Plugin Directory

Changeset 2740677


Ignore:
Timestamp:
06/10/2022 11:10:44 PM (4 years ago)
Author:
vohotv
Message:

Fixed security issues

Location:
dyslexiefont
Files:
4 edited

Legend:

Unmodified
Added
Removed
  • dyslexiefont/tags/1.0.0/dyslexiefont.php

    r2739098 r2740677  
    101101
    102102        $script_params = array(
    103             'df_fontsize' => sanitize_option('dyslexiefont_free_fontsize',strip_tags(get_option('dyslexiefont_free_fontsize'))),
    104             'df_fontcolor' => sanitize_hex_color(strip_tags(get_option('dyslexiefont_free_fontcolor'))),
    105             'df_linkcolor' => sanitize_hex_color(strip_tags(get_option('dyslexiefont_free_linkcolor'))),
    106             'df_panellocation' => sanitize_option('dyslexiefont_free_panellocation',strip_tags(get_option('dyslexiefont_free_panellocation'))),
    107             'df_fonttype' => sanitize_option('dyslexiefont_free_fonttype',strip_tags(get_option('dyslexiefont_free_fonttype'))),
    108             'df_include_elements' => sanitize_option('dyslexiefont_free_include_elements',strip_tags(get_option('dyslexiefont_free_include_elements'))),
    109             'df_exclude_elements' => sanitize_option('dyslexiefont_free_exclude_elements',strip_tags(get_option('dyslexiefont_free_exclude_elements'))),
    110             'cookielocation' => esc_url_raw(site_url())
     103            'df_fontsize'         => esc_js( get_option('dyslexiefont_free_fontsize') ),
     104            'df_fontcolor'        => esc_js( get_option('dyslexiefont_free_fontcolor' ) ),
     105            'df_linkcolor'        => esc_js( get_option('dyslexiefont_free_linkcolor' ) ),
     106            'df_panellocation'    => esc_js( get_option('dyslexiefont_free_panellocation' ) ),
     107            'df_fonttype'         => esc_js( get_option('dyslexiefont_free_fonttype' ) ),
     108            'df_include_elements' => esc_js( get_option('dyslexiefont_free_include_elements' ) ),
     109            'df_exclude_elements' => esc_js( get_option('dyslexiefont_free_exclude_elements' ) ),
     110            'cookielocation'      => esc_js( site_url() ),
    111111        );
    112112        wp_localize_script( 'dfcore', 'dyslexiefont_free_settings', $script_params );   
  • dyslexiefont/tags/1.0.0/dyslexiefont_plugin_settings.php

    r2740653 r2740677  
    4848/* -- tabs */
    4949
    50 function sanitize_option_dyslexiefont_free_fontsize($number) {
    51     if (is_number($number)) {
    52         return $number;
    53     }
    54 }
    55 
    56 function sanitize_option_dyslexiefont_free_panellocation($loc) {
    57     if ($loc == "tl" || $loc == "tr" || $loc == "bl" || $loc == "br") {
    58         return $loc;
    59     }
    60 }
    61 
    62 function sanitize_option_dyslexiefont_free_fonttype($fontselected) {
    63     if ($fontselected == "dyslexiefont" || $fontselected == "dyslexiefontkids") {
    64         return $fontselected;
    65     }
    66 }
    67 
    68 function sanitize_option_dyslexiefont_free_include_elements($elemslist) {
    69     $elemslist_clean = esc_html(strip_tags($elemslist));
    70     return $elemslist_clean;
    71 }
    72 
    73 function sanitize_option_dyslexiefont_free_exclude_elements($elemslist) {
    74     $elemslist_clean = esc_html(strip_tags($elemslist));
    75     return $elemslist_clean;
    76 }
    77 
    78 
    7950// settings page
    8051if ((isset($_GET["tab"]) &&  $_GET["tab"] == "settings") || !isset($_GET["tab"])) {
    8152    if (isset($_POST["df_savesettings"])) {
    82         // escape posts
    83         update_option('dyslexiefont_free_fontsize', sanitize_option('dyslexiefont_free_fontsize',strip_tags($_POST["dfp_fontsize"])));
    84         update_option('dyslexiefont_free_fontcolor', sanitize_hex_color(strip_tags($_POST["dfp_color"])));
    85         update_option('dyslexiefont_free_linkcolor', sanitize_hex_color(strip_tags($_POST["dfp_linkcolor"])));
    86         update_option('dyslexiefont_free_panellocation', sanitize_option('dyslexiefont_free_panellocation',strip_tags($_POST["dfp_location"])));
    87         update_option('dyslexiefont_free_fonttype', sanitize_option('dyslexiefont_free_fonttype',strip_tags($_POST["dfp_fonttype"])));
    88         update_option('dyslexiefont_free_include_elements', sanitize_option('dyslexiefont_free_include_elements',strip_tags($_POST["dfp_includes"])));
    89         update_option('dyslexiefont_free_exclude_elements', sanitize_option('dyslexiefont_free_exclude_elements',strip_tags($_POST["dfp_excludes"])));
     53        // sanitize posts
     54        update_option('dyslexiefont_free_fontsize',         sanitize_text_field( $_POST["dfp_fontsize"] ) );
     55        update_option('dyslexiefont_free_fontcolor',        sanitize_hex_color( $_POST["dfp_color"] ) );
     56        update_option('dyslexiefont_free_linkcolor',        sanitize_hex_color( $_POST["dfp_linkcolor"] ) );
     57        update_option('dyslexiefont_free_panellocation',    sanitize_text_field( $_POST["dfp_location"] ) );
     58        update_option('dyslexiefont_free_fonttype',         sanitize_text_field( $_POST["dfp_fonttype"] ) );
     59        update_option('dyslexiefont_free_include_elements', sanitize_text_field( $_POST["dfp_includes"] ) );
     60        update_option('dyslexiefont_free_exclude_elements', sanitize_text_field( $_POST["dfp_excludes"] ) );
    9061
    9162        $savedSettingsMessage = "<span>Settings saved</span>";
  • dyslexiefont/trunk/dyslexiefont.php

    r2739098 r2740677  
    101101
    102102        $script_params = array(
    103             'df_fontsize' => sanitize_option('dyslexiefont_free_fontsize',strip_tags(get_option('dyslexiefont_free_fontsize'))),
    104             'df_fontcolor' => sanitize_hex_color(strip_tags(get_option('dyslexiefont_free_fontcolor'))),
    105             'df_linkcolor' => sanitize_hex_color(strip_tags(get_option('dyslexiefont_free_linkcolor'))),
    106             'df_panellocation' => sanitize_option('dyslexiefont_free_panellocation',strip_tags(get_option('dyslexiefont_free_panellocation'))),
    107             'df_fonttype' => sanitize_option('dyslexiefont_free_fonttype',strip_tags(get_option('dyslexiefont_free_fonttype'))),
    108             'df_include_elements' => sanitize_option('dyslexiefont_free_include_elements',strip_tags(get_option('dyslexiefont_free_include_elements'))),
    109             'df_exclude_elements' => sanitize_option('dyslexiefont_free_exclude_elements',strip_tags(get_option('dyslexiefont_free_exclude_elements'))),
    110             'cookielocation' => esc_url_raw(site_url())
     103            'df_fontsize'         => esc_js( get_option('dyslexiefont_free_fontsize') ),
     104            'df_fontcolor'        => esc_js( get_option('dyslexiefont_free_fontcolor' ) ),
     105            'df_linkcolor'        => esc_js( get_option('dyslexiefont_free_linkcolor' ) ),
     106            'df_panellocation'    => esc_js( get_option('dyslexiefont_free_panellocation' ) ),
     107            'df_fonttype'         => esc_js( get_option('dyslexiefont_free_fonttype' ) ),
     108            'df_include_elements' => esc_js( get_option('dyslexiefont_free_include_elements' ) ),
     109            'df_exclude_elements' => esc_js( get_option('dyslexiefont_free_exclude_elements' ) ),
     110            'cookielocation'      => esc_js( site_url() ),
    111111        );
    112112        wp_localize_script( 'dfcore', 'dyslexiefont_free_settings', $script_params );   
  • dyslexiefont/trunk/dyslexiefont_plugin_settings.php

    r2740653 r2740677  
    4848/* -- tabs */
    4949
    50 function sanitize_option_dyslexiefont_free_fontsize($number) {
    51     if (is_number($number)) {
    52         return $number;
    53     }
    54 }
    55 
    56 function sanitize_option_dyslexiefont_free_panellocation($loc) {
    57     if ($loc == "tl" || $loc == "tr" || $loc == "bl" || $loc == "br") {
    58         return $loc;
    59     }
    60 }
    61 
    62 function sanitize_option_dyslexiefont_free_fonttype($fontselected) {
    63     if ($fontselected == "dyslexiefont" || $fontselected == "dyslexiefontkids") {
    64         return $fontselected;
    65     }
    66 }
    67 
    68 function sanitize_option_dyslexiefont_free_include_elements($elemslist) {
    69     $elemslist_clean = esc_html(strip_tags($elemslist));
    70     return $elemslist_clean;
    71 }
    72 
    73 function sanitize_option_dyslexiefont_free_exclude_elements($elemslist) {
    74     $elemslist_clean = esc_html(strip_tags($elemslist));
    75     return $elemslist_clean;
    76 }
    77 
    78 
    7950// settings page
    8051if ((isset($_GET["tab"]) &&  $_GET["tab"] == "settings") || !isset($_GET["tab"])) {
    8152    if (isset($_POST["df_savesettings"])) {
    82         // escape posts
    83         update_option('dyslexiefont_free_fontsize', sanitize_option('dyslexiefont_free_fontsize',strip_tags($_POST["dfp_fontsize"])));
    84         update_option('dyslexiefont_free_fontcolor', sanitize_hex_color(strip_tags($_POST["dfp_color"])));
    85         update_option('dyslexiefont_free_linkcolor', sanitize_hex_color(strip_tags($_POST["dfp_linkcolor"])));
    86         update_option('dyslexiefont_free_panellocation', sanitize_option('dyslexiefont_free_panellocation',strip_tags($_POST["dfp_location"])));
    87         update_option('dyslexiefont_free_fonttype', sanitize_option('dyslexiefont_free_fonttype',strip_tags($_POST["dfp_fonttype"])));
    88         update_option('dyslexiefont_free_include_elements', sanitize_option('dyslexiefont_free_include_elements',strip_tags($_POST["dfp_includes"])));
    89         update_option('dyslexiefont_free_exclude_elements', sanitize_option('dyslexiefont_free_exclude_elements',strip_tags($_POST["dfp_excludes"])));
     53        // sanitize posts
     54        update_option('dyslexiefont_free_fontsize',         sanitize_text_field( $_POST["dfp_fontsize"] ) );
     55        update_option('dyslexiefont_free_fontcolor',        sanitize_hex_color( $_POST["dfp_color"] ) );
     56        update_option('dyslexiefont_free_linkcolor',        sanitize_hex_color( $_POST["dfp_linkcolor"] ) );
     57        update_option('dyslexiefont_free_panellocation',    sanitize_text_field( $_POST["dfp_location"] ) );
     58        update_option('dyslexiefont_free_fonttype',         sanitize_text_field( $_POST["dfp_fonttype"] ) );
     59        update_option('dyslexiefont_free_include_elements', sanitize_text_field( $_POST["dfp_includes"] ) );
     60        update_option('dyslexiefont_free_exclude_elements', sanitize_text_field( $_POST["dfp_excludes"] ) );
    9061
    9162        $savedSettingsMessage = "<span>Settings saved</span>";
Note: See TracChangeset for help on using the changeset viewer.