WordPress.org
Get WordPress

Plugin Directory

Changeset 3425729


Ignore:
Timestamp:
12/23/2025 02:02:22 AM (3 months ago)
Author:
kasuga16
Message:

Security fix: Moved spam logs to a non-public directory

Location:
stickeasy-protected-contact-form
Files:
11 added
5 edited

Legend:

Unmodified
Added
Removed

  • stickeasy-protected-contact-form/trunk/languages/stickeasy-protected-contact-form-ja.po

    r3400723 r3425729  
    11msgid ""
    22msgstr ""
    3 "Project-Id-Version: StickEasy Protected Contact Form 1.0.0\n"
     3"Project-Id-Version: StickEasy Protected Contact Form 1.0.1\n"
    44"Report-Msgid-Bugs-To: \n"
    5 "POT-Creation-Date: 2025-11-20 02:54:38+0000\n"
    6 "PO-Revision-Date: 2025-11-20 03:01:23+0000\n"
     5"POT-Creation-Date: 2025-12-23 01:36:13+0000\n"
     6"PO-Revision-Date: 2025-12-23 01:37:05+0000\n"
    77"Last-Translator: Kasuga\n"
    88"Language-Team: \n"
    … …  
    185185msgstr "ログをクリア"
    186186
    187 msgid "Log is stored in %s."
    188 msgstr "ログは %s に保存されています。"
    189 

  • stickeasy-protected-contact-form/trunk/languages/stickeasy-protected-contact-form.pot

    r3400723 r3425729  
    11msgid ""
    22msgstr ""
    3 "Project-Id-Version: StickEasy Protected Contact Form 1.0.0\n"
     3"Project-Id-Version: StickEasy Protected Contact Form 1.0.1\n"
    44"Report-Msgid-Bugs-To: \n"
    5 "POT-Creation-Date: 2025-11-20 02:54:38+0000\n"
     5"POT-Creation-Date: 2025-12-23 01:36:13+0000\n"
    66"PO-Revision-Date: \n"
    77"Last-Translator: \n"
    … …  
    185185msgstr ""
    186186
    187 msgid "Log is stored in %s."
    188 msgstr ""
    189 

  • stickeasy-protected-contact-form/trunk/readme.txt

    r3418199 r3425729  
    55Tested up to: 6.9
    66Requires PHP: 7.4
    7 Stable tag: 1.0.0
     7Stable tag: 1.0.1
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    105105
    106106== Changelog ==
     107= 1.0.1 =
     108* Security fix: Moved spam logs to a non-public directory.
     109
    107110= 1.0.0 =
    108111* Initial Release.

  • stickeasy-protected-contact-form/trunk/stickeasy-protected-contact-form.php

    r3400723 r3425729  
    33 * Plugin Name: StickEasy Protected Contact Form
    44 * Description: Just drop the shortcode on any page — your super simple, spam-protected contact form is ready!
    5  * Version: 1.0.0
     5 * Version: 1.0.1
    66 * Author: Kasuga
    77 * License: GPLv2 or later
    … …  
    149149
    150150/**
    151  * Get the path to the log file (inside uploads).
     151 * Get the path to the log file (non-public directory).
    152152 *
    153153 * @return string Log file path.
    154154 */
    155155function spcf_get_log_file_path() {
    156     $upload_dir = wp_upload_dir();
    157     $log_dir    = trailingslashit( $upload_dir['basedir'] ) . 'stickeasy-protected-contact-form';
     156    $log_dir = WP_CONTENT_DIR . '/spcf-logs';
    158157
    159158    if ( spcf_init_filesystem() ) {
    … …  
    161160
    162161        if ( ! $wp_filesystem->is_dir( $log_dir ) ) {
    163 
    164             if ( ! $wp_filesystem->mkdir( $log_dir ) ) {
    165                 wp_mkdir_p( $log_dir );
    166             }
     162            $wp_filesystem->mkdir( $log_dir );
    167163        }
    168164    } else {
    … …  
    666662            <?php wp_nonce_field( 'spcf_settings_nonce' ); ?> <textarea readonly rows="12" style="width:100%; font-family:monospace;"><?php echo esc_textarea( $log_display ); ?></textarea>
    667663            <input type="submit" name="spcf_clear_log" class="button" value="<?php esc_attr_e( 'Clear Log', 'stickeasy-protected-contact-form' ); ?>">
    668             <p class="description">
    669                 <?php
    670                 printf(
    671                     /* translators: %s: Directory path where the log file is stored, relative to the WordPress root directory. */
    672                     esc_html__( 'Log is stored in %s.', 'stickeasy-protected-contact-form' ),
    673                     esc_html( str_replace( ABSPATH, '', dirname( spcf_get_log_file_path() ) ) )
    674                 );
    675                 ?>
    676             </p>
    677664        </form>
    678665    </div>
    … …  
    687674    delete_option( 'spcf_options' );
    688675
    689     $upload_dir = wp_upload_dir();
    690     $log_dir    = trailingslashit( $upload_dir['basedir'] ) . 'stickeasy-protected-contact-form';
    691     $logfile    = trailingslashit( $log_dir ) . 'spcf-log.txt';
     676    $log_dir = WP_CONTENT_DIR . '/spcf-logs';
     677    $logfile = trailingslashit( $log_dir ) . 'spcf-log.txt';
    692678
    693679    if ( spcf_init_filesystem() ) {
    694680        global $wp_filesystem;
     681
    695682        if ( $wp_filesystem->exists( $logfile ) ) {
    696683            $wp_filesystem->delete( $logfile );
    697684        }
     685
    698686        if ( $wp_filesystem->is_dir( $log_dir ) ) {
    699687            $wp_filesystem->rmdir( $log_dir, true );
Note: See TracChangeset for help on using the changeset viewer.