WordPress.org
Get WordPress

Plugin Directory

Changeset 3082676


Ignore:
Timestamp:
05/07/2024 03:12:17 PM (2 years ago)
Author:
bmarshall511
Message:

tagging 5.5.7

Location:
zero-spam/trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • zero-spam/trunk/core/class-user.php

    r3049258 r3082676  
    2222     */
    2323    public static function get_ip() {
     24        $trusted_proxies = apply_filters( 'zerospam_trusted_proxies', array() );
     25
    2426        $ip_sources = [
     27            'REMOTE_ADDR',
    2528            'HTTP_CF_CONNECTING_IP',
    2629            'HTTP_CLIENT_IP',
    … …  
    3033            'HTTP_FORWARDED_FOR',
    3134            'HTTP_FORWARDED',
    32             'REMOTE_ADDR',
    3335        ];
    3436
    … …  
    3739                $ip = sanitize_text_field( wp_unslash( $_SERVER[ $source ] ) );
    3840
    39                 // Handle multiple IP addresses in X-Forwarded-For by taking the first valid IP.
    40                 if ( $source === 'HTTP_X_FORWARDED_FOR' && strpos( $ip, ',' ) !== false ) {
     41                // Handle multiple IP addresses in headers by taking the first valid IP.
     42                if ( strpos( $ip, ',' ) !== false ) {
    4143                    $ip_list = explode( ',', $ip );
    4244                    foreach ( $ip_list as $potential_ip ) {
    4345                        $potential_ip = trim( $potential_ip );
    4446                        if ( rest_is_ip_address( $potential_ip ) ) {
    45                             return apply_filters( 'zerospam_get_ip', $potential_ip );
     47                            // Validate IP only if it's from a trusted proxy or it's directly from REMOTE_ADDR.
     48                            if ( in_array( $_SERVER['REMOTE_ADDR'], $trusted_proxies ) || $source === 'REMOTE_ADDR' ) {
     49                                return apply_filters( 'zerospam_get_ip', $potential_ip );
     50                            }
    4651                        }
    4752                    }
    … …  
    4954                    // Validate single IP address.
    5055                    if ( rest_is_ip_address( $ip ) ) {
    51                         return apply_filters( 'zerospam_get_ip', $ip );
     56                        // Directly return the IP if it's from REMOTE_ADDR or a trusted proxy.
     57                        if ( in_array( $_SERVER['REMOTE_ADDR'], $trusted_proxies ) || $source === 'REMOTE_ADDR' ) {
     58                            return apply_filters( 'zerospam_get_ip', $ip );
     59                        }
    5260                    }
    5361                }

  • zero-spam/trunk/readme.txt

    r3079553 r3082676  
    66Tested up to: 6.5.2
    77Requires PHP: 7.4
    8 Stable tag: 5.5.6
     8Stable tag: 5.5.7
    99License: GNU GPLv3
    1010License URI: https://choosealicense.com/licenses/gpl-3.0/
    … …  
    107107
    108108== Changelog ==
     109
     110= v5.5.7 =
     111
     112* fix(bypass vulnerability): see https://patchstack.com/database/database/vulnerability/zero-spam/wordpress-zero-spam-for-wordpress-plugin-5-5-5-bypass-spam-protection-vulnerability
    109113
    110114= v5.5.6 =

  • zero-spam/trunk/wordpress-zero-spam.php

    r3079549 r3082676  
    1414 * Plugin URI:        https://www.highfivery.com/projects/zero-spam/
    1515 * Description:       Tired of all the ineffective WordPress anti-spam & security plugins? Zero Spam for WordPress makes blocking spam &amp; malicious activity a cinch. <strong>Just activate, configure, and say goodbye to spam.</strong>
    16  * Version:           5.5.6
     16 * Version:           5.5.7
    1717 * Requires at least: 5.2
    1818 * Requires PHP:      7.3
    … …  
    3232define( 'ZEROSPAM_PATH', plugin_dir_path( ZEROSPAM ) );
    3333define( 'ZEROSPAM_PLUGIN_BASE', plugin_basename( ZEROSPAM ) );
    34 define( 'ZEROSPAM_VERSION', '5.5.6' );
     34define( 'ZEROSPAM_VERSION', '5.5.7' );
    3535
    3636if ( defined( 'ZEROSPAM_DEVELOPMENT_URL' ) ) {
Note: See TracChangeset for help on using the changeset viewer.