WordPress.org
Get WordPress

Plugin Directory

Changeset 3300836


Ignore:
Timestamp:
05/26/2025 02:47:12 PM (10 months ago)
Author:
wclovers
Message:

WCFM 6.7.17 version update

Location:
wc-frontend-manager
Files:
862 added
5 edited

Legend:

Unmodified
Added
Removed

  • wc-frontend-manager/trunk/core/class-wcfm-admin.php

    r3000772 r3300836  
    7373     */
    7474    function wcfm_redirect_to_setup(){
     75        $is_allowed = apply_filters( 'wcfm_allow_setup_page_access', current_user_can( 'administrator' ) );
     76
     77        if (!$is_allowed) {
     78            wp_die(
     79                __( "You don't have permission to access this page. Please contact the site administrator for assistance.", 'wc-frontend-manager' ),
     80                __( 'Access Denied', 'wc-frontend-manager' )
     81            );
     82        }
     83
    7584        if ( get_transient( '_wc_activation_redirect' ) ) {
    7685            delete_transient( '_wc_activation_redirect' );
    … …  
    7988        if ( get_transient( '_wcfm_activation_redirect' ) ) {
    8089            delete_transient( '_wcfm_activation_redirect' );
     90           
    8191            if ( ( ! empty( $_GET['page'] ) && in_array( $_GET['page'], array( 'wcfm-setup' ) ) ) || is_network_admin() || isset( $_GET['activate-multi'] ) || apply_filters( 'wcfm_prevent_automatic_setup_redirect', false ) ) {
    8292              return;
    8393            }
    84             wp_safe_redirect( admin_url( 'index.php?page=wcfm-setup' ) );
     94
     95            wp_safe_redirect(
     96                wp_nonce_url(
     97                    admin_url( 'index.php?page=wcfm-setup' ),
     98                    'wcfm-setup-page-nonce',
     99                    'security'
     100                )
     101            );
     102
    85103            exit;
    86104        }

  • wc-frontend-manager/trunk/helpers/class-wcfm-setup.php

    r3016256 r3300836  
    3838        if ( filter_input(INPUT_GET, 'page') != 'wcfm-setup') {
    3939            return;
     40        }
     41
     42        if ( ! check_ajax_referer( 'wcfm-setup-page-nonce', 'security', false ) ) {
     43            wp_die(
     44                __( "Security check failed. You don't have permission to access this page. Please contact the site administrator for assistance.", 'wc-frontend-manager' ),
     45                __( 'Access Denied', 'wc-frontend-manager' )
     46            );
    4047        }
    4148

  • wc-frontend-manager/trunk/readme.txt

    r3252739 r3300836  
    44Donate link: https://www.paypal.me/wclovers/25usd
    55Requires at least: 4.4
    6 Tested up to: 6.7
     6Tested up to: 6.8
    77WC requires at least: 3.0
    8 WC tested up to: 9.7.0
     8WC tested up to: 9.8.0
    99Requires PHP: 5.6
    10 Stable tag: 6.7.16
     10Stable tag: 6.7.17
    1111License: GPLv2 or later
    1212License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    222222== Changelog ==
    223223
     224= 6.7.17 =
     225*Updated - 26/05/2025*
     226
     227* Enhance - WooCommerce 9.8+ compatibility check added
     228* Fixed   - Add 'wcfm_allow_setup_page_access' filter and nonce check to fix missing authorization vulnerability in setup page (reported by Brian Sans-Souci (liardom) - Wordfence)
     229
    224230= 6.7.16 =
    225231*Updated - 09/03/2025*
    … …  
    26882694== Upgrade Notice ==
    26892695
    2690 = 6.7.16 =
    2691 * Enhance - WooCommerce 9.7+ compatibility check added
    2692 * Fixed   - Stripe vendor connect issue for cross border countries. Now vendor needs to choose from a list of supported countries.
    2693 * Fixed   - Minor bug fixes
     2696= 6.7.17 =
     2697* Enhance - WooCommerce 9.8+ compatibility check added
     2698* Fixed   - Add 'wcfm_allow_setup_page_access' filter and nonce check to fix missing authorization vulnerability in setup page (reported by Brian Sans-Souci (liardom) - Wordfence)

  • wc-frontend-manager/trunk/wc_frontend_manager.php

    r3252739 r3300836  
    55 * Description: WooCommerce is really Easy and Beautiful. We are here to make your life much more Easier and Peaceful.
    66 * Author: WC Lovers
    7  * Version: 6.7.16
     7 * Version: 6.7.17
    88 * Author URI: https://wclovers.com
    99 *
    … …  
    1212 *
    1313 * WC requires at least: 3.0.0
    14  * WC tested up to: 9.7.0
     14 * WC tested up to: 9.8.0
    1515 *
    1616 */

  • wc-frontend-manager/trunk/wc_frontend_manager_config.php

    r3252739 r3300836  
    55define('WCFM_TEXT_DOMAIN', 'wc-frontend-manager');
    66
    7 define('WCFM_VERSION', '6.7.16');
     7define('WCFM_VERSION', '6.7.17');
    88
    99define('WCFM_SERVER_URL', 'https://wclovers.com');
Note: See TracChangeset for help on using the changeset viewer.