WordPress.org
Get WordPress

Plugin Directory

Changeset 3402164


Ignore:
Timestamp:
11/25/2025 02:53:23 AM (4 months ago)
Author:
era404
Message:

Added more sanitization, as recommended by Wordfence (thank you)

Location:
stafflist/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • stafflist/trunk/readme.txt

    r3245912 r3402164  
    103103
    104104== Changelog ==
     105= 3.2.7 =
     106* Added more sanitization, as recommended by Wordfence (thank you);
     107
    105108= 3.2.6 =
    106109* Fixed deprecation warnings that appeared in PHP8+, found by @thomasprice61 (thank you);

  • stafflist/trunk/stafflist.php

    r3245912 r3402164  
    44Plugin URI: http://wordpress.org/plugins/stafflist/
    55Description: A super simplified staff directory tool
    6 Version: 3.2.6
     6Version: 3.2.7
    77Author: era404
    88Author URI: http://www.era404.com
    … …  
    292292
    293293    global  $stafflisturl;
    294             $stafflisturl = STAFFLIST_URL . ($w ? "&search=".esc_attr($w) : "") . ($s ? "&s=".esc_attr($s) : "");
     294            $stafflisturl = wp_nonce_url(STAFFLIST_URL . ($w ? "&search=".esc_attr($w) : "") . ($s ? "&s=".esc_attr($s) : ""));
    295295    echo renderAdminPager($pg);
    296296   
    … …  
    438438        if($col['active']== 1) {
    439439            $cname = ($col['id']>5 ? $col['name'] : $std[ $col['name'] ]);
    440             echo "<li class='ui-state-default' id='col{$col['id']}'>{$cname}</li>";
     440            echo "<li class='ui-state-default' id='col{$col['id']}'>".esc_html($cname)."</li>";
    441441        }
    442442    }
    … …  
    448448        if($col['active']== -1) {
    449449            $cname = ($col['id']>5 ? $col['name'] : $std[ $col['name'] ]);
    450             echo "<li class='ui-state-highlight' id='col{$col['id']}'>{$cname}</li>";
     450            echo "<li class='ui-state-highlight' id='col{$col['id']}'>".esc_html($cname)."</li>";
    451451        }
    452452    }
    … …  
    458458        if($col['active'] == 0) {
    459459            $cname = ($col['id']>5 ? $col['name'] : $std[ $col['name'] ]);
    460             echo "<li class='ui-state-highlight' id='col{$col['id']}'>{$cname}</li>";
     460            echo "<li class='ui-state-highlight' id='col{$col['id']}'>".esc_html($cname)."</li>";
    461461        }
    462462    }
    … …  
    535535    if($pg[0]<1 || $last<2) return("");
    536536    //previous
    537     $html = ($cur > 1 ? "<p class='pager'><a href='{$stafflisturl}&p=".($cur-1)."'>Previous </a></p>" : "");
     537    $html = ($cur > 1 ? "<p class='pager'><a href='".wp_nonce_url("{$stafflisturl}&p=".($cur-1))."'>Previous </a></p>" : "");
    538538    //pages
    539539    if($cur<=3){
    … …  
    554554    }
    555555    //next
    556     $html .= (($cur < $pg[2] && $pg[2] > 1) ? "<p class='pager'><a href='{$stafflisturl}&p=".($cur+1)."'> Next</a></p>" : ""); //>
     556    $html .= (($cur < $pg[2] && $pg[2] > 1) ? "<p class='pager'><a href='".wp_nonce_url("{$stafflisturl}&p=".($cur+1))."'> Next</a></p>" : ""); //>
    557557    //page numbering
    558558    $html .= "<div class='pageNum'>Page: ".($pg[3])." ( ".($pg[4]+1)."-".($pg[5]+1)." of ".($pg[0])." )</div>";
    … …  
    561561function renderAdminPage($style, $page){
    562562    global $stafflisturl; //includes search
    563     return("<p class='pager{$style}'>".(is_numeric($page)?"<a href='{$stafflisturl}&p={$page}'>{$page}</a>":$page)."</p>");
     563    return("<p class='pager{$style}'>".(is_numeric($page)?"<a href='".wp_nonce_url("{$stafflisturl}&p={$page}")."'>{$page}</a>":$page)."</p>");
    564564}
    565565/***********************************************************************************
    … …  
    872872
    873873        //build query from passed vars
    874         $fval =     (string) stripslashes($_POST['fval']);
     874        $fval =     (string) sanitize_text_field(stripslashes($_POST['fval']));
    875875        $fname =    (string) stripslashes($_POST['fname'][0]);
    876876        $id =       (int)    stripslashes($_POST['fname'][1]);
Note: See TracChangeset for help on using the changeset viewer.