Changeset 1527904

Timestamp:

11/04/2016 07:33:59 AM (9 years ago)

Author:

froman118

Message:

Permission and security fixes

Location:

my-page-order/trunk

Files:

• mypageorder.php (modified) (8 diffs)
• readme.txt (modified) (2 diffs)

my-page-order/trunk/mypageorder.php

@@ -4 +4 @@
 Plugin URI: http://www.geekyweekly.com/mypageorder
 Description: My Page Order allows you to set the order of pages through a drag and drop interface. The default method of setting the order page by page is extremely clumsy, especially with a large number of pages.
-Version: 4.3.2
+Version: 4.4.2
 Author: Andrew Charlton
 Author URI: http://www.geekyweekly.com
@@ -46 +46 @@
 $success = "";
 
+current_user_can('edit_pages'); 
+
 if (isset($_POST)) {
-    if ( ! isset( $_POST['_nonce_my_page_order'] ) || ! wp_verify_nonce( $_POST['_nonce_my_page_order'], 'update' )  ) {
-     // exit;
-    }
-    
+
     if (isset($_POST['btnSubPages'])) { 
-    $parentID = $_POST['pages'];
+        $parentID = $_POST['pages'];
     }
     elseif (isset($_POST['hdnParentID'])) { 
@@ -58 +57 @@
     }
 
+    if(!is_numeric($parentID))
+        return '<div id="message" class="error fade"><p>'. __('An error occured.', 'mypageorder').'</p></div>';
+        
     if (isset($_POST['btnReturnParent'])) { 
-        $parentsParent = $wpdb->get_row( $wpdb->prepare("SELECT post_parent FROM $wpdb->posts WHERE ID = %d ", $_POST['hdnParentID'] ), ARRAY_N);
+        $returnParentID = $_POST['hdnParentID'];
+        if(!is_numeric($returnParentID))
+            return '<div id="message" class="error fade"><p>'. __('An error occured.', 'mypageorder').'</p></div>';
+        
+        $parentsParent = $wpdb->get_row( $wpdb->prepare("SELECT post_parent FROM $wpdb->posts WHERE ID = %d", $returnParentID), ARRAY_N);
         $parentID = $parentsParent[0];
     }
-
-    if (isset($_POST['btnOrderPages'])) { 
+    elseif (isset($_POST['btnOrderPages'])) { 
+        check_admin_referer('update_mypageorder_'.$parentID);
         $success = mypageorder_updateOrder();
     }
@@ -73 +79 @@
 <div class='wrap'>
 <form name="frmMyPageOrder" method="post" action="">
+    <?php wp_nonce_field('update_mypageorder_'.$parentID); ?>
     <h2><?php _e('My Page Order', 'mypageorder') ?></h2>
     <?php echo $success; ?>
@@ -110 +117 @@
     <input type="hidden" id="hdnMyPageOrder" name="hdnMyPageOrder" />
     <input type="hidden" id="hdnParentID" name="hdnParentID" value="<?php echo $parentID; ?>" />
-    <?php wp_nonce_field('update', '_nonce_my_page_order' ); ?>
+    
 </form>
 </div>
@@ -189 +196 @@
 
         $hdnMyPageOrder = $_POST['hdnMyPageOrder'];
+            
         $IDs = explode(",", $hdnMyPageOrder);
         $result = count($IDs);
@@ -195 +203 @@
         {
             $str = str_replace("id_", "", $IDs[$i]);
+            
+            if(!is_numeric($str))
+                return '<div id="message" class="error fade"><p>'. __('An error occured, order has not been saved.', 'mypageorder').'</p></div>';
+            
             $wpdb->query($wpdb->prepare("UPDATE $wpdb->posts SET menu_order = %d WHERE id = %d ", $i, $str));
         }
@@ -201 +213 @@
     }
     else
-        return '<div id="message" class="updated fade"><p>'. __('An error occured, order has not been saved.', 'mypageorder').'</p></div>';
+        return '<div id="message" class="error fade"><p>'. __('An error occured, order has not been saved.', 'mypageorder').'</p></div>';
 }
 

my-page-order/trunk/readme.txt

@@ -4 +4 @@
 Tags: page, order, sidebar, widget
 Requires at least: 2.8
-Tested up to: 4.3.2
-Stable tag: 4.3.2
+Tested up to: 4.4.2
+Stable tag: 4.4.2
 
 My Page Order allows you to set the order of pages through a drag and drop interface.
@@ -18 +18 @@
 
 == Change Log ==
+= 4.4.2 =
+* Permission check and security improvement.
 = 4.3 =
 * PHP7 constructor update