WordPress.org
Get WordPress

Plugin Directory

Changeset 2591285


Ignore:
Timestamp:
08/31/2021 07:54:46 AM (4 years ago)
Author:
msh134
Message:

Fixed security issues, compatibility checked

Location:
wp-reroute-email/trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • wp-reroute-email/trunk/db_log.php

    r2226063 r2591285  
    1616        <table class="message-table">
    1717            <tr>
    18                 <th><?php _e('Sent On', 'wp_reroute_email'); ?>:</th>
    19                 <td><?php echo get_date_from_gmt( $item->sent_on, 'j F, Y H:i:s' ); ?></td>
     18                <th><?php esc_html_e('Sent On', 'wp_reroute_email'); ?>:</th>
     19                <td><?php esc_html_e(get_date_from_gmt( $item->sent_on, 'j F, Y H:i:s' )); ?></td>
    2020            </tr>
    2121            <tr>
    22                 <th><?php _e('To', 'wp_reroute_email'); ?>:</th>
    23                 <td><?php echo $item->recipients_to; ?></td>
     22                <th><?php esc_html_e('To', 'wp_reroute_email'); ?>:</th>
     23                <td><?php esc_html_e($item->recipients_to); ?></td>
    2424            </tr>
    2525            <tr>
    26                 <th><?php _e('CC', 'wp_reroute_email'); ?>:</th>
    27                 <td><?php echo $item->recipients_cc; ?></td>
     26                <th><?php esc_html_e('CC', 'wp_reroute_email'); ?>:</th>
     27                <td><?php esc_html_e($item->recipients_cc); ?></td>
    2828            </tr>
    2929            <tr>
    30                 <th><?php _e('BCC', 'wp_reroute_email'); ?>:</th>
    31                 <td><?php echo $item->recipients_bcc; ?></td>
     30                <th><?php esc_html_e('BCC', 'wp_reroute_email'); ?>:</th>
     31                <td><?php esc_html_e($item->recipients_bcc); ?></td>
    3232            </tr>
    3333            <tr>
    34                 <th><?php _e('Subject', 'wp_reroute_email'); ?>:</th>
    35                 <td><?php echo $item->subject; ?></td>
     34                <th><?php esc_html_e('Subject', 'wp_reroute_email'); ?>:</th>
     35                <td><?php esc_html_e($item->subject); ?></td>
    3636            </tr>
    3737            <tr>
    3838                <td>&nbsp;</td>
    39                 <td><a href="javascript:;" id="view-original" class="orgview"><?php _e('View Original Message', 'wp_reroute_email');?></a></td>
     39                <td><a href="javascript:;" id="view-original" class="orgview"><?php esc_html_e('View Original Message', 'wp_reroute_email');?></a></td>
    4040            </tr>
    4141            <tr>
    … …  
    4444                    <?php
    4545                        $is_only_html = preg_match("/<[^<]+>/",  $item->message, $m) != 0;
    46                         echo $is_only_html ? $item->message : nl2br($item->message);
     46                        echo $is_only_html ? wp_kses_post($item->message) : nl2br($item->message);
    4747                    ?>
    4848                    </div>   

  • wp-reroute-email/trunk/includes/db_log_list.class.php

    r2226063 r2591285  
    2424    function column_subject($item){
    2525        $actions = array(
    26             'view'      => sprintf('<a href="?page=%s&tab=details&action=%s&logid=%s">' . __('View Message', 'wp_reroute_email') . '</a>',$_REQUEST['page'],'view',$item->id)
     26            'view'      => sprintf('<a href="?page=%s&tab=details&action=%s&logid=%s">' . esc_attr__('View Message', 'wp_reroute_email') . '</a>',$_REQUEST['page'],'view',$item->id)
    2727        );
    2828
    … …  
    3434   
    3535    function column_sent_on($item){
    36         return get_date_from_gmt( $item->sent_on, 'j F, Y H:i:s' );
     36        return get_date_from_gmt($item->sent_on, 'j F, Y H:i:s');
    3737    }
    3838
    … …  
    4040        $columns = array(
    4141            'id' => 'ID',
    42             'subject'     => __('Subject', 'wp_reroute_email'),
    43             'recipients_to'    => __('Sent To', 'wp_reroute_email'),
    44             'sent_on'  => __('Sent On', 'wp_reroute_email')
     42            'subject'     => esc_attr__('Subject', 'wp_reroute_email'),
     43            'recipients_to'    => esc_attr__('Sent To', 'wp_reroute_email'),
     44            'sent_on'  => esc_attr__('Sent On', 'wp_reroute_email')
    4545        );
    4646
    … …  
    5858    function get_bulk_actions() {
    5959        $actions = array(
    60             'delete_all_messages'    => __('Delete All Messages', 'wp_reroute_email')
     60            'delete_all_messages'    => esc_attr__('Delete All Messages', 'wp_reroute_email')
    6161        );
    6262

  • wp-reroute-email/trunk/readme.txt

    r2476281 r2591285  
    33Tags: mail, email, developer tool, development server
    44Tested up to: 5.6.1
    5 Stable tag: 1.4.5
     5Stable tag: 1.4.6
    66License: GPLv2 or later
    77
    … …  
    3333
    3434== Changelog ==
     35= 1.4.6 =
     36* Security fixes.
     37* Compatibility check.
     38
    3539= 1.4.5 =
    3640* Added options to disable rerouting based on email subjects.

  • wp-reroute-email/trunk/settings.php

    r2476281 r2591285  
    1818
    1919        if($enable && !$email){
    20             print '<div id="message" class="error fade"><p>'. __('Enter at least one email address.', 'wp_reroute_email') . '</p></div>';
     20            print '<div id="message" class="error fade"><p>'. esc_html__('Enter at least one email address.', 'wp_reroute_email') . '</p></div>';
    2121            $error = true;
    2222        }
    … …  
    3030            update_option('wp_reroute_email_db_log_option', $db_log_option);
    3131            update_option('wp_reroute_email_ignored_subjects', $ignored_subjects);
    32             print '<div id="message" class="updated fade"><p>'. __('Settings saved.', 'wp_reroute_email') . '</p></div>';
     32            print '<div id="message" class="updated fade"><p>'. esc_html__('Settings saved.', 'wp_reroute_email') . '</p></div>';
    3333        }
    3434    }
    … …  
    4747    <h2>WP Reroute Email</h2>
    4848    <h2 class="nav-tab-wrapper">
    49         <a href="?page=wp-reroute-email%2Fsettings.php" class="nav-tab <?php echo empty($tab) ? 'nav-tab-active' : ''; ?>"><?php _e('Settings', 'wp_reroute_email'); ?></a>
    50         <a href="?page=wp-reroute-email%2Fsettings.php&tab=log" class="nav-tab <?php echo $tab ==  'log' ? 'nav-tab-active' : ''; ?>"><?php _e('Logs', 'wp_reroute_email'); ?></a>
    51         <a href="?page=wp-reroute-email%2Fsettings.php&tab=test" class="nav-tab <?php echo $tab ==  'test' ? 'nav-tab-active' : ''; ?>"><?php _e('Test', 'wp_reroute_email'); ?></a>
     49        <a href="?page=wp-reroute-email%2Fsettings.php" class="nav-tab <?php esc_attr_e(empty($tab) ? 'nav-tab-active' : ''); ?>"><?php esc_html_e('Settings', 'wp_reroute_email'); ?></a>
     50        <a href="?page=wp-reroute-email%2Fsettings.php&tab=log" class="nav-tab <?php esc_attr_e($tab ==  'log' ? 'nav-tab-active' : ''); ?>"><?php esc_html_e('Logs', 'wp_reroute_email'); ?></a>
     51        <a href="?page=wp-reroute-email%2Fsettings.php&tab=test" class="nav-tab <?php esc_attr_e($tab ==  'test' ? 'nav-tab-active' : ''); ?>"><?php esc_html_e('Test', 'wp_reroute_email'); ?></a>
    5252        <?php if($tab == 'details'): ?>
    53         <a href="javascript:;" class="nav-tab <?php echo $tab ==  'details' ? 'nav-tab-active' : ''; ?>"><?php _e('Message Details', 'wp_reroute_email'); ?></a>
     53        <a href="javascript:;" class="nav-tab <?php esc_attr_e($tab ==  'details' ? 'nav-tab-active' : ''); ?>"><?php esc_html_e('Message Details', 'wp_reroute_email'); ?></a>
    5454        <?php endif; ?>
    5555    </h2>
    … …  
    6060            <tbody>
    6161                <tr>
    62                     <th scope="row"><?php  _e('Enable rerouting', 'wp_reroute_email'); ?></th>
     62                    <th scope="row"><?php  esc_html_e('Enable rerouting', 'wp_reroute_email'); ?></th>
    6363                    <td>
    64                         <input type="checkbox" <?php print $enable ? 'checked="checked"' : ''; ?> value="1" name="enable_reroute" id="enable_reroute">
     64                        <input type="checkbox" <?php esc_attr_e($enable ? 'checked="checked"' : ''); ?> value="1" name="enable_reroute" id="enable_reroute">
    6565                    </td>
    6666                </tr>
    … …  
    7171                <tbody>
    7272                    <tr>
    73                         <th scope="row"><?php  _e('Email address', 'wp_reroute_email'); ?></th>
     73                        <th scope="row"><?php  esc_html_e('Email address', 'wp_reroute_email'); ?></th>
    7474                        <td>
    75                             <input type="text" name="email_address" size="60" value="<?php print $email; ?>">
    76                             <br><span class="description"><?php  _e('Provide a comma-delimited list of email addresses to pass through.', 'wp_reroute_email'); ?></span>
     75                            <input type="text" name="email_address" size="60" value="<?php esc_attr_e($email); ?>">
     76                            <br><span class="description"><?php esc_html_e('Provide a comma-delimited list of email addresses to pass through.', 'wp_reroute_email'); ?></span>
    7777                        </td>
    7878                    </tr>
    7979                    <tr>
    80                         <th scope="row"><?php  _e('Append text', 'wp_reroute_email'); ?></th>
     80                        <th scope="row"><?php  esc_html_e('Append text', 'wp_reroute_email'); ?></th>
    8181                        <td>
    82                             <input type="text" name="append_msg" size="60" value="<?php print $append_msg; ?>">
    83                             <br><span class="description"><?php  _e('This text will be appended with the mail body. Leave it blank if you do not want to append anything.', 'wp_reroute_email'); ?></span>
     82                            <input type="text" name="append_msg" size="60" value="<?php esc_attr_e($append_msg); ?>">
     83                            <br><span class="description"><?php esc_html_e('This text will be appended with the mail body. Leave it blank if you do not want to append anything.', 'wp_reroute_email'); ?></span>
    8484                        </td>
    8585                    </tr>
    8686                    <tr>
    87                         <th scope="row"><?php  _e('Append recipient email addresses', 'wp_reroute_email'); ?></th>
     87                        <th scope="row"><?php  esc_html_e('Append recipient email addresses', 'wp_reroute_email'); ?></th>
    8888                        <td>
    89                             <input type="checkbox" <?php print $append_recipient ? 'checked="checked"' : ''; ?> value="1" name="append_recipient" id="append_recipient">
    90                             <br><span class="description"><?php  _e('Enable this if you want to append recipient email addresses at the bottom of the email.', 'wp_reroute_email'); ?></span>
     89                            <input type="checkbox" <?php esc_attr_e($append_recipient ? 'checked="checked"' : ''); ?> value="1" name="append_recipient" id="append_recipient">
     90                            <br><span class="description"><?php  esc_html_e('Enable this if you want to append recipient email addresses at the bottom of the email.', 'wp_reroute_email'); ?></span>
    9191                        </td>
    9292                    </tr>
    9393                    <tr>
    94                         <th scope="row"><?php  _e('Log emails in DB', 'wp_reroute_email'); ?></th>
     94                        <th scope="row"><?php  esc_html_e('Log emails in DB', 'wp_reroute_email'); ?></th>
    9595                        <td>
    96                             <input type="checkbox" <?php print $enable_db_log ? 'checked="checked"' : ''; ?> name="enable_db_log" id="enable_db_log" value="1">
    97                             <br><span class="description"><?php  _e('Enable this if you want to store a copy of the email in database. You may also skip email sending and store email only to database.', 'wp_reroute_email'); ?></span>
     96                            <input type="checkbox" <?php esc_attr_e($enable_db_log ? 'checked="checked"' : ''); ?> name="enable_db_log" id="enable_db_log" value="1">
     97                            <br><span class="description"><?php esc_html_e('Enable this if you want to store a copy of the email in database. You may also skip email sending and store email only to database.', 'wp_reroute_email'); ?></span>
    9898                            <div class="log-email-options">
    99                                 <strong><?php  _e('Select an option', 'wp_reroute_email'); ?></strong><br>
    100                                 <input type="radio" <?php print $db_log_option == 1 ? 'checked="checked"' : ''; ?> name="enable_db_log_option" id="enable_db_log_option_1" value="1"> <label for="enable_db_log_option_1"><?php  _e('Store a copy of email in database and send email', 'wp_reroute_email'); ?></label><br>
    101                                 <input type="radio" <?php print $db_log_option == 2 ? 'checked="checked"' : ''; ?> name="enable_db_log_option" id="enable_db_log_option_2" value="2"> <label for="enable_db_log_option_2"><?php  _e('Store a copy of email in database and do not send email', 'wp_reroute_email'); ?></label>
     99                                <strong><?php esc_html_e('Select an option', 'wp_reroute_email'); ?></strong><br>
     100                                <input type="radio" <?php esc_attr_e($db_log_option == 1 ? 'checked="checked"' : ''); ?> name="enable_db_log_option" id="enable_db_log_option_1" value="1"> <label for="enable_db_log_option_1"><?php  esc_html_e('Store a copy of email in database and send email', 'wp_reroute_email'); ?></label><br>
     101                                <input type="radio" <?php esc_attr_e($db_log_option == 2 ? 'checked="checked"' : ''); ?> name="enable_db_log_option" id="enable_db_log_option_2" value="2"> <label for="enable_db_log_option_2"><?php  esc_html_e('Store a copy of email in database and do not send email', 'wp_reroute_email'); ?></label>
    102102                            </div>
    103103                        </td>
    104104                    </tr>
    105105                    <tr>
    106                         <th scope="row"><?php  _e('Ignore emails containing these texts in subjects', 'wp_reroute_email'); ?></th>
     106                        <th scope="row"><?php  esc_html_e('Ignore emails containing these texts in subjects', 'wp_reroute_email'); ?></th>
    107107                        <td>
    108                             <textarea name="ignored_subjects" id="ignored_subjects" rows="8" cols="100"><?php echo $ignored_subjects; ?></textarea>
    109                             <br><span class="description"><?php  _e('Provide a comma, semicolon, or newline-delimited list of message subjects or part of the subjects to be ignored when rerouting.', 'wp_reroute_email'); ?></span>
     108                            <textarea name="ignored_subjects" id="ignored_subjects" rows="8" cols="100"><?php esc_attr_e($ignored_subjects); ?></textarea>
     109                            <br><span class="description"><?php esc_html_e('Provide a comma, semicolon, or newline-delimited list of message subjects or part of the subjects to be ignored when rerouting.', 'wp_reroute_email'); ?></span>
    110110                        </td>
    111111                    </tr>
    … …  
    113113            </table>
    114114        </div>
    115         <p class="submit"><input type="submit" value="<?php  _e('Save Changes', 'wp_reroute_email'); ?>"></p>
     115        <p class="submit"><input type="submit" value="<?php esc_html_e('Save Changes', 'wp_reroute_email'); ?>" class="button blue"></p>
    116116    </form>
    117117    <?php elseif($tab == 'log' || $tab == 'details'): ?>

  • wp-reroute-email/trunk/test.php

    r2226063 r2591285  
    55   
    66    if($_SERVER['REQUEST_METHOD'] == 'POST' && $tab == 'test'){
    7         $to = filter_input(INPUT_POST, 'to_email');
    8         $subject = filter_input(INPUT_POST, 'subject');
    9         $message = filter_input(INPUT_POST, 'message');
     7        $to = sanitize_text_field(filter_input(INPUT_POST, 'to_email'));
     8        $subject = sanitize_text_field(filter_input(INPUT_POST, 'subject'));
     9        $message = sanitize_textarea_field(filter_input(INPUT_POST, 'message'));
    1010       
    1111        if($to && $subject && $message){
    1212            wp_mail($to, $subject, $message);
    13             print '<div id="message" class="updated fade"><p>'. __('Email sent.', 'wp_reroute_email') . '</p></div>';
     13            print '<div id="message" class="updated fade"><p>'. esc_html__('Email sent.', 'wp_reroute_email') . '</p></div>';
    1414        }
    1515    }
    1616?>   
    17 <p><?php _e('You may test your settings by sending an email using this form.', 'wp_reroute_email');?></p>   
     17<p><?php esc_html_e('You may test your settings by sending an email using this form.', 'wp_reroute_email');?></p>   
    1818<form action="" method="POST">
    1919    <table class="form-table">
    2020        <tbody>
    2121            <tr>
    22                 <th scope="row"><?php  _e('To', 'wp_reroute_email'); ?></th>
     22                <th scope="row"><?php  esc_html_e('To', 'wp_reroute_email'); ?></th>
    2323                <td><input type="email" name="to_email" size="60" value="[email protected]"></td>
    2424            </tr>
    2525            <tr>
    26                 <th scope="row"><?php  _e('Subject', 'wp_reroute_email'); ?></th>
     26                <th scope="row"><?php  esc_html_e('Subject', 'wp_reroute_email'); ?></th>
    2727                <td><input type="text" name="subject" size="60" value="WP Reroute Email Test Message"></td>
    2828            </tr>
    2929            <tr>
    30                 <th scope="row"><?php  _e('Message', 'wp_reroute_email'); ?></th>
     30                <th scope="row"><?php  esc_html_e('Message', 'wp_reroute_email'); ?></th>
    3131                <td><textarea name="message" rows="5" cols="70">This is a test message from WP Reroute Email.</textarea></td>
    3232            </tr>
    3333            <tr>
    34                 <td colspan="2"><input type="submit" value=" <?php _e('Send', 'wp_reroute_email'); ?> "></td>
     34                <td colspan="2"><input type="submit" value=" <?php esc_attr_e('Send', 'wp_reroute_email'); ?> " class="button blue"></td>
    3535            </tr>
    3636        </tbody>

  • wp-reroute-email/trunk/wp-reroute-email.php

    r2476281 r2591285  
    44 * Plugin URI: http://wordpress.org/extend/plugins/wp-reroute-email/
    55 * Description: This plugin intercepts all outgoing emails from a WordPress site and reroutes them to a predefined configurable email address.
    6  * Version: 1.4.5
     6 * Version: 1.4.6
    77 * Author: Sajjad Hossain
    88 * Author URI: http://www.sajjadhossain.com
    … …  
    188188
    189189        if ($file == $this->plugin_name) {
    190             $settings_link = '<a href="admin.php?page=wp-reroute-email/settings.php">' . __('Settings', 'wp_reroute_email') . '</a>';
     190            $settings_link = '<a href="admin.php?page=wp-reroute-email/settings.php">' . esc_html__('Settings', 'wp_reroute_email') . '</a>';
    191191            array_unshift($links, $settings_link);
    192192        }
    … …  
    278278
    279279    private function ignore_send($subject){
    280        
    281 
    282280        return false;
    283281    }
    … …  
    290288               
    291289                if($db_log_option == 1){
    292                     $extra = __('All emails will be stored in database after sending.', 'wp_reroute_email');
     290                    $extra = esc_html__('All emails will be stored in database after sending.', 'wp_reroute_email');
    293291                }
    294292                else{
    295                     $extra = __('Emails will only be stored in database and no email will be sent.', 'wp_reroute_email');
     293                    $extra = esc_html__('Emails will only be stored in database and no email will be sent.', 'wp_reroute_email');
    296294                }
    297295            }
    298296            else if(get_option('wp_reroute_email_address')){
    299                 $extra = sprintf(__('All emails from the site will be sent to <strong>%1$s</strong>', 'wp_reroute_email'), get_option('wp_reroute_email_address'));
     297                $extra = sprintf(esc_html__('All emails from the site will be sent to <strong>%1$s</strong>', 'wp_reroute_email'), get_option('wp_reroute_email_address'));
    300298            }
    301299           
    302300            $admin_url = admin_url();
    303301            echo '<div class="error"> <p>'
    304                 . sprintf(__('This site has %1$sWP Reroute Email%2$s enabled.', 'wp_reroute_email'), '<strong>', '</strong>')
     302                . sprintf(esc_html__('This site has %1$sWP Reroute Email%2$s enabled.', 'wp_reroute_email'), '<strong>', '</strong>')
    305303                . ($extra ? ' ' . $extra . ' ' : '')
    306                 . sprintf(__('To change settings go %1$shere%2$s.', 'wp_reroute_email'), '<a href="' . $admin_url . 'admin.php?page=wp-reroute-email%2Fsettings.php">', '</a>')
     304                . sprintf(esc_html__('To change settings go %1$shere%2$s.', 'wp_reroute_email'), '<a href="' . $admin_url . 'admin.php?page=wp-reroute-email%2Fsettings.php">', '</a>')
    307305                    . '</p></div>';
    308306        }
Note: See TracChangeset for help on using the changeset viewer.