WordPress.org
Get WordPress

Plugin Directory

Changeset 1259341


Ignore:
Timestamp:
10/04/2015 03:30:02 PM (11 years ago)
Author:
stevenellis
Message:

Version 1.3.0: enhances plugin security and version 4.3.1 compatability

Location:
easy2map/trunk
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • easy2map/trunk/includes/Easy2Map.php

    r1242841 r1259341  
    77    const min_php_version = '5.0';
    88    const min_wp_version = '3.0';
    9     const e2m_version = '1.2.9';
     9    const e2m_version = '1.3.0';
    1010
    1111    // Used to uniquely identify this plugin's menu page in the WP manager

  • easy2map/trunk/includes/MapImport.php

    r898860 r1259341  
    2121        $xmlObject = simplexml_load_string(file_get_contents($_FILES["xmlfile"]['tmp_name']));
    2222       
    23         if (isset($xmlObject->map)) {
     23        if ($xmlObject && isset($xmlObject->map)) {
    2424
    2525            //only import map settings if required
    … …  
    109109                }
    110110            }
     111        } else {
     112            echo "Invalid XML uploaded";
    111113        }
    112114

  • easy2map/trunk/includes/MapImportCSV.php

    r1178300 r1259341  
    1919
    2020    $file = $_FILES["csvfile"]['tmp_name'];
     21
     22    //only allow CSV files to be uploaded
     23    $mimes = array('application/vnd.ms-excel','text/plain','text/csv','text/tsv');
     24    if(!in_array($_FILES["csvfile"]["type"],$mimes)){
     25        echo'<script> jQuery(function() {
     26            alert("No records imported - incorrect file format. Only CSV files permitted.")
     27            window.location = "?page=easy2map&action=edit&map_id=' . $mapID . '";
     28            });
     29            </script>';
     30        die();
     31    }
     32
    2133    $handle = fopen($file, "r");
    2234    $row = 0;
    … …  
    4961
    5062                    $SQL = $wpdb->prepare("
    51                     INSERT INTO $markersTable (MapID,
    52                     CreatedByUserID,
    53                     LatLong,
    54                     Title,
    55                     PinImageURL,
    56                     DetailsHTML)
    57                     VALUES (%s, '%s', '%s', '%s', '%s', '%s');", $mapID, $current_user->ID, "(" . $lat . "," . $lng . ")", $title, $pinImage, $pinHTML);
     63                        INSERT INTO $markersTable (MapID,
     64                            CreatedByUserID,
     65                            LatLong,
     66                            Title,
     67                            PinImageURL,
     68                            DetailsHTML)
     69                    VALUES (%s, '%s', '%s', '%s', '%s', '%s');",
     70                    $mapID, $current_user->ID, "(" . $lat . "," . $lng . ")",
     71                    $title, $pinImage, $pinHTML);
    5872
    5973                    $wpdb->query($SQL);
    … …  
    6680            alert("' . $row . ' records successfully imported");
    6781            window.location = "?page=easy2map&action=edit&map_id=' . $mapID . '";});
    68         </script>';
    69     }
     82</script>';
     83}
    7084}
    7185?>
    … …  
    7488
    7589    <form name="formImport3" enctype="multipart/form-data" id="formImport3"
    76           action="?page=easy2map&action=mapimportcsv&map_id=<?php echo $mapID; ?>"
    77           method="post">
     90    action="?page=easy2map&action=mapimportcsv&map_id=<?php echo $mapID; ?>"
     91    method="post">
    7892
    79         <table style="background-color:#EBEBEB;width:60%;margin-left:auto;margin-right:auto;margin-top:10px;" cellspacing="3" cellpadding="3" class="table table-bordered">
    80             <tr>
    81                 <td class="instructions"><h5>Import Markers via .CSV (Using Latitude &amp; Longitude)</h5>
    82                 </td>
    83             </tr>
     93    <table style="background-color:#EBEBEB;width:60%;margin-left:auto;margin-right:auto;margin-top:10px;" cellspacing="3" cellpadding="3" class="table table-bordered">
     94        <tr>
     95            <td class="instructions"><h5>Import Markers via .CSV (Using Latitude &amp; Longitude)</h5>
     96            </td>
     97        </tr>
    8498
    85             <tr><td align="center" style="text-align:center">
     99        <tr><td align="center" style="text-align:center">
    86100
    87                     <h5><input type='file' name='csvfile'
    88                                id='csvfile'
    89                                size='30' style="width:300px;vertical-align:middle;"
    90                                acceptedFileList='CSV'
    91                                accept='csv/*'></h5>
    92                     <h6><i>(Only Valid .CSV Files Accepted)</i></h6>
    93                     <button style="margin-top:20px;margin-left:auto;" class="btn btn-primary" data-dismiss="modal"
    94                             onclick="easy2map_map_functions.uploadImportCSV()" aria-hidden="true">Upload CSV File</button>
    95                     <button onclick="window.history.back(-1);" type="button"
    96                             style="margin-top:20px;width:120px;float:right" class="btn">Back</button>
    97                 </td></tr>
    98         </table>
     101            <h5><input type='file' name='csvfile'
     102             id='csvfile'
     103             size='30' style="width:300px;vertical-align:middle;"
     104             acceptedFileList='CSV'
     105             accept='csv/*'></h5>
     106             <h6><i>(Only Valid .CSV Files Accepted)</i></h6>
     107             <button style="margin-top:20px;margin-left:auto;" class="btn btn-primary" data-dismiss="modal"
     108             onclick="easy2map_map_functions.uploadImportCSV()" aria-hidden="true">Upload CSV File</button>
     109             <button onclick="window.history.back(-1);" type="button"
     110             style="margin-top:20px;width:120px;float:right" class="btn">Back</button>
     111         </td></tr>
     112     </table>
    99113
    100         <table style="font-size:11px;background-color:#FFFFFF;width:60%;margin-left:auto;margin-right:auto;margin-top:30px;" cellspacing="3" cellpadding="3" class="table table-bordered">
     114     <table style="font-size:11px;background-color:#FFFFFF;width:60%;margin-left:auto;margin-right:auto;margin-top:30px;" cellspacing="3" cellpadding="3" class="table table-bordered">
    101115
    102             <tr>
    103                 <th>Please upload .CSV files in the following format:</th>
    104             </tr>
    105             <tr><td>[marker 1 latitude],[marker 1 longitude],[marker 1 title],[marker 1 icon],[marker 1 description]<br>
     116        <tr>
     117            <th>Please upload .CSV files in the following format:</th>
     118        </tr>
     119        <tr><td>[marker 1 latitude],[marker 1 longitude],[marker 1 title],[marker 1 icon],[marker 1 description]<br>
    106120            [marker 2 latitude],[marker 2 longitude],[marker 2 title],[marker 2 icon],[marker 2 description]</td></tr>
    107121            <tr><th>Example:
    108             <p style="font-style:italic">51.508039, -0.128068999, Trafalgar Square, 222.png, At the heart of London<br>
    109             48.85837, 2.294481, Tour Eiffel, 222.png, At the heart of Paris
    110             </p></th></tr>
    111             <tr>
     122                <p style="font-style:italic">51.508039, -0.128068999, Trafalgar Square, 222.png, At the heart of London<br>
     123                    48.85837, 2.294481, Tour Eiffel, 222.png, At the heart of Paris
     124                </p></th></tr>
     125                <tr>
    112126
    113                 <td style="margin-top:20px;">
     127                    <td style="margin-top:20px;">
    114128
    115                     <h5>Important to note:</h5>
    116                     <ul>
    117                         <li> <b>Latitude and longitude:</b> must be numeric, for example <b><i>-26.022850990407825, 28.046894073486328</i></b></li>
    118                         <li> <b>Marker icon:</b> this can be the file name of a marker icon that has been uploaded, for example <b>CoolPinIcon.png</b><br>(leave this field empty for default icon to appear)</li>
    119                         <li> <b>Marker description:</b> can contain HTML</li>
    120                     </ul>
     129                        <h5>Important to note:</h5>
     130                        <ul>
     131                            <li> <b>Latitude and longitude:</b> must be numeric, for example <b><i>-26.022850990407825, 28.046894073486328</i></b></li>
     132                            <li> <b>Marker icon:</b> this can be the file name of a marker icon that has been uploaded, for example <b>CoolPinIcon.png</b><br>(leave this field empty for default icon to appear)</li>
     133                            <li> <b>Marker description:</b> can contain HTML</li>
     134                        </ul>
    121135
    122136
    123                 </td>
     137                    </td>
    124138
    125             </tr>
    126         </table>
     139                </tr>
     140            </table>
    127141
    128142
    129     </form>
    130 </div>
     143        </form>
     144    </div>
    131145

  • easy2map/trunk/includes/MapImportCSV2.php

    r1178308 r1259341  
    1919
    2020    $file = $_FILES["csvfile"]['tmp_name'];
     21
     22    //only allow CSV files to be uploaded
     23    $mimes = array('application/vnd.ms-excel','text/plain','text/csv','text/tsv');
     24    if(!in_array($_FILES["csvfile"]["type"],$mimes)){
     25        echo'<script> jQuery(function() {
     26            alert("No records imported - incorrect file format. Only CSV files permitted.")
     27            window.location = "?page=easy2map&action=edit&map_id=' . $mapID . '";
     28            });
     29            </script>';
     30        die();
     31    }
     32
    2133    $handle = fopen($file, "r");
    2234    $row = 0;
    … …  
    5668                    PinImageURL,
    5769                    DetailsHTML)
    58                     VALUES (%s, '%s', '%s', '%s', '%s', '%s');", $mapID, $current_user->ID, "(" . $loc["lat"] . "," . $loc["lng"] . ")", $title, $pinImage, $pinHTML);
     70                    VALUES (%s, '%s', '%s', '%s', '%s', '%s');",
     71                    $mapID, $current_user->ID, "(" .
     72                        $loc["lat"] . "," .
     73                        $loc["lng"] . ")",
     74                    $title, $pinImage, $pinHTML);
    5975
    6076                    $wpdb->query($SQL);

  • easy2map/trunk/includes/MapPinImageSave.php

    r1242823 r1259341  
    2626        $resizeHeight = '100';
    2727
    28         if( isset($_POST['max_marker_width'])
     28        //only resize if is valid image
     29        if( isset($type)
     30            && in_array($type, array(IMAGETYPE_PNG, IMAGETYPE_JPEG, IMAGETYPE_GIF))
     31            && isset($_POST['max_marker_width'])
    2932            && isset($_POST['max_marker_height'])
    3033            && is_numeric($_POST['max_marker_width'])
    … …  
    3841        }
    3942   
    40         if ($_FILES["pinicon"]['size'] < 5000000) {
    41             $arrSmallImage = resizeImage($imagesDirectory, $uploadedFile, $imageName, $width, $height, $type, $attr, $resizeWidth, $resizeHeight, "SMALL");
    42             $imagePlusLocation = WP_CONTENT_URL . "/uploads/easy2map/images/map_pins/uploaded/" . $_GET["map_id"] . "/" . $arrSmallImage[0];
     43        //sanitize data before uploading icon
     44        if ($_FILES["pinicon"]['size'] < 5000000
     45            && is_numeric($_GET["map_id"])
     46            && intval($_GET["map_id"]) > 0) {
     47
     48            $arrSmallImage = resizeImage($imagesDirectory, $uploadedFile,
     49                $imageName, $width, $height, $type, $attr,
     50                $resizeWidth, $resizeHeight, "SMALL");
     51
     52            $imagePlusLocation = WP_CONTENT_URL . "/uploads/easy2map/images/map_pins/uploaded/" . intval($_GET["map_id"]) . "/" . $arrSmallImage[0];
    4353           
    4454        }

  • easy2map/trunk/includes/SettingsEdit.php

    r1195339 r1259341  
    5858    echo ' disabled="disabled"';
    5959}
    60 echo ' />&nbsp;&nbspAllow map zooming <p style="font-size:0.9em;text-decoration:italic;">(only true, map zoom level is static and can\'t be changed).</p></h6>';
     60echo ' />&nbsp;&nbspAllow map zooming <p style="font-size:0.9em;text-decoration:italic;">(if false, map zoom level is static and can\'t be changed).</p></h6>';
    6161
    6262echo '<h5 style="margin-top:20px;border-top:1px solid #EBEBEB;padding-top:0.5em;">Marker Popup Settings</h5>'

  • easy2map/trunk/index.php

    r1242841 r1259341  
    66  Description: The easiest tool available for creating custom & great-looking Google Maps. Add multiple pins and customize maps with drag-and-drop simplicity.
    77  Author: Steven Ellis
    8   Version: 1.2.9
     8  Version: 1.3.0
    99  Author URI: http://easy2map.com/
    1010 */

  • easy2map/trunk/readme.txt

    r1242841 r1259341  
    55
    66Requires at least: 3.0.1
    7 Tested up to: 4.3
    8 Stable tag: 1.2.9
     7Tested up to: 4.3.1
     8Stable tag: 1.3.0
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    144144* Additional styling options added to map templates containing pin lists.
    145145
     146= 1.3.0 =
     147* Increased data sanitization logic, for improved plugin security.
     148* WordPress version 4.3.1 compatability.
     149
    146150== Upgrade Notice ==
    147151
    … …  
    202206* Two new map templates added.
    203207* Additional styling options added to map templates containing pin lists.
     208
     209= 1.3.0 =
     210* Improvements to data sanitization logic, for enhanced plugin security.
     211* WordPress version 4.3.1 compatability.

  • easy2map/trunk/scripts/easy2map.js

    r1195339 r1259341  
    8282
    8383            });
    84         }
     84}
    8585        //if pin 'load' settings set to '2', open popup on window load
    8686        if (loadBehaviour === 2) {
    … …  
    137137
    138138        if (!!mapSettings
    139          && !!mapSettings.setMaxWidthPopups
    140          && typeof mapSettings.setMaxWidthPopups !== "undefined"
    141          && !!mapSettings.maxWidthPopups
    142          && typeof mapSettings.maxWidthPopups !== "undefined"){
    143 
    144          if (parseInt(mapSettings.setMaxWidthPopups) === 1 && !isNaN(mapSettings.maxWidthPopups)){
    145              maxPopupWidth = mapSettings.maxWidthPopups;
    146          }
    147 
    148      }
    149 
    150      var data = {
     139           && !!mapSettings.setMaxWidthPopups
     140           && typeof mapSettings.setMaxWidthPopups !== "undefined"
     141           && !!mapSettings.maxWidthPopups
     142           && typeof mapSettings.maxWidthPopups !== "undefined"){
     143
     144           if (parseInt(mapSettings.setMaxWidthPopups) === 1 && !isNaN(mapSettings.maxWidthPopups)){
     145               maxPopupWidth = mapSettings.maxWidthPopups;
     146           }
     147
     148       }
     149
     150       var data = {
    151151        action: 'retrieve_map_points',
    152152        MapID: mapID,
    … …  
    230230                    markersArray.push(insertNewMapPoint(arrMapPins[i], map, maxPopupWidth));
    231231                }
    232          }
    233      });
     232            }
     233        });
    234234};
    235235
    … …  
    275275                $allowMapZoom = true;
    276276            }
    277          
     277
    278278            if ($mapType === "ROADMAP")
    279279                $mapType = google.maps.MapTypeId.ROADMAP;

  • easy2map/trunk/scripts/functions.map.admin.js

    r1242823 r1259341  
    13471347
    13481348            if (csvContinue === true) {
    1349                 busy();
    13501349                document.formImport3.submit();
    13511350            }
Note: See TracChangeset for help on using the changeset viewer.