Changeset 3232924

Timestamp:

01/31/2025 09:31:37 PM (11 months ago)

Author:

Milap

Message:

Fixed XSS Vulnerability for URL field

Location:

facebook-pagelike-widget

Files:

• tags/6.4.1 (added)
• tags/6.4.1/FacebookLocales.json (added)
• tags/6.4.1/admin (added)
• tags/6.4.1/admin/assets (added)
• tags/6.4.1/admin/assets/css (added)
• tags/6.4.1/admin/assets/css/add-review.css (added)
• tags/6.4.1/admin/assets/js (added)
• tags/6.4.1/admin/assets/js/custom.js (added)
• tags/6.4.1/admin/includes (added)
• tags/6.4.1/admin/includes/add-review.php (added)
• tags/6.4.1/facebook_widget.php (added)
• tags/6.4.1/facebook_widget.po (added)
• tags/6.4.1/fb.js (added)
• tags/6.4.1/fb_class.php (added)
• tags/6.4.1/loader.gif (added)
• tags/6.4.1/readme.txt (added)
• tags/6.4.1/screenshot-1.png (added)
• tags/6.4.1/screenshot-2.png (added)
• tags/6.4.1/screenshot-3.png (added)
• tags/6.4.1/short_code.php (added)
• trunk/facebook_widget.php (modified) (2 diffs)
• trunk/fb_class.php (modified) (1 diff)
• trunk/readme.txt (modified) (2 diffs)

facebook-pagelike-widget/trunk/facebook_widget.php

@@ -2 +2 @@
 /**
  * @package Widget for Social Page Feeds
- * @version 6.4
+ * @version 6.4.1
  */
 /*
@@ -9 +9 @@
 Description: This widget adds a Simple Facebook Page Like Widget into your WordPress website sidebar within few minutes.
 Author: Milap Patel
-Version: 6.4
+Version: 6.4.1
 Author URI: https://patelmilap.wordpress.com/
 Text Domain: facebook-pagelike-widget

facebook-pagelike-widget/trunk/fb_class.php

@@ -71 +71 @@
         
         $instance['title']                          =   strip_tags( $new_instance['title'] );
-        $instance['fb_url']                         =   strip_tags( $new_instance['fb_url'] );
+        $instance['fb_url']                         =   strip_tags( htmlspecialchars($new_instance['fb_url']) );
         $instance['width']                          =   strip_tags( $new_instance['width'] );
         $instance['height']                         =   strip_tags( $new_instance['height'] );

facebook-pagelike-widget/trunk/readme.txt

@@ -5 +5 @@
 Requires at least: 3.0.1
 Tested up to: 6.7.1
-Stable tag: 6.4
+Stable tag: 6.4.1
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -116 +116 @@
 == Changelog ==
 
+= Version 6.4.1 =
+* Fixed XSS Vulnerability for URL field.
+
 = Version 6.4 =
 * Removed the Custom CSS option from widget settings, as WordPress now includes its own Custom CSS option.