WordPress.org
Get WordPress

Plugin Directory

Changeset 3384308


Ignore:
Timestamp:
10/25/2025 05:52:52 AM (3 months ago)
Author:
Litonice13
Message:

security issue fixed

Location:
image-hover-effects-elementor-addon
Files:
58 added
4 edited

Legend:

Unmodified
Added
Removed

  • image-hover-effects-elementor-addon/trunk/Inc/Addon/Image_Hover_Effects.php

    r2957172 r3384308  
    10961096
    10971097}
     1098

  • image-hover-effects-elementor-addon/trunk/Libs/Recommended.php

    r2957172 r3384308  
    290290                        wp_send_json_error( array( 'mess' => __( 'Nonce is invalid', 'image-hover-effects-elementor-addon' ) ) );
    291291                    }
     292
     293                    // Check if user has permission to activate plugins
     294                    if ( ! current_user_can( 'activate_plugins' ) ) {
     295                        wp_send_json_error( array( 'mess' => __( 'You do not have permission to activate plugins.', 'image-hover-effects-elementor-addon' ) ) );
     296                    }
     297
    292298                    $file   = sanitize_text_field( wp_unslash( $_POST['file'] ) );
    293299                    $result = activate_plugin( $file );
    … …  
    345351                        wp_send_json_error( array( 'mess' => __( 'Nonce is invalid', 'image-hover-effects-elementor-addon' ) ) );
    346352                    }
    347                     $plugin   = sanitize_text_field( wp_unslash( $_POST['plugin'] ) );
     353
     354                    // Check if user has permission to install/update plugins
     355                    if ( ! current_user_can( 'install_plugins' ) ) {
     356                        wp_send_json_error( array( 'mess' => __( 'You do not have permission to install or update plugins.', 'image-hover-effects-elementor-addon' ) ) );
     357                    }
     358
     359                    $plugin   = esc_url_raw( wp_unslash( $_POST['plugin'] ) );
    348360                    $type     = isset( $_POST['type'] ) ? sanitize_text_field( wp_unslash( $_POST['type'] ) ) : 'install';
     361
     362                    // Validate plugin URL to ensure it's from wordpress.org or allowed sources
     363                    $allowed_hosts = array( 'downloads.wordpress.org', 'wordpress.org' );
     364                    $plugin_host   = wp_parse_url( $plugin, PHP_URL_HOST );
     365
     366                    if ( ! in_array( $plugin_host, $allowed_hosts, true ) ) {
     367                        wp_send_json_error( array( 'mess' => __( 'Invalid plugin source. Only WordPress.org plugins are allowed.', 'image-hover-effects-elementor-addon' ) ) );
     368                    }
     369
    349370                    $skin     = new \WP_Ajax_Upgrader_Skin();
    350371                    $upgrader = new \Plugin_Upgrader( $skin );
    … …  
    385406                        if ( $plugin_data && ! is_wp_error( $plugin_data ) ) {
    386407                            $install_status = \install_plugin_install_status( $plugin_data );
     408
     409                            // Check activation permission before activating
     410                            if ( ! current_user_can( 'activate_plugins' ) ) {
     411                                wp_send_json_error( array( 'mess' => __( 'Plugin installed but you do not have permission to activate it.', 'image-hover-effects-elementor-addon' ) ) );
     412                            }
     413
    387414                            $active_plugin  = activate_plugin( $install_status['file'] );
    388415
    … …  
    408435                        }
    409436                    } else {
     437                        // For updates, validate that the plugin parameter is a valid plugin file path
     438                        if ( ! validate_file( $plugin ) === 0 ) {
     439                            wp_send_json_error( array( 'mess' => __( 'Invalid plugin file path.', 'image-hover-effects-elementor-addon' ) ) );
     440                        }
     441
    410442                        $is_active = is_plugin_active( $plugin );
    411443                        $result    = $upgrader->upgrade( $plugin );
    … …  
    418450                            );
    419451                        } else {
    420                             activate_plugin( $plugin );
     452                            // Check activation permission before re-activating
     453                            if ( $is_active && current_user_can( 'activate_plugins' ) ) {
     454                                activate_plugin( $plugin );
     455                            }
    421456                            wp_send_json_success(
    422457                                array(

  • image-hover-effects-elementor-addon/trunk/image-hover-effects-elementor-addon.php

    r2959929 r3384308  
    44 * Plugin URI:  https://master-addons.com/demos/image-hover-effects/
    55 * Description: Image Hover Effects addon for elementor page builder plugin. Compare Before and After Images beautifully.
    6  * Version:     1.0.2.3
     6 * Version:     1.0.2.4
    77 * Author:      Jewel Theme
    88 * Author URI:  https://jeweltheme.com

  • image-hover-effects-elementor-addon/trunk/readme.txt

    r2959929 r3384308  
    44Tags: media, gallery, image, hover, effects, image hover, image hover effects, photo hover, image title, elementor, elementor addon
    55Requires at least: 4.0
    6 Tested up to: 6.3
    7 Stable tag: 1.0.2.3
     6Tested up to: 6.8
     7Stable tag: 1.0.2.4
    88Requires PHP: 5.6
    99License: GPLv3 or later
    … …  
    127127
    128128
    129 = 1.0.2 (23-08-2022)=
     129
     130== Changelog ==
     131 = 1.0.2.4 (25-10-2025) =
     132 * Security: Fixed Security Issues
     133 * Security: Added capability checks to prevent unauthorized plugin installations
     134 * Security: Added URL validation to restrict plugin sources to WordPress.org only
     135 * Updated: WordPress 6.8 compatibility tested
     136
     137= 1.0.2 (23-08-2022) =
    130138* Updated: WordPress 6.3 compatibility checked and fixed bugs
    131139
    132 
    133 == Changelog ==
    134  = 1.0.0 (09-06-2020)=
     140 = 1.0.0 (09-06-2020) =
    135141 * Initial Release
    136142
Note: See TracChangeset for help on using the changeset viewer.