Changeset 3423917

Timestamp:

12/19/2025 06:09:21 PM (3 months ago)

Author:

etruel

Message:

Fully compatible with WP 6.9 and Security Fixes!

Location:

wpecounter

Files:

• tags/2.1.3 (added)
• tags/2.1.3/.gitignore (added)
• tags/2.1.3/LICENSE (added)
• tags/2.1.3/README.md (added)
• tags/2.1.3/assets (added)
• tags/2.1.3/assets/css (added)
• tags/2.1.3/assets/css/settings.css (added)
• tags/2.1.3/assets/js (added)
• tags/2.1.3/assets/js/reset-views.js (added)
• tags/2.1.3/assets/js/settings.js (added)
• tags/2.1.3/block.json (added)
• tags/2.1.3/build (added)
• tags/2.1.3/build/index.asset.php (added)
• tags/2.1.3/build/index.js (added)
• tags/2.1.3/includes (added)
• tags/2.1.3/includes/class-views.php (added)
• tags/2.1.3/includes/functions.php (added)
• tags/2.1.3/includes/plugin-utils.php (added)
• tags/2.1.3/includes/scripts.php (added)
• tags/2.1.3/includes/settings.php (added)
• tags/2.1.3/includes/version.php (added)
• tags/2.1.3/includes/widget.php (added)
• tags/2.1.3/index.php (added)
• tags/2.1.3/languages (added)
• tags/2.1.3/languages/wpecounter-en_US.pot (added)
• tags/2.1.3/languages/wpecounter-es_ES.mo (added)
• tags/2.1.3/languages/wpecounter-es_ES.po (added)
• tags/2.1.3/languages/wpecounter-sr_RS.mo (added)
• tags/2.1.3/languages/wpecounter-sr_RS.po (added)
• tags/2.1.3/package-lock.json (added)
• tags/2.1.3/package.json (added)
• tags/2.1.3/readme.txt (added)
• tags/2.1.3/screenshot-1.png (added)
• tags/2.1.3/screenshot-2.png (added)
• tags/2.1.3/screenshot-3.png (added)
• tags/2.1.3/screenshot-4.png (added)
• tags/2.1.3/src (added)
• tags/2.1.3/src/index.js (added)
• tags/2.1.3/src/style-index.css (added)
• tags/2.1.3/wpecounter.php (added)
• trunk/includes/settings.php (modified) (3 diffs)
• trunk/readme.txt (modified) (3 diffs)
• trunk/wpecounter.php (modified) (2 diffs)

wpecounter/trunk/includes/settings.php

@@ -78 +78 @@
         public function register_settings() {
 
+            // Security: only admins
+            if ( ! is_admin() || ! current_user_can( 'manage_options' ) ) {
+                return;
+            }
             // no options - create them.
             if (false == get_option($this->options_key)) {
@@ -205 +209 @@
 */
             // Handle reset counters action
-            if (isset($_POST['reset_counters_btn'])) {
+            if (isset($_POST['reset_counters_btn']) &&  check_admin_referer('wpecounter_reset_counters', 'wpecounter_reset_nonce') ) {  
                 global $wpdb;
                 if (!isset($WPeCounterViews)) {
@@ -299 +303 @@
                                 <div class="inside">
                                     <h3><span class="dashicons dashicons-sos"></span><?php _e('Danger Area', 'wpecounter'); ?></h3>
+                                    <?php wp_nonce_field( 'wpecounter_reset_counters', 'wpecounter_reset_nonce' ); ?>
                                     <hr />
                                     <?php

wpecounter/trunk/readme.txt

@@ -4 +4 @@
 Tags: post views, views counter, popular posts, ajax counter, analytics
 Requires at least: 3.1
-Tested up to: 6.8.2
-Requires PHP: 5.6
-Stable tag: 2.1.2
+Tested up to: 6.9
+Requires PHP: 7.0
+Stable tag: 2.1.3
 License: GPLv2
 
@@ -55 +55 @@
 
 == Changelog ==
+
+= 2.1.3 – Dec 19, 2025 =
+* Security: Improved access control and request validation in admin settings.
+* Added proper capability checks to restrict sensitive actions to administrators only.
+* Added nonce verification to protect destructive actions against unauthorized requests.
+* General hardening of admin-side logic.
 
 = 2.1.2 – Nov 19, 2025 =
@@ -120 +126 @@
 
 == Upgrade Notice ==
-Fully compatible with WP 6.8.2. Fixed PHP Warnings displayed in DEBUG mode
+Fully compatible with WP 6.9 and Security Fixes!

wpecounter/trunk/wpecounter.php

@@ -4 +4 @@
  * Plugin URI:   https://etruel.com/downloads/wpecounter
  * Description:  Counts visits on post lists, pages and/or custom post types. It also displays them in posts, pages or text widget content, shortcode [WPeCounter].
- * Version:      2.1.2
+ * Version:      2.1.3
  * Author:       Etruel Developments LLC
  * Author URI:   https://etruel.com
@@ -15 +15 @@
 // Plugin version
 if (!defined('WPECOUNTER_VERSION'))
-    define('WPECOUNTER_VERSION', '2.1.2');
+    define('WPECOUNTER_VERSION', '2.1.3');
 
 if (!class_exists('WPeCounter')) :