WordPress.org
Get WordPress

Plugin Directory

Changeset 3201957


Ignore:
Timestamp:
12/03/2024 09:12:42 PM (15 months ago)
Author:
ctltwp
Message:

Security fix - Sanitizing and Escaping

Location:
tabs-shortcode/trunk
Files:
1 added
2 edited

Legend:

Unmodified
Added
Removed

  • tabs-shortcode/trunk/readme.txt

    r827740 r3201957  
    33Tags: tab, shortcode
    44Requires at least: 3.4
    5 Tested up to: 3.5
    6 Stable tag: 2.0.2
     5Tested up to: 6.7.1
     6Stable tag: 3.0.0
    77License: GPLv2 or later
    88
    … …  
    5151This will tell the plugin to not include tab styling to your theme.
    5252
    53 
    5453 
    5554== Frequently Asked Questions ==

  • tabs-shortcode/trunk/tabs-shortcode.php

    r827740 r3201957  
    11<?php
    22/**
    3 * Plugin Name: Tabs Shortcode
    4 * Plugin URI: http://wordpress.org/extend/plugins/tabs-shortcode/
    5 * Description: Create shortcode that enables you to create tabs on your pages and posts
    6 * Author: CTLT
    7 * Version: 2.0.2
    8 * Author URI: http://ctlt.ubc.ca
    9 
    10 * This program is free software; you can redistribute it and/or modify it under the terms of the GNU
    11 * General Public License as published by the Free Software Foundation; either version 2 of the License,
    12 * or (at your option) any later version.
    13 *
    14 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
    15 * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
    16 *
    17 * You should have received a copy of the GNU General Public License along with this program; if not, write
    18 * to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA * This program is free software; you can redistribute it and/or modify it under the terms of the GNU
    19 * General Public License as published by the Free Software Foundation; either version 2 of the License,
    20 * or (at your option) any later version.
    21 *
    22 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
    23 * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
    24 *
    25 * You should have received a copy of the GNU General Public License along with this program; if not, write
    26 * to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
    27 */
     3 * Plugin Name: Tabs Shortcode
     4 * Plugin URI: http://wordpress.org/extend/plugins/tabs-shortcode/
     5 * Description: Create shortcode that enables you to create tabs on your pages and posts
     6 * Author: CTLT
     7 * Version: 3.0.0
     8 * Author URI: http://ctlt.ubc.ca
     9 * License:     GPL v2 or later
     10 * License URI: http://www.gnu.org/licenses/gpl-2.0.txt
     11
     12 * This program is free software; you can redistribute it and/or modify it under the terms of the GNU
     13 * General Public License as published by the Free Software Foundation; either version 2 of the License,
     14 * or (at your option) any later version.
     15 *
     16 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
     17 * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
     18 *
     19 * You should have received a copy of the GNU General Public License along with this program; if not, write
     20 * to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA * This program is free software; you can redistribute it and/or modify it under the terms of the GNU
     21 * General Public License as published by the Free Software Foundation; either version 2 of the License,
     22 * or (at your option) any later version.
     23 *
     24 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
     25 * even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
     26 *
     27 * You should have received a copy of the GNU General Public License along with this program; if not, write
     28 * to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
     29 */
    2830
    2931/**
    … …  
    3133 */
    3234class OLT_Tab_Shortcode {
    33    
     35
    3436    static $add_script;
    3537    static $shortcode_count;
    … …  
    3840    static $shortcode_js_data;
    3941    static $current_tab_id;
    40    
     42
    4143    static $tabs_support;
    42    
    43    
    44     /**
    45     * has_shortcode function.
    46     *
    47     * @access public
    48     * @param mixed $shortcode
    49     * @return void
    50     */
    51     function has_shortcode( $shortcode ) {
     44
     45
     46    /**
     47     * has_shortcode function.
     48     *
     49     * @access public
     50     * @param mixed $shortcode
     51     * @return void
     52     */
     53    public static function has_shortcode( $shortcode ) {
    5254        global $shortcode_tags;
    53    
    54         return ( in_array( $shortcode, array_keys ( $shortcode_tags ) ) ? true : false);
    55     }
    56 
    57     /**
    58     * add_shortcode function.
    59     *
    60     * @access public
    61     * @param mixed $shortcode
    62     * @param mixed $shortcode_function
    63     * @return void
    64     */
    65     function add_shortcode( $shortcode, $shortcode_function ) {
    66    
    67     if( !self::has_shortcode( $shortcode ) )
    68         add_shortcode( $shortcode, array( __CLASS__, $shortcode_function ) );
     55
     56        return ( in_array( $shortcode, array_keys( $shortcode_tags ) ) ? true : false );
     57    }
     58
     59    /**
     60     * add_shortcode function.
     61     *
     62     * @access public
     63     * @param mixed $shortcode
     64     * @param mixed $shortcode_function
     65     * @return void
     66     */
     67    public static function add_shortcode( $shortcode, $shortcode_function ) {
     68
     69        if ( ! self::has_shortcode( $shortcode ) ) {
     70            add_shortcode( $shortcode, array( __CLASS__, $shortcode_function ) );
     71        }
    6972    }
    7073    /**
    7174     * init function.
    72      * 
     75     *
    7376     * @access public
    7477     * @static
    … …  
    7982        self::add_shortcode( 'tab', 'tab_shortcode' );
    8083        self::add_shortcode( 'tabs', 'tabs_shortcode' );
    81        
    82 
    83         add_action( 'init', array(__CLASS__, 'register_script_and_style' ) );
    84         add_action( 'wp_footer', array(__CLASS__, 'print_script' ) );
    85        
    86         add_action( 'wp_enqueue_scripts', array(__CLASS__, 'enqueue_style' ) );
    87        
     84
     85        add_action( 'init', array( __CLASS__, 'register_script_and_style' ) );
     86        add_action( 'wp_footer', array( __CLASS__, 'print_script' ) );
     87
     88        add_action( 'wp_enqueue_scripts', array( __CLASS__, 'enqueue_style' ) );
     89
    8890        /* Apply filters to the tabs content. */
    8991        add_filter( 'tab_content', 'wpautop' );
    9092        add_filter( 'tab_content', 'shortcode_unautop' );
    9193        add_filter( 'tab_content', 'do_shortcode' );
    92        
    93         self::$shortcode_count = 0;
     94
     95        self::$shortcode_count        = 0;
    9496        self::$current_active_content = 0;
    95        
    96 
    97     }
    98    
     97    }
     98
    9999    /**
    100100     * tab_shortcode function.
    101      * 
     101     *
    102102     * @access public
    103103     * @static
    … …  
    106106     * @return void
    107107     */
    108     public static  function tab_shortcode( $atts, $content ) {
     108    public static function tab_shortcode( $atts, $content ) {
    109109        global $post;
    110        
    111         extract(shortcode_atts(array(
     110
     111        extract(
     112            shortcode_atts(
     113                array(
    112114                    'title' => null,
    113115                    'class' => null,
    114                 ), $atts) );
    115        
    116         //
    117         $selected = ( self::$current_active_content == self::$shortcode_count ? true : false );
    118        
    119         $class = apply_filters( "tabs-shortcode-content-panel-class", $class, $selected );
    120         $class_atr  = ( empty( $class ) ? '' : 'class=" '.$class.' "' );
    121         $title      = ( empty( $title ) ? $post->post_title : $title );
    122         $id         = preg_replace("/[^A-Za-z0-9]/", "", $title )."-".self::$shortcode_count;
    123        
    124        
    125         if( empty( $title ) )
     116                ),
     117                $atts
     118            )
     119        );
     120
     121                $selected = ( self::$current_active_content == self::$shortcode_count ? true : false );
     122
     123        $class     = apply_filters( 'tabs-shortcode-content-panel-class', $class, $selected );
     124        $class_atr = ( empty( $class ) ? '' : 'class=" ' . $class . ' "' );
     125        $title     = ( empty( $title ) ? $post->post_title : $title );
     126        $id        = preg_replace( '/[^A-Za-z0-9]/', '', $title ) . '-' . self::$shortcode_count;
     127
     128        if ( empty( $title ) ) {
    126129            return '<span style="color:red">Please enter a title attribute like [tab title="title name"]tab content[tab]</span>';
    127        
    128         self::$shortcode_data[  self::$current_tab_id ][] = array( 'title' => $title, 'id' => $id , 'class' => $class );
    129        
    130         self::$shortcode_count++;
    131 
    132         return '<div id="'.$id.'" '.$class_atr.' >'. apply_filters( 'tab_content', $content ). '</div>';
    133        
    134     }
    135    
    136    
     130        }
     131
     132        self::$shortcode_data[ self::$current_tab_id ][] = array(
     133            'title' => $title,
     134            'id'    => $id,
     135            'class' => $class,
     136        );
     137
     138        ++self::$shortcode_count;
     139
     140        return '<div id="' . esc_attr( $id ) . '" ' . esc_attr( $class_atr ) . ' >' . wp_kses_post( apply_filters( 'tab_content', $content ) ) . '</div>';
     141    }
     142
     143
    137144    /**
    138145     * tabs_shortcode function.
    139      * 
     146     *
    140147     * @access public
    141148     * @static
    … …  
    145152     */
    146153    public static function tabs_shortcode( $atts, $content ) {
    147        
    148         self::$add_script =  true;
    149 
    150         if( is_string($atts) )
     154
     155        self::$add_script = true;
     156
     157        if ( is_string( $atts ) ) {
    151158            $atts = array();
    152        
    153         if( isset( $atts['vertical_tabs'] ) ):
    154             $vertical_tabs = ( self::eval_bool( $atts['vertical_tabs'] ) ? "vertical-tabs": "");
    155             unset($atts['vertical_tabs']);
    156         else:
    157             $vertical_tabs = "";
     159        }
     160
     161        if ( isset( $atts['vertical_tabs'] ) ) :
     162            $vertical_tabs = ( self::eval_bool( $atts['vertical_tabs'] ) ? 'vertical-tabs' : '' );
     163            unset( $atts['vertical_tabs'] );
     164        else :
     165            $vertical_tabs = '';
    158166        endif;
    159        
    160         if( isset( $atts['position'] )  && in_array( $atts['position'], array( 'top', 'bottom', 'left', 'right' ) ) ):
     167
     168        if ( isset( $atts['position'] ) && in_array( $atts['position'], array( 'top', 'bottom', 'left', 'right' ) ) ) :
    161169            $position = $atts['position'];
    162         else:
    163             $position = ( empty($vertical_tabs) ? 'top' : 'left');
     170        else :
     171            $position = ( empty( $vertical_tabs ) ? 'top' : 'left' );
    164172        endif;
    165        
     173
    166174        // optional attributes
    167        
    168         $attr['collapsible'] =  ( isset($atts['collapsible']) ? self::eval_bool( $atts['collapsible'] ) : false );
    169         $attr['selected']   =   ( isset($atts['selected']) ? (int)$atts['selected'] : 0);
    170         $attr['event']      =   ( isset($atts['event']) && in_array($atts['event'], array('click', 'mouseover') ) ? $atts['event'] : 'click');
    171        
     175
     176        $attr['collapsible'] = ( isset( $atts['collapsible'] ) ? self::eval_bool( $atts['collapsible'] ) : false );
     177        $attr['selected']    = ( isset( $atts['selected'] ) ? (int) $atts['selected'] : 0 );
     178        $attr['event']       = ( isset( $atts['event'] ) && in_array( $atts['event'], array( 'click', 'mouseover' ) ) ? $atts['event'] : 'click' );
     179
    172180        self::$current_active_content = $attr['selected'] + self::$shortcode_count;
    173        
    174         $query_atts = shortcode_atts( array(
    175                 'collapsible'   => false,
    176                 'selected'      => 0,
    177                 'event'         => 'click',
    178             ), $attr );
    179        
    180         self::$current_tab_id = "random-tab-id-".rand(0,1000);
    181        
    182         $content = str_replace( "]<br />","]", ( substr( $content, 0 , 6 ) == "<br />" ? substr( $content, 6 ): $content ) );
    183        
     181
     182        $query_atts = shortcode_atts(
     183            array(
     184                'collapsible' => false,
     185                'selected'    => 0,
     186                'event'       => 'click',
     187            ),
     188            $attr
     189        );
     190
     191        self::$current_tab_id = 'random-tab-id-' . wp_rand( 0, 1000 );
     192
     193        $content = str_replace( ']<br />', ']', ( substr( $content, 0, 6 ) == '<br />' ? substr( $content, 6 ) : $content ) );
     194
    184195        self::$shortcode_js_data[ self::$current_tab_id ] = $query_atts;
    185        
     196
    186197        $individual_tabs = do_shortcode( $content );
    187198        $individual_tabs = apply_filters( 'tabs-shortcode-content-shell', $individual_tabs );
    188        
    189         $shell_class = apply_filters( 'tabs-shortcode-shell-class', "tabs-shortcode ". $vertical_tabs." tabs-shortcode-".$position, $position );
    190         $list_class  = apply_filters( 'tabs-shortcode-list-class', "tabs-shortcode-list" );
    191        
    192         $list_attr   = apply_filters( 'tabs-shortcode-list-attr', ''); // don't
    193         $list_link_attr   = apply_filters( 'tabs-shortcode-list-link-attr', ''); // don't
     199
     200        $shell_class = apply_filters( 'tabs-shortcode-shell-class', 'tabs-shortcode ' . $vertical_tabs . ' tabs-shortcode-' . $position, $position );
     201        $list_class  = apply_filters( 'tabs-shortcode-list-class', 'tabs-shortcode-list' );
     202
     203        $list_attr      = apply_filters( 'tabs-shortcode-list-attr', '' ); // don't
     204        $list_link_attr = apply_filters( 'tabs-shortcode-list-link-attr', '' ); // don't
    194205        ob_start();
    195        
    196         ?><div id="<?php echo self::$current_tab_id ?>" class="<?php echo $shell_class ?>"><?php
    197        
    198             if( $position == 'bottom' )
    199                 echo $individual_tabs;
    200        
    201             // $content = (substr($content,0,6) =="<br />" ? substr( $content,6 ): $content);
    202             // $content = str_replace("]<br />","]",$content); ?>
    203             <ul class="<?php echo $list_class ?>">
     206
     207        ?><div id="<?php echo esc_attr( self::$current_tab_id ); ?>" class="<?php echo esc_attr( $shell_class ); ?>">
     208        <?php
     209
     210        if ( $position == 'bottom' ) {
     211            echo wp_kses_post( $individual_tabs );
     212        }
     213
     214        if ( is_array( self::$shortcode_data ) && count( self::$shortcode_data ) > 0 ) {
     215            ?>
     216                <ul class="<?php echo esc_attr( $list_class ); ?>">
    204217            <?php
    205218            $list_counter_class = 0;
    206             foreach( self::$shortcode_data[self::$current_tab_id] as $tab_data ): ?>
    207                 <li <?php if( $tab_data['class']): ?> class="<?php echo $tab_data['class'];?>  " <?php echo $list_attr; ?> <?php endif; ?> ><a href="#<?php echo $tab_data['id']; ?>" <?php echo $list_link_attr; ?>><?php echo $tab_data['title']; ?></a></li><?php
    208             $list_counter_class++;
    209             endforeach;
    210            
    211             ?></ul><?php
    212            
    213            
    214             if( $position != 'bottom' )
    215                 echo $individual_tabs;
    216            
    217             ?></div><?php
    218                    
    219         return apply_filters( 'tab_content', str_replace("\r\n", '',  ob_get_clean() ) );
    220 
    221     }
    222    
     219
     220            foreach ( self::$shortcode_data[ self::$current_tab_id ] as $tab_data ) :
     221                ?>
     222                    <li
     223                    <?php
     224                    if ( $tab_data['class'] ) :
     225                        ?>
     226                        class="<?php echo esc_attr( $tab_data['class'] ); ?>  " <?php echo esc_attr( $list_attr ); ?> <?php endif; ?> ><a href="#<?php echo esc_attr( $tab_data['id'] ); ?>" <?php echo esc_attr( $list_link_attr ); ?>><?php echo wp_kses_post( $tab_data['title'] ); ?></a></li>
     227                                    <?php
     228                                    ++$list_counter_class;
     229                endforeach;
     230
     231            ?>
     232                </ul>
     233            <?php
     234        }
     235
     236        if ( $position != 'bottom' ) {
     237            echo wp_kses_post( $individual_tabs );
     238        }
     239
     240        ?>
     241            </div>
     242            <?php
     243
     244            return apply_filters( 'tab_content', str_replace( "\r\n", '', ob_get_clean() ) );
     245    }
     246
    223247    /**
    224248     * eval_bool function.
    225      * 
     249     *
    226250     * @access public
    227251     * @static
    … …  
    230254     */
    231255    static function eval_bool( $item ) {
    232        
    233         return ( (string) $item == 'false' || (string)$item == 'null'  || (string)$item == '0' || empty($item)  ? false : true );
    234     }
    235    
     256
     257        return ( (string) $item == 'false' || (string) $item == 'null' || (string) $item == '0' || empty( $item ) ? false : true );
     258    }
     259
    236260    /**
    237261     * register_script function.
    238      * 
     262     *
    239263     * @access public
    240264     * @static
    … …  
    242266     */
    243267    static function register_script_and_style() {
    244         self::$tabs_support = get_theme_support('tabs');
    245        
     268        self::$tabs_support = get_theme_support( 'tabs' );
     269
    246270        $suffix = ( defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG ) ? '' : '.min';
    247        
    248         wp_register_style( 'tab-shortcode',  plugins_url('tab'.$suffix.'.css', __FILE__) );
    249         wp_register_script( 'tab-shortcode' , plugins_url('tab'.$suffix.'.js', __FILE__), array('jquery', 'jquery-ui-core', 'jquery-ui-tabs'), '1.0', true );
    250        
    251         if( self::$tabs_support[0] == 'twitter-bootstrap' ):
    252             require_once( 'support/twitter-bootstrap/action.php' );
    253            
    254             wp_register_script( 'twitter-tab-shortcode' , plugins_url('support/twitter-bootstrap/twitter.bootstrap.tabs'.$suffix.'.js', __FILE__), array( 'jquery' ), '1.0', true );
    255        
     271
     272        wp_register_style( 'tab-shortcode', plugins_url( 'tab' . $suffix . '.css', __FILE__ ) );
     273        wp_register_script( 'tab-shortcode', plugins_url( 'tab' . $suffix . '.js', __FILE__ ), array( 'jquery', 'jquery-ui-core', 'jquery-ui-tabs' ), '1.0', true );
     274
     275        if ( ! is_array( self::$tabs_support ) ) {
     276            self::$tabs_support = array();
     277        }
     278
     279        if ( count( self::$tabs_support ) === 0 ) {
     280            return;
     281        }
     282
     283        if ( self::$tabs_support[0] == 'twitter-bootstrap' ) :
     284            require_once 'support/twitter-bootstrap/action.php';
     285
     286            wp_register_script( 'twitter-tab-shortcode', plugins_url( 'support/twitter-bootstrap/twitter.bootstrap.tabs' . $suffix . '.js', __FILE__ ), array( 'jquery' ), '1.0', true );
     287
    256288        endif;
    257        
    258        
    259     }
    260    
     289    }
     290
    261291    static function enqueue_style() {
    262         if( empty( self::$tabs_support ) )
     292        // if( empty( self::$tabs_support ) )
    263293            wp_enqueue_style( 'tab-shortcode' );
    264        
    265     }
    266    
     294    }
     295
    267296    /**
    268297     * print_script function.
    269      * 
     298     *
    270299     * @access public
    271300     * @static
    … …  
    273302     */
    274303    static function print_script() {
    275        
    276         if ( ! self::$add_script )
     304
     305        if ( ! self::$add_script ) {
    277306            return;
    278        
    279        
    280         if( empty( self::$tabs_support ) ||  'style-only' == self::$tabs_support[0]) {
     307        }
     308
     309        if ( empty( self::$tabs_support ) || 'style-only' == self::$tabs_support[0] ) {
    281310            wp_enqueue_script( 'tab-shortcode' );
    282311            wp_localize_script( 'tab-shortcode', 'tabs_shortcode', self::$shortcode_js_data );
    283         }
    284        
    285         if( self::$tabs_support[0] == 'twitter-bootstrap' ) {
    286            
    287             wp_enqueue_script( 'twitter-tab-shortcode' );
    288            
    289         }
     312        }
     313
     314        if ( array_key_exists( 0, self::$tabs_support ) && self::$tabs_support[0] === 'twitter-bootstrap' ) {
     315            wp_enqueue_script( 'twitter-tab-shortcode' );
     316            wp_enqueue_script( 'tab-shortcode' );
     317            wp_localize_script( 'tab-shortcode', 'tabs_shortcode', self::$shortcode_js_data );
     318        }
    290319    }
    291320}
Note: See TracChangeset for help on using the changeset viewer.