WordPress.org
Get WordPress

Plugin Directory

Changeset 3260081


Ignore:
Timestamp:
03/22/2025 03:13:50 PM (12 months ago)
Author:
webvitaly
Message:

Ver.1.9

  • Sanitized [sitekit_menu] shortcode params.
Location:
sitekit
Files:
23 added
3 edited

Legend:

Unmodified
Added
Removed

  • sitekit/trunk/inc/sitekit-shortcode-menu.php

    r3163729 r3260081  
    2626    $atts = shortcode_atts( $defaults, $atts, 'sitekit_menu' );
    2727   
    28     return wp_nav_menu( $atts ) . SITEKIT_PLUGIN_POWERED;
     28    // Sanitize attributes to prevent XSS attacks
     29    $safe_atts = array();
     30   
     31    // Sanitize text fields
     32    $text_fields = array('menu', 'fallback_cb', 'walker');
     33    foreach ($text_fields as $field) {
     34        $safe_atts[$field] = isset($atts[$field]) ? sanitize_text_field($atts[$field]) : '';
     35    }
     36   
     37    // Sanitize HTML attributes that will appear as tag attributes
     38    $html_attr_fields = array('container', 'container_class', 'container_id', 'menu_class', 'menu_id', 'before', 'after', 'link_before', 'link_after', 'items_wrap');
     39    foreach ($html_attr_fields as $field) {
     40        if (isset($atts[$field])) {
     41            if ($field === 'container') {
     42                // Container should only accept specific valid values
     43                $safe_atts[$field] = in_array($atts[$field], array('div', 'nav', '', false)) ? $atts[$field] : 'div';
     44            } elseif ($field === 'items_wrap') {
     45                // Items wrap is a special case with a specific format
     46                $safe_atts[$field] = sanitize_text_field($atts[$field]);
     47            } else {
     48                $safe_atts[$field] = sanitize_html_class($atts[$field]);
     49            }
     50        } else {
     51            $safe_atts[$field] = '';
     52        }
     53    }
     54   
     55    // Handle numeric values
     56    $safe_atts['depth'] = isset($atts['depth']) ? intval($atts['depth']) : 0;
     57    $safe_atts['echo'] = isset($atts['echo']) ? (bool)$atts['echo'] : false;
     58   
     59    return wp_nav_menu( $safe_atts ) . SITEKIT_PLUGIN_POWERED;
    2960}
    3061add_shortcode( 'sitekit_menu', 'sitekit_shortcode_menu' );

  • sitekit/trunk/readme.txt

    r3163757 r3260081  
    44Tags: widget, widgets, search, archive, archives, category, categories, pages, shortcode, shortcodes, bloginfo, iframe
    55Requires at least: 4.0
    6 Tested up to: 6.6.2
    7 Stable tag: 1.8
     6Tested up to: 6.7.2
     7Stable tag: 1.9
    88License: GPLv3
    99License URI: http://www.gnu.org/licenses/gpl.html
    … …  
    1313== Description ==
    1414
    15 * **[Advanced iFrame Pro](https://1.envato.market/KdRNz "Advanced iFrame Pro")**
    1615* **[Sitekit](http://web-profile.net/wordpress/plugins/sitekit/ "Plugin page")**
    1716* **[Donate](http://web-profile.net/donate/ "Support the development")**
    … …  
    128127== Changelog ==
    129128
     129= 1.9 =
     130* Sanitized [sitekit_menu] shortcode params.
     131
    130132= 1.8 =
    131133* Added [sitekit_menu] shortcode.

  • sitekit/trunk/sitekit.php

    r3163729 r3260081  
    44Plugin URI: https://wordpress.org/plugins/sitekit/
    55Description: Widgets: search, archives, categories, pages, posts. Shortcodes: archives, bloginfo, categories, posts, custom menu.
    6 Version: 1.8
     6Version: 1.9
    77Author: webvitaly
    88Text Domain: sitekit
    … …  
    1515}
    1616
    17 define('SITEKIT_PLUGIN_VERSION', '1.8');
     17define('SITEKIT_PLUGIN_VERSION', '1.9');
    1818define('SITEKIT_PLUGIN_POWERED', "\n".'<!-- Powered by Sitekit v.'.SITEKIT_PLUGIN_VERSION.' https://wordpress.org/plugins/sitekit/ -->'."\n");
    1919
Note: See TracChangeset for help on using the changeset viewer.