Context Navigation

Changeset 3434947

Timestamp:

01/08/2026 08:23:34 AM (3 months ago)

Author:

yocoadmin

Message:

Update to version 3.9.1 from Gitlab

Location:

yoco-payment-gateway

Files:

-                      r3434365
+                      r3434947
 Tested up to: 6.9
 Requires PHP: 7.4.0
 Stable tag: 3.9.0
+Stable tag: 3.9.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 == Changelog ==
+= 3.9.1 =
+Bug Fixes
+* Added validation to ensure files meet specific format and naming requirements.
+* Enhanced input sanitization for file parameter handling.
+* Implemented path normalization with comprehensive directory boundary verification.
+* Improved file accessibility and readability checks before processing.
 = 3.9.0 =
 * Add First and Last Name validation in checkout for both Legacy and Blocks to ensure compatibility with Yoco payment gateway.

-                      r3434365
+                      r3434947
     public function callback( WP_REST_Request $request ): WP_REST_Response {
         $file = (string) $request->get_param( 'file' );
+        $file = sanitize_file_name( $request->get_param( 'file' ) );
+        if ( '' === $file ) {
+        // Allow only files that start with yoco and have .log extension.
+        if ( '' === $file || '.log' !== substr( $file, -4 ) || 'yoco' !== substr( $file, 0, 4 ) ) {
             return new WP_REST_Response(
                 array( 'message' => 'Not found' ),
 …
+        }
         // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
         $log_data = file_get_contents( WC_LOG_DIR . $request->get_param( 'file' ) ); // NOSONAR
+        $log_data = file_get_contents( $target ); // NOSONAR
         add_filter(

-                      r3434365
+                      r3434947
 Tested up to: 6.9
 Requires PHP: 7.4.0
 Stable tag: 3.9.0
+Stable tag: 3.9.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 == Changelog ==
+= 3.9.1 =
+Bug Fixes
+* Added validation to ensure files meet specific format and naming requirements.
+* Enhanced input sanitization for file parameter handling.
+* Implemented path normalization with comprehensive directory boundary verification.
+* Improved file accessibility and readability checks before processing.
 = 3.9.0 =
 * Add First and Last Name validation in checkout for both Legacy and Blocks to ensure compatibility with Yoco payment gateway.

-                      r3434365
+                      r3434947
     public function callback( WP_REST_Request $request ): WP_REST_Response {
         $file = (string) $request->get_param( 'file' );
+        $file = sanitize_file_name( $request->get_param( 'file' ) );
+        if ( '' === $file ) {
+        // Allow only files that start with yoco and have .log extension.
+        if ( '' === $file || '.log' !== substr( $file, -4 ) || 'yoco' !== substr( $file, 0, 4 ) ) {
             return new WP_REST_Response(
                 array( 'message' => 'Not found' ),
 …
+        }
         // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents
         $log_data = file_get_contents( WC_LOG_DIR . $request->get_param( 'file' ) ); // NOSONAR
+        $log_data = file_get_contents( $target ); // NOSONAR
         add_filter(

Note: See TracChangeset for help on using the changeset viewer.