WordPress.org
Get WordPress

Plugin Directory

Changeset 3366016


Ignore:
Timestamp:
09/22/2025 07:17:03 PM (6 months ago)
Author:
integromat
Message:

1.6.3

  • New feature: Content sanitization control option
Location:
integromat-connector
Files:
39 added
6 edited

Legend:

Unmodified
Added
Removed

  • integromat-connector/trunk/class/class-guard.php

    r3361722 r3366016  
    1010     * @return bool
    1111     */
    12     public static function is_protected() { 
     12    public static function is_protected() {
    1313        // Only guard if IWC-API-KEY header is present
    1414        if ( ! isset( $_SERVER['HTTP_IWC_API_KEY'] ) || empty( $_SERVER['HTTP_IWC_API_KEY'] ) ) {

  • integromat-connector/trunk/class/class-rest-request.php

    r3364774 r3366016  
    126126            return $sanitized;
    127127        } elseif ( is_string( $data ) ) {
    128             // Get allowed post tags and add iframe support for embedded content
    129             $allowed_tags = wp_kses_allowed_html( 'post' );
    130             $allowed_tags['iframe'] = array(
    131                 'src'             => true,
    132                 'width'           => true,
    133                 'height'          => true,
    134                 'frameborder'     => true,
    135                 'allowfullscreen' => true,
    136                 'loading'         => true,
    137                 'title'           => true,
    138                 'sandbox'         => true,
    139                 'allow'           => true,
    140                 'style'           => true,
    141             );
    142             return wp_kses( wp_unslash( $data ), $allowed_tags );
     128            // Check if content sanitization is enabled
     129            $sanitize_content = get_option( 'iwc_sanitize_post_content', '0' );
     130            if ( $sanitize_content === '1' ) {
     131                return wp_kses_post( wp_unslash( $data ) );
     132            } else {
     133                // Only apply basic unslashing without HTML stripping when disabled
     134                return wp_unslash( $data );
     135            }
    143136        } elseif ( is_numeric( $data ) ) {
    144137            return is_float( $data ) ? floatval( $data ) : intval( $data );
    … …  
    264257        if ( $movefile && ! isset( $movefile['error'] ) ) {
    265258            // Get additional metadata
    266             // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
     259            // phpcs:disable WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
    267260            $title       = isset( $_REQUEST['title'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['title'] ) ) : '';
    268             // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
    269261            $description = isset( $_REQUEST['description'] ) ? sanitize_textarea_field( wp_unslash( $_REQUEST['description'] ) ) : '';
    270             // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
    271262            $caption     = isset( $_REQUEST['caption'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['caption'] ) ) : '';
    272             // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
    273263            $alt_text    = isset( $_REQUEST['alt_text'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['alt_text'] ) ) : '';
    274             // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
    275264            $post_id     = isset( $_REQUEST['post'] ) ? absint( $_REQUEST['post'] ) : 0;
    276265            $filename   = basename( $movefile['file'] );
     266            // phpcs:enable WordPress.Security.NonceVerification.Recommended
    277267            // Prepare attachment data
    278268            $attachment = array(

  • integromat-connector/trunk/index.php

    r3364774 r3366016  
    33/**
    44 * @package Integromat_Connector
    5  * @version 1.6.2
     5 * @version 1.6.3
    66 */
    77
    … …  
    1111Author: Celonis s.r.o.
    1212Author URI: https://www.make.com/en?utm_source=wordpress&utm_medium=partner&utm_campaign=wordpress-partner-make
    13 Version: 1.6.2
     13Version: 1.6.3
    1414License: GPL v2 or later
    1515License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    1919define('IWC_PLUGIN_NAME_SAFE', 'integromat-wordpress-connector');
    2020define('IWC_MENUITEM_IDENTIFIER', 'integromat_custom_fields');
    21 define('IWC_PLUGIN_VERSION', '1.6.2');
     21define('IWC_PLUGIN_VERSION', '1.6.3');
    2222
    2323require __DIR__ . '/class/class-user.php';
    … …  
    236236        add_option('iwc_allowed_file_extensions', 'jpg,jpeg,png,gif,webp,svg,bmp,ico,pdf,doc,docx,xls,xlsx,ppt,pptx,txt,rtf,odt,ods,zip,rar,7z,tar,gz,mp3,wav,mp4,avi,mov,wmv,flv,webm,json,xml,csv');
    237237        add_option('iwc_log_security_events', '0');
     238        add_option('iwc_sanitize_post_content', '0');
    238239    }
    239240   

  • integromat-connector/trunk/readme.txt

    r3364774 r3366016  
    55Tested up to: 6.8
    66Requires PHP: 7.2
    7 Stable tag: 1.6.2
     7Stable tag: 1.6.3
    88License: GPLv2 or later
    99
    … …  
    4545
    4646== Changelog ==
     47= 1.6.3 =
     48* New feature: Content sanitization control option
     49
    4750= 1.6.2 =
    4851* Fixed reported issues on content missing when creating post

  • integromat-connector/trunk/settings/object-types/security.php

    r3361722 r3366016  
    88    // Register security settings
    99    register_setting( 'integromat_security_options', 'iwc_rate_limit_enabled', array(
    10         'sanitize_callback' => 'sanitize_text_field',
     10        'sanitize_callback' => 'Integromat\\iwc_sanitize_checkbox_value',
    1111        'default' => '0',
    1212    ) );
    … …  
    1818   
    1919    register_setting( 'integromat_security_options', 'iwc_payload_limit_enabled', array(
    20         'sanitize_callback' => 'sanitize_text_field',
     20        'sanitize_callback' => 'Integromat\\iwc_sanitize_checkbox_value',
    2121        'default' => '0',
    2222    ) );
    … …  
    2828   
    2929    register_setting( 'integromat_security_options', 'iwc_strict_file_validation', array(
    30         'sanitize_callback' => 'sanitize_text_field',
     30        'sanitize_callback' => 'Integromat\\iwc_sanitize_checkbox_value',
    3131        'default' => '0',
    3232    ) );
    … …  
    3838   
    3939    register_setting( 'integromat_security_options', 'iwc_log_security_events', array(
    40         'sanitize_callback' => 'sanitize_text_field',
     40        'sanitize_callback' => 'Integromat\\iwc_sanitize_checkbox_value',
     41        'default' => '0',
     42    ) );
     43   
     44    register_setting( 'integromat_security_options', 'iwc_sanitize_post_content', array(
     45        'sanitize_callback' => 'Integromat\\iwc_sanitize_checkbox_value',
    4146        'default' => '0',
    4247    ) );
    … …  
    6368                </label>
    6469                <p class="description">Log rate limiting violations and permission denials for security monitoring.</p>
     70            </div>
     71            <?php
     72        },
     73        'integromat_security_options',
     74        'integromat_security_section',
     75        array()
     76    );
     77
     78    add_settings_field(
     79        'sanitize_post_content_control',
     80        'Content Sanitization',
     81        function ( $args ) {
     82            $sanitize_post_content = get_option( 'iwc_sanitize_post_content', '0' );
     83            ?>
     84            <div class="iwc-sanitize-content-container">
     85                <label>
     86                    <input type="checkbox" name="iwc_sanitize_post_content" value="1" <?php checked( $sanitize_post_content, '1' ); ?> />
     87                    Sanitize post content (recommended)
     88                </label>
     89                <p class="description">Strip potentially harmful HTML tags and attributes from incoming content.</p>
     90               
     91                <div class="notice notice-warning" style="margin: 10px 0; padding: 10px; background: #fff3cd; border: 1px solid #ffeaa7; border-left: 4px solid #ffb900;">
     92                    <p style="margin: 0 0 8px 0; font-size: 13px;">
     93                        <strong>⚠️ Warning:</strong> Disabling this may allow dangerous HTML/scripts to be stored. Only disable if you trust your API clients completely.
     94                    </p>
     95                    <p style="margin: 0; font-size: 12px; color: #666;">
     96                        <strong>Examples of tags that will be stripped when enabled:</strong> &lt;script&gt;, &lt;iframe&gt;, &lt;object&gt;, &lt;embed&gt;, &lt;form&gt;, &lt;input&gt;, &lt;style&gt;, &lt;link&gt;, &lt;meta&gt;
     97                    </p>
     98                </div>
    6599            </div>
    66100            <?php
    … …  
    325359    return get_option( 'iwc_allowed_file_extensions', 'jpg,jpeg,png,gif,webp,svg,bmp,ico,pdf,doc,docx,xls,xlsx,ppt,pptx,txt,rtf,odt,ods,zip,rar,7z,tar,gz,mp3,wav,mp4,avi,mov,wmv,flv,webm,json,xml,csv' );
    326360}
     361
     362function iwc_sanitize_checkbox_value( $value ) {
     363    // Ensure only '0' or '1' values are accepted for checkbox settings
     364    return ( $value === '1' || $value === 1 || $value === true ) ? '1' : '0';
     365}

  • integromat-connector/trunk/settings/template/security_settings.phtml

    r3361722 r3366016  
    33
    44<!-- Security Settings Banner -->
    5 <div class="notice notice-info" style="margin: 20px 0; padding: 15px; border-left: 4px solid #0073aa;">
     5<div class="notice notice-info" style="margin: 20px 20px 20px 0; padding: 15px; border-left: 4px solid #0073aa;">
    66    <div style="display: flex; align-items: flex-start;">
    77        <span class="dashicons dashicons-info" style="color: #0073aa; margin-right: 10px; margin-top: 2px;"></span>
Note: See TracChangeset for help on using the changeset viewer.