WordPress.org
Get WordPress

Plugin Directory

Changeset 3312204


Ignore:
Timestamp:
06/15/2025 11:28:35 PM (10 months ago)
Author:
webvitaly
Message:

v.2.0
Sanitized archives shortcode params

Location:
sitekit
Files:
23 added
3 edited

Legend:

Unmodified
Added
Removed

  • sitekit/trunk/inc/sitekit-shortcode-archives.php

    r1800932 r3312204  
    1313    );
    1414    $atts_obj = shortcode_atts( $defaults, $atts );
     15   
     16    // Sanitize and validate all input parameters to prevent XSS attacks and other security issues
     17   
     18    // Sanitize text output parameters
     19    $atts_obj['before'] = esc_html($atts_obj['before']);
     20    $atts_obj['after'] = esc_html($atts_obj['after']);
     21   
     22    // Validate type parameter against allowed values
     23    $allowed_types = array('yearly', 'monthly', 'daily', 'weekly', 'postbypost', 'alpha');
     24    if (!in_array($atts_obj['type'], $allowed_types)) {
     25        $atts_obj['type'] = 'monthly'; // Default to monthly if invalid
     26    }
     27   
     28    // Validate format parameter against allowed values
     29    $allowed_formats = array('html', 'option', 'link');
     30    if (!in_array($atts_obj['format'], $allowed_formats)) {
     31        $atts_obj['format'] = 'html'; // Default to html if invalid
     32    }
     33   
     34    // Ensure limit is numeric
     35    if ($atts_obj['limit'] !== '') {
     36        $atts_obj['limit'] = absint($atts_obj['limit']);
     37    }
     38   
     39    // Ensure show_post_count and echo are boolean-like (0 or 1)
     40    $atts_obj['show_post_count'] = $atts_obj['show_post_count'] ? 1 : 0;
     41    $atts_obj['echo'] = $atts_obj['echo'] ? 1 : 0;
     42   
     43    // Validate order parameter
     44    $atts_obj['order'] = strtoupper($atts_obj['order']) === 'ASC' ? 'ASC' : 'DESC';
    1545   
    1646    $archives = wp_get_archives( $atts_obj );

  • sitekit/trunk/readme.txt

    r3260081 r3312204  
    44Tags: widget, widgets, search, archive, archives, category, categories, pages, shortcode, shortcodes, bloginfo, iframe
    55Requires at least: 4.0
    6 Tested up to: 6.7.2
    7 Stable tag: 1.9
     6Tested up to: 6.8.1
     7Stable tag: 2.0
    88License: GPLv3
    99License URI: http://www.gnu.org/licenses/gpl.html

  • sitekit/trunk/sitekit.php

    r3260081 r3312204  
    44Plugin URI: https://wordpress.org/plugins/sitekit/
    55Description: Widgets: search, archives, categories, pages, posts. Shortcodes: archives, bloginfo, categories, posts, custom menu.
    6 Version: 1.9
     6Version: 2.0
    77Author: webvitaly
    88Text Domain: sitekit
    … …  
    1515}
    1616
    17 define('SITEKIT_PLUGIN_VERSION', '1.9');
     17define('SITEKIT_PLUGIN_VERSION', '2.0');
    1818define('SITEKIT_PLUGIN_POWERED', "\n".'<!-- Powered by Sitekit v.'.SITEKIT_PLUGIN_VERSION.' https://wordpress.org/plugins/sitekit/ -->'."\n");
    1919
Note: See TracChangeset for help on using the changeset viewer.