Changeset 3302588

Timestamp:

05/29/2025 03:02:57 AM (7 months ago)

Author:

ninjateam

Message:

Version 1.2

Location:

ninjateam-telegram/trunk

Files:

• blocks/src/init.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• telegram.php (modified) (3 diffs)

ninjateam-telegram/trunk/blocks/src/init.php

@@ -122 +122 @@
         $btn_icon_or_image = '';
         if (empty($attributes['imageUrl'])) {
-            $btn_icon_or_image = '<div class="tele__btn_icon"><img src="' . NTA_TELEGRAM_PLUGIN_URL . 'assets/img/telegram_logo.svg' . '" alt=' . $attributes['imageAlt'] . '/></div>';
+            $btn_icon_or_image = '<div class="tele__btn_icon"><img src="' . esc_attr(NTA_TELEGRAM_PLUGIN_URL) . 'assets/img/telegram_logo.svg" alt="' . esc_attr($attributes['imageAlt']) . '"/></div>';
         } else {
-            $btn_icon_or_image = '<div class="tele__cs_img"><div class="tele__cs_img_wrap" style="background: url(' . $attributes['imageUrl'] . ') center center no-repeat; background-size: cover;"></div></div>';
+            $btn_icon_or_image = '<div class="tele__cs_img"><div class="tele__cs_img_wrap" style="background: url(' . esc_attr($attributes['imageUrl']) . ') center center no-repeat; background-size: cover;"></div></div>';
         }
         $html = '';
         $html .= '<div style="margin: 30px 0 30px;">';
-        $html .= '<a target="_blank" href="https://t.me/' . $attributes['username'] . '" class="tele__button ' . $btnStyleClass . ' tele__stt_online ' . $avatarClass . '" style="background-color: ' . $attributes['buttonColor'] . '; color: ' . $attributes['textColor'] . '">';
-        $html .= $btn_icon_or_image;
+        $html .= '<a target="_blank" href="https://t.me/' . esc_attr($attributes['username']) . '" class="tele__button ' . esc_attr($btnStyleClass) . ' tele__stt_online ' . esc_attr($avatarClass) . '" style="background-color: ' . esc_attr($attributes['buttonColor']) . '; color: ' . esc_attr($attributes['textColor']) . '">';
+        $html .= wp_kses_post($btn_icon_or_image);
         $html .= '<div class="tele__btn_txt">';
         if (!empty($attributes['buttonTitle'])) {
             $html .= '<div class="tele__cs_info">';
-            $html .= '<div class="tele__cs_name" style="color: ' . $attributes['textColor'] . '">' . $attributes['buttonTitle'] . '</div>';
+            $html .= '<div class="tele__cs_name" style="color: ' . esc_attr($attributes['textColor']) . '">' . esc_html($attributes['buttonTitle']) . '</div>';
             $html .= '<div class="tele__cs_status">Online</div></div>';
         }
-        $html .= '<div class="tele__btn_title">' . $attributes['buttonInfo'] . '</div></div></a></div>';
+        $html .= '<div class="tele__btn_title">' . esc_html($attributes['buttonInfo']) . '</div></div></a></div>';
         return $html;
     }

ninjateam-telegram/trunk/readme.txt

@@ -4 +4 @@
 Requires at least: 3.0
 Tested up to: 6.8
-Stable tag: 1.1
+Stable tag: 1.2
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -104 +104 @@
 == Changelog ==
 
+= May 29, 2025 - Version 1.2 =
+- Fixed: Stored Cross-Site Scripting via Username Parameter
+
 = Dec 18, 2024 - Version 1.1 =
 - Fixed: Security (Stored Cross-Site Scripting)

ninjateam-telegram/trunk/telegram.php

@@ -5 +5 @@
  * Plugin URI:        https://ninjateam.org/wordpress-telegram-chat
  * Description:       Integrate your Telegram experience directly into your website. This is one of the best way to connect and interact with your customer.
- * Version:           1.1
+ * Version:           1.2
  * Author:            NinjaTeam
  * Author URI:        https://ninjateam.org
@@ -15 +15 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'NTA_TELEGRAM_VERSION', '1.1' );
+define( 'NTA_TELEGRAM_VERSION', '1.2' );
 define( 'NTA_TELEGRAM_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
 define( 'NTA_TELEGRAM_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
@@ -21 +21 @@
 
 
-if ( file_exists( dirname( __FILE__ ) . '/includes/Review.php' ) ) {
-    require_once dirname( __FILE__ ) . '/includes/Review.php';
+if ( file_exists( __DIR__ . '/includes/Review.php' ) ) {
+    require_once __DIR__ . '/includes/Review.php';
 }