Changeset 2986331

Timestamp:

10/30/2023 05:34:29 PM (2 years ago)

Author:

sevenspark

Message:

Committing 1.4.3 to trunk

Location:

bellows-accordion-menu/trunk

Files:

• admin/assets/css/admin.control-panel.css (modified) (1 diff)
• bellows-accordion-menu.php (modified) (2 diffs)
• includes/bellows.api.php (modified) (11 diffs)
• includes/functions.php (modified) (4 diffs)
• languages/bellows.pot (modified) (2 diffs)
• readme.txt (modified) (2 diffs)

bellows-accordion-menu/trunk/admin/assets/css/admin.control-panel.css

@@ -91 +91 @@
   text-shadow: 0 -1px 1px rgba(0, 0, 0, 0.2), 1px 0 1px rgba(0, 0, 0, 0.2),
     0 1px 1px rgba(0, 0, 0, 0.2), -1px 0 1px rgba(0, 0, 0, 0.2);
+}
+.wp-core-ui .ssmenu-wrap .button-primary:focus,
+.wp-core-ui .ssmenu-wrap .button-tertiary:focus {
+  outline: 2px solid #4997ea;
+  outline-offset: 2px;
 }
 .wp-core-ui .ssmenu-wrap .button-tertiary {

bellows-accordion-menu/trunk/bellows-accordion-menu.php

@@ -5 +5 @@
  * Plugin URI:        http://getbellows.com
  * Description:       A flexible and robust WordPress accordion menu plugin
- * Version:           1.4.2
+ * Version:           1.4.3
  * Requires at least: 5.0
  * Requires PHP:      7.4
  * Author:            SevenSpark
- * Author URI:        http://sevenspark.com
+ * Author URI:        https://sevenspark.com
  * Text Domain:       bellows
  * Domain Path:       /languages
@@ -16 +16 @@
 if( ! defined( 'WPINC' ) ) die;         // If this file is called directly, abort.
 
-if( ! defined( 'BELLOWS_VERSION' ) )    define( 'BELLOWS_VERSION',  '1.4.2' );
+if( ! defined( 'BELLOWS_VERSION' ) )    define( 'BELLOWS_VERSION',  '1.4.3' );
 if( ! defined( 'BELLOWS_PRO' ) )        define( 'BELLOWS_PRO' ,     false );
 

bellows-accordion-menu/trunk/includes/bellows.api.php

@@ -3 +3 @@
 function bellows_menu_toggle( $menu_id, $content, $btn_class, $args ){
     $content = apply_filters( 'bellows_menu_toggle_content', $content, $menu_id, $args );
-    $btn = '<button class="bellows-menu-toggle '.$btn_class.'" aria-controls="'.$menu_id.'">'.$content.'</button>';
+    $btn = '<button class="bellows-menu-toggle '.esc_attr($btn_class).'" aria-controls="'.esc_attr($menu_id).'">'.$content.'</button>';
     return apply_filters( 'bellows_menu_toggle', $btn, $menu_id, $args );
 }
@@ -16 +16 @@
 function bellows( $config_id = 'main' , $menu_args = [] ){
 
+    $config_id = bellows_validate_config_id( $config_id );
+
     _BELLOWS()->set_current_config_id( $config_id );
 
     $menu_args['bellows_source'] = 'menu'; // Default source
     $args = bellows_get_nav_menu_args( $config_id , $menu_args );
-
-    // Should the toggle and menu be printed
-    $print = isset( $args['echo'] ) ? $args['echo'] : true;
-
-    // Get the toggle based on config settings
-    $toggle = bellows_menu_toggle_default( $args['container_id'], $config_id, $args );
-
-    // If we're printing, print the toggle.
-    if( $print ){
-        echo $toggle;
-    }
+    $toggle = bellows_output_responsive_toggle($config_id, $args);
 
     // Generate the menu (wp_nav_menu will print if we're printing)
@@ -47 +39 @@
         'theme_location'    => '',
         'menu'              => '',
-
-
     ), $atts));
 
+    
     $args = array();
     $args['echo'] = false;
@@ -71 +62 @@
  */
 function bellows_section( string $config_id, array $menu_args, array $section_args ){
+
+    $config_id = bellows_validate_config_id( $config_id );
 
     if( !BELLOWS_PRO ){
@@ -93 +86 @@
     $args['container_id'] = 'bellows-'.$config_id.'-'.sanitize_key( $menu_args['menu'] ).'-section-'.$section_args['root'];
 
-    // Should the toggle and menu be printed
-    $print = isset( $args['echo'] ) ? $args['echo'] : true;
-
-    // Get the toggle based on config settings
-    $toggle = bellows_menu_toggle_default( $args['container_id'], $config_id, $args );
-
-    // If we're printing, print the toggle.
-    if( $print ){
-        echo $toggle;
-    }
+    // // Should the toggle and menu be printed
+    // $print = isset( $args['echo'] ) ? $args['echo'] : true;
+
+    // // Get the toggle based on config settings
+    // $toggle = bellows_menu_toggle_default( $args['container_id'], $config_id, $args );
+
+    // // If we're printing, print the toggle.
+    // if( $print ){
+    //  echo $toggle;
+    // }
+
+    $toggle = bellows_output_responsive_toggle($config_id, $args);
 
     // Generate the menu (wp_nav_menu will print if we're printing)
@@ -152 +147 @@
         );
     }
+
+    $config_id = bellows_validate_config_id( $config_id );
 
     // If 'taxonomies' is passed, convert to 'taxonomy'
@@ -201 +198 @@
     // bellp( $menu_args );
 
+    $toggle = bellows_output_responsive_toggle($config_id, $menu_args);
+
     //add_filter( 'wp_get_nav_menu_items' , 'bellows_populate_terms' , 10, 3 );
     add_filter( 'wp_nav_menu_objects' , 'bellows_populate_terms' , 10, 2 );
@@ -209 +208 @@
     //TODO: ECHO OR RETURN CHECK
 
-    return $menu;
+    return $toggle . $menu;
 }
 
@@ -278 +277 @@
         );
     }
+
+    $config_id = bellows_validate_config_id( $config_id );
 
     $post_arg_defaults = array(
@@ -344 +345 @@
     $menu_args = bellows_get_nav_menu_args( $config_id , $menu_args );
 
+    $toggle = bellows_output_responsive_toggle($config_id, $menu_args);
+
     //bellp( get_term( 73, 'nav_menu' ) );
 
@@ -357 +360 @@
 
     //TODO: ECHO OR RETURN CHECK
-    return $menu;
+    return $toggle.$menu;
 
 }

bellows-accordion-menu/trunk/includes/functions.php

@@ -6 +6 @@
 
 function bellows_get_nav_menu_args( $config_id , $args = array() ){
+
+    // Config ID should be pre-validated
 
     $args['container']          = bellows_op( 'container_tag' , $config_id );
@@ -43 +45 @@
     _BELLOWS()->count_menu_instance( $nav_menu_id );
 
-    //ID
+    //ID (Config ID is pre-validated and pre-escaped)
     $args['container_id']       = 'bellows-'.$config_id.'-'.sanitize_key( $nav_menu_id );
     if( $theme_location ){
@@ -60 +62 @@
 
     //Config
-    $args['container_class']    .= ' bellows-'.$config_id;
+    $args['container_class']    .= ' bellows-'.$config_id; // Already escaped
 
     //Source
@@ -253 +255 @@
 
 
+function bellows_output_responsive_toggle($config_id, $args){
+    // Should the toggle and menu be printed
+    $print = isset( $args['echo'] ) ? $args['echo'] : true;
+
+    // Get the toggle based on config settings
+    $toggle = bellows_menu_toggle_default( $args['container_id'], $config_id, $args );
+
+    // If we're printing, print the toggle.
+    if( $print ){
+        echo $toggle;
+    }
+
+    return $toggle;
+}
+
+
+/**
+ * Validates that the passed config ID matches an existing configuration, 
+ * after escaping unsafe characters that may have been passed
+ * 
+ * If the config is invalid, returns the default configuration
+ * 
+ */
+function bellows_validate_config_id( $config_id, $default = 'main' ){
+
+    // Escape the string to defend against XSS attacks
+    $config_id = esc_attr( $config_id );
+
+    // If this is the main ID, we don't actually need to query the DB, as this always exists
+    if( $config_id === 'main' ){
+        return $config_id;
+    }
+
+    // Find the valid configurations
+    $valid_configs = bellows_get_menu_configurations();
+
+    // If the ID matches a valid configuration, we're good to go
+    if( in_array( $config_id, $valid_configs ) ){
+        return $config_id;
+    }
+
+    // If not, return a valid config (main by default)
+    return $default;
+}
+
 
 function bellp( $d ){

bellows-accordion-menu/trunk/languages/bellows.pot

@@ -3 +3 @@
 msgid ""
 msgstr ""
-"Project-Id-Version: Bellows Pro - Accordion Menu 1.4.2\n"
+"Project-Id-Version: Bellows Pro - Accordion Menu 1.4.3\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/bellows-pro\n"
-"POT-Creation-Date: 2023-02-03 20:49:52+00:00\n"
+"POT-Creation-Date: 2023-10-30 17:08:51+00:00\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=utf-8\n"
@@ -280 +280 @@
 msgstr ""
 
-#: includes/functions.php:93 includes/widget.php:169
+#: includes/functions.php:95 includes/widget.php:169
 #: pro/admin/settings.control-panel.generator.php:346
 msgid "Menu"

bellows-accordion-menu/trunk/readme.txt

@@ -4 +4 @@
 Tags: menu, navigation, accordion, images, widgets, icons, shortcodes, responsive, expand, toggle, reveal, accordian
 Requires at least: 5.0
-Tested up to: 6.1.1
+Tested up to: 6.3.2
 Requires PHP: 7.4
-Stable tag: 1.4.2
+Stable tag: 1.4.3
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -57 +57 @@
 
 == Changelog ==
+
+= 1.4.3 =
+
+* Security: Fix XSS vulnerability - Authenticated (Contributor+) Stored cross-site scripting via shortcode
 
 = 1.4.2 =