Changeset 3287964
- Timestamp:
- 05/05/2025 05:36:18 PM (9 months ago)
- Location:
- progress-bar
- Files:
-
- 10 edited
- 1 copied
-
tags/2.2.4 (copied) (copied from progress-bar/trunk)
-
tags/2.2.4/functions.php (modified) (8 diffs)
-
tags/2.2.4/phpcs.ruleset.xml (modified) (1 diff)
-
tags/2.2.4/readme.txt (modified) (4 diffs)
-
tags/2.2.4/wp-progress-bar.php (modified) (6 diffs)
-
tags/2.2.4/wppb-widget.php (modified) (3 diffs)
-
trunk/functions.php (modified) (8 diffs)
-
trunk/phpcs.ruleset.xml (modified) (1 diff)
-
trunk/readme.txt (modified) (4 diffs)
-
trunk/wp-progress-bar.php (modified) (6 diffs)
-
trunk/wppb-widget.php (modified) (3 diffs)
Legend:
- Unmodified
- Added
- Removed
-
progress-bar/tags/2.2.4/functions.php
r2914360 r3287964 100 100 $progress = str_replace( $currency, '', $progress ); 101 101 } 102 102 103 $xofy = explode( '/', $progress ); 103 if ( ! $xofy[1] ) { 104 $xofy[1] = 100; 105 } 106 $percentage = $xofy[0] / $xofy[1] * 100; 104 105 // Validate that both sides of the fraction are numeric. 106 $x = ( isset( $xofy[0] ) ) && is_numeric( $xofy[0] ) ? $xofy[0] : 0; 107 $y = ( isset( $xofy[1] ) ) && is_numeric( $xofy[1] ) ? $xofy[1] : 100; 108 109 $percentage = floatval( $x ) / floatval( $y ) * 100; 107 110 $width = $percentage . '%'; 108 111 if ( $has_currency_symbol === false ) { 109 $progress = number_format_i18n( $x ofy[0] ) . ' / ' . number_format_i18n( $xofy[1]);112 $progress = number_format_i18n( $x ) . ' / ' . number_format_i18n( $y ); 110 113 } else { 111 114 // If there's a currency symbol in the progress, display it manually. 112 $progress = $currency . number_format_i18n( $x ofy[0] ) . ' / ' . $currency . number_format_i18n( $xofy[1]);115 $progress = $currency . number_format_i18n( $x ) . ' / ' . $currency . number_format_i18n( $y ); 113 116 } 114 117 } … … 133 136 */ 134 137 function wppb_get_progress_bar( $location = false, $text = false, $progress = '', $option = false, $width = '', $fullwidth = false, $color = false, $gradient = false, $gradient_end = false ) { 135 // Sanitize user input. 136 $location = sanitize_html_class( esc_attr( $location ) ); 137 $text = sanitize_text_field( esc_attr( $text ) ); 138 $width = floatval( $width ); 139 $fullwidth = sanitize_html_class( esc_attr( $fullwidth ) ); 140 $color = esc_attr( wppb_sanitize_color( $color ) ); 141 $gradient = esc_attr( wppb_sanitize_color( $gradient ) ); 142 $gradient_end = esc_attr( wppb_sanitize_color( $gradient_end ) ); 143 $option = esc_attr( wppb_sanitize_option( $option ) ); 138 /* 139 * Sanitize user input. 140 * This would be better handled as we're outputting the variables. We're pre-escaping here for convenience, but need to remember to not escape again later inside the strings. 141 */ 142 $location = isset( $location ) ? esc_attr( sanitize_html_class( $location ) ) : $location; 143 $text_exists = ! is_bool( $text ) && trim( $text ) !== ''; 144 $text = $text_exists ? esc_html( sanitize_text_field( $text ) ) : $text; 145 $width = isset( $width ) ? floatval( $width ) : $width; 146 $fullwidth = isset( $fullwidth ) ? esc_attr( $fullwidth ) : $fullwidth; 147 $color = is_string( $color ) ? esc_attr( wppb_sanitize_color( $color ) ) : ''; 148 $gradient = isset( $gradient ) ? esc_attr( floatval( $gradient ) ) : $gradient; 149 $gradient_end = is_string( $gradient_end ) ? esc_attr( wppb_sanitize_color( $gradient_end ) ) : ''; 150 $option = isset( $option ) ? esc_attr( wppb_sanitize_option( $option ) ) : $option; 151 $progress = isset( $progress ) ? esc_html( sanitize_text_field( $progress ) ) : $progress; 152 153 // Calculate $gradient_end if missing. 154 if ( $gradient && $color && ! $gradient_end ) { 155 $gradient_end = wppb_brightness( $color, floatval( $gradient ) ); 156 } 144 157 145 158 // Throw an exception if $progress or $width are empty. … … 173 186 $wppb_output .= $progress; 174 187 $wppb_output .= '</div>'; 175 } elseif ( ! $location && $text ) { // If the location is not set, but there is custom text.188 } elseif ( ! $location && $text_exists ) { // If the location is not set, but there is custom text. 176 189 $wppb_output .= "<div class=\"inside\">$text</div>"; 177 190 } … … 190 203 $wppb_output .= " style=\"width: $width%; background: {$color};"; 191 204 if ( $gradient_end ) { 192 $wppb_output .= "background: -moz-linear-gradient(top, {$color} 0%, $gradient_end 100%); background: -webkit-gradient(linear, left top, left bottom, color-stop(0%,{$color}), color-stop(100%,$gradient_end)); background: -webkit-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -o-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -ms-linear-gradient(top, {$gradient} 0%,$gradient_end 100%); background: linear-gradient(top, {$color} 0%,$gradient_end 100%); \""; 193 } 205 $wppb_output .= "background: -moz-linear-gradient(top, {$color} 0%, $gradient_end 100%); background: -webkit-gradient(linear, left top, left bottom, color-stop(0%,{$color}), color-stop(100%,$gradient_end)); background: -webkit-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -o-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -ms-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: linear-gradient(top, {$color} 0%,$gradient_end 100%); \""; 206 } 207 $wppb_output .= '"'; 194 208 } else { 195 $wppb_output .= " style=\"width: $width%;"; 196 } 197 if ( $gradient && $color ) { 198 $wppb_output .= "background: -moz-linear-gradient(top, {$color} 0%, $gradient_end 100%); background: -webkit-gradient(linear, left top, left bottom, color-stop(0%,{$color}), color-stop(100%,$gradient_end)); background: -webkit-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -o-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -ms-linear-gradient(top, {$gradient} 0%,$gradient_end 100%); background: linear-gradient(top, {$color} 0%,$gradient_end 100%); \""; 199 } else { 200 $wppb_output .= '"'; 209 $wppb_output .= " style=\"width: $width%;\""; 201 210 } 202 211 $wppb_output .= '><span></span></span>'; … … 216 225 */ 217 226 function wppb_sanitize_color( $color = '' ) { 218 if ( '' === $color) {219 return $color;227 if ( ! is_string( $color ) ) { 228 return ''; 220 229 } 221 230 … … 229 238 230 239 // Check if $color contains a hexadecimal or rgb value. If neither, return an empty string.. 231 if ( false === strpos( $color, '#' ) && false === strpos( $color, 'rgb(' ) && false === strpos( $color, 'rgba(' ) ) { 240 if ( false === strpos( $color, '#' ) && 241 false === strpos( $color, 'rgb(' ) && 242 false === strpos( $color, 'rgba(' ) 243 ) { 232 244 // If the string is not a valid hexadecimal value, return an empty string. 233 if ( ! ctype_xdigit( $color ) && ( strlen( $color ) !== 3 ||strlen( $color ) !== 6 ) ) {245 if ( ! ctype_xdigit( $color ) || ( strlen( $color ) !== 3 && strlen( $color ) !== 6 ) ) { 234 246 return ''; 235 247 } … … 239 251 if ( false !== strpos( $color, '#' ) ) { 240 252 $color = sanitize_hex_color( $color ); 241 } 242 243 // If $color contains an rgb/rgba value, sanitize it.244 if ( false !== strpos( $color, 'rgb(' ) || false !== strpos( $color, 'rgba(' ) ) {245 $color = sanitize_text_field( $color );253 254 // If sanitize_hex_color() failed, return early. 255 if ( ! is_string( $color ) || $color === '' ) { 256 return ''; 257 } 246 258 } 247 259 … … 340 352 'honeydew', 341 353 'hotpink', 342 'indianred 343 'indigo 354 'indianred', 355 'indigo', 344 356 'ivory', 345 357 'khaki', -
progress-bar/tags/2.2.4/phpcs.ruleset.xml
r2914360 r3287964 4 4 <exclude-pattern>vendor/</exclude-pattern> 5 5 <exclude-pattern>tests/</exclude-pattern> 6 <ini name="error_reporting" value="E_ALL & ~E_DEPRECATED" /> 6 7 <rule ref="Pantheon-WP"> 7 8 <exclude name="WordPress.Files.FileName.InvalidClassFileName" /> -
progress-bar/tags/2.2.4/readme.txt
r2914360 r3287964 4 4 Tags: progress bar, css3, progress, shortcode 5 5 Requires at least: 2.8 6 Tested up to: 6. 2.17 Stable tag: 2.2. 36 Tested up to: 6.7.2 7 Stable tag: 2.2.4 8 8 9 9 A simple progress bar shortcode that can be styled with CSS … … 169 169 170 170 Makes the progress bar take up 100% of the container. (Good for responsive layouts.) *Not* recommended for progress bars that exceed their goal. 171 *Note:* `fullwidth` will actually take any value. If `fullwidth` is present at all, it will display a progress bar that is 100% wide. For example `fullwidth=foo` would output the same as `fullwidth=true`.171 *Note:* As of 2.2.4, `fullwidth` will _only take truthy_ values. Previously, it would accept any value, e.g. `fullwidth=foo` would output the same as `fullwidth=true`. This is no longer the case. 172 172 173 173 Supported value: true … … 227 227 228 228 == Upgrade Notice == 229 ** 2.2.4 ** 230 231 * Previously, the `fullwidth` parameter would accept any value. This has been updated to use the PHP `FILTER_VALIDATE_BOOLEAN` constant so that only "truthy" values (1, true, "true", "yes", etc.) are supported. 232 229 233 ** 2.2.0 ** 230 234 … … 233 237 234 238 == Changelog == 239 240 ** 2.2.4 ** 241 * Fixed XSS vulnerability reported by muhammad yudha for [Patchstack](https://patchstack.com) 242 * Cleaned up and refactored some possibly buggy code and sanitization/escaping issues. 235 243 236 244 ** 2.2.3 ** -
progress-bar/tags/2.2.4/wp-progress-bar.php
r2914360 r3287964 4 4 * Plugin URI: https://github.com/jazzsequence/progress-bar 5 5 * Description: A simple progress bar shortcode that can be styled with CSS. 6 * Version: 2.2. 36 * Version: 2.2.4 7 7 * Author: Chris Reynolds 8 8 * Author URI: https://progressbar.jazzsequence.com/ … … 35 35 * @return string 36 36 */ 37 function wppb_version() 38 return '2.2. 3';37 function wppb_version(): string { 38 return '2.2.4'; 39 39 } 40 40 … … 53 53 } 54 54 add_action( 'init', 'wppb_init' ); 55 56 /** 57 * Register the widget. 58 * 59 * @author Chris Reynolds 60 * @since 2.0.1 61 * @uses WP_Widget 62 */ 63 function wppb_register_widget() { 64 register_widget( 'WPPB_Widget' ); 65 } 66 add_action( 'widgets_init', 'wppb_register_widget' ); 55 67 56 68 /** … … 104 116 105 117 // Get the values of the shortcode attributes. 106 $progress = isset( $atts['progress'] ) ? $atts['progress']: '';107 $option = isset( $atts['option'] ) ? $atts['option']: '';108 $percent = isset( $atts['percent'] ) ? $atts['percent']: '';109 $location = isset( $atts['location'] ) ? $atts['location'] : ''; 110 $fullwidth = isset( $atts['fullwidth'] ) ? $atts['fullwidth']: '';111 $color = isset( $atts['color'] ) ? $atts['color']: '';112 $gradient = isset( $atts['gradient'] ) ? $atts['gradient']: '';113 $endcolor = isset( $atts['endcolor'] ) ? $atts['endcolor']: '';114 $text = isset( $atts['text'] ) ? $atts['text']: '';118 $progress = isset( $atts['progress'] ) ? sanitize_text_field( $atts['progress'] ) : ''; 119 $option = isset( $atts['option'] ) ? wppb_sanitize_option( $atts['option'] ) : ''; 120 $percent = isset( $atts['percent'] ) ? sanitize_text_field( $atts['percent'] ) : ''; 121 $location = isset( $atts['location'] ) ? $atts['location'] : ''; // Sanitization handled in wppb_get_progress_bar. 122 $fullwidth = isset( $atts['fullwidth'] ) ? filter_var( $atts['fullwidth'], FILTER_VALIDATE_BOOLEAN ) : ''; 123 $color = isset( $atts['color'] ) ? wppb_sanitize_color( $atts['color'] ) : ''; 124 $gradient = isset( $atts['gradient'] ) ? sanitize_text_field( $atts['gradient'] ) : ''; 125 $endcolor = isset( $atts['endcolor'] ) ? wppb_sanitize_color( $atts['endcolor'] ) : ''; 126 $text = isset( $atts['text'] ) ? sanitize_text_field( $atts['text'] ) : ''; 115 127 116 128 // Check the progress for a slash, indicating a fraction instead of a percent. … … 130 142 } 131 143 132 // Sanitize any text content.133 if ( $text !== '' ) {134 $text = wp_strip_all_tags( $text );135 }136 137 144 // Figure out gradient stuff. 138 145 $gradient_end = null; … … 144 151 } 145 152 146 if ( $fullwidth !== '' ) {147 $fullwidth = true;148 }149 150 153 $progress = $wppb_check_results[0]; 151 154 -
progress-bar/tags/2.2.4/wppb-widget.php
r2909774 r3287964 6 6 * @package WP_Progress_Bar 7 7 */ 8 9 /**10 * Register the widget.11 *12 * @author Chris Reynolds13 * @since 2.0.114 * @uses WP_Widget15 */16 function wppb_register_widget() {17 register_widget( 'WPPB_Widget' );18 }19 add_action( 'widgets_init', 'wppb_register_widget' );20 8 21 9 /** … … 98 86 } 99 87 100 $option = null; 101 if ( $color ) { 102 $option .= $color; 103 } 104 if ( $candystripe ) { 105 $option .= ' ' . $candystripe; 106 } 88 $option = wppb_sanitize_option( trim( "$color $candystripe" ) ); 107 89 108 90 echo wp_kses_post( wppb_get_progress_bar( $location, $text, $percent, $option, $width, 'true' ) ); 109 91 echo wp_kses_post( wpautop( $description ) ); 110 92 echo wp_kses_post( $args['after_widget'] ); 111 112 93 } 113 94 … … 242 223 <p> 243 224 <label for="<?php echo esc_attr( $this->get_field_name( 'text' ) ); ?>"><strong><?php esc_html_e( 'Text', 'wp-progress-bar' ); ?></strong></label> 244 <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'text' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'text' ) ); ?>" type="text" value="<?php wp_kses_post( $text ); ?>" /><br />225 <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'text' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'text' ) ); ?>" type="text" value="<?php echo esc_attr( $text ); ?>" /><br /> 245 226 <span class="description"><?php esc_html_e( 'Custom text to display (instead of the progress value). (optional).', 'wp-progress-bar' ); ?></span> 246 227 </p> -
progress-bar/trunk/functions.php
r2914360 r3287964 100 100 $progress = str_replace( $currency, '', $progress ); 101 101 } 102 102 103 $xofy = explode( '/', $progress ); 103 if ( ! $xofy[1] ) { 104 $xofy[1] = 100; 105 } 106 $percentage = $xofy[0] / $xofy[1] * 100; 104 105 // Validate that both sides of the fraction are numeric. 106 $x = ( isset( $xofy[0] ) ) && is_numeric( $xofy[0] ) ? $xofy[0] : 0; 107 $y = ( isset( $xofy[1] ) ) && is_numeric( $xofy[1] ) ? $xofy[1] : 100; 108 109 $percentage = floatval( $x ) / floatval( $y ) * 100; 107 110 $width = $percentage . '%'; 108 111 if ( $has_currency_symbol === false ) { 109 $progress = number_format_i18n( $x ofy[0] ) . ' / ' . number_format_i18n( $xofy[1]);112 $progress = number_format_i18n( $x ) . ' / ' . number_format_i18n( $y ); 110 113 } else { 111 114 // If there's a currency symbol in the progress, display it manually. 112 $progress = $currency . number_format_i18n( $x ofy[0] ) . ' / ' . $currency . number_format_i18n( $xofy[1]);115 $progress = $currency . number_format_i18n( $x ) . ' / ' . $currency . number_format_i18n( $y ); 113 116 } 114 117 } … … 133 136 */ 134 137 function wppb_get_progress_bar( $location = false, $text = false, $progress = '', $option = false, $width = '', $fullwidth = false, $color = false, $gradient = false, $gradient_end = false ) { 135 // Sanitize user input. 136 $location = sanitize_html_class( esc_attr( $location ) ); 137 $text = sanitize_text_field( esc_attr( $text ) ); 138 $width = floatval( $width ); 139 $fullwidth = sanitize_html_class( esc_attr( $fullwidth ) ); 140 $color = esc_attr( wppb_sanitize_color( $color ) ); 141 $gradient = esc_attr( wppb_sanitize_color( $gradient ) ); 142 $gradient_end = esc_attr( wppb_sanitize_color( $gradient_end ) ); 143 $option = esc_attr( wppb_sanitize_option( $option ) ); 138 /* 139 * Sanitize user input. 140 * This would be better handled as we're outputting the variables. We're pre-escaping here for convenience, but need to remember to not escape again later inside the strings. 141 */ 142 $location = isset( $location ) ? esc_attr( sanitize_html_class( $location ) ) : $location; 143 $text_exists = ! is_bool( $text ) && trim( $text ) !== ''; 144 $text = $text_exists ? esc_html( sanitize_text_field( $text ) ) : $text; 145 $width = isset( $width ) ? floatval( $width ) : $width; 146 $fullwidth = isset( $fullwidth ) ? esc_attr( $fullwidth ) : $fullwidth; 147 $color = is_string( $color ) ? esc_attr( wppb_sanitize_color( $color ) ) : ''; 148 $gradient = isset( $gradient ) ? esc_attr( floatval( $gradient ) ) : $gradient; 149 $gradient_end = is_string( $gradient_end ) ? esc_attr( wppb_sanitize_color( $gradient_end ) ) : ''; 150 $option = isset( $option ) ? esc_attr( wppb_sanitize_option( $option ) ) : $option; 151 $progress = isset( $progress ) ? esc_html( sanitize_text_field( $progress ) ) : $progress; 152 153 // Calculate $gradient_end if missing. 154 if ( $gradient && $color && ! $gradient_end ) { 155 $gradient_end = wppb_brightness( $color, floatval( $gradient ) ); 156 } 144 157 145 158 // Throw an exception if $progress or $width are empty. … … 173 186 $wppb_output .= $progress; 174 187 $wppb_output .= '</div>'; 175 } elseif ( ! $location && $text ) { // If the location is not set, but there is custom text.188 } elseif ( ! $location && $text_exists ) { // If the location is not set, but there is custom text. 176 189 $wppb_output .= "<div class=\"inside\">$text</div>"; 177 190 } … … 190 203 $wppb_output .= " style=\"width: $width%; background: {$color};"; 191 204 if ( $gradient_end ) { 192 $wppb_output .= "background: -moz-linear-gradient(top, {$color} 0%, $gradient_end 100%); background: -webkit-gradient(linear, left top, left bottom, color-stop(0%,{$color}), color-stop(100%,$gradient_end)); background: -webkit-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -o-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -ms-linear-gradient(top, {$gradient} 0%,$gradient_end 100%); background: linear-gradient(top, {$color} 0%,$gradient_end 100%); \""; 193 } 205 $wppb_output .= "background: -moz-linear-gradient(top, {$color} 0%, $gradient_end 100%); background: -webkit-gradient(linear, left top, left bottom, color-stop(0%,{$color}), color-stop(100%,$gradient_end)); background: -webkit-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -o-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -ms-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: linear-gradient(top, {$color} 0%,$gradient_end 100%); \""; 206 } 207 $wppb_output .= '"'; 194 208 } else { 195 $wppb_output .= " style=\"width: $width%;"; 196 } 197 if ( $gradient && $color ) { 198 $wppb_output .= "background: -moz-linear-gradient(top, {$color} 0%, $gradient_end 100%); background: -webkit-gradient(linear, left top, left bottom, color-stop(0%,{$color}), color-stop(100%,$gradient_end)); background: -webkit-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -o-linear-gradient(top, {$color} 0%,$gradient_end 100%); background: -ms-linear-gradient(top, {$gradient} 0%,$gradient_end 100%); background: linear-gradient(top, {$color} 0%,$gradient_end 100%); \""; 199 } else { 200 $wppb_output .= '"'; 209 $wppb_output .= " style=\"width: $width%;\""; 201 210 } 202 211 $wppb_output .= '><span></span></span>'; … … 216 225 */ 217 226 function wppb_sanitize_color( $color = '' ) { 218 if ( '' === $color) {219 return $color;227 if ( ! is_string( $color ) ) { 228 return ''; 220 229 } 221 230 … … 229 238 230 239 // Check if $color contains a hexadecimal or rgb value. If neither, return an empty string.. 231 if ( false === strpos( $color, '#' ) && false === strpos( $color, 'rgb(' ) && false === strpos( $color, 'rgba(' ) ) { 240 if ( false === strpos( $color, '#' ) && 241 false === strpos( $color, 'rgb(' ) && 242 false === strpos( $color, 'rgba(' ) 243 ) { 232 244 // If the string is not a valid hexadecimal value, return an empty string. 233 if ( ! ctype_xdigit( $color ) && ( strlen( $color ) !== 3 ||strlen( $color ) !== 6 ) ) {245 if ( ! ctype_xdigit( $color ) || ( strlen( $color ) !== 3 && strlen( $color ) !== 6 ) ) { 234 246 return ''; 235 247 } … … 239 251 if ( false !== strpos( $color, '#' ) ) { 240 252 $color = sanitize_hex_color( $color ); 241 } 242 243 // If $color contains an rgb/rgba value, sanitize it.244 if ( false !== strpos( $color, 'rgb(' ) || false !== strpos( $color, 'rgba(' ) ) {245 $color = sanitize_text_field( $color );253 254 // If sanitize_hex_color() failed, return early. 255 if ( ! is_string( $color ) || $color === '' ) { 256 return ''; 257 } 246 258 } 247 259 … … 340 352 'honeydew', 341 353 'hotpink', 342 'indianred 343 'indigo 354 'indianred', 355 'indigo', 344 356 'ivory', 345 357 'khaki', -
progress-bar/trunk/phpcs.ruleset.xml
r2914360 r3287964 4 4 <exclude-pattern>vendor/</exclude-pattern> 5 5 <exclude-pattern>tests/</exclude-pattern> 6 <ini name="error_reporting" value="E_ALL & ~E_DEPRECATED" /> 6 7 <rule ref="Pantheon-WP"> 7 8 <exclude name="WordPress.Files.FileName.InvalidClassFileName" /> -
progress-bar/trunk/readme.txt
r2914360 r3287964 4 4 Tags: progress bar, css3, progress, shortcode 5 5 Requires at least: 2.8 6 Tested up to: 6. 2.17 Stable tag: 2.2. 36 Tested up to: 6.7.2 7 Stable tag: 2.2.4 8 8 9 9 A simple progress bar shortcode that can be styled with CSS … … 169 169 170 170 Makes the progress bar take up 100% of the container. (Good for responsive layouts.) *Not* recommended for progress bars that exceed their goal. 171 *Note:* `fullwidth` will actually take any value. If `fullwidth` is present at all, it will display a progress bar that is 100% wide. For example `fullwidth=foo` would output the same as `fullwidth=true`.171 *Note:* As of 2.2.4, `fullwidth` will _only take truthy_ values. Previously, it would accept any value, e.g. `fullwidth=foo` would output the same as `fullwidth=true`. This is no longer the case. 172 172 173 173 Supported value: true … … 227 227 228 228 == Upgrade Notice == 229 ** 2.2.4 ** 230 231 * Previously, the `fullwidth` parameter would accept any value. This has been updated to use the PHP `FILTER_VALIDATE_BOOLEAN` constant so that only "truthy" values (1, true, "true", "yes", etc.) are supported. 232 229 233 ** 2.2.0 ** 230 234 … … 233 237 234 238 == Changelog == 239 240 ** 2.2.4 ** 241 * Fixed XSS vulnerability reported by muhammad yudha for [Patchstack](https://patchstack.com) 242 * Cleaned up and refactored some possibly buggy code and sanitization/escaping issues. 235 243 236 244 ** 2.2.3 ** -
progress-bar/trunk/wp-progress-bar.php
r2914360 r3287964 4 4 * Plugin URI: https://github.com/jazzsequence/progress-bar 5 5 * Description: A simple progress bar shortcode that can be styled with CSS. 6 * Version: 2.2. 36 * Version: 2.2.4 7 7 * Author: Chris Reynolds 8 8 * Author URI: https://progressbar.jazzsequence.com/ … … 35 35 * @return string 36 36 */ 37 function wppb_version() 38 return '2.2. 3';37 function wppb_version(): string { 38 return '2.2.4'; 39 39 } 40 40 … … 53 53 } 54 54 add_action( 'init', 'wppb_init' ); 55 56 /** 57 * Register the widget. 58 * 59 * @author Chris Reynolds 60 * @since 2.0.1 61 * @uses WP_Widget 62 */ 63 function wppb_register_widget() { 64 register_widget( 'WPPB_Widget' ); 65 } 66 add_action( 'widgets_init', 'wppb_register_widget' ); 55 67 56 68 /** … … 104 116 105 117 // Get the values of the shortcode attributes. 106 $progress = isset( $atts['progress'] ) ? $atts['progress']: '';107 $option = isset( $atts['option'] ) ? $atts['option']: '';108 $percent = isset( $atts['percent'] ) ? $atts['percent']: '';109 $location = isset( $atts['location'] ) ? $atts['location'] : ''; 110 $fullwidth = isset( $atts['fullwidth'] ) ? $atts['fullwidth']: '';111 $color = isset( $atts['color'] ) ? $atts['color']: '';112 $gradient = isset( $atts['gradient'] ) ? $atts['gradient']: '';113 $endcolor = isset( $atts['endcolor'] ) ? $atts['endcolor']: '';114 $text = isset( $atts['text'] ) ? $atts['text']: '';118 $progress = isset( $atts['progress'] ) ? sanitize_text_field( $atts['progress'] ) : ''; 119 $option = isset( $atts['option'] ) ? wppb_sanitize_option( $atts['option'] ) : ''; 120 $percent = isset( $atts['percent'] ) ? sanitize_text_field( $atts['percent'] ) : ''; 121 $location = isset( $atts['location'] ) ? $atts['location'] : ''; // Sanitization handled in wppb_get_progress_bar. 122 $fullwidth = isset( $atts['fullwidth'] ) ? filter_var( $atts['fullwidth'], FILTER_VALIDATE_BOOLEAN ) : ''; 123 $color = isset( $atts['color'] ) ? wppb_sanitize_color( $atts['color'] ) : ''; 124 $gradient = isset( $atts['gradient'] ) ? sanitize_text_field( $atts['gradient'] ) : ''; 125 $endcolor = isset( $atts['endcolor'] ) ? wppb_sanitize_color( $atts['endcolor'] ) : ''; 126 $text = isset( $atts['text'] ) ? sanitize_text_field( $atts['text'] ) : ''; 115 127 116 128 // Check the progress for a slash, indicating a fraction instead of a percent. … … 130 142 } 131 143 132 // Sanitize any text content.133 if ( $text !== '' ) {134 $text = wp_strip_all_tags( $text );135 }136 137 144 // Figure out gradient stuff. 138 145 $gradient_end = null; … … 144 151 } 145 152 146 if ( $fullwidth !== '' ) {147 $fullwidth = true;148 }149 150 153 $progress = $wppb_check_results[0]; 151 154 -
progress-bar/trunk/wppb-widget.php
r2909774 r3287964 6 6 * @package WP_Progress_Bar 7 7 */ 8 9 /**10 * Register the widget.11 *12 * @author Chris Reynolds13 * @since 2.0.114 * @uses WP_Widget15 */16 function wppb_register_widget() {17 register_widget( 'WPPB_Widget' );18 }19 add_action( 'widgets_init', 'wppb_register_widget' );20 8 21 9 /** … … 98 86 } 99 87 100 $option = null; 101 if ( $color ) { 102 $option .= $color; 103 } 104 if ( $candystripe ) { 105 $option .= ' ' . $candystripe; 106 } 88 $option = wppb_sanitize_option( trim( "$color $candystripe" ) ); 107 89 108 90 echo wp_kses_post( wppb_get_progress_bar( $location, $text, $percent, $option, $width, 'true' ) ); 109 91 echo wp_kses_post( wpautop( $description ) ); 110 92 echo wp_kses_post( $args['after_widget'] ); 111 112 93 } 113 94 … … 242 223 <p> 243 224 <label for="<?php echo esc_attr( $this->get_field_name( 'text' ) ); ?>"><strong><?php esc_html_e( 'Text', 'wp-progress-bar' ); ?></strong></label> 244 <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'text' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'text' ) ); ?>" type="text" value="<?php wp_kses_post( $text ); ?>" /><br />225 <input class="widefat" id="<?php echo esc_attr( $this->get_field_id( 'text' ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( 'text' ) ); ?>" type="text" value="<?php echo esc_attr( $text ); ?>" /><br /> 245 226 <span class="description"><?php esc_html_e( 'Custom text to display (instead of the progress value). (optional).', 'wp-progress-bar' ); ?></span> 246 227 </p>
Note: See TracChangeset
for help on using the changeset viewer.