WordPress.org
Get WordPress

Plugin Directory

Changeset 2879914


Ignore:
Timestamp:
03/14/2023 03:33:17 PM (3 years ago)
Author:
prismtechstudios
Message:

Fix XSS vulnerability

Location:
modern-footnotes
Files:
16 added
2 edited

Legend:

Unmodified
Added
Removed

  • modern-footnotes/trunk/modern-footnotes.php

    r2867112 r2879914  
    55Text Domain: modern-footnotes
    66Description: Add inline footnotes to your post via the footnote icon on the toolbar for editing posts and pages. Or, use the [mfn] or [modern_footnote] shortcodes [mfn]like this[/mfn].
    7 Version:     1.4.15
     7Version:     1.4.16
    88Author:      Prism Tech Studios
    99Author URI:  http://prismtechstudios.com/
    … …  
    1515defined( 'ABSPATH' ) or die( 'No script kiddies please!' );
    1616
    17 $modern_footnotes_version = '1.4.15';
     17$modern_footnotes_version = '1.4.16';
    1818
    1919$modern_footnotes_options = get_option('modern_footnotes_settings');
    … …  
    588588            esc_html__($property_label, 'modern-footnotes') .
    589589            '</label>';
    590   $html = sprintf($html, $property_name, isset($modern_footnotes_options[$property_name]) ? $modern_footnotes_options[$property_name] : '');
     590  $html = sprintf($html, $property_name, isset($modern_footnotes_options[$property_name]) ? esc_attr($modern_footnotes_options[$property_name]) : '');
    591591
    592592  echo $html;
    … …  
    609609  foreach ($options as $key => $value) {
    610610    $option_html = '<option value="%s" %s>%s</option>';
    611     $html .= sprintf($option_html, $key, $selected_value == $key ? 'selected' : '', $value);
     611    $html .= sprintf($option_html, esc_attr($key), $selected_value == $key ? 'selected' : '', esc_html($value));
    612612  }
    613613  $html .= '</select>';
    … …  
    634634  foreach ($options as $key => $value) {
    635635    $option_html = '<option value="%s" %s>%s</option>';
    636     $html .= sprintf($option_html, $key, $selected_value == $key ? 'selected' : '', $value);
     636    $html .= sprintf($option_html, esc_attr($key), $selected_value == $key ? 'selected' : '', esc_html($value));
    637637  }
    638638  $html .= '</select>';
    … …  
    649649    global $modern_footnotes_options;
    650650   
    651     $html = '<textarea id="modern_footnotes_custom_css" name="modern_footnotes_settings[modern_footnotes_custom_css]" style="max-width:100%;width:400px;height:200px">' . (isset($modern_footnotes_options['modern_footnotes_custom_css']) ? $modern_footnotes_options['modern_footnotes_custom_css'] : '') . '</textarea>';
     651    $html = '<textarea id="modern_footnotes_custom_css" name="modern_footnotes_settings[modern_footnotes_custom_css]" style="max-width:100%;width:400px;height:200px">' . (isset($modern_footnotes_options['modern_footnotes_custom_css']) ? esc_textarea($modern_footnotes_options['modern_footnotes_custom_css']) : '') . '</textarea>';
    652652    $html .= '<label for="modern_footnotes_custom_css">' .
    653653            esc_html__('Enter any custom CSS for the plugin, without any <style> tags.', 'modern-footnotes') .

  • modern-footnotes/trunk/readme.txt

    r2867112 r2879914  
    44Requires at least: 4.6
    55Tested up to: 6.1.1
    6 Stable tag: 1.4.15
     6Stable tag: 1.4.16
    77License: GNU General Public License v2
    88License URI: https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html
    … …  
    8484== Changelog ==
    8585
     86= 1.4.16 =
     87* Security fix for XSS issue. Thanks to Rio Darmawan for identifying the issue.
     88
    8689= 1.4.15 =
    8790* Fix for duplicate HTML ids
Note: See TracChangeset for help on using the changeset viewer.