Changeset 3255024

Timestamp:

03/12/2025 08:54:47 PM (9 months ago)

Author:

shanebp

Message:

new commit for plugin team

Location:

bp-email-assign-templates/trunk

Files:

• pp-email-templates-admin-buddyboss.php (modified) (2 diffs)
• pp-email-templates-admin-buddypress.php (modified) (1 diff)
• pp-email-templates-admin.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)

bp-email-assign-templates/trunk/pp-email-templates-admin-buddyboss.php

@@ -344 +344 @@
             'ajax'  => false
             ) );
-         }
+        }
 
         function get_columns() {
@@ -367 +367 @@
             
             $id = absint( $id );
-
-            $wpdb->query( "DELETE FROM $wpdb->options WHERE option_id = $id" );
-
+            
+            $option_name = $wpdb->get_var( "SELECT option_name FROM $wpdb->options WHERE option_id = $id" );
+            
+            if ( strncmp( $option_name, "bp-email-template-", 18 ) === 0 ) {
+                $wpdb->query( "DELETE FROM $wpdb->options WHERE option_id = $id" );
+            }
+            
         }
 

bp-email-assign-templates/trunk/pp-email-templates-admin-buddypress.php

@@ -358 +358 @@
             
             $id = absint( $id );
-
-            $wpdb->query( "DELETE FROM $wpdb->options WHERE option_id = $id" );
-
+            
+            $option_name = $wpdb->get_var( "SELECT option_name FROM $wpdb->options WHERE option_id = $id" );
+            
+            if ( strncmp( $option_name, "bp-email-template-", 18 ) === 0 ) {
+                $wpdb->query( "DELETE FROM $wpdb->options WHERE option_id = $id" );
+            }
+            
         }
 

bp-email-assign-templates/trunk/pp-email-templates-admin.php

@@ -356 +356 @@
         function delete_eto( $id ) {
             global $wpdb;
-                
+            
             $id = absint( $id );
-
-            $wpdb->query( "DELETE FROM $wpdb->options WHERE option_id = $id" );
-
+            
+            $option_name = $wpdb->get_var( "SELECT option_name FROM $wpdb->options WHERE option_id = $id" );
+            
+            if ( strncmp( $option_name, "bp-email-template-", 18 ) === 0 ) {
+                $wpdb->query( "DELETE FROM $wpdb->options WHERE option_id = $id" );
+            }
+            
         }
 

bp-email-assign-templates/trunk/readme.txt

@@ -55 +55 @@
 
 = 1.7 =
-* fixes another XSS security issue
+* fixes arbitrary option value deletion risk
 
 = 1.6 =
@@ -86 +86 @@
 
 = 1.7 =
-* fixes another XSS security issue
+* fixes arbitrary option value deletion risk
 
 = 1.6 =