Changeset 2984506

Timestamp:

10/26/2023 03:06:02 PM (2 years ago)

Author:

93digital

Message:

Security issue patched and tested with WP version 6.3.2

Location:

animated-typing-effect/trunk

Files:

• README.txt (modified) (2 diffs)
• typingeffect.php (modified) (2 diffs)

animated-typing-effect/trunk/README.txt

@@ -3 +3 @@
 Tags: animated typing effect, typewriter effect, typing effect plugin
 Requires at least: 3.5
-Tested up to: 5.4
+Tested up to: 6.3.2
 Stable tag: trunk
 License: GPL v3
@@ -52 +52 @@
 == Changelog ==
 
+= 1.3.7 =
+* Security patch. Tested with WordPress v6.3.2
+
 = 1.3.6 = 
 * Plugin abandoned and not longer supported! We are keeping it publicly available due to its popularity. We hope to start developing a v2 in the coming year or so.

animated-typing-effect/trunk/typingeffect.php

@@ -2 +2 @@
 /**
  * Plugin Name: Typing Effect
- * Version: 1.3.6
+ * Version: 1.3.7
  * Plugin URI: http://93digital.co.uk/
  * Description: Animated typing effect plugin, allowing you to generate a shortcode that 'types' out words on your page or post. Based on Typed.js by Matt Boldt.
@@ -84 +84 @@
     $options = array();
 
+    /**
+     * List of allowed attributes.
+     *
+     * @version 1.3.7
+     */
+    $allowed_settings = [
+      'typespeed',
+      'startdelay',
+      'backspeed',
+      'backdelay',
+      'loopcount',
+      'loop',
+      'shuffle',
+    ];
+
     //WP Convert the parameters in lowercase format, but I need in camel case
     $params = array(
       'typespeed' => 'type-speed',
       'backdelay' => 'back-delay',
+      'backspeed' => 'back-speed',
       'startdelay' => 'start-delay',
       'loopcount' => 'loop-count',
       'shuffle' => 'shuffle',
     );
-
+    
     //Generate the javascript code
     foreach( $atts as $key => $value ) {
+      if ( strpos( $key, 'string' ) !== 0 && ! in_array( $key, $allowed_settings ) ) {
+        // Attribute not recognised so skip adding it as a HTML attr.
+        continue;
+      }
       $key = isset( $params[ $key ] ) ? $params[$key] : $key;
-      $span .= " data-{$key}=\"" . $value . '"';
+      $span .= " data-{$key}=\"" . esc_attr( $value ) . '"';
     }