WordPress.org
Get WordPress

Plugin Directory

Changeset 3464204


Ignore:
Timestamp:
02/18/2026 10:29:02 AM (6 weeks ago)
Author:
softaculous
Message:

New version 2.0.8

Location:
pagelayer/trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • pagelayer/trunk/css/pagelayer-editor.css

    r3384061 r3464204  
    26012601}
    26022602
     2603.pagelayer-widget-group h5:only-child,
     2604.pagelayer-leftbar-group h5:only-child{
     2605display: none; 
     2606}
     2607
    26032608.pagelayer-global-widget-pro{
    26042609text-align: center;

  • pagelayer/trunk/init.php

    r3411050 r3464204  
    66define('PAGELAYER_BASE', plugin_basename(PAGELAYER_FILE));
    77define('PAGELAYER_PREMIUM_BASE', 'pagelayer-pro/pagelayer-pro.php');
    8 define('PAGELAYER_VERSION', '2.0.7');
     8define('PAGELAYER_VERSION', '2.0.8');
    99define('PAGELAYER_DIR', dirname(PAGELAYER_FILE));
    1010define('PAGELAYER_SLUG', 'pagelayer');

  • pagelayer/trunk/main/ajax.php

    r3384061 r3464204  
    228228       
    229229        // Restrict contributors from setting 'publish' or modifying unauthorized fields
    230         $can_publish = current_user_can($post_type_obj->cap->publish_posts);
    231         if(!$can_publish){
     230        $current_user_can_publish = current_user_can($post_type_obj->cap->publish_posts);
     231        if(!$current_user_can_publish){
    232232            if(!in_array($post['post_status'], ['draft', 'pending'])){
    233233                $post['post_status'] = 'pending'; // Force pending status
    … …  
    337337           
    338338        // Any contact templates ?
    339         if(!empty($_REQUEST['contacts'])){
     339        if(!empty($_REQUEST['contacts']) && $current_user_can_publish){
    340340            update_post_meta($postID, 'pagelayer_contact_templates', $_REQUEST['contacts']);
    341341        }else{
    … …  
    12711271    if(isset($formdata['cfa-custom-template']) && !empty($formdata['cfa-post-id'])){
    12721272        $post_id = (int) $formdata['cfa-post-id'];
    1273        
    1274         if(!empty($post_id)){
     1273               
     1274        if(!empty($post_id) && ( get_post_status( $post_id ) === 'publish' || current_user_can('publish_posts') )){
    12751275            $contact_array = get_post_meta($post_id, 'pagelayer_contact_templates', true);
    12761276           
    … …  
    13281328            }
    13291329           
    1330             if(is_array($i)){
    1331                 $i = pagelayer_flat_join($i);
    1332             }
    1333            
    1334             // Record a reply to if it is to be used
    1335             if(is_email(trim($i)) && empty($reply_to)){
    1336                 $reply_to = trim($i);
    1337             }
    1338            
    13391330            $body .= $k."\t : \t $".$k."\n";
    13401331           
    … …  
    13431334        $body .= "\n\n --\n This e-mail was sent from a contact form (".get_home_url().")";
    13441335   
     1336    }
     1337       
     1338    // Add attachment
     1339    if(!empty($_FILES)){
     1340        add_action('phpmailer_init', 'pagelayer_cf_email_attachment', 10, 1);
     1341    }
     1342   
     1343    $sanitized_data = array();
     1344   
     1345    // If we are using HTML, then we should escape html as well
     1346    foreach($formdata as $k => $i){
     1347       
     1348        if(is_array($i)){
     1349            $i = pagelayer_flat_join($i);
     1350        }
     1351       
     1352        $i = pagelayer_esc_crlf($i);
     1353       
     1354        if(!empty($use_html)){
     1355            $i = esc_html($i);
     1356        }
     1357       
     1358        // Sanitize text field
     1359        $i = sanitize_text_field($i);
     1360       
     1361        // Record a reply to if it is to be used
     1362        if(is_email($i) && empty($reply_to)){
     1363            $reply_to = $i;
     1364        }
     1365       
     1366        $sanitized_data[$k] = $i;   
    13451367    }
    13461368   
    … …  
    13501372    }
    13511373   
    1352     // Add attachment
    1353     if(!empty($_FILES)){
    1354         add_action('phpmailer_init', 'pagelayer_cf_email_attachment', 10, 1);
    1355     }
    1356    
    1357     // If we are using HTML, then we should escape html as well
    1358     if(!empty($use_html)){
    1359         foreach($formdata as $k => $i){
    1360            
    1361             if(is_array($i)){
    1362                 $i = pagelayer_flat_join($i);
    1363             }
    1364            
    1365             $formdata[$k] = esc_html($i);
    1366         }
    1367     }
    1368    
    13691374    // Add Site Title as option in formdata
    1370     $formdata['site_title'] = get_bloginfo( 'name' );
     1375    $sanitized_data['site_title'] = get_bloginfo( 'name' );
    13711376   
    13721377    // Do parse a variables
    1373     $to_mail = pagelayer_replace_vars($to_mail, $formdata, '$');
    1374     $from_mail = pagelayer_replace_vars($from_mail, $formdata, '$');
    1375     $subject = pagelayer_replace_vars($subject, $formdata, '$');
    1376     $headers = pagelayer_replace_vars($headers, $formdata, '$');
    1377     $body = pagelayer_replace_vars($body, $formdata, '$');
     1378    $to_mail = pagelayer_replace_vars($to_mail, $sanitized_data, '$');
     1379    $from_mail = pagelayer_replace_vars($from_mail, $sanitized_data, '$');
     1380    $subject = pagelayer_replace_vars($subject, $sanitized_data, '$');
     1381    $headers = pagelayer_replace_vars($headers, $sanitized_data, '$');
     1382    $body = pagelayer_replace_vars($body, $sanitized_data, '$');
    13781383   
    13791384    if ( $use_html && ! preg_match( '%<html[>\s].*</html>%is', $body ) ) {
    … …  
    13881393    }
    13891394   
    1390     $to_mail = apply_filters('pagelayer_contact_send', $to_mail, $formdata);
     1395    $to_mail = apply_filters('pagelayer_contact_send', $to_mail, $sanitized_data);
    13911396   
    13921397    // Send the email

  • pagelayer/trunk/main/functions.php

    r3411050 r3464204  
    12911291   
    12921292    // These events not start with on
    1293     $not_allowed = array('click', 'dblclick', 'mousedown', 'mousemove', 'mouseout', 'mouseover', 'mouseup', 'load', 'unload', 'change', 'submit', 'reset', 'select', 'blur', 'focus', 'keydown', 'keypress', 'keyup', 'afterprint', 'beforeprint', 'beforeunload', 'error', 'hashchange', 'message', 'offline', 'online', 'pagehide', 'pageshow', 'popstate', 'resize', 'storage', 'contextmenu', 'input', 'invalid', 'search', 'mousewheel', 'wheel', 'drag', 'dragend', 'dragenter', 'dragleave', 'dragover', 'dragstart', 'drop', 'scroll', 'copy', 'cut', 'paste', 'abort', 'canplay', 'canplaythrough', 'cuechange', 'durationchange', 'emptied', 'ended', 'loadeddata', 'loadedmetadata', 'loadstart', 'pause', 'play', 'playing', 'progress', 'ratechange', 'seeked', 'seeking', 'stalled', 'suspend', 'timeupdate', 'volumechange', 'waiting', 'toggle', 'animationstart', 'animationcancel', 'animationend', 'animationiteration', 'auxclick', 'beforeinput', 'beforematch', 'beforexrselect', 'compositionend', 'compositionstart', 'compositionupdate', 'contentvisibilityautostatechange', 'focusout', 'focusin', 'fullscreenchange', 'fullscreenerror', 'gotpointercapture', 'lostpointercapture', 'mouseenter', 'mouseleave', 'pointercancel', 'pointerdown', 'pointerenter', 'pointerleave', 'pointermove', 'pointerout', 'pointerover', 'pointerrawupdate', 'pointerup', 'scrollend', 'securitypolicyviolation', 'touchcancel', 'touchend', 'touchmove', 'touchstart', 'transitioncancel', 'transitionend', 'transitionrun', 'transitionstart', 'MozMousePixelScroll', 'DOMActivate', 'afterscriptexecute', 'beforescriptexecute', 'DOMMouseScroll', 'willreveal', 'gesturechange', 'gestureend', 'gesturestart', 'mouseforcechanged', 'mouseforcedown', 'mouseforceup', 'mouseforceup');
     1293    $not_allowed = array('click', 'dblclick', 'mousedown', 'mousemove', 'mouseout', 'mouseover', 'mouseup', 'load', 'unload', 'change', 'submit', 'reset', 'select', 'blur', 'focus', 'keydown', 'keypress', 'keyup', 'afterprint', 'beforeprint', 'beforeunload', 'error', 'hashchange', 'message', 'offline', 'online', 'pagehide', 'pageshow', 'popstate', 'resize', 'storage', 'contextmenu', 'input', 'invalid', 'search', 'mousewheel', 'wheel', 'drag', 'dragend', 'dragenter', 'dragleave', 'dragover', 'dragstart', 'drop', 'scroll', 'copy', 'cut', 'paste', 'abort', 'canplay', 'canplaythrough', 'cuechange', 'durationchange', 'emptied', 'ended', 'loadeddata', 'loadedmetadata', 'loadstart', 'pause', 'play', 'playing', 'progress', 'ratechange', 'seeked', 'seeking', 'stalled', 'suspend', 'timeupdate', 'volumechange', 'waiting', 'toggle', 'animationstart', 'animationcancel', 'animationend', 'animationiteration', 'auxclick', 'beforeinput', 'beforematch', 'beforexrselect', 'compositionend', 'compositionstart', 'compositionupdate', 'contentvisibilityautostatechange', 'focusout', 'focusin', 'fullscreenchange', 'fullscreenerror', 'gotpointercapture', 'lostpointercapture', 'mouseenter', 'mouseleave', 'pointercancel', 'pointerdown', 'pointerenter', 'pointerleave', 'pointermove', 'pointerout', 'pointerover', 'pointerrawupdate', 'pointerup', 'scrollend', 'securitypolicyviolation', 'touchcancel', 'touchend', 'touchmove', 'touchstart', 'transitioncancel', 'transitionend', 'transitionrun', 'transitionstart', 'MozMousePixelScroll', 'DOMActivate', 'afterscriptexecute', 'beforescriptexecute', 'DOMMouseScroll', 'willreveal', 'gesturechange', 'gestureend', 'gesturestart', 'mouseforcechanged', 'mouseforcedown', 'mouseforceup', 'mouseforceup', 'beforetoggle');
    12941294   
    12951295    $not_allowed = implode('|', $not_allowed);
    … …  
    39853985    return false;
    39863986}
     3987
     3988function pagelayer_esc_crlf($value){
     3989
     3990    // Remove CRLF to prevent header injection
     3991    $value = str_replace(array("\r", "\n", "%0a", "%0d"), '', $value);
     3992
     3993    // Trim spaces
     3994    $value = trim($value);
     3995
     3996    return $value;
     3997}

  • pagelayer/trunk/pagelayer.php

    r3411050 r3464204  
    44Plugin URI: http://wordpress.org/plugins/pagelayer/
    55Description: Pagelayer is a WordPress page builder plugin. Its very easy to use and very light on the browser.
    6 Version: 2.0.7
     6Version: 2.0.8
    77Author: Pagelayer Team
    88Author URI: https://pagelayer.com/

  • pagelayer/trunk/readme.txt

    r3411050 r3464204  
    55Tested up to: 6.9
    66Requires PHP: 5.5
    7 Stable tag: 2.0.7
     7Stable tag: 2.0.8
    88License: LGPL v2.1
    99License URI: http://www.gnu.org/licenses/lgpl-2.1.html
    … …  
    132132== Changelog ==
    133133
     134= 2.0.8 (FEB 16, 2026) =
     135* [Bug Fix] Improved XSS security checks.
     136* [Bug Fix] Sanitized the contact form "Reply-To" header to prevent CRLF injection.
     137* [Bug Fix] Restricted low-level users from adding custom templates in the contact form.
     138
    134139= 2.0.7 (DEC 02, 2025) =
    135140* [Task] Tested compatibility with WordPress 6.9.
Note: See TracChangeset for help on using the changeset viewer.