Changeset 2615120

Timestamp:

10/16/2021 01:46:50 PM (4 years ago)

Author:

funnycat

Message:

fix XSS vulnerability

Location:

wp-sitemap-page/trunk

Files:

• readme.txt (modified) (2 diffs)
• settings.php (modified) (1 diff)
• wp-sitemap-page.php (modified) (2 diffs)

wp-sitemap-page/trunk/readme.txt

@@ -1 +1 @@
 === WP Sitemap Page ===
 Contributors: funnycat
-Donate link: http://www.infowebmaster.fr/dons.php
+Donate link: https://www.infowebmaster.fr/dons.php
 Tags: sitemap, generator, page list, site map, html sitemap, sitemap generator, dynamic sitemap, seo
 Requires at least: 3.0
-Tested up to: 5.6.2
-Stable tag: 1.6.4
+Tested up to: 5.8.1
+Stable tag: 1.6.5
 License: GPLv2 or later
 
@@ -102 +102 @@
 == Changelog ==
 
+= 1.6.5
+* fix vulnaribility issue (XSS)
 = 1.6.3 and 1.6.4 =
 * compatibility to PHP 8

wp-sitemap-page/trunk/settings.php

@@ -149 +149 @@
                             $textarea = $wsp_posts_by_category;
                         }
+                        
+                        // fix an XSS issue by removing every HTML tag except the <a>
+                        $textarea = strip_tags($textarea, '<a><strong><b><em><i>');
                         ?>
                         <textarea name="wsp_posts_by_category" id="wsp_posts_by_category" 

wp-sitemap-page/trunk/wp-sitemap-page.php

@@ -4 +4 @@
 Plugin URI: http://tonyarchambeau.com/
 Description: Add a sitemap on any page/post using the simple shortcode [wp_sitemap_page]
-Version: 1.6.4
+Version: 1.6.5
 Author: Tony Archambeau
 Author URI: http://tonyarchambeau.com/
@@ -1221 +1221 @@
         add_option( 'wsp_posts_by_category', $wsp_posts_by_category );
     }
+    // fix an XSS issue by removing every HTML tag except the <a>
+    $wsp_posts_by_category = strip_tags($wsp_posts_by_category, '<a><strong><b><em><i>');
     
     // list the posts