Changeset 777917

Timestamp:

09/24/2013 07:04:36 PM (12 years ago)

Author:

joshua.strebel

Message:

security related changes

Location:

pagely-reseller-management/trunk

Files:

• partner-api.php (modified) (10 diffs)
• readme.txt (modified) (1 diff)

pagely-reseller-management/trunk/partner-api.php

@@ -4 +4 @@
 Plugin URI: https://docs-api.pagely.com/reseller-plugin/
 Description: For Pagely Resellers
-Version: 3.1.5
+Version: 3.1.6
 Author: joshua.strebel
-Author URI: https://page.ly
+Author URI: https://pagely.com
 
 */
@@ -78 +78 @@
 class PagelyApi {
 
-   var $ver ='p3.1.4';
+   var $ver ='p3.1.6';
    var $pagely_api_sec = '';
    var $bypass_pagely_varnish = true;       // if running on page.ly, need to bypass varnish 
    var $live_endpoint           = 'https://api.pagely.com/v1';
-  // var $sandbox_endpoint      = 'https://sandbox-api.pagely.com/v1';
-   var $sandbox_endpoint        = 'http://api.hcs/v1';
+   var $sandbox_endpoint        = 'https://sandbox-api.pagely.com/v1';
+   //var $sandbox_endpoint      = 'http://api.hcs/v1';
    var $api_endpoint            = '';
     static $pp_portal_url       = 'https://atomic.pagely.com/';
@@ -339 +339 @@
         // lets check for a post action from the plans page
     
+        
+        
         if (isset($_POST['pagely_order']['plan'])) {
             // plan preselected
@@ -490 +492 @@
         if (! $item ) {
             //look for post
-            $item = $_POST['item'];
+            $item = htmlentities( $_POST['item'] );
+            
         }
         // make sure we have an array
@@ -538 +541 @@
     public function _delitem_cart($item_id = false) {
         if (!$item_id && $_POST['item_id']) {
-            $item_id = $_POST['item_id'];
+            $item_id = htmlentities( $_POST['item_id'] );
         }
         // get the cart
@@ -682 +685 @@
         header( "Content-Type: application/json" );
 
-        $field = $_POST['field'];
+        $field = htmlentities($_POST['field']);
         // check to see if the submitted nonce matches with the generated nonce we created earlier
         
@@ -728 +731 @@
         $form =  $_POST['pagely_order'];
         foreach ($form as $k => $v) {
-            $form[$k] = trim($v);
+            $form[$k] = trim( htmlentities( strip_tags($v) ) );
         }
         
@@ -762 +765 @@
         $form = $this->_get_pp_session('acc_form_post');
         foreach ($form as $k => $v) {
-            $form[$k] = trim($v);
+            $form[$k] = trim( htmlentities( strip_tags($v) ) );
         }
         // lets add their plan choice to the session
@@ -964 +967 @@
         $form = $_POST['pagely_order'];
         foreach ($form as $k => $v) {
-            $form[$k] = strip_tags(trim($v));
+            $form[$k] = trim( htmlentities( strip_tags($v) ) );
         }
         
@@ -1241 +1244 @@
             if (is_array($v)) {
                 foreach ($v as $kk => $vv) {
-                    $v[$kk] = strip_tags( trim($vv) );
+                    $v[$kk] =  trim( htmlentities( strip_tags($vv) ) );
                 }
             } else {
-                $form[$k] = strip_tags( trim($v) );
+                $form[$k] = trim( htmlentities( strip_tags($v) ) );
             }
         }
         // array of products to be added to cart
         $items = $form;
+        
         
         

pagely-reseller-management/trunk/readme.txt

@@ -20 +20 @@
 Read [the documentation here](https://docs-api.pagely.com/reseller-plugin/).
 == Changelog ==
+= 3.1.6 =
+Security related changes
 = 3.1.5 =
 new options page class, and options