00 2001
From: Bartosz Gadomski <kontakt@bartoszgadomski.pl>
Date: Mon, 6 Jul 2026 10:30:34 +0200
Subject: [PATCH 1/4] Harden live update preference authorization

Enforce the view capability and always target the current user in the
stream_enable_live_update AJAX handler so a user can only change their
own live update preference. Drop the client-supplied user field from the
markup and AJAX payload, and add PHPUnit coverage for the authorization
behavior.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 classes/class-list-table.php             |  3 -
 classes/class-live-update.php            | 18 ++----
 src/js/admin.js                          |  2 -
 tests/phpunit/test-class-live-update.php | 80 ++++++++++++++++++++++++
 4 files changed, 85 insertions(+), 18 deletions(-)
 create mode 100644 tests/phpunit/test-class-live-update.php

diff --git a/classes/class-list-table.php b/classes/class-list-table.php
index d22133775..de41c1e19 100644
--- a/classes/class-list-table.php
+++ b/classes/class-list-table.php
@@ -1155,9 +1155,6 @@ public function screen_controls( $status, $args ) {
 			<div>
 				<input type="hidden" name="stream_live_update_nonce" id="stream_live_update_nonce" value="<?php echo esc_attr( $nonce ); ?>"/>
 			</div>
-			<div>
-				<input type="hidden" name="enable_live_update_user" id="enable_live_update_user" value="<?php echo absint( $user_id ); ?>"/>
-			</div>
 			<div class="metabox-prefs stream-live-update-checkbox">
 				<label for="enable_live_update">
 					<input type="checkbox" value="on" name="enable_live_update" id="enable_live_update" data-heartbeat="<?php echo esc_attr( $heartbeat ); ?>" <?php checked( $option, 'on' ); ?> />
diff --git a/classes/class-live-update.php b/classes/class-live-update.php
index 7b0ae2e31..4435b1235 100644
--- a/classes/class-live-update.php
+++ b/classes/class-live-update.php
@@ -55,23 +55,15 @@ public function __construct( $plugin ) {
 	public function enable_live_update() {
 		check_ajax_referer( $this->user_meta_key . '_nonce', 'nonce' );
 
-		$input = array(
-			'checked'   => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
-			'user'      => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
-			'heartbeat' => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
-		);
-
-		$input = filter_input_array( INPUT_POST, $input );
-
-		if ( false === $input ) {
-			wp_send_json_error( 'Error in live update checkbox' );
+		if ( ! current_user_can( $this->plugin->admin->view_cap ) ) {
+			wp_send_json_error( esc_html__( 'You do not have permission to do this.', 'stream' ) );
 		}
 
-		$checked = ( 'checked' === $input['checked'] ) ? 'on' : 'off';
+		$checked = ( 'checked' === wp_stream_filter_input( INPUT_POST, 'checked' ) ) ? 'on' : 'off';
 
-		$user = (int) $input['user'];
+		$user = get_current_user_id();
 
-		if ( 'false' === $input['heartbeat'] ) {
+		if ( 'false' === wp_stream_filter_input( INPUT_POST, 'heartbeat' ) ) {
 			update_user_meta( $user, $this->user_meta_key, 'off' );
 
 			wp_send_json_error( esc_html__( "Live updates could not be enabled because Heartbeat is not loaded.\n\nYour hosting provider or another plugin may have disabled it for performance reasons.", 'stream' ) );
diff --git a/src/js/admin.js b/src/js/admin.js
index 80d3d4b23..5f6cf7f7d 100644
--- a/src/js/admin.js
+++ b/src/js/admin.js
@@ -222,7 +222,6 @@ $( document ).ready(
 		$( '#enable_live_update' ).click(
 			function() {
 				const nonce = $( '#stream_live_update_nonce' ).val();
-				const user = $( '#enable_live_update_user' ).val();
 				let checked = 'unchecked';
 				let heartbeat = 'true';
 
@@ -239,7 +238,6 @@ $( document ).ready(
 						data: {
 							action: 'stream_enable_live_update',
 							nonce,
-							user,
 							checked,
 							heartbeat,
 						},
diff --git a/tests/phpunit/test-class-live-update.php b/tests/phpunit/test-class-live-update.php
new file mode 100644
index 000000000..172c33d5d
--- /dev/null
+++ b/tests/phpunit/test-class-live-update.php
@@ -0,0 +1,80 @@
+<?php
+namespace WP_Stream;
+
+/**
+ * Class Test_Live_Update
+ *
+ * @package WP_Stream
+ */
+class Test_Live_Update extends WP_StreamTestCase {
+	/**
+	 * Live update instance under test.
+	 *
+	 * @var Live_Update
+	 */
+	protected $live_update;
+
+	public function setUp(): void {
+		parent::setUp();
+
+		$this->live_update = new Live_Update( $this->plugin );
+	}
+
+	public function tearDown(): void {
+		unset( $_POST['action'], $_POST['nonce'], $_POST['checked'], $_POST['heartbeat'], $_POST['user'] );
+
+		parent::tearDown();
+	}
+
+	public function test_enable_live_update_only_updates_current_user() {
+		$attacker_id = $this->factory->user->create( array( 'role' => 'subscriber' ) );
+		$victim_id   = $this->factory->user->create( array( 'role' => 'administrator' ) );
+
+		$this->plugin->settings->options['general_role_access'] = array( 'subscriber' );
+		wp_set_current_user( $attacker_id );
+
+		$this->assertTrue( current_user_can( $this->plugin->admin->view_cap ) );
+
+		update_user_meta( $attacker_id, $this->live_update->user_meta_key, 'off' );
+		update_user_meta( $victim_id, $this->live_update->user_meta_key, 'off' );
+
+		$_POST['action']    = 'stream_enable_live_update';
+		$_POST['nonce']     = wp_create_nonce( $this->live_update->user_meta_key . '_nonce' );
+		$_POST['checked']   = 'checked';
+		$_POST['heartbeat'] = 'true';
+		$_POST['user']      = (string) $victim_id;
+
+		try {
+			$this->_handleAjax( 'stream_enable_live_update' );
+		} catch ( \WPAjaxDieContinueException $e ) {
+			// Expected: wp_send_json_success() terminates the AJAX request.
+		}
+
+		$this->assertSame( 'on', get_user_meta( $attacker_id, $this->live_update->user_meta_key, true ) );
+		$this->assertSame( 'off', get_user_meta( $victim_id, $this->live_update->user_meta_key, true ) );
+	}
+
+	public function test_enable_live_update_denies_users_without_view_cap() {
+		$user_id = $this->factory->user->create( array( 'role' => 'subscriber' ) );
+
+		$this->plugin->settings->options['general_role_access'] = array( 'administrator' );
+		wp_set_current_user( $user_id );
+
+		$this->assertFalse( current_user_can( $this->plugin->admin->view_cap ) );
+
+		update_user_meta( $user_id, $this->live_update->user_meta_key, 'off' );
+
+		$_POST['action']    = 'stream_enable_live_update';
+		$_POST['nonce']     = wp_create_nonce( $this->live_update->user_meta_key . '_nonce' );
+		$_POST['checked']   = 'checked';
+		$_POST['heartbeat'] = 'true';
+
+		try {
+			$this->_handleAjax( 'stream_enable_live_update' );
+		} catch ( \WPAjaxDieContinueException $e ) {
+			// Expected: wp_send_json_error() terminates the AJAX request.
+		}
+
+		$this->assertSame( 'off', get_user_meta( $user_id, $this->live_update->user_meta_key, true ) );
+	}
+}

From 6aeb53cd8212b22c5a3b89cbc865e773a5f14f66 Mon Sep 17 00:00:00 2001
From: Bartosz Gadomski <kontakt@bartoszgadomski.pl>
Date: Mon, 6 Jul 2026 10:47:16 +0200
Subject: [PATCH 2/4] Fix E2E CI: refresh apt metadata before Playwright
 install

The ondrej/php PPA added by setup-php changed its repository Label, which
caused the apt-get update run by `playwright install --with-deps` to abort
with exit code 100. Refresh apt metadata with --allow-releaseinfo-change
first so browser dependency installation succeeds.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/lint-and-test.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index b4acf5cf8..c9d790705 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -120,6 +120,14 @@ jobs:
       - name: Install Composer dependencies
         run: composer install
 
+      - name: Refresh apt metadata
+        # `shivammathur/setup-php` adds the ondrej/php PPA, which recently
+        # changed its repository `Label`. `apt-get update` (invoked by
+        # Playwright's `--with-deps`) aborts with exit code 100 on such
+        # changes unless `--allow-releaseinfo-change` is passed. Refresh the
+        # metadata here so the subsequent Playwright dependency install works.
+        run: sudo apt-get update --allow-releaseinfo-change
+
       - name: Install Playwright browsers
         run: npx playwright install --with-deps chromium
 

From 41fcef8a7e855decd9235d4522431d8123e92431 Mon Sep 17 00:00:00 2001
From: Bartosz Gadomski <kontakt@bartoszgadomski.pl>
Date: Mon, 6 Jul 2026 13:35:29 +0200
Subject: [PATCH 3/4] Assert AJAX response in live update authorization tests

Pin the JSON success flag in both the denial and current-user tests so a
future refactor cannot silently return success without writing the
expected user meta.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 tests/phpunit/test-class-live-update.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/phpunit/test-class-live-update.php b/tests/phpunit/test-class-live-update.php
index 172c33d5d..c6195bbaa 100644
--- a/tests/phpunit/test-class-live-update.php
+++ b/tests/phpunit/test-class-live-update.php
@@ -50,6 +50,9 @@ public function test_enable_live_update_only_updates_current_user() {
 			// Expected: wp_send_json_success() terminates the AJAX request.
 		}
 
+		$response = json_decode( $this->_last_response );
+		$this->assertTrue( $response->success );
+
 		$this->assertSame( 'on', get_user_meta( $attacker_id, $this->live_update->user_meta_key, true ) );
 		$this->assertSame( 'off', get_user_meta( $victim_id, $this->live_update->user_meta_key, true ) );
 	}
@@ -75,6 +78,9 @@ public function test_enable_live_update_denies_users_without_view_cap() {
 			// Expected: wp_send_json_error() terminates the AJAX request.
 		}
 
+		$response = json_decode( $this->_last_response );
+		$this->assertFalse( $response->success );
+
 		$this->assertSame( 'off', get_user_meta( $user_id, $this->live_update->user_meta_key, true ) );
 	}
 }

From cb4fed9b68a15f3d321423f8fea25f6aa437ca08 Mon Sep 17 00:00:00 2001
From: Bartosz Gadomski <kontakt@bartoszgadomski.pl>
Date: Mon, 6 Jul 2026 18:38:30 +0200
Subject: [PATCH 4/4] Release 4.2.2

Bump version to 4.2.2 and document the live update authorization
hardening in the changelog.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 changelog.md             | 6 ++++++
 classes/class-plugin.php | 2 +-
 readme.txt               | 6 +++++-
 stream.php               | 2 +-
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/changelog.md b/changelog.md
index 784520ba8..d2071a263 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,5 +1,11 @@
 # Stream Changelog
 
+## 4.2.2 - July 6, 2026
+
+### Security
+
+- Harden authorization for the live update preference: enforce the Stream view capability and always target the current user in the `stream_enable_live_update` AJAX handler so a user can only change their own live update preference ([#1918](https://github.com/xwp/stream/pull/1918)).
+
 ## 4.2.1 - July 2, 2026
 
 ### Bug Fixes
diff --git a/classes/class-plugin.php b/classes/class-plugin.php
index 28c3648df..c6a652869 100755
--- a/classes/class-plugin.php
+++ b/classes/class-plugin.php
@@ -20,7 +20,7 @@ class Plugin {
 	 *
 	 * @const string
 	 */
-	const VERSION = '4.2.1';
+	const VERSION = '4.2.2';
 
 	/**
 	 * WP-CLI command
diff --git a/readme.txt b/readme.txt
index f5d1c0b26..11b177124 100644
--- a/readme.txt
+++ b/readme.txt
@@ -3,7 +3,7 @@ Contributors: xwp
 Tags: wp stream, stream, activity, logs, track
 Requires at least: 4.6
 Tested up to: 7.0
-Stable tag: 4.2.1
+Stable tag: 4.2.2
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -134,6 +134,10 @@ Use only `$_SERVER['REMOTE_ADDR']` as the client IP address for event logs witho
 
 == Changelog ==
 
+= 4.2.2 - July 6, 2026 =
+
+See: [https://github.com/xwp/stream/blob/develop/changelog.md#422---july-6-2026](https://github.com/xwp/stream/blob/develop/changelog.md#422---july-6-2026)
+
 = 4.2.1 - July 2, 2026 =
 
 See: [https://github.com/xwp/stream/blob/develop/changelog.md#421---july-2-2026](https://github.com/xwp/stream/blob/develop/changelog.md#421---july-2-2026)
diff --git a/stream.php b/stream.php
index 2d4bfb7db..cf85e83e2 100644
--- a/stream.php
+++ b/stream.php
@@ -3,7 +3,7 @@
  * Plugin Name: Stream
  * Plugin URI: https://xwp.co/work/stream/
  * Description: Stream tracks logged-in user activity so you can monitor every change made on your WordPress site in beautifully organized detail. All activity is organized by context, action and IP address for easy filtering. Developers can extend Stream with custom connectors to log any kind of action.
- * Version: 4.2.1
+ * Version: 4.2.2
  * Author: XWP
  * Author URI: https://xwp.co
  * License: GPLv2+