WordPress.org
Get WordPress

Plugin Directory

Changeset 3447757


Ignore:
Timestamp:
01/27/2026 10:43:46 AM (2 months ago)
Author:
wpchill
Message:

Update to version 2.13.7 from GitHub

Location:
modula-best-grid-gallery
Files:
14 edited
1 copied

Legend:

Unmodified
Added
Removed

  • modula-best-grid-gallery/tags/2.13.7/Modula.php

    r3443192 r3447757  
    55* Description:              Modula is the most powerful, user-friendly WordPress gallery plugin. Add galleries, masonry grids and more in a few clicks.
    66* Author:                   WPChill
    7 * Version:                  2.13.6
     7* Version:                  2.13.7
    88* Author URI:               https://www.wpchill.com/
    99* License:                  GPLv3 or later
    … …  
    4848 */
    4949
    50 define( 'MODULA_LITE_VERSION', '2.13.6' );
     50define( 'MODULA_LITE_VERSION', '2.13.7' );
    5151define( 'MODULA_PATH', plugin_dir_path( __FILE__ ) );
    5252define( 'MODULA_URL', plugin_dir_url( __FILE__ ) );

  • modula-best-grid-gallery/tags/2.13.7/assets/js/admin/editor-plugin.js

    r3262199 r3447757  
    11(function () {
    2     tinymce.create('tinymce.plugins.Modula', {
     2        tinymce.create('tinymce.plugins.Modula', {
    33        init: function (ed, url) {
    44            ed.addCommand('modula_shortcode_editor', function () {
     5                var nonce = typeof modulaEditorNonce !== 'undefined' ? modulaEditorNonce : '';
     6                var ajaxUrl = ajaxurl + '?action=modula_shortcode_editor';
     7                if (nonce) {
     8                    ajaxUrl += '&nonce=' + encodeURIComponent(nonce);
     9                }
    510                ed.windowManager.open(
    611                    {
    7                         file: ajaxurl + '?action=modula_shortcode_editor',
     12                        file: ajaxUrl,
    813                        width:
    914                            900 + parseInt(ed.getLang('button.delta_width', 0)),

  • modula-best-grid-gallery/tags/2.13.7/assets/js/admin/editor-plugin.min.js

    r2982490 r3447757  
    1 tinymce.create("tinymce.plugins.Modula",{init:function(t,o){t.addCommand("modula_shortcode_editor",(function(){t.windowManager.open({file:ajaxurl+"?action=modula_shortcode_editor",width:900+parseInt(t.getLang("button.delta_width",0)),height:500+parseInt(t.getLang("button.delta_height",0)),inline:1},{plugin_url:o})}));var e=o.split("assets/");t.addButton("modula_shortcode_editor",{title:"Modula Gallery",cmd:"modula_shortcode_editor",image:e[0]+"assets/images/modula-logo.jpg"})},getInfo:function(){return{longname:"Modula Gallery",author:"Macho Themes",authorurl:"https://www.machothemes.com/",infourl:"https://www.machothemes.com/",version:tinymce.majorVersion+"."+tinymce.minorVersion}}}),tinymce.PluginManager.add("modula_shortcode_editor",tinymce.plugins.Modula);
     1tinymce.create("tinymce.plugins.Modula",{init:function(o,e){o.addCommand("modula_shortcode_editor",(function(){var t="undefined"!=typeof modulaEditorNonce?modulaEditorNonce:"",n=ajaxurl+"?action=modula_shortcode_editor";t&&(n+="&nonce="+encodeURIComponent(t)),o.windowManager.open({file:n,width:900+parseInt(o.getLang("button.delta_width",0)),height:500+parseInt(o.getLang("button.delta_height",0)),inline:1},{plugin_url:e})}));var t=e.split("assets/");o.addButton("modula_shortcode_editor",{title:"Modula Gallery",cmd:"modula_shortcode_editor",image:t[0]+"assets/images/modula-logo.jpg"})},getInfo:function(){return{longname:"Modula Gallery",author:"Macho Themes",authorurl:"https://www.machothemes.com/",infourl:"https://www.machothemes.com/",version:tinymce.majorVersion+"."+tinymce.minorVersion}}}),tinymce.PluginManager.add("modula_shortcode_editor",tinymce.plugins.Modula);

  • modula-best-grid-gallery/tags/2.13.7/changelog.txt

    r3443192 r3447757  
     1= 2.13.7 - 27.01.2026 =
     2Fixed: Security issues.
     3
    14= 2.13.6 - 20.01.2026 =
    25Fixed: Gutenberg block editor was throwing an error due to circular references.

  • modula-best-grid-gallery/tags/2.13.7/includes/admin/class-modula-cpt.php

    r3352565 r3447757  
    225225        $modula_images = $this->sanitize_images( $value );
    226226
    227         $this->batch_update_images( $modula_images, $obj->ID );
    228 
     227        // Validate and filter out invalid attachment IDs before processing
     228        $valid_images = array();
     229        foreach ( $modula_images as $image ) {
     230            if ( ! isset( $image['id'] ) || empty( $image['id'] ) ) {
     231                continue;
     232            }
     233
     234            $attachment_id = absint( $image['id'] );
     235            if ( ! $attachment_id ) {
     236                continue;
     237            }
     238
     239            // Security check: Verify the ID is an attachment
     240            if ( 'attachment' !== get_post_type( $attachment_id ) ) {
     241                continue;
     242            }
     243
     244            // Security check: Verify user has permission to edit this attachment
     245            if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
     246                continue;
     247            }
     248
     249            $valid_images[] = $image;
     250        }
     251
     252        // Only update with valid attachments
     253        $this->batch_update_images( $valid_images, $obj->ID );
     254
     255        // Update gallery meta with filtered valid images
    229256        update_post_meta(
    230257            $obj->ID,
    231258            'modula-images',
    232             $modula_images
     259            $valid_images
    233260        );
    234261    }
    … …  
    253280
    254281        // We’ll process in chunks to avoid overly large queries
     282        // Additional security: Filter out any invalid attachments that may have slipped through
     283        $valid_images = array();
     284        foreach ( $images as $image ) {
     285            if ( ! isset( $image['id'] ) || empty( $image['id'] ) ) {
     286                continue;
     287            }
     288
     289            $attachment_id = absint( $image['id'] );
     290            if ( ! $attachment_id ) {
     291                continue;
     292            }
     293
     294            // Security check: Verify the ID is an attachment
     295            if ( 'attachment' !== get_post_type( $attachment_id ) ) {
     296                continue;
     297            }
     298
     299            // Security check: Verify user has permission to edit this attachment
     300            if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
     301                continue;
     302            }
     303
     304            $valid_images[] = $image;
     305        }
     306
     307        if ( empty( $valid_images ) ) {
     308            return;
     309        }
     310
    255311        $batch_size = 200;
    256         $chunks     = array_chunk( $images, $batch_size );
     312        $chunks     = array_chunk( $valid_images, $batch_size );
    257313
    258314        foreach ( $chunks as $chunk ) {
    … …  
    267323        global $wpdb;
    268324
    269         // 1) Collect all relevant attachment IDs
     325        // 1) Collect and validate all relevant attachment IDs
    270326        $attachment_ids = array();
     327        $valid_images   = array();
     328       
    271329        foreach ( $images_chunk as $image ) {
    272             if ( ! empty( $image['id'] ) ) {
    273                 $attachment_ids[] = absint( $image['id'] );
    274             }
    275         }
    276         $attachment_ids = array_filter( $attachment_ids );
     330            if ( ! isset( $image['id'] ) || empty( $image['id'] ) ) {
     331                continue;
     332            }
     333
     334            $attachment_id = absint( $image['id'] );
     335            if ( ! $attachment_id ) {
     336                continue;
     337            }
     338
     339            // Security check: Verify the ID is an attachment
     340            if ( 'attachment' !== get_post_type( $attachment_id ) ) {
     341                continue;
     342            }
     343
     344            // Security check: Verify user has permission to edit this attachment
     345            if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
     346                continue;
     347            }
     348
     349            $attachment_ids[] = $attachment_id;
     350            $valid_images[]   = $image;
     351        }
     352
    277353        $attachment_ids = array_unique( $attachment_ids );
    278354
    … …  
    323399        $meta_inserts    = array();  // We'll insert the new alt rows
    324400
    325         // 4) Loop through images and build the final updates only if needed
    326         foreach ( $images_chunk as $image ) {
     401        // 4) Loop through valid images and build the final updates only if needed
     402        foreach ( $valid_images as $image ) {
    327403            $attachment_id = isset( $image['id'] ) ? absint( $image['id'] ) : 0;
    328404            if ( ! $attachment_id ) {
     405                continue;
     406            }
     407
     408            // Additional security check: Verify the ID is still an attachment (defense in depth)
     409            if ( 'attachment' !== get_post_type( $attachment_id ) ) {
     410                continue;
     411            }
     412
     413            // Additional security check: Verify user still has permission (defense in depth)
     414            if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
    329415                continue;
    330416            }

  • modula-best-grid-gallery/tags/2.13.7/includes/class-modula.php

    r3394968 r3447757  
    168168        add_filter( 'mce_external_plugins', array( $this, 'register_editor_plugin' ) );
    169169        add_action( 'wp_ajax_modula_shortcode_editor', array( $this, 'modula_shortcode_editor' ) );
     170        add_action( 'admin_print_scripts', array( $this, 'add_editor_nonce' ) );
    170171
    171172        // Allow other mime types to be uploaded
    … …  
    543544
    544545    /**
     546     * Add nonce for TinyMCE editor plugin
     547     */
     548    public function add_editor_nonce() {
     549        $screen = get_current_screen();
     550        // Only add nonce on post edit screens where TinyMCE is available
     551        if ( ! $screen || ! in_array( $screen->base, array( 'post', 'page' ), true ) ) {
     552            return;
     553        }
     554        ?>
     555        <script type="text/javascript">
     556            var modulaEditorNonce = '<?php echo esc_js( wp_create_nonce( 'modula-ajax-save' ) ); ?>';
     557        </script>
     558        <?php
     559    }
     560
     561    /**
    545562     * Display galleries selection
    546563     */
    547564    public function modula_shortcode_editor() {
     565        // Check user capability
     566        if ( ! current_user_can( 'edit_posts' ) ) {
     567            wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'modula-best-grid-gallery' ) );
     568        }
     569
     570        // Verify nonce
     571        $nonce = '';
     572        if ( isset( $_REQUEST['nonce'] ) ) {
     573            $nonce = sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) );
     574        }
     575
     576        if ( ! wp_verify_nonce( $nonce, 'modula-ajax-save' ) ) {
     577            wp_die( esc_html__( 'Security check failed.', 'modula-best-grid-gallery' ) );
     578        }
     579
    548580        $css_path  = MODULA_URL . 'assets/css/admin/edit.css';
    549581        $admin_url = admin_url();

  • modula-best-grid-gallery/tags/2.13.7/readme.txt

    r3443192 r3447757  
    55Tested up to: 6.9
    66Requires PHP: 5.6
    7 Stable tag: 2.13.6
     7Stable tag: 2.13.7
    88
    99License: GNU General Public License v3.0 or later 
    … …  
    326326
    327327== Changelog ==
     328= 2.13.7 - 27.01.2026 =
     329Fixed: Security issues.
     330
    328331= 2.13.6 - 20.01.2026 =
    329332Fixed: Gutenberg block editor was throwing an error due to circular references.
    330333
    331 = 2.13.5 - 14.12.2025 =
    332 Fixed: Fatal error when the theme enqueues styles for all widgets.
    333 Fixed: Security issues.
    334 
    335 = 2.13.4 - 08.12.2025 =
    336 Fixed: Security issues.
    337 
    338 = 2.13.3 - 02.12.2025 =
    339 Fixed: Vulnerability in zip import.
    340 
    341 = 2.13.2 - 19.11.2025 =
    342 Updated: Performance improvements.
    343 
    344 = 2.13.1 - 14.11.2025 =
    345 Added: Enhancements for zip import.
    346 
    347 = 2.13.0 - 12.11.2025 =
    348 Added: Yoast/Rank Math/SEOPress image sitemaps.
    349 
    350 = 2.12.30 - 11.11.2025 =
    351 Fixed: Improved remote requests handling.
    352 
    353 = 2.12.29 - 07.11.2025 =
    354 Fixed: Security issue.
    355 
    356 = 2.12.28 - 05.11.2025 =
    357 Added: Filters to exclude Modula JS files from third-party optimization plugins.
    358 Added: Black Friday upsells & notifications updates.
    359 Fixed: Missing data-image-id on lightbox link.
    360 
    361 = 2.12.27 - 24.10.2025 =
    362 Fixed: Left/Right thumbnail navigation.
    363 Fixed: Lightbox image display.
    364 Fixed: Custom gallery Guttenberg preview.
    365 Fixed: Divi builder compatibility.
    366 
    367 = 2.12.26 - 20.10.2025 =
    368 Updated: Fancybox Lightbox to version 5.0.36.
    369 Changed: Enabled the Custom Responsiveness setting by default for a better out of the box experience.
    370 Fixed: Missing text domains in some strings.
    371 Fixed: Load in view setting causing gallery images to remain hidden.
    372 Added: Debounce on window resize.
    373 Added: Interactive elements now include proper button roles and visible focus indicators, improving WCAG 2.1 compliance.
    374 
    375 = 2.12.25 - 18.09.2025 =
    376 Update: Better fit for social icons when using smaller images.
    377 
    378 = 2.12.23 - 29.08.2025 =
    379 Update: Share icons.
    380 Added: Collapsable social buttons for desktop and set default to be collapsed.
    381 
    382 = 2.12.22 - 28.08.2025 =
    383 Fixed: Social icons hover display issue.
    384 
    385 = 2.12.21 - 27.08.2025 =
    386 Fixed: Loading effect 'in view' setting not properly working.
    387 
    388 = 2.12.20 - 20.08.2025 =
    389 Fixed: Gallery jumping/scrolling issue in Elementor due to lazy load re-rendering.
    390 
    391 = 2.12.19 - 12.08.2025 =
    392 Fixed: Broken lightbox images when original image type was .heic.
    393 
    394 = 2.12.18 - 28.07.2025 =
    395 Added: Filter `modula_show_alignment_options` to allow enabling image alignment options.
    396 Fixed: Inconsistency between masonry script responsive breakpoints and CSS breakpoints.
    397 
    398 = 2.12.17 - 22.07.2025 =
    399 Added: Compatibility with Translatepress.
    400 
    401 = 2.12.16 - 14.07.2025 =
    402 Enhancement: The `modula_gallery_images` filter now receives the `gallery_id` parameter, allowing for more context-aware modifications.
    403 
    404 = 2.12.15 - 08.07.2025 =
    405 Added: Compatibility with Imagify and Modula Lazy Load option.
    406 
    407 = 2.12.14 - 07.07.2025 =
    408 Fixed: PHP warning when image has no valign or halign.
    409 
    410 = 2.12.13 - 24.06.2025 =
    411 Added: Compatibility with Imagify.
    412 
    413 = 2.12.12 - 13.05.2025 =
    414 Fixed: Security update
    415 
    416 = 2.12.11 - 26.03.2025 =
    417 Fixed: Import sources are now queried only on the Modula settings page.
    418 Update: Improved code formatting for the gallery template.
    419 
    420 = 2.12.10 - 19.03.2025 =
    421 Updated: Twitter icon to X icon.
    422 Added: Upsells in gallery edit screen.
    423 
    424 = 2.12.9 – 18.03.2025 =
    425 Changed: Removed tooltips.
    426 Update: Links to online knowledge base.
    427 Update: Default gallery type set to Masonry.
    428 Update: Title and Caption default size values.
    429 Update: Removed Misc tab from general settings.
    430 
    431 = 2.12.8 - 15.03.2025 =
    432 Added: Performance improvements in gallery listing page.
    433 
    434 = 2.12.7 - 12.03.2025 =
    435 Fixed: Fixes a PHP error occurring in certain scenarios
    436 
    437 = 2.12.6 - 11.03.2025 =
    438 Update: Notification system to WPChill Notification System.
    439 Fixed: Custom galleries preview images wrong scaling after image/bulk edit.
    440 Added: Upsells for Modula Comments.
    441 Fixed: Fixed: PHP Warning
    442 
    443 = 2.12.5 - 07.03.2025 =
    444 Fixed: Escaping of links in image's title & caption.
    445 
    446 = 2.12.4 - 06.03.2025 =
    447 Fixed: Not displaying image metadata properly
    448 Fixed: Saving image metadata on gallery edit
    449 
    450 = 2.12.3 - 05.03.2025 =
    451 Fixed: Do not strip image's title & caption html tags on image edit.
    452 
    453 = 2.12.2 - 05.03.2025 =
    454 Fixed: Plugin loading order.
    455 
    456 = 2.12.1 – 03.03.2025 =
    457 Fixed: AI Image Optimizer update method.
    458 
    459 = 2.12.0 – 28.02.2025 =
    460 Added: AI Image Optimizer.
    461 
    462 = 2.11.11 – 07.01.2025 =
    463 Fixed: ZIP file vulnerability fix.
    464 
    465 See the full changelog [here](https://github.com/WPChill/modula-lite/blob/master/changelog.txt).
    466 
    467 == Upgrade Notice ==
    468 
    469 = 2.11.11 =
    470 This update resolved a vulnerability for ZIP files!

  • modula-best-grid-gallery/trunk/Modula.php

    r3443192 r3447757  
    55* Description:              Modula is the most powerful, user-friendly WordPress gallery plugin. Add galleries, masonry grids and more in a few clicks.
    66* Author:                   WPChill
    7 * Version:                  2.13.6
     7* Version:                  2.13.7
    88* Author URI:               https://www.wpchill.com/
    99* License:                  GPLv3 or later
    … …  
    4848 */
    4949
    50 define( 'MODULA_LITE_VERSION', '2.13.6' );
     50define( 'MODULA_LITE_VERSION', '2.13.7' );
    5151define( 'MODULA_PATH', plugin_dir_path( __FILE__ ) );
    5252define( 'MODULA_URL', plugin_dir_url( __FILE__ ) );

  • modula-best-grid-gallery/trunk/assets/js/admin/editor-plugin.js

    r3262199 r3447757  
    11(function () {
    2     tinymce.create('tinymce.plugins.Modula', {
     2        tinymce.create('tinymce.plugins.Modula', {
    33        init: function (ed, url) {
    44            ed.addCommand('modula_shortcode_editor', function () {
     5                var nonce = typeof modulaEditorNonce !== 'undefined' ? modulaEditorNonce : '';
     6                var ajaxUrl = ajaxurl + '?action=modula_shortcode_editor';
     7                if (nonce) {
     8                    ajaxUrl += '&nonce=' + encodeURIComponent(nonce);
     9                }
    510                ed.windowManager.open(
    611                    {
    7                         file: ajaxurl + '?action=modula_shortcode_editor',
     12                        file: ajaxUrl,
    813                        width:
    914                            900 + parseInt(ed.getLang('button.delta_width', 0)),

  • modula-best-grid-gallery/trunk/assets/js/admin/editor-plugin.min.js

    r2982490 r3447757  
    1 tinymce.create("tinymce.plugins.Modula",{init:function(t,o){t.addCommand("modula_shortcode_editor",(function(){t.windowManager.open({file:ajaxurl+"?action=modula_shortcode_editor",width:900+parseInt(t.getLang("button.delta_width",0)),height:500+parseInt(t.getLang("button.delta_height",0)),inline:1},{plugin_url:o})}));var e=o.split("assets/");t.addButton("modula_shortcode_editor",{title:"Modula Gallery",cmd:"modula_shortcode_editor",image:e[0]+"assets/images/modula-logo.jpg"})},getInfo:function(){return{longname:"Modula Gallery",author:"Macho Themes",authorurl:"https://www.machothemes.com/",infourl:"https://www.machothemes.com/",version:tinymce.majorVersion+"."+tinymce.minorVersion}}}),tinymce.PluginManager.add("modula_shortcode_editor",tinymce.plugins.Modula);
     1tinymce.create("tinymce.plugins.Modula",{init:function(o,e){o.addCommand("modula_shortcode_editor",(function(){var t="undefined"!=typeof modulaEditorNonce?modulaEditorNonce:"",n=ajaxurl+"?action=modula_shortcode_editor";t&&(n+="&nonce="+encodeURIComponent(t)),o.windowManager.open({file:n,width:900+parseInt(o.getLang("button.delta_width",0)),height:500+parseInt(o.getLang("button.delta_height",0)),inline:1},{plugin_url:e})}));var t=e.split("assets/");o.addButton("modula_shortcode_editor",{title:"Modula Gallery",cmd:"modula_shortcode_editor",image:t[0]+"assets/images/modula-logo.jpg"})},getInfo:function(){return{longname:"Modula Gallery",author:"Macho Themes",authorurl:"https://www.machothemes.com/",infourl:"https://www.machothemes.com/",version:tinymce.majorVersion+"."+tinymce.minorVersion}}}),tinymce.PluginManager.add("modula_shortcode_editor",tinymce.plugins.Modula);

  • modula-best-grid-gallery/trunk/changelog.txt

    r3443192 r3447757  
     1= 2.13.7 - 27.01.2026 =
     2Fixed: Security issues.
     3
    14= 2.13.6 - 20.01.2026 =
    25Fixed: Gutenberg block editor was throwing an error due to circular references.

  • modula-best-grid-gallery/trunk/includes/admin/class-modula-cpt.php

    r3352565 r3447757  
    225225        $modula_images = $this->sanitize_images( $value );
    226226
    227         $this->batch_update_images( $modula_images, $obj->ID );
    228 
     227        // Validate and filter out invalid attachment IDs before processing
     228        $valid_images = array();
     229        foreach ( $modula_images as $image ) {
     230            if ( ! isset( $image['id'] ) || empty( $image['id'] ) ) {
     231                continue;
     232            }
     233
     234            $attachment_id = absint( $image['id'] );
     235            if ( ! $attachment_id ) {
     236                continue;
     237            }
     238
     239            // Security check: Verify the ID is an attachment
     240            if ( 'attachment' !== get_post_type( $attachment_id ) ) {
     241                continue;
     242            }
     243
     244            // Security check: Verify user has permission to edit this attachment
     245            if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
     246                continue;
     247            }
     248
     249            $valid_images[] = $image;
     250        }
     251
     252        // Only update with valid attachments
     253        $this->batch_update_images( $valid_images, $obj->ID );
     254
     255        // Update gallery meta with filtered valid images
    229256        update_post_meta(
    230257            $obj->ID,
    231258            'modula-images',
    232             $modula_images
     259            $valid_images
    233260        );
    234261    }
    … …  
    253280
    254281        // We’ll process in chunks to avoid overly large queries
     282        // Additional security: Filter out any invalid attachments that may have slipped through
     283        $valid_images = array();
     284        foreach ( $images as $image ) {
     285            if ( ! isset( $image['id'] ) || empty( $image['id'] ) ) {
     286                continue;
     287            }
     288
     289            $attachment_id = absint( $image['id'] );
     290            if ( ! $attachment_id ) {
     291                continue;
     292            }
     293
     294            // Security check: Verify the ID is an attachment
     295            if ( 'attachment' !== get_post_type( $attachment_id ) ) {
     296                continue;
     297            }
     298
     299            // Security check: Verify user has permission to edit this attachment
     300            if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
     301                continue;
     302            }
     303
     304            $valid_images[] = $image;
     305        }
     306
     307        if ( empty( $valid_images ) ) {
     308            return;
     309        }
     310
    255311        $batch_size = 200;
    256         $chunks     = array_chunk( $images, $batch_size );
     312        $chunks     = array_chunk( $valid_images, $batch_size );
    257313
    258314        foreach ( $chunks as $chunk ) {
    … …  
    267323        global $wpdb;
    268324
    269         // 1) Collect all relevant attachment IDs
     325        // 1) Collect and validate all relevant attachment IDs
    270326        $attachment_ids = array();
     327        $valid_images   = array();
     328       
    271329        foreach ( $images_chunk as $image ) {
    272             if ( ! empty( $image['id'] ) ) {
    273                 $attachment_ids[] = absint( $image['id'] );
    274             }
    275         }
    276         $attachment_ids = array_filter( $attachment_ids );
     330            if ( ! isset( $image['id'] ) || empty( $image['id'] ) ) {
     331                continue;
     332            }
     333
     334            $attachment_id = absint( $image['id'] );
     335            if ( ! $attachment_id ) {
     336                continue;
     337            }
     338
     339            // Security check: Verify the ID is an attachment
     340            if ( 'attachment' !== get_post_type( $attachment_id ) ) {
     341                continue;
     342            }
     343
     344            // Security check: Verify user has permission to edit this attachment
     345            if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
     346                continue;
     347            }
     348
     349            $attachment_ids[] = $attachment_id;
     350            $valid_images[]   = $image;
     351        }
     352
    277353        $attachment_ids = array_unique( $attachment_ids );
    278354
    … …  
    323399        $meta_inserts    = array();  // We'll insert the new alt rows
    324400
    325         // 4) Loop through images and build the final updates only if needed
    326         foreach ( $images_chunk as $image ) {
     401        // 4) Loop through valid images and build the final updates only if needed
     402        foreach ( $valid_images as $image ) {
    327403            $attachment_id = isset( $image['id'] ) ? absint( $image['id'] ) : 0;
    328404            if ( ! $attachment_id ) {
     405                continue;
     406            }
     407
     408            // Additional security check: Verify the ID is still an attachment (defense in depth)
     409            if ( 'attachment' !== get_post_type( $attachment_id ) ) {
     410                continue;
     411            }
     412
     413            // Additional security check: Verify user still has permission (defense in depth)
     414            if ( ! current_user_can( 'edit_post', $attachment_id ) ) {
    329415                continue;
    330416            }

  • modula-best-grid-gallery/trunk/includes/class-modula.php

    r3394968 r3447757  
    168168        add_filter( 'mce_external_plugins', array( $this, 'register_editor_plugin' ) );
    169169        add_action( 'wp_ajax_modula_shortcode_editor', array( $this, 'modula_shortcode_editor' ) );
     170        add_action( 'admin_print_scripts', array( $this, 'add_editor_nonce' ) );
    170171
    171172        // Allow other mime types to be uploaded
    … …  
    543544
    544545    /**
     546     * Add nonce for TinyMCE editor plugin
     547     */
     548    public function add_editor_nonce() {
     549        $screen = get_current_screen();
     550        // Only add nonce on post edit screens where TinyMCE is available
     551        if ( ! $screen || ! in_array( $screen->base, array( 'post', 'page' ), true ) ) {
     552            return;
     553        }
     554        ?>
     555        <script type="text/javascript">
     556            var modulaEditorNonce = '<?php echo esc_js( wp_create_nonce( 'modula-ajax-save' ) ); ?>';
     557        </script>
     558        <?php
     559    }
     560
     561    /**
    545562     * Display galleries selection
    546563     */
    547564    public function modula_shortcode_editor() {
     565        // Check user capability
     566        if ( ! current_user_can( 'edit_posts' ) ) {
     567            wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'modula-best-grid-gallery' ) );
     568        }
     569
     570        // Verify nonce
     571        $nonce = '';
     572        if ( isset( $_REQUEST['nonce'] ) ) {
     573            $nonce = sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) );
     574        }
     575
     576        if ( ! wp_verify_nonce( $nonce, 'modula-ajax-save' ) ) {
     577            wp_die( esc_html__( 'Security check failed.', 'modula-best-grid-gallery' ) );
     578        }
     579
    548580        $css_path  = MODULA_URL . 'assets/css/admin/edit.css';
    549581        $admin_url = admin_url();

  • modula-best-grid-gallery/trunk/readme.txt

    r3443192 r3447757  
    55Tested up to: 6.9
    66Requires PHP: 5.6
    7 Stable tag: 2.13.6
     7Stable tag: 2.13.7
    88
    99License: GNU General Public License v3.0 or later 
    … …  
    326326
    327327== Changelog ==
     328= 2.13.7 - 27.01.2026 =
     329Fixed: Security issues.
     330
    328331= 2.13.6 - 20.01.2026 =
    329332Fixed: Gutenberg block editor was throwing an error due to circular references.
    330333
    331 = 2.13.5 - 14.12.2025 =
    332 Fixed: Fatal error when the theme enqueues styles for all widgets.
    333 Fixed: Security issues.
    334 
    335 = 2.13.4 - 08.12.2025 =
    336 Fixed: Security issues.
    337 
    338 = 2.13.3 - 02.12.2025 =
    339 Fixed: Vulnerability in zip import.
    340 
    341 = 2.13.2 - 19.11.2025 =
    342 Updated: Performance improvements.
    343 
    344 = 2.13.1 - 14.11.2025 =
    345 Added: Enhancements for zip import.
    346 
    347 = 2.13.0 - 12.11.2025 =
    348 Added: Yoast/Rank Math/SEOPress image sitemaps.
    349 
    350 = 2.12.30 - 11.11.2025 =
    351 Fixed: Improved remote requests handling.
    352 
    353 = 2.12.29 - 07.11.2025 =
    354 Fixed: Security issue.
    355 
    356 = 2.12.28 - 05.11.2025 =
    357 Added: Filters to exclude Modula JS files from third-party optimization plugins.
    358 Added: Black Friday upsells & notifications updates.
    359 Fixed: Missing data-image-id on lightbox link.
    360 
    361 = 2.12.27 - 24.10.2025 =
    362 Fixed: Left/Right thumbnail navigation.
    363 Fixed: Lightbox image display.
    364 Fixed: Custom gallery Guttenberg preview.
    365 Fixed: Divi builder compatibility.
    366 
    367 = 2.12.26 - 20.10.2025 =
    368 Updated: Fancybox Lightbox to version 5.0.36.
    369 Changed: Enabled the Custom Responsiveness setting by default for a better out of the box experience.
    370 Fixed: Missing text domains in some strings.
    371 Fixed: Load in view setting causing gallery images to remain hidden.
    372 Added: Debounce on window resize.
    373 Added: Interactive elements now include proper button roles and visible focus indicators, improving WCAG 2.1 compliance.
    374 
    375 = 2.12.25 - 18.09.2025 =
    376 Update: Better fit for social icons when using smaller images.
    377 
    378 = 2.12.23 - 29.08.2025 =
    379 Update: Share icons.
    380 Added: Collapsable social buttons for desktop and set default to be collapsed.
    381 
    382 = 2.12.22 - 28.08.2025 =
    383 Fixed: Social icons hover display issue.
    384 
    385 = 2.12.21 - 27.08.2025 =
    386 Fixed: Loading effect 'in view' setting not properly working.
    387 
    388 = 2.12.20 - 20.08.2025 =
    389 Fixed: Gallery jumping/scrolling issue in Elementor due to lazy load re-rendering.
    390 
    391 = 2.12.19 - 12.08.2025 =
    392 Fixed: Broken lightbox images when original image type was .heic.
    393 
    394 = 2.12.18 - 28.07.2025 =
    395 Added: Filter `modula_show_alignment_options` to allow enabling image alignment options.
    396 Fixed: Inconsistency between masonry script responsive breakpoints and CSS breakpoints.
    397 
    398 = 2.12.17 - 22.07.2025 =
    399 Added: Compatibility with Translatepress.
    400 
    401 = 2.12.16 - 14.07.2025 =
    402 Enhancement: The `modula_gallery_images` filter now receives the `gallery_id` parameter, allowing for more context-aware modifications.
    403 
    404 = 2.12.15 - 08.07.2025 =
    405 Added: Compatibility with Imagify and Modula Lazy Load option.
    406 
    407 = 2.12.14 - 07.07.2025 =
    408 Fixed: PHP warning when image has no valign or halign.
    409 
    410 = 2.12.13 - 24.06.2025 =
    411 Added: Compatibility with Imagify.
    412 
    413 = 2.12.12 - 13.05.2025 =
    414 Fixed: Security update
    415 
    416 = 2.12.11 - 26.03.2025 =
    417 Fixed: Import sources are now queried only on the Modula settings page.
    418 Update: Improved code formatting for the gallery template.
    419 
    420 = 2.12.10 - 19.03.2025 =
    421 Updated: Twitter icon to X icon.
    422 Added: Upsells in gallery edit screen.
    423 
    424 = 2.12.9 – 18.03.2025 =
    425 Changed: Removed tooltips.
    426 Update: Links to online knowledge base.
    427 Update: Default gallery type set to Masonry.
    428 Update: Title and Caption default size values.
    429 Update: Removed Misc tab from general settings.
    430 
    431 = 2.12.8 - 15.03.2025 =
    432 Added: Performance improvements in gallery listing page.
    433 
    434 = 2.12.7 - 12.03.2025 =
    435 Fixed: Fixes a PHP error occurring in certain scenarios
    436 
    437 = 2.12.6 - 11.03.2025 =
    438 Update: Notification system to WPChill Notification System.
    439 Fixed: Custom galleries preview images wrong scaling after image/bulk edit.
    440 Added: Upsells for Modula Comments.
    441 Fixed: Fixed: PHP Warning
    442 
    443 = 2.12.5 - 07.03.2025 =
    444 Fixed: Escaping of links in image's title & caption.
    445 
    446 = 2.12.4 - 06.03.2025 =
    447 Fixed: Not displaying image metadata properly
    448 Fixed: Saving image metadata on gallery edit
    449 
    450 = 2.12.3 - 05.03.2025 =
    451 Fixed: Do not strip image's title & caption html tags on image edit.
    452 
    453 = 2.12.2 - 05.03.2025 =
    454 Fixed: Plugin loading order.
    455 
    456 = 2.12.1 – 03.03.2025 =
    457 Fixed: AI Image Optimizer update method.
    458 
    459 = 2.12.0 – 28.02.2025 =
    460 Added: AI Image Optimizer.
    461 
    462 = 2.11.11 – 07.01.2025 =
    463 Fixed: ZIP file vulnerability fix.
    464 
    465 See the full changelog [here](https://github.com/WPChill/modula-lite/blob/master/changelog.txt).
    466 
    467 == Upgrade Notice ==
    468 
    469 = 2.11.11 =
    470 This update resolved a vulnerability for ZIP files!
Note: See TracChangeset for help on using the changeset viewer.