WordPress.org
Get WordPress

Plugin Directory

Changeset 3174179


Ignore:
Timestamp:
10/23/2024 09:34:30 AM (15 months ago)
Author:
platformlycom
Message:

Security fix. Fixed CSRF vulnerability. Fixed XSS vulnerability when add API key

Location:
platformly/trunk
Files:
13 edited

Legend:

Unmodified
Added
Removed

  • platformly/trunk/inc/pages/ply.events.php

    r2208564 r3174179  
    3838                <a href="javascript:;" id="btnPlyRefreshEvents" class="btn btn-default" title="Refresh">&#8635;</a>
    3939                <hr>
    40                 <table id="plyEventsTable" class="table">
     40                <table id="plyEventsTable" class="table" data-nonce="<?php echo wp_create_nonce("ply_load_data"); ?>">
    4141                    <thead>
    4242                        <tr>

  • platformly/trunk/inc/pages/ply.optins.page.php

    r1998157 r3174179  
    88
    99if(isset($_POST['saveOptin'])){
     10    check_admin_referer('ply_options_save');
    1011    $res = ply_update_optin_info();
    1112    if($res == '1')
    … …  
    1617
    1718if(isset($_POST['removeOptin'])){
     19    check_admin_referer('ply_options_remove');
    1820    $res = ply_remove_optin_info();
    1921    if($res == '1')
    … …  
    3638$editOptin = false;
    3739if(isset($_POST['editOptin'])){
     40    check_admin_referer('ply_options_edit');
    3841    $editOptin = ply_get_optin_by_id((int)$_POST['editOptin']);
    3942}
    … …  
    9598                    <h4 style='display: inline-block; margin-right: 5px'>Please select optin</h4><a target="_blank" href="<?php echo $user['main_url'] ?>/?page=lead_capture.forms" class="btn btn-default">View Optins</a><hr style="margin-top: 5px !important">
    9699                </div>
    97                 <div class="col-md-12" id="tdOptins">
     100                <div class="col-md-12" id="tdOptins" data-nonce="<?php echo wp_create_nonce("ply_load_data"); ?>">
    98101                    <label>Select project first</label>
    99102                </div>
    … …  
    364367    <input type="text" name="formOptinBlurBack" id="formOptinBlurBack" value="" />
    365368    <input type="hidden" name='formOptinWherePages' id='formOptinWherePages' value=''/>
    366    
     369    <?php wp_nonce_field('ply_options_save'); ?>
    367370    <input type="hidden" name="saveOptin" value="1" />
    368371</form>
    369372
    370373<form id="optinRemoveForm" style="display:none" method="post" action="">
     374    <?php wp_nonce_field('ply_options_remove'); ?>
    371375    <input type="hidden" name="removeOptin" id="removeOptin" value="" />
    372376</form>
    373377
    374378<form id="optinEditForm" style="display:none" method="post" action="">
     379    <?php wp_nonce_field('ply_options_edit'); ?>
    375380    <input type="hidden" name="editOptin" id="editOptin" value="" />
    376381</form>

  • platformly/trunk/inc/pages/ply.pages.php

    r2585949 r3174179  
    1313
    1414if(isset($_POST['savePage'])){
     15    check_admin_referer('ply_pages_save');
    1516    $res = ply_update_page_info();
    1617    if($res == '1'){
    … …  
    2223
    2324if(isset($_POST['removePage'])){
     25    check_admin_referer('ply_pages_remove');
    2426    $res = ply_remove_page_info();
    2527    if($res == '1'){
    … …  
    4345$editPage = false;
    4446if(isset($_POST['editPage'])){
     47    check_admin_referer('ply_pages_edit');
    4548    $editPage = ply_get_page_by_id((int)$_POST['editPage']);
    4649}
    … …  
    101104                    <h4 style='display: inline-block; margin-right: 5px'>Please select page</h4><a target="_blank" href="<?php echo $user['main_url'] ?>/?page=lead_capture.pages" class="btn btn-default">View Pages</a><hr style="margin-top: 5px !important">
    102105                </div>
    103                 <div class="col-md-12" id="tdPages">
     106                <div class="col-md-12" id="tdPages" data-nonce="<?php echo wp_create_nonce("ply_load_data"); ?>">
    104107                    <label>Select project first</label>
    105108                </div>
    … …  
    242245    <input type="text" name="formPageSlug" id="formPageSlug" value=""/>
    243246    <input type="text" name="formPagePingUpdateServices" id="formPagePingUpdateServices" value=""/>
     247    <?php wp_nonce_field('ply_pages_save'); ?>
    244248    <input type="hidden" name="savePage" value="1" />
    245249</form>
    246250
    247251<form id="pageRemoveForm" style="display:none" method="post" action="">
     252    <?php wp_nonce_field('ply_pages_remove'); ?>
    248253    <input type="hidden" name="removePage" id="removePage" value="" />
    249254</form>
    250255
    251256<form id="pageEditForm" style="display:none" method="post" action="">
     257    <?php wp_nonce_field('ply_pages_edit'); ?>
    252258    <input type="hidden" name="editPage" id="editPage" value="" />
    253259</form>

  • platformly/trunk/inc/pages/ply.settings.php

    r2293315 r3174179  
    44
    55if(isset($_POST['plugin_key'])){
     6    check_admin_referer('ply_settings');
    67    $res = ply_update_plugin_key();
    78    if($res == '1')
    … …  
    5455        <label for="plugin_key"></label>
    5556        <input type="text" name="plugin_key" id="plugin_key" style="width:500px;" value="<?php echo $pkey ?>" />
     57        <?php wp_nonce_field( 'ply_settings' ); ?>
    5658        <input type="submit" name="button" id="button" class="button" value="Save" /><br />
    5759        <span style="font-size:12px;"> You will need to add your API Key from your Platform.ly account. <br>You can find the API section if you click on your name in the upper right corner on Platform.ly and then on 'Api Keys'.</span>
    … …  
    112114                    <?php endforeach; ?>
    113115                </select>
     116                <input type="hidden" value="<?php echo wp_create_nonce("ply_save_project_code"); ?>" id="projectCodeNonce">
    114117                <input id="btnPlySaveProjectCode" class="button" type="button" value="Save"/>
    115118                <div id="msgPlyGetProgectCodeError"></div>

  • platformly/trunk/inc/ply.btn.php

    r2293315 r3174179  
    66    $projectCode = ply_get_project_code();
    77?>
    8 <div id="ply-add-link-dialog" class="hidden" style="max-width:600px;max-height: 500px;">
     8<div id="ply-add-link-dialog" class="hidden" style="max-width:600px;max-height: 500px;" data-nonce="<?php echo wp_create_nonce("ply_load_data"); ?>">
    99    <div>Loading . . .</div>
    1010</div>

  • platformly/trunk/inc/ply.functions.php

    r2694710 r3174179  
    4646
    4747function ply_update_plugin_key(){
    48     $code = wp_strip_all_tags($_POST['plugin_key'], true);
    49     update_option('ply_plugin_key', $code);
    50 
    51     return '1';
     48    $code = sanitize_text_field($_POST['plugin_key']);
     49    $res = preg_match('/^[a-zA-Z0-9]{32}$/', $code);
     50    if($res){
     51        $check = wp_remote_get(PLATFORMLY_URL . "/plugin/plugin.check.key.php?plugin_key=" . $code);
     52        $check = wp_remote_retrieve_body($check);
     53        if($check){
     54            $check = json_decode($check, true);
     55            if($check['status'] != 'not_found'){
     56                update_option('ply_plugin_key', $code);
     57                return '1';
     58            }
     59        }
     60    }
     61    return 'The API key you added is not correct.';
    5262}
    5363

  • platformly/trunk/js/events.js

    r1998157 r3174179  
    44    }
    55    jQuery('#plyEventsTable tbody').html('<tr><td colspan="6">Loading...</td></tr>');
    6     jQuery.post(ajaxurl, {'action': 'ply_load_events','projectId': projectId}, function(response){
     6    jQuery.post(ajaxurl, {'action': 'ply_load_events','projectId': projectId, '_wpnonce': jQuery('#plyEventsTable').data('nonce')}, function(response){
    77        data = JSON.parse(response);
    88        if(data.status!='success'){
    … …  
    8484    $('#plyProjectSelect').click(function(){
    8585        var projectId = $(this).val();
    86         /*$('#msgPlyGetProgectCodeActivated').hide();
    87         $('#plyProjectCodeMsgNotExist').hide();
    88         $.post(ajaxurl, {'action': 'ply_check_project_code','projectId': projectId}, function(response){
    89             if(response){
    90                 $('#msgPlyGetProgectCodeActivated span').text($('#plyProjectSelect option:selected').text());
    91                 $('#msgPlyGetProgectCodeActivated').show();
    92             }else{
    93                 $('#plyProjectCodeMsgNotExist').show();
    94             }
    95         });*/
    9686        loadEvents(projectId);
    9787    });

  • platformly/trunk/js/optins.js

    r1998157 r3174179  
    55    var data = {
    66        'action': 'ply_load_optins',
    7         'projectId': projectId
     7        'projectId': projectId,
     8        '_wpnonce': jQuery('#tdOptins').data('nonce')
    89    };
    910

  • platformly/trunk/js/pages.js

    r2585949 r3174179  
    66    var data = {
    77        'action': 'ply_load_pages',
    8         'projectId': projectId
     8        'projectId': projectId,
     9        '_wpnonce': jQuery('#tdPages').data('nonce')
    910    };
    1011

  • platformly/trunk/js/ply_add_link_functions.js

    r2293315 r3174179  
    55function get_ply_tracking_links(){
    66    jQuery('#ply-add-link-dialog').html('<div>Loading . . .</div>');
    7     jQuery.post(ajaxurl, {action: 'ply_get_tracking_links'}, function(response){
     7    jQuery.post(ajaxurl, {action: 'ply_get_tracking_links', '_wpnonce': jQuery('#ply-add-link-dialog').data('nonce')}, function(response){
    88        jQuery('.ui-dialog-buttonpane button:contains("Add Link")').button().hide();
    99        var data = JSON.parse(response);
    … …  
    6161function load_trackingLinks_inDetails(id){
    6262    jQuery('#ply-add-link-dialog').html('<div>Loading . . .</div>');
    63     jQuery.post(ajaxurl, {action: 'ply_get_tracking_links_details', id: id}, function(response){
     63    jQuery.post(ajaxurl, {action: 'ply_get_tracking_links_details', id: id, '_wpnonce': jQuery('#ply-add-link-dialog').data('nonce')}, function(response){
    6464        var data = JSON.parse(response);
    6565        if(data.status=='success'){
    … …  
    128128    //ply-project-name
    129129    jQuery('#ply-add-link-dialog').html('<div>Loading . . .</div>');
    130     jQuery.post(ajaxurl, {'action': 'ply_get_projects'}, function(response){
     130    jQuery.post(ajaxurl, {'action': 'ply_get_projects', '_wpnonce': jQuery('#ply-add-link-dialog').data('nonce')}, function(response){
    131131        var data = JSON.parse(response);
    132132        for(var key in data) {
    … …  
    149149    jQuery('.ui-dialog-buttonpane button:contains("Copy Code")').button().hide();
    150150    jQuery('#ply-add-link-dialog #ply-events-block').html('<div id="ply-default-event-msg">Loading...</div></div>');
    151     jQuery.post(ajaxurl, {'action': 'ply_load_events','projectId': projectId}, function(response){
     151    jQuery.post(ajaxurl, {'action': 'ply_load_events','projectId': projectId, '_wpnonce': jQuery('#ply-add-link-dialog').data('nonce')}, function(response){
    152152        var data = JSON.parse(response);
    153153        if(data.status!='success'){

  • platformly/trunk/js/settings.js

    r2293315 r3174179  
    1313                $('#msgPlyGetProgectCodeActivated').hide();
    1414                $('#plyLoadingProjectCode').show();
    15                 $.post(ajaxurl, {'action': 'ply_save_project_code','projectId': projectId}, function(response){
     15                $.post(ajaxurl, {'action': 'ply_save_project_code','projectId': projectId, '_wpnonce': $('#projectCodeNonce').val()}, function(response){
    1616                    data = JSON.parse(response);
    1717                    $('#plyLoadingProjectCode').hide();
    … …  
    2626        }
    2727    });
    28     /* $('#plyProjectSelect').change(function(){
    29         $('#msgPlyGetProgectCodeError').hide();
    30         $('#msgPlyGetProgectCodeActivated').hide();
    31         var projectId = $(this).val();
    32         $.post(ajaxurl, {'action': 'ply_check_project_code','projectId': projectId}, function(response){
    33             if(response){
    34                 $('#msgPlyGetProgectCodeActivated span').text($('#plyProjectSelect option:selected').text());
    35                 $('#msgPlyGetProgectCodeActivated').show();
    36             }else{
    37                
    38             }
    39         });
    40     }); */
    41     /*var prevVal;
    42     $('#plyProjectSelect').focus(function(){
    43         prevVal = $(this).val();
    44     }).change(function(){
    45         if($('#plyProjectCodeBlock').hasClass('ply-wc-project-code')){
    46             $(this).blur();
    47             if(!confirm('Changing the project will change the current project in Platform.ly WooCommerce plugin')){
    48                 $(this).val(prevVal);
    49                 return false;
    50             }
    51         }
    52     });*/
    5328    $('#plyCheckboxSetProjectCode').change(function(){
    5429        if($(this).prop('checked')){
    … …  
    6035        }
    6136        if(!$('#plyProjectCodeBlock').hasClass('ply-wc-project-code')){
    62             $.post(ajaxurl, {action: 'ply_project_code_include', includeCode: includeProjectCode}, function(response){});
     37            $.post(ajaxurl, {action: 'ply_project_code_include', includeCode: includeProjectCode, '_wpnonce': $('#projectCodeNonce').val()}, function(response){});
    6338        }
    6439    });
    … …  
    6641        if(!$('#plyProjectCodeBlock').hasClass('ply-wc-project-code')) {
    6742            if (confirm('Are you sure you want to remove the project code?')) {
    68                 $.post(ajaxurl, {'action': 'ply_remove_project_code'}, function (response) {
     43                $.post(ajaxurl, {'action': 'ply_remove_project_code', '_wpnonce': $('#projectCodeNonce').val()}, function (response) {
    6944                    $('#msgPlyGetProgectCodeActivated').hide();
    7045                    alert('Project code was removed.');

  • platformly/trunk/platformly.php

    r3149131 r3174179  
    44Plugin Name: Platform.ly Official
    55Description: Platform.ly plugin is the easiest way to setup your optins and pages that your created with Platform.ly. After building your optin or page with our interactive WYSIWYG builders, you can set them up to show on your site with just a couple of clicks.
    6 Version: 1.13
     6Version: 1.14
    77Author: Platform.ly
    88Author URI: https://www.platform.ly/
    … …  
    1616define("PLATFORMLY_URL", "https://pageserver.platform.ly");
    1717
    18 define('PLATFORMLY_PLUGIN_VERSION', '1.11');
     18define('PLATFORMLY_PLUGIN_VERSION', '1.14');
    1919
    2020include plugin_dir_path(__FILE__) . '/inc/ply.functions.php';
    … …  
    9292
    9393function ply_settings(){
    94     wp_enqueue_script('ply_optins_script', plugin_dir_url(__FILE__)."js/settings.js");
     94    wp_enqueue_script('ply_optins_script', plugin_dir_url(__FILE__)."js/settings.js", array(),1);
    9595    include plugin_dir_path(__FILE__) . 'inc/pages/ply.settings.php';
    9696}
    … …  
    101101    wp_enqueue_style('select2', plugin_dir_url(__FILE__)."css/select2.min.css");
    102102    wp_enqueue_script('select2', plugin_dir_url(__FILE__)."js/select2.min.js");
    103     wp_enqueue_script('ply_optins_script', plugin_dir_url(__FILE__)."js/optins.js");
     103    wp_enqueue_script('ply_optins_script', plugin_dir_url(__FILE__)."js/optins.js", array(),1);
    104104    include plugin_dir_path(__FILE__) . 'inc/pages/ply.optins.page.php';
    105105}
    … …  
    108108    wp_enqueue_style('bootstrap_styles', plugin_dir_url(__FILE__)."css/bootstrap.min.css");
    109109    wp_enqueue_style('bootstrap_theme_styles', plugin_dir_url(__FILE__)."css/bootstrap-theme.min.css");
    110     wp_enqueue_script('ply_pages_script', plugin_dir_url(__FILE__)."js/pages.js");
     110    wp_enqueue_script('ply_pages_script', plugin_dir_url(__FILE__)."js/pages.js", array(),1);
    111111    include plugin_dir_path(__FILE__) . 'inc/pages/ply.pages.php';
    112112}
    … …  
    117117    wp_enqueue_script('bootstrap_script', plugin_dir_url(__FILE__)."js/bootstrap.min.js");
    118118    include plugin_dir_path(__FILE__) . 'inc/pages/ply.events.php';
    119     wp_enqueue_script('ply_events_script', plugin_dir_url(__FILE__)."js/events.js");
     119    wp_enqueue_script('ply_events_script', plugin_dir_url(__FILE__)."js/events.js", array(),1);
    120120}
    121121
    … …  
    230230
    231231function ply_load_optins_callback(){
     232    check_ajax_referer('ply_load_data');
    232233    $projectId = intval($_POST['projectId']);
    233234    $get_optins = wp_remote_get(PLATFORMLY_URL . "/plugin/plugin.actions.php?plugin_key=" . ply_get_plugin_key() . "&action=listOptins&projectId=" . $projectId);
    … …  
    238239
    239240function ply_load_pages_callback(){
     241    check_ajax_referer('ply_load_data');
    240242    $projectId = intval($_POST['projectId']);
    241243    $get_pages = wp_remote_get(PLATFORMLY_URL . "/plugin/plugin.actions.php?plugin_key=" . ply_get_plugin_key() . "&action=listPages&projectId=" . $projectId);
    … …  
    246248
    247249function ply_get_tracking_links_callback(){
     250    check_ajax_referer('ply_load_data');
    248251    $result = wp_remote_get(PLATFORMLY_URL . "/plugin/plugin.actions.php?plugin_key=" . ply_get_plugin_key() . "&action=getTrackingLinks");
    249252    $result = wp_remote_retrieve_body($result);
    … …  
    253256
    254257function ply_load_events_callback(){
     258    check_ajax_referer('ply_load_data');
    255259    $projectId = intval($_POST['projectId']);
    256260    $result = wp_remote_get(PLATFORMLY_URL . "/plugin/plugin.actions.php?plugin_key=" . ply_get_plugin_key() . "&action=getEvents&projectId=" . $projectId);
    … …  
    261265
    262266function ply_get_tracking_links_details_callback(){
     267    check_ajax_referer('ply_load_data');
    263268    $linkId = intval($_POST['id']);
    264269    $result = wp_remote_get(PLATFORMLY_URL . "/plugin/plugin.actions.php?plugin_key=" . ply_get_plugin_key() . "&action=getDetailsTrackingLinks&linkId=" . $linkId);
    … …  
    269274
    270275function ply_save_project_code_callback(){
     276    check_ajax_referer('ply_save_project_code');
    271277    $projectId = intval($_POST['projectId']);
    272278    $result = wp_remote_get(PLATFORMLY_URL."/plugin/plugin.actions.php?plugin_key=".ply_get_plugin_key()."&action=getProjectCode&projectId=".$projectId);
    … …  
    291297}
    292298function ply_check_project_code_callback(){
     299    check_ajax_referer('ply_load_data');
    293300    $projectId = intval($_POST['projectId']);
    294301    $projectCode = ply_get_project_code($projectId);
    … …  
    303310
    304311function ply_remove_project_code_callback(){
     312    check_ajax_referer('ply_save_project_code');
    305313    ply_remove_project_code();
    306314    wp_die();
    … …  
    308316
    309317function ply_project_code_include_callback(){
     318    check_ajax_referer('ply_save_project_code');
    310319    $includeCode = isset($_POST['includeCode']) && !empty($_POST['includeCode']) ? true : false;
    311320    ply_project_code_include($includeCode);
    … …  
    314323
    315324function ply_get_projects_callback(){
     325    check_ajax_referer('ply_load_data');
    316326    $result = wp_remote_get(PLATFORMLY_URL."/plugin/plugin.actions.php?plugin_key=".ply_get_plugin_key()."&action=listProjects");
    317327    $result = wp_remote_retrieve_body($result);
    … …  
    446456    wp_enqueue_script('jquery-ui-dialog');
    447457    wp_enqueue_style('wp-jquery-ui-dialog');
    448     wp_enqueue_script('ply-add-link', plugin_dir_url(__FILE__) . 'js/ply_add_link_functions.js');
     458    wp_enqueue_script('ply-add-link', plugin_dir_url(__FILE__) . 'js/ply_add_link_functions.js', array(),1);
    449459    if(get_user_option('rich_editing') == 'true'){
    450460        add_filter("mce_external_plugins", "add_platform_ly_link_plugin");

  • platformly/trunk/readme.txt

    r3149131 r3174179  
    11=== Platform.ly Official ===
    22Contributors: platformlycom
    3 Tags: CRM, ecommerce, custom pages, landing pages, optin forms, events, tracking links, platform.ly, platform, platformly
     3Tags: crm, ecommerce, platform.ly, platform, platformly
    44Requires at least: 4.6
    55Tested up to: 6.6
    … …  
    7878== Upgrade Notice ==
    7979
     80= 1.14 =
     81- Security fix
     82
    8083= 1.13 =
    8184- Improvement: Compatibility with WP 6.6
Note: See TracChangeset for help on using the changeset viewer.