WordPress.org
Get WordPress

Plugin Directory

Changeset 3405892


Ignore:
Timestamp:
11/29/2025 05:12:29 PM (4 months ago)
Author:
foomagoo
Message:

Fixed possible SQL injection on the plugin search page

Location:
plugin-organizer
Files:
33 added
5 edited

Legend:

Unmodified
Added
Removed

  • plugin-organizer/trunk/lib/PO_Ajax.class.php

    r3265047 r3405892  
    517517       
    518518        $postIDsQuery = "SELECT post_id FROM ".$wpdb->prefix."po_plugins WHERE post_type != 'plugin_filter' AND post_id != 0 AND permalink NOT LIKE [ESC_LIKE] GROUP BY post_id";
    519         $postIDsQuery = preg_replace('/\[ESC_LIKE\]/', "'".$wpdb->esc_like($newSiteAddress)."%'", $postIDsQuery);
     519        $postIDsQuery = preg_replace('/\[ESC_LIKE\]/', "'".esc_sql($newSiteAddress)."%'", $postIDsQuery);
    520520       
    521521        $postIDs = $wpdb->get_results($postIDsQuery, ARRAY_A);
    … …  
    983983       
    984984        $sql = $this->PO->prepare_in("SELECT COUNT(*) FROM ".$wpdb->prefix."po_plugins WHERE post_type='global_plugin_lists' AND post_id=0 AND user_role IN ([R_IN]) AND (disabled_plugins LIKE [ESC_LIKE] OR disabled_mobile_plugins LIKE [ESC_LIKE]".$groupSearch.")", $availableRoles, '[R_IN]');
    985         $sql = preg_replace('/\[ESC_LIKE\]/', "'%".$wpdb->esc_like($postedPluginPath)."%'", $sql);
     985        $sql = preg_replace('/\[ESC_LIKE\]/', "'%".esc_sql($postedPluginPath)."%'", $sql);
    986986        $pluginSearchResult = $wpdb->get_var($sql);
    987987
    … …  
    991991       
    992992        $sql = $this->PO->prepare_in("SELECT COUNT(*) FROM ".$wpdb->prefix."po_plugins WHERE post_type='search_plugin_lists' AND post_id=0 AND user_role IN ([R_IN]) AND (disabled_plugins LIKE [ESC_LIKE] OR disabled_mobile_plugins LIKE [ESC_LIKE]".$groupSearch.")", $availableRoles, '[R_IN]');
    993         $sql = preg_replace('/\[ESC_LIKE\]/', "'%".$wpdb->esc_like($postedPluginPath)."%'", $sql);
     993        $sql = preg_replace('/\[ESC_LIKE\]/', "'%".esc_sql($postedPluginPath)."%'", $sql);
    994994        $pluginSearchResult = $wpdb->get_var($sql);
    995995
    … …  
    999999
    10001000        $sql = $this->PO->prepare_in("SELECT post_id FROM ".$wpdb->prefix."po_plugins WHERE post_id!=0 AND user_role IN ([R_IN]) AND (disabled_plugins LIKE [ESC_LIKE] OR disabled_mobile_plugins LIKE [ESC_LIKE]".$groupSearch.") GROUP BY post_id", $availableRoles, '[R_IN]');
    1001         $sql = preg_replace('/\[ESC_LIKE\]/', "'%".$wpdb->esc_like($postedPluginPath)."%'", $sql);
     1001        $sql = preg_replace('/\[ESC_LIKE\]/', "'%".esc_sql($postedPluginPath)."%'", $sql);
    10021002        $pluginSearchResult = $wpdb->get_var($sql);
    10031003        $pluginSearchResult = $wpdb->get_results($sql, ARRAY_A);

  • plugin-organizer/trunk/lib/PluginOrganizer.class.php

    r3265047 r3405892  
    246246        global $pagenow;
    247247        ##Check version and activate if needed.
    248         if (get_option("PO_version_num") != "10.2.3" && !in_array($pagenow, array("plugins.php", "update-core.php", "update.php"))) {
     248        if (get_option("PO_version_num") != "10.2.4" && !in_array($pagenow, array("plugins.php", "update-core.php", "update.php"))) {
    249249            $this->activate();
    250250        }
    … …  
    562562        }
    563563       
    564         if (get_option("PO_version_num") != "10.2.3") {
    565             update_option("PO_version_num", "10.2.3");
     564        if (get_option("PO_version_num") != "10.2.4") {
     565            update_option("PO_version_num", "10.2.4");
    566566        }
    567567

  • plugin-organizer/trunk/lib/PluginOrganizerMU.class.php

    r3265047 r3405892  
    44Plugin URI: https://www.sterup.com/wordpress-plugins/plugin-organizer/
    55Description: A plugin for specifying the load order of your plugins.
    6 Version: 10.2.3
     6Version: 10.2.4
    77Author: Jeff Sterup
    88Author URI: https://www.sterup.com
    … …  
    8080           
    8181            $this->set_requested_permalink();
    82             if (get_option('PO_updating_plugin') != '1' && get_option("PO_version_num") != "10.2.3") {
     82            if (get_option('PO_updating_plugin') != '1' && get_option("PO_version_num") != "10.2.4") {
    8383                $newPluginList = $pluginList;
    84                 $this->adminMsg[] = '<strong>WARNING:</strong> Selective plugin loading for Plugin Organizer has been disabled because the version numbers of the MU plugin and the standard plugin don\'t match.<br />The current version number returned from the database is '.get_option("PO_version_num").' and the current MU plugin version number is 10.2.3.<br />If you are using a caching plugin try clearing the cache.';
     84                $this->adminMsg[] = '<strong>WARNING:</strong> Selective plugin loading for Plugin Organizer has been disabled because the version numbers of the MU plugin and the standard plugin don\'t match.<br />The current version number returned from the database is '.get_option("PO_version_num").' and the current MU plugin version number is 10.2.4.<br />If you are using a caching plugin try clearing the cache.';
    8585            } else {
    8686                $sql = "SELECT disabled_plugins, disabled_mobile_plugins, disabled_groups, disabled_mobile_groups FROM ".$wpdb->prefix."po_plugins WHERE post_type='global_plugin_lists' AND post_id=0";

  • plugin-organizer/trunk/plugin-organizer.php

    r3265047 r3405892  
    44Plugin URI: https://www.sterup.com/wordpress-plugins/plugin-organizer/
    55Description: A plugin to disable plugins on indivudual pages and change the order that they are loaded in.
    6 Version: 10.2.3
     6Version: 10.2.4
    77Author: Jeff Sterup
    88Author URI: https://www.sterup.com

  • plugin-organizer/trunk/readme.txt

    r3265047 r3405892  
    44Tags: plugin organizer, plugin load order, disable plugins by post or page, turn off plugins for post or page
    55Requires at least: 4.6.0
    6 Tested up to: 6.8
    7 Stable tag: 10.2.3
     6Tested up to: 6.9
     7Stable tag: 10.2.4
    88License: GPLv2
    99
    … …  
    121121== Changelog ==
    122122
     123= 10.2.4 =
     124Fixed possible SQL injection on the plugin search page.
     125
    123126= 10.2.3 =
    124127Removed all references to WP Spamshield since the plugin no longer exists and is no longer a threat to Plugin Organizer users
    … …  
    322325== Upgrade Notice ==
    323326
    324 = 10.2.3 =
    325 Removed all references to WP Spamshield since the plugin no longer exists and is no longer a threat to Plugin Organizer users
    326 Fixed a few typos in the settings help text
    327 Moved debug messages to the browser console to prevent display problems
    328 Removed custom CSS settings because they are no longer needed with console debug messages
     327= 10.2.4 =
     328Fixed possible SQL injection on the plugin search page.
Note: See TracChangeset for help on using the changeset viewer.