WordPress.org
Get WordPress

Plugin Directory

Changeset 3151684


Ignore:
Timestamp:
09/14/2024 07:21:05 AM (19 months ago)
Author:
jamesdlow
Message:

1.5.2

  • Additional security fixes and improvements to editor
Location:
css-js-files
Files:
7 added
2 edited

Legend:

Unmodified
Added
Removed

  • css-js-files/trunk/css-js-files.php

    r3150555 r3151684  
    44Plugin URI: https://wordpress.org/plugins/css-js-files/
    55Description: Add CSS files and/or CSS custom rules to any single page or post or globally
    6 Version: 1.5.1
     6Version: 1.5.2
    77Author: James Low
    88Author URI: http://jameslow.com
    … …  
    8787                update_option('css_js_files_body_rules', $bodyrules, true);
    8888                update_option('css_js_files_footer_rules', $footerrules, true);
    89                 update_option('css_js_files_path', $path, true);
     89                if (strpos($path, '../') === false) {
     90                    update_option('css_js_files_path', $path, true);
     91                }
    9092            }
    9193        }
    … …  
    121123    public static function editor_page() {
    122124        $file = isset($_GET['file']) ? sanitize_text_field($_GET['file']) : '';
    123         $hasfile = $file != '' && str_starts_with($file, get_option('css_js_files_path')) && strpos($file, '..') === false;
     125        $lower = strtolower($file);
     126        $hasfile = $file != '' && str_starts_with($file, get_option('css_js_files_path')) && strpos($file, '../') === false
     127            && (strpos($lower, '.css') !== false || strpos($lower, '.js') !== false);
    124128        $path = $hasfile ? WP_CONTENT_DIR.'/'.$file : '';
    125129        if (!current_user_can( 'manage_options' ))  {
    … …  
    128132        echo '<div class="wrap">';
    129133        echo '<h2>CSS/JS Editor</h2>';
    130        
     134
    131135        //Save File
    132136        if (self::has_nounce()) {
    … …  
    138142        }
    139143       
     144        if ($file != '' && !$hasfile || !file_exists($path)) {
     145            echo '<div class="notice notice-error">
     146                <p>Invalid file path.</p>
     147            </div>';
     148            $content = '';
     149        } else {
     150            $content = $hasfile ? self::read_file($path) : '';
     151        }
     152
    140153        //Form
    141154        echo '<form action="" method="post">';
    … …  
    143156        echo '<div align="right"><button type="submit" class="button button-primary button-large'.($hasfile?'':' button-disabled').'"'.($hasfile?'':' disabled').'>Save</button></div>';
    144157        echo self::get_file(array($file), 'all');
    145         $content = $hasfile ? self::read_file($path) : '';
    146158        echo '<br /><textarea class="css-js-files-text css-js-files-text-full" id="css-js-files-content" name="css_js_files_content">'.htmlentities($content).'</textarea>';
    147159        echo '</form>';
    … …  
    151163    public static function read_file($name) {
    152164        $file = fopen($name, 'r');
     165        if (!$file) {
     166            return null;
     167        }
    153168        $data = fread($file,filesize($name));
    154169        fclose($file);

  • css-js-files/trunk/readme.txt

    r3150555 r3151684  
    55Requires at least: 3.0
    66Tested up to: 6.5.5
    7 Stable tag: 1.5.1
     7Stable tag: 1.5.2
    88License: MIT Licens
    99License URI: https://opensource.org/licenses/MIT
    … …  
    2929
    3030== Changelog ==
     31
     32= 1.5.2 =
     33* Additional security fixes and improvements to editor
    3134
    3235= 1.5.1 =
Note: See TracChangeset for help on using the changeset viewer.