WordPress.org
Get WordPress

Plugin Directory

Changeset 3479046


Ignore:
Timestamp:
03/10/2026 12:15:42 PM (3 weeks ago)
Author:
softaculous
Message:

New version 2.0.9

Location:
pagelayer/trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • pagelayer/trunk/init.php

    r3464204 r3479046  
    66define('PAGELAYER_BASE', plugin_basename(PAGELAYER_FILE));
    77define('PAGELAYER_PREMIUM_BASE', 'pagelayer-pro/pagelayer-pro.php');
    8 define('PAGELAYER_VERSION', '2.0.8');
     8define('PAGELAYER_VERSION', '2.0.9');
    99define('PAGELAYER_DIR', dirname(PAGELAYER_FILE));
    1010define('PAGELAYER_SLUG', 'pagelayer');

  • pagelayer/trunk/main/ajax.php

    r3464204 r3479046  
    631631    if(isset($_REQUEST['pagelayer_section_id'])){
    632632       
    633         $get_url = PAGELAYER_API.'/library.php?give_id='.$_REQUEST['pagelayer_section_id'].(!empty($pagelayer->license['license']) ? '&license='.$pagelayer->license['license'] : '').'&url='.rawurlencode(site_url());
     633        $get_url = PAGELAYER_API.'/library.php?give_id='.sanitize_text_field($_REQUEST['pagelayer_section_id']).(!empty($pagelayer->license['license']) ? '&license='.$pagelayer->license['license'] : '').'&url='.rawurlencode(site_url());
    634634       
    635635        // For SitePad users
    … …  
    718718    if(isset($_REQUEST['pagelayer_section_id'])){
    719719       
    720         $get_url = PAGELAYER_API.'/library.php?give_id='.$_REQUEST['pagelayer_section_id'].(!empty($pagelayer->license['license']) ? '&license='.$pagelayer->license['license'] : '').'&url='.rawurlencode(site_url());
     720        $get_url = PAGELAYER_API.'/library.php?give_id='.sanitize_text_field($_REQUEST['pagelayer_section_id']).(!empty($pagelayer->license['license']) ? '&license='.$pagelayer->license['license'] : '').'&url='.rawurlencode(site_url());
    721721       
    722722        // For SitePad users
    … …  
    11721172    // Some AJAX security
    11731173    check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
    1174     // TODO : Allowed
    1175     echo pagelayer_widget_posts($_POST);
     1174   
     1175    // This ajax call is only used during post/page editing
     1176    if(!current_user_can('edit_posts')){
     1177        echo __pl('no_permission');
     1178        wp_die();
     1179    }
     1180   
     1181    $sanitized_post = pagelayer_sanitize_posts_data($_POST);
     1182    echo pagelayer_widget_posts($sanitized_post);
    11761183   
    11771184    wp_die();
    … …  
    11851192    check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
    11861193   
     1194    // This ajax call is only used during post/page editing
     1195    if(!current_user_can('edit_posts')){
     1196        echo __pl('no_permission');
     1197        wp_die();
     1198    }
     1199   
    11871200    // Load shortcodes
    11881201    pagelayer_load_shortcodes();
    1189     // TODO : Allowed
    1190     echo pagelayer_posts($_POST);
     1202   
     1203    $sanitized_post = pagelayer_sanitize_posts_data($_POST, false);
     1204    echo pagelayer_posts($sanitized_post);
    11911205    wp_die();
    11921206}
    … …  
    12221236    $sc = '[pl_archive_posts '.$string.'][/pl_archive_posts]';
    12231237   
    1224     // TODO : Allowed
    12251238    echo pagelayer_the_content($sc);
    12261239    wp_die();
    … …  
    13281341            }
    13291342           
    1330             $body .= $k."\t : \t $".$k."\n";
     1343            $body .= sanitize_text_field($k)."\t : \t $".$k."\n";
    13311344           
    13321345        }
    … …  
    14321445        // If After logout URL, then save
    14331446        if(!empty($_REQUEST['logout_url'])){
    1434             update_user_option($user->ID, 'pagelayer_logout_url', $_REQUEST['logout_url']);
     1447            update_user_option($user->ID, 'pagelayer_logout_url', sanitize_url($_REQUEST['logout_url']));
    14351448        }
    14361449   
    … …  
    14501463    check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
    14511464   
     1465    if(!current_user_can('edit_posts')){
     1466        echo __pl('no_permission');
     1467        wp_die();
     1468    }
     1469   
    14521470    $args = array(
    1453         'post_type' => $_POST['type'],
    1454         'orderby' => $_POST['post_order'],
    1455         'order' => $_POST['order'],
    1456         'hierarchical' => (empty($_POST['hier']) || $_POST['hier'] == null ? '' : $_POST['hier']),
    1457         'number' => (empty($_POST['depth']) || $_POST['depth'] == null ? '' : $_POST['depth']),
     1471        'post_type' => sanitize_text_field($_POST['type']),
     1472        'orderby' => sanitize_text_field($_POST['post_order']),
     1473        'order' => sanitize_text_field($_POST['order']),
     1474        'hierarchical' => (empty($_POST['hier']) || $_POST['hier'] == null ? '' : sanitize_text_field($_POST['hier'])),
     1475        'number' => (empty($_POST['depth']) || $_POST['depth'] == null ? '' : sanitize_text_field($_POST['depth'])),
    14581476        'posts_per_page' => -1,
    14591477    );
    … …  
    17781796    // Some AJAX security
    17791797    check_ajax_referer('pagelayer_ajax', 'pagelayer_nonce');
     1798   
     1799    if(!current_user_can('edit_posts')){
     1800        echo __pl('no_permission');
     1801        wp_die();
     1802    }
    17801803   
    17811804    $args = array(

  • pagelayer/trunk/main/class.php

    r3384061 r3479046  
    4343    var $template_header;
    4444    var $template_post;
     45    var $template_editor;
    4546    var $template_footer;
    4647    var $template_popup_ids;

  • pagelayer/trunk/main/functions.php

    r3464204 r3479046  
    12911291   
    12921292    // These events not start with on
    1293     $not_allowed = array('click', 'dblclick', 'mousedown', 'mousemove', 'mouseout', 'mouseover', 'mouseup', 'load', 'unload', 'change', 'submit', 'reset', 'select', 'blur', 'focus', 'keydown', 'keypress', 'keyup', 'afterprint', 'beforeprint', 'beforeunload', 'error', 'hashchange', 'message', 'offline', 'online', 'pagehide', 'pageshow', 'popstate', 'resize', 'storage', 'contextmenu', 'input', 'invalid', 'search', 'mousewheel', 'wheel', 'drag', 'dragend', 'dragenter', 'dragleave', 'dragover', 'dragstart', 'drop', 'scroll', 'copy', 'cut', 'paste', 'abort', 'canplay', 'canplaythrough', 'cuechange', 'durationchange', 'emptied', 'ended', 'loadeddata', 'loadedmetadata', 'loadstart', 'pause', 'play', 'playing', 'progress', 'ratechange', 'seeked', 'seeking', 'stalled', 'suspend', 'timeupdate', 'volumechange', 'waiting', 'toggle', 'animationstart', 'animationcancel', 'animationend', 'animationiteration', 'auxclick', 'beforeinput', 'beforematch', 'beforexrselect', 'compositionend', 'compositionstart', 'compositionupdate', 'contentvisibilityautostatechange', 'focusout', 'focusin', 'fullscreenchange', 'fullscreenerror', 'gotpointercapture', 'lostpointercapture', 'mouseenter', 'mouseleave', 'pointercancel', 'pointerdown', 'pointerenter', 'pointerleave', 'pointermove', 'pointerout', 'pointerover', 'pointerrawupdate', 'pointerup', 'scrollend', 'securitypolicyviolation', 'touchcancel', 'touchend', 'touchmove', 'touchstart', 'transitioncancel', 'transitionend', 'transitionrun', 'transitionstart', 'MozMousePixelScroll', 'DOMActivate', 'afterscriptexecute', 'beforescriptexecute', 'DOMMouseScroll', 'willreveal', 'gesturechange', 'gestureend', 'gesturestart', 'mouseforcechanged', 'mouseforcedown', 'mouseforceup', 'mouseforceup', 'beforetoggle');
     1293    $not_allowed = array('click', 'dblclick', 'mousedown', 'mousemove', 'mouseout', 'mouseover', 'mouseup', 'load', 'unload', 'change', 'submit', 'reset', 'select', 'blur', 'focus', 'keydown', 'keypress', 'keyup', 'afterprint', 'beforeprint', 'beforeunload', 'error', 'hashchange', 'message', 'offline', 'online', 'pagehide', 'pageshow', 'popstate', 'resize', 'storage', 'contextmenu', 'input', 'invalid', 'search', 'mousewheel', 'wheel', 'drag', 'dragend', 'dragenter', 'dragleave', 'dragover', 'dragstart', 'drop', 'scroll', 'copy', 'cut', 'paste', 'abort', 'canplay', 'canplaythrough', 'cuechange', 'durationchange', 'emptied', 'ended', 'loadeddata', 'loadedmetadata', 'loadstart', 'pause', 'play', 'playing', 'progress', 'ratechange', 'seeked', 'seeking', 'stalled', 'suspend', 'timeupdate', 'volumechange', 'waiting', 'toggle', 'animationstart', 'animationcancel', 'animationend', 'animationiteration', 'auxclick', 'beforeinput', 'beforematch', 'beforexrselect', 'compositionend', 'compositionstart', 'compositionupdate', 'contentvisibilityautostatechange', 'focusout', 'focusin', 'fullscreenchange', 'fullscreenerror', 'gotpointercapture', 'lostpointercapture', 'mouseenter', 'mouseleave', 'pointercancel', 'pointerdown', 'pointerenter', 'pointerleave', 'pointermove', 'pointerout', 'pointerover', 'pointerrawupdate', 'pointerup', 'scrollend', 'securitypolicyviolation', 'touchcancel', 'touchend', 'touchmove', 'touchstart', 'transitioncancel', 'transitionend', 'transitionrun', 'transitionstart', 'MozMousePixelScroll', 'DOMActivate', 'afterscriptexecute', 'beforescriptexecute', 'DOMMouseScroll', 'willreveal', 'gesturechange', 'gestureend', 'gesturestart', 'mouseforcechanged', 'mouseforcedown', 'mouseforceup', 'mouseforceup', 'beforetoggle', 'selectstart', 'selectionchange');
    12941294   
    12951295    $not_allowed = implode('|', $not_allowed);
    … …  
    34533453   
    34543454    return $str;
     3455}
     3456
     3457// Sanitize posts data for WP_Query
     3458function pagelayer_sanitize_posts_data($data, $only_allowed = true) {
     3459   
     3460    $allowed_keys = [
     3461        'post_type', 'posts_per_page', 'order', 'orderby', 'paged',
     3462        'filter_by', 'term', 'exc_term', 'cat', 'category_name',
     3463        'tag', 'author', 'author_name', 'post__in', 'post__not_in',
     3464        'include', 'exclude', 'search', 's', 'exact', 'sentence',
     3465        'post_status', 'post_parent', 'offset',
     3466        'posts_per_archive_page', 'page', 'ignore_sticky_posts'
     3467    ];
     3468   
     3469    $sanitized = [];
     3470   
     3471    foreach($data as $key => $value){
     3472        if($only_allowed && !in_array($key, $allowed_keys)) {
     3473            continue;
     3474        }
     3475       
     3476        $sanitized[$key] = pagelayer_sanitize_text_field($value);
     3477    }
     3478
     3479    // Security: Restrict post_status to prevent information disclosure
     3480    // Only users who can read private posts or edit others' posts should be able to query non-public statuses
     3481    if(isset($sanitized['post_status'])){
     3482        $requested_status = $sanitized['post_status'];
     3483       
     3484        // If requesting something other than publish, verify permissions
     3485        if ($requested_status !== 'publish') {
     3486            // Check if the user has permission to read private posts or edit others' posts
     3487            // This prevents contributors from seeing titles of private posts they don't own.
     3488            if (!current_user_can('read_private_posts') && !current_user_can('edit_others_posts')) {
     3489                $sanitized['post_status'] = 'publish';
     3490            }
     3491        }
     3492    }else{
     3493        // Default to publish for safety if not specified
     3494        $sanitized['post_status'] = 'publish';
     3495    }
     3496   
     3497    if(isset($sanitized['posts_per_page'])){
     3498        $sanitized['posts_per_page'] = (int) $sanitized['posts_per_page'];
     3499        if ($sanitized['posts_per_page'] > 100) {
     3500            $sanitized['posts_per_page'] = 100;
     3501        }
     3502    }
     3503   
     3504    if(isset($sanitized['paged'])){
     3505        $sanitized['paged'] = (int) $sanitized['paged'];
     3506    }
     3507   
     3508    if(isset($sanitized['offset'])){
     3509        $sanitized['offset'] = (int) $sanitized['offset'];
     3510    }
     3511   
     3512    if(isset($sanitized['post__in']) && is_string($sanitized['post__in'])){
     3513        $sanitized['post__in'] = array_map('intval', explode(',', $sanitized['post__in']));
     3514    }
     3515   
     3516    if(isset($sanitized['post__not_in']) && is_string($sanitized['post__not_in'])){
     3517        $sanitized['post__not_in'] = array_map('intval', explode(',', $sanitized['post__not_in']));
     3518    }
     3519   
     3520    if(isset($sanitized['post_parent'])){
     3521        $sanitized['post_parent'] = (int) $sanitized['post_parent'];
     3522    }
     3523   
     3524    if(isset($sanitized['cat'])){
     3525        $sanitized['cat'] = (int) $sanitized['cat'];
     3526    }
     3527   
     3528    if(isset($sanitized['author'])){
     3529        $sanitized['author'] = (int) $sanitized['author'];
     3530    }
     3531   
     3532    return $sanitized;
    34553533}
    34563534

  • pagelayer/trunk/main/shortcode_functions.php

    r3411050 r3479046  
    16651665}
    16661666
     1667// Anchor Handler
     1668function pagelayer_sc_anchor(&$el){
     1669    $el['atts']['title'] = empty($el['atts']['title']) ? '' : esc_attr(sanitize_html_class( $el['atts']['title']));
     1670}
     1671
    16671672function pagelayer_sc_google_maps(&$el){
    16681673   

  • pagelayer/trunk/pagelayer.php

    r3464204 r3479046  
    44Plugin URI: http://wordpress.org/plugins/pagelayer/
    55Description: Pagelayer is a WordPress page builder plugin. Its very easy to use and very light on the browser.
    6 Version: 2.0.8
     6Version: 2.0.9
    77Author: Pagelayer Team
    88Author URI: https://pagelayer.com/

  • pagelayer/trunk/readme.txt

    r3464204 r3479046  
    55Tested up to: 6.9
    66Requires PHP: 5.5
    7 Stable tag: 2.0.8
     7Stable tag: 2.0.9
    88License: LGPL v2.1
    99License URI: http://www.gnu.org/licenses/lgpl-2.1.html
    … …  
    131131
    132132== Changelog ==
     133= 2.0.9 (March 09, 2026) =
     134* [Bug Fix] Improved XSS security checks.
     135* [Bug-Fix] There was some PHP warnings. This is fixed.
    133136
    134137= 2.0.8 (FEB 16, 2026) =
Note: See TracChangeset for help on using the changeset viewer.