WordPress.org
Get WordPress

Plugin Directory

Changeset 1753559


Ignore:
Timestamp:
10/26/2017 11:54:16 PM (8 years ago)
Author:
scottvavoom
Message:

Add security when reading settings from the database

Location:
wp-iclew/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • wp-iclew/trunk/readme.txt

    r1753524 r1753559  
    7575Do not show the Agent on posts/pages if the key is empty
    7676
     77= 1.3 =
     78
     79Add security when reading options from database.
     80
    7781== Learn More section ==
    7882

  • wp-iclew/trunk/wp-acobot.php

    r1753524 r1753559  
    44Plugin URI:   http://vavoomdesign.com/wordpress/scott/wp-acobot/
    55Description:  Add a sophisticated, customizable Agent to your pages with a shortcode. Powered by acobot
    6 Version:      1.2
     6Version:      1.3
    77Author:       Scott Campbell
    88Author URI:   http://vavoomdesign.com/wordpress/scott
    … …  
    7474    private function add_acobot_script( $admin = false ) {
    7575        $url = self::ACOBOT_URL;
    76         $key = get_option(self::OPT_KEY, '' );
     76        $key = sanitize_text_field(get_option(self::OPT_KEY, '' ));
    7777
    7878        //if admin && no key, then use the REF_KEY
    … …  
    9696        $js.= ' if( $("#aco-wrapper").length ) {';
    9797
    98         $setting = get_option(self::OPT_COLOR, '' );
     98        $setting = sanitize_text_field(get_option(self::OPT_COLOR, '' ));
    9999        if( isset($setting) ) {
    100100            $js.= '$("body").append( "<style>.iclew-color{background-color:' . $setting . ';}</style>" );';
    … …  
    102102
    103103        // the image file name requires both tests, I couldn't figure out why
    104         $setting = get_option(self::OPT_IMG, '' );
     104        $setting = sanitize_text_field(get_option(self::OPT_IMG, '' ));
    105105        if( isset($setting) && !empty($setting) ) {
    106106            $js.= '$("#iclew-button-img").attr( "src","' . $setting . '").width(60);';
    … …  
    129129  public function run_acobot( $atts, $content='' ) {
    130130        // if enabled, then show the bot
    131         $setting = get_option(self::OPT_ENB, '1' );
    132         $key = get_option(self::OPT_KEY, '' );
     131        $setting = sanitize_text_field(get_option(self::OPT_ENB, '1' ));
     132        $key = sanitize_text_field(get_option(self::OPT_KEY, '' ));
    133133
    134134        if( (1 == $setting) && !empty($key) ) {
    … …  
    185185 
    186186  public function callback_acobot_key( $args ) {
    187     $setting = get_option(self::OPT_KEY, '' );
     187    $setting = sanitize_text_field(get_option(self::OPT_KEY, '' ));
    188188    ?>
    189189    <p><input type="text" name="<?= self::OPT_KEY ?>" size="30" value="<?= isset($setting) ? esc_attr($setting) : ''; ?>">
    … …  
    193193
    194194  public function callback_acobot_enb( $args ) {
    195     $setting = get_option(self::OPT_ENB, '1' );
     195    $setting = sanitize_text_field(get_option(self::OPT_ENB, '1' ));
    196196    ?>
    197197        <p><input type="checkbox" name="<?= self::OPT_ENB ?>" value="1" <? checked( '1', $setting ) ?>>
    … …  
    201201
    202202  public function callback_acobot_color( $args ) {
    203     $setting = get_option(self::OPT_COLOR, '' );
     203    $setting = sanitize_text_field(get_option(self::OPT_COLOR, '' ));
    204204    ?>
    205205        <p><input type="text" name="<?= self::OPT_COLOR ?>" size="30" value="<?= isset($setting) ? esc_attr($setting) : ''; ?>">
    … …  
    209209
    210210  public function callback_acobot_img( $args ) {
    211     $setting = get_option(self::OPT_IMG, '' );
     211    $setting = sanitize_text_field(get_option(self::OPT_IMG, '' ));
    212212    ?>
    213213        <p><input type="text" name="<?= self::OPT_IMG ?>" size="30" value="<?= isset($setting) ? esc_attr($setting) : ''; ?>">
Note: See TracChangeset for help on using the changeset viewer.