WordPress.org
Get WordPress

Plugin Directory

Changeset 2950391


Ignore:
Timestamp:
08/09/2023 10:19:19 AM (3 years ago)
Author:
shorthandconnect
Message:

Created tag 1.3.29

Location:
shorthand-connect/tags/1.3.29
Files:
4 edited
1 copied

Legend:

Unmodified
Added
Removed

  • shorthand-connect/tags/1.3.29/README.txt

    r2898299 r2950391  
    55Requires at least: 4.0
    66Tested up to: 6.1
    7 Stable tag: 1.3.28
     7Stable tag: 1.3.29
    88Requires PHP: 5.6
    99License: GPLv2 or later
    … …  
    3636  [
    3737    {
    38       "query":  "/<title.(.*?)<\/title>/",
     38      "query": "/<title>(.*?)<\\/title>/",
    3939      "replace":""
    4040    },
    … …  
    6464== Changelog ==
    6565
     66= 1.3.29 =
     67* Security Fixes & Updates
     68* JSON Post-Processing Fixes
     69
    6670= 1.3.28 =
    6771* Code clean up & bug fixes

  • shorthand-connect/tags/1.3.29/includes/api.php

    r2898299 r2950391  
    140140   
    141141    do_action('sh_copy_story', $post_id, $story_id, $story);
    142     unlink($zip_file);
    143    
     142    wp_delete_file($zip_file);
    144143    return $story;
    145144}

  • shorthand-connect/tags/1.3.29/includes/shorthand_options.php

    r2898299 r2950391  
    2626';
    2727
     28// JSON Checker
     29function validate_json($json_string) {
     30    // Try to decode the JSON data. If it fails, the JSON is invalid.
     31    $json_data = json_decode($json_string, true);
     32
     33    if (json_last_error() !== JSON_ERROR_NONE) {
     34        // The JSON is invalid.
     35        return false;
     36    }
     37
     38    // Return the original JSON string if it's valid.
     39    return $json_string;
     40}
     41
    2842function shand_shorthand_options()
    2943{
    … …  
    3549    }
    3650    if( isset($_POST['sh_submit_hidden']) && $_POST['sh_submit_hidden'] == 'Y' && check_admin_referer( 'sh-update-configuration' ) ) {
    37         update_option('sh_v2_token', sanitize_text_field($_POST['sh_v2_token']));
    38     }
     51        //If there's a token set, use it, if not set it to an empty string
     52        $sh_v2_token = isset($_POST['sh_v2_token']) ? sanitize_text_field($_POST['sh_v2_token']) : '';
     53        update_option('sh_v2_token', $sh_v2_token);
     54    }
     55   
    3956    $v2_token = esc_html(get_option('sh_v2_token'));
    4057   
    4158    if( isset($_POST['sh_submit_hidden_two']) && $_POST['sh_submit_hidden_two'] == 'Y' && check_admin_referer( 'sh-update-configuration' ) ) {
    42         update_option('sh_css', wp_kses_post($_POST['sh_css']));
    43     }
    44     if( isset($_POST['sh_submit_hidden_three']) && $_POST['sh_submit_hidden_three'] == 'Y' && check_admin_referer( 'sh-update-configuration' ) ) {
    45         update_option('sh_permalink', sanitize_text_field($_POST['sh_permalink']));
     59        //Check if there's custom CSS, if there is, use wp_kses_post() to sanitize otherwise set an empty string
     60        $sh_css = isset($_POST['sh_css']) ? wp_kses_post($_POST['sh_css']) : '';
     61        update_option('sh_css', $sh_css);
     62    }
     63
     64
     65    // Rather than running a rewrite flush everytime a post is submitted, run it on plugin activate/deactivate
     66    function shand_rewrite_flush() {
    4667        shand_create_post_type();
    4768        flush_rewrite_rules();
     69    }
     70    register_activation_hook( __FILE__, 'shand_rewrite_flush' );
     71    register_deactivation_hook( __FILE__, 'flush_rewrite_rules' );
     72
     73    if( isset($_POST['sh_submit_hidden_three']) && $_POST['sh_submit_hidden_three'] == 'Y' && check_admin_referer( 'sh-update-configuration' ) ) {
     74        //Check if there's custom permalink, if there is, use sanitize_text_field() to sanitize potential HTML and then set an empty string
     75        $sh_permalink = isset($_POST['sh_permalink']) ? sanitize_text_field($_POST['sh_permalink']) : '';
     76        update_option('sh_permalink', $sh_permalink);
     77        shand_rewrite_flush();
    4878    }
    4979    $permalink_structure = esc_html(get_option('sh_permalink'));
    … …  
    6393    }
    6494
    65     if (isset($_POST['sh_submit_hidden_four']) && $_POST['sh_submit_hidden_four'] == 'Y' && check_admin_referer( 'sh-update-configuration' )) {
    66         update_option('sh_regex_list', base64_encode(wp_unslash($_POST['sh_regex_list'])));
    67     }
     95if (isset($_POST['sh_submit_hidden_four']) && $_POST['sh_submit_hidden_four'] == 'Y' && check_admin_referer('sh-update-configuration')) {
     96    $sh_regex_list = isset($_POST['sh_regex_list']) ? wp_unslash($_POST['sh_regex_list']) : '';
     97
     98    if (empty($sh_regex_list)) {
     99        // Update the option with an empty value if the input is empty
     100        update_option('sh_regex_list', '');
     101    } else {
     102        // Validate if it's a valid JSON without sanitizing
     103        $sh_regex_list = validate_json($sh_regex_list);
     104
     105        if ($sh_regex_list !== false) {
     106            // Since we are storing it as base64, no need to sanitize the JSON, as base64_encode will handle that
     107            update_option('sh_regex_list', base64_encode($sh_regex_list));
     108        } else {
     109            // Handle invalid JSON error here.
     110        }
     111    }
     112}
     113
     114
    68115
    69116    $sh_regex_list = base64_decode(get_option('sh_regex_list'));
    … …  
    80127 
    81128    $profile = sh_get_profile();
    82     $n_once = wp_nonce_field( 'sh-update-configuration' );
    83 
    84 ?>
    85     <h3>Shorthand API Configuration</h3>
     129
     130    ob_start();
     131    wp_nonce_field( 'sh-update-configuration' );
     132    $n_once  = ob_get_clean();
     133
     134?> 
     135<div class="container">
     136    <div class="py-1">
     137    <h1>Shorthand API Configuration</h1>
     138    <h2>Shorthand Connect Status</h2>
    86139    <form name="form1" method="post">
    87140        <?php echo $n_once ?>
    … …  
    89142        <table class="form-table"><tbody>
    90143        <tr class="v2row">
    91             <th scope="row"><label for="sh_v2_token"><?php _e("Shorthand Team Token", 'sh-v2-token' ); ?></label></th>
     144            <th scope="row"><label for="sh_v2_token"><?php esc_html_e("Shorthand Team Token", 'sh-v2-token' ); ?></label></th>
    92145            <td><input type="text" id="sh_v2_token" name="sh_v2_token" value="<?php echo esc_attr($v2_token); ?>" size="28"></td>
    93146        </tr>
    94147        </tbody></table>
    95         <p class="submit">
    96             <input type="submit" name="Submit" class="button-primary" value="<?php esc_attr_e('Save Changes') ?>" />
    97         </p>
    98         <hr />
    99     </form>
    100     <h3>Shorthand Connect Status</h3>
    101     <?php if ($profile) { ?>
     148        <?php if ($profile) { ?>
    102149        <p class="status">Successfully connected</p>
    103         <p><strong>Username</strong>: <?php echo $profile->username; ?></p>
     150        <p><strong>Username</strong>: <?php echo esc_html($profile->username); ?></p>
    104151    <?php } else { ?>
    105152        <p class="status warn">Not Connected</p>
    106153    <?php } ?>
    107154    <div style='clear:both'></div>
    108     <h3>Shorthand Permalink Structure</h3>
     155        <p class="submit">
     156            <input type="submit" name="Submit" class="button-primary" value="<?php esc_attr_e('Save Changes') ?>" />
     157        </p>
     158    </form>
     159    </div>
     160
     161
     162    <div class="py-1">
     163    <h2>Shorthand Permalink Structure</h2>
    109164        <p>Use this to set the permalink structure of Shorthand story URLs</p>
    110         <form name="form2" method="post">
     165        <form name="permalinks" method="post">
    111166            <?php echo $n_once ?>
    112167            <input type="hidden" name="sh_submit_hidden_three" value="Y" />
    … …  
    118173            </p>
    119174        </form>
    120 
    121 
    122 
    123     <h3>Shorthand Story Page CSS (theme wide CSS)</h3>
     175    </div>
     176
     177    <div class="py-1">
     178    <h2>Shorthand Story Page CSS (theme wide CSS)</h2>
    124179        <p>Use this CSS to customise Shorthand Story pages to better suit your theme</p>
    125180        <?php if ($no_css) { ?>
    126181            <p class="status warn">No custom CSS found, using default theme CSS</p>
    127182        <?php }?>
    128         <form name="form2" method="post">
     183        <form name="themecss" method="post">
    129184            <?php echo $n_once ?>
    130185            <input type="hidden" name="sh_submit_hidden_two" value="Y" />
    … …  
    134189            </p>
    135190        </form>
    136 
    137     <h3>Post-processing</h3>
     191        </div>
     192
     193    <div class="py-1"> 
     194    <h2>Post-processing</h2>
    138195        <p>Use this to create a JSON object of regex queries and replacements.</p>
    139196        <p><em>This Example removes title tags from within the head tag by replacing it with nothing.</em></p>
    140197<pre><code>
    141   {
    142     "head":
    143     [
    144       {
    145         &quot;query&quot;:&quot;/&lt;title.(.*?)&lt;\/title&gt;/&quot;,
    146         &quot;replace&quot;:&quot;&quot;
    147       }
    148     ],
    149     "body":[]
    150   }
     198{
     199  "head": [
     200    {
     201      &quot;query&quot;: &quot;/&lt;title&gt;(.*?)&lt;\\/title&gt;/&quot;,
     202      &quot;replace&quot;: &quot;&quot;
     203    }
     204  ],
     205  "body": []
     206}
     207
    151208</code></pre>
    152         <form name="form2" method="post" onsubmit="padJson()">
     209        <form name="postprocessing" method="post">
    153210            <?php echo $n_once ?>
    154211            <input type="hidden" name="sh_submit_hidden_four" value="Y" />
    … …  
    160217        <script>
    161218            let textarea = document.querySelector("textarea#sh_regex_list");
    162  
    163             function padJson() {
    164                 console.log('updated JSON');
    165                 textarea.value = textarea.value.replace(/\\/g, '\\\\');
    166             }
    167            
    168            
     219       
    169220            textarea.addEventListener("keyup", function(event) {
    170221                try{
    … …  
    183234            });
    184235        </script>
    185 
    186     <style>
     236    </div>
     237   
     238    <div class="py-1">
     239        <h2>Experimental Features</h2>
     240        <p>Early access features that are still subject to change.</p>
     241        <form name="form_experimental" method="post">
     242        <?php echo $n_once ?>
     243        <input type="hidden" name="sh_submit_hidden_experimental" value="Y" />
     244        <input type="checkbox" id="sh_media_cron_offload" name="sh_media_cron_offload" value="true" <?php echo esc_attr($sh_media_cron_offload ? 'checked' : '') ?> />
     245        <label for="sh_media_cron_offload">Import media assets via cron</label>
     246        <p>Assets will be fetched after story save to prevent potential execution timeouts. Media won't be immediately available on save but progress will be updated based on the `media_status` field.</p>
     247        <p>It is advised that Shorthand Story Posts are saved as a draft first to trigger the cron job prior to public publishing.</p>
     248        <br/>
     249        <input type="checkbox" id="sh_disable_acf" name="sh_disable_acf" value="true" <?php echo esc_attr($sh_disable_acf ? 'checked' : '') ?> />
     250        <label for="sh_disable_acf">Disable Advanced Custom Fields</label>
     251        <p>Used to prevent any potential issues that could cause the Shorthand Custom Fields to become hidden by Advanced Custom Fields.</p>
     252        </br>
     253        <p class="submit">
     254        <input type="submit" name="Submit" class="button-primary" value="<?php esc_attr_e('Save Changes') ?>" />
     255        </p>
     256        </form>
     257        </div>
     258    </div>
     259        </div>
     260<style>
     261        .py-1 {
     262            padding: 1em;
     263        }
     264        .bg-white {
     265            background: white;
     266        }
     267        .container {
     268            max-width: 980px;
     269        }
    187270        img.grav {
    188271            float: left;
    … …  
    205288            display:none;
    206289        }
    207 
     290        #wpfooter {
     291            position: unset;
     292        }
    208293        code {
    209   font-family: monospace;
    210   display: inherit;
    211 }
     294            font-family: monospace;
     295            display: inherit;
     296        }
    212297    </style>
    213298
    214 <h3>Experimental Features</h3>
    215 <p>Early access features that are still subject to change.</p>
    216 <form name="form_experimental" method="post">
    217 <?php echo $n_once ?>
    218 <input type="hidden" name="sh_submit_hidden_experimental" value="Y" />
    219 <input type="checkbox" id="sh_media_cron_offload" name="sh_media_cron_offload" value="true" <?php echo esc_attr($sh_media_cron_offload ? 'checked' : '') ?> />
    220 <label for="sh_media_cron_offload">Import media assets via cron</label>
    221 <p>Assets will be fetched after story save to prevent potential execution timeouts. Media won't be immediately available on save but progress will be updated based on the `media_status` field.</p>
    222 <p>It is advised that Shorthand Story Posts are saved as a draft first to trigger the cron job prior to public publishing.</p>
    223 <br/>
    224 <input type="checkbox" id="sh_disable_acf" name="sh_disable_acf" value="true" <?php echo esc_attr($sh_disable_acf ? 'checked' : '') ?> />
    225 <label for="sh_disable_acf">Disable Advanced Custom Fields</label>
    226 <p>Used to prevent any potential issues that could cause the Shorthand Custom Fields to become hidden by Advanced Custom Fields.</p>
    227 </br>
    228 <p class="submit">
    229 <input type="submit" name="Submit" class="button-primary" value="<?php esc_attr_e('Save Changes') ?>" />
    230 </p>
    231 </form>
     299
    232300<?php
    233301}

  • shorthand-connect/tags/1.3.29/shorthand_connect.php

    r2898299 r2950391  
    33/**
    44 * @package Shorthand Connect
    5  * @version 1.3.28
     5 * @version 1.3.29
    66 */
    77/*
    … …  
    1010Description: Import your Shorthand stories into your Wordpress CMS as simply as possible - magic!
    1111Author: Shorthand
    12 Version: 1.3.28
     12Version: 1.3.29
    1313Author URI: http://shorthand.com
    1414*/
    1515
    16 if (file_exists('config.php')) {
    17     include_once('config.php');
     16if (file_exists( plugin_dir_path( __FILE__) . 'config.php')) {
     17    include_once( plugin_dir_path( __FILE__) . 'config.php');
    1818} else {
    19     require_once('config.default.php');
    20 }
    21 require_once('includes/api.php');
    22 require_once('includes/mass_pull.php');
    23 
    24 require_once('includes/shorthand_options.php');
    25 require_once('templates/abstract.php');
     19    require_once( plugin_dir_path( __FILE__) . 'config.default.php');
     20}
     21require_once( plugin_dir_path( __FILE__) . 'includes/api.php');
     22require_once( plugin_dir_path( __FILE__) . 'includes/mass_pull.php');
     23
     24require_once( plugin_dir_path( __FILE__) . 'includes/shorthand_options.php');
     25require_once( plugin_dir_path( __FILE__) . 'templates/abstract.php');
    2626
    2727if ( !function_exists('WP_Filesystem') ) {
    … …  
    341341    }
    342342
    343     if (!$noabstract && isset($_REQUEST['abstract'])) {
    344         update_post_meta($post_id, 'abstract', wp_kses_post($_REQUEST['abstract']));
    345     } else if ($noabstract && get_post_meta($post_id, 'abstract')) {
    346         delete_post_meta($post_id, 'abstract');
    347     }
    348 
    349     if (!get_post_meta($post_id, 'no_update')) {
    350         update_post_meta($post_id, 'no_update', "false");
    351     }
    352 
    353     if (isset($_REQUEST['extra_html'])) {
    354         update_post_meta($post_id, 'extra_html', wp_kses_post($_REQUEST['extra_html']));
    355     }
    356    
    357     $do_update_story = isset($_REQUEST['shand_update']) || get_post_meta($post_id, 'no_update')[0] !== "true";
     343    //Check if these fields are nonce_verified
     344    if (isset($_POST['eventmeta_noncename']) && wp_verify_nonce(sanitize_text_field($_POST['eventmeta_noncename']), plugin_basename(__FILE__))) {
     345        if (!$noabstract && isset($_REQUEST['abstract'])) {
     346            update_post_meta($post_id, 'abstract', wp_kses_post($_REQUEST['abstract']));
     347        } else if ($noabstract && get_post_meta($post_id, 'abstract')) {
     348            delete_post_meta($post_id, 'abstract');
     349        }
     350   
     351        if (!get_post_meta($post_id, 'no_update')) {
     352            update_post_meta($post_id, 'no_update', "false");
     353        }
     354
     355        if (isset($_REQUEST['extra_html'])) {
     356            update_post_meta($post_id, 'extra_html', wp_kses_post($_REQUEST['extra_html']));
     357        }
     358    }
     359   
     360    $do_update_story = isset($_REQUEST['shand_update']) || get_post_meta($post_id, 'no_update', true) !== "true";
    358361   
    359362    if (isset($_REQUEST['story_id']) && $_REQUEST['story_id'] !== "" && $do_update_story) {
    360363        update_post_meta($post_id, 'no_update', "true");
    361364        $sh_media_cron_offload = filter_var(get_option('sh_media_cron_offload'), FILTER_VALIDATE_BOOLEAN);
    362         $safe_story_id = preg_replace("/\W|_/", '', $_REQUEST['story_id']);
     365
     366        //Sanitize but also check if the query is GET or POST
     367        if (isset($_REQUEST['story_id'])) {
     368            $story_id = filter_input(INPUT_GET, 'story_id', FILTER_SANITIZE_STRING);
     369            if ($story_id === null) { // If the variable is not present in the $_GET array
     370                $story_id = filter_input(INPUT_POST, 'story_id', FILTER_SANITIZE_STRING);
     371            }
     372            $safe_story_id = preg_replace("/\W|_/", '', $story_id);
     373        }
     374       
     375
    363376        update_post_meta($post_id, 'story_id', sanitize_text_field($safe_story_id));
    364377        $err = sh_copy_story($post_id, $safe_story_id, $sh_media_cron_offload);
    365378        $story_path = sh_get_story_path($post_id, $safe_story_id);
     379       
    366380        //Sometimes the story needs to be gotten twice
    367381        if (!isset($story_path)) {
    … …  
    482496add_action('wp_head', 'hook_css');
    483497
    484 
    485498/* Get Posts Hook */
    486499function shand_shorthand_get_posts($query)
    487500{
    488     if (is_home() && $query->is_main_query()) {
    489         $query->set( 'post_type', array( 'post', 'shorthand_story' ) );
    490     }
    491     return $query;
     501    if (is_admin()) {
     502        return $query;
     503    }
     504
     505    // Check if the query is the main query and it's for the front-end
     506    if ($query->is_main_query() && !is_admin()) {
     507        $queried_object = get_queried_object();
     508        $shorthand_templates = array('single-shorthand_story.php', 'templates/single-shorthand_story.php', 'template-parts/single-shorthand_story.php');
     509
     510        // Check if the queried object uses a Shorthand Post template from the array
     511        if ($queried_object
     512            && isset($queried_object->ID)
     513            && in_array(get_page_template_slug($queried_object->ID), $shorthand_templates)) {
     514           
     515            // Get the current post type(s)
     516            $post_type = $query->get('post_type');
     517           
     518            // If the post type hasn't been modified, then add the shorthand post type
     519            if (empty($post_type) || $post_type == 'post') {
     520                $query->set('post_type', array('post', 'shorthand_story'));
     521            }
     522        }
     523    }
     524    return $query;
    492525}
    493526add_filter('pre_get_posts', 'shand_shorthand_get_posts');
    … …  
    519552function shand_shorthand_activate()
    520553{
     554    flush_rewrite_rules();
    521555    shand_create_post_type();
    522     flush_rewrite_rules();
    523556}
    524557register_activation_hook(__FILE__, 'shand_shorthand_activate');
    … …  
    562595    $extra_html = get_post_meta($post->ID, 'extra_html', true);
    563596    echo '<input type="hidden" name="eventmeta_noncename" id="eventmeta_noncename" value="' .
    564         wp_create_nonce(plugin_basename(__FILE__)) . '" />';
     597        esc_attr(wp_create_nonce(plugin_basename(__FILE__))) . '" />';
    565598    echo '<textarea id="codearea" name="extra_html">' . esc_textarea($extra_html) . '</textarea>';
    566599}
Note: See TracChangeset for help on using the changeset viewer.