WordPress.org
Get WordPress

Plugin Directory

Changeset 3462046


Ignore:
Timestamp:
02/15/2026 08:48:30 PM (6 weeks ago)
Author:
visiblefirst
Message:

Release 3.2.60 - Security hardening and WordPress.org compliance fixes

Location:
visiblefirst
Files:
8 edited
1 copied

Legend:

Unmodified
Added
Removed

  • visiblefirst/tags/3.2.60/admin/views/metabox.php

    r3461929 r3462046  
    621621            <div id="visibl-faq-pairs">
    622622                <?php if (!empty($visibl_faq_pairs)): ?>
    623                     <?php foreach ($visibl_faq_pairs as $index => $pair): ?>
    624                     <div class="visibl-faq-pair" data-index="<?php echo intval($index); ?>">
     623                    <?php foreach ($visibl_faq_pairs as $visibl_index => $visibl_pair): ?>
     624                    <div class="visibl-faq-pair" data-index="<?php echo intval($visibl_index); ?>">
    625625                        <div class="visibl-faq-question">
    626626                            <input type="text"
    627                                    name="_visibl_faq_pairs[<?php echo intval($index); ?>][question]"
    628                                    value="<?php echo esc_attr($pair['question'] ?? ''); ?>"
     627                                   name="_visibl_faq_pairs[<?php echo intval($visibl_index); ?>][question]"
     628                                   value="<?php echo esc_attr($visibl_pair['question'] ?? ''); ?>"
    629629                                   placeholder="<?php esc_attr_e('Question', 'visiblefirst'); ?>">
    630630                        </div>
    631631                        <div class="visibl-faq-answer">
    632                             <textarea name="_visibl_faq_pairs[<?php echo intval($index); ?>][answer]"
     632                            <textarea name="_visibl_faq_pairs[<?php echo intval($visibl_index); ?>][answer]"
    633633                                      rows="2"
    634                                       placeholder="<?php esc_attr_e('Answer', 'visiblefirst'); ?>"><?php echo esc_textarea($pair['answer'] ?? ''); ?></textarea>
     634                                      placeholder="<?php esc_attr_e('Answer', 'visiblefirst'); ?>"><?php echo esc_textarea($visibl_pair['answer'] ?? ''); ?></textarea>
    635635                        </div>
    636636                        <button type="button" class="visibl-faq-remove" title="<?php esc_attr_e('Remove', 'visiblefirst'); ?>">&times;</button>

  • visiblefirst/tags/3.2.60/admin/views/settings.php

    r3461929 r3462046  
    7070
    7171// Determine active tab - default to 'business' if not set or empty
    72 $visibl_active_tab = !empty($_GET['tab']) ? sanitize_text_field($_GET['tab']) : 'business';
     72$visibl_active_tab = !empty($_GET['tab']) ? sanitize_text_field(wp_unslash($_GET['tab'])) : 'business';
    7373// Validate tab is one of the allowed values
    7474if (!in_array($visibl_active_tab, ['business', 'sitefiles', 'account'], true)) {
    … …  
    7676}
    7777// Also check for #business-info anchor
    78 if (isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], '#business-info') !== false) {
     78if (isset($_SERVER['HTTP_REFERER']) && strpos(esc_url_raw(wp_unslash($_SERVER['HTTP_REFERER'])), '#business-info') !== false) {
    7979    $visibl_active_tab = 'business';
    8080}
    … …  
    285285                                   style="width: 80px;"
    286286                                   value="<?php echo esc_attr($visibl_business_info['founding_year'] ?? ''); ?>"
    287                                    placeholder="<?php echo esc_attr(date('Y')); ?>"
     287                                   placeholder="<?php echo esc_attr(gmdate('Y')); ?>"
    288288                                   maxlength="4">
    289289                            <p class="description"><?php esc_html_e('Year your business was founded. Used in llms.txt and schema.', 'visiblefirst'); ?></p>

  • visiblefirst/tags/3.2.60/readme.txt

    r3461985 r3462046  
    55Tested up to: 6.9
    66Requires PHP: 7.4
    7 Stable tag: 3.2.59
     7Stable tag: 3.2.60
    88License: GPLv2 or later
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    196196
    197197== Changelog ==
     198
     199= 3.2.60 =
     200* FIX: Security hardening - proper escaping and sanitization for WordPress.org compliance
     201* FIX: Use gmdate() instead of date() for timezone-safe operations
     202* FIX: Properly prefix loop variables to avoid global namespace pollution
    198203
    199204= 3.2.59 =

  • visiblefirst/tags/3.2.60/visiblefirst.php

    r3461985 r3462046  
    33 * Plugin Name: VisibleFirst
    44 * Description: AI + SEO + Social visibility in one plugin. Complete visibility optimization for WordPress.
    5  * Version: 3.2.59
     5 * Version: 3.2.60
    66 * Author: VisibleFirst
    77 * Author URI: https://visiblefirst.com
    … …  
    1616
    1717// Plugin constants
    18 define('VISIBL_VERSION', '3.2.59');
     18define('VISIBL_VERSION', '3.2.60');
    1919define('VISIBL_PLUGIN_DIR', plugin_dir_path(__FILE__));
    2020define('VISIBL_PLUGIN_URL', plugin_dir_url(__FILE__));
    … …  
    426426        // Save custom JSON-LD schema (textarea - use wp_kses_post for HTML/JSON safety)
    427427        if (isset($_POST['_visibl_custom_schema'])) {
    428             $custom_schema = wp_unslash($_POST['_visibl_custom_schema']);
     428            $custom_schema = sanitize_textarea_field(wp_unslash($_POST['_visibl_custom_schema']));
    429429            // Validate it's valid JSON if not empty
    430430            if (!empty(trim($custom_schema))) {
    … …  
    514514        update_option('visibl_version', VISIBL_VERSION);
    515515        echo '<div class="notice notice-info is-dismissible visibl-api-notice">';
    516         echo '<p><strong>' . esc_html__('VisibleFirst updated to', 'visiblefirst') . ' v' . VISIBL_VERSION . '!</strong></p>';
     516        echo '<p><strong>' . esc_html__('VisibleFirst updated to', 'visiblefirst') . ' v' . esc_html(VISIBL_VERSION) . '!</strong></p>';
    517517        echo '</div>';
    518518    }

  • visiblefirst/trunk/admin/views/metabox.php

    r3461929 r3462046  
    621621            <div id="visibl-faq-pairs">
    622622                <?php if (!empty($visibl_faq_pairs)): ?>
    623                     <?php foreach ($visibl_faq_pairs as $index => $pair): ?>
    624                     <div class="visibl-faq-pair" data-index="<?php echo intval($index); ?>">
     623                    <?php foreach ($visibl_faq_pairs as $visibl_index => $visibl_pair): ?>
     624                    <div class="visibl-faq-pair" data-index="<?php echo intval($visibl_index); ?>">
    625625                        <div class="visibl-faq-question">
    626626                            <input type="text"
    627                                    name="_visibl_faq_pairs[<?php echo intval($index); ?>][question]"
    628                                    value="<?php echo esc_attr($pair['question'] ?? ''); ?>"
     627                                   name="_visibl_faq_pairs[<?php echo intval($visibl_index); ?>][question]"
     628                                   value="<?php echo esc_attr($visibl_pair['question'] ?? ''); ?>"
    629629                                   placeholder="<?php esc_attr_e('Question', 'visiblefirst'); ?>">
    630630                        </div>
    631631                        <div class="visibl-faq-answer">
    632                             <textarea name="_visibl_faq_pairs[<?php echo intval($index); ?>][answer]"
     632                            <textarea name="_visibl_faq_pairs[<?php echo intval($visibl_index); ?>][answer]"
    633633                                      rows="2"
    634                                       placeholder="<?php esc_attr_e('Answer', 'visiblefirst'); ?>"><?php echo esc_textarea($pair['answer'] ?? ''); ?></textarea>
     634                                      placeholder="<?php esc_attr_e('Answer', 'visiblefirst'); ?>"><?php echo esc_textarea($visibl_pair['answer'] ?? ''); ?></textarea>
    635635                        </div>
    636636                        <button type="button" class="visibl-faq-remove" title="<?php esc_attr_e('Remove', 'visiblefirst'); ?>">&times;</button>

  • visiblefirst/trunk/admin/views/settings.php

    r3461929 r3462046  
    7070
    7171// Determine active tab - default to 'business' if not set or empty
    72 $visibl_active_tab = !empty($_GET['tab']) ? sanitize_text_field($_GET['tab']) : 'business';
     72$visibl_active_tab = !empty($_GET['tab']) ? sanitize_text_field(wp_unslash($_GET['tab'])) : 'business';
    7373// Validate tab is one of the allowed values
    7474if (!in_array($visibl_active_tab, ['business', 'sitefiles', 'account'], true)) {
    … …  
    7676}
    7777// Also check for #business-info anchor
    78 if (isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], '#business-info') !== false) {
     78if (isset($_SERVER['HTTP_REFERER']) && strpos(esc_url_raw(wp_unslash($_SERVER['HTTP_REFERER'])), '#business-info') !== false) {
    7979    $visibl_active_tab = 'business';
    8080}
    … …  
    285285                                   style="width: 80px;"
    286286                                   value="<?php echo esc_attr($visibl_business_info['founding_year'] ?? ''); ?>"
    287                                    placeholder="<?php echo esc_attr(date('Y')); ?>"
     287                                   placeholder="<?php echo esc_attr(gmdate('Y')); ?>"
    288288                                   maxlength="4">
    289289                            <p class="description"><?php esc_html_e('Year your business was founded. Used in llms.txt and schema.', 'visiblefirst'); ?></p>

  • visiblefirst/trunk/readme.txt

    r3461985 r3462046  
    55Tested up to: 6.9
    66Requires PHP: 7.4
    7 Stable tag: 3.2.59
     7Stable tag: 3.2.60
    88License: GPLv2 or later
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    196196
    197197== Changelog ==
     198
     199= 3.2.60 =
     200* FIX: Security hardening - proper escaping and sanitization for WordPress.org compliance
     201* FIX: Use gmdate() instead of date() for timezone-safe operations
     202* FIX: Properly prefix loop variables to avoid global namespace pollution
    198203
    199204= 3.2.59 =

  • visiblefirst/trunk/visiblefirst.php

    r3461985 r3462046  
    33 * Plugin Name: VisibleFirst
    44 * Description: AI + SEO + Social visibility in one plugin. Complete visibility optimization for WordPress.
    5  * Version: 3.2.59
     5 * Version: 3.2.60
    66 * Author: VisibleFirst
    77 * Author URI: https://visiblefirst.com
    … …  
    1616
    1717// Plugin constants
    18 define('VISIBL_VERSION', '3.2.59');
     18define('VISIBL_VERSION', '3.2.60');
    1919define('VISIBL_PLUGIN_DIR', plugin_dir_path(__FILE__));
    2020define('VISIBL_PLUGIN_URL', plugin_dir_url(__FILE__));
    … …  
    426426        // Save custom JSON-LD schema (textarea - use wp_kses_post for HTML/JSON safety)
    427427        if (isset($_POST['_visibl_custom_schema'])) {
    428             $custom_schema = wp_unslash($_POST['_visibl_custom_schema']);
     428            $custom_schema = sanitize_textarea_field(wp_unslash($_POST['_visibl_custom_schema']));
    429429            // Validate it's valid JSON if not empty
    430430            if (!empty(trim($custom_schema))) {
    … …  
    514514        update_option('visibl_version', VISIBL_VERSION);
    515515        echo '<div class="notice notice-info is-dismissible visibl-api-notice">';
    516         echo '<p><strong>' . esc_html__('VisibleFirst updated to', 'visiblefirst') . ' v' . VISIBL_VERSION . '!</strong></p>';
     516        echo '<p><strong>' . esc_html__('VisibleFirst updated to', 'visiblefirst') . ' v' . esc_html(VISIBL_VERSION) . '!</strong></p>';
    517517        echo '</div>';
    518518    }
Note: See TracChangeset for help on using the changeset viewer.