Changeset 3124882

Timestamp:

07/25/2024 12:41:19 AM (19 months ago)

Author:

123host

Message:

Fix XSS vulnerability

Location:

speakout/trunk

Files:

• includes/emailpetition.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• speakout-email-petitions.php (modified) (2 diffs)

speakout/trunk/includes/emailpetition.php

@@ -139 +139 @@
             $progress_width = ( $options[ 'petition_theme' ] == 'basic' ) ? 300 : 200; // defaults
             $progress_width = isset( $attr[ 'progresswidth' ] ) ? $attr[ 'progresswidth' ] : $progress_width;
+            
+            // Function to detect potential JavaScript in shorcode
+            function contains_js($input) {
+                $pattern = '/(javascript|on\w+|<script|<\/script|<\?|<\w+[^>]*\s*on\w+\s*=\s*["\']?[^>"\']+["\']?)/i';
+                return preg_match($pattern, $input);
+            }
+
+            // Validate and sanitize shortcode attributes
+            if (isset( $attr['width']) && contains_js($attr['width']) || 
+                isset( $attr['height']) && contains_js($attr['height']) || 
+                isset( $attr['css_classes']) && contains_js($attr['css_classes']  ) || 
+                isset( $attr['progresswidth']) && contains_js($attr['progresswidth'])) {
+                // Handle potential injection attempt
+                die('Invalid javascript detected in shortcode');
+            }
 
             if ( !$expired ) {

speakout/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 6.5
 Requires PHP: 7.4
-Stable tag: 4.3.6
+Stable tag: 4.4.0
 License: GPLv2 or later 
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -22 +22 @@
 
 == Changelog ==
+
+== 4.4.0 ==
+
+* bug fix: fixed XSS vulnerability in specially crafter shortcode - thanks Darius S. @ patchstack.com
 
 == 4.3.6 ==

speakout/trunk/speakout-email-petitions.php

@@ -16 +16 @@
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
-Version: 4.3.6
+Version: 4.4.0
 
 {Plugin Name} is free software: you can redistribute it and/or modify
@@ -34 +34 @@
 $db_petitions  = $wpdb->prefix . 'dk_speakout_petitions';
 $db_signatures = $wpdb->prefix . 'dk_speakout_signatures';
-$dk_speakout_version = '4.3.6';
+$dk_speakout_version = '4.4.0';
 
 // enable localizations