Changeset 3200973

Timestamp:

12/02/2024 02:14:41 PM (15 months ago)

Author:

onlyoffice

Message:

dev v2.1.2

Location:

onlyoffice-docspace/trunk

Files:

• CHANGELOG.md (modified) (1 diff)
• onlyoffice-docspace-wordpress.php (modified) (2 diffs)
• public/class-oodsp-public-docspace.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)

onlyoffice-docspace/trunk/CHANGELOG.md

@@ -1 +1 @@
 # Change Log
 
+## 2.1.2
+## Changed
+- fixed xss vulnerabilities in onlyoffice-docspace page component
 
 ## 2.1.1

onlyoffice-docspace/trunk/onlyoffice-docspace-wordpress.php

@@ -8 +8 @@
  * Plugin URI:        https://github.com/ONLYOFFICE/onlyoffice-docspace-wordpress
  * Description:       Add ONLYOFFICE DocSpace on page
- * Version:           2.1.1
+ * Version:           2.1.2
  * Requires at least: 5.7
  * Requires PHP:      7.4
@@ -46 +46 @@
  */
 define( 'OODSP_PLUGIN_NAME', 'onlyoffice-docspace-wordpress' );
-define( 'OODSP_VERSION', '2.1.1' );
+define( 'OODSP_VERSION', '2.1.2' );
 define( 'OODSP_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
 define( 'OODSP_PLUGIN_FILE', __FILE__ );

onlyoffice-docspace/trunk/public/class-oodsp-public-docspace.php

@@ -183 +183 @@
         );
 
-        $align = ! empty( $atts['align'] ) ? 'align' . $atts['align'] : '';
-        $size  = ! empty( $atts['width'] ) && ! ( 'full' === $atts['align'] ) ? 'width: ' . $atts['width'] . ';' : '';
-        $size .= ! empty( $atts['height'] ) ? 'height: ' . $atts['height'] . ';' : '';
+        $align = ! empty( $atts['align'] ) ? 'align' . sanitize_text_field( $atts['align'] ) : '';
+        $size  = ! empty( $atts['width'] ) && ! ( 'full' === $atts['align'] ) ? 'width: ' . sanitize_text_field( $atts['width'] ) . ';' : '';
+        $size .= ! empty( $atts['height'] ) ? 'height: ' . sanitize_text_field( $atts['height'] ) . ';' : '';
 
-        $output  = '<div class="wp-block-onlyoffice-docspace-wordpress-onlyoffice-docspace ' . $align . ' size-full" style="' . $size . '">';
+        $output  = '<div class="wp-block-onlyoffice-docspace-wordpress-onlyoffice-docspace ' . esc_attr( $align ) . ' size-full" style="' . esc_attr( $size ) . '">';
         $output .= "<div class='onlyoffice-docspace-block' data-config='" . wp_json_encode( $atts ) . "' id='onlyoffice-docspace-block-" . $instance . "'></div>";
         $output .= '</div>';

onlyoffice-docspace/trunk/readme.txt

@@ -4 +4 @@
 Requires at least: 6.2
 Tested up to: 6.3.1
-Stable tag: 2.1.1
+Stable tag: 2.1.2
 Requires PHP: 8.0
 License: GPLv2
@@ -89 +89 @@
 
 == Changelog ==
+= 2.1.2 =
+* fixed xss vulnerabilities in onlyoffice-docspace page component
+
+= 2.1.1 =
+* DocSpace JS SDK version 1.0.1
+* use username in user export data if first_name and last_name is empty 
+
 = 2.1.0 =
 * ability to add multiple rooms/files to a page