Changeset 1169560

Timestamp:

05/28/2015 06:58:09 PM (11 years ago)

Author:

kyleabaker

Message:

v1.0.6

• Fixed XSS security vulnerability

Location:

wp-useragent/trunk

Files:

• readme.txt (modified) (3 diffs)
• wp-useragent.php (modified) (5 diffs)

wp-useragent/trunk/readme.txt

@@ -4 +4 @@
 Tags: useragent, user-agent, user agent, web, browser, web browser, operating system, platform, os, mac, apple, windows, win, linux, phone
 Requires at least: 2.0
-Tested up to: 4.0
-Stable tag: 1.0.5
+Tested up to: 4.2.2
+Stable tag: 1.0.6
 
 == Description ==
@@ -66 +66 @@
 
 == Changelog ==
+
+= v1.0.6 =
+* Fixed XSS security vulnerability
+
 
 = v1.0.5 =
@@ -597 +601 @@
 == Upgrade Notice ==
 
-= v1.0.5 =
-* Added height and width attributes to icons to fix an issue with 'Simple Lazyload' (props: Yu)
+= v1.0.6 =
+* Fixed XSS security vulnerability

wp-useragent/trunk/wp-useragent.php

@@ -4 +4 @@
 Plugin URI: http://kyleabaker.com/goodies/coding/wp-useragent/
 Description: A simple User-Agent detection plugin that lets you easily insert icons and/or textual web browser and operating system details with each comment.
-Version: 1.0.5
+Version: 1.0.6
 Author: Kyle Baker
 Author URI: http://kyleabaker.com/
@@ -11 +11 @@
 */
 
-/* Copyright 2008-2014  Kyle Baker  (email: [email protected])
+/* Copyright 2008-2015  Kyle Baker  (email: [email protected])
     //Copyright 2008  Fernando Briano  (email : [email protected])
 
@@ -129 +129 @@
 
     // Where should we display the useragent output?
-    $useragent=$comment->comment_agent;
+    $useragent=wp_strip_all_tags($comment->comment_agent, false);
     if($ua_output_location=="before")
     {
@@ -245 +245 @@
 
         // Attach the full ua string to the output.
-        $ua.="<small>".htmlspecialchars($comment->comment_agent)."</small>";
+        $ua.="<small>".htmlspecialchars(wp_strip_all_tags($comment->comment_agent, false))."</small>";
     }
 
@@ -263 +263 @@
     {
         get_currentuserinfo();
-        $useragent=$comment->comment_agent;
+        $useragent=wp_strip_all_tags($comment->comment_agent, false);
         display_useragent();
     }