Changeset 3393619

Timestamp:

11/11/2025 12:06:45 PM (5 weeks ago)

Author:

FolioVision

Message:

2.8: Security and WordPress 6.8 fixes

Location:

fv-antispam/trunk

Files:

• fv-antispam.php (modified) (6 diffs)
• readme.txt (modified) (2 diffs)

fv-antispam/trunk/fv-antispam.php

@@ -5 +5 @@
 Description: Powerful and simple antispam plugin. Puts all the spambot comments directly into trash and let's other plugins (Akismet) deal with the rest.
 Author: Foliovision
-Version: 2.7
+Version: 2.8
 Author URI: http://www.foliovision.com
 */
 
 
-$fv_antispam_ver = '2.7';
+$fv_antispam_ver = '2.8';
 $FV_Antispam_iFilledInCount = 0;
 $FV_Antispam_bMathJS = false;
@@ -551 +551 @@
       $date = date('Y-m-d H:i:s' ,mktime(0, 0, 0, date("m")-1, date("d"), date("Y")));
     }
+
+    if ( ! $date ) {
+      return;
+    }
+
     $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_id NOT IN ( select comment_id from $wpdb->commentmeta where meta_key = '_wp_trash_meta_time' ) AND comment_date_gmt < '$date' AND comment_approved = 'trash' ORDER BY comment_date_gmt ASC LIMIT 5000");
     if( count($comments) ) {      
@@ -1042 +1047 @@
   
   function disp__login_form_js() {
+    $key   = $this->func__ip_protect();
     $value = !empty($_POST[$this->func__ip_protect()]) ? $_POST[$this->func__ip_protect()] : '';
     ?>
@@ -1047 +1053 @@
   jQuery(document).ready(function() {
         jQuery( '#user_email').after(
-            jQuery("#user_email").clone().attr('id', '<?php echo $this->func__ip_protect(); ?>').attr('name', '<?php echo $this->func__ip_protect(); ?>').attr('value', '<?php echo $value; ?>')
+            jQuery("#user_email").clone().attr('id', '<?php echo esc_js( $key ); ?>').attr('name', '<?php echo esc_js( $key ); ?>').attr('value', '<?php echo esc_attr( $value ); ?>')
         );
     jQuery("#user_email").hide();    
@@ -1660 +1666 @@
     $sTextarea = $aMatch[1];
   
-    preg_match( '/class=[\"\'](.*?)[\"\']/', $sTextarea, $class );
+    preg_match( '/class=["\'](.*?)["\']/', $sTextarea, $class );
     preg_match( '/id=[\"\'](.*?)[\"\']/', $sTextarea, $id );
     preg_match( '/name=[\"\'](.*?)[\"\']/', $sTextarea, $name );
+    preg_match( '/\s*?required=["\'](.*?)["\']/', $sTextarea, $required );
 
     $sClass = !empty($class) ? $class[1] : false;
     $sID = $id[1];
     $sName = $name[1];
+    $sRequired = !empty( $required ) ? $required[0] : false;
 
     $sTextarea = preg_replace('~<textarea([^\>]*>).*?</textarea>~', "<textarea$1</textarea>", $sTextarea ); // have to keep the hidden textarea empty
-        
+
+    // Remove the required attribute from the textarea
+    $sTextarea = str_replace( $sRequired, '', $sTextarea );
+
     $sProtect = FV_Antispam::func__protect($post->ID);
     
@@ -1780 +1791 @@
         $_POST['user_email'] = ( $_POST['user_email'] ) ? $_POST['user_email'] : $_POST[$this->func__ip_protect()];
     } else if( isset($_POST['user_email']) && trim($_POST['user_email']) != "" ) {
-      $fv_antispam_registrations = get_option('fv_antispam_registrations');
-      $fv_antispam_registrations = ( $fv_antispam_registrations ) ? $fv_antispam_registrations : array();      
+      $fv_antispam_registrations = get_option('fv_antispam_registrations', array() );
+
+      // Go through $fv_antispam_registrations and remove items older than 1 year
+      $keep_recent_only = array();
+      foreach( $fv_antispam_registrations as $line ) {
+        if ( strtotime( $line['date'] ) > strtotime( '-1 year' ) ) {
+          $keep_recent_only[] = $line;
+        }
+      }
+      $fv_antispam_registrations = $keep_recent_only;
+
       $fv_antispam_registrations[] = array( 'date' => date('r'), 'user_login' => $_POST['user_login'], 'user_email' => $_POST['user_email'] );
-      update_option( 'fv_antispam_registrations', $fv_antispam_registrations );
+      update_option( 'fv_antispam_registrations', $fv_antispam_registrations, false );
       unset($_POST['user_email']);
       

fv-antispam/trunk/readme.txt

@@ -3 +3 @@
 Tags: antispam, spam, akismet
 Requires at least: 3.5
-Tested up to: 6.7
+Tested up to: 6.8
 Stable tag: trunk
 
@@ -39 +39 @@
 
 == Changelog ==
+
+= 2.8 =
+
+* Security: Avoid CSRF on the wp-login.php registration page
+* WordPress 6.8 fix for the "required" attribute on comment textarea
 
 = 2.7 =