WordPress.org
Get WordPress

Plugin Directory

Changeset 3341756


Ignore:
Timestamp:
08/08/2025 04:30:12 PM (8 months ago)
Author:
vladimir.s
Message:

Terms descriptions v.3.4.9. Bug fixes: XSS vulnerability fixed

Location:
terms-descriptions/trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • terms-descriptions/trunk/ajax/td_terms_ajax.php

    r3211640 r3341756  
    7474    switch ($_POST['td_content_type']) {
    7575        case 'ext_link' :
    76             $term_link = $_POST['td_link'];
     76            $term_link = htmlspecialchars($_POST['td_link']);
    7777            if (!preg_match('/^\w{3,5}\:\/\//i', $term_link)) {
    7878                $term_link = 'http://' . $term_link;
    7979            }
    8080            $link_title = $term_link;
    81             $trimmedTitle = trim($_POST['td_title']);
     81            $trimmedTitle = htmlspecialchars(trim($_POST['td_title']));
    8282            if ( isset( $_POST[ 'td_title' ] ) && !empty($trimmedTitle) ) {
    8383                $link_title = $trimmedTitle;
    … …  
    8787                               't_post_url'   => $term_link,
    8888                               't_post_type'  => $_POST['td_content_type'],
    89                                't_term'       => $_POST['td_term'],
     89                               't_term'       => $term,
    9090                               't_use_in_post_types' => serialize($_POST['t_use_in_post_types']),
    9191                            );
    … …  
    105105                               't_post_url'   => $term_link,
    106106                               't_post_type'  => $_POST['td_content_type'],
    107                                't_term'       => $_POST['td_term'],
     107                               't_term'       => $term,
    108108                               't_use_in_post_types' => serialize($_POST['t_use_in_post_types']),
    109109                            );
    … …  
    123123                               't_post_url'   => $term_link,
    124124                               't_post_type'  => $_POST['td_content_type'],
    125                                't_term'       => $_POST['td_term'],
     125                               't_term'       => $term,
    126126                               't_use_in_post_types' => serialize($_POST['t_use_in_post_types']),
    127127                            );

  • terms-descriptions/trunk/includes/parsers/td_parser.php

    r2754088 r3341756  
    2828                    $new_terms[ $i ] = $term;
    2929                    $new_terms[ $i ][ 't_term' ] = $prepared_term;
     30                    $new_terms[ $i ][ 't_post_title' ] = htmlspecialchars($term[ 't_post_title' ]);
     31                    $new_terms[ $i ][ 't_post_url' ] = htmlspecialchars($term[ 't_post_url' ]);
    3032                }
    3133            }

  • terms-descriptions/trunk/includes/parsers/td_simple_parser.php

    r2902998 r3341756  
    127127                //adding links to terms
    128128                foreach ( $matches[0] as $match ) {
    129                     //is their a text before this occurrence?
     129                    //is there a text before this occurrence?
    130130                    $length = $match[1] - $start_pos;
    131131                    if ( $length > 0 ) {

  • terms-descriptions/trunk/includes/td_admin_options.php

    r2902998 r3341756  
    11<?php
     2
     3require_once TD_DIR . 'includes/utils.php';
     4
    25/**
    36 * This class creates Options page in Terms menu
    … …  
    4144            $options = $terms_class->get_default_options();
    4245            add_option( 'td_options', $options );
     46        }
     47
     48        foreach ($options as $key => $value) {
     49            $options[$key] = preg_replace('/"/i', '&quot;', $value);
    4350        }
    4451?>
    … …  
    318325            $input[ 'additional_filters' ] = '';
    319326        }
     327
     328        foreach ($input as $key => $value) {
     329            $input[$key] = td_sanitize_XSS($value);
     330        }
     331
    320332        if ( false !== $old_options ) {
    321333            return array_merge( $old_options, $input );

  • terms-descriptions/trunk/includes/td_options.php

    r2902998 r3341756  
    11<?php
     2
     3require_once TD_DIR . 'includes/utils.php';
     4
    25class SCO_TD_Options {
    36    private $options = array();
    … …  
    4447            return false;
    4548        }
    46         return $this->options[ $name ];
     49        return td_sanitize_XSS($this->options[ $name ]);
    4750    }
    4851}

  • terms-descriptions/trunk/readme.txt

    r3211640 r3341756  
    11=== Terms descriptions ===
    22Contributors: vladimir.s
    3 Tags: post, page, links, plugin, link building, cross linking, seo
     3Tags: post, page, links, link building, cross linking
    44Requires at least: 4.1
    5 Tested up to: 6.6.2
     5Tested up to: 6.8.2
    66Stable tag: trunk
     7License: GPLv3
     8License URI: https://www.gnu.org/licenses/gpl-3.0.html
    79
    810This plugin allows you to create list of terms and assign links to them. Plugin replaces terms occurrences in your posts with appropriate links.
     11
     12== Description ==
    913
    1014The main purpose of this plugin is easy link building.
    … …  
    7983== Changelog ==
    8084
     85= 3.4.9 =
     86
     87* Bug fixes: XSS vulnerability fixed
     88
    8189= 3.4.8 =
    8290

  • terms-descriptions/trunk/terms-descriptions.php

    r3211640 r3341756  
    44Plugin URI: https://simplecoding.org/plagin-wordpress-terms-descriptions
    55Description: This plugin allows you to create list of terms and assign links to them. Plugin automatically replaces terms occurrences in your posts with appropriate links. You can control the number of replacements. After activation you can create terms list on plugin administration page (Tools -> Terms Descriptions).
    6 Version: 3.4.8
     6Version: 3.4.9
    77Author: Vladimir Statsenko
    88Author URI: https://simplecoding.org
Note: See TracChangeset for help on using the changeset viewer.