WordPress.org
Get WordPress

Plugin Directory

Changeset 3231327


Ignore:
Timestamp:
01/29/2025 01:20:40 PM (14 months ago)
Author:
visualmodo
Message:

1.6.1 - Jan 29 2025

  • Fixed - RCE Vulnerability (CVE-2024-11600).
  • Security - Additional sanitization on font pack names and charmap.php generation.
Location:
borderless
Files:
210 added
3 edited

Legend:

Unmodified
Added
Removed

  • borderless/trunk/borderless.php

    r3230461 r3231327  
    55Plugin URI: https://visualmodo.com/borderless/
    66Description: One service packed with powerful tools to help you reach your purposes.
    7 Version: 1.6.0
     7Version: 1.6.1
    88Author: Visualmodo
    99Author URI: https://visualmodo.com
    … …  
    2121/*-----------------------------------------------------------------------------------*/
    2222
    23 define( 'BORDERLESS__VERSION', '1.6.0' );
     23define( 'BORDERLESS__VERSION', '1.6.1' );
    2424define( 'BORDERLESS__DIR', plugin_dir_path( __FILE__ ) );
    2525define( 'BORDERLESS__URL', plugins_url( '/', __FILE__ ) );

  • borderless/trunk/includes/icon-manager/icon-manager.php

    r3230461 r3231327  
    380380                $glyphs    = $xml->defs->font->children();
    381381
    382                 // Sanitize the font name (ip_name)
     382                // Sanitize the font name (ip_name) - changed to sanitize_file_name() for security
    383383                $this->ip_name = (string) $font_attr['id'];
    384                 $this->ip_name = sanitize_text_field( $this->ip_name );
     384                $this->ip_name = sanitize_file_name( $this->ip_name );
     385
     386                if ( empty( $this->ip_name ) ) {
     387                    $this->ip_name = 'unknown';
     388                }
    385389
    386390                $font_folder = trailingslashit( $this->paths['fontdir'] ) . $this->ip_name;
    … …  
    406410                    // Create a "class" by removing spaces and sanitizing further
    407411                    $icon_class = str_replace( ' ', '', $icon_name );
    408                     // Remove any other characters that are not typical in a CSS class
    409412                    $icon_class = preg_replace( '/[^A-Za-z0-9\-_]/', '', $icon_class );
    410413                   
    411414                    $raw_tags   = isset( $icon->icon->tags ) ? $icon->icon->tags : array();
    412                     // Sanitize each tag
    413415                    $safe_tags  = array_map( 'sanitize_text_field', $raw_tags );
    414416                    $tags       = implode( ",", $safe_tags );
    … …  
    443445                // Safely build the PHP array with sanitized content
    444446                foreach ( $this->json_config[ $this->ip_name ] as $icon => $info ) {
    445                     if ( ! empty( $info ) ) {
    446                         $delimiter   = "'";
    447                         $safe_icon   = esc_attr( $icon );
    448                         $safe_class  = esc_attr( $info["class"] );
    449                         $safe_tags   = esc_attr( $info["tags"] );
    450 
    451                         fwrite( $handle, "\r\n" . '$icons[\'' . $this->ip_name . '\'][' . $delimiter . $safe_icon . $delimiter . '] = array("class"=>' . $delimiter . $safe_class . $delimiter . ',"tags"=>' . $delimiter . $safe_tags . $delimiter . ');' );
    452                     } else {
    453                         $this->delete_folder( $this->paths['tempdir'] );
    454                         die( esc_html__( 'Error generating the configuration file.', 'borderless' ) );
    455                     }
     447                    // Escapes to prevent any code injection in the generated PHP
     448                    $safe_icon  = addslashes( $icon );
     449                    $safe_class = addslashes( $info["class"] );
     450                    $safe_tags  = addslashes( $info["tags"] );
     451                    $escaped_ip_name = addslashes( $this->ip_name );
     452
     453                    fwrite(
     454                        $handle,
     455                        "\r\n" .
     456                        '$icons[\'' . $escaped_ip_name . '\'][\'' . $safe_icon . '\'] = array("class"=>\'' . $safe_class . '\',"tags"=>\'' . $safe_tags . '\');'
     457                    );
    456458                }
    457459                fclose( $handle );

  • borderless/trunk/readme.txt

    r3230461 r3231327  
    55Tested up to: 6.7.1
    66Requires PHP: 7.4
    7 Stable tag: 1.6.0
     7Stable tag: 1.6.1
    88License: GPLv3
    99License URI: https://www.gnu.org/licenses/gpl-3.0.html
    … …  
    8282== Changelog ==
    8383
     84= 1.6.1 - Jan 29 2025 =
     85* Fixed - RCE Vulnerability (CVE-2024-11600).
     86* Security - Additional sanitization on font pack names and `charmap.php` generation.
     87
    8488= 1.6.0 - Jan 28 2025 =
    8589* Fixed - General Vulnerabilities.
Note: See TracChangeset for help on using the changeset viewer.