Changeset 2848025

Timestamp:

01/13/2023 03:19:24 PM (3 years ago)

Author:

ResponsiveVoice

Message:

RES-363 add sanitation to shortcode attributes; Change “tested up to” Wordpress 6.1.1;

Location:

responsivevoice-text-to-speech/trunk

Files:

• readme.txt (modified) (2 diffs)
• responsivevoice-text-to-speech.php (modified) (4 diffs)

responsivevoice-text-to-speech/trunk/readme.txt

@@ -5 +5 @@
 Tags: audio, google translate, Google Voice, speech, text to audio, text to speech, text-to-speech, text2speech, speech synthesis api, webspeech api, voice, espeak, javascript, Speak, speech, spoken, text, text-to-speech, talk, listen, accessibility, a11y, webreader, ivona, tts, arabic, mp3, ogg, buddypress, button, chinese, english, french, german, google, welcome, greetings, hebrew, html, html5, iPad, iphone, italian, jquery, link, links, menus, mobile, multilingual, page, pages, plugin, plugins, portuguese, Post, posts, readability, Russian, seo, shortcode, sidebar, sound, spanish, gspeech, stats, tablet, tts, widget, wordpress, button, blind, visual impairment, elderly, ADA, BS 8878:2010, WCAG 2.0, Web Content Accessibility Guidelines 2.0
 Requires at least: 3.6
-Tested up to: 6.1
-Stable tag: 1.7.6
+Tested up to: 6.1.1
+Stable tag: 1.7.7
 License: GPLv2
 
@@ -80 +80 @@
 
 == Changelog ==
+
+= Version 1.7.7 =
+* Add sanitation to shortcode attributes 
+* Update "Tested up to" Wordpress 6.1.1 release
 
 = Version 1.7.6 =

responsivevoice-text-to-speech/trunk/responsivevoice-text-to-speech.php

@@ -4 +4 @@
 Plugin URI: responsivevoice.com/wordpress-text-to-speech-plugin/?utm_source=wpadmin&utm_medium=plugin&utm_campaign=wprvttsplugin
 Description: An easy to use plugin to integrate ResponsiveVoice Text to Speech into your WP blog.
-Version: 1.7.6
+Version: 1.7.7
 Author: ResponsiveVoice
 Author URI: http://responsivevoice.com
@@ -53 +53 @@
     ), $attributes));
 
+    // Sanitize attributes
+    $voice = esc_js($voice);
+    $buttontext = esc_js($buttontext);
+    
     $parameters = RV_extract_extra_parameters($attributes);
 
@@ -99 +103 @@
     ), $attributes));
 
+    // Sanitize attributes
+    $voice = esc_js($voice);
+    $buttontext = esc_js($buttontext);
+
     $parameters = RV_extract_extra_parameters($attributes);
 
@@ -148 +156 @@
         if (array_search($attribute, $valid_attributes) === false) {
             unset($attributes[$attribute]);
+        } else {
+            // Sanitize attributes
+            $attributes[$attribute] = esc_js($value);
         }
-
     }