WordPress.org
Get WordPress

Plugin Directory

Changeset 1655594


Ignore:
Timestamp:
05/12/2017 01:03:00 AM (9 years ago)
Author:
shen045
Message:

Sanitize values obtained from querystring immediately

Location:
crafty-social-buttons/trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • crafty-social-buttons/trunk/README.txt

    r1654731 r1655594  
    102102== Changelog ==
    103103
     104= 1.5.8 =
     105* Added additional defences against cross site scripting
     106
    104107= 1.5.7 =
    105108* Fixed potential cross site scripting vulnerability in admin page
    … …  
    254257== Upgrade Notice ==
    255258
     259= 1.5.8 =
     260* Added additional defences against cross site scripting
     261
    256262= 1.5.7 =
    257263* Fixed potential cross site scripting vulnerability in admin page

  • crafty-social-buttons/trunk/class-SH-Crafty-Social-Buttons-Plugin.php

    r1363388 r1655594  
    263263         }
    264264         // get service
    265          $service = isset($_GET['service']) ? $_GET['service'] : '';
     265         $service = sanitize_text_field(isset($_GET['service']) ? $_GET['service'] : '');
    266266         if (empty($service) || strpos($settings['share_services'], $service) === false) {
    267267            $result->error = true;
    … …  
    271271
    272272         // get key
    273          $key = isset($_GET['key']) ? $_GET['key'] : '';
     273         $key = sanitize_key(isset($_GET['key']) ? $_GET['key'] : '');
    274274         if (empty($key)) {
    275275            $result->error = true;
    … …  
    280280         // get url
    281281         if ($key == "page") {
    282             $url = isset($_GET['url']) ? $_GET['url'] : '';
     282            $url = sanitize_text_field(isset($_GET['url']) ? $_GET['url'] : '');
    283283            if (empty($url)) {
    284284               $result->error = true;

  • crafty-social-buttons/trunk/crafty-social-buttons.php

    r1654731 r1655594  
    1616 * Plugin URI:  http://github.com/sarahhenderson/crafty-social-buttons
    1717 * Description: Adds social sharing buttons and links to your site, including Ravelry, Etsy, Craftsy and Pinterest
    18  * Version:     1.5.7
     18 * Version:     1.5.8
    1919 * Author:      Sarah Henderson
    2020 * Author URI:  http://sarahhenderson.nz

  • crafty-social-buttons/trunk/js/admin.min.js

    r1654731 r1655594  
    11/*! crafty-social-buttons  (c) Sarah Henderson 2017
    2  * Version 1.5.7 (11-05-2017) */
     2 * Version 1.5.8 (12-05-2017) */
    33jQuery(document).ready(function(a){a("#csbsort1, #csbsort2").sortable({connectWith:".connectedSortable",update:function(){var b;b=a("#csbsort2 li").map(function(){return a(this).attr("id")}).get(),a(".csb-services").val(b)}}).disableSelection(),a(".csb-services").val(a("#csbsort2 li").map(function(){return a(this).attr("id")}).get()),a(".csb-image-set").change(function(){var b=a(this).val();a.each(a(".csb-services img"),function(c,d){var e=a(d).attr("data-url"),f=a(d).attr("data-alt-url"),g=a(d).attr("data-filename"),h=e+b+"/"+g,i=f+b+"/"+g;a(d).attr("src",h),a(d).attr("data-image-set",b),a.ajax(h,{method:"get",error:function(b,c,e){a(d).attr("src",i)}})})}),a("#share_image_size").bind("input",function(){var b=a(this).val();a.each(a(".csb-services img"),function(c,d){a(d).attr("width",b),a(d).attr("height",b)})}),a("#link_image_size").bind("input",function(){var b=a(this).val();a.each(a(".csb-services img"),function(c,d){a(d).attr("width",b),a(d).attr("height",b)})})});

  • crafty-social-buttons/trunk/js/public.min.js

    r1654731 r1655594  
    11/*! crafty-social-buttons  (c) Sarah Henderson 2017
    2  * Version 1.5.7 (11-05-2017) */
     2 * Version 1.5.8 (12-05-2017) */
    33jQuery(document).ready(function(a){var b=[];for(var c in window)0===c.indexOf("crafty_social_buttons_data_")&&b.push(window[c]);for(var d=function(a){return a<1e3?a:a<1e4?(a/1e3).toFixed(1)+"k":Math.floor(a/1e3)+"k"},e=function(b,c,e,f){var g=e+"&service="+b+"&key="+f;"page"==f&&(g+="&url="+c);var h=b.toLowerCase();a.ajax(g,{cache:!1,type:"get",dataType:"json",contentType:"application/json",success:function(b){if(b&&b.count){var c=d(b.count);$count=a(".crafty-social-share-count-"+h+"-"+f),$count.html(c),$count.show()}},error:function(a,b,c){}})},f=0,g=b.length;f<g;f++)for(var h=b[f],i=h.url,j=h.callbackUrl,c=h.key,k=0,l=h.services.length;k<l;k++){var m=h.services[k];e(m,i,j,c)}var n=function(a){var b="height=400,width=640";return a.indexOf("ravelry.com")>-1&&(b="fullscreen=yes"),newwindow=window.open(a,"share",b+",resizable=yes"),window.focus&&newwindow.focus(),!1},o=a(".crafty-social-buttons a.popup");a.each(o,function(b,c){a(c).hasClass("csb-email")||a(c).hasClass("csb-pinterest")||(c.onclick=function(){return n(this.href)})})});

  • crafty-social-buttons/trunk/js/whatsapp-share.min.js

    r1654731 r1655594  
    11/*! crafty-social-buttons  (c) Sarah Henderson 2017
    2  * Version 1.5.7 (11-05-2017) */
     2 * Version 1.5.8 (12-05-2017) */
    33jQuery(document).ready(function(a){/Android|webOS|iPhone|iPad|iPod|BlackBerry|BB10|IEMobile|Opera Mini/i.test(navigator.userAgent)&&a("div.crafty-social-share-buttons ul li a.crafty-social-button.csb-whatsapp").show()});

  • crafty-social-buttons/trunk/views/admin.php

    r1654731 r1655594  
    33    <h2><?php _e('Crafty Social Buttons', $this->plugin_slug); ?></h2>
    44
    5     <?php $active_tab = (isset($_GET['tab'])) ? $_GET['tab'] : 'share_options'; ?>
     5    <?php $active_tab = sanitize_key(isset($_GET['tab'])) ? $_GET['tab'] : 'share_options'; ?>
    66
    77    <h2 class="nav-tab-wrapper">
Note: See TracChangeset for help on using the changeset viewer.