WordPress.org
Get WordPress

Plugin Directory

Changeset 2918310


Ignore:
Timestamp:
05/28/2023 10:03:15 PM (3 years ago)
Author:
zuda
Message:

best possible security in case your site admin gets hacked.

Location:
redirect-editor/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • redirect-editor/trunk/readme.txt

    r2918278 r2918310  
    33website link: https://planetzuda.com
    44security-flaw:security@planetzuda.com
    5 Tags: SEO, redirect editor,  xml sitemap, content analysis 
     5Tags: SEO, xml sitemap, content analysis 
    66Requires at least: 3.0
    77Tested up to: 6.2.2
    … …  
    1414
    1515== Description ==
    16 SEO done right is the best type of seo, redirects help seo, descriptions search see's help SEO and your customer know what they're looking for. SEO generated urls for your blog posts? We do that too! Get unique links optimized for SEO.
    17 
     16SEO done right is the best type of seo. We provide redirects, SEO descriptions, xml sitemaps, slugs  generated urls specifically for SEO optimization.
     17 
    1818Unlock SEO with our comprehensive suite of tools. We understand the importance of optimizing your online presence, and that's why we provide you with cutting-edge features designed to maximize your website's visibility and drive organic traffic. Allow us to introduce our XML sitemap, 301 redirect editor, seo description of your posts and pages, and automatically generated seo optimized links for your blog posts and pages.  This brings your SEO game to a whole new level, with your xml sitemap easy to access, redirects improving your bounce rate, so people stay on your site longer, seo optimized links help with showing up on google and explaining what you're doing, seo descriptions are of key importance for people to know what your posts and pages are about and also helps search engines.
    1919
    … …  
    5454It adds in some protection from certain SEO software that has flaws which we patched.
    5555== Screenshots ==
     56== 3.1.3 ==
     57Best possible security for the plugin in case your site admin is hacked
    5658== 3.1.2 ==
    5759fixes inability to see redirect editor due to page being all black.

  • redirect-editor/trunk/redirect-editor.php

    r2918278 r2918310  
    33/*
    44Plugin Name: Search Engine Optimization Redirect Editor
    5 Version: 3.1.2
     5Version: 3.1.3
    66Plugin URI: https://planetzuda.com
    77Description: If you need to redirect whether for search engine optimization purposes or otherwise you can use our app to  redirect to any page. We provide a direct link to your xml sitemap which you can submit to search engines manually.  We  protect you against popular SEO plugins that damage your rankings by making your sitemap invisible to Google's bots by telling them to not index it, which is a free and automatically applied feature. More search features are coming. Our redirect editor is extremely useful and highly secure, which has been tested in bug bounties by white hat hackers, including our security and seo company.
    … …  
    102102    public static function output_notices()
    103103    {
     104        if(current_user_can('manage_options'))
     105           {
    104106        $notices = self::get_notices();
    105107        if (empty($notices)) {
    … …  
    114116            }
    115117        }
     118        }
    116119        // All stored notices have been output. Update the stored array of notices to be an empty array.
    117120        self::update_notices([]);
    … …  
    120123    private static function get_notices()
    121124    {
     125        if(current_user_can('manage_options'))
     126           {
    122127        $notices = get_option(self::NOTICES_OPTION_KEY, []);
    123128        return $notices;
    124129    }
     130    }
    125131public function create_plugin_settings_page() {
    126132    // Add the menu item and page
    … …  
    224230    public function add_admin_menu()
    225231    {
     232        if(current_user_can('manage_options'))
     233           {
    226234        add_options_page('SEO Redirect Editor', 'SEO Redirect Editor', 'manage_options', 'redirect-editor', array(
    227235            $this,
    … …  
    229237        ));
    230238    }
    231 
     239    }
    232240    public function admin_page()
    233241    {
     242        if(current_user_can('manage_options'))
     243           {
    234244        $redirects = $this->get_setting('redirects_raw');
    235245       
    … …  
    251261        require_once ('form.php');
    252262    }
    253 
     263    }
    254264    public function get_setting($name, $default = '')
    255265    {
     266   
    256267        $settings = get_option('redirect_editor', array());
    257268
    … …  
    268279                return $setting;
    269280            }
    270             return htmlspecialchars($setting, ENT_QUOTES, 'UTF-8');
     281            $allowed_html = '';
     282            return wp_kses($setting,$allowed_html);
    271283        } else {
    272284            return $default;
    … …  
    304316    public function save_data()
    305317    {
     318       
    306319        // since this gets called in the admin_init action, we only want it to
    307320
    … …  
    330343
    331344            if ($this->checkNonce($this->_redirectEditorSaveActionNonceName, $this->_redirectEditorSaveActionName)) {
    332                 print 'Sorry, your nonce did not verify.';
    333                 exit();
     345                wp_die('Sorry, your nonce did not verify.');
    334346            } else {
    335347                if (isset($_POST['redirects'])) {
    336348                    // updated this to manage_options instead of the legacy code check_admin_referer for a more modern current_user_can.
    337                     $redirects_rawed = $_POST['redirects'];
     349                    $allowed_html = wp_kses_allowed_html();
     350                    $redirects_rawed = wp_kses($_POST['redirects'], $allowed_html);
    338351                    // $allowed_html - https://codex.wordpress.org/Function_Reference/wp_kses_allowed_html
    339                     $allowed_html = wp_kses_allowed_html();
     352                   
    340353                    // $allowed_protocols
    341354                    $allowed_protocols = wp_allowed_protocols();
Note: See TracChangeset for help on using the changeset viewer.