WordPress.org
Get WordPress

Plugin Directory

Changeset 3263526


Ignore:
Timestamp:
03/28/2025 01:23:06 PM (12 months ago)
Author:
wcproducttable
Message:

v3.9.6 update

Location:
wc-product-table-lite/trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • wc-product-table-lite/trunk/main.php

    r3231930 r3263526  
    77 * Author: WC Product Table
    88 * Author URI: https://profiles.wordpress.org/wcproducttable/
    9  * Version: 3.9.5
     9 * Version: 3.9.6
    1010 *
    1111 * WC requires at least: 3.4.4
    12  * WC tested up to: 9.6.0
     12 * WC tested up to: 9.7.1
    1313 *
    1414 * Text Domain: wc-product-table-pro
    … …  
    2323// define('WCPT_DEV', TRUE);
    2424
    25 define('WCPT_VERSION', '3.9.5');
     25define('WCPT_VERSION', '3.9.6');
    2626define('WCPT_PLUGIN_PATH', plugin_dir_path(__FILE__));
    2727define('WCPT_PLUGIN_URL', plugin_dir_url(__FILE__));
    … …  
    54365436}
    54375437
    5438 // refresh custom field list
     5438// refresh custom field list 
    54395439add_action('admin_init', 'wcpt_refresh_custom_fields');
    54405440function wcpt_refresh_custom_fields()
    … …  
    54425442  if (
    54435443    is_admin() &&
    5444     !empty($_GET['wcpt_refresh_custom_fields'])
     5444    !empty($_GET['wcpt_refresh_custom_fields']) &&
     5445    current_user_can('manage_options') // Only allow administrators
    54455446  ) {
    54465447    delete_transient('wcpt_custom_fields');

  • wc-product-table-lite/trunk/presets/presets.php

    r3204509 r3263526  
    101101function wcpt_presets__set_preset_required_meta_flag()
    102102{
     103  // Check if we're on the table editor page
    103104  if (!wcpt_preset__is_table_editor_page()) {
    104105    return;
    105106  }
    106107
    107   // if table is new (no data) then set preset requrired meta flag
    108   $post_id = $_GET['post_id'];
     108  // Check if user has proper capabilities
     109  if (!current_user_can('create_wc_product_tables')) {
     110    return;
     111  }
     112
     113  // Validate and sanitize post_id
     114  if (empty($_GET['post_id']) || !is_numeric($_GET['post_id'])) {
     115    return;
     116  }
     117
     118  $post_id = intval($_GET['post_id']);
     119
     120  // Verify post exists and is the correct type
     121  $post = get_post($post_id);
     122  if (!$post || $post->post_type !== 'wc_product_table') {
     123    return;
     124  }
     125
     126  // If table is new (no data) then set preset required meta flag
    109127  $table_data = get_post_meta($post_id, 'wcpt_data', true);
    110 
    111128  if (!$table_data) {
    112129    update_post_meta($post_id, 'wcpt_preset_required', true);
    113130  }
    114131}
    115 
    116132
    117133// duplicate a preset to table
    … …  
    119135function wcpt_presets__duplicate_preset_to_table()
    120136{
     137  // Check if we're on the table editor page
    121138  if (!wcpt_preset__is_table_editor_page()) {
    122139    return;
    123140  }
    124141
     142  // Check for proper authorization
    125143  if (!current_user_can('create_wc_product_tables')) {
    126     exit('Unauthorized action.');
    127   }
    128 
    129   // no preset selected yet
     144    wp_die('Unauthorized action.');
     145  }
     146
     147  // No preset selected yet
    130148  if (empty($_GET['wcpt_preset'])) {
    131149    return;
    132150  }
    133151
     152  // Validate and sanitize post_id
     153  if (empty($_GET['post_id']) || !is_numeric($_GET['post_id'])) {
     154    return;
     155  }
     156
    134157  $post_id = intval($_GET['post_id']);
     158
     159  // Verify post exists and is the correct type
     160  $post = get_post($post_id);
     161  if (!$post || $post->post_type !== 'wc_product_table') {
     162    return;
     163  }
     164
     165  // Sanitize preset slug and validate against an allowlist (better approach)
    135166  $slug = sanitize_file_name($_GET['wcpt_preset']);
    136167
    137   // preset already applied on this table
     168  // You might want to create an allowlist of valid presets
     169  $allowed_presets = array('blank', 'regular-table', 'list-layout'); // Add all valid presets
     170  if (!in_array($slug, $allowed_presets)) {
     171    wp_die('Invalid preset selected.');
     172  }
     173
     174  // Preset already applied on this table
    138175  if (!wcpt_preset__required($post_id)) {
    139176    return;
    140177  }
    141178
    142   // apply the preset
    143   update_post_meta($post_id, 'wcpt_preset_required', false); // turn off 'preset required' flag
    144 
    145   wp_update_post(
    146     array(
    147       'ID' => $post_id,
    148       'post_title' => $slug == 'blank' ? 'New table' : ucwords(str_replace('-', ' ', $slug)),
    149       'post_status' => 'publish',
    150     )
    151   );
     179  // Apply the preset
     180  update_post_meta($post_id, 'wcpt_preset_required', false); // Turn off 'preset required' flag
     181
     182  wp_update_post(array(
     183    'ID' => $post_id,
     184    'post_title' => $slug == 'blank' ? 'New table' : ucwords(str_replace('-', ' ', $slug)),
     185    'post_status' => 'publish',
     186  ));
    152187
    153188  if ($slug !== 'blank') {
    154     // get data from json preset file
     189    // Get data from json preset file
    155190    $preset_path = WCPT_PLUGIN_PATH . 'presets/table/' . $slug . '.json';
    156     if (realpath($preset_path) && strpos(realpath($preset_path), realpath(WCPT_PLUGIN_PATH . 'presets/table/')) === 0) {
    157       $preset_json = file_get_contents($preset_path);
    158 
     191
     192    // More robust path validation to prevent directory traversal
     193    $real_preset_path = realpath($preset_path);
     194    $real_presets_dir = realpath(WCPT_PLUGIN_PATH . 'presets/table/');
     195
     196    if ($real_preset_path && strpos($real_preset_path, $real_presets_dir) === 0 && file_exists($real_preset_path)) {
     197      $preset_json = file_get_contents($real_preset_path);
    159198      $table_data = json_decode($preset_json, true);
    160       wcpt_new_ids($table_data);
    161       $table_data['id'] = $post_id;
    162       update_post_meta($post_id, 'wcpt_data', addslashes(json_encode($table_data)));
    163 
    164       update_post_meta($post_id, 'wcpt_preset_applied__message_required', true);
    165       update_post_meta($post_id, 'wcpt_preset_applied__slug', $slug);
     199
     200      if ($table_data) {
     201        wcpt_new_ids($table_data);
     202        $table_data['id'] = $post_id;
     203        update_post_meta($post_id, 'wcpt_data', addslashes(json_encode($table_data)));
     204        update_post_meta($post_id, 'wcpt_preset_applied__message_required', true);
     205        update_post_meta($post_id, 'wcpt_preset_applied__slug', $slug);
     206      }
    166207    }
    167208  }

  • wc-product-table-lite/trunk/query_editor_v2/query_editor_v2.php

    r3204509 r3263526  
    2828function wcpt_qv2_reset()
    2929{
     30  // Check if all required parameters are present
    3031  if (
    31     isset($_GET['post_type']) && $_GET['post_type'] === 'wc_product_table' &&
    32     isset($_GET['page']) && $_GET['page'] === 'wcpt-edit' &&
    33     isset($_GET['post_id'])
    34     && isset($_GET['qv2']) && $_GET['qv2'] === "false"
     32    isset($_GET['post_type']) &&
     33    $_GET['post_type'] === 'wc_product_table' &&
     34    isset($_GET['page']) &&
     35    $_GET['page'] === 'wcpt-edit' &&
     36    isset($_GET['post_id']) &&
     37    isset($_GET['qv2']) &&
     38    $_GET['qv2'] === "false"
    3539  ) {
    36     // provide new ids to avoid conflicts
    37     if ($table_data = get_post_meta($_GET['post_id'], 'wcpt_data', true)) {
     40    // Check user capability
     41    if (!current_user_can('create_wc_product_tables')) {
     42      wp_die('Unauthorized action.');
     43    }
     44
     45    // Sanitize and validate post_id
     46    $post_id = intval($_GET['post_id']);
     47
     48    // Verify post exists and is the correct type
     49    $post = get_post($post_id);
     50    if (!$post || $post->post_type !== 'wc_product_table') {
     51      return;
     52    }
     53
     54    // Provide new ids to avoid conflicts
     55    $table_data = get_post_meta($post_id, 'wcpt_data', true);
     56    if ($table_data) {
    3857      $table_data = json_decode($table_data, true);
    39       $table_data['query_v2'] = false;
    40       update_post_meta($_GET['post_id'], 'wcpt_data', addslashes(json_encode($table_data)));
     58      if (is_array($table_data)) {
     59        $table_data['query_v2'] = false;
     60        update_post_meta($post_id, 'wcpt_data', addslashes(json_encode($table_data)));
     61      }
    4162    }
    4263  }
    … …  
    640661    'wcpt_qv2/v1',
    641662    '/terms/(?P<taxonomy_slug>[a-zA-Z0-9_-]+)',
    642     array (
     663    array(
    643664      'methods' => WP_REST_Server::READABLE,
    644665      'callback' => 'wcpt_qv2_ajax_return_taxonomy_terms_with_children',
    645       'args' => array (
    646         'taxonomy_slug' => array (
     666      'args' => array(
     667        'taxonomy_slug' => array(
    647668          'validate_callback' => function ($param, $request, $key) {
    648             return !empty ($param);
     669            return !empty($param);
    649670          }
    650671        ),
    … …  
    652673      'permission_callback' => function (WP_REST_Request $request) {
    653674
    654         if (isset ($_SERVER['HTTP_X_WP_NONCE']) && wp_verify_nonce($_SERVER['HTTP_X_WP_NONCE'], 'wp_rest')) {
     675        if (isset($_SERVER['HTTP_X_WP_NONCE']) && wp_verify_nonce($_SERVER['HTTP_X_WP_NONCE'], 'wp_rest')) {
    655676          return true;
    656677        }
    657678
    658         return new WP_Error('forbidden', 'You do not have permission to access this resource.', array ('status' => 403));
     679        return new WP_Error('forbidden', 'You do not have permission to access this resource.', array('status' => 403));
    659680
    660681      }

  • wc-product-table-lite/trunk/readme.txt

    r3231930 r3263526  
    178178
    179179== Changelog ==
     180
     181= 3.9.6 (28th March '25) =
     182
     183Fixed
     184* Patched security vulnerabilities
     185* WooCommerce 9.7 compatibility tag
    180186
    181187= 3.9.5 (30th January '25) =
Note: See TracChangeset for help on using the changeset viewer.