WordPress.org
Get WordPress

Plugin Directory

Changeset 3219339


Ignore:
Timestamp:
01/09/2025 12:00:52 AM (14 months ago)
Author:
123host
Message:

Improved XSS security

Location:
speakout/trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • speakout/trunk/includes/class.settings.php

    r2892370 r3219339  
    116116        $this->g_recaptcha_version          = $options['g_recaptcha_version'];
    117117        $this->g_recaptcha_status           = $options['g_recaptcha_status'];
    118         $this->g_recaptcha_site_key           = $options['g_recaptcha_site_key'];
    119         $this->g_recaptcha_secret_key         = $options['g_recaptcha_secret_key'];
     118        $this->g_recaptcha_site_key         = $options['g_recaptcha_site_key'];
     119        $this->g_recaptcha_secret_key       = $options['g_recaptcha_secret_key'];
    120120        $this->hcaptcha_status              = $options['hcaptcha_status'];
    121         $this->hcaptcha_site_key           = $options['hcaptcha_site_key'];
    122         $this->hcaptcha_secret_key         = $options['hcaptcha_secret_key'];
     121        $this->hcaptcha_site_key            = $options['hcaptcha_site_key'];
     122        $this->hcaptcha_secret_key          = $options['hcaptcha_secret_key'];
    123123        $this->display_anedot               = $options['display_anedot'];
    124124        $this->display_sharing              = $options['display_sharing'];

  • speakout/trunk/includes/emailpetition.php

    r3124883 r3219339  
    134134
    135135            // shortcode attributes
    136             $width = isset( $attr[ 'width' ] ) ? 'style="width: ' . $attr[ 'width' ] . ';"': '';
    137             $height = isset( $attr[ 'height' ] ) ? 'style="height: ' . $attr[ 'height' ] . ' !important;"': '';
    138             $css_classes = isset( $attr[ 'class' ] ) ? $css_classes = $attr[ 'class' ] : '';
     136            $width = isset( $attr['width'] ) && preg_match( '/^\d+(px|%)?$/', $attr['width'] ) ? 'style="width: ' . esc_attr( $attr['width'] ) . ';"' : '';
     137            $height = isset( $attr['height'] ) && preg_match( '/^\d+(px|%)?$/', $attr['height'] ) ? 'style="height: ' . esc_attr( $attr['height'] ) . ';"' : '';
     138            $css_classes = isset( $attr[ 'class' ] ) ? $css_classes = esc_attr($attr[ 'class' ]) : '';
    139139            $progress_width = ( $options[ 'petition_theme' ] == 'basic' ) ? 300 : 200; // defaults
    140             $progress_width = isset( $attr[ 'progresswidth' ] ) ? $attr[ 'progresswidth' ] : $progress_width;
    141            
    142             // Function to detect potential JavaScript in shorcode
    143             function contains_js($input) {
    144                 $pattern = '/(javascript|on\w+|<script|<\/script|<\?|<\w+[^>]*\s*on\w+\s*=\s*["\']?[^>"\']+["\']?)/i';
    145                 return preg_match($pattern, $input);
    146             }
    147 
    148             // Validate and sanitize shortcode attributes
    149             if (isset( $attr['width']) && contains_js($attr['width']) ||
    150                 isset( $attr['height']) && contains_js($attr['height']) ||
    151                 isset( $attr['css_classes']) && contains_js($attr['css_classes']  ) ||
    152                 isset( $attr['progresswidth']) && contains_js($attr['progresswidth'])) {
    153                 // Handle potential injection attempt
    154                 die('Invalid javascript detected in shortcode');
    155             }
     140            $progress_width = isset( $attr[ 'progresswidth' ] ) ? esc_attr( $attr[ 'progresswidth' ] ): $progress_width;         
    156141
    157142            if ( !$expired ) {

  • speakout/trunk/includes/install.php

    r2999352 r3219339  
    232232        "g_recaptcha_site_key"  => "",
    233233        "hcaptcha_status"       => "",
    234         "hcaptcha__site_key"    => "",
     234        "hcaptcha_site_key"     => "",
    235235        "hcaptcha_secret_key"   => "",
    236236        "anedot_page_id"        => "",

  • speakout/trunk/readme.txt

    r3176575 r3219339  
    55Tested up to: 6.7
    66Requires PHP: 7.4
    7 Stable tag: 4.4.2
     7Stable tag: 4.5.0
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    2222
    2323== Changelog ==
     24
     25== 4.5.0 ==
     26
     27* improvement: further refined bug fixed in 4.4.0 - thanks Darius S. @ patchstack.com
     28
     29== 4.4.3 ==
     30
     31* improvement: updated old changelog link at end of current changelog
    2432
    2533== 4.4.2 ==
    … …  
    191199[Earlier Changelog][2]
    192200
    193 [2]: https://speakoutpetitions.com/changelog "SpeakOut! Changelog"
     201[2]: https://speakoutpetitions.com/speakout-free-changelog/ "SpeakOut! old Changelog"
    194202
    195203

  • speakout/trunk/speakout-email-petitions.php

    r3176575 r3219339  
    1616License URI: https://www.gnu.org/licenses/gpl-2.0.html
    1717
    18 Version: 4.4.2
     18Version: 4.5.0
    1919
    2020{Plugin Name} is free software: you can redistribute it and/or modify
    … …  
    3232
    3333global $wpdb, $db_petitions, $db_signatures, $dk_speakout_version;
    34 $dk_speakout_version = '4.4.2';
     34$dk_speakout_version = '4.5.0';
    3535$db_petitions  = $wpdb->prefix . 'dk_speakout_petitions';
    3636$db_signatures = $wpdb->prefix . 'dk_speakout_signatures';
Note: See TracChangeset for help on using the changeset viewer.