Changeset 3209389

Timestamp:

12/17/2024 05:04:47 PM (13 months ago)

Author:

arothman

Message:

This update includes security enhancements and the removal of a disused parameter.

Location:

pcrecruiter-extensions/trunk

Files:

• PCRecruiter-Extensions.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)

pcrecruiter-extensions/trunk/PCRecruiter-Extensions.php

@@ -21 +21 @@
 function pcr_frame($atts)
 {
-    $a = shortcode_atts(array(
+    $a = shortcode_atts([
         'link' => 'about:blank',
         'background' => 'transparent',
         'initialheight' => '640',
-        'analytics' => '',
         'form' => ''
-    ), $atts);
-    // If the link was empty and the formnumber is numeric insert the custom form
-    $sid         = $a['form'];
-    $loadurl     = $a['link'];
-    $analytics     = $a['analytics'];
-    if ($a['analytics'] != '') {
-        $analytics = ' analytics="true" ';
-    };
+    ], $atts);
+
+    $sid = intval($a['form']);
+    $loadurl = $a['link'];
+    function sanitize_loadurl($urlparam)
+        {
+            // Allow only letters, numbers, periods, equals, colons, question marks, forward slashes, percent signs, and spaces
+            return preg_replace('/[^a-zA-Z0-9\.\=\:\?\/%\s]/', '', $urlparam);
+            
+        }
+    $loadurl = sanitize_loadurl($loadurl);
+    $initialheight = intval($a['initialheight']);
+    $background = preg_match('/^#[a-fA-F0-9]{3,6}$|^transparent$/', $a['background']) ? $a['background'] : 'transparent';
     $pcrframecss = '<link rel="stylesheet" href="https://www2.pcrecruiter.net/pcrimg/inc/pcrframehost.css">';
-    // If the link doesn't contain a specific module, append jobboard.aspx
-    if (strpos($loadurl, '.asp?') === false && strpos($loadurl, '.exe?') === false && strpos($loadurl, '.aspx?') === false) {
-            $loadurl     = 'jobboard.aspx?uid=' . $loadurl;
-            $pcrframecss = '';
-    };
-    // If the link has a form number, load customform script instead of job board
-    if (is_numeric($sid) && $loadurl !== "about:blank") {
-        return '<!-- Start PCRecruiter Form --><script src="https://www2.pcrecruiter.net/pcrbin/' . $loadurl . '&action=opencustomform&sid=' . $sid . '"></script><!-- End PCRecruiter Form -->';
-    } else {
-        // If the link doesn't start with http and doesn't start with jobboard, prepend the Classic ASP URL and add CSS link
-        if (substr($loadurl, 0, 4) !== "http" && substr($loadurl, 0, 8) !== "jobboard") {
-            $aspurl  = 'https://www2.pcrecruiter.net/pcrbin/' . $loadurl;
-            $loadurl = $aspurl;
-        }
-        ;
-        // If the link doesn't start with http and starts with jobboard, prepend the Job Board URL
-        if (substr($loadurl, 0, 4) !== "http" && substr($loadurl, 0, 8) == "jobboard") {
-            $pcrframecss = '';
-            $aspurl      = 'https://host.pcrecruiter.net/pcrbin/' . $loadurl;
-            $loadurl     = $aspurl;
-        };
-        return "<!-- Start PCRecruiter WP 1.4.10-->" . $pcrframecss . "<iframe frameborder=\"0\" host=\"{$loadurl}\" id=\"pcrframe\" name=\"pcrframe\" src=\"about:blank\" style=\"height:{$a['initialheight']}px;width:100%;background-color:{$a['background']};border:0;margin:0;padding:0\" {$analytics} onload=\"pcrframeurl();\"></iframe><!-- End PCRecruiter WP -->";
-    }
-}
+
+    // Modify the URL when needed
+    if ($sid === '' && strpos($loadurl, '.asp?') === false && strpos($loadurl, '.exe?') === false && strpos($loadurl, '.aspx?') === false) {
+        $loadurl = 'jobboard.aspx?uid=' . $loadurl;
+        $pcrframecss = '';
+    }
+
+    // If a custom form is specified
+    if ($sid && $loadurl !== "about:blank") {
+        // Create the <script> tag with DOMDocument
+        $doc = new DOMDocument('1.0', 'UTF-8');
+        $script = $doc->createElement('script');
+        $loadurl = urldecode($loadurl);
+        $loadurl = urlencode($loadurl);
+        $script->setAttribute('src', "https://host.pcrecruiter.net/pcrbin/jobboard.aspx?uid={$loadurl}&action=opencustomform&sid={$sid}");
+        $doc->appendChild($script);
+        
+        return "<!-- Start PCRecruiter Form -->"
+            . $doc->saveHTML()
+            . "<!-- End PCRecruiter Form -->";
+    }
+
+    // Prepend URL based on the link
+    if (substr($loadurl, 0, 4) !== "http") {
+        $loadurl = 'jobboard.aspx?uid=' . $loadurl;
+        $prefix = (substr($loadurl, 0, 8) === "jobboard")
+            ? 'https://host.pcrecruiter.net/pcrbin/'
+            : 'https://www2.pcrecruiter.net/pcrbin/';
+        $loadurl = $prefix . $loadurl;
+    }
+
+    // Create iframe with DOMDocument
+    $doc = new DOMDocument('1.0', 'UTF-8');
+    $iframe = $doc->createElement('iframe');
+    $iframe->setAttribute('frameborder', '0');
+    $iframe->setAttribute('host', $loadurl);
+    $iframe->setAttribute('id', 'pcrframe');
+    $iframe->setAttribute('name', 'pcrframe');
+    $iframe->setAttribute('src', 'about:blank');
+    $iframe->setAttribute('style', "height:{$a['initialheight']}px;width:100%;background-color:{$a['background']};border:0;margin:0;padding:0");
+    $iframe->setAttribute('onload', 'pcrframeurl();');
+
+    $doc->appendChild($iframe);
+
+    return "<!-- Start PCRecruiter WP 1.4.2-->"
+        . $pcrframecss
+        . $doc->saveHTML()
+        . "<!-- End PCRecruiter WP -->";
+}
+
 add_shortcode('PCRecruiter', 'pcr_frame');
 

pcrecruiter-extensions/trunk/readme.txt

@@ -1 +1 @@
 === PCRecruiter Extensions ===
-Contributors: Main Sequence Technology, Inc.
+Contributors: arothman
 Tags: Recruiting, Staffing, Applicant Tracking
 Requires at least: 3.0
-Tested up to: 6.6.0
+Tested up to: 6.7.1
 Stable tag: trunk
 
@@ -27 +27 @@
 *   background="" (defaults to transparent if omitted)
 *   form="" (insert the 15-digit ID of a custom form)
-*   analytics="" (set to on if integrating Google Analytics with PCR)
 
 == XML Feed Setup ==