WordPress.org
Get WordPress

Plugin Directory

Changeset 3395777


Ignore:
Timestamp:
11/14/2025 02:01:29 PM (5 months ago)
Author:
viaads
Message:

Security Update

Location:
viaads
Files:
14 added
10 edited

Legend:

Unmodified
Added
Removed

  • viaads/trunk/apikey.php

    r2975155 r3395777  
    3232                <hr class="wp-header-end">
    3333                <form method="post">
     34                    ' . wp_nonce_field('viaads_update_settings', 'viaads_settings_nonce', true, false) . '
    3435                    <table class="form-table">
    3536                        <tbody>
    … …  
    7273            ';
    7374
     75    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Output contains admin form HTML with properly escaped variables
    7476    echo $html;
    7577}
    … …  
    7981function ViaAds_pluginHandler()
    8082{
     83    // Security checks for settings update
    8184    if (isset($_POST['viaadsApiKeyUpdate'])) {
     85        // Verify user has permission to manage options
     86        if (!current_user_can('manage_options')) {
     87            return;
     88        }
     89
     90        // Verify nonce for CSRF protection
     91        if (!isset($_POST['viaads_settings_nonce']) ||
     92            !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['viaads_settings_nonce'])), 'viaads_update_settings')) {
     93            return;
     94        }
     95       
    8296        if (isset($_POST['viaadsApiKey'])) {
    8397            $name = "viaads_api_key";
    … …  
    108122    }
    109123
    110     if (!preg_match('/^[0-9A-F]{8}-[0-9A-F]{4}-4[0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i', $apiKey)) {
     124    if (!preg_match('/^[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}$/i', $apiKey)) {
    111125        add_action('admin_notices', 'ViaAds\\viaads_apikey_error_notice');
    112126        return false;
    … …  
    122136    ?>
    123137    <div class="error notice">
    124         <p><?php echo _e('The API Key provided is not of a valid format'); ?></p>
     138        <p><?php esc_html_e('The API Key provided is not of a valid format', 'viaads'); ?></p>
    125139    </div>
    126140    <?php
    … …  
    131145    ?>
    132146    <div class="updated notice">
    133         <p><?php echo _e('The settings is updated'); ?></p>
     147        <p><?php esc_html_e('The settings is updated', 'viaads'); ?></p>
    134148    </div>
    135149    <?php

  • viaads/trunk/endpoints.php

    r2996362 r3395777  
    8787                $deleteApiKey = $request->get_param('deleteApiKey');
    8888                if (isset($deleteApiKey)){
     89                    // Direct query required: WooCommerce API keys table has no WordPress wrapper function
    8990                    $wpdb->delete(
    9091                        "{$wpdb->prefix}woocommerce_api_keys",
    … …  
    9293                        array('%d')
    9394                    );
     95                    // Clear any related caches
     96                    wp_cache_delete('woocommerce_api_keys_' . $user_id, 'woocommerce');
    9497                }
    9598
    9699                //Check if user already have an api key
    97                 $user_keys = $wpdb->get_var(
    98                     $wpdb->prepare(
    99                         "SELECT COUNT(*) FROM {$wpdb->prefix}woocommerce_api_keys WHERE user_id = %d",
    100                         $user_id
    101                     )
    102                 );
     100                // Check cache first
     101                $cache_key = 'woocommerce_api_keys_count_' . $user_id;
     102                $user_keys = wp_cache_get($cache_key, 'woocommerce');
     103               
     104                if (false === $user_keys) {
     105                    // Direct query required: WooCommerce API keys table has no WordPress wrapper function
     106                    $user_keys = $wpdb->get_var(
     107                        $wpdb->prepare(
     108                            "SELECT COUNT(*) FROM {$wpdb->prefix}woocommerce_api_keys WHERE user_id = %d",
     109                            $user_id
     110                        )
     111                    );
     112                    // Cache the result for 1 hour
     113                    wp_cache_set($cache_key, $user_keys, 'woocommerce', HOUR_IN_SECONDS);
     114                }
    103115
    104116                //Check if any keys exists
    … …  
    118130                    );
    119131
     132                    // Direct query required: WooCommerce API keys table has no WordPress wrapper function
    120133                    $wpdb->insert(
    121134                        "{$wpdb->prefix}woocommerce_api_keys",
    … …  
    131144                        )
    132145                    );
     146                   
     147                    // Clear cache after insert
     148                    wp_cache_delete('woocommerce_api_keys_' . $user_id, 'woocommerce');
     149                    wp_cache_delete('woocommerce_api_keys_count_' . $user_id, 'woocommerce');
    133150
    134151
    … …  
    140157                    ViaAds_PostToUrl("https://integration.viaads.dk/woocommerce/ApiKey", $api_key_object, true);
    141158
    142                     print_r(json_encode($api_key_object));
    143                     echo "\r\n\r\n\r\n\r\n";
    144                     print_r(get_userdata( $user_id ));
    145                     echo "\r\n\r\n\r\n\r\n";
    146                     print_r($admin_role);
    147                     echo "\r\n\r\n\r\n\r\n";
    148                     print_r(get_role($groupName));
    149                     echo "\r\n\r\n\r\n\r\n";
    150 
    151159                    return new WP_REST_Response('Created user', 200);
    152160                }
    … …  
    156164                $error_object->Error = $e->getMessage();
    157165
    158                 $currentPageUrl = sanitize_url(home_url($_SERVER['REQUEST_URI']));
     166                $currentPageUrl = sanitize_url(home_url(sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'] ?? ''))));
    159167                $error_object->Url = wp_http_validate_url($currentPageUrl);
    160168

  • viaads/trunk/hooks/addCart.php

    r3019790 r3395777  
    2828            return;
    2929        }
    30         $cookieValues = json_decode(base64_decode($_COOKIE['via_ads']));
     30        $cookieValues = json_decode(base64_decode(sanitize_text_field(wp_unslash($_COOKIE['via_ads']))));
    3131        if (!$cookieValues->Consent) {
    3232            return;
    … …  
    3737        //ClientInfo
    3838        $clientInfo = new stdClass();
    39         $clientInfo->ip = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
     39        $clientInfo->ip = isset($_SERVER['HTTP_X_FORWARDED_FOR'])
     40            ? sanitize_text_field(wp_unslash($_SERVER['HTTP_X_FORWARDED_FOR']))
     41            : sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'] ?? ''));
    4042
    4143
    … …  
    4850            $userAgent->device_name = $ua[ 'platform' ];
    4951            $userAgent->name = $ua[ 'name' ];
    50             $userAgent->original = sanitize_text_field($_SERVER[ 'HTTP_USER_AGENT' ]);
     52            $userAgent->original = sanitize_text_field(wp_unslash($_SERVER[ 'HTTP_USER_AGENT' ] ?? ''));
    5153            $userAgent->version = $ua[ 'version' ];
    5254            $data->user_agent = $userAgent;
    … …  
    5860
    5961        //Email
    60         global $current_user;
    61         get_currentuserinfo();
     62        $current_user = wp_get_current_user();
    6263        $email = strtolower(( string )$current_user->user_email);
    6364        $customer = new stdClass();
    … …  
    7374        //Thrid party cookies
    7475        if (isset($_COOKIE['via_ads2'])) {
    75             $cookieValues2 = json_decode(base64_decode($_COOKIE['via_ads2']));
     76            $cookieValues2 = json_decode(base64_decode(sanitize_text_field(wp_unslash($_COOKIE['via_ads2']))));
    7677            $customer->ViaAds2 = $cookieValues2->ViaAds ?? "";
    7778            $customer->Email2 = $cookieValues2->Email ?? "";
    … …  
    109110        $error_object->Error = $e->getMessage();
    110111       
    111         $currentPageUrl = sanitize_url( home_url( $_SERVER['REQUEST_URI'] ) );
     112        $currentPageUrl = sanitize_url( home_url( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ?? '' ) ) ) );
    112113        $error_object->Url = wp_http_validate_url($currentPageUrl);
    113114

  • viaads/trunk/hooks/orderHooks.php

    r2919840 r3395777  
    2323        }
    2424        if(isset($_COOKIE['via_ads'])) {
    25             $cookieValues = json_decode(base64_decode($_COOKIE['via_ads']));
     25            $cookieValues = json_decode(base64_decode(sanitize_text_field(wp_unslash($_COOKIE['via_ads']))));
    2626            if ($cookieValues->Consent) {
    2727                $cookieValues->Email = strtolower($order->get_billing_email());
    … …  
    167167        $error_object->Error = $e->getMessage();
    168168
    169         $currentPageUrl = sanitize_url(home_url($_SERVER['REQUEST_URI']));
     169        $currentPageUrl = sanitize_url(home_url(sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'] ?? ''))));
    170170        $error_object->Url = wp_http_validate_url($currentPageUrl);
    171171

  • viaads/trunk/hooks/pageLook.php

    r2996362 r3395777  
    2929            return;
    3030        }
    31         $cookieValues = json_decode(base64_decode($_COOKIE['via_ads']));
     31        $cookieValues = json_decode(base64_decode(sanitize_text_field(wp_unslash($_COOKIE['via_ads']))));
    3232        if (!$cookieValues->Consent) {
    3333            return;
    … …  
    3838        //ClientInfo
    3939        $clientInfo = new stdClass();
    40         $ip = sanitize_text_field($_SERVER['HTTP_X_FORWARDED_FOR']);
    41         $clientInfo->ip = $ip;
     40        $clientInfo->ip = isset($_SERVER['HTTP_X_FORWARDED_FOR'])
     41            ? sanitize_text_field(wp_unslash($_SERVER['HTTP_X_FORWARDED_FOR']))
     42            : sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'] ?? ''));
    4243
    4344        //User Agent
    … …  
    4950            $userAgent->device_name = $ua['platform'];
    5051            $userAgent->name = $ua['name'];
    51             $userAgent->original = sanitize_text_field($_SERVER['HTTP_USER_AGENT']);
     52            $userAgent->original = sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'] ?? ''));
    5253            $userAgent->version = $ua['version'];
    5354            $data->user_agent = $userAgent;
    … …  
    5960
    6061        //Email
    61         global $current_user;
    62         get_currentuserinfo();
     62        $current_user = wp_get_current_user();
    6363        $email = strtolower(( string )$current_user->user_email);
    6464        $customer = new stdClass();
    … …  
    7474        //Thrid party cookies
    7575        if (isset($_COOKIE['via_ads2'])) {
    76             $cookieValues2 = json_decode(base64_decode($_COOKIE['via_ads2']));
     76            $cookieValues2 = json_decode(base64_decode(sanitize_text_field(wp_unslash($_COOKIE['via_ads2']))));
    7777            $customer->ViaAds2 = $cookieValues2->ViaAds ?? "";
    7878            $customer->Email2 = $cookieValues2->Email ?? "";
    … …  
    108108        $error_object->Error = $e->getMessage();
    109109
    110         $currentPageUrl = sanitize_url(home_url($_SERVER['REQUEST_URI']));
     110        $currentPageUrl = sanitize_url(home_url(sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'] ?? ''))));
    111111        $error_object->Url = wp_http_validate_url($currentPageUrl);
    112112

  • viaads/trunk/hooks/productHooks.php

    r3120016 r3395777  
    2828        $error_object->Error = $e->getMessage();
    2929
    30         $currentPageUrl = sanitize_url(home_url($_SERVER['REQUEST_URI']));
     30        $currentPageUrl = sanitize_url(home_url(sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'] ?? ''))));
    3131        $error_object->Url = wp_http_validate_url($currentPageUrl);
    3232

  • viaads/trunk/hooks/removeCart.php

    r2996362 r3395777  
    3131            return;
    3232        }
    33         $cookieValues = json_decode(base64_decode($_COOKIE['via_ads']));
     33        $cookieValues = json_decode(base64_decode(sanitize_text_field(wp_unslash($_COOKIE['via_ads']))));
    3434        if (!$cookieValues->Consent) {
    3535            return;
    … …  
    4040        //ClientInfo
    4141        $clientInfo = new stdClass();
    42         $ip = sanitize_text_field($_SERVER['HTTP_X_FORWARDED_FOR']);
    43         $clientInfo->ip = $ip;
     42        $clientInfo->ip = isset($_SERVER['HTTP_X_FORWARDED_FOR'])
     43            ? sanitize_text_field(wp_unslash($_SERVER['HTTP_X_FORWARDED_FOR']))
     44            : sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'] ?? ''));
    4445
    4546        //User Agent
    … …  
    5152            $userAgent->device_name = $ua['platform'];
    5253            $userAgent->name = $ua['name'];
    53             $userAgent->original = $_SERVER['HTTP_USER_AGENT'];
     54            $userAgent->original = sanitize_text_field(wp_unslash($_SERVER['HTTP_USER_AGENT'] ?? ''));
    5455            $userAgent->version = $ua['version'];
    5556            $data->user_agent = $userAgent;
    … …  
    6162
    6263        //Email
    63         global $current_user;
    64         get_currentuserinfo();
     64        $current_user = wp_get_current_user();
    6565        $email = strtolower(( string )$current_user->user_email);
    6666        $customer = new stdClass();
    … …  
    7676        //Thrid party cookies
    7777        if (isset($_COOKIE['via_ads2'])) {
    78             $cookieValues2 = json_decode(base64_decode($_COOKIE['via_ads2']));
     78            $cookieValues2 = json_decode(base64_decode(sanitize_text_field(wp_unslash($_COOKIE['via_ads2']))));
    7979            $customer->ViaAds2 = $cookieValues2->ViaAds ?? "";
    8080            $customer->Email2 = $cookieValues2->Email ?? "";
    … …  
    113113        $error_object->Error = $e->getMessage();
    114114
    115         $currentPageUrl = sanitize_url(home_url($_SERVER['REQUEST_URI']));
     115        $currentPageUrl = sanitize_url(home_url(sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'] ?? ''))));
    116116        $error_object->Url = wp_http_validate_url($currentPageUrl);
    117117

  • viaads/trunk/readme.txt

    r3236781 r3395777  
    1 === Plugin Name ===
     1=== ViaAds ===
    22Contributors: @viaads
    33Tags: ViaAds, ViaBill
    44Requires at least: 5.4
    5 Tested up to: 6.7
    6 Stable tag: 2.1.1
     5Tested up to: 6.8
     6Stable tag: 2.1.3
    77Requires PHP: 7.0
    8 License: GPLv3
    9 License URI: https://www.gnu.org/licenses/gpl-3.0.html
     8License: GPL v2 or later
     9License URI: https://www.gnu.org/licenses/gpl-2.0.html
    1010
    1111ViaAds plugin enables order and behavior-based marketing solution for ViaBill merchants.

  • viaads/trunk/userAgent.php

    r2876443 r3395777  
    66
    77function ViaAds_getBrowser() {
    8     $u_agent = sanitize_text_field($_SERVER[ 'HTTP_USER_AGENT' ]);
     8    $u_agent = sanitize_text_field(wp_unslash($_SERVER[ 'HTTP_USER_AGENT' ] ?? ''));
    99    $bname = 'Unknown';
    1010    $platform = 'Unknown';

  • viaads/trunk/viaads.php

    r3236781 r3395777  
    33 * Plugin Name: ViaAds
    44 * Description: Plugin der muliggør forbindelsen til ViaAds / Plug-in enabling the connection to ViaAds.
    5  * Version: 2.1.1
     5 * Version: 2.1.3
    66 * Author: ViaAds
    77 * Author URI: https://www.viaads.dk/
    … …  
    5454    $user_id = username_exists("ViaAds");
    5555    global $wpdb;
    56     //Delete keys
     56    //Delete keys - Direct query required: WooCommerce API keys table has no WordPress wrapper function
    5757    $wpdb->delete(
    5858        "{$wpdb->prefix}woocommerce_api_keys",
    … …  
    6060        array('%d')
    6161    );
     62    // Clear any related caches
     63    wp_cache_delete('woocommerce_api_keys_' . $user_id, 'woocommerce');
    6264    //Delete user
    6365    wp_delete_user($user_id);
Note: See TracChangeset for help on using the changeset viewer.