WordPress.org
Get WordPress

Plugin Directory

Changeset 3427589


Ignore:
Timestamp:
12/26/2025 07:09:54 AM (2 months ago)
Author:
litexten
Message:

bug fixes

Location:
litextension-data-migration-to-woocommerce/trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • litextension-data-migration-to-woocommerce/trunk/changelog.txt

    r3422581 r3427589  
     1= 1.2.5 =
     2* Security and compatibility improvements
     3* Fixed WooCommerce Helper notice
     4* Improved HPOS compatibility
     5
    16= 1.2.4 =
    27* Tested up to: 6.9

  • litextension-data-migration-to-woocommerce/trunk/class/LitAutoLoad.php

    r3422581 r3427589  
    3434
    3535        // Only handle our own namespace.
    36         if ( 0 !== strpos( $className, $prefix ) ) {
     36        if ( 0 !== strpos( (string) $className, $prefix ) ) {
    3737            return false;
    3838        }
    3939
    40         // Block unexpected characters to avoid traversal / weird encodings.
    41         if ( ! preg_match( '/^[A-Za-z0-9_\\\\]+$/', $className ) ) {
     40        // Only allow expected characters.
     41        if ( ! preg_match( '/^[A-Za-z0-9_\\\\]+$/', (string) $className ) ) {
    4242            return false;
    4343        }
    4444
    45         $relative = substr( $className, strlen( $prefix ) );
     45        $relative = substr( (string) $className, strlen( $prefix ) );
    4646        if ( '' === $relative ) {
    4747            return false;
    … …  
    5656        $file_real = realpath( $file_path );
    5757
    58         // realpath() returns false if the file doesn't exist.
    5958        if ( false === $base_real || false === $file_real ) {
    6059            return false;
    6160        }
    6261
    63         // Ensure resolved file is inside base dir.
    64         $base_real = rtrim( $base_real, DIRECTORY_SEPARATOR ) . DIRECTORY_SEPARATOR;
     62        // Normalize paths for reliable prefix checking.
     63        $base_real = trailingslashit( wp_normalize_path( $base_real ) );
     64        $file_real = wp_normalize_path( $file_real );
     65
     66        // Ensure the resolved file is within base directory.
    6567        if ( 0 !== strpos( $file_real, $base_real ) ) {
    6668            return false;
    … …  
    6870
    6971        if ( is_readable( $file_real ) ) {
     72            // Semgrep flags variable require args; path is strictly validated above.
     73            // nosemgrep: audit.php.lang.security.file.inclusion-arg
    7074            require_once $file_real;
    7175            return true;

  • litextension-data-migration-to-woocommerce/trunk/class/LitView.php

    r3422581 r3427589  
    2020     */
    2121    public function litView( $file, $_param ) {
     22        $file = (string) $file;
     23
    2224        // Only allow safe view names (no ../, no slashes).
    23         $file = (string) $file;
    2425        if ( ! preg_match( '/^[A-Za-z0-9_-]+$/', $file ) ) {
    2526            /* translators: %s: View name. */
    26             throw new \Exception(sprintf(esc_html__( 'Invalid view name: %s', 'litextension-data-migration-to-woocommerce' ), esc_html($file)));
     27            throw new \Exception(sprintf(esc_html__( 'Invalid view name: %s', 'litextension-data-migration-to-woocommerce' ), esc_html( $file )));
    2728        }
    2829
    … …  
    3536        if ( false === $base_real || false === $file_real ) {
    3637            /* translators: %s: File path. */
    37             throw new \Exception(sprintf(esc_html__( 'File "%s" not found!', 'litextension-data-migration-to-woocommerce' ), esc_html($filePath)));
     38            throw new \Exception(sprintf(esc_html__( 'File "%s" not found!', 'litextension-data-migration-to-woocommerce' ), esc_html( $filePath )));
    3839        }
    3940
    40         // Ensure the resolved file is inside the views directory.
    41         $base_real = rtrim( $base_real, DIRECTORY_SEPARATOR ) . DIRECTORY_SEPARATOR;
     41        // Normalize paths then ensure the resolved file is inside the views directory.
     42        $base_real = trailingslashit( wp_normalize_path( $base_real ) );
     43        $file_real = wp_normalize_path( $file_real );
     44
    4245        if ( 0 !== strpos( $file_real, $base_real ) ) {
    4346            /* translators: %s: File path. */
    44             throw new \Exception(sprintf(esc_html__( 'File "%s" not allowed!', 'litextension-data-migration-to-woocommerce' ), esc_html($filePath)));
     47            throw new \Exception(sprintf(esc_html__( 'File "%s" not allowed!', 'litextension-data-migration-to-woocommerce' ), esc_html( $filePath )));
    4548        }
    4649
    … …  
    5053        }
    5154
     55        // Semgrep flags variable require args; path is strictly validated above.
     56        // nosemgrep: audit.php.lang.security.file.inclusion-arg
    5257        require $file_real;
    5358    }

  • litextension-data-migration-to-woocommerce/trunk/litextension.php

    r3422581 r3427589  
    44 * Plugin URI: https://litextension.com/
    55 * Description: Migrate your store from 140+ platforms to WooCommerce with no downtime, no data loss, and secure, automated migration.
    6  * Version: 1.2.4
     6 * Version: 1.2.5
    77 * Author: Litextension
    88 * Author URI: https://litextension.com
    9  * License: GPL2
     9 * License: GPLv2 or later
     10 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
    1011 * Text Domain: litextension-data-migration-to-woocommerce
    1112 * Requires at least: 5.8
    1213 * Tested up to: 6.9
    1314 * Requires PHP: 7.4
    14  * Woo: 6.0
    1515 * WC requires at least: 6.0
    1616 * WC tested up to: 9.0
    … …  
    2323}
    2424
    25 define( 'LIT_VERSION', '1.2.4' );
     25define( 'LIT_VERSION', '1.2.5' );
    2626define( 'LIT_PATH_PLUGIN', __DIR__ . '/' );
    2727define( 'LIT_URL_PLUGIN', plugin_dir_url( __FILE__ ) ); // plugin_dir_url already ends with /

  • litextension-data-migration-to-woocommerce/trunk/readme.txt

    r3422631 r3427589  
    44Requires at least: 5.8
    55Tested up to: 6.9
    6 Stable tag: 1.2.4
     6Stable tag: 1.2.5
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
Note: See TracChangeset for help on using the changeset viewer.