Changeset 2999517

Timestamp:

11/21/2023 11:00:25 AM (2 years ago)

Author:

jorisvanmontfort

Message:

1.2.6

Location:

jvm-rich-text-icons/trunk

Files:

• plugin.php (modified) (2 diffs)
• readme.txt (modified) (1 diff)
• views/icon-list.php (modified) (2 diffs)
• views/uploader.php (modified) (2 diffs)

jvm-rich-text-icons/trunk/plugin.php

@@ -3 +3 @@
  * Plugin Name: JVM rich text icons
  * Description: Add Font Awesome icons, or icons from a custom icon set to the Gutenberg editor.
- * Version: 1.2.5
+ * Version: 1.2.6
  * Author: Joris van Montfort
  * Author URI: https://jorisvm.nl
@@ -11 +11 @@
  * @category Gutenberg
  * @author Joris van Montfort
- * @version 1.2.5
+ * @version 1.2.6
  * @package JVM rich text icons
  */

jvm-rich-text-icons/trunk/readme.txt

@@ -88 +88 @@
 == Changelog ==
 
-= 1.2.5 =
-Security update. Fixed a vulnerability issue in plugin settings delete icon option.
-
-= 1.2.4 =
-Security update. Fixed a vulnerability issue in the uploader and plugin settings.
+= 1.2.6 =
+Security update. Fixed a vulnerabilities in plugin settings upload and delete icon options.
 
 = 1.2.3 =

jvm-rich-text-icons/trunk/views/icon-list.php

@@ -5 +5 @@
 <?php
     $css_class = JVM_Richtext_icons::get_class_prefix();
+    $nonce = wp_create_nonce( 'jvm-rich-text-icons-delete-icon' );
     foreach ($files as $file) {
         $pi = pathinfo($file);
@@ -10 +11 @@
         $icon_class = sanitize_title($pi['filename']);
 
-        echo '<a id="icon-dialog-link-'.$icon_class.'" href="#icon-dialog" class="icon-dialog-link icon" data-icon-class-full="'.$css_class . ' ' . $icon_class .'" data-icon-class="'. $icon_class .'" data-file="'.esc_js(basename($file)).'">';
+        echo '<a id="icon-dialog-link-'.$icon_class.'" href="#icon-dialog" class="icon-dialog-link icon" data-icon-class-full="'.$css_class . ' ' . $icon_class .'" data-icon-class="'. $icon_class .'" data-file="'.esc_js(basename($file)).'" data-nonce="'.$nonce.'">';
         echo '<i class="' . $css_class . ' ' . $icon_class . '" aria-hidden="true"> </i>';
         echo '</a>'."\n";

jvm-rich-text-icons/trunk/views/uploader.php

@@ -8 +8 @@
 
 $form_class = 'media-upload-form type-form validate';
+$nonce = wp_create_nonce( 'jvm-rich-text-icons-upload-icon' );
 
 if ( get_user_setting( 'uploader' ) || isset( $_GET['browser-uploader'] ) ) {
@@ -33 +34 @@
     </div>
 </div>
-<form id="jvm-rich-text-icons_custom_icon_uploader" action="<?php echo admin_url( 'admin-ajax.php' );?>?action=jvm-rich-text-icons-upload-icon" class="dropzone" style="display: none;">
+<form id="jvm-rich-text-icons_custom_icon_uploader" action="<?php echo admin_url( 'admin-ajax.php' );?>?action=jvm-rich-text-icons-upload-icon&nonce=<?php echo $nonce;?>" class="dropzone" style="display: none;">
     <div class="media-frame wp-core-ui mode-grid">
         <div class="uploader-inline">