Changeset 3281954

Timestamp:

04/25/2025 02:22:44 PM (8 months ago)

Author:

shanebp

Message:

commit 2.3

Location:

bp-messages-tool/trunk

Files:

• loader.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• templates/bpmt-messages-loop.php (modified) (1 diff)

bp-messages-tool/trunk/loader.php

@@ -4 +4 @@
 Plugin URI: https://www.philopress.com
 Description: View Messages for any BuddyPress member via wp-admin screen Tools > BP Messages
-Version: 2.2
+Version: 2.3
 Author: PhiloPress
 Author URI: https://www.philopress.com/

bp-messages-tool/trunk/readme.txt

@@ -6 +6 @@
 Plugin URI: https://philopress.com/
 Requires at least: WP 4.0
-Tested up to: 5.4
-Stable tag: 2.2
+Tested up to: 6.8
+Stable tag: 2.3
 License: GPLv2 or later
 
@@ -44 +44 @@
 
 == Changelog ==
+
+= 2.3 =
+* fix XSS vulnerability
 
 = 2.2 =

bp-messages-tool/trunk/templates/bpmt-messages-loop.php

@@ -12 +12 @@
     $bpmt_get_member = '&user_id=' . $bpmt_user_data->ID;
 else
-    $bpmt_get_member = '&user_id=' . $_GET['user'];
+    $bpmt_get_member = '&user_id=' . intval( sanitize_text_field( $_GET['user'] ) );
 
 
-if( isset( $_GET['mpage'] ) )
-    $bpmt_get_member .= '&mpage=' . $_GET['mpage'];
+if( isset( $_GET['mpage'] ) ) {
+    
+    $mpage = intval( sanitize_text_field( $_GET['mpage'] ) );
+    
+    $bpmt_get_member .= '&mpage=' . $mpage;
+    
+}
 
 $bpmt_get_member .= '&box=' . $bpmt_user_data->box;