Changeset 3251292

Timestamp:

03/05/2025 07:09:41 PM (12 months ago)

Author:

flexmls

Message:

Flexmls WordPress plugin 3.14.29

Location:

flexmls-idx/trunk

Files:

• README.txt (modified) (2 diffs)
• flexmls_connect.php (modified) (2 diffs)
• lib/base.php (modified) (1 diff)
• lib/flexmlsAPI/Core.php (modified) (1 diff)
• views/admin-settings-portal.php (modified) (2 diffs)

flexmls-idx/trunk/README.txt

@@ -5 +5 @@
 Tested up to: 6.7.2
 Requires PHP: 7.4
-Stable tag: 3.14.28
+Stable tag: 3.14.29
 
 Add Flexmls® IDX listings, market statistics, IDX searches, and a contact form on your web site.
@@ -86 +86 @@
 
 == Changelog ==
+= 3.14.29 =
+Efficiency Update
+* Security Improvements
+
 = 3.14.28 =
 Efficiency Update

flexmls-idx/trunk/flexmls_connect.php

@@ -6 +6 @@
 Description: Provides Flexmls&reg; Customers with Flexmls&reg; IDX features on their WordPress websites. <strong>Tips:</strong> <a href="admin.php?page=fmc_admin_settings">Activate your Flexmls&reg; IDX plugin</a> on the settings page; <a href="widgets.php">add widgets to your sidebar</a> using the Widgets Admin under Appearance; and include widgets on your posts or pages using the Flexmls&reg; IDX Widget Short-Code Generator on the Visual page editor.
 Author: FBS
-Version: 3.14.28
+Version: 3.14.29
 Author URI:  https://www.flexmls.com
 Requires at least: 5.0
@@ -17 +17 @@
 const FMC_API_BASE = 'sparkapi.com';
 const FMC_API_VERSION = 'v1';
-const FMC_PLUGIN_VERSION = '3.14.28';
+const FMC_PLUGIN_VERSION = '3.14.29';
 
 define( 'FMC_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );

flexmls-idx/trunk/lib/base.php

@@ -271 +271 @@
     }
 
-    return "<iframe src='{$show_link}' width='{$attr['width']}' height='{$attr['height']}' frameborder='0'></iframe>";
+    $flexmls_iframe = "<iframe src='{$show_link}' width='{$attr['width']}' height='{$attr['height']}' frameborder='0'></iframe>";
+
+    $allowed_tags = array(
+        'iframe' => array(
+          'src'    => true, // Allow src attribute
+          'width'  => true, // Allow width
+          'height' => true, // Allow height
+          'frameborder' => true
+        ),
+    );
+
+    return wp_kses($flexmls_iframe, $allowed_tags);
+    
   }
 

flexmls-idx/trunk/lib/flexmlsAPI/Core.php

@@ -44 +44 @@
         'Accept-Encoding' => "gzip,deflate",
         'Content-Type' => "application/json",
-        'User-Agent' => "FlexMLS WordPress Plugin/3.14.28",
-        'X-SparkApi-User-Agent' => "flexmls-WordPress-Plugin/3.14.28"
+        'User-Agent' => "FlexMLS WordPress Plugin/3.14.29",
+        'X-SparkApi-User-Agent' => "flexmls-WordPress-Plugin/3.14.29"
     );
 

flexmls-idx/trunk/views/admin-settings-portal.php

@@ -23 +23 @@
                 <td>
                     <p>
-                        <input type="text" class="regular-text" name="fmc_settings[oauth_key]" id="oauth_key" autocomplete="off" value="<?php echo ( isset( $fmc_settings[ 'oauth_key' ] ) ? $fmc_settings[ 'oauth_key' ] : '' ); ?>">
+                        <input type="text" class="regular-text" name="fmc_settings[oauth_key]" id="oauth_key" autocomplete="off" value="<?php echo ( isset( $fmc_settings[ 'oauth_key' ] ) ? esc_attr($fmc_settings[ 'oauth_key' ]) : '' ); ?>">
                     </p>
                 </td>
@@ -32 +32 @@
                 </th>
                 <td>
-                    <p><input type="<?php if( isset( $fmc_settings[ 'oauth_secret' ] ) ): ?>password<?php else: ?>text<?php endif; ?>" class="regular-text" name="fmc_settings[oauth_secret]" id="oauth_secret" autocomplete="off" value="<?php echo ( isset( $fmc_settings[ 'oauth_secret' ] ) ? $fmc_settings[ 'oauth_secret' ] : '' ); ?>"></p>
+                    <p><input type="<?php if( isset( $fmc_settings[ 'oauth_secret' ] ) ): ?>password<?php else: ?>text<?php endif; ?>" class="regular-text" name="fmc_settings[oauth_secret]" id="oauth_secret" autocomplete="off" value="<?php echo ( isset( $fmc_settings[ 'oauth_secret' ] ) ? esc_attr($fmc_settings[ 'oauth_secret' ]) : '' ); ?>"></p>
                 </td>
             </tr>