WordPress.org
Get WordPress

Plugin Directory

Changeset 2918564


Ignore:
Timestamp:
05/29/2023 12:28:32 PM (3 years ago)
Author:
msh134
Message:

Fixed security issues, compatibility checked

Location:
wp-reroute-email/trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • wp-reroute-email/trunk/db_log.php

    r2591285 r2918564  
    77
    88    $table = new DBLogList();
     9    $logId = filter_input(INPUT_GET, 'logid', FILTER_VALIDATE_INT);
    910
    10     if($tab == 'details' && !empty($_GET['logid'])){
    11         $item = $table->get_item(filter_input(INPUT_GET, 'logid'));
     11    if($tab == 'details' && !empty($logId)){
     12        $item = $table->get_item($logId);
    1213
    1314        if($item){
    … …  
    4445                    <?php
    4546                        $is_only_html = preg_match("/<[^<]+>/",  $item->message, $m) != 0;
    46                         echo $is_only_html ? wp_kses_post($item->message) : nl2br($item->message);
     47                        echo $is_only_html ? wp_kses_post($item->message) : wp_kses_post(nl2br($item->message));
    4748                    ?>
    4849                    </div>   

  • wp-reroute-email/trunk/includes/db_log_list.class.php

    r2908808 r2918564  
    2323
    2424    function column_subject($item){
     25        $page = sanitize_text_field(filter_input(INPUT_GET, 'page'));
    2526        $actions = array(
    26             'view'      => sprintf('<a href="?page=%s&tab=details&action=%s&logid=%s">' . esc_attr__('View Message', 'wp_reroute_email') . '</a>',$_REQUEST['page'],'view',$item->id)
     27            'view'      => sprintf('<a href="?page=%s&tab=details&action=%s&logid=%s">' . esc_attr__('View Message', 'wp_reroute_email') . '</a>', esc_attr($page),'view', esc_attr($item->id))
    2728        );
    2829
    29         return sprintf('%1$s %2$s',
    30             /*$1%s*/ $item->subject,
    31             /*$2%s*/ $this->row_actions($actions)
    32         );
     30        return sprintf('%1$s %2$s', $item->subject, $this->row_actions($actions));
    3331    }
    3432   
    … …  
    8583        $query = "SELECT * FROM {$wpdb->prefix}wpre_emails";
    8684
    87         $orderby = !empty($_GET['orderby']) && in_array($_GET['orderby'], ['sent_on'])? esc_sql($_GET['orderby']) : 'sent_on';
    88         $order = !empty($_GET['order']) && in_array($_GET['order'], ['ASC', 'DESC']) ? esc_sql($_GET['order']) : 'DESC';
     85        $orderby = sanitize_text_field(filter_input(INPUT_GET, 'orderby'));
     86        $order = sanitize_text_field(filter_input(INPUT_GET, 'order'));
     87        $paged = sanitize_text_field(filter_input(INPUT_GET, 'paged', FILTER_VALIDATE_INT));
     88
     89        $orderby = !empty($orderby) && in_array($orderby, ['sent_on']) ? esc_sql($orderby) : 'sent_on';
     90        $order = !empty($order) && in_array($order, ['ASC', 'DESC']) ? esc_sql($order) : 'DESC';
    8991
    9092        if(!empty($orderby) & !empty($order)){
    91             $query.=' ORDER BY '.$orderby.' '.$order;
     93            $query.= ' ORDER BY ' . $orderby . ' ' . $order;
    9294        }
    9395
    9496        $total_items = $wpdb->query($query);
    9597
    96         $paged = !empty($_GET['paged']) && is_numeric($_GET['paged']) ? esc_sql($_GET['paged']) : '';
    97 
    98         if(empty($paged) || !is_numeric($paged) || $paged <= 0 ){
    99             $paged = 1;
    100         }
    101 
     98        $paged = !empty($paged) && is_numeric($paged) && $paged > 0 ? esc_sql($paged) : 1;
    10299        $total_pages = ceil($total_items/$per_page);
    103100
    104101        if(!empty($paged) && !empty($per_page)){
    105102            $offset = ($paged - 1) * $per_page;
    106             $query.=' LIMIT '.(int)$offset.','.(int)$per_page;
     103            $query.= ' LIMIT '. $offset . ',' . $per_page;
    107104        }
    108105
    … …  
    119116        global $wpdb;
    120117        $id = (int) $id;
    121         $result = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wpre_emails WHERE id = '$id'");
    122118
    123         if($result){
    124             return $result;
     119        if($id){
     120            $result = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wpre_emails WHERE id = '$id'");
     121
     122            if($result){
     123                return $result;
     124            }
    125125        }
    126126

  • wp-reroute-email/trunk/readme.txt

    r2908808 r2918564  
    22Contributors: msh134
    33Tags: mail, email, developer tool, development server
    4 Tested up to: 6.2
    5 Stable tag: 1.4.8
     4Tested up to: 6.2.2
     5Stable tag: 1.4.9
    66License: GPLv2 or later
    77
    … …  
    3333
    3434== Changelog ==
    35 = 1.4.8 =
     35= 1.4.9 =
    3636* Security fixes.
    3737* Compatibility check.

  • wp-reroute-email/trunk/settings.php

    r2908808 r2918564  
    44    }
    55   
    6     $tab = filter_input(INPUT_GET, 'tab');
     6    $tab = sanitize_text_field(filter_input(INPUT_GET, 'tab'));
    77   
    88    if($_SERVER['REQUEST_METHOD'] == 'POST' && !in_array($tab, ['test', 'log'])){

  • wp-reroute-email/trunk/test.php

    r2908808 r2918564  
    2828            <tr>
    2929                <th scope="row"><?php  esc_html_e('To', 'wp_reroute_email'); ?></th>
    30                 <td><input type="email" name="to_email" size="60" value="[email protected]"></td>
     30                <td><input type="email" name="to_email" size="60" value="<?php esc_attr_e('[email protected]');?>"></td>
    3131            </tr>
    3232            <tr>
    3333                <th scope="row"><?php  esc_html_e('Subject', 'wp_reroute_email'); ?></th>
    34                 <td><input type="text" name="subject" size="60" value="WP Reroute Email Test Message"></td>
     34                <td><input type="text" name="subject" size="60" value="<?php esc_attr_e('WP Reroute Email Test Message');?>"></td>
    3535            </tr>
    3636            <tr>
    3737                <th scope="row"><?php  esc_html_e('Message', 'wp_reroute_email'); ?></th>
    38                 <td><textarea name="message" rows="5" cols="70">This is a test message from WP Reroute Email.</textarea></td>
     38                <td><textarea name="message" rows="5" cols="70"><?php esc_attr_e('This is a test message from WP Reroute Email.');?></textarea></td>
    3939            </tr>
    4040            <tr>

  • wp-reroute-email/trunk/wp-reroute-email.php

    r2908808 r2918564  
    44 * Plugin URI: http://wordpress.org/extend/plugins/wp-reroute-email/
    55 * Description: This plugin intercepts all outgoing emails from a WordPress site and reroutes them to a predefined configurable email address.
    6  * Version: 1.4.8
     6 * Version: 1.4.9
    77 * Author: Sajjad Hossain
    88 * Author URI: http://www.sajjadhossain.com
Note: See TracChangeset for help on using the changeset viewer.