Changeset 2712645

Timestamp:

04/21/2022 08:55:15 AM (4 years ago)

Author:

husobj

Message:

Version 3.4.1

Location:

wp-subtitle/trunk

Files:

• CHANGELOG.md (modified) (1 diff)
• README.md (modified) (1 diff)
• plugin/admin/admin.php (modified) (4 diffs)
• readme.txt (modified) (3 diffs)
• wp-subtitle.php (modified) (1 diff)

wp-subtitle/trunk/CHANGELOG.md

@@ -3 +3 @@
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [3.4.1] - 2022-04-21
+
+### Security
+- Resolve XSS issue by improving sanitization when saving subtitle custom field.
+
 ## [3.4] - 2020-01-31
+
+### Changed
+- Pass the current post object to the `wps_subtitle_field_placeholder` filter. Props [Dominik Schilling](https://github.com/ocean90).
 
 ### Added

wp-subtitle/trunk/README.md

@@ -141 +141 @@
 --------------
 
+### 3.4.1
+Resolve XSS issue by improving sanitization when saving subtitle custom field.
+
 ### 3.4
 Added support for the SEOPress plugin and updating the subtitle via the REST API.

wp-subtitle/trunk/plugin/admin/admin.php

@@ -28 +28 @@
         add_filter( '_wp_post_revision_fields', array( 'WPSubtitle_Admin', '_wp_post_revision_fields' ), 9 );
         add_action( 'wp_restore_post_revision', array( 'WPSubtitle_Admin', 'wp_restore_post_revision' ), 10, 2 );
+
+        add_filter( 'sanitize_post_meta_wps_subtitle', array( 'WPSubtitle_Admin', 'sanitize_subtitle_value' ) );
 
     }
@@ -315 +317 @@
         // As of WordPress 4.3 no need to esc_attr() AND htmlentities().
         // @see  https://core.trac.wordpress.org/changeset/33271
-        echo '<input type="text" id="wpsubtitle" name="wps_subtitle" value="' . esc_attr( $value ) . '" autocomplete="off" placeholder="' . esc_attr( apply_filters( 'wps_subtitle_field_placeholder', __( 'Enter subtitle here', 'wp-subtitle' ) ) ) . '" style="width:99%;" />';
+        echo '<input type="text" id="wpsubtitle" name="wps_subtitle" value="' . esc_attr( $value ) . '" autocomplete="off" placeholder="' . esc_attr( apply_filters( 'wps_subtitle_field_placeholder', __( 'Enter subtitle here', 'wp-subtitle' ), $post ) ) . '" style="width:99%;" />';
 
         echo apply_filters( 'wps_subtitle_field_description', '', $post );
@@ -342 +344 @@
         // As of WordPress 4.3 no need to esc_attr() AND htmlentities().
         // @see  https://core.trac.wordpress.org/changeset/33271
-        echo '<input type="text" id="wpsubtitle" name="wps_subtitle" value="' . esc_attr( $value ) . '" autocomplete="off" placeholder="' . esc_attr( apply_filters( 'wps_subtitle_field_placeholder', __( 'Enter subtitle here', 'wp-subtitle' ) ) ) . '" />';
+        echo '<input type="text" id="wpsubtitle" name="wps_subtitle" value="' . esc_attr( $value ) . '" autocomplete="off" placeholder="' . esc_attr( apply_filters( 'wps_subtitle_field_placeholder', __( 'Enter subtitle here', 'wp-subtitle' ), $post ) ) . '" />';
 
         echo '</div>';
@@ -520 +522 @@
     }
 
+    public static function sanitize_subtitle_value( $value ) {
+
+        return wp_kses( $value, wp_kses_allowed_html( 'data' ) );
+
+    }
+
 }

wp-subtitle/trunk/readme.txt

@@ -4 +4 @@
 Tags: subtitle, content, title, subheading, subhead, alternate title
 Requires at least: 3.7
-Tested up to: 5.3.2
-Stable tag: 3.4
+Tested up to: 5.9.3
+Stable tag: 3.4.1
 License: GPLv2
 License URI: http://www.gnu.org/licenses/gpl-2.0.txt
@@ -154 +154 @@
 == Changelog ==
 
+= 3.4.1 =
+* Security: Resolve XSS issue by improving sanitization when saving subtitle custom field.
+* Pass the current post object to the `wps_subtitle_field_placeholder` filter. Props [Dominik Schilling](https://github.com/ocean90).
+
 = 3.4 =
 * Added support for the SEOPress plugin. Props @chriselkins.
@@ -255 +259 @@
 == Upgrade Notice ==
 
+= 3.4.1 =
+Resolve XSS issue by improving sanitization when saving subtitle custom field.
+
 = 3.4 =
 Added support for the SEOPress plugin and updating the subtitle via the REST API.

wp-subtitle/trunk/wp-subtitle.php

@@ -5 +5 @@
 Plugin URI: http://wordpress.org/plugins/wp-subtitle/
 Description: Adds a subtitle field to pages and posts. Possible to add support for custom post types.
-Version: 3.4
+Version: 3.4.1
 Author: Ben Huson, Husani Oakley
 Author URI: https://github.com/benhuson/wp-subtitle