Changeset 2681715
- Timestamp:
- 02/19/2022 09:15:03 AM (4 years ago)
- Location:
- books-papers
- Files:
-
- 36 added
- 2 edited
-
tags/0.20210223 (added)
-
tags/0.20210223/README.md (added)
-
tags/0.20210223/books-n-papers.php (added)
-
tags/0.20210223/classes (added)
-
tags/0.20210223/classes/.gitkeep (added)
-
tags/0.20210223/classes/article.php (added)
-
tags/0.20210223/classes/author.php (added)
-
tags/0.20210223/classes/book.php (added)
-
tags/0.20210223/classes/bridge.php (added)
-
tags/0.20210223/classes/conference.php (added)
-
tags/0.20210223/classes/functions (added)
-
tags/0.20210223/classes/functions/bridge-replace_pub_updated.php (added)
-
tags/0.20210223/classes/functions/bridge-replace_publications.php (added)
-
tags/0.20210223/classes/item.php (added)
-
tags/0.20210223/js (added)
-
tags/0.20210223/js/.gitkeep (added)
-
tags/0.20210223/js/append.js (added)
-
tags/0.20210223/js/appendPapers.js (added)
-
tags/0.20210223/js/authorSelection.js (added)
-
tags/0.20210223/js/authorSelectionPaper.js (added)
-
tags/0.20210223/js/help.js (added)
-
tags/0.20210223/js/readFile.js (added)
-
tags/0.20210223/js/stickyScroll.js (added)
-
tags/0.20210223/js/typeSelect.js (added)
-
tags/0.20210223/pages (added)
-
tags/0.20210223/pages/.gitkeep (added)
-
tags/0.20210223/pages/add-author-page.php (added)
-
tags/0.20210223/pages/add-paper-page.php (added)
-
tags/0.20210223/pages/import-data-page.php (added)
-
tags/0.20210223/pages/loadAnimation.php (added)
-
tags/0.20210223/pages/manage-author-page.php (added)
-
tags/0.20210223/pages/manage-papers-page.php (added)
-
tags/0.20210223/pages/settings-page.php (added)
-
tags/0.20210223/pages/style.css (added)
-
tags/0.20210223/pages/title-page.php (added)
-
tags/0.20210223/readme.txt (added)
-
trunk/books-n-papers.php (modified) (39 diffs)
-
trunk/readme.txt (modified) (3 diffs)
Legend:
- Unmodified
- Added
- Removed
-
books-papers/trunk/books-n-papers.php
r2479969 r2681715 3 3 Plugin Name: Books & Papers 4 4 Plugin URI: 5 Version: 0.202 102235 Version: 0.20220219 6 6 Author: Research in Theory of Magnetism Department of Taras Shevchenko National University of Kyiv 7 7 Author_URI: http://ritm.knu.ua/ … … 115 115 { 116 116 include(bnpp_plugin_dir . "./pages/add-author-page.php"); 117 if(isset($_POST['firstName'])&&isset($_POST['lastName'])&& check_admin_referer('bnp_add_author') && current_user_can('publish_pages') ) //checks vital inputs for author creation117 if(isset($_POST['firstName'])&&isset($_POST['lastName'])&& check_admin_referer('bnp_add_author') && current_user_can('publish_pages') && !preg_match("/[\"'*?<>|]$/", $_POST["firstName"]) && !preg_match("/[\"'*?<>|]$/", $_POST["lastName"])) //checks vital inputs for author creation 118 118 { 119 119 $author = new BNPP_Author($this->dbAuthors); //creates author object and fills data fields 120 120 $author->firstName = sanitize_text_field($_POST['firstName']); 121 121 $author->lastName = sanitize_text_field($_POST['lastName']); 122 $author->email = sanitize_email($_POST['email']); 123 $author->personalUrl = sanitize_text_field($_POST['url']); 124 $author->slug = sanitize_text_field($_POST['slug']); 122 if(!preg_match("/[\"'*?<>|]$/", $_POST["email"])){ 123 $author->email = sanitize_email($_POST['email']); 124 } 125 if(!preg_match("/[\"'*?<>|]$/", $_POST["url"])){ 126 $author->personalUrl = sanitize_text_field($_POST['url']); 127 } 128 if(!preg_match("/[\"'*?<>|]$/", $_POST["slug"])){ 129 $author->personalUrl = sanitize_text_field($_POST['slug']); 130 } 125 131 $author->InsertAuthorInfo(); //calls author creation function 126 132 $timeout = get_option('bnpp_timeout_step') * 100; 127 //echo "<script>window.onload = function () { document.getElementById('success').innerHTML = 'Author $author->firstName $author->lastName was added.';setTimeout(function() {window.location=document.location.href;},$timeout); } </script>";128 133 } 129 134 } … … 154 159 } else if(sanitize_text_field($_POST["checkManage"])=="update") //checks if modification call was recieved 155 160 { 156 $sql = $wpdb->prepare("UPDATE $this->dbAuthors SET first_name = %s, last_name = %s, email = %s, personal_url = %s, slug = %s WHERE (id = %d)", array(sanitize_text_field($_POST["firstName"]), sanitize_text_field($_POST["lastName"]), sanitize_email($_POST["email"]), sanitize_text_field($_POST["url"]), sanitize_text_field($_POST["slug"]), sanitize_text_field($_POST["authorID"]))); //updates author data in table 157 $wpdb->query($sql); 161 if(!preg_match("/[\"'*?<>|]$/", $_POST["firstName"]) && !preg_match("/[\"'*?<>|]$/", $_POST["lastName"])){ 162 $sql = $wpdb->prepare("UPDATE $this->dbAuthors SET first_name = %s, last_name = %s, email = %s, personal_url = %s, slug = %s WHERE (id = %d)", array(sanitize_text_field($_POST["firstName"]), sanitize_text_field($_POST["lastName"]), (!preg_match("/[\"'*?<>|]$/", $_POST["email"]) ? sanitize_email($_POST["email"]) : ""), (!preg_match("/[\"'*?<>|]$/", $_POST["url"]) ? sanitize_text_field($_POST["url"]) : ""), (!preg_match("/[\"'*?<>|]$/", $_POST["slug"]) ? sanitize_text_field($_POST["slug"]) : ""), sanitize_text_field($_POST["authorID"]))); //updates author data in table 163 $wpdb->query($sql); 164 } 158 165 echo "<script>window.onload = function () { document.getElementById('success').innerHTML = 'Author " . sanitize_text_field($_POST['authorID']) . " has been updated.';setTimeout(function() {window.location=document.location.href;},$timeout); }</script>"; 159 166 } … … 179 186 echo "<script>window.location=document.location.href;</script>"; 180 187 } 181 if(isset($_POST["promote"])&& check_admin_referer('bnp_promote_authors') && current_user_can('publish_pages') )188 if(isset($_POST["promote"])&& check_admin_referer('bnp_promote_authors') && current_user_can('publish_pages') && !preg_match("/[\"'*?<>|]$/", $_POST["firstName"]) && !preg_match("/[\"'*?<>|]$/", $_POST["lastName"])) 182 189 { 183 190 $author = new BNPP_Author($this->dbAuthors); //creates author object and fills data fields 184 191 $author->firstName = sanitize_text_field($_POST['firstName']); 185 192 $author->lastName = sanitize_text_field($_POST['lastName']); 186 $author->email = sanitize_email($_POST['email']); 187 $author->personalUrl = sanitize_text_field($_POST['url']); 188 $author->slug = sanitize_text_field($_POST['slug']); 193 if(!preg_match("/[\"'*?<>|]$/", $_POST["email"])){ 194 $author->email = sanitize_email($_POST['email']); 195 } 196 if(!preg_match("/[\"'*?<>|]$/", $_POST["url"])){ 197 $author->personalUrl = sanitize_text_field($_POST['url']); 198 } 199 if(!preg_match("/[\"'*?<>|]$/", $_POST["slug"])){ 200 $author->personalUrl = sanitize_text_field($_POST['slug']); 201 } 189 202 $author->InsertAuthorInfo(); //calls author creation function 190 203 $newAuthor = $wpdb->get_results("SELECT * FROM $this->dbAuthors ORDER BY id DESC LIMIT 1"); … … 212 225 echo "<script>window.onload = function () { document.getElementById('success').innerHTML = 'Author $author->firstName $author->lastName was added.';setTimeout(function() {window.location=document.location.href;},$timeout); } </script>"; 213 226 } 227 } 228 229 function clean_input($text_input){ //cleans input text data from prohibited symbols 230 if(preg_match("/[\"'*<>|]$/", $text_input)){ 231 $to_replace = array("'", "\"", "*", "<", ">", "|", "\\"); 232 $text_input = str_replace($to_replace, "", $text_input); 233 } 234 return $text_input; 214 235 } 215 236 … … 261 282 $fileName = ""; 262 283 if(isset($_POST["file_m"]) && sanitize_text_field($_POST["file_m"])!="") 263 $fileName = sanitize_text_field($_POST["file_m"]);284 $fileName = $this->clean_input(sanitize_text_field($_POST["file_m"])); 264 285 else 265 286 $fileName = sanitize_mime_type($_FILES['file']['name']); 266 $this->bridge->addArticle(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), sanitize_text_field($_POST["pages"]), sanitize_text_field($_POST["doi"]), sanitize_text_field($_POST["url"]), sanitize_text_field($_POST["issn"]), sanitize_text_field($_POST["supp"]), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), sanitize_text_field($_POST["arxiv"]), $this->bridge->checkJournal(sanitize_text_field($_POST["journal"])), sanitize_text_field($_POST["volume"]), sanitize_text_field($_POST["issue"]), $char1val, $char2val, $char3val, sanitize_text_field($_POST["preprint"])); //writes article data in table287 $this->bridge->addArticle(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), $this->clean_input(sanitize_text_field($_POST["pages"])), $this->clean_input(sanitize_text_field($_POST["doi"])), $this->clean_input(sanitize_text_field($_POST["url"])), $this->clean_input(sanitize_text_field($_POST["issn"])), $this->clean_input(sanitize_text_field($_POST["supp"])), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), $this->clean_input(sanitize_text_field($_POST["arxiv"])), $this->bridge->checkJournal($this->clean_input(sanitize_text_field($_POST["journal"]))), sanitize_text_field($_POST["volume"]), sanitize_text_field($_POST["issue"]), $char1val, $char2val, $char3val, sanitize_text_field($_POST["preprint"])); //writes article data in table 267 288 $art_id; 268 289 $data = $wpdb->get_results("SELECT id FROM " . $this->dbArticles . " ORDER By id DESC LIMIT 1"); //gets id of previously created article … … 275 296 if(isset($_POST["author" . $k])) 276 297 { //relates every author with article 277 $this->bridge->addArticleAuthor($this->bridge->checkAuthor( sanitize_text_field($_POST["author" . $k])), $art_id);298 $this->bridge->addArticleAuthor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["author" . $k]))), $art_id); 278 299 } 279 300 } … … 282 303 if(isset($_POST["tag" . $k])) 283 304 { //relates every tag with article 284 $this->bridge->addArticleTag($this->bridge->checkTag( sanitize_text_field($_POST["tag" . $k])), $art_id);305 $this->bridge->addArticleTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag" . $k]))), $art_id); 285 306 } 286 307 } … … 308 329 $fileName = ""; 309 330 if(isset($_POST["file_m"]) && sanitize_text_field($_POST["file_m"])!="") 310 $fileName = sanitize_text_field($_POST["file_m"]);331 $fileName = $this->clean_input(sanitize_text_field($_POST["file_m"])); 311 332 else 312 333 $fileName = sanitize_mime_type($_FILES['file']['name']); 313 $this->bridge->addConference(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), sanitize_text_field($_POST["pages"]), sanitize_text_field($_POST["doi"]), sanitize_text_field($_POST["url"]), sanitize_text_field($_POST["issn"]), sanitize_text_field($_POST["supp"]), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), sanitize_text_field($_POST["arxiv"]), sanitize_text_field($_POST["bookTitle"]), sanitize_text_field($_POST["confPages"]), $char1val, $char2val, $char3val); //writes conference data in table334 $this->bridge->addConference(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), $this->clean_input(sanitize_text_field($_POST["pages"])), $this->clean_input(sanitize_text_field($_POST["doi"])), $this->clean_input(sanitize_text_field($_POST["url"])), $this->clean_input(sanitize_text_field($_POST["issn"])), $this->clean_input(sanitize_text_field($_POST["supp"])), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), $this->clean_input(sanitize_text_field($_POST["arxiv"])), sanitize_text_field($_POST["bookTitle"]), $this->clean_input(sanitize_text_field($_POST["confPages"])), $char1val, $char2val, $char3val); //writes conference data in table 314 335 $art_id; 315 336 $data = $wpdb->get_results("SELECT id FROM " . $this->dbConferences . " ORDER By id DESC LIMIT 1"); //gets id of previously created conference … … 322 343 if(isset($_POST["author" . $k])) 323 344 { //relates every author with conference 324 $this->bridge->addConferenceAuthor($this->bridge->checkAuthor( sanitize_text_field($_POST["author" . $k])), $art_id);345 $this->bridge->addConferenceAuthor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["author" . $k]))), $art_id); 325 346 } 326 347 } … … 329 350 if(isset($_POST["tag" . $k])) 330 351 { //relates every tag with conference 331 $this->bridge->addConferenceTag($this->bridge->checkTag( sanitize_text_field($_POST["tag" . $k])), $art_id);352 $this->bridge->addConferenceTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag" . $k]))), $art_id); 332 353 } 333 354 } … … 355 376 $fileName = ""; 356 377 if(isset($_POST["file_m"]) && sanitize_text_field($_POST["file_m"])!="") 357 $fileName = sanitize_text_field($_POST["file_m"]);378 $fileName = $this->clean_input(sanitize_text_field($_POST["file_m"])); 358 379 else 359 380 $fileName = sanitize_mime_type($_FILES['file']['name']); 360 $this->bridge->addBook(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), sanitize_text_field($_POST["pages"]), sanitize_text_field($_POST["doi"]), sanitize_text_field($_POST["url"]), sanitize_text_field($_POST["issn"]), sanitize_text_field($_POST["supp"]), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), sanitize_text_field($_POST["arxiv"]), sanitize_text_field($_POST["publisher"]), sanitize_text_field($_POST["chapter"]), sanitize_text_field($_POST["isbn"]), $char1val, $char2val, $char3val); //writes book data in table381 $this->bridge->addBook(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), $this->clean_input(sanitize_text_field($_POST["pages"])), $this->clean_input(sanitize_text_field($_POST["doi"])), $this->clean_input(sanitize_text_field($_POST["url"])), $this->clean_input(sanitize_text_field($_POST["issn"])), $this->clean_input(sanitize_text_field($_POST["supp"])), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), $this->clean_input(sanitize_text_field($_POST["arxiv"])), $this->clean_input(sanitize_text_field($_POST["publisher"])), $this->clean_input(sanitize_text_field($_POST["chapter"])), $this->clean_input(sanitize_text_field($_POST["isbn"])), $char1val, $char2val, $char3val); //writes book data in table 361 382 $art_id; 362 383 $data = $wpdb->get_results("SELECT id FROM " . $this->dbBooks . " ORDER By id DESC LIMIT 1"); //gets id of previously created book … … 369 390 if(isset($_POST["author" . $k])) 370 391 { //relates every author with book 371 $this->bridge->addBookAuthor($this->bridge->checkAuthor( sanitize_text_field($_POST["author" . $k])), $art_id);392 $this->bridge->addBookAuthor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["author" . $k]))), $art_id); 372 393 } 373 394 } … … 376 397 if(isset($_POST["editor" . $k])) 377 398 { //relates every editor with book 378 $this->bridge->addBookEditor($this->bridge->checkAuthor( sanitize_text_field($_POST["editor" . $k])), $art_id);399 $this->bridge->addBookEditor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["editor" . $k]))), $art_id); 379 400 } 380 401 } … … 383 404 if(isset($_POST["tag" . $k])) 384 405 { //relates every tag with book 385 $this->bridge->addBookTag($this->bridge->checkTag( sanitize_text_field($_POST["tag" . $k])), $art_id);406 $this->bridge->addBookTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag" . $k]))), $art_id); 386 407 } 387 408 } … … 451 472 if(isset($_POST["author" . $k]) && sanitize_text_field($_POST["author" . $k])!="") 452 473 { //creates new relations between article and authors 453 $this->bridge->addArticleAuthor($this->bridge->checkAuthor( sanitize_text_field($_POST["author" . $k])), sanitize_text_field($_POST['articleID']));474 $this->bridge->addArticleAuthor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["author" . $k]))), sanitize_text_field($_POST['articleID'])); 454 475 } 455 476 } … … 459 480 if(isset($_POST["tag" . $k]) && sanitize_text_field($_POST["tag" . $k])!="") 460 481 { //creates new relations between article and tags 461 $this->bridge->addArticleTag($this->bridge->checkTag( sanitize_text_field($_POST["tag" . $k])), sanitize_text_field($_POST['articleID']));482 $this->bridge->addArticleTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag" . $k]))), sanitize_text_field($_POST['articleID'])); 462 483 } 463 484 } … … 479 500 $fileName = ""; 480 501 if(isset($_POST["file_m"]) && sanitize_text_field($_POST["file_m"])!="") 481 $fileName = sanitize_text_field($_POST["file_m"]);502 $fileName = $this->clean_input(sanitize_text_field($_POST["file_m"])); 482 503 else 483 504 $fileName = sanitize_mime_type($_FILES['file']['name']); 484 $this->bridge->manageArticle(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), sanitize_text_field($_POST["pages"]), sanitize_text_field($_POST["doi"]), sanitize_text_field($_POST["url"]), sanitize_text_field($_POST["issn"]), sanitize_text_field($_POST["supp"]), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), sanitize_text_field($_POST["arxiv"]), $this->bridge->checkJournal(sanitize_text_field($_POST["journal"])), sanitize_text_field($_POST["volume"]), sanitize_text_field($_POST["issue"]), sanitize_text_field($_POST["articleID"]), $char1val, $char2val, $char3val, sanitize_text_field($_POST["preprint"]));505 $this->bridge->manageArticle(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), $this->clean_input(sanitize_text_field($_POST["pages"])), $this->clean_input(sanitize_text_field($_POST["doi"])), $this->clean_input(sanitize_text_field($_POST["url"])), $this->clean_input(sanitize_text_field($_POST["issn"])), $this->clean_input(sanitize_text_field($_POST["supp"])), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), $this->clean_input(sanitize_text_field($_POST["arxiv"])), $this->bridge->checkJournal($this->clean_input(sanitize_text_field($_POST["journal"]))), sanitize_text_field($_POST["volume"]), sanitize_text_field($_POST["issue"]), sanitize_text_field($_POST["articleID"]), $char1val, $char2val, $char3val, sanitize_text_field($_POST["preprint"])); 485 506 if(isset($_FILES['file']) && sanitize_mime_type($_FILES['file']['name']) != "") 486 507 { … … 521 542 if(isset($_POST["author" . $k]) && sanitize_text_field($_POST["author" . $k])!="") 522 543 { 523 $this->bridge->addConferenceAuthor($this->bridge->checkAuthor( sanitize_text_field($_POST["author" . $k])), sanitize_text_field($_POST['articleID']));544 $this->bridge->addConferenceAuthor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["author" . $k]))), sanitize_text_field($_POST['articleID'])); 524 545 } 525 546 } … … 529 550 if(isset($_POST["tag" . $k]) && sanitize_text_field($_POST["tag" . $k])!="") 530 551 { //creates new relations between conference and tags 531 $this->bridge->addConferenceTag($this->bridge->checkTag( sanitize_text_field($_POST["tag" . $k])), sanitize_text_field($_POST['articleID']));552 $this->bridge->addConferenceTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag" . $k]))), sanitize_text_field($_POST['articleID'])); 532 553 } 533 554 } … … 549 570 $fileName = ""; 550 571 if(isset($_POST["file_m"]) && sanitize_text_field($_POST["file_m"])!="") 551 $fileName = sanitize_text_field($_POST["file_m"]);572 $fileName = $this->clean_input(sanitize_text_field($_POST["file_m"])); 552 573 else 553 574 $fileName = sanitize_mime_type($_FILES['file']['name']); 554 $this->bridge->manageConference(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), sanitize_text_field($_POST["pages"]), sanitize_text_field($_POST["doi"]), sanitize_text_field($_POST["url"]), sanitize_text_field($_POST["issn"]), sanitize_text_field($_POST["supp"]), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), sanitize_text_field($_POST["arxiv"]), sanitize_text_field($_POST["bookTitle"]), sanitize_text_field($_POST["confPages"]), sanitize_text_field($_POST["articleID"]), $char1val, $char2val, $char3val);575 $this->bridge->manageConference(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), $this->clean_input(sanitize_text_field($_POST["pages"])), $this->clean_input(sanitize_text_field($_POST["doi"])), $this->clean_input(sanitize_text_field($_POST["url"])), $this->clean_input(sanitize_text_field($_POST["issn"])), $this->clean_input(sanitize_text_field($_POST["supp"])), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), $this->clean_input(sanitize_text_field($_POST["arxiv"])), sanitize_text_field($_POST["bookTitle"]), $this->clean_input(sanitize_text_field($_POST["confPages"])), sanitize_text_field($_POST["articleID"]), $char1val, $char2val, $char3val); 555 576 if(isset($_FILES['file']) && sanitize_mime_type($_FILES['file']['name']) != "") 556 577 { … … 591 612 if(isset($_POST["author" . $k]) && sanitize_text_field($_POST["author" . $k])!="") 592 613 { 593 $this->bridge->addBookAuthor($this->bridge->checkAuthor( sanitize_text_field($_POST["author" . $k])), sanitize_text_field($_POST['articleID']));614 $this->bridge->addBookAuthor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["author" . $k]))), sanitize_text_field($_POST['articleID'])); 594 615 } 595 616 } … … 599 620 if(isset($_POST["editor" . $k]) && sanitize_text_field($_POST["editor" . $k])!="") 600 621 { 601 $this->bridge->addBookEditor($this->bridge->checkAuthor( sanitize_text_field($_POST["editor" . $k])), sanitize_text_field($_POST['articleID']));622 $this->bridge->addBookEditor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["editor" . $k]))), sanitize_text_field($_POST['articleID'])); 602 623 } 603 624 } … … 607 628 if(isset($_POST["tag" . $k]) && sanitize_text_field($_POST["tag" . $k])!="") 608 629 { //creates new relations between book and tags 609 $this->bridge->addBookTag($this->bridge->checkTag( sanitize_text_field($_POST["tag" . $k])), sanitize_text_field($_POST['articleID']));630 $this->bridge->addBookTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag" . $k]))), sanitize_text_field($_POST['articleID'])); 610 631 } 611 632 } … … 627 648 $fileName = ""; 628 649 if(isset($_POST["file_m"]) && sanitize_text_field($_POST["file_m"])!="") 629 $fileName = sanitize_text_field($_POST["file_m"]);650 $fileName = $this->clean_input(sanitize_text_field($_POST["file_m"])); 630 651 else 631 652 $fileName = sanitize_mime_type($_FILES['file']['name']); 632 $this->bridge->manageBook(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), sanitize_text_field($_POST["pages"]), sanitize_text_field($_POST["doi"]), sanitize_text_field($_POST["url"]), sanitize_text_field($_POST["issn"]), sanitize_text_field($_POST["supp"]), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), sanitize_text_field($_POST["arxiv"]), sanitize_text_field($_POST["publisher"]), sanitize_text_field($_POST["chapter"]), sanitize_text_field($_POST["isbn"]), sanitize_text_field($_POST["articleID"]), $char1val, $char2val, $char3val);653 $this->bridge->manageBook(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), $this->clean_input(sanitize_text_field($_POST["pages"])), $this->clean_input(sanitize_text_field($_POST["doi"])), $this->clean_input(sanitize_text_field($_POST["url"])), $this->clean_input(sanitize_text_field($_POST["issn"])), $this->clean_input(sanitize_text_field($_POST["supp"])), $fileName, sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), $this->clean_input(sanitize_text_field($_POST["arxiv"])), $this->clean_input(sanitize_text_field($_POST["publisher"])), $this->clean_input(sanitize_text_field($_POST["chapter"])), $this->clean_input(sanitize_text_field($_POST["isbn"])), sanitize_text_field($_POST["articleID"]), $char1val, $char2val, $char3val); 633 654 if(isset($_FILES['file']) && sanitize_mime_type($_FILES['file']['name']) != "") 634 655 { … … 739 760 if($_POST["paperType"]=="article") //inserts article paper info 740 761 { 741 $this->bridge->addArticle(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), sanitize_text_field($_POST["pages"]), sanitize_text_field($_POST["doi"]), sanitize_text_field($_POST["url"]), sanitize_text_field($_POST["issn"]), sanitize_text_field($_POST["supp"]), sanitize_text_field($_POST["file"]), sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), sanitize_text_field($_POST["arxiv"]), $this->bridge->checkJournal(sanitize_text_field($_POST["journal"])), sanitize_text_field($_POST["volume"]), sanitize_text_field($_POST["issue"]), $char1val, $char2val, $char3val, sanitize_text_field($_POST["preprint"])); //writes article data in table762 $this->bridge->addArticle(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), $this->clean_input(sanitize_text_field($_POST["pages"])), $this->clean_input(sanitize_text_field($_POST["doi"])), $this->clean_input(sanitize_text_field($_POST["url"])), $this->clean_input(sanitize_text_field($_POST["issn"])), $this->clean_input(sanitize_text_field($_POST["supp"])), $this->clean_input(sanitize_text_field($_POST["file"])), sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), $this->clean_input(sanitize_text_field($_POST["arxiv"])), $this->bridge->checkJournal($this->clean_input(sanitize_text_field($_POST["journal"]))), sanitize_text_field($_POST["volume"]), sanitize_text_field($_POST["issue"]), $char1val, $char2val, $char3val, sanitize_text_field($_POST["preprint"])); //writes article data in table 742 763 $art_id; 743 764 $data = $wpdb->get_results("SELECT id FROM " . $this->dbArticles . " ORDER By id DESC LIMIT 1"); //gets id of previously created article … … 750 771 if(isset($_POST["author" . $k])) 751 772 { //relates every author with article 752 $this->bridge->addArticleAuthor($this->bridge->checkAuthor( sanitize_text_field($_POST["author" . $k])), $art_id);773 $this->bridge->addArticleAuthor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["author" . $k]))), $art_id); 753 774 } 754 775 } 755 776 if(isset($_POST["tag"])) 756 777 { //relates tags with article 757 $this->bridge->addArticleTag($this->bridge->checkTag( sanitize_text_field($_POST["tag"])), $art_id);778 $this->bridge->addArticleTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag"]))), $art_id); 758 779 } 759 780 for($k = 0; $k <= 20; $k++) … … 761 782 if(isset($_POST["tag" . $k])) 762 783 { //relates tags with article 763 $this->bridge->addArticleTag($this->bridge->checkTag( sanitize_text_field($_POST["tag" . $k])), $art_id);784 $this->bridge->addArticleTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag" . $k]))), $art_id); 764 785 } 765 786 } 766 787 } else if(sanitize_text_field($_POST["paperType"])=="conference") //inserts conference info 767 788 { 768 $this->bridge->addConference(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), sanitize_text_field($_POST["pages"]), sanitize_text_field($_POST["doi"]), sanitize_text_field($_POST["url"]), sanitize_text_field($_POST["issn"]), sanitize_text_field($_POST["supp"]), sanitize_text_field($_POST["file"]), sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), sanitize_text_field($_POST["arxiv"]), sanitize_text_field($_POST["bookTitle"]), sanitize_text_field($_POST["confPages"]), $char1val, $char2val, $char3val); //writes conference data in table789 $this->bridge->addConference(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), $this->clean_input(sanitize_text_field($_POST["pages"])), $this->clean_input(sanitize_text_field($_POST["doi"])), $this->clean_input(sanitize_text_field($_POST["url"])), $this->clean_input(sanitize_text_field($_POST["issn"])), $this->clean_input(sanitize_text_field($_POST["supp"])), $this->clean_input(sanitize_text_field($_POST["file"])), sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), $this->clean_input(sanitize_text_field($_POST["arxiv"])), sanitize_text_field($_POST["bookTitle"]), $this->clean_input(sanitize_text_field($_POST["confPages"])), $char1val, $char2val, $char3val); //writes conference data in table 769 790 $art_id; 770 791 $data = $wpdb->get_results("SELECT id FROM " . $this->dbConferences . " ORDER By id DESC LIMIT 1"); //gets id of previously created conference … … 777 798 if(isset($_POST["author" . $k])) 778 799 { //relates every author with conference 779 $this->bridge->addConferenceAuthor($this->bridge->checkAuthor( sanitize_text_field($_POST["author" . $k])), $art_id);800 $this->bridge->addConferenceAuthor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["author" . $k]))), $art_id); 780 801 } 781 802 } 782 803 if(isset($_POST["tag"])) 783 804 { //relates tags with article 784 $this->bridge->addConferenceTag($this->bridge->checkTag( sanitize_text_field($_POST["tag"])), $art_id);805 $this->bridge->addConferenceTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag"]))), $art_id); 785 806 } 786 807 for($k = 0; $k <= 20; $k++) … … 788 809 if(isset($_POST["tag" . $k])) 789 810 { //relates tags with article 790 $this->bridge->addConferenceTag($this->bridge->checkTag( sanitize_text_field($_POST["tag" . $k])), $art_id);811 $this->bridge->addConferenceTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag" . $k]))), $art_id); 791 812 } 792 813 } 793 814 } else if(sanitize_text_field($_POST["paperType"])=="book") //inserts book info 794 815 { 795 $this->bridge->addBook(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), sanitize_text_field($_POST["pages"]), sanitize_text_field($_POST["doi"]), sanitize_text_field($_POST["url"]), sanitize_text_field($_POST["issn"]), sanitize_text_field($_POST["supp"]), sanitize_text_field($_POST["file"]), sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), sanitize_text_field($_POST["arxiv"]), sanitize_text_field($_POST["publisher"]), sanitize_text_field($_POST["chapter"]), sanitize_text_field($_POST["isbn"]), $char1val, $char2val, $char3val); //writes book data in table816 $this->bridge->addBook(sanitize_text_field($_POST["title"]), sanitize_text_field($_POST["year"]), $this->clean_input(sanitize_text_field($_POST["pages"])), $this->clean_input(sanitize_text_field($_POST["doi"])), $this->clean_input(sanitize_text_field($_POST["url"])), $this->clean_input(sanitize_text_field($_POST["issn"])), $this->clean_input(sanitize_text_field($_POST["supp"])), $this->clean_input(sanitize_text_field($_POST["file"])), sanitize_text_field($_POST["date"]), sanitize_text_field($_POST["public"]), $this->clean_input(sanitize_text_field($_POST["arxiv"])), $this->clean_input(sanitize_text_field($_POST["publisher"])), $this->clean_input(sanitize_text_field($_POST["chapter"])), $this->clean_input(sanitize_text_field($_POST["isbn"])), $char1val, $char2val, $char3val); //writes book data in table 796 817 $art_id; 797 818 $data = $wpdb->get_results("SELECT id FROM " . $this->dbBooks . " ORDER By id DESC LIMIT 1"); //gets id of previously created book … … 804 825 if(isset($_POST["author" . $k])) 805 826 { //relates every author with book 806 $this->bridge->addBookAuthor($this->bridge->checkAuthor( sanitize_text_field($_POST["author" . $k])), $art_id);827 $this->bridge->addBookAuthor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["author" . $k]))), $art_id); 807 828 } 808 829 } … … 811 832 if(isset($_POST["editor" . $k])) 812 833 { //relates every editor with book 813 $this->bridge->addBookEditor($this->bridge->checkAuthor( sanitize_text_field($_POST["editor" . $k])), $art_id);834 $this->bridge->addBookEditor($this->bridge->checkAuthor($this->clean_input(sanitize_text_field($_POST["editor" . $k]))), $art_id); 814 835 } 815 836 } 816 837 if(isset($_POST["tag"])) 817 838 { //relates tags with article 818 $this->bridge->addBookTag($this->bridge->checkTag( sanitize_text_field($_POST["tag"])), $art_id);839 $this->bridge->addBookTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag"]))), $art_id); 819 840 } 820 841 for($k = 0; $k <= 20; $k++) … … 822 843 if(isset($_POST["tag" . $k])) 823 844 { //relates tags with article 824 $this->bridge->addBookTag($this->bridge->checkTag( sanitize_text_field($_POST["tag" . $k])), $art_id);845 $this->bridge->addBookTag($this->bridge->checkTag($this->clean_input(sanitize_text_field($_POST["tag" . $k]))), $art_id); 825 846 } 826 847 } … … 862 883 if(isset($_POST["prefix"])&& check_admin_referer('bnp_prefix_setting') && current_user_can('publish_pages')) //checks if db prefix was set 863 884 { 864 if(sanitize_text_field($_POST["prefix"]) != "" ) //if not empty, sets new prefix value885 if(sanitize_text_field($_POST["prefix"]) != "" && preg_match("/^[a-zA-Z0-9_-]*$/", $_POST["prefix"])) //if not empty, sets new prefix value 865 886 { 866 887 update_option('bnpp_tables_created', false); 867 888 update_option('bnpp_custom_db_prefix',sanitize_text_field($_POST["prefix"])); 868 889 echo "<script type='text/javascript'> window.location=document.location.href;</script>"; 890 } else { 891 echo "<script type='text/javascript'> alert('The prefix cannot contain special characters. Please, use letters, numbers, dash and underscore only!'); window.location=document.location.href;</script>"; 869 892 } 870 893 } … … 872 895 if(isset($_POST["comp_rbracket"])&& check_admin_referer('bnp_compatibility_setting') && current_user_can('publish_pages')) 873 896 { 874 update_option('bnpp_comp_rbracket',sanitize_text_field($_POST["comp_rbracket"])); 875 update_option('bnpp_comp_lbracket',sanitize_text_field($_POST["comp_lbracket"])); 897 if(preg_match("/^[a-zA-Z0-9_\[\](){}-]*$/", $_POST["comp_rbracket"])){ 898 update_option('bnpp_comp_rbracket',sanitize_text_field($_POST["comp_rbracket"])); 899 } else { 900 echo "<script type='text/javascript'> alert('The brackets cannot contain special characters. Please, use letters, numbers, dash, brackets and underscore only!'); window.location=document.location.href;</script>"; 901 } 902 if(preg_match("/^[a-zA-Z0-9_\[\](){}-]*$/", $_POST["comp_lbracket"])){ 903 update_option('bnpp_comp_lbracket',sanitize_text_field($_POST["comp_lbracket"])); 904 } else { 905 echo "<script type='text/javascript'> alert('The brackets cannot contain special characters. Please, use letters, numbers, dash, brackets and underscore only!'); window.location=document.location.href;</script>"; 906 } 876 907 if(isset($_POST["comp_pub"])) 877 908 update_option('bnpp_comp_pub',true); … … 903 934 if(isset($_POST["upload_abs_hidden"])&& check_admin_referer('bnp_upload_dir_setting') && current_user_can('publish_pages')) 904 935 { 905 update_option('bnpp_upload_dir',sanitize_text_field($_POST["upload"])); 936 if(!preg_match("/[\"'*?<>|]$/", $_POST["upload"])){ 937 update_option('bnpp_upload_dir',sanitize_text_field($_POST["upload"])); 938 } else { 939 echo "<script type='text/javascript'> alert('Cannot accept the upload folder path. Please, avoid using these symbols for the folder: \", \', *, ?, <, >, |'); window.location=document.location.href;</script>"; 940 } 906 941 if(isset($_POST["upload_abs"])) 907 942 update_option('bnpp_upload_dir_abs',true); … … 928 963 } 929 964 update_option('bnpp_list_division',sanitize_text_field($_POST["listDivision"])); 930 update_option('bnpp_list_division_style',sanitize_text_field($_POST["listDivisionStyle"])); 965 if(preg_match("/^[a-zA-Z0-9_.,:; #()%-]*$/", $_POST["listDivisionStyle"])){ 966 update_option('bnpp_list_division_style',sanitize_text_field($_POST["listDivisionStyle"])); 967 } else { 968 echo "<script type='text/javascript'> alert('Style input contains disallowed symbols.'); window.location=document.location.href;</script>"; 969 } 931 970 update_option('bnpp_list_order',sanitize_text_field($_POST["listOrder"])); 932 971 echo "<script type='text/javascript'> window.location=document.location.href;</script>"; … … 934 973 if(isset($_POST["lstylevalue"])&& check_admin_referer('bnp_lstyle_setting') && current_user_can('publish_pages')) 935 974 { 936 update_option('bnpp_lstyle_value',sanitize_text_field($_POST["lstylevalue"])); 937 echo "<script type='text/javascript'> window.location=document.location.href;</script>"; 975 if(preg_match("/^[a-zA-Z0-9_.,:; #()%-]*$/", $_POST["lstylevalue"])){ 976 update_option('bnpp_lstyle_value',sanitize_text_field($_POST["lstylevalue"])); 977 echo "<script type='text/javascript'> window.location=document.location.href;</script>"; 978 } else { 979 echo "<script type='text/javascript'> alert('Style input contains disallowed symbols.'); window.location=document.location.href;</script>"; 980 } 938 981 } 939 982 //sets characteristics values 940 983 if(isset($_POST["char1name"])&& check_admin_referer('bnp_char1_setting') && current_user_can('publish_pages')) 941 984 { 942 update_option('bnpp_custom_char1_name',sanitize_text_field($_POST["char1name"])); 943 update_option('bnpp_custom_char1_value',sanitize_text_field($_POST["char1value"])); 985 if(preg_match("/^[a-zA-Z0-9_-]*$/", $_POST["char1name"])){ 986 update_option('bnpp_custom_char1_name',sanitize_text_field($_POST["char1name"])); 987 } else { 988 echo "<script type='text/javascript'> alert('The characteristic name cannot contain special characters. Please, use letters, numbers, dash and underscore only!'); window.location=document.location.href;</script>"; 989 } 990 if(preg_match("/^[a-zA-Z0-9_.,:; #()%-]*$/", $_POST["char1value"])){ 991 update_option('bnpp_custom_char1_value',sanitize_text_field($_POST["char1value"])); 992 } else { 993 echo "<script type='text/javascript'> alert('Style input contains disallowed symbols.'); window.location=document.location.href;</script>"; 994 } 944 995 echo "<script type='text/javascript'> window.location=document.location.href;</script>"; 945 996 } 946 997 if(isset($_POST["char2name"])&& check_admin_referer('bnp_char2_setting') && current_user_can('publish_pages')) 947 998 { 948 update_option('bnpp_custom_char2_name',sanitize_text_field($_POST["char2name"])); 949 update_option('bnpp_custom_char2_value',sanitize_text_field($_POST["char2value"])); 999 if(preg_match("/^[a-zA-Z0-9_-]*$/", $_POST["char2name"])){ 1000 update_option('bnpp_custom_char2_name',sanitize_text_field($_POST["char2name"])); 1001 } else { 1002 echo "<script type='text/javascript'> alert('The characteristic name cannot contain special characters. Please, use letters, numbers, dash and underscore only!'); window.location=document.location.href;</script>"; 1003 } 1004 if(preg_match("/^[a-zA-Z0-9_.,:; #()%-]*$/", $_POST["char2value"])){ 1005 update_option('bnpp_custom_char2_value',sanitize_text_field($_POST["char2value"])); 1006 } else { 1007 echo "<script type='text/javascript'> alert('Style input contains disallowed symbols.'); window.location=document.location.href;</script>"; 1008 } 950 1009 echo "<script type='text/javascript'> window.location=document.location.href;</script>"; 951 1010 } 952 1011 if(isset($_POST["char3name"])&& check_admin_referer('bnp_char3_setting') && current_user_can('publish_pages')) 953 1012 { 954 update_option('bnpp_custom_char3_name',sanitize_text_field($_POST["char3name"])); 955 update_option('bnpp_custom_char3_value',sanitize_text_field($_POST["char3value"])); 1013 if(preg_match("/^[a-zA-Z0-9_-]*$/", $_POST["char3name"])){ 1014 update_option('bnpp_custom_char3_name',sanitize_text_field($_POST["char3name"])); 1015 } else { 1016 echo "<script type='text/javascript'> alert('The characteristic name cannot contain special characters. Please, use letters, numbers, dash and underscore only!'); window.location=document.location.href;</script>"; 1017 } 1018 if(preg_match("/^[a-zA-Z0-9_.,:; #()%-]*$/", $_POST["char3value"])){ 1019 update_option('bnpp_custom_char3_value',sanitize_text_field($_POST["char3value"])); 1020 } else { 1021 echo "<script type='text/javascript'> alert('Style input contains disallowed symbols.'); window.location=document.location.href;</script>"; 1022 } 956 1023 echo "<script type='text/javascript'> window.location=document.location.href;</script>"; 957 1024 } … … 969 1036 } else 970 1037 { 971 $this->bridge->dropTables(get_option(' custom_db_prefix'));1038 $this->bridge->dropTables(get_option('bnpp_custom_db_prefix')); 972 1039 update_option('bnpp_drop_db_tables',true); 973 1040 update_option('bnpp_db_import_debug', 'No logs'); -
books-papers/trunk/readme.txt
r2479970 r2681715 4 4 Tags: academic, publication, paper, article, conference, proceedings, bibliography, management, auto-fill, autofill 5 5 Requires at least: 5.1.1 6 Tested up to: 5. 67 Stable tag: 0.202 102236 Tested up to: 5.9 7 Stable tag: 0.20220219 8 8 Requires PHP: 5.6 9 9 License: GPLv2 or later … … 113 113 == Changelog == 114 114 115 = 0.20220219 = 116 * Fixed input fields vulnerability. 117 115 118 = 0.20210223 = 116 119 * Fixed bug with incorrect representation of several authors with the same surnames. … … 202 205 == Upgrade Notice == 203 206 207 = 0.20220219 = 208 * Fixed input fields vulnerability. 209 204 210 = 0.20210223 = 205 211 * Fixed bug with incorrect representation of several authors with the same surnames.
Note: See TracChangeset
for help on using the changeset viewer.