WordPress.org
Get WordPress

Plugin Directory

Changeset 3391790


Ignore:
Timestamp:
11/07/2025 02:21:51 PM (5 months ago)
Author:
wpchill
Message:

Update to version 2.12.29 from GitHub

Location:
modula-best-grid-gallery
Files:
8 edited
1 copied

Legend:

Unmodified
Added
Removed

  • modula-best-grid-gallery/tags/2.12.29/Modula.php

    r3390878 r3391790  
    55* Description:              Modula is the most powerful, user-friendly WordPress gallery plugin. Add galleries, masonry grids and more in a few clicks.
    66* Author:                   WPChill
    7 * Version:                  2.12.28
     7* Version:                  2.12.29
    88* Author URI:               https://www.wpchill.com/
    99* License:                  GPLv3 or later
    … …  
    4848 */
    4949
    50 define( 'MODULA_LITE_VERSION', '2.12.28' );
     50define( 'MODULA_LITE_VERSION', '2.12.29' );
    5151define( 'MODULA_PATH', plugin_dir_path( __FILE__ ) );
    5252define( 'MODULA_URL', plugin_dir_url( __FILE__ ) );

  • modula-best-grid-gallery/tags/2.12.29/changelog.txt

    r3390878 r3391790  
     1= 2.12.29 - 07.11.2025 =
     2Fixed: Security issue.
     3
    14= 2.12.28 - 05.11.2025 =
    25Added: Filters to exclude Modula JS files from third-party optimization plugins.

  • modula-best-grid-gallery/tags/2.12.29/includes/admin/class-modula-gallery-upload.php

    r3292565 r3391790  
    565565        }
    566566
    567         $file        = wp_unslash( $_POST['file'] );
    568         $delete_file = 'false' === sanitize_text_field( wp_unslash( $_POST['delete_files'] ) ) ? false : true;
    569 
    570         $attachment_id = $this->upload_image( $file, $delete_file );
     567        $file = wp_unslash( $_POST['file'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
     568
     569        $real_path    = realpath( $file );
     570        $uploads_dir  = wp_upload_dir();
     571        $allowed_base = realpath( $uploads_dir['basedir'] );
     572
     573        if ( false === $real_path || false === $allowed_base || 0 !== strpos( $real_path, $allowed_base ) ) {
     574            wp_send_json_error( __( 'Invalid file path.', 'modula-best-grid-gallery' ) );
     575        }
     576
     577        if ( ! file_exists( $real_path ) || ! is_readable( $real_path ) ) {
     578            wp_send_json_error( __( 'File does not exist or is not readable.', 'modula-best-grid-gallery' ) );
     579        }
     580
     581        $delete_file = isset( $_POST['delete_files'] ) && 'false' !== sanitize_text_field( wp_unslash( $_POST['delete_files'] ) ) ? true : false;
     582
     583        $attachment_id = $this->upload_image( $real_path, $delete_file );
    571584        if ( ! $attachment_id ) {
    572             $prev_uploaded_files       = $this->get_uploaded_error_files( absint( $_POST['post_ID'] ) );
    573             $uploaded_files['files'][] = $_POST['file'];
    574             $this->update_uploaded_error_files( absint( $_POST['post_ID'] ), array_merge( $prev_uploaded_files, $uploaded_files ) );
     585            $post_id = isset( $_POST['post_ID'] ) ? absint( $_POST['post_ID'] ) : 0;
     586            if ( $post_id > 0 ) {
     587                $prev_uploaded_files       = $this->get_uploaded_error_files( $post_id );
     588                $uploaded_files['files'][] = $file;
     589                $this->update_uploaded_error_files( $post_id, array_merge( $prev_uploaded_files, $uploaded_files ) );
     590            }
    575591            wp_send_json_error( __( 'The file could not be uploaded.', 'modula-best-grid-gallery' ) );
    576592        }
    … …  
    11521168    }
    11531169
    1154     private function delete_atachment( $file_id, $force ){
     1170    private function delete_atachment( $file_id, $force ) {
    11551171        if ( ! current_user_can( 'delete_post', $file_id ) ) {
    11561172            return false;

  • modula-best-grid-gallery/tags/2.12.29/readme.txt

    r3390878 r3391790  
    323323
    324324== Changelog ==
     325= 2.12.29 - 07.11.2025 =
     326Fixed: Security issue.
     327
    325328= 2.12.28 - 05.11.2025 =
    326329Added: Filters to exclude Modula JS files from third-party optimization plugins.

  • modula-best-grid-gallery/trunk/Modula.php

    r3390878 r3391790  
    55* Description:              Modula is the most powerful, user-friendly WordPress gallery plugin. Add galleries, masonry grids and more in a few clicks.
    66* Author:                   WPChill
    7 * Version:                  2.12.28
     7* Version:                  2.12.29
    88* Author URI:               https://www.wpchill.com/
    99* License:                  GPLv3 or later
    … …  
    4848 */
    4949
    50 define( 'MODULA_LITE_VERSION', '2.12.28' );
     50define( 'MODULA_LITE_VERSION', '2.12.29' );
    5151define( 'MODULA_PATH', plugin_dir_path( __FILE__ ) );
    5252define( 'MODULA_URL', plugin_dir_url( __FILE__ ) );

  • modula-best-grid-gallery/trunk/changelog.txt

    r3390878 r3391790  
     1= 2.12.29 - 07.11.2025 =
     2Fixed: Security issue.
     3
    14= 2.12.28 - 05.11.2025 =
    25Added: Filters to exclude Modula JS files from third-party optimization plugins.

  • modula-best-grid-gallery/trunk/includes/admin/class-modula-gallery-upload.php

    r3292565 r3391790  
    565565        }
    566566
    567         $file        = wp_unslash( $_POST['file'] );
    568         $delete_file = 'false' === sanitize_text_field( wp_unslash( $_POST['delete_files'] ) ) ? false : true;
    569 
    570         $attachment_id = $this->upload_image( $file, $delete_file );
     567        $file = wp_unslash( $_POST['file'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
     568
     569        $real_path    = realpath( $file );
     570        $uploads_dir  = wp_upload_dir();
     571        $allowed_base = realpath( $uploads_dir['basedir'] );
     572
     573        if ( false === $real_path || false === $allowed_base || 0 !== strpos( $real_path, $allowed_base ) ) {
     574            wp_send_json_error( __( 'Invalid file path.', 'modula-best-grid-gallery' ) );
     575        }
     576
     577        if ( ! file_exists( $real_path ) || ! is_readable( $real_path ) ) {
     578            wp_send_json_error( __( 'File does not exist or is not readable.', 'modula-best-grid-gallery' ) );
     579        }
     580
     581        $delete_file = isset( $_POST['delete_files'] ) && 'false' !== sanitize_text_field( wp_unslash( $_POST['delete_files'] ) ) ? true : false;
     582
     583        $attachment_id = $this->upload_image( $real_path, $delete_file );
    571584        if ( ! $attachment_id ) {
    572             $prev_uploaded_files       = $this->get_uploaded_error_files( absint( $_POST['post_ID'] ) );
    573             $uploaded_files['files'][] = $_POST['file'];
    574             $this->update_uploaded_error_files( absint( $_POST['post_ID'] ), array_merge( $prev_uploaded_files, $uploaded_files ) );
     585            $post_id = isset( $_POST['post_ID'] ) ? absint( $_POST['post_ID'] ) : 0;
     586            if ( $post_id > 0 ) {
     587                $prev_uploaded_files       = $this->get_uploaded_error_files( $post_id );
     588                $uploaded_files['files'][] = $file;
     589                $this->update_uploaded_error_files( $post_id, array_merge( $prev_uploaded_files, $uploaded_files ) );
     590            }
    575591            wp_send_json_error( __( 'The file could not be uploaded.', 'modula-best-grid-gallery' ) );
    576592        }
    … …  
    11521168    }
    11531169
    1154     private function delete_atachment( $file_id, $force ){
     1170    private function delete_atachment( $file_id, $force ) {
    11551171        if ( ! current_user_can( 'delete_post', $file_id ) ) {
    11561172            return false;

  • modula-best-grid-gallery/trunk/readme.txt

    r3390878 r3391790  
    323323
    324324== Changelog ==
     325= 2.12.29 - 07.11.2025 =
     326Fixed: Security issue.
     327
    325328= 2.12.28 - 05.11.2025 =
    326329Added: Filters to exclude Modula JS files from third-party optimization plugins.
Note: See TracChangeset for help on using the changeset viewer.