WordPress.org
Get WordPress

Plugin Directory

Changeset 2955407


Ignore:
Timestamp:
08/18/2023 01:26:01 PM (3 years ago)
Author:
RobertPHeller
Message:

Fix security issue: ​https://patchstack.com/database/report-preview/b626e7c0-9a3e-48d5-a5ad-5cbf33d16b2e?pin=tyLtfTu1yGOgOrDo

Location:
weblibrarian/trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • weblibrarian/trunk/WebLibrarian.php

    r2754193 r2955407  
    44 * Plugin URI: http://www.deepsoft.com/WebLibrarian
    55 * Description: A plugin that implements a web-based library catalog and circulation System
    6  * Version: 3.5.8.1
     6 * Version: 3.5.8.2
    77 * Author: Robert Heller
    88 * Author URI: http://www.deepsoft.com/

  • weblibrarian/trunk/includes/WEBLIB_Collection_Admin.php

    r2381098 r2955407  
    437437  function display_one_item_form($returnURL) {
    438438    if ( isset($_REQUEST['paged']) ) {
    439       ?><input type="hidden" name="paged" value="<?php echo $_REQUEST['paged'] ?>" /><?php
     439      $paged = sanitize_text_field($_REQUEST['paged']);
     440      ?><input type="hidden" name="paged" value="<?php echo $paged; ?>" /><?php
    440441    }
    441442    if ( isset($_REQUEST['screen-options-apply']) ) {
    442       ?><input type="hidden" name="screen-options-apply" value="<?php echo $_REQUEST['screen-options-apply'] ?>" /><?php
     443      $screenopts = sanitize_text_field($_REQUEST['screen-options-apply']);
     444      ?><input type="hidden" name="screen-options-apply" value="<?php echo $screenopts; ?>" /><?php
    443445    }
    444446    if ( isset($_REQUEST['wp_screen_options']['option']) ) {
    445       ?><input type="hidden" name="wp_screen_options[option]" value="<?php echo $_REQUEST['wp_screen_options']['option'] ?>" /><?php
     447      $wpscreenoptsopt = sanitize_text_field($_REQUEST['wp_screen_options']['option']);
     448      ?><input type="hidden" name="wp_screen_options[option]" value="<?php echo $wpscreenoptsopt; ?>" /><?php
    446449    }
    447450    if ( isset($_REQUEST['wp_screen_options']['value']) ) {
    448       ?><input type="hidden" name="wp_screen_options[value]" value="<?php echo $_REQUEST['wp_screen_options']['value'] ?>" /><?php
     451      $wpscreenoptsval = sanitize_text_field($_REQUEST['wp_screen_options']['value']);
     452      ?><input type="hidden" name="wp_screen_options[value]" value="<?php echo $wpscreenoptsval; ?>" /><?php
    449453    }
    450454    if ($this->viewmode == 'view') {

  • weblibrarian/trunk/includes/WEBLIB_Patrons_Admin.php

    r1747278 r2955407  
    490490  function display_one_item_form($returnURL) {
    491491    if ( isset($_REQUEST['paged']) ) {
    492       ?><input type="hidden" name="paged" value="<?php echo $_REQUEST['paged'] ?>" /><?php
     492      $paged = sanitize_text_field($_REQUEST['paged']);
     493      ?><input type="hidden" name="paged" value="<?php echo $paged; ?>" /><?php
    493494    }
    494495    if ( isset($_REQUEST['screen-options-apply']) ) {
    495       ?><input type="hidden" name="screen-options-apply" value="<?php echo $_REQUEST['screen-options-apply'] ?>" /><?php
     496      $screenopts = sanitize_text_field($_REQUEST['screen-options-apply']);
     497      ?><input type="hidden" name="screen-options-apply" value="<?php echo $screenopts; ?>" /><?php
    496498    }
    497499    if ( isset($_REQUEST['wp_screen_options']['option']) ) {
    498       ?><input type="hidden" name="wp_screen_options[option]" value="<?php echo $_REQUEST['wp_screen_options']['option'] ?>" /><?php
     500      $wpscreenoptsopt = sanitize_text_field($_REQUEST['wp_screen_options']['option']);
     501      ?><input type="hidden" name="wp_screen_options[option]" value="<?php echo $wpscreenoptsopt; ?>" /><?php
    499502    }
    500503    if ( isset($_REQUEST['wp_screen_options']['value']) ) {
    501       ?><input type="hidden" name="wp_screen_options[value]" value="<?php echo $_REQUEST['wp_screen_options']['value'] ?>" /><?php
     504      $wpscreenoptsval = sanitize_text_field($_REQUEST['wp_screen_options']['value']);
     505      ?><input type="hidden" name="wp_screen_options[value]" value="<?php echo $wpscreenoptsval; ?>" /><?php
    502506    }
    503507    if ($this->viewmode == 'view') {
    … …  
    641645  function display_bulk_upload_form($returnURL) {
    642646    if ( isset($_REQUEST['paged']) ) {
    643       ?><input type="hidden" name="paged" value="<?php echo $_REQUEST['paged'] ?>" /><?php
     647      $paged = sanitize_text_field($_REQUEST['paged']);
     648      ?><input type="hidden" name="paged" value="<?php echo $paged; ?>" /><?php
    644649    }
    645650    if ( isset($_REQUEST['screen-options-apply']) ) {
    646       ?><input type="hidden" name="screen-options-apply" value="<?php echo $_REQUEST['screen-options-apply'] ?>" /><?php
     651      $screenopts = sanitize_text_field($_REQUEST['screen-options-apply']);
     652      ?><input type="hidden" name="screen-options-apply" value="<?php echo $screenopts; ?>" /><?php
    647653    }
    648654    if ( isset($_REQUEST['wp_screen_options']['option']) ) {
    649       ?><input type="hidden" name="wp_screen_options[option]" value="<?php echo $_REQUEST['wp_screen_options']['option'] ?>" /><?php
     655      $wpscreenoptsopt = sanitize_text_field($_REQUEST['wp_screen_options']['option']);
     656      ?><input type="hidden" name="wp_screen_options[option]" value="<?php echo $wpscreenoptsopt; ?>" /><?php
    650657    }
    651658    if ( isset($_REQUEST['wp_screen_options']['value']) ) {
    652       ?><input type="hidden" name="wp_screen_options[value]" value="<?php echo $_REQUEST['wp_screen_options']['value'] ?>" /><?php
    653     }
    654     ?><p><label for="file_name"><?php _e('CSV File:','weblibrarian'); ?></label>
     659      $wpscreenoptsval = sanitize_text_field($_REQUEST['wp_screen_options']['value']);
     660      ?><input type="hidden" name="wp_screen_options[value]" value="<?php echo $wpscreenoptsval; ?>" /><?php
     661    }
     662  ?><p><label for="file_name"><?php _e('CSV File:','weblibrarian'); ?></label>
    655663     <input type="file" id="file_name" name="file_name"
    656         value="<?php echo $_REQUEST['file_name']; ?>" /></p>
     664        value="<?php echo sanitize_file_name($_REQUEST['file_name']); ?>" /></p>
    657665      <p><label for="use_csv_header"><?php _e('Use CSV Header?','weblibrarian'); ?></label>
    658666     <input type="checkbox" name="use_csv_header" id="use_csv_header"

  • weblibrarian/trunk/includes/WEBLIB_Types_Database_Admin.php

    r1747278 r2955407  
    270270  function display_one_item_form($returnURL) {
    271271    if ( isset($_REQUEST['paged']) ) {
    272       ?><input type="hidden" name="paged" value="<?php echo $_REQUEST['paged'] ?>" /><?php
     272      $paged = sanitize_text_field($_REQUEST['paged']);
     273      ?><input type="hidden" name="paged" value="<?php echo $paged; ?>" /><?php
    273274    }
    274275    if ( isset($_REQUEST['screen-options-apply']) ) {
    275       ?><input type="hidden" name="screen-options-apply" value="<?php echo $_REQUEST['screen-options-apply'] ?>" /><?php
     276      $screenopts = sanitize_text_field($_REQUEST['screen-options-apply']);
     277      ?><input type="hidden" name="screen-options-apply" value="<?php echo $screenopts; ?>" /><?php
    276278    }
    277279    if ( isset($_REQUEST['wp_screen_options']['option']) ) {
    278       ?><input type="hidden" name="wp_screen_options[option]" value="<?php echo $_REQUEST['wp_screen_options']['option'] ?>" /><?php
     280      $wpscreenoptsopt = sanitize_text_field($_REQUEST['wp_screen_options']['option']);
     281      ?><input type="hidden" name="wp_screen_options[option]" value="<?php echo $wpscreenoptsopt; ?>" /><?php
    279282    }
    280283    if ( isset($_REQUEST['wp_screen_options']['value']) ) {
    281       ?><input type="hidden" name="wp_screen_options[value]" value="<?php echo $_REQUEST['wp_screen_options']['value'] ?>" /><?php
     284      $wpscreenoptsval = sanitize_text_field($_REQUEST['wp_screen_options']['value']);
     285      ?><input type="hidden" name="wp_screen_options[value]" value="<?php echo $wpscreenoptsval; ?>" /><?php
    282286    }
    283287    ?><table class="form-table">

  • weblibrarian/trunk/readme.txt

    r2754193 r2955407  
    55Requires at least: 3.2.1
    66Tested up to: 6.0
    7 Stable tag: 3.5.8.1
     7Stable tag: 3.5.8.2
    88License: GPL2
    99
    … …  
    157157== Changelog ==
    158158
     159= 3.5.8.2 =
     160
     161Fix security issue:
     162https://patchstack.com/database/report-preview/b626e7c0-9a3e-48d5-a5ad-5cbf33d16b2e?pin=tyLtfTu1yGOgOrDo
     163
    159164= 3.5.8.1 =
    160165
Note: See TracChangeset for help on using the changeset viewer.