Changeset 1723410

Timestamp:

09/01/2017 07:50:46 PM (8 years ago)

Author:

Cimmo

Message:

Fixed XSS security vulnerability that can be triggered by other admin users (credit to Zach Julian)

Location:

cimy-swift-smtp/trunk

Files:

• README_OFFICIAL.txt (modified) (1 diff)
• swift_engine.php (modified) (1 diff)

cimy-swift-smtp/trunk/README_OFFICIAL.txt

@@ -63 +63 @@
 CHANGELOG:
 v3.0.0 - /08/2017
-- Updated Swift Mailer to 6.0.1 (dropped support for PHP <=5.x)
+- Updated Swift Mailer to 6.0.1 (dropped support for PHP <=5.x and WordPress <= 3.x)
+- Fixed XSS security vulnerability that can be triggered by other admin users (credit to Zach Julian)
 
 v2.6.3 - 10/05/2017

cimy-swift-smtp/trunk/swift_engine.php

@@ -323 +323 @@
     catch (Exception $e) {
         $result = false;
-        if ($echo_error)
-            echo $e->getMessage();
+        if ($echo_error) {
+            echo esc_html_x($e->getMessage());
+        }
     }