WordPress.org
Get WordPress

Plugin Directory

Changeset 3435498


Ignore:
Timestamp:
01/08/2026 09:48:00 PM (2 months ago)
Author:
Dharm1025
Message:

Releasing version 1.5.9 to WordPress.org plugin repository.

Location:
mailchimp/tags/1.5.9
Files:
3 edited
1 copied

Legend:

Unmodified
Added
Removed

  • mailchimp/tags/1.5.9/mailchimp.php

    r2790403 r3435498  
    44Plugin URI: http://www.mailchimp.com/plugins/mailchimp-wordpress-plugin/
    55Description: The MailChimp plugin allows you to quickly and easily add a signup form for your MailChimp list.
    6 Version: 1.5.8
     6Version: 1.5.9
    77Author: MailChimp
    88Author URI: https://mailchimp.com/
    … …  
    2626
    2727// Version constant for easy CSS refreshes
    28 define('MCSF_VER', '1.5.8');
     28define('MCSF_VER', '1.5.9');
    2929
    3030// What's our permission (capability) threshold
    … …  
    186186        switch ($_POST['mcsf_action']) {
    187187            case 'login':
     188                if (
     189                    ! current_user_can( MCSF_CAP_THRESHOLD ) ||
     190                    ! isset( $_POST['_mcsf_nonce_action'] ) ||
     191                    ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_mcsf_nonce_action'] ) ), 'mc_login' )
     192                ) {
     193                    wp_die('Security check failed.');
     194                }
     195
    188196                $key = trim($_POST['mailchimpSF_api_key']);
    189197
    … …  
    573581 **/
    574582function mailchimpSF_change_list_if_necessary() {
    575     // Simple permission check before going through all this
    576     if (!current_user_can(MCSF_CAP_THRESHOLD)) { return; }
     583    if ( ! isset( $_POST['mc_list_id'] ) ) {
     584        return;
     585    }
     586
     587    if (
     588        ! current_user_can( MCSF_CAP_THRESHOLD ) ||
     589        ! isset( $_POST['update_mc_list_id_nonce'] ) ||
     590        ! wp_verify_nonce( sanitize_key( $_POST['update_mc_list_id_nonce'] ), 'update_mc_list_id_action' )
     591    ) {
     592        wp_die( 'Security check failed.' );
     593    }
    577594
    578595    $api = mailchimpSF_get_api();

  • mailchimp/tags/1.5.9/readme.txt

    r2790403 r3435498  
    44Requires at least: 2.8
    55Tested up to: 4.5
    6 Stable tag: 1.5.8
     6Stable tag: 1.5.9
    77
    88== Description ==
    … …  
    132132
    133133== Changelog ==
     134= 1.5.9 =
     135* Fix – Provide CSRF hardening for Mailchimp List changes.
     136
    134137= 1.5.8 =
    135138* Fix PHP warning for merge tags.

  • mailchimp/tags/1.5.9/views/setup_page.php

    r2790403 r3435498  
    4747                    </td>
    4848                    <td>
     49                        <?php wp_nonce_field('mc_login', '_mcsf_nonce_action'); ?>
    4950                        <input type="submit" value="Connnect">
    5051                    </td>
    … …  
    141142                <td>
    142143                    <input type="hidden" name="mcsf_action" value="update_mc_list_id" />
     144                    <?php wp_nonce_field( 'update_mc_list_id_action', 'update_mc_list_id_nonce' ); ?>
    143145                    <input type="submit" name="Submit" value="<?php esc_attr_e('Update List', 'mailchimp_i18n'); ?>" class="button" />
    144146                </td>
Note: See TracChangeset for help on using the changeset viewer.