Changeset 3321472

Timestamp:

07/02/2025 10:35:40 PM (5 months ago)

Author:

majick

Message:

0.9.7 trunk commit

Location:

guten-free-options/trunk

Files:

• guten-free-options.php (modified) (19 diffs)
• readme.md (modified) (2 diffs)
• readme.txt (modified) (2 diffs)

guten-free-options/trunk/guten-free-options.php

@@ -5 +5 @@
 Author: Tony Hayes
 Description: Gutenberg Free Options for your WordPressed Burger err I mean Editor
-Version: 0.9.6
+Version: 0.9.7
 Author URI: https://wpmedic.tech
 GitHub Plugin URI: majick777/guten-free-options
@@ -384 +384 @@
 // ----------------------
 // [unused] - via Classic Editor plugin
-function gfo_add_edit_links($actions, $post) {
+function gfo_add_edit_links( $actions, $post ) {
 
     // This is in Gutenberg now.
@@ -461 +461 @@
 
     // --- output the switch editor button on the editor page ---
+    // 0.9.7: add missing escaping to style/class outputs
     echo '<div id="gutenberg-editor-button-wrapper">' . "\n";
         echo '<a href="' . esc_url( $button['url'] ) . '">' . "\n";
             echo '<div id="' . esc_attr( $button['id'] ) . '" class="' . esc_attr( $button['class'] ) . '" title="' . esc_attr( $button['title'] ) . '"';
             if ( !empty( $button['styles'] ) ) {
-                echo ' style="' . $button['styles'] . '"';
+                echo ' style="' . esc_attr( $button['styles'] ) . '"';
             }
             echo '>' . "\n";
-                echo '<span class="'.$button['icon_class'].'"';
+                echo '<span class="' . esc_attr( $button['icon_class'] ) . '"';
                 if ( !empty( $button['icon_style'] ) ) {
-                    echo ' style="' . $button['icon_style'] . '"';
+                    echo ' style="' . esc_attr( $button['icon_style'] ) . '"';
                 }
                 echo '></span>' . "\n";
@@ -680 +681 @@
     $disable_widget_blocks = false;
     $widget_blocks = gfo_get_setting( 'widget_blocks', false );
-    
+
+    // 0.9.7: fix mismatched text domains
     echo '<div class="message">' . "\n";
-        echo '<b>' . esc_html( __( 'Guten Free Options', 'bioship' ) ) . '</b>: ';
+        echo '<b>' . esc_html( __( 'Guten Free Options', 'guten-free-options' ) ) . '</b>: ';
         if ( 'off' == $widget_blocks ) {
-            echo esc_html( __( 'The use of the Block Editor has been disabled for Widgets.', 'bioship' ) );
+            echo esc_html( __( 'The use of the Block Editor has been disabled for Widgets.', 'guten-free-options' ) );
         } elseif ( ( '' == $widget_blocks ) || ( 'auto' == $widget_blocks ) ) {
-            echo esc_html( __( 'No Widgets contain blocks. Auto mode has disabled the Block Editor for Widgets.', 'bioship' ) );
+            echo esc_html( __( 'No Widgets contain blocks. Auto mode has disabled the Block Editor for Widgets.', 'guten-free-options' ) );
         }
         // 0.9.6: link to settings at options-general.php not admin.php
@@ -1243 +1245 @@
     // --- update network default editor setting ---
     if ( isset( $_POST['gfo_network_default_editor'] ) ) {
-        $default_editor = sanitize_text_field( $_POST['gfo_network_default_editor'] );
+        $default_editor = sanitize_text_field( wp_unslash( $_POST['gfo_network_default_editor'] ) );
         $valid = array( 'classic', 'block' );
         if ( in_array( $default_editor, $valid ) ) {
@@ -1299 +1301 @@
     if ( isset( $_GET['updated'] ) ) {
         echo '<tr><td></td><td></td><td>' . "\n";
-        if ( 'yes' == sanitize_text_field( $_GET['updated'] ) ) {
+        if ( 'yes' == sanitize_text_field( wp_unslash( $_GET['updated'] ) ) ) {
             $message = esc_html( $settings['title'] ) . ' ';
             if ( $network ) {
@@ -2233 +2235 @@
     if ( has_filter( 'replace_editor', 'gutenberg_init' )
       || has_filter( 'load-post.php', 'gutenberg_intercept_edit_post' )
-      || has_filter( 'load-post-new.php', 'gutenberg_intercept_post_new') ) {
+      || has_filter( 'load-post-new.php', 'gutenberg_intercept_post_new' ) ) {
         return 'plugin';
     }
@@ -2258 +2260 @@
         if ( 'yes' == gfo_get_setting( 'check_blocks' ) ) {
             $protocol = 'http';
-            if ( isset($_SERVER['HTTPS'] ) && ( 'off' !== $_SERVER['HTTPS'] ) ) {
+            if ( isset( $_SERVER['HTTPS'] ) && ( 'off' !== $_SERVER['HTTPS'] ) ) {
                 $protocol = 'https';
             }
@@ -2342 +2344 @@
         // use querystring or set to post for post-new.php if not specified and on that page
         if ( isset( $_GET['post_type'] ) ) {
-            $post_type = sanitize_text_field( $_GET['post_type'] );
+            $post_type = sanitize_text_field( wp_unslash( $_GET['post_type'] ) );
         } elseif ( gfo_is_gutenberg_admin_url( array( 'post-new.php' ) ) ) {
             $post_type = 'post';
@@ -2378 +2380 @@
     if ( !$locked ) {
         if ( isset( $_GET['editor'] ) ) {
-            if ( 'block' == $_GET['editor'] ) {
+            if ( 'block' == sanitize_text_field( wp_unslash( $_GET['editor'] ) ) ) {
                 $gutenfree['last'] = 'querystring';
                 return true;
-            } elseif ( 'classic' == $_GET['editor'] ) {
+            } elseif ( 'classic' == sanitize_text_field( wp_unslash( $_GET['editor'] ) ) ) {
                 $gutenfree['last'] = 'querystring';
                 return false;
@@ -2625 +2627 @@
     // --- check for editor querystrings (manual user override) ---
     if ( isset( $_GET['editor'] ) ) {
-        if ( 'block' == $_GET['editor'] ) {
+        if ( 'block' == sanitize_text_field( wp_unslash( $_GET['editor'] ) ) ) {
             $gutenfree['last'] = 'querystring';
             return true;
-        } elseif ( 'classic' == $_GET['editor'] ) {
+        } elseif ( 'classic' == sanitize_text_field( wp_unslash( $_GET['editor'] ) ) ) {
             $gutenfree['last'] = 'querystring';
             return false;
@@ -2746 +2748 @@
         $can_edit = false;
         $gutenfree['last'] = 'meta';
-        gfo_debug_log('Post ' . $post_id . ' Meta Other -> Classic' );
+        gfo_debug_log( 'Post ' . $post_id . ' Meta Other -> Classic' );
     }
 
@@ -3105 +3107 @@
 
         // 0.9.6: removed unused and undefined onchange variable
-        echo '<td><span class="editor-override-label">' . __( 'Editor','guten-free-options' ) . '</span></td>';
+        // 0.9.7: adding missing escaping on editor label
+        echo '<td><span class="editor-override-label">' . esc_html( __( 'Editor','guten-free-options' ) ) . '</span></td>';
         echo '<td><select name="editor_override" id="editor_override">';
         foreach ( $options as $option => $label ) {
@@ -3118 +3121 @@
         // --- set a help icon with title for the setting ---
         $posttypeobject = get_post_type_object( get_post_type($post->ID ) );
-        $title = __( 'Set the Editor for this', 'guten-free-options' ) . " " . $posttypeobject->labels->singular_name;
+        $title = __( 'Set the Editor for this', 'guten-free-options' ) . ' ' . $posttypeobject->labels->singular_name;
         echo '<td><span id="editor-override-help" class="dashicons dashicons-editor-help" title="' . esc_attr( $title ) . '"></span></td>';
 
@@ -3187 +3190 @@
     }
     if ( isset( $_POST['editor_override'] ) ) {
-        $override = sanitize_text_field( $_POST['editor_override'] );
+        $override = sanitize_text_field( wp_unslash( $_POST['editor_override'] ) );
         $options = array(
             ''          => __( 'Do Not Override', 'guten-free-options' ),
@@ -3270 +3273 @@
         $referer = sanitize_text_field( wp_unslash( $_POST['_wp_http_referer'] ) );
         if ( false !== strpos( $referer, '&classic-editor' ) ) {
-            $location = add_query_arg('classic-editor', '', $location);
+            $location = add_query_arg( 'classic-editor', '', $location );
         }
         if ( false !== strpos( $referer, '&editor=classic' ) ) {
-            $location = add_query_arg('editor', 'classic', $location );
+            $location = add_query_arg( 'editor', 'classic', $location );
         }
         // not sure if will ever really be needed... but let us add the other way around just in case!
@@ -3319 +3322 @@
 function gfo_get_post_name_only( $post_id ) {
     global $wpdb;
-    $query = "SELECT post_name FROM ".$wpdb->prefix."posts WHERE ID = '%d'";
+    $query = "SELECT post_name FROM " . $wpdb->prefix . "posts WHERE ID = '%d'";
     $query = $wpdb->prepare( $query, $post_id );
     $result = $wpdb->get_var( $query );
@@ -3335 +3338 @@
     global $wpdb;
     // 0.9.6: remove unnecessary quotes around integer value
-    $query = "SELECT post_content FROM ".$wpdb->prefix."posts WHERE ID = %d";
+    $query = "SELECT post_content FROM " . $wpdb->prefix . "posts WHERE ID = %d";
     // 0.9.2: fix to use post_id not id
     $query = $wpdb->prepare( $query, $post_id );
@@ -3352 +3355 @@
         return true;
     }
-    $active_plugins = (array)get_option( 'active_plugins' );
+    $active_plugins = (array) get_option( 'active_plugins' );
     if ( in_array( 'gutenberg/gutenberg.php', $active_plugins ) ) {
         $active = true;

guten-free-options/trunk/readme.md

@@ -10 +10 @@
 Requires at least: 4.9.0
 Tested up to: 6.8.1
-Stable tag: 0.9.6
+Stable tag: 0.9.7
 
-Gutenberg Free Options for your WordPressed Burger err I mean Editor
+Gutenberg Free Options for your WordPressed Burger err I mean Editor.
 
 == Description ==
 
 Want to use and/or not use the new Block Editor (Gutenberg) according to *your needs*?
+
+Guten Free Options provides this for your WordPressed Burger err I mean Editor.
 
 Guten Free Options allows you to smoothly transition your writing experience to WordPress 5+ by giving you full control over when a post should be edited with the Classic Editor or Block Editor... plus have a button to easily switch between them like other page builders.
@@ -73 +75 @@
 
 == Changelog ==
+
+= 0.9.7 =
+* Fixed: extra sanitization and escaping
 
 = 0.9.6 =

guten-free-options/trunk/readme.txt

@@ -10 +10 @@
 Requires at least: 4.9.0
 Tested up to: 6.8.1
-Stable tag: 0.9.6
+Stable tag: 0.9.7
 
 Gutenberg Free Options for your WordPressed Burger err I mean Editor.
@@ -76 +76 @@
 == Changelog ==
 
+= 0.9.7 =
+* Fixed: extra sanitization and escaping
+
 = 0.9.6 =
 * Updated: WordQuest Helper (1.8.3)