WordPress.org
Get WordPress

Plugin Directory

Changeset 3187877


Ignore:
Timestamp:
11/13/2024 05:00:36 PM (14 months ago)
Author:
zeshanb
Message:

fixed security issue to allow only specified attributes in shortcode

Location:
quran-phrases-about-most-people-shortcodes/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • quran-phrases-about-most-people-shortcodes/trunk/plugin.php

    r2580030 r3187877  
    44 * Plugin URI:        https://www.zdatatech.com/portfolio/plugins/quran-phrases-about-most-people-shortcodes
    55 * Description:       Shortcodes to display phrases about "most people". Use short codes [people_defient /], [people_reason /], [people_know/], [people_grateful/], [people_know_also/], [people_grateful_also/]
    6  * Version:           1.4
    7  * Requires at least: 5.3
    8  * Requires PHP:      5.6
     6 * Version:           1.5
     7 * Requires at least: 5.6
     8 * Requires PHP:      7.0
    99 * Author:            Zeshan B
    1010 * Author URI:        https://www.zdatatech.com
    1111 * License:           GPL v2 or later
    1212 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
    13  * Text Domain:       qpmp
     13 * Text Domain:       quran-phrases-about-most-people-shortcodes
    1414 * Domain Path:       /public/lang
    1515 */
    … …  
    2020   
    2121      $src = plugins_url('/quran-phrases-about-most-people-shortcodes/public/font/alqalamquran/stylesheet.css',dirname(__FILE__) );
    22       wp_register_style('stylesheet', $src);
     22      $version = '1.2.0'; //stylesheet version
     23      wp_register_style('stylesheet', $src, array(), $version);
    2324      wp_enqueue_style('stylesheet');
    2425     
    … …  
    3839     
    3940 }
    40  
    41  function qpmp_people_grateful_also_2_243_shortcode($atts){
    42       extract(shortcode_atts(array(
    43            'size' => "40px",
    44             'tag' => "p",
    45             'color' => "#000"
    46           ),$atts));
    47      
    48 
    49      $people_gratitude_text  = '<'.$tag.' style="font-size:'.$size.';color:'.$color.';font-family:al_qalam_quranregular" dir="rtl">';
    50      $people_gratitude_text .= '..';
    51      $people_gratitude_text .= ' أَكْثَرَ النَّاسِ لَا يَشْكُرُونَ';
    52      $people_gratitude_text .= '..';
    53      $people_gratitude_text .= '<a href="http://www.tanzil.net/#trans/en.sahih/2:243" target="_blank" style="color:'.$color.'">(2:243)</a>';
    54      $people_gratitude_text .= '</'.$tag.'>';
    55 
    56      return $people_gratitude_text;
    57      
    58  }
    59  
    60  
    61  function qpmp_people_reason_5_103_shortcode($atts){
    62       extract(shortcode_atts(array(
    63            'size' => "40px",
    64             'tag' => "p",
    65             'color' => "#000"
    66           ),$atts));
    67 
    68      $people_reason_text  = '<'.$tag.' style="font-size:'.$size.';color:'.$color.';font-family:al_qalam_quranregular" dir="rtl">';
    69      $people_reason_text .= '..';
    70      $people_reason_text .= 'أَكْثَرُهُمْ لَا يَعْقِلُونَ';
    71      $people_reason_text .= '..';
    72      $people_reason_text .= '<a href="http://www.tanzil.net/#trans/en.sahih/5:103" target="_blank" style="color:'.$color.'">(5:103)</a>';
    73     $people_reason_text .= '</'.$tag.'>';
    74    
     41
     42 function qpmp_people_grateful_also_2_243_shortcode($atts) {
     43     // Define the allowed attributes with their default values
     44     $allowed_atts = array(
     45         'size' => '40px',   // Default font size
     46         'color' => '#000',  // Default color
     47         'tag' => 'p'        // Default HTML tag
     48     );
     49 
     50     // Extract and sanitize only the allowed attributes
     51     $atts = shortcode_atts($allowed_atts, $atts, 'qpmp_people_grateful_also_2_243_shortcode');
     52 
     53     // Sanitize the allowed attributes
     54     $size = preg_match('/^\d+(px|em|rem|%)?$/', $atts['size']) ? $atts['size'] : '40px';
     55     $tag = in_array($atts['tag'], array('p', 'span', 'div', 'strong')) ? $atts['tag'] : 'p';
     56     $color = preg_match('/^#([a-fA-F0-9]{3}|[a-fA-F0-9]{6})$/', $atts['color']) ? $atts['color'] : '#000';
     57 
     58     // Build the content output
     59     $people_grateful_also_text = "<{$tag} style='font-size:{$size}; color:{$color}; font-family:al_qalam_quranregular;' dir='rtl'>";
     60     $people_grateful_also_text .= '..';
     61     $people_grateful_also_text .= ' أَكْثَرَ النَّاسِ لَا يَشْكُرُونَ ';
     62     $people_grateful_also_text .= '..';
     63     $people_grateful_also_text .= "<a href='http://www.tanzil.net/#trans/en.sahih/2:243' target='_blank' style='color:{$color};'>(2:243)</a>";
     64     $people_grateful_also_text .= "</{$tag}>";
     65 
     66     return $people_grateful_also_text;
     67 }
     68 
     69 
     70 function qpmp_people_reason_5_103_shortcode($atts) {
     71     // Define allowed attributes with default values
     72     $allowed_atts = array(
     73         'size' => '40px',   // Default font size
     74         'color' => '#000',  // Default color
     75         'tag' => 'p'        // Default HTML tag
     76     );
     77 
     78     // Extract and sanitize only the allowed attributes
     79     $atts = shortcode_atts($allowed_atts, $atts, 'qpmp_people_reason_5_103_shortcode');
     80 
     81     // Sanitize the allowed attributes
     82     $size = preg_match('/^\d+(px|em|rem|%)?$/', $atts['size']) ? $atts['size'] : '40px';
     83     $tag = in_array($atts['tag'], array('p', 'span', 'div', 'strong')) ? $atts['tag'] : 'p';
     84     $color = preg_match('/^#([a-fA-F0-9]{3}|[a-fA-F0-9]{6})$/', $atts['color']) ? $atts['color'] : '#000';
     85 
     86     // Construct the content with specified attributes
     87     $people_reason_text  = "<{$tag} style='font-size:{$size}; color:{$color}; font-family:al_qalam_quranregular;' dir='rtl'>";
     88     $people_reason_text .= '.. ';
     89     $people_reason_text .= 'أَكْثَرُهُمْ لَا يَعْقِلُونَ ';
     90     $people_reason_text .= '.. ';
     91     $people_reason_text .= "<a href='http://www.tanzil.net/#trans/en.sahih/5:103' target='_blank' style='color:{$color};'>";
     92     $people_reason_text .= '(5:103)</a>';
     93     $people_reason_text .= "</{$tag}>";
     94 
    7595     return $people_reason_text;
    76      
    77  }
    78  
    79   function qpmp_people_defient_5_49_shortcode($atts){
    80        extract(shortcode_atts(array(
    81            'size' => "40px",
    82             'tag' => "p",
    83             'color' => "#000"
    84           ),$atts));
    85 
    86      $people_defient_text  = '<'.$tag.' style="font-size:'.$size.';color:'.$color.';font-family:al_qalam_quranregular" dir="rtl">';
    87      $people_defient_text .= '..';
    88      $people_defient_text .= 'كَثِيرًا مِّنَ النَّاسِ لَفَاسِقُونَ';
    89      $people_defient_text .= '..';
    90      $people_defient_text .= '<a href="http://www.tanzil.net/#trans/en.sahih/5:49" target="_blank" style="color:'.$color.'">(5:49)</a>';
    91      $people_defient_text .= '</'.$tag.'>';
    92 
     96 }
     97 
     98 
     99 function qpmp_people_defient_5_49_shortcode($atts) {
     100     // Define allowed attributes with default values
     101     $allowed_atts = array(
     102         'size' => '40px',   // Default font size
     103         'color' => '#000',  // Default color
     104         'tag' => 'p'        // Default HTML tag
     105     );
     106 
     107     // Extract and sanitize only the allowed attributes
     108     $atts = shortcode_atts($allowed_atts, $atts, 'qpmp_people_defient_5_49_shortcode');
     109 
     110     // Sanitize the allowed attributes
     111     $size = preg_match('/^\d+(px|em|rem|%)?$/', $atts['size']) ? $atts['size'] : '40px';
     112     $tag = in_array($atts['tag'], array('p', 'span', 'div', 'strong')) ? $atts['tag'] : 'p';
     113     $color = preg_match('/^#([a-fA-F0-9]{3}|[a-fA-F0-9]{6})$/', $atts['color']) ? $atts['color'] : '#000';
     114 
     115     // Construct the content with specified attributes
     116     $people_defient_text  = "<{$tag} style='font-size:{$size}; color:{$color}; font-family:al_qalam_quranregular;' dir='rtl'>";
     117     $people_defient_text .= '.. ';
     118     $people_defient_text .= 'كَثِيرًا مِّنَ النَّاسِ لَفَاسِقُونَ ';
     119     $people_defient_text .= '.. ';
     120     $people_defient_text .= "<a href='http://www.tanzil.net/#trans/en.sahih/5:49' target='_blank' style='color:{$color};'>";
     121     $people_defient_text .= '(5:49)</a>';
     122     $people_defient_text .= "</{$tag}>";
     123 
    93124     return $people_defient_text;
    94      
    95  }
    96  
    97  function qpmp_people_know_7_187_shortcode($atts){
    98       extract(shortcode_atts(array(
    99            'size' => "40px",
    100             'tag' => "p",
    101             'color' => "#000"
    102           ),$atts));
    103 
    104      $people_know_text  = '<'.$tag.' style="font-size:'.$size.';color:'.$color.';font-family:al_qalam_quranregular" dir="rtl">';
    105      $people_know_text .= '..';
    106      $people_know_text .= ' أَكْثَرَ النَّاسِ لَا يَعْلَمُونَ';
    107      $people_know_text .= '..';
    108      $people_know_text .= '<a href="http://www.tanzil.net/#trans/en.sahih/7:187" target="_blank" style="color:'.$color.'">(7:187)</a>';
    109      $people_know_text  .= '</'.$tag.'>';
    110 
     125 }
     126
     127 
     128 function qpmp_people_know_7_187_shortcode($atts) {
     129     // Define allowed attributes with default values
     130     $allowed_atts = array(
     131         'size' => '40px',   // Default font size
     132         'color' => '#000',  // Default color
     133         'tag' => 'p'        // Default HTML tag
     134     );
     135 
     136     // Extract and sanitize only the allowed attributes
     137     $atts = shortcode_atts($allowed_atts, $atts, 'qpmp_people_know_7_187_shortcode');
     138 
     139     // Sanitize the allowed attributes
     140     $size = preg_match('/^\d+(px|em|rem|%)?$/', $atts['size']) ? $atts['size'] : '40px';
     141     $tag = in_array($atts['tag'], array('p', 'span', 'div', 'strong')) ? $atts['tag'] : 'p';
     142     $color = preg_match('/^#([a-fA-F0-9]{3}|[a-fA-F0-9]{6})$/', $atts['color']) ? $atts['color'] : '#000';
     143 
     144     // Construct the content with specified attributes
     145     $people_know_text  = "<{$tag} style='font-size:{$size}; color:{$color}; font-family:al_qalam_quranregular;' dir='rtl'>";
     146     $people_know_text .= '.. ';
     147     $people_know_text .= 'أَكْثَرَ النَّاسِ لَا يَعْلَمُونَ ';
     148     $people_know_text .= '.. ';
     149     $people_know_text .= "<a href='http://www.tanzil.net/#trans/en.sahih/7:187' target='_blank' style='color:{$color};'>";
     150     $people_know_text .= '(7:187)</a>';
     151     $people_know_text .= "</{$tag}>";
     152 
    111153     return $people_know_text;
    112      
    113  }
    114  
    115   function qpmp_people_grateful_10_60_shortcode($atts){
    116        extract(shortcode_atts(array(
    117            'size' => "40px",
    118             'tag' => "p",
    119             'color' => "#000"
    120           ),$atts));
    121 
    122      $people_grateful_text  = '<'.$tag.' style="font-size:'.$size.';color:'.$color.';font-family:al_qalam_quranregular" dir="rtl">';
    123      $people_grateful_text .= '..';
    124      $people_grateful_text .= ' أَكْثَرَهُمْ لَا يَشْكُرُونَ';
    125      $people_grateful_text .= '..';
    126      $people_grateful_text .= '<a href="http://www.tanzil.net/#trans/en.sahih/10:60" target="_blank" style="color:'.$color.'">(10:60)</a>';
    127      $people_grateful_text  .= '</'.$tag.'>';
    128 
    129      return $people_grateful_text;
    130      
    131  }
    132  
    133  function qpmp_people_do_not_know_12_21_shortcode($atts){
    134       extract(shortcode_atts(array(
    135            'size' => "40px",
    136             'tag' => "p",
    137             'color' => "#000"
    138           ),$atts));
    139 
    140      $people_do_not_know_text  = '<'.$tag.' style="font-size:'.$size.';color:'.$color.';font-family:al_qalam_quranregular" dir="rtl">';
    141      $people_do_not_know_text .= '..';
    142      $people_do_not_know_text .= ' أَكْثَرَ النَّاسِ لَا يَعْلَمُونَ';
    143      $people_do_not_know_text .= '..';
    144      $people_do_not_know_text .= '<a href="http://www.tanzil.net/#trans/en.sahih/12:21" target="_blank" style="color:'.$color.'">(12:21)</a>';
    145      $people_do_not_know_text  .= '</'.$tag.'>';
    146 
     154 }
     155
     156
     157function qpmp_people_grateful_10_60_shortcode($atts) {
     158    // Define allowed attributes with default values
     159    $allowed_atts = array(
     160        'size' => '40px',   // Default font size
     161        'color' => '#000',  // Default color
     162        'tag' => 'p'        // Default HTML tag
     163    );
     164
     165    // Extract and sanitize only the allowed attributes
     166    $atts = shortcode_atts($allowed_atts, $atts, 'qpmp_people_grateful_10_60_shortcode');
     167
     168    // Sanitize the allowed attributes
     169    $size = preg_match('/^\d+(px|em|rem|%)?$/', $atts['size']) ? $atts['size'] : '40px';
     170    $tag = in_array($atts['tag'], array('p', 'span', 'div', 'strong')) ? $atts['tag'] : 'p';
     171    $color = preg_match('/^#([a-fA-F0-9]{3}|[a-fA-F0-9]{6})$/', $atts['color']) ? $atts['color'] : '#000';
     172
     173    // Construct the content with specified attributes
     174    $people_grateful_text  = "<{$tag} style='font-size:{$size}; color:{$color}; font-family:al_qalam_quranregular;' dir='rtl'>";
     175    $people_grateful_text .= '.. ';
     176    $people_grateful_text .= 'أَكْثَرَهُمْ لَا يَشْكُرُونَ ';
     177    $people_grateful_text .= '.. ';
     178    $people_grateful_text .= "<a href='http://www.tanzil.net/#trans/en.sahih/10:60' target='_blank' style='color:{$color};'>";
     179    $people_grateful_text .= '(10:60)</a>';
     180    $people_grateful_text .= "</{$tag}>";
     181
     182    return $people_grateful_text;
     183}
     184
     185
     186function qpmp_people_do_not_know_12_21_shortcode($atts) {
     187     // Define allowed attributes with default values
     188     $allowed_atts = array(
     189         'size' => '40px',   // Default font size
     190         'color' => '#000',  // Default color
     191         'tag' => 'p'        // Default HTML tag
     192     );
     193 
     194     // Extract and sanitize only the allowed attributes
     195     $atts = shortcode_atts($allowed_atts, $atts, 'qpmp_people_do_not_know_12_21_shortcode');
     196 
     197     // Sanitize the allowed attributes
     198     $size = preg_match('/^\d+(px|em|rem|%)?$/', $atts['size']) ? $atts['size'] : '40px';
     199     $tag = in_array($atts['tag'], array('p', 'span', 'div', 'strong')) ? $atts['tag'] : 'p';
     200     $color = preg_match('/^#([a-fA-F0-9]{3}|[a-fA-F0-9]{6})$/', $atts['color']) ? $atts['color'] : '#000';
     201 
     202     // Construct the content with specified attributes
     203     $people_do_not_know_text  = "<{$tag} style='font-size:{$size}; color:{$color}; font-family:al_qalam_quranregular;' dir='rtl'>";
     204     $people_do_not_know_text .= '.. ';
     205     $people_do_not_know_text .= 'أَكْثَرَ النَّاسِ لَا يَعْلَمُونَ ';
     206     $people_do_not_know_text .= '.. ';
     207     $people_do_not_know_text .= "<a href='http://www.tanzil.net/#trans/en.sahih/12:21' target='_blank' style='color:{$color};'>";
     208     $people_do_not_know_text .= '(12:21)</a>';
     209     $people_do_not_know_text .= "</{$tag}>";
     210 
    147211     return $people_do_not_know_text;
    148      
    149  }
    150  
    151   function qpmp_people_argue_18_54_shortcode($atts){
    152        extract(shortcode_atts(array(
    153            'size' => "40px",
    154             'tag' => "p",
    155             'color' => "#000"
    156           ),$atts));
    157 
    158      $people_argue_text  = '<'.$tag.' style="font-size:'.$size.';color:'.$color.';font-family:al_qalam_quranregular" dir="rtl">';
    159      $people_argue_text .= '..';
    160      $people_argue_text .= 'أَكْثَرَ شَيْءٍ جَدَلً';
    161      $people_argue_text .= '..';
    162      $people_argue_text .= '<a href="http://www.tanzil.net/#trans/en.sahih/18:54" target="_blank" style="color:'.$color.'">(18:54)</a>';
    163      $people_argue_text  .= '</'.$tag.'>';
    164 
     212 }
     213
     214
     215function qpmp_people_argue_18_54_shortcode($atts) {
     216     // Define allowed attributes with default values
     217     $allowed_atts = array(
     218         'size' => '40px',   // Default font size
     219         'color' => '#000',  // Default color
     220         'tag' => 'p'        // Default HTML tag
     221     );
     222 
     223     // Extract and sanitize only the allowed attributes
     224     $atts = shortcode_atts($allowed_atts, $atts, 'qpmp_people_argue_18_54_shortcode');
     225 
     226     // Sanitize the allowed attributes
     227     $size = preg_match('/^\d+(px|em|rem|%)?$/', $atts['size']) ? $atts['size'] : '40px';
     228     $tag = in_array($atts['tag'], array('p', 'span', 'div', 'strong')) ? $atts['tag'] : 'p';
     229     $color = preg_match('/^#([a-fA-F0-9]{3}|[a-fA-F0-9]{6})$/', $atts['color']) ? $atts['color'] : '#000';
     230 
     231     // Construct the content with specified attributes
     232     $people_argue_text  = "<{$tag} style='font-size:{$size}; color:{$color}; font-family:al_qalam_quranregular;' dir='rtl'>";
     233     $people_argue_text .= '.. ';
     234     $people_argue_text .= 'أَكْثَرَ شَيْءٍ جَدَلً ';
     235     $people_argue_text .= '.. ';
     236     $people_argue_text .= "<a href='http://www.tanzil.net/#trans/en.sahih/18:54' target='_blank' style='color:{$color};'>";
     237     $people_argue_text .= '(18:54)</a>';
     238     $people_argue_text .= "</{$tag}>";
     239 
    165240     return $people_argue_text;
    166      
    167  }
    168  
     241 }
     242
    169243 
    170244?>

  • quran-phrases-about-most-people-shortcodes/trunk/readme.txt

    r2580031 r3187877  
    44Tags: quran, display phrases, most people, shortcode
    55Requires at least: 4.0
    6 Tested up to: 5.8
     6Tested up to: 6.7
    77Requires PHP: 7.0
    8 Stable tag: 1.4
     8Stable tag: 1.5
    99License: GPLv2 or later
    1010License URI: https://www.gnu.org/licenses/gpl-2.0.html
    1111
     12Use shortcodes to display phrases from Quran about most people.
    1213
    1314=== Description ===
    … …  
    21221. [people_know_also /]
    22231. [people_grateful_also /]
    23 
     241. [people_argue /]
     25 
    2426You can also set the font size, color, and html tag.
    2527
    … …  
    4648
    4749== Changelog ==
     50
     51= 1.5 =
     52* Fixed issue to only allow specified attributes size, color and tag
    4853
    4954= 1.4 =
Note: See TracChangeset for help on using the changeset viewer.