Changeset 3486528

Timestamp:

03/19/2026 01:52:23 PM (9 days ago)

Author:

trustindex

Message:

Security fixes

Location:

widgets-for-google-feed

Files:

• tags/1.8 (copied) (copied from widgets-for-google-feed/trunk)
• tags/1.8/admin.php (copied) (copied from widgets-for-google-feed/trunk/admin.php)
• tags/1.8/assets (copied) (copied from widgets-for-google-feed/trunk/assets)
• tags/1.8/assets/css/admin-notification.css (copied) (copied from widgets-for-google-feed/trunk/assets/css/admin-notification.css)
• tags/1.8/assets/css/admin.css (copied) (copied from widgets-for-google-feed/trunk/assets/css/admin.css)
• tags/1.8/assets/css/frontend-notifictions.css (copied) (copied from widgets-for-google-feed/trunk/assets/css/frontend-notifictions.css) (1 diff)
• tags/1.8/assets/img/trustindex.svg (copied) (copied from widgets-for-google-feed/trunk/assets/img/trustindex.svg)
• tags/1.8/assets/js/admin.js (copied) (copied from widgets-for-google-feed/trunk/assets/js/admin.js)
• tags/1.8/include (copied) (copied from widgets-for-google-feed/trunk/include)
• tags/1.8/include/admin.php (copied) (copied from widgets-for-google-feed/trunk/include/admin.php)
• tags/1.8/include/cache-plugin-filters.php (copied) (copied from widgets-for-google-feed/trunk/include/cache-plugin-filters.php)
• tags/1.8/include/get-more-customers-box.php (copied) (copied from widgets-for-google-feed/trunk/include/get-more-customers-box.php)
• tags/1.8/include/trustindex-elementor-widgets.php (copied) (copied from widgets-for-google-feed/trunk/include/trustindex-elementor-widgets.php) (1 diff)
• tags/1.8/include/update.php (copied) (copied from widgets-for-google-feed/trunk/include/update.php)
• tags/1.8/languages (copied) (copied from widgets-for-google-feed/trunk/languages)
• tags/1.8/languages/widgets-for-google-feed-lv.mo (copied) (copied from widgets-for-google-feed/trunk/languages/widgets-for-google-feed-lv.mo)
• tags/1.8/readme.txt (copied) (copied from widgets-for-google-feed/trunk/readme.txt) (2 diffs)
• tags/1.8/tabs (copied) (copied from widgets-for-google-feed/trunk/tabs)
• tags/1.8/tabs/advanced.php (copied) (copied from widgets-for-google-feed/trunk/tabs/advanced.php) (1 diff)
• tags/1.8/tabs/feed-configurator.php (copied) (copied from widgets-for-google-feed/trunk/tabs/feed-configurator.php) (3 diffs)
• tags/1.8/tabs/my-posts.php (copied) (copied from widgets-for-google-feed/trunk/tabs/my-posts.php)
• tags/1.8/trustindex-feed-plugin.class.php (copied) (copied from widgets-for-google-feed/trunk/trustindex-feed-plugin.class.php) (2 diffs)
• tags/1.8/uninstall.php (copied) (copied from widgets-for-google-feed/trunk/uninstall.php) (1 diff)
• tags/1.8/widgets-for-google-feed.php (copied) (copied from widgets-for-google-feed/trunk/widgets-for-google-feed.php) (2 diffs)
• tags/1.8/wordfence-vendor.txt (copied) (copied from widgets-for-google-feed/trunk/wordfence-vendor.txt)
• trunk/assets/css/frontend-notifictions.css (modified) (1 diff)
• trunk/include/trustindex-elementor-widgets.php (modified) (1 diff)
• trunk/readme.txt (modified) (2 diffs)
• trunk/tabs/advanced.php (modified) (1 diff)
• trunk/tabs/feed-configurator.php (modified) (3 diffs)
• trunk/trustindex-feed-plugin.class.php (modified) (2 diffs)
• trunk/uninstall.php (modified) (1 diff)
• trunk/widgets-for-google-feed.php (modified) (2 diffs)

widgets-for-google-feed/tags/1.8/assets/css/frontend-notifictions.css

@@ -1 @@
-.trustindex-notice{position:fixed;z-index:10;width:300px;left:0;opacity:1;margin:15px 20px;border-radius:4px;padding:0 10px;background-color:#fff;color:#000;box-shadow:2px 2px 10px 0px rgba(0, 0, 0, 0.15);transition:0.5s ease-in;display:flex;align-items:center;cursor:pointer}.trustindex-notice.notice-warning strong{color:#dba617}.trustindex-notice.notice-error strong{color:#e80000}.trustindex-notice img{height:60px}.trustindex-notice p{font-size:12px;padding:0 30px;margin-top:15px}.trustindex-notice a{display:inline-block;color:#fff;background-color:#0095f6;padding:3px 10px;border-radius:5px;margin-top:5px;transition:all 0.2s ease-in-out}.trustindex-notice a:hover{color:#fff;background-color:#0086dd;outline-width:3px;outline-style:solid;outline-color:rgba(0, 149, 246, 0.5)}.trustindex-notice .trustindex-notice-dismiss{position:absolute;right:-15px;top:-15px;border-radius:50%;background:#fff;box-shadow:2px 2px 10px 0px rgba(0, 0, 0, 0.15);width:35px;height:35px}.trustindex-notice .trustindex-notice-dismiss::before,.trustindex-notice .trustindex-notice-dismiss::after{content:"";position:absolute;top:50%;left:50%;width:50%;height:2px;background-color:#7b7b7b;transform-origin:center;border-radius:5px;transition:all 0.5s ease-in-out}.trustindex-notice .trustindex-notice-dismiss::before{transform:translate(-50%, -50%) rotate(45deg)}.trustindex-notice .trustindex-notice-dismiss::after{transform:translate(-50%, -50%) rotate(-45deg)}.trustindex-notice .trustindex-notice-dismiss:hover{background-color:#000;transition:all 0.3s ease-in-out}.trustindex-notice .trustindex-notice-dismiss:hover::before,.trustindex-notice .trustindex-notice-dismiss:hover::after{height:4px;background-color:#fff}
+.trustindex-notice{position:fixed;z-index:10;width:300px;left:0;opacity:1;margin:15px 20px;border-radius:4px;padding:0 10px;background-color:#fff;color:#000;box-shadow:2px 2px 10px 0px rgba(0, 0, 0, 0.15);transition:0.5s ease-in;display:flex;align-items:center;cursor:pointer}.trustindex-notice.notice-warning strong{color:#dba617}.trustindex-notice.notice-error strong{color:#e80000}.trustindex-notice img{height:60px}.trustindex-notice p{font-size:12px;padding:0 30px;margin-top:15px}.trustindex-notice a{display:inline-block;color:#fff;text-decoration:none;background-color:#0095f6;padding:3px 10px;border-radius:5px;margin-top:5px;transition:all 0.2s ease-in-out}.trustindex-notice a:hover{color:#fff;background-color:#0086dd;outline-width:3px;outline-style:solid;outline-color:rgba(0, 149, 246, 0.5)}.trustindex-notice .trustindex-notice-dismiss{position:absolute;right:-15px;top:-15px;border-radius:50%;background:#fff;box-shadow:2px 2px 10px 0px rgba(0, 0, 0, 0.15);width:35px;height:35px}.trustindex-notice .trustindex-notice-dismiss::before,.trustindex-notice .trustindex-notice-dismiss::after{content:"";position:absolute;top:50%;left:50%;width:50%;height:2px;background-color:#7b7b7b;transform-origin:center;border-radius:5px;transition:all 0.5s ease-in-out}.trustindex-notice .trustindex-notice-dismiss::before{transform:translate(-50%, -50%) rotate(45deg)}.trustindex-notice .trustindex-notice-dismiss::after{transform:translate(-50%, -50%) rotate(-45deg)}.trustindex-notice .trustindex-notice-dismiss:hover{background-color:#000;transition:all 0.3s ease-in-out}.trustindex-notice .trustindex-notice-dismiss:hover::before,.trustindex-notice .trustindex-notice-dismiss:hover::after{height:4px;background-color:#fff}

widgets-for-google-feed/tags/1.8/include/trustindex-elementor-widgets.php

@@ -19 +19 @@
 }
 protected function render() {
-$pluginManagerInstance = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.7.9", "Widgets for Google Feed", "Google");
+$pluginManagerInstance = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.8", "Widgets for Google Feed", "Google");
 echo do_shortcode('['.$pluginManagerInstance->getShortcodeName().']');
 }

widgets-for-google-feed/tags/1.8/readme.txt

@@ -4 +4 @@
 Tags: google, feed, posts, widget, gallery
 Tested up to: 6.9
-Stable tag: 1.7.9
+Stable tag: 1.8
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -13 +13 @@
 Author URI: https://www.trustindex.io/
 Text Domain: widgets-for-google-feed
-Version: 1.7.9
+Version: 1.8
 
 Google Feed Widgets. Display your Google feed on your website to increase engagement, sales and SEO.

widgets-for-google-feed/tags/1.8/tabs/advanced.php

@@ -38 +38 @@
 $yesIcon = '<span class="dashicons dashicons-yes-alt"></span>';
 $noIcon = '<span class="dashicons dashicons-dismiss"></span>';
-$pluginUpdated = ($pluginManagerInstance->getPluginCurrentVersion() <= "1.7.9");
+$pluginUpdated = ($pluginManagerInstance->getPluginCurrentVersion() <= "1.8");
 $cssInline = get_option($pluginManagerInstance->getOptionName('load-css-inline'), 0);
 $css = get_option($pluginManagerInstance->getOptionName('css-content'));

widgets-for-google-feed/tags/1.8/tabs/feed-configurator.php

@@ -46 +46 @@
 delete_option($pluginManagerInstance->getOptionName('feed-data'));
 delete_option($pluginManagerInstance->getOptionName('feed-data-saved'));
-delete_option($pluginManagerInstance->getOptionName('public-id'));
 delete_option($pluginManagerInstance->getOptionName('token-expires'));
 delete_option($pluginManagerInstance->getOptionName('layout'));
@@ -222 +221 @@
 </form>
 <?php $connectUrl = 'https://admin.trustindex.io/source/edit_feed/type/Google/iframe/1'; ?>
-<?php
-if ($isReconnectingSource) {
-$connectUrl .= '/public_id/'.get_option($pluginManagerInstance->getOptionName('public-id'));
-}
-?>
 <div class="ti-box" style="padding: 0">
 <?php
@@ -232 +226 @@
 isset($connectPending['error']) ? [] : $connectPending,
 array(
+'public_id' => get_option($pluginManagerInstance->getOptionName('public-id')),
 'website' => esc_attr(urlencode(get_option('siteurl'))),
 'version' => esc_attr($pluginManagerInstance->getVersion()),

widgets-for-google-feed/tags/1.8/trustindex-feed-plugin.class.php

@@ -123 +123 @@
 public function activate()
 {
+$requestBody = [
+'platform' => 'Google',
+'website' => get_option('siteurl'),
+];
+$response = wp_remote_post('https://admin.trustindex.io/new/wordpress-feed/register', [
+'headers' => [
+'Content-Type' => 'application/x-www-form-urlencoded',
+'ti-secure' => hash_hmac('sha256', http_build_query($requestBody), 'd07796b23064cf9a8bccae2ec5aafb42'),
+],
+'body' => $requestBody,
+'timeout' => '30',
+'sslverify' => false,
+]);
+if (is_wp_error($response)) {
+update_option($this->getOptionName('public-id'), $response->get_error_message(), false);
+return;
+}
+$data = json_decode(wp_remote_retrieve_body($response), true);
+update_option($this->getOptionName('public-id'), $data['public-id'] ?? $data['error'], false);
 include $this->getPluginDir() . 'include' . DIRECTORY_SEPARATOR . 'activate.php';
 if (!$this->getNotificationParam('rate-us', 'hidden', false) && $this->getNotificationParam('rate-us', 'active', true)) {
@@ -5470 +5489 @@
 }
 $body = $request->get_body();
-$expected = hash_hmac('sha256', $body.$timestamp, get_option($this->getOptionName('public-id'), $request->get_param('data')['public_id']));
+$expected = hash_hmac('sha256', $body.$timestamp, get_option($this->getOptionName('public-id')));
 if (!hash_equals($expected, $signature)) {
 return new WP_Error('invalid_signature', 'Signature mismatch', ['status' => 403]);

widgets-for-google-feed/tags/1.8/uninstall.php

@@ -4 +4 @@
 }
 require_once plugin_dir_path( __FILE__ ) . 'trustindex-feed-plugin.class.php';
-$trustindex_feed_google = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.7.9", "Widgets for Google Feed", "Google");
+$trustindex_feed_google = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.8", "Widgets for Google Feed", "Google");
 $trustindex_feed_google->uninstall();
 ?>

widgets-for-google-feed/tags/1.8/widgets-for-google-feed.php

@@ -6 +6 @@
 Description: Google Feed Widgets. Display your Google feed on your website to increase engagement, sales and SEO.
 Tags: google, feed, posts, widget, gallery
-Version: 1.7.9
+Version: 1.8
 Requires at least: 6.2
 Requires PHP: 7.0
@@ -28 +28 @@
 require_once plugin_dir_path(__FILE__) . 'include' . DIRECTORY_SEPARATOR . 'cache-plugin-filters.php';
 require_once plugin_dir_path( __FILE__ ) . 'trustindex-feed-plugin.class.php';
-$trustindex_feed_google = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.7.9", "Widgets for Google Feed", "Google");
+$trustindex_feed_google = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.8", "Widgets for Google Feed", "Google");
 $pluginManagerInstance = $trustindex_feed_google;
 register_activation_hook(__FILE__, [ $pluginManagerInstance, 'activate' ]);

widgets-for-google-feed/trunk/assets/css/frontend-notifictions.css

@@ -1 @@
-.trustindex-notice{position:fixed;z-index:10;width:300px;left:0;opacity:1;margin:15px 20px;border-radius:4px;padding:0 10px;background-color:#fff;color:#000;box-shadow:2px 2px 10px 0px rgba(0, 0, 0, 0.15);transition:0.5s ease-in;display:flex;align-items:center;cursor:pointer}.trustindex-notice.notice-warning strong{color:#dba617}.trustindex-notice.notice-error strong{color:#e80000}.trustindex-notice img{height:60px}.trustindex-notice p{font-size:12px;padding:0 30px;margin-top:15px}.trustindex-notice a{display:inline-block;color:#fff;background-color:#0095f6;padding:3px 10px;border-radius:5px;margin-top:5px;transition:all 0.2s ease-in-out}.trustindex-notice a:hover{color:#fff;background-color:#0086dd;outline-width:3px;outline-style:solid;outline-color:rgba(0, 149, 246, 0.5)}.trustindex-notice .trustindex-notice-dismiss{position:absolute;right:-15px;top:-15px;border-radius:50%;background:#fff;box-shadow:2px 2px 10px 0px rgba(0, 0, 0, 0.15);width:35px;height:35px}.trustindex-notice .trustindex-notice-dismiss::before,.trustindex-notice .trustindex-notice-dismiss::after{content:"";position:absolute;top:50%;left:50%;width:50%;height:2px;background-color:#7b7b7b;transform-origin:center;border-radius:5px;transition:all 0.5s ease-in-out}.trustindex-notice .trustindex-notice-dismiss::before{transform:translate(-50%, -50%) rotate(45deg)}.trustindex-notice .trustindex-notice-dismiss::after{transform:translate(-50%, -50%) rotate(-45deg)}.trustindex-notice .trustindex-notice-dismiss:hover{background-color:#000;transition:all 0.3s ease-in-out}.trustindex-notice .trustindex-notice-dismiss:hover::before,.trustindex-notice .trustindex-notice-dismiss:hover::after{height:4px;background-color:#fff}
+.trustindex-notice{position:fixed;z-index:10;width:300px;left:0;opacity:1;margin:15px 20px;border-radius:4px;padding:0 10px;background-color:#fff;color:#000;box-shadow:2px 2px 10px 0px rgba(0, 0, 0, 0.15);transition:0.5s ease-in;display:flex;align-items:center;cursor:pointer}.trustindex-notice.notice-warning strong{color:#dba617}.trustindex-notice.notice-error strong{color:#e80000}.trustindex-notice img{height:60px}.trustindex-notice p{font-size:12px;padding:0 30px;margin-top:15px}.trustindex-notice a{display:inline-block;color:#fff;text-decoration:none;background-color:#0095f6;padding:3px 10px;border-radius:5px;margin-top:5px;transition:all 0.2s ease-in-out}.trustindex-notice a:hover{color:#fff;background-color:#0086dd;outline-width:3px;outline-style:solid;outline-color:rgba(0, 149, 246, 0.5)}.trustindex-notice .trustindex-notice-dismiss{position:absolute;right:-15px;top:-15px;border-radius:50%;background:#fff;box-shadow:2px 2px 10px 0px rgba(0, 0, 0, 0.15);width:35px;height:35px}.trustindex-notice .trustindex-notice-dismiss::before,.trustindex-notice .trustindex-notice-dismiss::after{content:"";position:absolute;top:50%;left:50%;width:50%;height:2px;background-color:#7b7b7b;transform-origin:center;border-radius:5px;transition:all 0.5s ease-in-out}.trustindex-notice .trustindex-notice-dismiss::before{transform:translate(-50%, -50%) rotate(45deg)}.trustindex-notice .trustindex-notice-dismiss::after{transform:translate(-50%, -50%) rotate(-45deg)}.trustindex-notice .trustindex-notice-dismiss:hover{background-color:#000;transition:all 0.3s ease-in-out}.trustindex-notice .trustindex-notice-dismiss:hover::before,.trustindex-notice .trustindex-notice-dismiss:hover::after{height:4px;background-color:#fff}

widgets-for-google-feed/trunk/include/trustindex-elementor-widgets.php

@@ -19 +19 @@
 }
 protected function render() {
-$pluginManagerInstance = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.7.9", "Widgets for Google Feed", "Google");
+$pluginManagerInstance = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.8", "Widgets for Google Feed", "Google");
 echo do_shortcode('['.$pluginManagerInstance->getShortcodeName().']');
 }

widgets-for-google-feed/trunk/readme.txt

@@ -4 +4 @@
 Tags: google, feed, posts, widget, gallery
 Tested up to: 6.9
-Stable tag: 1.7.9
+Stable tag: 1.8
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -13 +13 @@
 Author URI: https://www.trustindex.io/
 Text Domain: widgets-for-google-feed
-Version: 1.7.9
+Version: 1.8
 
 Google Feed Widgets. Display your Google feed on your website to increase engagement, sales and SEO.

widgets-for-google-feed/trunk/tabs/advanced.php

@@ -38 +38 @@
 $yesIcon = '<span class="dashicons dashicons-yes-alt"></span>';
 $noIcon = '<span class="dashicons dashicons-dismiss"></span>';
-$pluginUpdated = ($pluginManagerInstance->getPluginCurrentVersion() <= "1.7.9");
+$pluginUpdated = ($pluginManagerInstance->getPluginCurrentVersion() <= "1.8");
 $cssInline = get_option($pluginManagerInstance->getOptionName('load-css-inline'), 0);
 $css = get_option($pluginManagerInstance->getOptionName('css-content'));

widgets-for-google-feed/trunk/tabs/feed-configurator.php

@@ -46 +46 @@
 delete_option($pluginManagerInstance->getOptionName('feed-data'));
 delete_option($pluginManagerInstance->getOptionName('feed-data-saved'));
-delete_option($pluginManagerInstance->getOptionName('public-id'));
 delete_option($pluginManagerInstance->getOptionName('token-expires'));
 delete_option($pluginManagerInstance->getOptionName('layout'));
@@ -222 +221 @@
 </form>
 <?php $connectUrl = 'https://admin.trustindex.io/source/edit_feed/type/Google/iframe/1'; ?>
-<?php
-if ($isReconnectingSource) {
-$connectUrl .= '/public_id/'.get_option($pluginManagerInstance->getOptionName('public-id'));
-}
-?>
 <div class="ti-box" style="padding: 0">
 <?php
@@ -232 +226 @@
 isset($connectPending['error']) ? [] : $connectPending,
 array(
+'public_id' => get_option($pluginManagerInstance->getOptionName('public-id')),
 'website' => esc_attr(urlencode(get_option('siteurl'))),
 'version' => esc_attr($pluginManagerInstance->getVersion()),

widgets-for-google-feed/trunk/trustindex-feed-plugin.class.php

@@ -123 +123 @@
 public function activate()
 {
+$requestBody = [
+'platform' => 'Google',
+'website' => get_option('siteurl'),
+];
+$response = wp_remote_post('https://admin.trustindex.io/new/wordpress-feed/register', [
+'headers' => [
+'Content-Type' => 'application/x-www-form-urlencoded',
+'ti-secure' => hash_hmac('sha256', http_build_query($requestBody), 'd07796b23064cf9a8bccae2ec5aafb42'),
+],
+'body' => $requestBody,
+'timeout' => '30',
+'sslverify' => false,
+]);
+if (is_wp_error($response)) {
+update_option($this->getOptionName('public-id'), $response->get_error_message(), false);
+return;
+}
+$data = json_decode(wp_remote_retrieve_body($response), true);
+update_option($this->getOptionName('public-id'), $data['public-id'] ?? $data['error'], false);
 include $this->getPluginDir() . 'include' . DIRECTORY_SEPARATOR . 'activate.php';
 if (!$this->getNotificationParam('rate-us', 'hidden', false) && $this->getNotificationParam('rate-us', 'active', true)) {
@@ -5470 +5489 @@
 }
 $body = $request->get_body();
-$expected = hash_hmac('sha256', $body.$timestamp, get_option($this->getOptionName('public-id'), $request->get_param('data')['public_id']));
+$expected = hash_hmac('sha256', $body.$timestamp, get_option($this->getOptionName('public-id')));
 if (!hash_equals($expected, $signature)) {
 return new WP_Error('invalid_signature', 'Signature mismatch', ['status' => 403]);

widgets-for-google-feed/trunk/uninstall.php

@@ -4 +4 @@
 }
 require_once plugin_dir_path( __FILE__ ) . 'trustindex-feed-plugin.class.php';
-$trustindex_feed_google = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.7.9", "Widgets for Google Feed", "Google");
+$trustindex_feed_google = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.8", "Widgets for Google Feed", "Google");
 $trustindex_feed_google->uninstall();
 ?>

widgets-for-google-feed/trunk/widgets-for-google-feed.php

@@ -6 +6 @@
 Description: Google Feed Widgets. Display your Google feed on your website to increase engagement, sales and SEO.
 Tags: google, feed, posts, widget, gallery
-Version: 1.7.9
+Version: 1.8
 Requires at least: 6.2
 Requires PHP: 7.0
@@ -28 +28 @@
 require_once plugin_dir_path(__FILE__) . 'include' . DIRECTORY_SEPARATOR . 'cache-plugin-filters.php';
 require_once plugin_dir_path( __FILE__ ) . 'trustindex-feed-plugin.class.php';
-$trustindex_feed_google = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.7.9", "Widgets for Google Feed", "Google");
+$trustindex_feed_google = new TRUSTINDEX_Feed_Google("google", __FILE__, "1.8", "Widgets for Google Feed", "Google");
 $pluginManagerInstance = $trustindex_feed_google;
 register_activation_hook(__FILE__, [ $pluginManagerInstance, 'activate' ]);