WordPress.org
Get WordPress

Plugin Directory

Changeset 1253322


Ignore:
Timestamp:
09/25/2015 11:56:07 AM (9 years ago)
Author:
dustin999
Message:

Security fixes

Location:
local-market-explorer/trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • local-market-explorer/trunk/admin.php

    r933818 r1253322  
    6161                "name" => "Walk Score",
    6262                "description" => "see <a href=\"http://www.walkscore.com\">Walk Score</a>"),
    63             "yelp" => array(
    64                 "name" => "Yelp reviews",
    65                 "description" => "from <a href=\"http://www.yelp.com\">Yelp</a>"),
    6663            "dsidxpress" => array(
    6764                "name" => "Newest real estate",
    … …  
    159156                                        <input class="lme-api-key" type="text" id="local-market-explorer[api-keys][zillow]"
    160157                                            name="local-market-explorer[api-keys][zillow]"
    161                                             value="<?php echo $options["api-keys"]["zillow"] ?>" />
     158                                            value="<?php if (isset($options["api-keys"]["zillow"])) { echo $options["api-keys"]["zillow"]; } ?>" />
    162159                                    </td>
    163160                                </tr>
    … …  
    172169                                        <input class="lme-api-key" type="text" id="local-market-explorer[api-keys][walk-score]"
    173170                                            name="local-market-explorer[api-keys][walk-score]"
    174                                             value="<?php echo $options["api-keys"]["walk-score"] ?>" />
    175                                     </td>
    176                                 </tr>
    177                                 <tr>
    178                                     <th>
    179                                         <label for="local-market-explorer[api-keys][yelp]">
    180                                             Yelp API key:<br>
    181                                             <span style="font-size: 10px;">(<a href="http://www.yelp.com/developers/getting_started/api_access" target="_blank">get one</a>)</span>
    182                                         </label>
    183                                     </th>
    184                                     <td>
    185                                         <input class="lme-api-key" type="text" id="local-market-explorer[api-keys][yelp]"
    186                                             name="local-market-explorer[api-keys][yelp]"
    187                                             value="<?php echo $options["api-keys"]["yelp"] ?>" />
     171                                            value="<?php if (isset($options["api-keys"]["walk-score"])) { echo $options["api-keys"]["walk-score"]; } ?>" />
    188172                                    </td>
    189173                                </tr>
    … …  
    194178                                <li>
    195179                                    <input type="text" name="local-market-explorer[zillow-username]"
    196                                         id="local-market-explorer[zillow-username]" value="<?php echo $options["zillow-username"] ?>" />
     180                                        id="local-market-explorer[zillow-username]" value="<?php if (isset($options["zillow-username"])) { echo $options["zillow-username"]; } ?>" />
    197181                                    <label for="local-market-explorer[zillow-username]">
    198182                                        Your username on Zillow.com (for your branding when clicking through on the links)</label>
    … …  
    426410    }
    427411    static function proxyZillowApiRequest() {
    428         $apiBase = "http://www.zillow.com/webservice/" . sanitize_text_field($_GET["api"]) . ".htm?";
     412    $theApikey = preg_replace("/[^a-z0-9_\-]+/i", "", esc_js($_GET["api"]));
     413    $apiBase = "http://www.zillow.com/webservice/" . urlencode($theApikey) . ".htm";
    429414        $apiParams = $_GET["apiParams"];
    430        
    431         $finalApiUrl = $apiBase;
    432         foreach ($apiParams as $k => $v)
    433             $finalApiUrl .= $k . "=" . urlencode($v) . "&";
     415                                             
     416    $finalApiUrl = $apiBase;
     417    $finalApiUrl = add_query_arg( $apiParams, $finalApiUrl );
    434418        if (empty($apiParams["zws-id"])) {
    435419            $options = get_option(LME_OPTION_NAME);
    436             $finalApiUrl .= "zws-id=" . urlencode($options["api-keys"]["zillow"]) . "&";
     420      $finalApiUrl = add_query_arg( array('zws-id' => urlencode($options["api-keys"]["zillow"])), $finalApiUrl );
    437421        }
    438        
     422    $finalApiUrl = add_query_arg( array('output' => 'json'), $finalApiUrl );   
     423
    439424        $apiResponse = wp_remote_get($finalApiUrl);
    440425       

  • local-market-explorer/trunk/modules-page.php

    r933818 r1253322  
    2323                unset($wp_query->query["lme-action"]);
    2424            } else {
    25                 $q->query_vars["caller_get_posts"] = true;
     25                $q->query_vars["ignore_sticky_posts"] = true;
    2626            }
    2727        }
    … …  
    134134            if ($module == "schools")
    135135                $content .= LmeModuleSchools::getModuleHtml($moduleContent["schools"]);
    136             if ($module == "yelp")
     136            if ($module == "yelp_DISABLED")
    137137                $content .= LmeModuleYelp::getModuleHtml($moduleContent["yelp"]);
    138138            if ($module == "walk-score")
    … …  
    181181    static function getNeighborhood() {
    182182        global $wp_query;
    183         return urldecode(str_replace(array("-", "_"), array(" ", "-"), $wp_query->query["lme-neighborhood"]));
     183    if (isset($wp_query->query["lme-neighborhood"])) {
     184          return urldecode(str_replace(array("-", "_"), array(" ", "-"), $wp_query->query["lme-neighborhood"]));
     185    }
     186    else {
     187      return null;
     188    }
    184189    }
    185190    static function getCity() {
    186191        global $wp_query;
    187         return urldecode(str_replace(array("-", "_"), array(" ", "-"), $wp_query->query["lme-city"]));
     192    if (isset($wp_query->query["lme-city"])) {
     193          return urldecode(str_replace(array("-", "_"), array(" ", "-"), $wp_query->query["lme-city"]));
     194    }
     195    else {
     196      return null;
     197    }
    188198    }
    189199    static function getState() {
    190200        global $wp_query;
    191         return $wp_query->query["lme-state"];
     201    if (isset($wp_query->query["lme-state"])) {
     202          return $wp_query->query["lme-state"];
     203    }
     204    else {
     205      return null;
     206    }
    192207    }
    193208    static function getZip() {

  • local-market-explorer/trunk/modules/colleges.php

    r933818 r1253322  
    3333       
    3434        if (!empty($opt_zip)) {
    35             $areaName = htmlspecialchars($zip);
     35            $areaName = htmlspecialchars($opt_zip);
    3636        } else {
    3737            $areaName = htmlspecialchars(ucwords($opt_city) . ", " . strtoupper($opt_state));
    … …  
    113113HTML;
    114114        }
    115 
    116         $content .= <<<HTML
     115    if (isset($findMoreUrl)) {
     116        $content .= <<<HTML
    117117                    </div>
    118118                </div>
    119119                <div style="clear: both;"></div> <!-- IE 6 fix -->
    120120                <div class="lme-colleges-find-more">
    121                     Find more <a href="{$findMoreUrl}" rel="nofollow" target="_blank">Colleges in {$state}</a>
     121                     Find more <a href="{$findMoreUrl}" rel="nofollow" target="_blank">Colleges in {$state}</a>
    122122                </div>
    123123                <div style="clear: both;"></div> <!-- IE 6 fix -->
    124124            </div>
    125125HTML;
     126    }
     127    else {
     128        $content .= <<<HTML
     129                    </div>
     130                </div>
     131                <div style="clear: both;"></div>
     132            </div>
     133HTML;
     134    }
    126135        return $content;
    127136    }

  • local-market-explorer/trunk/modules/market-stats.php

    r446550 r1253322  
    7171        $ownersRentersChart = $demographics[0]->xpath("charts/chart[name='Owners vs. Renters']/url");
    7272        $yearBuiltChart = $demographics[0]->xpath("charts/chart[name='Year Built']/url");
    73        
     73   
     74    $noshowarr = ['PERCENT LISTING PRICE REDUCTION', 'MEDIAN LIST PRICE', 'HOMES FOR SALE','HOMES RECENTLY SOLD','MEDIAN VALUE PER SQ FT','HOMES FOR SALE BY OWNER','NEW CONSTRUCTION','FORECLOSURES'];
     75   
    7476        $content = <<<HTML
    7577            <h2 class="lme-module-heading">Real Estate Market Stats</h2>
    … …  
    7779                {$zhviHtml}
    7880                <div class="lme-market-charts-container">
    79                     <img src="{$regionChart->url}{$zillowUrlSuffix}" class="lme-zhvi-chart" />
     81                    <!--<img src="{$regionChart->url}{$zillowUrlSuffix}" class="lme-zhvi-chart" />
    8082                    <div class="lme-market-charts">
    81                         <div>
     83            <div>
    8284                            <h4>Zillow Home Value Index</h4>
    8385                            <img src="{$zhviDistributionChart[0]}" />
    … …  
    8890                        </div>
    8991                    </div>
     92          //-->
    9093                    <div class="lme-market-chart-supplemental" style="clear: both;">
    9194                        <h4>Home Size in Square Feet</h4>
    … …  
    110113           
    111114            $name = htmlentities($attribute->name);
     115      if (in_array(trim(strtoupper($name)), $noshowarr)) {
     116        continue;
     117      }
    112118            $value = (array)$attribute->values->{$localNodeName}->value;
    113119            $nationalValue = (array)$attribute->values->nation->value;
    114120           
    115             if ($value["@attributes"]["type"] == "USD") {
     121            if ( (isset($value["@attributes"]["type"])) && ($value["@attributes"]["type"] == "USD") ) {
    116122                $value = "$" . number_format(intval($value["0"]));
    117123                $nationalValue = "$" . number_format(intval($nationalValue["0"]));
    118             } else if ($value["@attributes"]["type"] == "percent") {
     124            } else if ( (isset($value["@attributes"]["type"])) && ($value["@attributes"]["type"] == "percent") ) {
    119125                $value = ($value["0"] * 100) . "%";
    120126                $nationalValue = ($nationalValue["0"] * 100) . "%";
    121127            } else {
    122                 $value = number_format(intval($value["0"]));
    123                 $nationalValue = number_format(intval($nationalValue["0"]));
     128        if (isset($value["0"])) {
     129                  $value = number_format(intval($value["0"]));
     130        }
     131        else {
     132          $value = number_format(intval(0));
     133        }
     134        if (isset($nationalValue["0"])) {
     135                  $nationalValue = number_format(intval($nationalValue["0"]));
     136        }
     137        else {
     138          $nationalValue = number_format(intval(0));
     139        }
    124140            }
    125            
     141?>
     142<?php           
    126143            $content .= <<<HTML
    127144                    <tr>

  • local-market-explorer/trunk/modules/walk-score-iframe.php

    r951275 r1253322  
    5858    </div>
    5959    <?php
    60     $apiKey = preg_replace('/[^a-z0-9_-]/', '', esc_js($_GET['api-key']));
     60    $apiKey = preg_replace('/[^a-z0-9_\-]/', '', esc_js($_GET['api-key']));
    6161    $location = preg_replace('/[^a-z0-9_\-,\']/', '', esc_js(urldecode($_GET['location'])));
    6262    $location = str_replace("'", "\\'", $location);

  • local-market-explorer/trunk/modules/yelp.php

    r933818 r1253322  
    3636        wp_enqueue_script("local-market-explorer");
    3737       
    38         if (version_compare($wp_version, '3.3', '<')) {
     38    include ABSPATH . WPINC .'/version.php';
     39   
     40    if (version_compare($wp_version, '3.3', '<')) {
    3941            $wp_scripts->in_footer[] = "gmaps3";
    4042            $wp_scripts->in_footer[] = "local-market-explorer";
    … …  
    4244       
    4345        foreach ($yelpResponse as $business) {
    44             $jsonResults[] = (object)array(
    45                 "name"              => $business->name,
    46                 "address1"          => $business->address1,
    47                 "address2"          => $business->address2,
    48                 "address3"          => $business->address3,
    49                 "city"              => $business->city,
    50                 "state_code"        => $business->state_code,
    51                 "zip"               => $business->zip,
    52                 "phone"             => $business->phone,
    53                 "rating_img_url"    => $business->rating_img_url,
    54                 "review_count"      => $business->review_count,
    55                 "url"               => $business->url,
    56                 "latitude"          => $business->latitude,
    57                 "longitude"         => $business->longitude,
    58                 "photo_url"         => $business->photo_url
    59             );
     46      if ( isset($business->latitude) && isset($business->longitude) ) {
     47        $jsonResults[] = (object)array(
     48          "name"                => $business->name,
     49          "address1"            => $business->address1,
     50          "address2"            => $business->address2,
     51          "address3"            => $business->address3,
     52          "city"                => $business->city,
     53          "state_code"      => $business->state_code,
     54          "zip"             => $business->zip,
     55          "phone"               => $business->phone,
     56          "rating_img_url"  => $business->rating_img_url,
     57          "review_count"        => $business->review_count,
     58          "url"             => $business->url,
     59          "latitude"            => $business->latitude,
     60          "longitude"           => $business->longitude,
     61          "photo_url"           => $business->photo_url
     62        );
     63      }
     64      else {
     65        $jsonResults[] = (object)array(
     66          "name"                => $business->name,
     67          "address1"            => $business->address1,
     68          "address2"            => $business->address2,
     69          "address3"            => $business->address3,
     70          "city"                => $business->city,
     71          "state_code"      => $business->state_code,
     72          "zip"             => $business->zip,
     73          "phone"               => $business->phone,
     74          "rating_img_url"  => $business->rating_img_url,
     75          "review_count"        => $business->review_count,
     76          "url"             => $business->url,
     77          "latitude"            => null,
     78          "longitude"           => null,
     79          "photo_url"           => $business->photo_url
     80        );
     81      }
    6082        }
    6183       

  • local-market-explorer/trunk/readme.txt

    r933820 r1253322  
    33Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=10178626
    44Feedback page link: http://localmarketexplorer.uservoice.com/
    5 Tags: zillow, walk score, schools, education.com, real estate, local, city data, yelp, matchcollege, homethinking
     5Tags: zillow, walk score, schools, education.com, real estate, local, city data, matchcollege, homethinking
    66Requires at least: 2.8
    7 Tested up to: 3.3
    8 Stable tag: 3.2.6
     7Tested up to: 4.3
     8Stable tag: 4.0
    99
    1010This plugin allows WordPress to load data from a number of neighborhood-related APIs to be presented on a single page or within
    … …  
    2020* Schools (via [Education.com](http://www.education.com))
    2121* Walk Score (via [Walk Score](http://www.walkscore.com))
    22 * Yelp (via [Yelp](http://www.yelp.com))
    2322* IDX / MLS Real Estate Data (via [dsIDXpress](http://www.dsidxpress.com))
    2423* Colleges (via [MatchCollege](http://www.matchcollege.com))
    … …  
    9190* Small styling fixes
    9291* Fixes for Zillow market activity and market stats modules
    93 * Fixed maps in Yelp and NileGuide modules
    9492
    9593= 3.1.2 =
    … …  
    1981963. Schools module
    1991974. Walk Score module
    200 5. Yelp module
    201 6. Local Classes module
    202 7. Local Content from NileGuide module
     1985. Local Classes module
     1996. Local Content from NileGuide module
    2032007. Colleges module

  • local-market-explorer/trunk/widgets/areas.php

    r294797 r1253322  
    22class LmeAreasWidget extends WP_Widget {
    33    function LmeAreasWidget() {
    4         $this->WP_Widget("LmeAreas", "Local Market Explorer Areas", array(
    5             "classname" => "lme-areas",
    6             "description" => "Lists of Local Market Explorer areas with descriptions"
    7         ));
     4        parent::__construct(
     5      "LmeAreas",
     6      "Local Market Explorer Areas",
     7      array(
     8             "classname" => "lme-areas",
     9             "description" => "Lists of Local Market Explorer areas with descriptions"
     10          )
     11    );
    812    }
    913    function widget($args, $instance) {
Note: See TracChangeset for help on using the changeset viewer.