WordPress.org
Get WordPress

Plugin Directory

Changeset 2945835


Ignore:
Timestamp:
08/01/2023 07:20:52 AM (3 years ago)
Author:
whatshelp
Message:

fix xss and tagging version 1.8.10

Location:
whatshelp-chat-button
Files:
4 edited
1 copied

Legend:

Unmodified
Added
Removed

  • whatshelp-chat-button/tags/1.8.10/readme.txt

    r2944547 r2945835  
    55Requires at least: 2.7
    66Tested up to: 6.3
    7 Stable tag: 1.8.9.4
     7Stable tag: 1.8.10
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html

  • whatshelp-chat-button/tags/1.8.10/whatshelp.php

    r2362335 r2945835  
    33 * Plugin Name: Chat Button by GetButton.io (ex. WhatsHelp)
    44 * Description: The Chat button by GetButton takes website visitor directly to the messaging app such as Facebook Messenger or WhatsApp and allows them to initiate a conversation with you. After that, both you and your customer can follow up the conversation anytime and anywhere!
    5  * Version: 1.8.4
     5 * Version: 1.8.10
    66 * Author: GetButton
    77 * Author URI: https://getbutton.io
    … …  
    6363}
    6464
     65
     66function get_clean_code($code)
     67{
     68    function getParseError() {
     69        return 'console.warn("Getbutton: parsing code failed!"); return;';
     70    }
     71
     72    // 1. remove all comments
     73    $code_clean = preg_replace('/(?:(?:\/\*(?:[^*]|(?:\*+[^*\/]))*\*+\/)|(?:(?<!\:|\\\|\'|\")\/\/.*))/', '', $code);
     74
     75    // 2. find positions of all variables
     76    preg_match_all('/(?:var|let|const)[\s]+[a-zA-Z0-9_]+[\s]*=/', $code_clean, $allVarsPos, PREG_OFFSET_CAPTURE);
     77    $allVarsPos = $allVarsPos[0];
     78    if (!count($allVarsPos[0])) {
     79        return getParseError();
     80    }
     81
     82    // 3. find start position of "options" variable and next variable after options
     83    $varOptionPos = null;
     84    $nextVarPos = null;
     85    for ($i=0; $i<count($allVarsPos); $i++) {
     86        $pos = $allVarsPos[$i];
     87        if (strpos($pos[0], 'options') !== false) {
     88            $varOptionPos = $pos[1];
     89            if (isset($allVarsPos[$i + 1])) {
     90                $nextVarPos = $allVarsPos[$i + 1][1];
     91            }
     92            break;
     93        };
     94    }
     95    if ($varOptionPos === null) {
     96        return getParseError();
     97    }
     98
     99    // 3. find end position of "options" variable
     100    // 4.1 find all positions of "}"
     101    preg_match_all('/}/', $code_clean, $posCurls, PREG_OFFSET_CAPTURE, $varOptionPos);
     102    $posCurls = $posCurls[0];
     103    if (!count($posCurls)) {
     104        return getParseError();
     105    }
     106    // 4.2 find position of last "}" before any next variable
     107    $positionCurl = null;
     108    // if there no var after options
     109    if ($nextVarPos === null) {
     110        $positionCurl = end($posCurls)[1];
     111    } else {
     112        for ($i=0; $i<count($posCurls); $i++) {
     113            $pos = $posCurls[$i][1];
     114            if ($pos < $nextVarPos) {
     115                $positionCurl = $pos;
     116            }
     117        }
     118    }
     119    if (!$positionCurl) {
     120        return getParseError();
     121    }
     122
     123    // 5. Remove footer (after end of "options" var)
     124    $code_clean = substr($code_clean, 0, $positionCurl + 1);
     125
     126    // 6. Remove header (before "options" var)
     127    $code_clean = substr($code_clean, $varOptionPos);
     128
     129    // Clear XSS from code
     130    $result = strip_tags($code_clean);
     131    return $result;
     132}
     133
     134function get_prefix()
     135{
     136    $prefix = <<<EOTEXT
     137\n\n<!-- GetButton.io widget -->
     138<script type="text/javascript">
     139(function () {\n
     140EOTEXT;
     141    return $prefix;
     142}
     143
     144function get_suffix()
     145{
     146    $suffix = <<<EOTEXT
     147;
     148    var proto = 'https:', host = "getbutton.io", url = proto + '//static.' + host;
     149    var s = document.createElement('script'); s.type = 'text/javascript'; s.async = true; s.src = url + '/widget-send-button/js/init.js';
     150    s.onload = function () { WhWidgetSendButton.init(host, proto, options); };
     151    var x = document.getElementsByTagName('script')[0]; x.parentNode.insertBefore(s, x);
     152})();
     153</script>
     154<!-- /GetButton.io widget -->\n\n
     155EOTEXT;
     156
     157    return $suffix;
     158}
     159
    65160function add_whatshelp_code()
    66161{
    67     echo get_option('whatshelp-code');
     162    echo get_prefix();
     163    echo get_clean_code(get_option('whatshelp-code'));
     164    echo get_suffix();
    68165}
    69166

  • whatshelp-chat-button/trunk/readme.txt

    r2944547 r2945835  
    55Requires at least: 2.7
    66Tested up to: 6.3
    7 Stable tag: 1.8.9.4
     7Stable tag: 1.8.10
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html

  • whatshelp-chat-button/trunk/whatshelp.php

    r2362335 r2945835  
    33 * Plugin Name: Chat Button by GetButton.io (ex. WhatsHelp)
    44 * Description: The Chat button by GetButton takes website visitor directly to the messaging app such as Facebook Messenger or WhatsApp and allows them to initiate a conversation with you. After that, both you and your customer can follow up the conversation anytime and anywhere!
    5  * Version: 1.8.4
     5 * Version: 1.8.10
    66 * Author: GetButton
    77 * Author URI: https://getbutton.io
    … …  
    6363}
    6464
     65
     66function get_clean_code($code)
     67{
     68    function getParseError() {
     69        return 'console.warn("Getbutton: parsing code failed!"); return;';
     70    }
     71
     72    // 1. remove all comments
     73    $code_clean = preg_replace('/(?:(?:\/\*(?:[^*]|(?:\*+[^*\/]))*\*+\/)|(?:(?<!\:|\\\|\'|\")\/\/.*))/', '', $code);
     74
     75    // 2. find positions of all variables
     76    preg_match_all('/(?:var|let|const)[\s]+[a-zA-Z0-9_]+[\s]*=/', $code_clean, $allVarsPos, PREG_OFFSET_CAPTURE);
     77    $allVarsPos = $allVarsPos[0];
     78    if (!count($allVarsPos[0])) {
     79        return getParseError();
     80    }
     81
     82    // 3. find start position of "options" variable and next variable after options
     83    $varOptionPos = null;
     84    $nextVarPos = null;
     85    for ($i=0; $i<count($allVarsPos); $i++) {
     86        $pos = $allVarsPos[$i];
     87        if (strpos($pos[0], 'options') !== false) {
     88            $varOptionPos = $pos[1];
     89            if (isset($allVarsPos[$i + 1])) {
     90                $nextVarPos = $allVarsPos[$i + 1][1];
     91            }
     92            break;
     93        };
     94    }
     95    if ($varOptionPos === null) {
     96        return getParseError();
     97    }
     98
     99    // 3. find end position of "options" variable
     100    // 4.1 find all positions of "}"
     101    preg_match_all('/}/', $code_clean, $posCurls, PREG_OFFSET_CAPTURE, $varOptionPos);
     102    $posCurls = $posCurls[0];
     103    if (!count($posCurls)) {
     104        return getParseError();
     105    }
     106    // 4.2 find position of last "}" before any next variable
     107    $positionCurl = null;
     108    // if there no var after options
     109    if ($nextVarPos === null) {
     110        $positionCurl = end($posCurls)[1];
     111    } else {
     112        for ($i=0; $i<count($posCurls); $i++) {
     113            $pos = $posCurls[$i][1];
     114            if ($pos < $nextVarPos) {
     115                $positionCurl = $pos;
     116            }
     117        }
     118    }
     119    if (!$positionCurl) {
     120        return getParseError();
     121    }
     122
     123    // 5. Remove footer (after end of "options" var)
     124    $code_clean = substr($code_clean, 0, $positionCurl + 1);
     125
     126    // 6. Remove header (before "options" var)
     127    $code_clean = substr($code_clean, $varOptionPos);
     128
     129    // Clear XSS from code
     130    $result = strip_tags($code_clean);
     131    return $result;
     132}
     133
     134function get_prefix()
     135{
     136    $prefix = <<<EOTEXT
     137\n\n<!-- GetButton.io widget -->
     138<script type="text/javascript">
     139(function () {\n
     140EOTEXT;
     141    return $prefix;
     142}
     143
     144function get_suffix()
     145{
     146    $suffix = <<<EOTEXT
     147;
     148    var proto = 'https:', host = "getbutton.io", url = proto + '//static.' + host;
     149    var s = document.createElement('script'); s.type = 'text/javascript'; s.async = true; s.src = url + '/widget-send-button/js/init.js';
     150    s.onload = function () { WhWidgetSendButton.init(host, proto, options); };
     151    var x = document.getElementsByTagName('script')[0]; x.parentNode.insertBefore(s, x);
     152})();
     153</script>
     154<!-- /GetButton.io widget -->\n\n
     155EOTEXT;
     156
     157    return $suffix;
     158}
     159
    65160function add_whatshelp_code()
    66161{
    67     echo get_option('whatshelp-code');
     162    echo get_prefix();
     163    echo get_clean_code(get_option('whatshelp-code'));
     164    echo get_suffix();
    68165}
    69166
Note: See TracChangeset for help on using the changeset viewer.