WordPress.org
Get WordPress

Plugin Directory

Changeset 3440394


Ignore:
Timestamp:
01/15/2026 02:08:26 PM (3 months ago)
Author:
Skimlinks
Message:

Release 1.3.1 – add plugin deprecation and security fix (CWE-862)

Location:
skimlinks/trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • skimlinks/trunk/functions.php

    r1774811 r3440394  
    6060 */
    6161function sl_verify_footer_js() {
    62     $request = wp_remote_get( add_query_arg( 'sl_verify_footer_js', '1', get_bloginfo( 'url' ) ) );
     62    // One-time token to prevent unauthenticated option updates
     63    $token = wp_generate_password( 20, false, false );
     64    set_transient( 'sl_verify_footer_js_token', $token, 5 * MINUTE_IN_SECONDS );
     65    $url = add_query_arg(
     66            array( 'sl_verify_footer_js' => '1', 'sl_verify_token' => $token ),
     67            get_bloginfo( 'url' )
     68    );
     69    $request = wp_remote_get( $url );
    6370    $body = wp_remote_retrieve_body( $request );
    6471}
    … …  
    216223function sl_footer_js() {   
    217224
    218     // set an option to say footer js is being shown (so the theme is working)
    219     if( isset( $_GET['sl_verify_footer_js'] ) && untrailingslashit( $_GET['sl_verify_footer_js'] ) == '1' ) {
    220         update_option( 'sl_footer_js_works_for', get_current_theme() );
    221     }
     225
     226  if (
     227      isset( $_GET['sl_verify_footer_js'], $_GET['sl_verify_token'] ) &&
     228      untrailingslashit( $_GET['sl_verify_footer_js'] ) === '1'
     229  ) {
     230      $expected = get_transient( 'sl_verify_footer_js_token' );
     231      if ( is_string( $expected ) && hash_equals( $expected, (string) $_GET['sl_verify_token'] ) ) {
     232          update_option( 'sl_footer_js_works_for', get_current_theme() );
     233          delete_transient( 'sl_verify_footer_js_token' ); // one-time use
     234      }
     235  }
    222236   
    223237    // if the plugin is not configered, don't show anything
    … …  
    229243
    230244function skimlinks_footer() {
    231     // set an option to say footer js is being shown (so the theme is working)
    232     if( $_GET['sl_verify_footer_js'] == '1' ) {
    233         update_option( 'sl_footer_js_works_for', get_current_theme() );
    234     }
     245  // Keep legacy function aligned with the same verification guard
     246  if (
     247      isset( $_GET['sl_verify_footer_js'], $_GET['sl_verify_token'] ) &&
     248      $_GET['sl_verify_footer_js'] === '1'
     249  ) {
     250      $expected = get_transient( 'sl_verify_footer_js_token' );
     251      if ( is_string( $expected ) && hash_equals( $expected, (string) $_GET['sl_verify_token'] ) ) {
     252          update_option( 'sl_footer_js_works_for', get_current_theme() );
     253          delete_transient( 'sl_verify_footer_js_token' );
     254      }
     255  }
    235256
    236257    echo sl_get_footer_js();

  • skimlinks/trunk/readme.txt

    r1783196 r3440394  
    11=== Skimlinks Affiliate Marketing Tool ===
    22Contributors: skimlinks
    3 Tags: skimlinks, Affiliate, Marketing, Links, Monetization, Monetisation, Javascript, Easy, Make Money, Advertising, Affiliate Widget, Referral, Plugin, RSS, Feeds, Text Links, Earn Money, Revenue, Free, Tool
     3Tags: skimlinks, affiliate, marketing, links, monetization
    44Requires at least: 2.7.1
    55Tested up to: 4.9
    6 Stable tag: 1.3
     6Stable tag: 1.3.1
     7
     8== IMPORTANT NOTICE ==
     9
     10⚠️ **This plugin is no longer supported or maintained.**
     11
     12Skimlinks no longer recommends using this WordPress plugin. It will not receive updates, security fixes, or compatibility support for newer versions of WordPress or PHP.
     13
     14**Do not install this plugin on new WordPress sites.**
     15
     16---
     17
     18## Recommended Integration Method
     19
     20To integrate Skimlinks with WordPress, please follow the **official Skimlinks guide**:
     21
     22👉 https://support.skimlinks.com/hc/en-us/articles/223836108-Installing-Skimlinks-on-a-WordPress-site
     23
     24This guide explains how to correctly add Skimlinks to your WordPress site using the supported JavaScript-based integration.
     25
     26---
    727
    828== Description ==
    929
    10 Skimlinks is the leading content-to-commerce platform globally, helping more than 4 million websites monetize their editorial content.
     30Skimlinks is a content-to-commerce platform that helps publishers monetize outbound links to merchants.
    1131
    12 Skimlinks works behind-the scenes to take away all the manual effort usually associated with affiliate marketing. After you install the plugin you can start earning commission from every link to merchants you include in your posts.
     32This WordPress plugin was previously provided as a convenience integration. However, it has now been **deprecated** in favour of a simpler, more reliable, and fully supported integration method.
    1333
    14 With a decade’s experience working with blogs of all shapes and sizes, we’re confident our technology can help take your content monetization efforts to the next level:
     34**This plugin remains available for legacy sites only.**
    1535
    16 
    17 * **Easy to install**: Install our plugin and instantly monetize links on your Wordpress site.
    18 
    19 * **Earn from your RSS feed**: Monetize more activity on your blog when users click on an external link in your RSS feed, Skimlinks automatically turns these into affiliate links
    20 
    21 * **Earn more from affiliate marketing with Skimlinks**: Access to over 24,000 merchant in our network. There's no need to manually apply for each merchant. Once you are approved as a Skimlinks publisher you get instant access to all programs.
    22 
    23 * **Zero admin**: You can focus on creating great content and link to merchant products as normal and we’ll do all the work to create and maintain affiliate links for you.
    24 
    25 * **Increase your click-through rates**: We only turn links into affiliate links when they are clicked, so they don't look suspicious to your users.
    26 
    27 To use our Plugin you’ll need to [sign up for a Skimlinks account](https://signup.skimlinks.com). Once you’re approved, all you need to do is install the plugin and our technology will get to work.
     36---
    2837
    2938== Installation ==
    3039
    31 **N.B.** To use Skimlinks' Wordpress Plugin you’ll need to [sign up for a Skimlinks account](https://signup.skimlinks.com).
     40❌ **New installations are not recommended.**
    3241
    33 1. Upload the entire Skimlinks folder to the /wp-content/plugins/ directory.
    34 2. Activate the Skimlinks plugin through the 'Plugins' menu in WordPress.
    35 3. Configure the Skimlinks plugin through the menu option 'Settings > Skimlinks'. On this step you'll need to provide your Site ID, obtained from the [Publisher Hub](https://hub.skimlinks.com/settings/sites).
     42If you are currently using this plugin:
     43- We recommend migrating to the supported integration method as soon as possible.
     44- Follow the official guide linked above to remove the plugin and install Skimlinks correctly.
    3645
    37 If you have Skimlinks already added to your footer template please remove it before installing the Skimlinks WordPress Plugin.
    38 
     46---
    3947
    4048== Frequently Asked Questions ==
    4149
    42 = Q. What is Skimlinks? =
     50= Q. Is this plugin still supported? =
    4351
    44 Skimlinks is a clever technology that helps you easily monetize online content by converting normal product links from thousands of retailers into their equivalent affiliate links so you can earn a commission effortlessly every time a purchase is made.
     52No. This plugin is deprecated and no longer supported or maintained.
    4553
     54---
    4655
    47 = Q. How do I install the Skimlinks WordPress Plugin =
     56= Q. Should I install this plugin on a new WordPress site? =
    4857
    49 To install the Plugin you need to be a Skimlinks publisher and get the Plugin from the [WordPress Plugin Directory](http://wordpress.org/extend/plugins/skimlinks/). If you are not a Skimlinks publisher already, apply for an account [here](https://signup.skimlinks.com).
     58No. New installations should follow the official Skimlinks WordPress integration guide instead.
    5059
     60---
    5161
    52 = Q. I already have Skimlinks installed in my WordPress blog template, what should I do? =
     62= Q. Where can I find the supported integration instructions? =
    5363
    54 We recommend you remove it from the template and replace it with the Plugin to enjoy all the new features. If you have any questions feel free to [check our support pages](http://support.skimlinks.com)
     64You can find the up-to-date guide here: 
     65https://support.skimlinks.com/hc/en-us/articles/223836108-Installing-Skimlinks-on-a-WordPress-site
    5566
    56 
    57 = Q. What's the advantage of signing up to Skimlinks? =
    58 Of course you could spend time and money creating, tracking and maintaining your own affiliate links and signing up to thousands of merchant programs, but why not let us do all the hard work for you? 
    59 
    60 * Create content and link to merchants as normal and we'll convert your links into affiliate links on-the-fly so there is no effect on the users' experience
    61 * With one sign-up to Skimlinks, you get access to 24,000+ merchants' affiliate programs
    62 * Use our comprehensive reporting suite to keep track of exactly which merchants your users like
    63 * First-class account management
    64 * Free access to our powerful publisher tools
    65 * Publisher newsletters and affiliate marketing resources
    66 
    67 
    68 = Q. How can I calculate what revenue I could earn from using Skimlinks? =
    69 
    70 There are a huge number of factors influencing the potential to earn revenue from links on your blog, including the volume of users and their profile, the type of content, seasonality and the amount of other advertising you have on your site. Years of experience and lots of happy customers tell us that Skimlinks has a real impact on publishers businesses but why not give Skimlinks a try and see what it can do for you!
    71 Q. What costs are involved in signing-up to Skimlinks?
    72 It's completely free to sign-up to Skimlinks. Once approved as a Skimlinks' publisher you get full access to our suite of reports and tools.
    73 
    74 
    75 = Q. Will I earn the same amount I would earn if I created the affiliate links myself? =
    76 
    77 Because of our scale we can negotiate the very best commissions for our publishers, which means you can earn up to 110% of what you would have earned if you managed your affiliate links program yourself.  Skimlinks retains 25% of the commission payment from the merchant, and the rest we pay to you.
    78 
    79 
    80 = Q. Which Merchants do you work with? =
    81 We currently work with more than 24,000 merchants from all different verticals. Use the [Skimlinks Merchant Search](https://merchant.skimlinks.com) to browse through the list.
    82 
    83 
    84 = Q. Is Skimlinks visible to my blog readers? =
    85 Skimlinks lets the normal link appear, and turns it into an affiliate link only when the user clicks through, so there is no visible difference to the user. This gives users more trust in your site, and increases the likelihood they will click on the link.
    86 
    87 
    88 = Q. What happens in the event that the Skimlinks' service is unavailable? =
    89 The Skimlinks technology is monitored 24/7, and is fully redundant. If, in the unlikely event, our technology stops working, links will not be affiliated for a temporary period but the user experience is not affected. 
    90 
    91 = Q. Where can I get more help? =
    92 For more FAQ's and information on Skimlinks, please visit [Skimlinks support pages](https://support.skimlinks.com)
    93 
    94 
    95 == Screenshots ==
    96 
    97 1. The Skimlinks settings page
    98 2. Skimlinks publisher dashboard
     67---
    9968
    10069== Changelog ==
     70
     71= 1.3.1 =
     72* Mark plugin as deprecated
     73* Documentation update to direct users to supported integration method
    10174
    10275= 1.3 =
    … …  
    10982= 1.2.5 =
    11083* bug fixes and improvements
    111  
     84
    11285= 1.2.4 =
    11386* fixes url to skimlinks js library to be protocol-agnostic
Note: See TracChangeset for help on using the changeset viewer.