WordPress.org
Get WordPress

Plugin Directory

Changeset 3218015


Ignore:
Timestamp:
01/06/2025 11:02:28 PM (15 months ago)
Author:
era404
Message:

Additional sanitizing of API calls; Tested with WordPress 6.7.1;

Location:
imagemeta/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • imagemeta/trunk/imagemeta.php

    r2423813 r3218015  
    44Plugin URI: http://wordpress.org/plugins/imagemeta/
    55Description: The fastest way to manage meta-data for your wordpress images.
    6 Version: 1.1.2
     6Version: 1.1.3
    77Author: era404
    88Author URI: http://www.era404.com
    … …  
    6969       
    7070    //handle deleting images
    71     if(isset($_GET['cleanup']) && strstr($_GET['cleanup'],"|")){ list($cwpp,$cwppm) = explode("|",(string) trim($_GET['cleanup']));
     71    if(isset($_GET['cleanup']) && strstr($_GET['cleanup'],"|")){
     72        list($cwpp,$cwppm) = explode("|",(string) trim(strip_tags($_GET['cleanup'])));
    7273    } else { $cwpp = 0; $cwppm = 0; }
    73     if(isset($_GET['remove']) && is_numeric($_GET['remove']) && $_GET['remove']>0) list($cwpp,$cwppm) = cleanup($_GET['remove']);
    74    
     74    if(isset($_GET['remove']) && is_numeric($_GET['remove']) && $_GET['remove']>0){
     75        list($cwpp,$cwppm) = cleanup(strip_tags($_GET['remove']));
     76    }
     77
    7578    //handle sorting
    7679    $sorting = array("d"=>"post_date ASC",
    … …  
    402405*   updatedb: update the meta properties for the image
    403406**************************************************************************************************/
    404 function ajax_updatedb() {
     407function ajax_updatedb(){
    405408    global $wpdb;
    406409   

  • imagemeta/trunk/readme.txt

    r2423813 r3218015  
    5353
    5454== Changelog ==
     55= 1.1.3 =
     56* Additional sanitizing of API calls. Tested on WordPress 6.7.1;
    5557
    5658= 1.1.2 =
Note: See TracChangeset for help on using the changeset viewer.