WordPress.org
Get WordPress

Plugin Directory

Changeset 3287344


Ignore:
Timestamp:
05/05/2025 03:37:41 AM (11 months ago)
Author:
codemenschen
Message:

Update Version 4.5.3

Location:
gift-voucher
Files:
971 added
5 edited

Legend:

Unmodified
Added
Removed

  • gift-voucher/trunk/gift-voucher.php

    r3262503 r3287344  
    77 * Author: Codemenschen GmbH
    88 * Author URI: https://www.codemenschen.at/
    9  * Version: 4.5.2
    10  * Text Domain: gift-voucher
     9 * Version: 4.5.3 * Text Domain: gift-voucher
    1110 * Domain Path: /languages
    1211 * License: GNU General Public License v2.0 or later
    … …  
    2322if (!defined('ABSPATH')) exit;  // Exit if accessed directly
    2423
    25 define('WPGIFT_VERSION', '4.5.2');
     24define('WPGIFT_VERSION', '4.5.3');
    2625define('WPGIFT__MINIMUM_WP_VERSION', '4.0');
    2726define('WPGIFT__PLUGIN_DIR', untrailingslashit(plugin_dir_path(__FILE__)));

  • gift-voucher/trunk/include/voucher_list.php

    r3258149 r3287344  
    4242
    4343                <form action="<?php echo esc_url(admin_url('admin.php')); ?>">
    44                     <!-- <input type="hidden" name="post_type" value="wpgv_voucher_product"> -->
    4544                    <input type="hidden" name="page" value="<?php echo esc_html("vouchers-lists"); ?>">
    4645                    <?php if ($items): ?><input type="hidden" name="items" value="<?php echo esc_html("1"); ?>"><?php endif; ?>
    4746                    <input type="hidden" name="search" value="<?php echo esc_html("1"); ?>">
    4847                    <input type="text" name="voucher_code" autocomplete="off" placeholder="<?php echo esc_attr__('Search by Gift voucher code or email', 'gift-voucher'); ?>" value="<?php echo esc_html($voucher_code); ?>" style="width: 400px;">
    49                     <input type="submit" class="button button-primary" value="<?php echo esc_html("Search"); ?>">
     48                    <input type="submit" class="button button-primary" value="<?php echo esc_attr__("Search"); ?>">
    5049                </form>
    5150            </div>

  • gift-voucher/trunk/readme.txt

    r3262503 r3287344  
    33Tags: gift cards, gift certificates, gift voucher, premium vouchers, generate gift cards
    44Requires at least: 4.0
    5 Tested up to: 6.7.2
    6 Stable tag: 4.5.2
     5Tested up to: 6.8.1
     6Stable tag: 4.5.3
    77Requires PHP: 5.6
    88License: GPLv2 or later
    … …  
    219219== Changelog ==
    220220
     221= Version 4.5.3 - Released: May 05 2025
     222* Fix incorrect usage of esc_html_ in submit button templates.
     223* Improve security with nonce validation for preview-related actions.
     224* Sanitize and validate user input parameters for voucher
     225
    221226= Version 4.5.2 - Released: March 27 2025
    222227* Fix undefined function error for esc_html_ in new voucher template

  • gift-voucher/trunk/templates/wpgv_item_pdf.php

    r3248177 r3287344  
    55 */
    66
    7 if (!isset($_GET['action'])) {
     7if (!isset($_GET['action']) || !isset($_GET['nonce'])) {
    88    exit();
    99}
    1010
    11 $watermark = __('This is a preview voucher.', 'gift-voucher');
    12 if (sanitize_text_field(wp_unslash($_GET['action'])) == 'preview') {
     11$action = sanitize_text_field(wp_unslash($_GET['action']));
     12$nonce = sanitize_text_field(wp_unslash($_GET['nonce']));
     13
     14if ($action === 'preview' && wp_verify_nonce($nonce, 'wpgv_giftitems_form_verify')) {
    1315    $watermark = __('This is a preview voucher.', 'gift-voucher');
    1416} else {
    15     exit();
     17    wp_die(__('Security check failed', 'gift-voucher'));
    1618}
    1719
    … …  
    2729
    2830global $wpdb;
    29 $setting_table  = $wpdb->prefix . 'giftvouchers_setting';
    30 $setting_options = $wpdb->get_row("SELECT * FROM $setting_table WHERE id = 1");
     31$setting_options = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}giftvouchers_setting WHERE id = %d", 1));
     32
    3133$voucher_bgcolor = wpgv_hex2rgb($setting_options->voucher_bgcolor);
    3234$voucher_color = wpgv_hex2rgb($setting_options->voucher_color);

  • gift-voucher/trunk/templates/wpgv_voucher_pdf.php

    r3262503 r3287344  
    55 */
    66
    7 if (!isset($_GET['action'])) {
     7if (!isset($_GET['action']) || !isset($_GET['nonce'])) {
    88    exit();
    99}
    1010
     11$action = sanitize_text_field(wp_unslash($_GET['action']));
     12$nonce = sanitize_text_field(wp_unslash($_GET['nonce']));
    1113
    12 
    13 $watermark = __('This is a preview voucher.', 'gift-voucher');
    14 if (sanitize_text_field(wp_unslash($_GET['action'])) == 'preview') {
     14if ($action === 'preview' && wp_verify_nonce($nonce, 'voucher_form_verify')) {
    1515    $watermark = __('This is a preview voucher.', 'gift-voucher');
    1616} else {
    17     exit();
     17    wp_die(__('Security check failed', 'gift-voucher'));
    1818}
    1919
Note: See TracChangeset for help on using the changeset viewer.