WordPress.org
Get WordPress

Plugin Directory

Changeset 3424572


Ignore:
Timestamp:
12/21/2025 10:41:48 AM (3 months ago)
Author:
mkernel
Message:

update 2.3.2

Location:
grid/trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • grid/trunk/lib/grid/classes/Editor.php

    r3351302 r3424572  
    1313
    1414    public Storage $storage;
    15     public string $url;
     15    public string $url;
     16    private iHook $hook;
    1617
    1718    /**
    … …  
    2122     * @param string $urlBasePath url path to library dir
    2223     */
    23     public function __construct( Storage $storage, string $urlBasePath ) {
     24    public function __construct( Storage $storage, string $urlBasePath, iHook $hook ) {
    2425        $this->storage = $storage;
    2526        $this->url = $urlBasePath;
     27        $this->hook=$hook;
    2628    }
    2729
    … …  
    156158
    157159    public function getStyleEditor() {
    158         return new StyleEditor( $this->storage );
     160        return new StyleEditor( $this->storage,$this->hook );
    159161    }
    160162

  • grid/trunk/lib/grid/classes/StyleEditor.php

    r3351302 r3424572  
    1212
    1313    public Storage $storage;
    14    
    15     public function __construct(Storage $storage){
    16         $this->storage = $storage;
     14    private iHook $hook;
     15
     16    public function __construct(Storage $storage, iHook $hook){
     17    $this->storage = $storage;
     18    $this->hook = $hook;
    1719    }
    1820
    … …  
    2123        if(isset($_POST) && !empty($_POST))
    2224        {
     25            $this->hook->fire('styles_editor_post',$_POST);
    2326            foreach($_POST['container_styles'] as $idx=>$data)
    2427            {
    … …  
    9497</style>
    9598<div class="grid-style-editor">
    96 <form method="post">
     99    <form method="post">
     100        <?php $this->hook->fire('grid_editor_styles_get',null); ?>
    97101<p>Container Styles</p>
    98102<table>

  • grid/trunk/readme.txt

    r3351302 r3424572  
    55Requires at least: 4.0
    66Tested up to: 5.9.3
    7 Stable tag: 2.3.1
     7Stable tag: 2.3.2
    88License: GPLv3
    99License URI: http://www.gnu.org/licenses/gpl
    … …  
    8989== Changelog ==
    9090
     91= 2.3.2 =
     92
     93* Fix: prevents XSS attack on styles editor form
     94
    9195= 2.3.1 =
    9296
    93 * Fixed a XSS vulnerability
    94 * fixed some deprecation warnings
     97* Fix: prevented injection of JavaScript on the styles form into the database
    9598
    9699= 2.3.0 =

  • grid/trunk/vendor/composer/installed.php

    r3351302 r3424572  
    44        'pretty_version' => 'dev-master',
    55        'version' => 'dev-master',
    6         'reference' => '5f58f47222ffcd2b294d0a018ca7872794142929',
     6        'reference' => '9bdb1dc2022cba13d5bc75b92ab1502e693b0a33',
    77        'type' => 'library',
    88        'install_path' => __DIR__ . '/../../',
    … …  
    1414            'pretty_version' => 'dev-master',
    1515            'version' => 'dev-master',
    16             'reference' => '5f58f47222ffcd2b294d0a018ca7872794142929',
     16            'reference' => '9bdb1dc2022cba13d5bc75b92ab1502e693b0a33',
    1717            'type' => 'library',
    1818            'install_path' => __DIR__ . '/../../',

  • grid/trunk/wordpress_plugin.php

    r3351302 r3424572  
    44 * Plugin URI: https://github.com/palasthotel/grid-wordpress
    55 * Description: Helps layouting pages with containerist.
    6  * Version: 2.3.1
     6 * Version: 2.3.2
    77 * Author: Palasthotel <rezeption@palasthotel.de> (in person: Benjamin Birkenhake, Edward Bock, Enno Welbers, Jana Marie Eggebrecht)
    88 * Author URI: http://www.palasthotel.de
    … …  
    125125        $this->gridEditor   = new Editor(
    126126            $this->gridCore->storage,
    127             $this->url."/lib/grid/"
     127            $this->url."/lib/grid/",
     128            $this->gridHook
    128129        );
    129130
    … …  
    198199        add_action( 'pre_get_posts', 'grid_enable_front_page_landing_page' );
    199200
     201        add_action( 'grid_grid_editor_styles_get',array($this,'styles_nonce'));
     202        add_action( 'grid_styles_editor_post', array($this,'styles_checknonce'));
    200203        // ------------------------------------
    201204        // uninstall
    202205        // ------------------------------------
    203206        register_uninstall_hook( __FILE__, array( __CLASS__, 'uninstall' ) );
     207    }
     208
     209    public function styles_checknonce($data) {
     210        if(!isset($data['_wpnonce']) || ! wp_verify_nonce($data['_wpnonce'])) {
     211            die("invalid nonce.");
     212        }
     213    }
     214
     215    public function styles_nonce() {
     216        echo wp_nonce_field();
    204217    }
    205218
Note: See TracChangeset for help on using the changeset viewer.