WordPress.org
Get WordPress

Plugin Directory

Changeset 2903073


Ignore:
Timestamp:
04/24/2023 04:06:03 AM (3 years ago)
Author:
davejesch
Message:

Fix CSRF vulnerability.

Location:
database-collation-fix
Files:
5 added
2 edited

Legend:

Unmodified
Added
Removed

  • database-collation-fix/trunk/databasecollationfix.php

    r2507607 r2903073  
    44Plugin URL: https://serverpress.com/plugins/databasecollationfix
    55Description: Convert tables using utf8mb4_unicode_520_ci or utf8_unicode_520_ci collation to standard collation on a cron interval, plus on DesktopServer Create, Copy, Move, Import and Export operations.
    6 Version: 1.2.7
     6Version: 1.2.8
    77Author: Dave Jesch
    88Author URI: http://serverpress.com
     9Network: True
    910Text Domain: dbcollationfix
    1011Domain path: /language
     12License: GNU General Public License, version 2 http://www.gnu.org/license/gpl-20.0.html
    1113*/
    1214
    … …  
    1517    private static $_instance = NULL;
    1618
     19    const VERSION = '1.2.8';
    1720    const CRON_NAME = 'ds_database_collation_fix';
    1821    const TRIGGER_FILE = 'trigger.txt';
    … …  
    326329    public function admin_page()
    327330    {
     331        $perform_action = false;
     332
     333        if (isset($_SERVER['REQUEST_METHOD']) && 'POST' === $_SERVER['REQUEST_METHOD'] && isset($_POST['collation-fix'])) {
     334            if (wp_verify_nonce($_POST['collation-nonce'], 'collation-action') && current_user_can('manage_options')) {
     335                $perform_action = true;
     336            }
     337        }
     338    //echo '<pre>', 'perform=', ($perform_action ? 'true' : 'false'), PHP_EOL, var_export($_POST, true), '</pre>';
     339
    328340        echo '<div class="wrap">';
    329         echo '<h2>', __('ServerPress Database Collation Fix tool', 'dbcollationfix'), '</h2>';
     341        echo '<h2>', sprintf(__('ServerPress Database Collation Fix%1$s tool', 'dbcollationfix'), ' v' . self::VERSION), '</h2>';
    330342        echo '<p>', __('This tool is used to convert your site\'s database tables from using the ...unicode_520_ci Collation Algorithms to use a slightly older, but more compatible utf8mb4_unicode_ci Collation Algorithm.', 'dbcollationfix'), '</p>';
    331343        echo '<p>', __('The tool will automatically run every 24 hours and change any newly created database table. Or, you can use the button below to perform the database alterations on demand.', 'dbcollationfix'), '</p>';
    332344
    333         echo '<form action="', esc_url(add_query_arg('run', '1')), '" method="post">';
     345        echo '<form action="', esc_url(add_query_arg()), '" method="post">';
    334346        echo '<p>';
     347        wp_nonce_field('collation-action', 'collation-nonce', true, true);
    335348        echo '<input type="hidden" name="force-collation" value="0" />';
    336349        echo '<input type="checkbox" name="force-collation" value="1" />';
    … …  
    348361        echo '</form>';
    349362
    350         if (isset($_POST['collation-fix']) && '1' === $_GET['run']) {
     363        if ($perform_action) {
    351364            $this->modify_collation(TRUE);      // perform collation changes, with reporting
    352365        }

  • database-collation-fix/trunk/readme.txt

    r2507607 r2903073  
    11=== Database Collation Fix ===
    2 Contributors: serverpress, spectromtech, davejesch, Steveorevo
    3 Donate link: https://serverpress.com
     2Contributors: spectromtech, davejesch
     3Donate link: https://davejesch.com
    44Tags: database, migration, collation algorithm, utf8mb4_unicode_520_ci, desktopserver, export, import, moving data, staging
    55Requires at least: 4.6
    66Requires PHP: 5.3.1
    7 Tested up to: 5.7
     7Tested up to: 6.2
    88Stable tag: trunk
    99License: GPLv2 or later
    … …  
    9090
    9191== Changelog ==
     92= 1.2.8 - Apr 24, 2023 =
     93Fix CSRF vulnerability.
     94
     95= 1.2.7 - Apr 1, 2021 =
     96Add request method check; update readme.txt contents.
     97
    9298= 1.2.6 - Aug 2, 2018 =
    9399Add handling for FULLTEXT indexes.
Note: See TracChangeset for help on using the changeset viewer.