WordPress.org
Get WordPress

Plugin Directory

Changeset 3276446


Ignore:
Timestamp:
04/18/2025 08:53:45 AM (12 months ago)
Author:
momen2009
Message:

Cross-site scripting vulnerability response.

Location:
theme-changer/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • theme-changer/trunk/readme.txt

    r3275878 r3276446  
    44Requires at least: 3.0
    55Tested up to: 6.8
    6 Stable tag: 1.4
     6Stable tag: 1.5
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    4242= 1.4 =
    4343* Cross-site scripting vulnerability response.
     44
     45= 1.5 =
     46* Cross-site scripting vulnerability response.

  • theme-changer/trunk/theme-changer.php

    r3275878 r3276446  
    22/*
    33Plugin Name: Theme Changer
    4 Plugin URI: http://www.elegants.biz/theme-changer.php
     4Plugin URI: https://wordpress.org/plugins/theme-changer/
    55Description: Easy theme change in the get parameter. this to be a per-session only change, and one that everyone (all visitors) can use. I just enter the following URL. It's easy. e.g. http://wordpress_install_domain/?theme_changer=theme_folder_name
    6 Version: 1.4
     6Version: 1.5
    77Author: momen2009
    88License: GPLv2 or later
    … …  
    2929function add_meta_query_vars( $public_query_vars ) {
    3030    if(is_admin()) return;
    31     $public_query_vars[] = "theme_changer";
     31    $query_list = array("theme_changer","theme_changer_password");
     32    foreach($query_list as $val){
     33        $public_query_vars[] = $val;
     34    }
    3235    return $public_query_vars;
    3336}
    … …  
    4851        $theme_changer_theme = $now_theme -> get_stylesheet();
    4952
    50         if(isset($_SESSION["theme_changer_password"]) && !isset($_GET["theme_changer_password"])){
     53        if(isset($_SESSION["theme_changer_password"]) && null == get_query_var("theme_changer_password")){
    5154            if($_SESSION["theme_changer_password"] != $theme_changer_password) return;
    5255        }else{
    53             if(!isset($_GET["theme_changer_password"])) return;
    54             if($theme_changer_password != sanitize_text_field(wp_unslash($_GET["theme_changer_password"]))){
     56            if(null == get_query_var("theme_changer_password")) return;
     57            if($theme_changer_password != sanitize_text_field(wp_unslash(get_query_var("theme_changer_password")))){
    5558                return;
    5659            }else{
    … …  
    6063    }
    6164
    62     if(isset($_GET["theme_changer"])){
    63         $theme_changer = sanitize_text_field(wp_unslash($wpdb->escape($_GET["theme_changer"])));
     65    if(null != get_query_var("theme_changer")){
     66        $theme_changer = sanitize_text_field(wp_unslash($wpdb->escape(get_query_var("theme_changer"))));
    6467    }
    6568    if(isset($theme_changer) && $theme_changer != ""){
    … …  
    97100if(!is_admin()){
    98101    add_filter("query_vars","add_meta_query_vars");
    99     add_filter("setup_theme","theme_changer");
     102    add_filter("wp","theme_changer");
    100103    add_filter('stylesheet', 'my_theme_switcher');
    101104    add_filter('template', 'my_theme_switcher');
    … …  
    149152        wp_die( esc_html(__( 'You do not have sufficient permissions to access this page.' )) );
    150153    }
    151 
    152154    if (isset($_POST['theme_changer_password'])) {
     155            if (check_admin_referer()) {
    153156        update_option('theme_changer_password', sanitize_text_field(wp_unslash($_POST['theme_changer_password'])));
     157            }
    154158    }
    155159?>
    … …  
    157161<h1>Theme Changer Options</h1>
    158162<?php
     163
    159164if(isset($_POST['theme_changer_password'])) {
     165    if (check_admin_referer()) {
    160166    echo '<div id="setting-error-settings_updated" class="updated settings-error notice is-dismissible"><p><strong>Settings saved.</strong></p></div>';
     167}
    161168}
    162169?>
    … …  
    165172    <tr>
    166173        <th scope="row"><label for="theme_changer_password">Password</label></th>
    167         <td><input name="theme_changer_password" type="text" id="theme_changer_password" value="<?php form_option('theme_changer_password'); ?>" class="regular-text" /><p class="description" id="theme-changer-password-description">You can attach a password to the Theme Changer. e.g. http://wordpress_install_domain/?theme_changer=theme_folder_name&amp;<strong>theme_changer_password=input_password<strong></p></td>
     174        <td><?php wp_nonce_field(); ?><input name="theme_changer_password" type="text" id="theme_changer_password" value="<?php form_option('theme_changer_password'); ?>" class="regular-text" /><p class="description" id="theme-changer-password-description">You can attach a password to the Theme Changer. e.g. http://wordpress_install_domain/?theme_changer=theme_folder_name&amp;<strong>theme_changer_password=input_password<strong></p></td>
    168175    </tr>
    169176</table>
Note: See TracChangeset for help on using the changeset viewer.