Changeset 2664933

Timestamp:

01/25/2022 08:05:16 PM (3 years ago)

Author:

StatCounter

Message:

Added additional sanitation to prevent XSS attacks

Location:

official-statcounter-plugin-for-wordpress/trunk

Files:

• StatCounter-Wordpress-Plugin.php (modified) (4 diffs)
• readme.txt (modified) (3 diffs)

official-statcounter-plugin-for-wordpress/trunk/StatCounter-Wordpress-Plugin.php

@@ -2 +2 @@
 /*
  * Plugin Name: Official StatCounter Plugin
- * Version: 2.0.6
+ * Version: 2.0.7
  * Plugin URI: http://statcounter.com/
  * Description: Adds the StatCounter tracking code to your blog. <br>To get setup: 1) Activate this plugin  2) Enter your StatCounter Project ID and Security Code in the <a href="options-general.php?page=StatCounter-Wordpress-Plugin.php"><strong>options page</strong></a>.
@@ -74 +74 @@
 
         // Update the Project ID
-        $sc_project = trim($_POST[key_sc_project]);
-        if ($sc_project == '') {
-            $sc_project = sc_project_default;
-        }
-        update_option(key_sc_project, $sc_project);
+        $sc_project = sanitize_text_field(trim($_POST[key_sc_project]));
+        if (ctype_digit($sc_project) == 0) { 
+            echo "<script>alert('Project ID should be numbers only')</script>"; 
+        } else {
+            if ($sc_project == '') {
+                $sc_project = sc_project_default;
+            }
+            if (strlen($sc_project) > 16) {
+                echo "<script>alert('Project ID is invalid')</script>";
+            } else {
+                update_option(key_sc_project, $sc_project);
+            }
+        }
 
         // Update the Security ID
-        $sc_security = trim($_POST[key_sc_security]);
-        if ($sc_security =='') {
-            $sc_security = sc_security_default;
-        }
-        update_option(key_sc_security, $sc_security);
+        $sc_security = sanitize_text_field(trim($_POST[key_sc_security]));
+        $sc_security = str_replace('"', '', $sc_security);
+        $sc_security = stripslashes($sc_security);
+        if (ctype_alnum(trim($sc_security, '"')) == 0) {
+            echo "<script>alert('Security code should be numbers and letters only')</script>"; 
+        } else {
+            if ($sc_security =='') {
+                $sc_security = sc_security_default;
+            }
+            if (strlen($sc_security) > 16) {
+                echo "<script>alert('Security code is invalid')</script>"; 
+            } else {
+                update_option(key_sc_security, $sc_security);
+            }
+        }
 
         // Update the position
@@ -227 +245 @@
         <script>
             <!--
-            var sc_project=<?php echo $sc_project; ?>;
-            var sc_security="<?php echo $sc_security; ?>";
+            var sc_project=<?php echo esc_html($sc_project); ?>;
+            var sc_security="<?php echo esc_html($sc_security); ?>";
             <?php
             if($sc_invisible==1) {
@@ -259 +277 @@
             }
         }?>
-        <noscript><div class="statcounter"><a title="web analytics" href="<?php echo $protocol; ?>//statcounter.com/"><img class="statcounter" src="<?php echo $protocol; ?>//c.statcounter.com/<?php echo $sc_project; ?>/0/<?php echo $sc_security; ?>/<?php echo $sc_invisible; ?>/" alt="web analytics" /></a></div></noscript>
+        <noscript><div class="statcounter"><a title="web analytics" href="<?php echo $protocol; ?>//statcounter.com/"><img class="statcounter" src="<?php echo $protocol; ?>//c.statcounter.com/<?php echo esc_html($sc_project); ?>/0/<?php echo $sc_security; ?>/<?php echo $sc_invisible; ?>/" alt="web analytics" /></a></div></noscript>
         <!-- End of StatCounter Code -->
         <?php

official-statcounter-plugin-for-wordpress/trunk/readme.txt

@@ -4 +4 @@
 Tags: web, statistics, stats, hit, counter, visitor, ip, tracker, analytics
 Requires at least: 2.0.2
-Tested up to: 5.7
-Stable tag: 2.0.6
+Tested up to: 5.8.3
+Stable tag: 2.0.7
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -70 +70 @@
 
 == Changelog ==
+= 2.0.7 =
+Added additional sanitation to prevent XSS attacks
+
 = 2.0.6 =
 Readme fix
@@ -142 +145 @@
 == Upgrade Notice ==
 
+= 2.0.7 =
+Added additional sanitation to prevent XSS attacks
+
 = 1.6.9 =
 Fixed small bug with form