WordPress.org
Get WordPress

Plugin Directory

Changeset 3252921


Ignore:
Timestamp:
03/09/2025 07:00:40 PM (9 months ago)
Author:
xavivars
Message:

Bugfixes

Location:
xv-random-quotes/trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • xv-random-quotes/trunk/changelog.txt

    r3212536 r3252921  
    11== XV Random Quotes ==
     2= 1.41 =
     3Some bugfixes
     4
    25= 1.40 =
    36Increases length of source

  • xv-random-quotes/trunk/inc/stray_manage.php

    r1475784 r3252921  
    1212    if( $quotesoptions['stray_multiuser'] == false && !current_user_can('manage_options') )
    1313        die('Access Denied');
     14
     15       
     16    if ( !empty($_REQUEST['qa']) && !wp_verify_nonce($_POST['xv_random_quotes_tools'],'xv_random_quotes') )
     17    {
     18        die('Access Denied. Invalid nonce');
     19    }
     20
    1421
    1522    //decode and intercept
    … …  
    2734
    2835    if(isset($_GET['qo'])){
    29         $orderby = $_GET['qo'];
    30         $quotesoptions['stray_quotes_order'] = $_GET['qo'];
    31     }
    32     if(isset($_GET['qp']))$pages = $_GET['qp'];
     36        $orderby = sanitize_text_field($_GET['qo']);
     37        $quotesoptions['stray_quotes_order'] = sanitize_text_field($_GET['qo']);
     38    }
     39    if(isset($_GET['qp']))$pages = sanitize_text_field($_GET['qp']);
    3340
    3441    if(isset($_GET['qr'])){
    3542        $rows = $_GET['qr'];
    36         $quotesoptions['stray_quotes_rows'] = $_GET['qr'];
     43        $quotesoptions['stray_quotes_rows'] = sanitize_text_field($_GET['qr']);
    3744    }
    3845
    3946    if(isset($_GET['qc'])){
    4047        $categories = $_GET['qc'];
    41         $quotesoptions['stray_quotes_categories'] = $_GET['qc'];
     48        $quotesoptions['stray_quotes_categories'] = sanitize_text_field($_GET['qc']);
    4249    }
    4350
    4451    if(isset($_GET['qs'])){
    45         $sort = $_GET['qs'];
    46         $quotesoptions['stray_quotes_sort'] = $_GET['qs'];
     52        $sort = sanitize_text_field($_GET['qs']);
     53        $quotesoptions['stray_quotes_sort'] = sanitize_text_field($_GET['qs']);
    4754    }
    4855
    4956    /* zL: added: search keyword */
    5057    // get search keyword, if any ('l' in 'ql' stands for 'look');
    51     $keyword = isset($_GET['ql']) ? $_GET['ql'] : ''; // escaped later
     58    $keyword = isset($_GET['ql']) ? sanitize_text_field($_GET['ql']) : ''; // escaped later
    5259
    5360    $offset = ($pages - 1) * $rows;
    … …  
    132139            <script src="<?php echo WP_STRAY_QUOTES_PATH ?>inc/stray_quicktags.js" type="text/javascript"></script>
    133140            <form name="quoteform" id="quoteform" method="post" action="<?php echo $_SERVER['REQUEST_URI'] ?>">
     141                <?php wp_nonce_field('xv_random_quotes','xv_random_quotes_manage'); ?>
    134142                <input type="hidden" name="qa" value="edit_save">
    135143                <input type="hidden" name="qi" value="<?php echo $quoteID; ?>">
    … …  
    490498        $bulkurl = remove_querystring_var($bulkurl, 'qi');
    491499        ?><form name="bulkform" id="bulkform" method="post" action="<?php echo $bulkurl ?>">
     500        <?php wp_nonce_field('xv_random_quotes','xv_random_quotes_manage'); ?>
    492501        <div class="tablenav">
    493502        <div class="alignleft actions" style="margin-right:10px">

  • xv-random-quotes/trunk/inc/stray_new.php

    r1475784 r3252921  
    1212    if( $quotesoptions['stray_multiuser'] == false && !current_user_can('manage_options') )
    1313        die('Access Denied');
     14
     15
     16    if ( !empty($_REQUEST['action']) && !wp_verify_nonce($_POST['xv_random_quotes_new'],'xv_random_quotes') )
     17    {
     18        die('Access Denied. Invalid nonce');
     19    }
    1420
    1521    //decode and intercept
    … …  
    207213
    208214            <p><input type="submit" name="save"  class="button-primary" value="<?php _e('Add quote','stray-quotes') ?> &raquo;" /></p>
     215            <?php wp_nonce_field('xv_random_quotes','xv_random_quotes_new'); ?>
    209216        </form></div>
    210217

  • xv-random-quotes/trunk/inc/stray_remove.php

    r3212515 r3252921  
    1616    //handle the post event
    1717    if(isset($_POST['do']) && sanitize_text_field($_POST['do'])) {
     18
     19        if ( !wp_verify_nonce($_POST['xv_random_quotes_remove'],'xv_random_quotes') )
     20        {
     21            die('Access Denied. Invalid nonce');
     22        }
    1823
    1924        //update options
    … …  
    4550        // the deactivation form ?>
    4651        <form method="post" action="<?php $_SERVER['REQUEST_URI'] ?>">
     52        <?php wp_nonce_field('xv_random_quotes','xv_random_quotes_remove'); ?>
    4753        <div class="wrap">
    4854        <h2><?php _e('Remove and deactivate','stray-quotes') ?></h2>

  • xv-random-quotes/trunk/inc/stray_tools.php

    r1283940 r3252921  
    1414    if(isset($_POST['do']) && sanitize_text_field($_POST['do'])) {
    1515       
     16        if ( !wp_verify_nonce($_POST['xv_random_quotes_tools'],'xv_random_quotes') )
     17        {
     18            die('Access Denied. Invalid nonce');
     19        }
     20
    1621        $post_do = sanitize_text_field($_POST['do']);
    1722       
    … …  
    170175    <p class="submit"><input type="hidden" name="do" value="Update" />
    171176    <input type="submit" name="boptions" value="<?php _e('Apply bookmarklet options', 'stray-quotes'); ?>">
     177    <?php wp_nonce_field('xv_random_quotes','xv_random_quotes_tools'); ?>
    172178    </p></form><?php } ?>
    173179
    … …  
    197203    <p class="submit">&nbsp;<input type="hidden" name="do" value="Update" /><input type="submit" name="enable" value="<?php _e('Toggle shortcodes', 'stray-quotes'); ?>">
    198204    </p>
     205    <?php wp_nonce_field('xv_random_quotes','xv_random_quotes_tools'); ?>
    199206    </form></blockquote>
    200207
    … …  
    206213    <p class="submit">&nbsp;<input type="hidden" name="do" value="Update" /><input type="submit" name="submit" value="<?php _e('Reset index', 'stray-quotes'); ?>">
    207214    </p>
     215    <?php wp_nonce_field('xv_random_quotes','xv_random_quotes_tools'); ?>
    208216    </form></blockquote>
    209217
    … …  
    217225    <p class="submit">&nbsp;<input type="hidden" name="do" value="Update" /><input type="submit" name="resetsettings" value="<?php _e('Reset Settings', 'stray-quotes'); ?>">
    218226    </p>
     227    <?php wp_nonce_field('xv_random_quotes','xv_random_quotes_tools'); ?>
    219228    </form></blockquote>
    220229

  • xv-random-quotes/trunk/lib/class.constants.php

    r3212536 r3252921  
    1616
    1717    const PLUGIN_OPTIONS = 'stray_quotes_options';
    18     const VERSION = '1.40';
     18    const VERSION = '1.41';
    1919    const DEFAULT_CATEGORY_OPTION    = 'stray_default_category';
    2020    const DEFAULT_RELOAD_TEXT_OPTION     = 'stray_loader';

  • xv-random-quotes/trunk/readme.txt

    r3212536 r3252921  
    55Requires at least: 2.3
    66Tested up to: 6.7
    7 Stable tag: 1.40
     7Stable tag: 1.41
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html

  • xv-random-quotes/trunk/xv-random-quotes.php

    r3212536 r3252921  
    55Author: Xavi Ivars
    66Author URI: http://xavi.ivars.me/
    7 Version: 1.40
     7Version: 1.41
    88License: http://www.gnu.org/copyleft/gpl.html GNU General Public License
    99*/
Note: See TracChangeset for help on using the changeset viewer.