WordPress.org
Get WordPress

Plugin Directory

Changeset 2981645


Ignore:
Timestamp:
10/20/2023 10:50:31 AM (2 years ago)
Author:
amadercode
Message:
  1. Security bug and plugin version updated
Location:
wp-amazon-shop/trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • wp-amazon-shop/trunk/includes/import/wp-amazon-shop-import.php

    r2770027 r2981645  
    8888                            if(!empty($categories)){
    8989                                foreach ( $categories['categories'] as $index => $category ) {
    90                                     echo '<option value="'.$index.'">'.$category.'</option>';
     90                                    echo '<option value="' . esc_attr($index) . '">' . esc_html($category) . '</option>';
    9191                                }
    9292                            }
    … …  
    126126                            if(!empty($wpas_woo_categories)){
    127127                                foreach ( $wpas_woo_categories as $category ) {
    128                                     echo '<option value="'.$category->name.'">'.$category->name.'</option>';
     128                                    echo '<option value="'.esc_attr($category->name).'">'.esc_html($category->name).'</option>';
    129129                                }
    130130                            }
    … …  
    782782                            <span class="amazon-product-prime"></span>
    783783                        <?php } ?>
    784                         <img src="<?php echo $product['ImageUrl']; ?>" alt="Product">
     784                        <img src="<?php echo esc_url($product['ImageUrl']); ?>" alt="<?php echo esc_attr('Product'); ?>">
    785785                    </div>
    786786                </td>
    787                 <td class="wpas-import-title" >
    788                     <p class="field_text"><?php echo str_replace("\'", "", $product['Title']); ?> </p>
    789                     <p class="field_text"><a href="<?php echo esc_url_raw($product['DetailPageURL']); ?>?tag=<?php echo $affiliate_tag;  ?>" target="_blank" class="link_to_source product_url"><?php _e('Amazon Product page', 'wp-amazon-shop') ?></a></p>
    790                 <td class="wpas-import-asin" > <strong><?php echo $product['ASIN'];?></strong></td>
     787                <td class="wpas-import-title">
     788                    <p class="field_text"><?php echo esc_html(str_replace("\'", "", $product['Title'])); ?></p>
     789                    <p class="field_text"><a href="<?php echo esc_url($product['DetailPageURL'] . '?tag=' . esc_attr($affiliate_tag)); ?>" target="_blank" class="link_to_source product_url"><?php _e('Amazon Product page', 'wp-amazon-shop'); ?></a></p></td>
     790                <td class="wpas-import-asin"><strong><?php echo esc_html($product['ASIN']); ?></strong></td>
    791791                <td class="wpas-import-price">
    792                     <p class="field_text"><?php echo $product['Price'];?></strong></p>
     792                    <p class="field_text"><?php echo esc_html($product['Price']); ?></p>
    793793                </td>
    794794                <td class="wpas-import-rating-review" >
    … …  
    802802                        $rating_class="a-star-".$formatted_rating;
    803803                        ?>
    804                         <div class="amazon-product-rating" data-product-asin="<?php echo $product['ASIN']; ?>">
    805                             <i class="a-icon a-icon-star <?php echo $rating_class?>"><span class="a-icon-alt"><?php echo $product['Rating']; ?> <?php _e('out of 5 stars', 'wp-amazon-shop') ?></span></i>
    806                             <p>( <a href="<?php echo esc_url_raw($product['DetailPageURL']); ?>?tag=<?php echo $affiliate_tag;  ?>#dp-summary-see-all-reviews" target="_blank"><?php echo $product['TotalReviews'] ;?></a>)</p>
     804                        <div class="amazon-product-rating" data-product-asin="<?php echo esc_attr($product['ASIN']); ?>">
     805                            <i class="a-icon a-icon-star <?php echo esc_attr($rating_class); ?>"><span class="a-icon-alt"><?php echo esc_html($product['Rating']); ?> <?php _e('out of 5 stars', 'wp-amazon-shop'); ?></span></i>
     806                            <p>(<a href="<?php echo esc_url($product['DetailPageURL'] . '?tag=' . esc_attr($affiliate_tag) . '#dp-summary-see-all-reviews'); ?>" target="_blank"><?php echo esc_html($product['TotalReviews']); ?></a>)</p>
    807807                        </div>
    808808                    <?php } ?>
    809809                </td>
    810810                <td class="wpas-import-action">
    811                     <button type="button" wpas-import-data="<?php echo $import_data;?>" class="button button-primary button-small wpas-item-import-btn"><?php _e('Import to WooCommerce', 'wp-amazon-shop') ?></button>
     811                    <button type="button" wpas-import-data="<?php echo esc_attr($import_data);?>" class="button button-primary button-small wpas-item-import-btn"><?php _e('Import to WooCommerce', 'wp-amazon-shop') ?></button>
    812812                    <p class="wpas-import-success-action"></p>
    813813                </td>
    … …  
    825825        global $wp_error;
    826826        $response = array();
    827         $sku = sanitize_text_field( $_POST['sku']);
    828         $title = str_replace("\'", "", sanitize_text_field($_POST['title']));
    829         $price = wpas_clean($_POST['price']);
    830         $product_url = esc_url_raw( $_POST['amazon_url']);
    831         $image_url = esc_url_raw($_POST['image']);
     827        $sku = sanitize_text_field(isset($_POST['sku']) ? $_POST['sku'] : '');
     828        $title = sanitize_text_field(isset($_POST['title']) ? $_POST['title'] : '');
     829        $price = floatval(isset($_POST['price']) ? $_POST['price'] : 0.0);
     830        $product_url = esc_url_raw(isset($_POST['amazon_url']) ? $_POST['amazon_url'] : '');
     831        $image_url = esc_url_raw(isset($_POST['image']) ? $_POST['image'] : '');
    832832        $product_id = wc_get_product_id_by_sku($sku);
    833833        if ($product_id) {
    … …  
    838838            if($this->wpas_capabitlity()){
    839839                //inserting functionality
     840                $post_content = $title . '<br><img src="' . esc_url($image_url) . '" alt="' . esc_attr($title) . '"><br><br><a href="' . esc_url($product_url) . '" target="_blank">Product Link</a>';
    840841                $post = array(
    841842                    'post_author' => 1,
    842                     'post_content' => $title . '<br><img src="' . $image_url . '" alt="' . $title . '"><br> <br>  <a href="' . esc_url_raw($product_url) . '"  target="_blank">Product Link</a>',
     843                    'post_content' =>$post_content,
    843844                    'post_status' => "publish",
    844845                    'post_title' => $title,
    … …  
    880881                        $upload_dir = wp_upload_dir(); // Set upload folder
    881882                        $image_data = file_get_contents($big_image_url); // Get image data
     883
    882884                        $unique_file_name = wp_unique_filename($upload_dir['path'], $image_name); // Generate unique name
    883885                        $filename = basename($unique_file_name); // Create image file name
    884 
    885                         // Check folder permission and define file location
    886                         if (wp_mkdir_p($upload_dir['path'])) {
    887                             $file = $upload_dir['path'] . '/' . $filename;
    888                         } else {
    889                             $file = $upload_dir['basedir'] . '/' . $filename;
    890                         }
    891 
    892                         // Create the image  file on the server
    893                         file_put_contents($file, $image_data);
    894 
    895                         // Check image file type
    896                         $wp_filetype = wp_check_filetype($filename, null);
    897 
    898                         // Set attachment data
    899                         $attachment = array(
    900                             'post_mime_type' => $wp_filetype['type'],
    901                             'post_title' => sanitize_file_name($filename),
    902                             'post_content' => '',
    903                             'post_status' => 'inherit'
    904                         );
    905 
    906                         // Create the attachment
    907                         $attach_id = wp_insert_attachment($attachment, $file, $post_id);
    908 
    909                         // Include image.php
    910                         require_once(ABSPATH . 'wp-admin/includes/image.php');
    911 
    912                         // Define attachment metadata
    913                         $attach_data = wp_generate_attachment_metadata($attach_id, $file);
    914 
    915                         // Assign metadata to attachment
    916                         wp_update_attachment_metadata($attach_id, $attach_data);
    917 
    918                         // And finally assign featured image to post
    919                         $set_thumb = set_post_thumbnail($post_id, $attach_id);
    920                         if ($set_thumb != false) {
    921                             $response['status'] = 200;
    922                             $response['success_action'] = '<a href="' . get_admin_url() . '/post.php?post=' . $post_id . '&action=edit" target="_blank">' . __('Edit', 'wp-amazon-shop') . '</a> | <a href="' . get_permalink($post_id) . '" target="_blank">' . __('View', 'wp-amazon-shop') . '</a>';
    923                             $response['message'] = __('Imported successfully', 'wp-amazon-shop');
     886                        //Allow following images type only to upload but other file type.
     887                        $allowed_file_types = array( 'image/jpeg', 'image/png', 'image/gif' ); // Define allowed image types
     888                        $file_info = new finfo(FILEINFO_MIME_TYPE);
     889                        $file_type = $file_info->buffer($image_data);
     890                        if (in_array($file_type, $allowed_file_types)) {
     891                            // Check folder permission and define file location
     892                            if (wp_mkdir_p($upload_dir['path'])) {
     893                                $file = $upload_dir['path'] . '/' . $filename;
     894                            } else {
     895                                $file = $upload_dir['basedir'] . '/' . $filename;
     896                            }
     897
     898                            // Create the image  file on the server
     899                            file_put_contents($file, $image_data);
     900
     901                            // Check image file type
     902                            $wp_filetype = wp_check_filetype($filename, null);
     903
     904                            // Set attachment data
     905                            $attachment = array(
     906                                'post_mime_type' => $wp_filetype['type'],
     907                                'post_title' => sanitize_file_name($filename),
     908                                'post_content' => '',
     909                                'post_status' => 'inherit'
     910                            );
     911
     912                            // Create the attachment
     913                            $attach_id = wp_insert_attachment($attachment, $file, $post_id);
     914
     915                            // Include image.php
     916                            require_once(ABSPATH . 'wp-admin/includes/image.php');
     917
     918                            // Define attachment metadata
     919                            $attach_data = wp_generate_attachment_metadata($attach_id, $file);
     920
     921                            // Assign metadata to attachment
     922                            wp_update_attachment_metadata($attach_id, $attach_data);
     923
     924                            // And finally assign featured image to post
     925                            $set_thumb = set_post_thumbnail($post_id, $attach_id);
     926                            // if ($set_thumb != false) {
     927                                $response['status'] = 200;
     928                                $response['success_action'] = '<a href="' . get_admin_url() . '/post.php?post=' . $post_id . '&action=edit" target="_blank">' . __('Edit', 'wp-amazon-shop') . '</a> | <a href="' . get_permalink($post_id) . '" target="_blank">' . __('View', 'wp-amazon-shop') . '</a>';
     929                                $response['message'] = __('Imported successfully', 'wp-amazon-shop');
    924930                        } else {
    925931                            $response['status'] = 200;

  • wp-amazon-shop/trunk/includes/wp-amazon-shop-admin-api.php

    r2770027 r2981645  
    307307     * @return void
    308308     */
    309     public function display_meta_box_field ( $field = array(), $post ) {
     309    public function display_meta_box_field ( $field = array(), $post=null ) {
    310310
    311311        if ( ! is_array( $field ) || 0 == count( $field ) ) return;

  • wp-amazon-shop/trunk/readme.txt

    r2770027 r2981645  
    11=== Dropshipping & Affiliation with Amazon ===
    2 Contributors: amadercode
     2Contributors: amadercode,ttareq10
    33Donate link: https://www.amadercode.com
    44Tags: amazon, amazon shop,affiliate,amazon affiliate, dropship, amazon dropship,amazon product search, amazon product import,amazon product auto link
    55Requires at least: 4.4
    6 Tested up to: 6.0.1
     6Tested up to: 6.3.2
    77WC requires at least: 4.0
    8 WC tested up to: 6.7.0
    9 Stable tag: 2.1.1
     8WC tested up to: 8.2.1
     9Stable tag: 2.1.3
    1010Requires PHP: 5.6.0
    1111License: GPLv2 or later

  • wp-amazon-shop/trunk/wp-amazon-shop.php

    r2770027 r2981645  
    88 * Author URI: http://www.amadercode.com/
    99 * Requires at least: 4.4
    10  * Tested up to: 6.0.1
     10 * Tested up to: 6.3.2
    1111 * WC requires at least: 3.0
    12  * WC tested up to: 6.7.0
    13  * Stable tag: 2.1.2
     12 * WC tested up to:  8.2.1
     13 * Stable tag: 2.1.3
    1414 * Text Domain: wp-amazon-shop
    1515 * Domain Path: /lang/
Note: See TracChangeset for help on using the changeset viewer.