WordPress.org
Get WordPress

Plugin Directory

Changeset 3452498


Ignore:
Timestamp:
02/03/2026 01:48:14 AM (2 months ago)
Author:
infility
Message:

fix: infility_get_data security check.

Location:
infility-global/trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • infility-global/trunk/include/class/action.class.php

    r3184193 r3452498  
    1 <?php 
     1<?php
    22
    33class action{
    … …  
    2424    public static function get_form_post(){
    2525        global $wpdb;
    26        
     26
    2727        $data = db::get_all('wp_posts',"post_type='wpcf7_contact_form'");
    2828
    … …  
    6161        if (!$table) str::e_json('table不能为空',-1);
    6262        $table = $wpdb->prefix . $table;
    63        
    64        
     63
     64
    6565        $data = db::get_limit_page($table,$where,$field,$order,$page,$pageLimit);
    6666
    … …  
    7070        //  }
    7171        // }
    72        
     72
    7373        $result = [
    7474            'data'  =>  $data,
    … …  
    8787            $optionAry['plugins'][$key] = $Checked;
    8888        }else{
    89             str::e_json('ERROR',-1);           
     89            str::e_json('ERROR',-1);
    9090        }
    9191
    92         update_option(INFILITY_GLOBAL_OPTION_KEY,$optionAry);       
     92        update_option(INFILITY_GLOBAL_OPTION_KEY,$optionAry);
    9393        str::e_json($Checked?'开启成功':'关闭成功',1);
    9494    }
    9595}
    96 
    97  ?>

  • infility-global/trunk/infility_global.php

    r3449187 r3452498  
    44Plugin URI: https://www.infility.cn/
    55Description: Infility公共插件
    6 Version: 2.14.51
     6Version: 2.14.52
    77Author: Infility
    88Author URI: https://www.infility.cn/
    99License: GPLv2
    1010Requires at least: 5.6
    11 Tested up to: 6.7.0
     11Tested up to: 6.8.3
    1212Requires PHP: 7.3
    1313
    … …  
    139139v2.14.43 (20251216) Ben: 修复导入文件漏洞
    140140v2.14.43 (20251217) Ben: 修复导入文件漏洞添加nonce
     141v2.14.52 (20260203) Step: 修复 infility_get_data 接口的安全问题。
    141142*/
    142143
    … …  
    609610        ) return true;
    610611
     612        error_log("[infility global] api_action: " . json_encode($_GET));
     613
    611614        $ACTION_DATA = str::json_data(base64_decode($_GET['i']),'decode');
    612615        @extract($ACTION_DATA, EXTR_PREFIX_ALL, 'g');
    … …  
    622625                if ( isset( $_SERVER['REMOTE_ADDR'] ) && in_array( $_SERVER['REMOTE_ADDR'], $allowed_ips ) ) {
    623626                    // OK
    624                 } else if ( isset( $_SERVER['HTTP_X_REAL_IP'] ) && in_array( $_SERVER['HTTP_X_REAL_IP'], $allowed_ips ) ) {
    625                     // OK
    626                 } else if ( isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) && in_array( $_SERVER['HTTP_X_FORWARDED_FOR'], $allowed_ips ) ) {
    627                     // OK
     627                // } else if ( isset( $_SERVER['HTTP_X_REAL_IP'] ) && in_array( $_SERVER['HTTP_X_REAL_IP'], $allowed_ips ) ) {
     628                // // OK
     629                // } else if ( isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) && in_array( $_SERVER['HTTP_X_FORWARDED_FOR'], $allowed_ips ) ) {
     630                // // OK
    628631                } else {
    629632                    // 不允许

  • infility-global/trunk/readme.txt

    r3400110 r3452498  
    370370= 2.14.35 =
    371371修复wcf7表单代理ip出现2个时，地址显示错误问题
     372
     373= 2.14.52 =
     374安全问题修复
Note: See TracChangeset for help on using the changeset viewer.