WordPress.org
Get WordPress

Plugin Directory

Changeset 2769680


Ignore:
Timestamp:
08/12/2022 09:24:14 AM (4 years ago)
Author:
fastflow
Message:

Update for potential admin XSS

Location:
fast-flow-dashboard/trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • fast-flow-dashboard/trunk/fastflow.php

    r2708173 r2769680  
    55 * Plugin URI: https://fastflow.io
    66 * Description: User tagging and dashboard plugin for Fast Flow system
    7  * Version: 1.2.11
     7 * Version: 1.2.12
    88 * Author: FastFlow.io
    99 * Author URI: https://fastflow.io

  • fast-flow-dashboard/trunk/includes/fast-tagger-init.php

    r2558992 r2769680  
    788788        $previous = get_term_meta($term_id,'tag_color',true);
    789789
    790         update_term_meta($term_id,'tag_color',$_POST['color'],$previous);
     790        update_term_meta($term_id,'tag_color',wp_filter_nohtml_kses($_POST['color']),$previous);
    791791
    792792    }

  • fast-flow-dashboard/trunk/includes/fast-tagger-pages.php

    r2708173 r2769680  
    172172                <div class="alignleft actions">
    173173                    <form id="tag-filter" method="get">
    174     <input type="hidden" name="page" value="<?php echo $_REQUEST['page'] ?>" />
     174    <input type="hidden" name="page" value="<?php echo esc_attr($_REQUEST['page']); ?>" />
    175175                    <?php  $ft_list_table->display(); ?>
    176176                </form>
    … …  
    267267                    <form id="fast-tagged-users" method="post">
    268268                        <!-- For plugins, we also need to ensure that the form posts back to our current page -->
    269                         <input type="hidden" name="page" value="<?php echo $_REQUEST['page'] ?>" />
     269                        <input type="hidden" name="page" value="<?php echo esc_attr($_REQUEST['page']); ?>" />
    270270                        <input type="hidden" name="action" value="tag_or_type_filter" />
    271271                        <?php wp_nonce_field( 'tag_or_type_filter', 'tag_or_type_filter' ); ?>

  • fast-flow-dashboard/trunk/lib/class.color_schema.screen.opt.php

    r2038496 r2769680  
    198198  {
    199199      check_ajax_referer(self::NONCE, 'nonce');
    200       $screen = isset($_POST['screen']) ? $_POST['screen'] : false;
    201       $color_schema = isset($_POST['color_schema']) ? $_POST['color_schema'] : false;
    202       $is_minimal_color_schema = isset($_POST['is_minimal_color_schema']) ? $_POST['is_minimal_color_schema'] : 0;
     200      $screen = isset($_POST['screen']) ? wp_filter_nohtml_kses($_POST['screen']) : false;
     201      $color_schema = isset($_POST['color_schema']) ? wp_filter_nohtml_kses($_POST['color_schema']) : false;
     202      $is_minimal_color_schema = isset($_POST['is_minimal_color_schema']) ? wp_filter_nohtml_kses($_POST['is_minimal_color_schema']) : 0;
    203203
    204204      if(!$screen || !($user = wp_get_current_user()))

  • fast-flow-dashboard/trunk/lib/class.fastflow-addons.php

    r2323449 r2769680  
    241241          $params = self::get_param_data();
    242242          $params['_ff_data_action'] = 'get_prod';
    243           $params['_ff_data_source'] = $_POST['value'];
     243          $params['_ff_data_source'] = esc_html($_POST['value']);
    244244          $request_param = array(
    245245            'timeout' => 90,

  • fast-flow-dashboard/trunk/lib/class.fastflow.widgets.interface.php

    r2689915 r2769680  
    482482
    483483    <?php
    484         $p = isset($_REQUEST['p'])?$_REQUEST['p']:1;
     484        $p = isset($_REQUEST['p'])?esc_attr($_REQUEST['p']):1;
    485485        $fm_is_welcome_panel_enabled = get_user_option(
    486486                sprintf('fm_is_welcome_panel_enabled_%s', sanitize_key(get_current_screen()->id)),
    … …  
    513513        </div>
    514514
    515         <form action="<?php echo admin_url('admin.php?page=fast-flow&p='.$p);?>" name="form-<?php echo $p;?>" id="form-<?php echo $p;?>" method="post">
     515        <form action="<?php echo admin_url('admin.php?page=fast-flow&p='.esc_attr($p));?>" name="form-<?php echo esc_attr($p);?>" id="form-<?php echo esc_attr($p);?>" method="post">
    516516
    517517            <?php wp_nonce_field('closedpostboxes', 'closedpostboxesnonce', true ); ?>
    … …  
    519519            <?php wp_nonce_field('meta-box-order', 'meta-box-order-nonce', true ); ?>
    520520
    521             <input type="hidden" name="action" value="action-metabox-<?php echo $p;?>">
     521            <input type="hidden" name="action" value="action-metabox-<?php echo esc_attr($p);?>">
    522522
    523523            <?php wp_nonce_field( 'action-nonce' );?>

  • fast-flow-dashboard/trunk/readme.txt

    r2708173 r2769680  
    33Tags: fastflow, fast flow, dashboard, user tags
    44Requires at least: 4
    5 Tested up to: 5.9
    6 Requires PHP: 5.2
     5Tested up to: 6
     6Requires PHP: 7.4
    77Stable tag: trunk
    88License: GPL
    … …  
    6464
    6565== Changelog ==
     66
     67= 1.2.12 =
     68
     69Fix for potential admin XSS
    6670
    6771= 1.2.11 =
Note: See TracChangeset for help on using the changeset viewer.