# Trading Buttons

**URL:** <https://meta.discourse.org/t/trading-buttons/71308>\
**Category:** Plugin\
**Created:** [October 3, 2017, 11:01am UTC](https://meta.discourse.org/t/trading-buttons/71308 "2017-10-03T11:01:07Z")\
**Posts on this page:** 1\
**Showing post:** 113

<div class="post-metadata">

**Author:** ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)\
**Post date:** [June 23, 2024, 10:04am UTC](https://meta.discourse.org/t/trading-buttons/71308/113 "2024-06-23T10:04:20Z")

</div>

⚠ **security vulnerability** ⚠

TL;DR installing this plugin will - even when disabled - leak _all_ topic custom fields that are present to anyone who can access the topic, including anonymous users. Depending on other plugins you have installed, topic custom fields can contain sensitive data.

~~When vetting this plugin for a client we discovered a number of security issues. We have fixed these issues in our fork ([https://github.com/communiteq/discourse-topic-trade-buttons/tree/master](https://github.com/communiteq/discourse-topic-trade-buttons/tree/master)) and made a pull request. However, the topic author has not responded to our pull request or our PM so we are now disclosing these issues.~~

### Security fix: information leakage

All custom fields (including those from other plugins!) are being serialized, including to anonymous users. Custom fields can contain sensitive data and should never be serialized like that.

Since the `sold_at` etc values are being set server side anyway and the buttons are “computed” on `topic.archived`, the custom field logic can be removed from the frontend user-facing code and the custom fields only need to be serialized for the admin interface to work - hence the serialization can be limited to admin users. We do suspect that this is not even necessary either.

### Initialization fixes

The ` if SiteSetting.topic_trade_buttons_enabled` check that is fencing the serialization logic makes it necessary to restart Discourse after enabling or disabling the plugin. This check is unnecessary since Discourse already takes care of that.  
Using `respect_plugin_enabled: false` is unnecessary and aggravates the security issue described above.

---

_[View the full topic](https://meta.discourse.org/t/trading-buttons/71308)._