Changeset 3229331

Timestamp:

01/27/2025 10:27:51 AM (13 months ago)

Author:

clinked

Message:

XSS bugfixes

Location:

clinked-client-portal/trunk

Files:

• README.md (modified) (1 diff)
• clinked-wordpress-plugin.php (modified) (7 diffs)
• readme.txt (modified) (2 diffs)

clinked-client-portal/trunk/README.md

@@ -1 +1 @@
 # Clinked Wordpress Plugin
 
-This simple plugin provides a widget and shortcode to add a login form to a page.
+This simple plugin provides a widget and shortcode to add a login button to a page.
 
 ## Usage

clinked-client-portal/trunk/clinked-wordpress-plugin.php

@@ -59 +59 @@
 
   public static function get_widget($atts = [], $content = null, $tag = '') {
+
+
     $atts = shortcode_atts([
       "portal_url" => "https://app.clinked.app",
@@ -65 +67 @@
       "text" => "",
       "widget_id" => ""
-      ], $atts);
+      ], array_map('esc_attr', $atts));
 
     if (empty($atts['widget_id'])) {
@@ -81 +83 @@
     $buttonClasses = Array('wp-block-button', 'has-custom-font-size', 'has-small-font-size');
     if (!empty($atts['button_class'])) {
-      $buttonClasses = array_merge($buttonClasses, explode(',', $atts['button_class']));
+      $buttonClasses = array_merge($buttonClasses, explode(',', esc_attr($atts['button_class'])));
     }
     $atts['buttonClasses'] = $buttonClasses;
@@ -87 +89 @@
     $widget = '<div class="clinked-login-container"  data-widget="' . $atts["widget_id"] . '">';
     if (!empty($atts["text"])) {
-      $widget .= wpautop(wp_kses_post($atts["text"]));
+      $widget .= wpautop(wp_kses_post(esc_html($atts["text"])));
     }
     $widget .= self::build_view($atts["widget_id"], 'button', $atts);
@@ -148 +150 @@
       "remember_me" => false,
       "remember_me_text" => "Remember me"
-      ], $atts);
+      ], array_map('esc_attr', $atts));
 
     if (empty($atts['widget_id'])) {
@@ -168 +170 @@
     $inputClasses = Array();
     if (!empty($atts['input_class'])) {
-      $inputClasses = array_merge($inputClasses, explode(',', $atts['input_class']));
+      $inputClasses = array_merge($inputClasses, explode(',', esc_attr($atts['input_class'])));
     }
     $atts['inputClasses'] = $inputClasses;
@@ -174 +176 @@
     $buttonClasses = Array();
     if (!empty($atts['button_class'])) {
-      $buttonClasses = array_merge($buttonClasses, explode(',', $atts['button_class']));
+      $buttonClasses = array_merge($buttonClasses, explode(',', esc_attr($atts['button_class'])));
     }
     $atts['buttonClasses'] = $buttonClasses;

clinked-client-portal/trunk/readme.txt

@@ -3 +3 @@
 Tags: client portal, customer portal, client portal software, white-label file sharing, collaboration tool, online project management, task management software, project management tool, online project management software, share files, share large files, secure file sharing, file sharing site, online file sharing, file transfer, collaborate, collaboration site, online collaboration, ftp alternative, ftp replacement, send large files, web collaboration, team workspace, extranet, team collaboration, send large files, share files online, file sharing
 Requires at least: 3.0
-Tested up to: 6.4
-Stable tag: 1.9
+Tested up to: 6.7
+Stable tag: 1.10
 License: MIT
 License URI: https://mit-license.org/
@@ -111 +111 @@
 * The login form is depricated, please use the button instead.
 
+= 1.10 =
+* XSS bugfixes
+
 == Upgrade Notice ==