Context Navigation

Changeset 3054915

Timestamp:

03/20/2024 01:51:32 AM (2 years ago)

Author:

yeisonbp

Message:

init v6.1.11

Location:

awesome-support/trunk

Files:

-                      r2314850
+                      r3054915
         var data = {
+            action: 'wpas_dismiss_free_addon_page'
+            action: 'wpas_dismiss_free_addon_page',
+            nonce: WPAS_Optin.nonce,
         };

-                      r2721401
+                      r3054915
             data : {
                 action : 'wpas_skip_wizard_setup',
+                skip_wizard : true
+                skip_wizard : true,
+                nonce: WPAS_Wizard.nonce,
             },
             success : function( response ) {

-                      r3050608
+                      r3054915
  * Plugin URI:        https://getawesomesupport.com
  * Description:       Awesome Support is a great ticketing system that will help you improve your customer satisfaction by providing a unique customer support experience.
  * Version:           6.1.10
+ * Version:           6.1.11
  * Author:            Awesome Support Team
  * Author URI:         https://getawesomesupport.com
 …
          */
         private function setup_constants() {
             define( 'WPAS_VERSION',           '6.1.10' );
+            define( 'WPAS_VERSION',           '6.1.11' );
             define( 'WPAS_DB_VERSION',        '1' );
             define( 'WPAS_URL',               trailingslashit( plugin_dir_url( __FILE__ ) ) );

-                      r3050608
+                      r3054915
  */
 function wpas_dismiss_free_addon_page() {
+    check_ajax_referer('wpas_admin_optin', 'nonce');
+    if ( ! current_user_can( 'administrator' ) ) {
+        wp_send_json([], 401);
+    }
     return add_option( 'wpas_dismiss_free_addon_page', true );
+}
 …
  */
 function wpas_skip_wizard_setup() {
     if ( current_user_can( 'administrator' ) ) {
         add_option( 'wpas_skip_wizard_setup', true );
         wp_die();
+    check_ajax_referer('wpas_admin_wizard', 'nonce');
+    if ( ! current_user_can( 'administrator' ) ) {
+        wp_send_json([], 401);
+    }
+    wp_send_json([], 401);
+    add_option( 'wpas_skip_wizard_setup', true );
+    wp_die();
+}
 …
     wp_send_json_success();
+}

-                      r3050608
+                      r3054915
     wpas_upgrade_581();
+}
+/**
+ * Upgrade function for version 6.1.11
+ *
+ * No new capabilities need to be added to certain roles.
+ *
+ * @since 6.1
+ * @return void
+ */
+function wpas_upgrade_61110() {
+    // Run the 581 upgrade option for version 6014.
+    // The 581 upgrade was the internal upgrade option during testing of the 6013 release.
+    // Therefore the two routines are the same and there is no reason to write a separate 6013 routine.
+    // But we do want early 581 adopters to get the later changes to the update routine.  So
+    // we create this 6014 routine to make sure it runs for early 520 adopters.
+    wpas_upgrade_581();
+}

-                      r3050608
+                      r3054915
 <div class="changelog">
+    <div class="row">
+        <div>
+            <div class="about-body">
+                <h1>What's New In 6.1.11</h1>
+                <h3>6.1.11 includes the vulnerabilities fix and security patches. Here is a more comprehensive list:</h3>
+                <ul style="padding-left: 3em; list-style-type: disc;">
+                    <li>We implement a CSRF protection (via a nonce) in the endpoints wpas_dismiss_free_addon_page and wpas_skip_wizard_setup.</li>
+                </ul>
+            </div>
+        </div>
+    </div>
+    <hr />
     <div class="row">

-                      r3033134
+                      r3054915
     wp_register_script( 'wpas-admin-about-script', WPAS_URL . 'assets/admin/js/admin-about.js', array( 'jquery' ), WPAS_VERSION );
     wp_register_script( 'wpas-admin-optin-script', WPAS_URL . 'assets/admin/js/admin-optin.js', array( 'jquery' ), WPAS_VERSION );
+    wp_localize_script( 'wpas-admin-optin-script', 'WPAS_Optin', array(
+        'nonce' => wp_create_nonce('wpas_admin_optin'), // Créez la nonce et transmettez-la au script
+    ));
     wp_register_script( 'wpas-admin-script', WPAS_URL . 'assets/admin/js/admin.js', array( 'jquery', 'wpas-select2' ), WPAS_VERSION );
     wp_register_script( 'wpas-admin-toolbars-script', WPAS_URL . 'assets/admin/js/admin-toolbars.js', array( 'jquery', 'wpas-select2' ), WPAS_VERSION );
 …
     wp_localize_script( 'wpas-admin-wizard-script', 'WPAS_Wizard', array(
         'ajax_url' => admin_url( 'admin-ajax.php' ),
+        'about_page' => admin_url( 'edit.php?post_type=ticket&page=wpas-about' )
+        'about_page' => admin_url( 'edit.php?post_type=ticket&page=wpas-about' ),
+        'nonce' => wp_create_nonce('wpas_admin_wizard'), // Créez la nonce et transmettez-la au script
     ));

-                      r3050608
+                      r3054915
 Requires at least: 4.0
 Tested up to: 6.4
 Stable tag: 6.1.10
+Stable tag: 6.1.11
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 …
 == Changelog ==
+= 6.1.11
+    * We implement a CSRF protection (via a nonce) in the endpoints wpas_dismiss_free_addon_page and wpas_skip_wizard_setup.
 = 6.1.10
     * We fixed the vulnerability where a subscriber role could have the ability to skip the "Awesome Support: First Time Install" banner process in the admin dashboard.

Note: See TracChangeset for help on using the changeset viewer.