WordPress.org
Get WordPress

Plugin Directory

Changeset 3325924


Ignore:
Timestamp:
07/10/2025 08:58:28 PM (9 months ago)
Author:
marceljm
Message:

Security issue

Location:
featured-image-from-url/trunk
Files:
17 edited

Legend:

Unmodified
Added
Removed

  • featured-image-from-url/trunk/admin/api.php

    r3248885 r3325924  
    192192function fifu_get_ip() {
    193193    foreach (array('HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key) {
    194         if (array_key_exists($key, $_SERVER) === true) {
     194        if (isset($_SERVER[$key]) === true) {
    195195            foreach (explode(',', $_SERVER[$key]) as $ip) {
    196196                $ip = trim($ip);
    … …  
    200200        }
    201201    }
    202     return $_SERVER['REMOTE_ADDR'];
     202    return isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '127.0.0.1';
    203203}
    204204
    … …  
    207207        return json_decode(FIFU_NO_CREDENTIALS);
    208208
    209     $images = $request['selected'];
     209    $images = isset($request['selected']) ? $request['selected'] : [];
    210210
    211211    return fifu_create_thumbnails_list($images, false);
    … …  
    231231        if (!$cron) {
    232232            // manual
    233             $post_id = $image[0];
    234             $url = $image[1];
    235             $meta_key = $image[2];
    236             $meta_id = $image[3];
    237             $is_category = $image[4] == 1;
    238             $video_url = $image[5];
     233            $post_id = isset($image[0]) ? $image[0] : null;
     234            $url = isset($image[1]) ? $image[1] : null;
     235            $meta_key = isset($image[2]) ? $image[2] : null;
     236            $meta_id = isset($image[3]) ? $image[3] : null;
     237            $is_category = isset($image[4]) ? ($image[4] == 1) : false;
     238            $video_url = isset($image[5]) ? $image[5] : null;
    239239        } else {
    240240            // upload auto
    … …  
    445445
    446446    $rows = array();
    447     $images = $request['selected'];
     447    $images = isset($request['selected']) ? $request['selected'] : [];
    448448    $total = count($images);
    449449    $url_sign = '';
    450450    foreach ($images as $image) {
    451         $storage_id = $image['storage_id'];
     451        $storage_id = isset($image['storage_id']) ? $image['storage_id'] : null;
    452452        if (!$storage_id)
    453453            continue;
    … …  
    843843
    844844function fifu_api_list_all_fifu(WP_REST_Request $request) {
    845     $page = (int) $request['page'];
    846     $type = $request['type'];
    847     $keyword = $request['keyword'];
     845    $page = (int) (isset($request['page']) ? $request['page'] : 0);
     846    $type = isset($request['type']) ? $request['type'] : null;
     847    $keyword = isset($request['keyword']) ? $request['keyword'] : null;
    848848    $urls = fifu_db_get_all_urls($page, $type, $keyword);
    849849    return $urls;
    … …  
    854854        return null;
    855855
    856     $page = (int) $request['page'];
    857     $type = $request['type'];
    858     $keyword = $request['keyword'];
     856    $page = (int) (isset($request['page']) ? $request['page'] : 0);
     857    $type = isset($request['type']) ? $request['type'] : null;
     858    $keyword = isset($request['keyword']) ? $request['keyword'] : null;
    859859    return fifu_db_get_posts_with_internal_featured_image($page, $type, $keyword);
    860860}

  • featured-image-from-url/trunk/admin/column.php

    r3294304 r3325924  
    256256function fifu_optimized_column_image($url, $att_id) {
    257257    if (fifu_is_from_speedup($url)) {
    258         $url = explode('?', $url)[0];
     258        $aux = explode('?', $url);
     259        $url = isset($aux[0]) ? $aux[0] : $url;
    259260        return fifu_speedup_get_signed_url($url, 128, 128, null, null, false);
    260261    }

  • featured-image-from-url/trunk/admin/dimensions.php

    r3322839 r3325924  
    2525    "https://img.youtube.com",
    2626    "https://cdn.diariodeavisos.com",
     27    "https://i.guim.co.uk",
    2728]);
    2829

  • featured-image-from-url/trunk/admin/html/js/meta-box.js

    r3115860 r3325924  
    112112    var image = new Image();
    113113    jQuery(image).attr('onload', 'fifu_store_sizes(this);');
     114    image.onerror = function () {
     115        // Set the background to the fallback error image
     116        jQuery("#fifu_image").css('background-image', "url('https://storage.googleapis.com/featuredimagefromurl/image-not-found.jpg')");
     117    };
    114118    jQuery(image).attr('src', url);
    115119}
    … …  
    123127    jQuery("#fifu_image").on('click', function (evt) {
    124128        evt.stopImmediatePropagation();
     129
     130        // Do not open lightbox if the error image is set as background
     131        const errorImg = "https://storage.googleapis.com/featuredimagefromurl/image-not-found.jpg";
     132        const bg = jQuery("#fifu_image").css('background-image');
     133        if (bg && bg.includes(errorImg)) {
     134            return;
     135        }
     136
    125137        let url = fifu_convert(jQuery("#fifu_input_url").val());
    126138        let adjustedUrl = fifu_cdn_adjust(url);

  • featured-image-from-url/trunk/admin/html/meta-box.html

    r3294304 r3325924  
    1010                       name="fifu_input_alt"
    1111                       placeholder="<?php $fifu['common']['alt']() ?>"
    12                        value="<?php echo $alt; ?>"
     12                       value="<?php echo esc_attr($alt); ?>"
    1313                       style="<?php echo $width ?>;font-size:13px;margin:0px 0px 0px 2px" />
    1414            </td>
    … …  
    2525    <div id="fifu_image"
    2626         style="<?php echo $height, $show_image ?>
    27          background:url('<?php echo $url; ?>') no-repeat center center;
     27         background:url('<?php echo esc_url($url); ?>') no-repeat center center;
    2828         background-size:cover;
    2929         cursor:zoom-in;
    … …  
    3939                       name="fifu_input_url"
    4040                       placeholder="<?php $fifu['image']['keywords']() ?>"
    41                        value="<?php echo $url; ?>"
     41                       value="<?php echo esc_url($url); ?>"
    4242                       style="<?php echo $width ?>;font-size:13px;" />
    4343            </td>

  • featured-image-from-url/trunk/admin/html/troubleshooting.html

    r3307677 r3325924  
    7070                    <div class="greybox" style="position: relative; top: -10px;">
    7171                        WP RSS Aggregator feed items have no featured image:<br>
    72                         1) Enable 'FIFU → Settings → Automatic → Auto set featured media from post content → auto set featured media from post content' before fetching the feed source.<br>
     72                        1) Enable 'FIFU → Settings → Automatic → Auto set featured media from post content → Auto set → auto set featured media from post content' before fetching the feed source.<br>
    7373                    </div>                   
    7474                </div>
    … …  
    879879                        Using a video from post content as featured video:<br>
    880880                        1) enable "FIFU Settings → Video → Featured Video"<br>
    881                         2) enable "FIFU Settings → Automatic → Auto set featured media from post content → use the found image/video as featured image/video"<br>
    882                         3) enable "FIFU Settings → Automatic → Auto set featured media from post content → hide the image/video from content"<br>
     881                        2) enable "FIFU Settings → Automatic → Auto set featured media from post content → Auto set → auto set featured media from post content"<br>
     882                        3) select "FIFU Settings → Automatic → Auto set featured media from post content → Media type filter → Video"<br>
    883883                        4) access the campaign and uncheck all options in "Images" box<br>
    884884                        5) click on "Run campaign" button<br>
    … …  
    12361236                    <div class="greybox" style="position: relative; top: -10px">
    12371237                        Setting featured video automatically:<br>
    1238                         1) access "FIFU Settings → Automatic → Auto set featured media from post content";<br>
    1239                         2) enable "use the found image/video as featured image";<br>
    1240                         3) enable "hide the image/video from content";<br>
    1241                         4) access "Zapier → Make a Zap", select YouTube as the first app and configure as you want;<br>
     1238                        1) go to "FIFU Settings → Automatic → Auto set featured media from post content";<br>
     1239                        2) enable "Auto set → auto set featured media from post content";<br>
     1240                        3) select "Media type filter → Video";<br>
     1241                        4) go to "Zapier → Make a Zap", select YouTube as the first app and configure as you want;<br>
    12421242                        5) select WordPress as the second app;<br>
    12431243                        6) click on "Choose Action Event", select "Create Post" and "Continue";<br>

  • featured-image-from-url/trunk/admin/languages.php

    r3217355 r3325924  
    267267    // Dynamically handle locales not in the mapping
    268268    $parts = explode('_', $locale);
    269     return $parts[0]; // Return the first part of the locale (e.g., "es" from "es_ES")
     269    return !empty($parts) ? $parts[0] : $locale; // Return the first part of the locale (e.g., "es" from "es_ES")
    270270}

  • featured-image-from-url/trunk/admin/menu.php

    r3315511 r3325924  
    1212    $fifu = fifu_get_strings_settings();
    1313
    14     if (strpos($_SERVER['REQUEST_URI'], 'featured-image-from-url') !== false || strpos($_SERVER['REQUEST_URI'], 'fifu') !== false) {
     14    if (isset($_SERVER['REQUEST_URI']) && (strpos($_SERVER['REQUEST_URI'], 'featured-image-from-url') !== false || strpos($_SERVER['REQUEST_URI'], 'fifu') !== false)) {
    1515        wp_enqueue_script('font-awesome', 'https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/js/all.min.js');
    1616        wp_enqueue_style('jquery-ui-style1', 'https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.css');
    … …  
    276276    $arrDefaultType = array('fifu_default_cpt');
    277277    $arrOn = array('fifu_wc_zoom', 'fifu_wc_lbox');
    278     $arrOnNo = array('fifu_fake', 'fifu_photon');
     278    $arrOnNo = array('fifu_fake');
    279279    $arrOffNo = array('fifu_data_clean', 'fifu_run_delete_all', 'fifu_reset');
    280280

  • featured-image-from-url/trunk/admin/meta-box.php

    r3294304 r3325924  
    9696    $align = 'text-align:left;';
    9797
    98     $url = get_post_meta($post->ID, 'fifu_image_url', true);
    99     $alt = get_post_meta($post->ID, 'fifu_image_alt', true);
     98    $url = esc_url(get_post_meta($post->ID, 'fifu_image_url', true));
     99    $alt = esc_attr(get_post_meta($post->ID, 'fifu_image_alt', true));
    100100
    101101    if ($url) {
    … …  
    387387function fifu_dokan_product_edit_after_product_tags($post, $post_id) {
    388388    $fifu = fifu_get_strings_dokan();
    389     $url = get_post_meta($post_id, 'fifu_image_url', true);
     389    $url = esc_url(get_post_meta($post_id, 'fifu_image_url', true));
    390390    ?>
    391391
    … …  
    419419function fifu_mvx_product_manager_right_panel_after($post_id) {
    420420    $fifu = fifu_get_strings_dokan();
    421     $url = get_post_meta($post_id, 'fifu_image_url', true);
     421    $url = esc_url(get_post_meta($post_id, 'fifu_image_url', true));
    422422    ?>
    423423

  • featured-image-from-url/trunk/admin/widgets.php

    r3048639 r3325924  
    1313
    1414    public function widget($args, $instance) {
    15         echo $args['before_widget'];
    16         echo $args['after_widget'];
     15        if (isset($args['before_widget'])) {
     16            echo $args['before_widget'];
     17        }
     18        if (isset($args['after_widget'])) {
     19            echo $args['after_widget'];
     20        }
    1721    }
    1822
    … …  
    2630        return $instance;
    2731    }
    28 
    2932}
    3033
    … …  
    4245    public function widget($args, $instance) {
    4346        extract($args);
    44         echo $args['before_widget'];
    45         echo $args['after_widget'];
     47        if (isset($args['before_widget'])) {
     48            echo $args['before_widget'];
     49        }
     50        if (isset($args['after_widget'])) {
     51            echo $args['after_widget'];
     52        }
    4653    }
    4754
    … …  
    5764        return $instance;
    5865    }
    59 
    6066}
    6167
    … …  
    7278
    7379    public function widget($args, $instance) {
    74         echo $args['before_widget'];
    75         echo $args['after_widget'];
     80        if (isset($args['before_widget'])) {
     81            echo $args['before_widget'];
     82        }
     83        if (isset($args['after_widget'])) {
     84            echo $args['after_widget'];
     85        }
    7686    }
    7787
    … …  
    8696        return $instance;
    8797    }
    88 
    8998}
    9099

  • featured-image-from-url/trunk/featured-image-from-url.php

    r3322839 r3325924  
    55 * Plugin URI: https://fifu.app/
    66 * Description: Use a remote image or video as featured image of a post or WooCommerce product.
    7  * Version: 5.1.9
     7 * Version: 5.2.0
    88 * Author: fifu.app
    99 * Author URI: https://fifu.app/
    … …  
    132132
    133133function fifu_uninstall() {
    134     // buddyboss app
    135     if (isset($_REQUEST['page']) && strpos($_REQUEST['page'], 'bbapp') !== false)
     134    global $pagenow;
     135    if ($pagenow !== 'plugins.php')
    136136        return;
    137137

  • featured-image-from-url/trunk/gravity-forms/includes/class-fifu-image-gf-field.php

    r2926179 r3325924  
    133133    public function get_value_save_entry($value, $form, $input_name, $lead_id, $lead) {
    134134        if ($this->phoneFormat == 'standard' && preg_match('/^\D?(\d{3})\D?\D?(\d{3})\D?(\d{4})$/', $value, $matches)) {
    135             $value = sprintf('(%s) %s-%s', $matches[1], $matches[2], $matches[3]);
     135            $value = sprintf('(%s) %s-%s', isset($matches[1]) ? $matches[1] : '', isset($matches[2]) ? $matches[2] : '', isset($matches[3]) ? $matches[3] : '');
    136136        }
    137137

  • featured-image-from-url/trunk/includes/jetpack.php

    r3307677 r3325924  
    9393        return true;
    9494
    95     $blocklist = array('localhost', 'amazon-adsystem.com', 'sapo.io', 'i.guim.co.uk', 'image.influenster.com', 'api.screenshotmachine.com', 'img.brownsfashion.com', 'fbcdn.net', 'nitrocdn.com', 'brightspotcdn.com', 'realtysouth.com', 'tiktokcdn.com', 'fdcdn.akamaized.net', 'blockchainstock.azureedge.net', 'aa.com.tr', 'cdn.discordapp.com', 'download.schneider-electric.com', 'images.twojjs.com', 'preview.redd.it', 'external-preview.redd.it', 'i.redd.it', 'cdn.fbsbx.com', 'canva.com', 'cdn.fifu.app', 'cloud.fifu.app', 'images.placeholders.dev');
     95    $blocklist = array('localhost', 'amazon-adsystem.com', 'sapo.io', 'image.influenster.com', 'api.screenshotmachine.com', 'img.brownsfashion.com', 'fbcdn.net', 'nitrocdn.com', 'brightspotcdn.com', 'realtysouth.com', 'tiktokcdn.com', 'fdcdn.akamaized.net', 'blockchainstock.azureedge.net', 'aa.com.tr', 'cdn.discordapp.com', 'download.schneider-electric.com', 'images.twojjs.com', 'preview.redd.it', 'external-preview.redd.it', 'i.redd.it', 'cdn.fbsbx.com', 'canva.com', 'cdn.fifu.app', 'cloud.fifu.app', 'images.placeholders.dev');
    9696    foreach ($blocklist as $domain) {
    9797        if (strpos($url, $domain) !== false)

  • featured-image-from-url/trunk/includes/speedup.php

    r3311133 r3325924  
    151151
    152152    $aux = explode('-', $url);
    153     $width = (int) $aux[1];
    154     $height = (int) $aux[2];
     153    $width = isset($aux[1]) ? (int) $aux[1] : 0;
     154    $height = isset($aux[2]) ? (int) $aux[2] : 0;
    155155
    156156    if (isset($parameters['resize'])) {

  • featured-image-from-url/trunk/includes/thumbnail.php

    r3315511 r3325924  
    99
    1010global $pagenow;
    11 if (!in_array($pagenow, array('post.php', 'post-new.php', 'admin-ajax.php', 'wp-cron.php'))) {
     11if (!isset($pagenow) || !in_array($pagenow, array('post.php', 'post-new.php', 'admin-ajax.php', 'wp-cron.php'))) {
    1212    if (is_plugin_active('wordpress-seo/wp-seo.php')) {
    1313        add_action('wpseo_opengraph_image', 'fifu_add_social_tag_yoast');
    … …  
    117117        if (!empty($url)) {
    118118            $buffer_contents = ob_get_contents();
    119             if (strpos($buffer_contents, '<meta property="og:image"') === false) {
     119            if ($buffer_contents !== false && strpos($buffer_contents, '<meta property="og:image"') === false) {
    120120                $url = esc_url($url);
    121121                include 'html/social-home.html';
    … …  
    147147
    148148    // "all products" page
    149     if (function_exists('get_current_screen') && isset(get_current_screen()->parent_file) && get_current_screen()->parent_file == 'edit.php?post_type=product') {
     149    if (function_exists('get_current_screen') && get_current_screen() && isset(get_current_screen()->parent_file) && get_current_screen()->parent_file == 'edit.php?post_type=product') {
    150150        $attr['src'] = fifu_optimized_column_image($url, $attachment->ID);
    151151        return $attr;
    … …  
    185185
    186186    $src = fifu_get_attribute('src', $html);
    187     if (isset($FIFU_SESSION[$src])) {
     187    if (isset($FIFU_SESSION) && isset($FIFU_SESSION[$src])) {
    188188        $data = $FIFU_SESSION[$src];
    189189        if (strpos($html, 'fifu-replaced') !== false)
    … …  
    259259
    260260    global $post;
     261    if (!isset($post) || !isset($post->ID))
     262        return $content;
     263
    261264    $post_id = $post->ID;
    262265    $att_id = get_post_thumbnail_id($post_id);
    … …  
    325328
    326329        $del = substr($src[0], - 1);
    327         $url = fifu_normalize(explode($del, $src[0])[1]);
     330        $url_parts = explode($del, $src[0]);
     331        $url = isset($url_parts[1]) ? fifu_normalize($url_parts[1]) : '';
    328332
    329333        if (!$url || fifu_jetpack_blocked($url) || strpos($url, 'data:image') === 0)
    … …  
    443447function fifu_add_rss() {
    444448    global $post;
     449    if (!isset($post) || !isset($post->ID))
     450        return;
     451
    445452    if (has_post_thumbnail($post->ID)) {
    446453        $thumbnail = fifu_main_image_url($post->ID, true); // external (no CDN)
    … …  
    465472// for ajax pagination
    466473function fifu_posts_results($posts, $query) {
    467     if (!is_admin() && $query->is_main_query() && is_paged()) {
     474    if (!is_admin() && $query->is_main_query() && is_paged() && !empty($posts)) {
    468475        foreach ($posts as $post) {
    469             fifu_add_parameters_single_post($post->ID);
     476            if (isset($post->ID)) {
     477                fifu_add_parameters_single_post($post->ID);
     478            }
    470479        }
    471480    }

  • featured-image-from-url/trunk/includes/util.php

    r3307677 r3325924  
    77
    88    $aux = explode($attribute, $html);
    9     if ($aux)
     9    if (isset($aux[1]))
    1010        $aux = $aux[1];
     11    else
     12        return null;
     13
     14    if (empty($aux))
     15        return null;
    1116
    1217    $quote = $aux[0];

  • featured-image-from-url/trunk/readme.txt

    r3322839 r3325924  
    55Requires at least: 5.6
    66Tested up to: 6.8.1
    7 Stable tag: 5.1.9
     7Stable tag: 5.2.0
    88License: GPLv3
    99License URI: https://www.gnu.org/licenses/gpl-3.0.html
    … …  
    246246== Changelog ==
    247247
     248= 5.2.0 =
     249* Enhancement: Image Not Found message displayed in the post editor when the image URL is invalid; Fix: vulnerability reported by Wordfence (improved validation of values added in FIFU fields via post editor for better security); Fix: potential undefined index notices.
     250
    248251= 5.1.9 =
    249252* Notice: the plugin collects the theme name anonymously (the goal is to identify the most common themes and ensure FIFU works correctly with all of them).
    … …  
    252255* Fix: Optimized Images (performance issue when serving full image size and possible conflicts with images from Cloudinary); Fix: images in the WooCommerce product gallery (not displayed when Optimized Images was disabled).
    253256
    254 = 5.1.7 =
    255 * Enhancement: REST API (JSON examples with highlighted syntax).
    256 
    257257= others =
    258258* [more](https://fifu.app/changelog)
    … …  
    261261== Upgrade Notice ==
    262262
    263 = 5.1.9 =
    264 * Notice: the plugin collects the theme name anonymously (the goal is to identify the most common themes and ensure FIFU works correctly with all of them).
     263= 5.2.0 =
     264* Enhancement: Image Not Found message displayed in the post editor when the image URL is invalid; Fix: vulnerability reported by Wordfence (improved validation of values added in FIFU fields via post editor for better security); Fix: potential undefined index notices.
Note: See TracChangeset for help on using the changeset viewer.