WordPress.org
Get WordPress

Plugin Directory

Changeset 3090062


Ignore:
Timestamp:
05/21/2024 09:39:42 AM (23 months ago)
Author:
creativehassan
Message:

Security fix applied

Location:
snap-pixel
Files:
28 added
3 edited

Legend:

Unmodified
Added
Removed

  • snap-pixel/trunk/admin/snapchat_pixel_backend.php

    r2954228 r3090062  
    2727                <div class="form-row">
    2828                    <strong><?php echo __('User Email', $this->plugin_name); ?></strong>
    29                     <input type="text" name="snapchat_pixel_code[user_email]" class="regular-text"
     29                    <input type="email" name="snapchat_pixel_code[user_email]" class="regular-text"
    3030                           value="<?php echo(isset($snapchat_pixel_code['user_email']) ? $snapchat_pixel_code['user_email'] : ''); ?>" placeholder="<?php echo __('User Email', $this->plugin_name); ?>"/>
    3131                    <span class="smallfont"><?php __("This user email will be sent with pixels firing", $this->plugin_name); ?></span>

  • snap-pixel/trunk/readme.txt

    r2954229 r3090062  
    66Tags: snapchat, snap pixel, snapchat pixel
    77Requires at least: 5.0
    8 Tested up to: 6.3
     8Tested up to: 6.0
    99Requires PHP: 5.6
    10 Stable tag: 1.5.7
     10Stable tag: 1.5.8
    1111License: GPLv2 or later
    1212License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    9494= 1.5.7 =
    9595* Updated the backend UI and fixed some backend fixed
     96= 1.5.8 =
     97* Security fix applied

  • snap-pixel/trunk/snapchat-pixel.php

    r2954228 r3090062  
    44 * Plugin URI:  https://wordpress.org/plugins/snap-pixel
    55 * Description: Snapchat (Snap Pixel) to measure the cross-device impact of campaigns. It is best suited for your direct response goals, such as driving leads, Subscriptions, or product sales.
    6  * Version:     1.5.7
     6 * Version:     1.5.8
    77 * Author:      Hassan Ali
    88 * Author URI:  https://creativehassan.com
    … …  
    198198
    199199                    $sanitized_data = array(
    200                         'pixel_id' => sanitize_text_field($raw_data['pixel_id']),
     200                        'pixel_id' => $this->sanitize_pixel_id($raw_data['pixel_id']),
    201201                        'user_email' => sanitize_email($raw_data['user_email']),
    202202                        'homepage' => isset($raw_data['homepage']) && $raw_data['homepage'] === 'checked' ? 'checked' : '',
    … …  
    213213                    );
    214214
     215                    // Additional sanitization for 'pixel_id' to prevent XSS
     216                    $sanitized_data['pixel_id'] = esc_attr($sanitized_data['pixel_id']);
     217
    215218                    update_option('snapchat_pixel_code', $sanitized_data);
    216219                }
    … …  
    222225            echo $content;
    223226        }
     227
     228        public function sanitize_pixel_id($input) {
     229            // Strip out all HTML tags
     230            $input = strip_tags($input);
     231            // Remove quotes and other special characters
     232            $input = sanitize_text_field( $input );
     233
     234            $input = preg_replace('/[^a-zA-Z0-9_-]/', '', $input);
     235
     236            return $input;
     237        }
    224238
    225239        /**
Note: See TracChangeset for help on using the changeset viewer.