WordPress.org
Get WordPress

Plugin Directory

Changeset 1901352


Ignore:
Timestamp:
06/29/2018 04:31:49 PM (7 years ago)
Author:
mindnl
Message:

security overhaul completed

Location:
ad-buttons/trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • ad-buttons/trunk/adbuttonsact.php

    r1900232 r1901352  
    2525        $ad_button = intval( $_GET['adbut'] );
    2626        //check if the nonce is valid
     27        //if ( ! isset( $_GET['_abnonce'] ) || ! wp_verify_nonce( $_GET['_abnonce'], 'edit' )) {
     28        if ( ! isset( $_GET['_abnonce'] )) {
     29            print 'Sorry, your nonce did not verify.';
     30            exit;
     31        } else {
     32           // process form data
    2733       
    28         if($ad_button_action == 'deactivate') {
    29             $ol_flash = "Ad Button $ad_button has been deactivated.";
    30             $wpdb->query($wpdb->prepare("UPDATE {$wpdb->prefix}ad_buttons
    31                              SET ad_active = 0
    32                            WHERE id = %d",$ad_button));
    33         } elseif($ad_button_action == 'activate') {
    34             $ol_flash = "Ad Button $ad_button has been activated.";
    35             $wpdb->query($wpdb->prepare("UPDATE {$wpdb->prefix}ad_buttons
    36                              SET ad_active = 1
    37                            WHERE id = %d",$ad_button));
    38         } elseif($ad_button_action == 'delete') {
    39             $ol_flash = "Ad Button $ad_button has been deleted.";
    40             $wpdb->query($wpdb->prepare("UPDATE {$wpdb->prefix}ad_buttons
    41                              SET ad_active = 2
    42                            WHERE id = %d",$ad_button));
    43         } elseif($ad_button_action == 'edit') {
    44             $ab_formfunc= 'edit';
    45             $this_ad = $wpdb->get_row($wpdb->prepare("SELECT *
    46                                          FROM {$wpdb->prefix}ad_buttons
    47                                         WHERE id = %d",$ad_button));
    48             $ab_img     = $this_ad->ad_picture;
    49             $ab_link    = $this_ad->ad_link;
    50             $ab_txt     = $this_ad->ad_text;
    51             $ab_views   = $this_ad->ad_views;
    52             $ab_clicks  = $this_ad->ad_clicks;
    53             $ab_pos     = $this_ad->ad_pos;
    54             $ab_adbut   = $this_ad->id;
     34            if($ad_button_action == 'deactivate' && wp_verify_nonce( $_GET['_abnonce'], 'deactivate' )) {
     35                $ol_flash = "Ad Button $ad_button has been deactivated.";
     36                $wpdb->query($wpdb->prepare("UPDATE {$wpdb->prefix}ad_buttons
     37                                 SET ad_active = 0
     38                               WHERE id = %d",$ad_button));
     39            } elseif($ad_button_action == 'activate' && wp_verify_nonce( $_GET['_abnonce'], 'activate' )) {
     40                $ol_flash = "Ad Button $ad_button has been activated.";
     41                $wpdb->query($wpdb->prepare("UPDATE {$wpdb->prefix}ad_buttons
     42                                 SET ad_active = 1
     43                               WHERE id = %d",$ad_button));
     44            } elseif($ad_button_action == 'delete' && wp_verify_nonce( $_GET['_abnonce'], 'delete' )) {
     45                $ol_flash = "Ad Button $ad_button has been deleted.";
     46                $wpdb->query($wpdb->prepare("UPDATE {$wpdb->prefix}ad_buttons
     47                                 SET ad_active = 2
     48                               WHERE id = %d",$ad_button));
     49            } elseif($ad_button_action == 'edit' && wp_verify_nonce( $_GET['_abnonce'], 'edit' )) {
     50                $ab_formfunc= 'edit';
     51                $this_ad = $wpdb->get_row($wpdb->prepare("SELECT *
     52                                             FROM {$wpdb->prefix}ad_buttons
     53                                            WHERE id = %d",$ad_button));
     54                $ab_img     = $this_ad->ad_picture;
     55                $ab_link    = $this_ad->ad_link;
     56                $ab_txt     = $this_ad->ad_text;
     57                $ab_views   = $this_ad->ad_views;
     58                $ab_clicks  = $this_ad->ad_clicks;
     59                $ab_pos     = $this_ad->ad_pos;
     60                $ab_adbut   = $this_ad->id;
     61            }
    5562        }
    5663    }
    … …  
    6168// check if the form has been submitted and validate input
    6269if( $_SERVER['REQUEST_METHOD'] == 'POST' ){
    63     if ( ! isset( $_POST['updnonce'] ) || ! wp_verify_nonce( $_POST['updnonce'], 'update-ad' )) {
     70    if ( ! isset( $_POST['_abupd'] ) || ! wp_verify_nonce( $_POST['_abupd'], 'update-ad' )) {
    6471        print 'Sorry, your nonce did not verify.';
    6572        exit;
    … …  
    151158
    152159<p><form method="post" name="ab_form">
    153 <?php wp_nonce_field('update-ad', 'updnonce');
     160<?php wp_nonce_field('update-ad', '_abupd');
    154161$widget_adbuttons_cfg = get_option('widget_adbuttons_cfg');
    155162?>
    … …  
    218225        $ad_ctr = 0;
    219226    }
    220 /*
    221     // Sample URL, note the & in there
    222     $url = 'http://localhost/?arg1=value1&arg2=value2';
    223      
    224     // This will show http://localhost/?arg1=value1&amp;amp;arg2=value2&amp;amp;_wpnonce=abcdef
    225     echo wp_nonce_url( $url, 'action' );
    226      
    227     // This will return http://localhost/?arg1=value1&arg2=value2&_wpnonce=abcdef
    228     echo add_query_arg( '_wpnonce', wp_create_nonce( 'action' ), $url );
    229    
    230 esc_url( add_query_arg( '_abnonce', wp_create_nonce( 'action' ), $url ) )
    231 
    232 */
     227
    233228    echo  '
    234229        <tr class="active">

  • ad-buttons/trunk/adbuttonsadmin.php

    r1900232 r1901352  
    3535$ol_flash = '';
    3636
    37 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    38     if (is_numeric ($_POST['ab_dspcnt'])) {
    39         $widget_adbuttons_cfg['ab_title'] = sanitize_text_field($_POST['ab_title']);
    40         $widget_adbuttons_cfg['ab_dspcnt'] = (int)$_POST['ab_dspcnt'];
    41         $widget_adbuttons_cfg['ab_target'] = sanitize_text_field($_POST['ab_target']);
    42         $widget_adbuttons_cfg['ab_adsense'] = (bool)$_POST['ab_adsense'];
    43         $widget_adbuttons_cfg['ab_adsense_fixed'] = 1;
    44         $widget_adbuttons_cfg['ab_adsense_pos'] = (int)$_POST['ab_adsense_pos'];
    45         if($widget_adbuttons_cfg['ab_adsense_pos'] > $widget_adbuttons_cfg['ab_dspcnt']){
    46             $widget_adbuttons_cfg['ab_adsense_pos'] = $widget_adbuttons_cfg['ab_dspcnt'];
     37// check if the form has been submitted and validate input
     38if( $_SERVER['REQUEST_METHOD'] == 'POST' ){
     39    if ( ! isset( $_POST['_abupd'] ) || ! wp_verify_nonce( $_POST['_abupd'], 'update-settings' )) {
     40        print 'Sorry, your nonce did not verify.';
     41        exit;
     42    } else {
     43       // process form data
     44        if (is_numeric ($_POST['ab_dspcnt'])) {
     45            $widget_adbuttons_cfg['ab_title'] = sanitize_text_field($_POST['ab_title']);
     46            $widget_adbuttons_cfg['ab_dspcnt'] = (int)$_POST['ab_dspcnt'];
     47            $widget_adbuttons_cfg['ab_target'] = sanitize_text_field($_POST['ab_target']);
     48            $widget_adbuttons_cfg['ab_adsense'] = (bool)$_POST['ab_adsense'];
     49            $widget_adbuttons_cfg['ab_adsense_fixed'] = 1;
     50            $widget_adbuttons_cfg['ab_adsense_pos'] = (int)$_POST['ab_adsense_pos'];
     51            if($widget_adbuttons_cfg['ab_adsense_pos'] > $widget_adbuttons_cfg['ab_dspcnt']){
     52                $widget_adbuttons_cfg['ab_adsense_pos'] = $widget_adbuttons_cfg['ab_dspcnt'];
     53            }
     54            $widget_adbuttons_cfg['ab_adsense_pubid'] = sanitize_text_field($_POST['ab_adsense_pubid']);
     55            $widget_adbuttons_cfg['ab_adsense_channel'] = (int)$_POST['ab_adsense_channel'];
     56            if (preg_match('/rc:\d{1,2}/', $_POST['ab_adsense_corners']) == 1) $widget_adbuttons_cfg['ab_adsense_corners'] = $_POST['ab_adsense_corners'];
     57            $widget_adbuttons_cfg['ab_adsense_col_border'] = (int)hexdec(trim($_POST['ab_adsense_col_border'], "#"));
     58            $widget_adbuttons_cfg['ab_adsense_col_title'] = (int)hexdec(trim($_POST['ab_adsense_col_title'], "#"));
     59            $widget_adbuttons_cfg['ab_adsense_col_bg'] = (int)hexdec(trim($_POST['ab_adsense_col_bg'], "#"));
     60            $widget_adbuttons_cfg['ab_adsense_col_txt'] = (int)hexdec(trim($_POST['ab_adsense_col_txt'], "#"));
     61            $widget_adbuttons_cfg['ab_adsense_col_url'] = (int)hexdec(trim($_POST['ab_adsense_col_url'], "#"));
     62            $widget_adbuttons_cfg['ab_nocss'] = (bool)$_POST['ab_nocss'];
     63            $widget_adbuttons_cfg['ab_width'] = (int)$_POST['ab_width'];
     64            $widget_adbuttons_cfg['ab_padding'] = (int)$_POST['ab_padding'];
     65            $widget_adbuttons_cfg['ab_nofollow'] = (bool)$_POST['ab_nofollow'];
     66            $widget_adbuttons_cfg['ab_powered'] = (bool)$_POST['ab_powered'];
     67            $widget_adbuttons_cfg['ab_yah'] = (bool)$_POST['ab_yah'];
     68            $widget_adbuttons_cfg['ab_yourad'] = (bool)$_POST['ab_yourad'];
     69            $widget_adbuttons_cfg['ab_yaht'] = $_POST['ab_yaht'];
     70            $widget_adbuttons_cfg['ab_yahurl'] = $_POST['ab_yahurl'];   
     71            $widget_adbuttons_cfg['ab_fix'] = (bool)$_POST['ab_fix'];
     72            $widget_adbuttons_cfg['ab_count'] = (int)$_POST['ab_count'];                   
     73            update_option('widget_adbuttons_cfg',$widget_adbuttons_cfg);
     74            $ol_flash = "Your settings have been saved.";
     75        } else {
     76            $ab_num_err = 1;
    4777        }
    48         $widget_adbuttons_cfg['ab_adsense_pubid'] = sanitize_text_field($_POST['ab_adsense_pubid']);
    49         $widget_adbuttons_cfg['ab_adsense_channel'] = (int)$_POST['ab_adsense_channel'];
    50         if (preg_match('/rc:\d{1,2}/', $_POST['ab_adsense_corners']) == 1) $widget_adbuttons_cfg['ab_adsense_corners'] = $_POST['ab_adsense_corners'];
    51         $widget_adbuttons_cfg['ab_adsense_col_border'] = (int)hexdec(trim($_POST['ab_adsense_col_border'], "#"));
    52         $widget_adbuttons_cfg['ab_adsense_col_title'] = (int)hexdec(trim($_POST['ab_adsense_col_title'], "#"));
    53         $widget_adbuttons_cfg['ab_adsense_col_bg'] = (int)hexdec(trim($_POST['ab_adsense_col_bg'], "#"));
    54         $widget_adbuttons_cfg['ab_adsense_col_txt'] = (int)hexdec(trim($_POST['ab_adsense_col_txt'], "#"));
    55         $widget_adbuttons_cfg['ab_adsense_col_url'] = (int)hexdec(trim($_POST['ab_adsense_col_url'], "#"));
    56         $widget_adbuttons_cfg['ab_nocss'] = (bool)$_POST['ab_nocss'];
    57         $widget_adbuttons_cfg['ab_width'] = (int)$_POST['ab_width'];
    58         $widget_adbuttons_cfg['ab_padding'] = (int)$_POST['ab_padding'];
    59         $widget_adbuttons_cfg['ab_nofollow'] = (bool)$_POST['ab_nofollow'];
    60         $widget_adbuttons_cfg['ab_powered'] = (bool)$_POST['ab_powered'];
    61         $widget_adbuttons_cfg['ab_yah'] = (bool)$_POST['ab_yah'];
    62         $widget_adbuttons_cfg['ab_yourad'] = (bool)$_POST['ab_yourad'];
    63         $widget_adbuttons_cfg['ab_yaht'] = $_POST['ab_yaht'];
    64         $widget_adbuttons_cfg['ab_yahurl'] = $_POST['ab_yahurl'];   
    65         $widget_adbuttons_cfg['ab_fix'] = (bool)$_POST['ab_fix'];
    66         $widget_adbuttons_cfg['ab_count'] = (int)$_POST['ab_count'];                   
    67         update_option('widget_adbuttons_cfg',$widget_adbuttons_cfg);
    68         $ol_flash = "Your settings have been saved.";
    69     } else {
    70         $ab_num_err = 1;
    7178    }
    7279}
    … …  
    7784<h2>Ad Buttons Settings </h2>
    7885
    79 
    80 <?php wp_nonce_field('update-options');
     86<?php
    8187$widget_adbuttons_cfg = get_option('widget_adbuttons_cfg');
    8288$ab_plugindir = get_option('siteurl').'/'.PLUGINDIR.'/'.dirname(plugin_basename(__FILE__));
    … …  
    841847
    842848<form method="post">
     849<?php wp_nonce_field( 'update-settings', '_abupd' ); ?>
    843850<table class="form-table">
    844851<tr>
    … …  
    11381145    $count = $count + 1;
    11391146}
     1147
    11401148if($widget_adbuttons_cfg['ab_adsense']){
    11411149    if($widget_adbuttons_cfg['ab_adsense_pos']==$count){
    … …  
    11601168    }
    11611169}
    1162 
    11631170    ?>
    11641171    <div id="ab_clear"></div>

  • ad-buttons/trunk/adbuttonsstats.php

    r1900232 r1901352  
    55$ab_plugindir = get_option('siteurl').'/'.PLUGINDIR.'/'.dirname(plugin_basename(__FILE__));
    66
    7 $graphdate = intval($_GET['month']);
    8 $cleanup   = intval($_GET['cln']);
     7if(isset($_GET['month'])){
     8    $graphdate = intval($_GET['month']);
     9} else {
     10    $graphdate = date('Ym');
     11}
    912
    10 if(!$graphdate){
    11     $graphdate = date('Ym');
     13if(isset($_GET['cln'])){
     14    $cleanup   = intval($_GET['cln']);
     15} else {
     16    $cleanup   = 0;
    1217}
    1318
    … …  
    5257<?php
    5358if ($cleanup === 1) {
     59   
    5460    echo "cleaning up stats database...</br>";
    5561    // CLEANUP PROCEDURE

  • ad-buttons/trunk/adbuttonsstatsimg.php

    r1900232 r1901352  
    55$ab_plugindir = get_option('siteurl').'/'.PLUGINDIR.'/'.dirname(plugin_basename(__FILE__));
    66
    7 $graphdate = intval($_GET['graphdate']);
     7if(isset($_GET['graphdate'])){
     8    $graphdate = intval($_GET['graphdate']);
     9} else {
     10    $graphdate = date('Ym');
     11}
    812$graphyear = substr($graphdate, 0, 4);
    913$graphmonth = substr($graphdate, 4, 2);
    1014$checkdate = "$graphyear-$graphmonth-";
    1115$stringmonth = date("F", mktime(0, 0, 0, ($graphmonth), 1));
    12 
    1316
    1417function monthdays($someMonth, $someYear){
    … …  
    4346
    4447$days = monthdays($graphmonth,$graphyear);
     48
     49// initialize max variables
     50$max_view = 0;
     51$max_clicks = 0;
    4552
    4653foreach($view_counter as $view){               
    … …  
    240247        $click_scale = 200 / $max_clicks;
    241248        $r_y = 240 - ($click_scale * $stat_values[$statdays[$count]]['clicks']);
    242         $r_y2 = 240 - ($click_scale * $stat_values[$statdays[$count + 1]]['clicks']);
    243249        if ($count<$days){
     250            $r_y2 = 240 - ($click_scale * $stat_values[$statdays[$count + 1]]['clicks']);
    244251            // make a new line and add it to the image
    245252            imageline($im, $r_x, $r_y, $r_x + 20, $r_y2, $darkgrey);

  • ad-buttons/trunk/readme.txt

    r1900232 r1901352  
    55Requires at least: 2.8.0
    66Tested up to: 4.9
    7 Stable tag: 2.3.2
     7Stable tag: 3.0
    88
    99The Ad Buttons plugin displays a number of graphical ads in a sidebar widget.
    … …  
    3636
    3737= 3.0 =
    38 * 27-06-2018
     38* 29-06-2018
    3939* complete overhaul to make the plugin more secure
    4040
Note: See TracChangeset for help on using the changeset viewer.