Changeset 3397751

Timestamp:

11/18/2025 06:02:21 AM (4 months ago)

Author:

labs64

Message:

Update to version 0.10.2 from GitHub

Location:

pluginpass-pro-plugintheme-licensing

Files:

• tags/0.10.2 (copied) (copied from pluginpass-pro-plugintheme-licensing/trunk)
• tags/0.10.2/README.txt (modified) (2 diffs)
• tags/0.10.2/composer.lock (modified) (2 diffs)
• tags/0.10.2/constants.php (modified) (1 diff)
• tags/0.10.2/inc/libraries/autoloader.php (modified) (3 diffs)
• tags/0.10.2/pluginpass.php (modified) (1 diff)
• tags/0.10.2/vendor/composer/installed.php (modified) (2 diffs)
• trunk/README.txt (modified) (2 diffs)
• trunk/composer.lock (modified) (2 diffs)
• trunk/constants.php (modified) (1 diff)
• trunk/inc/libraries/autoloader.php (modified) (3 diffs)
• trunk/pluginpass.php (modified) (1 diff)
• trunk/vendor/composer/installed.php (modified) (2 diffs)

pluginpass-pro-plugintheme-licensing/tags/0.10.2/README.txt

@@ -8 +8 @@
 Tested up to: 6.8
 Requires PHP: 8.2
-Stable tag: 0.10.1
+Stable tag: 0.10.2
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -121 +121 @@
 == Changelog ==
 
+= 0.10.2 =
+* Fix: Harden file read operations against path traversal attacks
+
 = 0.10.1 =
 * This release reactivates the PluginPass plugin with major security updates and modernization. The update addresses critical security vulnerabilities and ensures compatibility with modern WordPress and PHP versions.

pluginpass-pro-plugintheme-licensing/tags/0.10.2/composer.lock

@@ -698 +698 @@
         {
             "name": "phpcsstandards/phpcsutils",
-            "version": "1.2.0",
+            "version": "1.2.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PHPCSStandards/PHPCSUtils.git",
-                "reference": "fa82d14ad1c1713224a52c66c78478145fe454ba"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/fa82d14ad1c1713224a52c66c78478145fe454ba",
-                "reference": "fa82d14ad1c1713224a52c66c78478145fe454ba",
+                "reference": "d71128c702c180ca3b27c761b6773f883394f162"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/d71128c702c180ca3b27c761b6773f883394f162",
+                "reference": "d71128c702c180ca3b27c761b6773f883394f162",
                 "shasum": ""
             },
@@ -787 +787 @@
                 }
             ],
-            "time": "2025-11-11T00:17:56+00:00"
+            "time": "2025-11-17T12:58:33+00:00"
         },
         {

pluginpass-pro-plugintheme-licensing/tags/0.10.2/constants.php

@@ -12 +12 @@
 if ( ! defined( NS . 'PLUGIN_VERSION' ) ) {
     // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.VariableConstantNameFound -- Constants are namespace-prefixed via NS
-    define( NS . 'PLUGIN_VERSION', '0.10.1' );
+    define( NS . 'PLUGIN_VERSION', '0.10.2' );
 }
 

pluginpass-pro-plugintheme-licensing/tags/0.10.2/inc/libraries/autoloader.php

@@ -24 +24 @@
 
         // If the specified $class_name does not include our namespace, duck out.
-        if ( false === strpos( $class_name, 'PluginPass' ) ) {
+        if ( 0 !== strpos( $class_name, 'PluginPass\\' ) ) {
                 return;
         }
@@ -30 +30 @@
         // Skip the main PluginPass class as it's defined in the main plugin file.
         if ( 'PluginPass\\PluginPass' === $class_name ) {
+            return;
+        }
+
+        // Security: Prevent directory traversal attacks.
+        if ( strpos( $class_name, '..' ) !== false || strpos( $class_name, "\0" ) !== false ) {
             return;
         }
@@ -70 +75 @@
 
         // Now build a path to the file using mapping to the file location.
-        $filepath  = trailingslashit( untrailingslashit( plugin_dir_path( dirname( __DIR__ ) ) ) . $namespace );
+        $base_dir  = plugin_dir_path( dirname( __DIR__ ) );
+        $filepath  = trailingslashit( untrailingslashit( $base_dir ) . $namespace );
         $filepath .= $file_name;
 
-        // If the file exists in the specified path, then include it.
-        if ( file_exists( $filepath ) ) {
-                include_once $filepath;
+        // Security: Validate the resolved file path is within the plugin directory.
+        $real_base = realpath( $base_dir );
+        $real_file = realpath( $filepath );
+
+        // If the file exists and is within our plugin directory, include it.
+        if ( $real_file && $real_base && 0 === strpos( $real_file, $real_base ) && file_exists( $real_file ) ) {
+                include_once $real_file;
         } else {
             wp_die(

pluginpass-pro-plugintheme-licensing/tags/0.10.2/pluginpass.php

@@ -16 +16 @@
  * Plugin URI:        https://wordpress.org/plugins/pluginpass-pro-plugintheme-licensing/
  * Description:       Easily control the use and monetize your WordPress plugins and themes using PluginPass - a WordPress License Manager backed by Labs64 NetLicensing.
- * Version:           0.10.1
+ * Version:           0.10.2
  * Author:            Labs64
  * Author URI:        https://netlicensing.io

pluginpass-pro-plugintheme-licensing/tags/0.10.2/vendor/composer/installed.php

@@ -2 +2 @@
     'root' => array(
         'name' => 'labs64/pluginpass',
-        'pretty_version' => '0.10.1',
-        'version' => '0.10.1.0',
-        'reference' => 'bc2e8bc49550b1471fb852b6a7fc75cfc246ecc2',
+        'pretty_version' => '0.10.2',
+        'version' => '0.10.2.0',
+        'reference' => 'c7f4f887574b5710986b84daefa5c5a8df8d1c1e',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
@@ -30 +30 @@
         ),
         'labs64/pluginpass' => array(
-            'pretty_version' => '0.10.1',
-            'version' => '0.10.1.0',
-            'reference' => 'bc2e8bc49550b1471fb852b6a7fc75cfc246ecc2',
+            'pretty_version' => '0.10.2',
+            'version' => '0.10.2.0',
+            'reference' => 'c7f4f887574b5710986b84daefa5c5a8df8d1c1e',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',

pluginpass-pro-plugintheme-licensing/trunk/README.txt

@@ -8 +8 @@
 Tested up to: 6.8
 Requires PHP: 8.2
-Stable tag: 0.10.1
+Stable tag: 0.10.2
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -121 +121 @@
 == Changelog ==
 
+= 0.10.2 =
+* Fix: Harden file read operations against path traversal attacks
+
 = 0.10.1 =
 * This release reactivates the PluginPass plugin with major security updates and modernization. The update addresses critical security vulnerabilities and ensures compatibility with modern WordPress and PHP versions.

pluginpass-pro-plugintheme-licensing/trunk/composer.lock

@@ -698 +698 @@
         {
             "name": "phpcsstandards/phpcsutils",
-            "version": "1.2.0",
+            "version": "1.2.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/PHPCSStandards/PHPCSUtils.git",
-                "reference": "fa82d14ad1c1713224a52c66c78478145fe454ba"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/fa82d14ad1c1713224a52c66c78478145fe454ba",
-                "reference": "fa82d14ad1c1713224a52c66c78478145fe454ba",
+                "reference": "d71128c702c180ca3b27c761b6773f883394f162"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/d71128c702c180ca3b27c761b6773f883394f162",
+                "reference": "d71128c702c180ca3b27c761b6773f883394f162",
                 "shasum": ""
             },
@@ -787 +787 @@
                 }
             ],
-            "time": "2025-11-11T00:17:56+00:00"
+            "time": "2025-11-17T12:58:33+00:00"
         },
         {

pluginpass-pro-plugintheme-licensing/trunk/constants.php

@@ -12 +12 @@
 if ( ! defined( NS . 'PLUGIN_VERSION' ) ) {
     // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.VariableConstantNameFound -- Constants are namespace-prefixed via NS
-    define( NS . 'PLUGIN_VERSION', '0.10.1' );
+    define( NS . 'PLUGIN_VERSION', '0.10.2' );
 }
 

pluginpass-pro-plugintheme-licensing/trunk/inc/libraries/autoloader.php

@@ -24 +24 @@
 
         // If the specified $class_name does not include our namespace, duck out.
-        if ( false === strpos( $class_name, 'PluginPass' ) ) {
+        if ( 0 !== strpos( $class_name, 'PluginPass\\' ) ) {
                 return;
         }
@@ -30 +30 @@
         // Skip the main PluginPass class as it's defined in the main plugin file.
         if ( 'PluginPass\\PluginPass' === $class_name ) {
+            return;
+        }
+
+        // Security: Prevent directory traversal attacks.
+        if ( strpos( $class_name, '..' ) !== false || strpos( $class_name, "\0" ) !== false ) {
             return;
         }
@@ -70 +75 @@
 
         // Now build a path to the file using mapping to the file location.
-        $filepath  = trailingslashit( untrailingslashit( plugin_dir_path( dirname( __DIR__ ) ) ) . $namespace );
+        $base_dir  = plugin_dir_path( dirname( __DIR__ ) );
+        $filepath  = trailingslashit( untrailingslashit( $base_dir ) . $namespace );
         $filepath .= $file_name;
 
-        // If the file exists in the specified path, then include it.
-        if ( file_exists( $filepath ) ) {
-                include_once $filepath;
+        // Security: Validate the resolved file path is within the plugin directory.
+        $real_base = realpath( $base_dir );
+        $real_file = realpath( $filepath );
+
+        // If the file exists and is within our plugin directory, include it.
+        if ( $real_file && $real_base && 0 === strpos( $real_file, $real_base ) && file_exists( $real_file ) ) {
+                include_once $real_file;
         } else {
             wp_die(

pluginpass-pro-plugintheme-licensing/trunk/pluginpass.php

@@ -16 +16 @@
  * Plugin URI:        https://wordpress.org/plugins/pluginpass-pro-plugintheme-licensing/
  * Description:       Easily control the use and monetize your WordPress plugins and themes using PluginPass - a WordPress License Manager backed by Labs64 NetLicensing.
- * Version:           0.10.1
+ * Version:           0.10.2
  * Author:            Labs64
  * Author URI:        https://netlicensing.io

pluginpass-pro-plugintheme-licensing/trunk/vendor/composer/installed.php

@@ -2 +2 @@
     'root' => array(
         'name' => 'labs64/pluginpass',
-        'pretty_version' => '0.10.1',
-        'version' => '0.10.1.0',
-        'reference' => 'bc2e8bc49550b1471fb852b6a7fc75cfc246ecc2',
+        'pretty_version' => '0.10.2',
+        'version' => '0.10.2.0',
+        'reference' => 'c7f4f887574b5710986b84daefa5c5a8df8d1c1e',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
@@ -30 +30 @@
         ),
         'labs64/pluginpass' => array(
-            'pretty_version' => '0.10.1',
-            'version' => '0.10.1.0',
-            'reference' => 'bc2e8bc49550b1471fb852b6a7fc75cfc246ecc2',
+            'pretty_version' => '0.10.2',
+            'version' => '0.10.2.0',
+            'reference' => 'c7f4f887574b5710986b84daefa5c5a8df8d1c1e',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',