WordPress.org
Get WordPress

Plugin Directory

Changeset 3269062


Ignore:
Timestamp:
04/08/2025 04:32:16 PM (11 months ago)
Author:
marcusbs
Message:

Fixed security vulnerability related to a query.

Location:
wp-mailing-group
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • wp-mailing-group/tags/3.0.0/template/mg_sendmessage.php

    r3268122 r3269062  
    55$actreq = sanitize_text_field($_REQUEST["act"]);
    66
    7 $gid = sanitize_text_field($_REQUEST['gid']);
    8 
    9 $addme = sanitize_text_field($_REQUEST["addme"]);
    10 
    11 $id = sanitize_text_field($_REQUEST['id']);$_POST = stripslashes_deep( $_POST );
     7$gid = absint($_REQUEST['gid']);
     8
     9$addme = absint($_REQUEST["addme"]);
     10
     11// Apply stripslashes before sanitization to ensure proper sanitization
     12$_POST = stripslashes_deep($_POST);
     13// Ensure $id is an integer to prevent SQL injection
     14$id = isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0;
    1215
    1316/* get all variables */
    … …  
    3134if($addme==1) {
    3235
    33     $sql = "UPDATE `$table_name_requestmanager` SET message_sent = message_sent + 1 WHERE id = '".$id."'";
    34 
    35     $wpdb->query($sql);
     36    // Use prepared statement to prevent SQL injection
     37    $wpdb->query($wpdb->prepare("UPDATE `$table_name_requestmanager` SET message_sent = message_sent + 1 WHERE id = %d", $id));
    3638
    3739    wpmg_sendmessagetoSubscriber($gid, $id, $_POST);

  • wp-mailing-group/trunk/template/mg_sendmessage.php

    r3268122 r3269062  
    55$actreq = sanitize_text_field($_REQUEST["act"]);
    66
    7 $gid = sanitize_text_field($_REQUEST['gid']);
    8 
    9 $addme = sanitize_text_field($_REQUEST["addme"]);
    10 
    11 $id = sanitize_text_field($_REQUEST['id']);$_POST = stripslashes_deep( $_POST );
     7$gid = absint($_REQUEST['gid']);
     8
     9$addme = absint($_REQUEST["addme"]);
     10
     11// Apply stripslashes before sanitization to ensure proper sanitization
     12$_POST = stripslashes_deep($_POST);
     13// Ensure $id is an integer to prevent SQL injection
     14$id = isset($_REQUEST['id']) ? absint($_REQUEST['id']) : 0;
    1215
    1316/* get all variables */
    … …  
    3134if($addme==1) {
    3235
    33     $sql = "UPDATE `$table_name_requestmanager` SET message_sent = message_sent + 1 WHERE id = '".$id."'";
    34 
    35     $wpdb->query($sql);
     36    // Use prepared statement to prevent SQL injection
     37    $wpdb->query($wpdb->prepare("UPDATE `$table_name_requestmanager` SET message_sent = message_sent + 1 WHERE id = %d", $id));
    3638
    3739    wpmg_sendmessagetoSubscriber($gid, $id, $_POST);
Note: See TracChangeset for help on using the changeset viewer.