WordPress.org
Get WordPress

Plugin Directory

Changeset 3469278


Ignore:
Timestamp:
02/25/2026 09:54:25 AM (5 weeks ago)
Author:
jamesdlow
Message:

1.4.8

  • Update/fixes for Wordpress best practices:
Location:
pageapp
Files:
18 added
10 edited

Legend:

Unmodified
Added
Removed

  • pageapp/trunk/inc/cachelib.php

    r2480307 r3469278  
    11<?php
     2/*
     3 * File: cachelib.php
     4 * Date: 20250225
     5 * Author: James D. Low
     6 * URL: http://jameslow.com
     7 * About: Helper class for caching data in MySQL databases
     8 */
    29if (!class_exists('ValueCache')) {
    310class ValueCache {
    … …  
    1522    private function table() {
    1623        global $wpdb;
    17         return $wpdb->prefix . $this->prefix . 'cache';
     24        return esc_sql($wpdb->prefix . $this->prefix . 'cache');
    1825    }
    1926    private function create_table() {
    … …  
    7885            global $wpdb;
    7986            $table = $this->table();
    80             $expiry = $expiry ? $expiry : $this->expiry;
     87            $expiry = esc_sql($expiry ? $expiry : $this->expiry);
    8188            $name = esc_sql($name);
    8289            $value = esc_sql($value);

  • pageapp/trunk/inc/httplib.php

    r2914535 r3469278  
    22/*
    33 * File: httplib.php
    4  * Date: 20230307
     4 * Date: 20250225
    55 * Author: James D. Low
    66 * URL: http://jameslow.com

  • pageapp/trunk/inc/jsonlib.php

    r3168966 r3469278  
    11<?php
     2/*
     3 * File: jsonlib.php
     4 * Date: 20250225
     5 * Author: James D. Low
     6 * URL: http://jameslow.com
     7 * About: Helper class for creating Wordpress REST end points, superseeded by restlib.php
     8 */
    29if (!class_exists('JsonLib')) {
    310class JsonLib {
    … …  
    5663            }
    5764        } catch (Exception $e) {
    58             return new WP_Error('error', __($e->getMessage(), 'pageapp'));
     65            return new WP_Error('error', $e->getMessage());
    5966        }
    6067    }
    … …  
    128135    }
    129136    public static function error($message) {
    130         return new WP_Error('error', __($message, 'premiere'));
     137        return new WP_Error('error', $message);
    131138    }
    132139    public static function output($json) {

  • pageapp/trunk/inc/pluginlib.php

    r3088045 r3469278  
    11<?php
     2/*
     3 * File: pageapp.php
     4 * Date: 20250225
     5 * Author: James D. Low
     6 * URL: http://jameslow.com
     7 * About: Helper class for creating Wordpress plugins
     8 */
    29if (!class_exists('PageAppPlugin')) {
    310    class PageAppPlugin {

  • pageapp/trunk/inc/restlib.php

    r3464734 r3469278  
    11<?php
    2 
     2/*
     3 * File: restlib.php
     4 * Date: 20250225
     5 * Author: James D. Low
     6 * URL: http://jameslow.com
     7 * About: Helper class for creating Wordpress REST end points
     8 */
    39class RestLib {
    410    public $apikeys;

  • pageapp/trunk/inc/settingslib.php

    r3129768 r3469278  
    11<?php
     2/*
     3 * File: settingslib.php
     4 * Date: 20250225
     5 * Author: James D. Low
     6 * URL: http://jameslow.com
     7 * About: Helper class for easily creating a Wordpress settings UI
     8 */
    29if (!class_exists('SettingsLib')) {
    310class SettingsLib {
    … …  
    3744                    'type' => $type,
    3845                    'description' => $setting->title,
    39                     'default' => property_exists($setting, 'default') ? $setting->default : null
     46                    'default' => property_exists($setting, 'default') ? $setting->default : null,
     47                    'sanitize_callback' => array($this , 'sanitize_callback')
    4048                )
    4149            );
    4250        }
     51    }
     52    public function sanitize_callback($input) {
     53        return sanitize_textarea_field($input);
    4354    }
    4455    public function admin_menu() {
    … …  
    6879    }
    6980    public static function notice($message, $type = 'success') {
    70         echo '<div class="notice notice-'.$type.' is-dismissible">
    71             <p><strong>'.$message.'</strong></p>
     81        echo '<div class="notice notice-'.esc_attr($type).' is-dismissible">
     82            <p><strong>'.esc_html($message).'</strong></p>
    7283        </div>';
    7384    }
    … …  
    89100        $setting = (object) $setting;
    90101        if ($setting->type == 'boolean') {
    91             echo self::settings_checkbox($setting);
     102            echo wp_kses(self::settings_checkbox($setting), array('tr', 'td', 'th', 'input', 'label'));
    92103        } elseif ($setting->type == 'select') {
    93             echo self::settings_select($setting);
     104            echo wp_kses(self::settings_select($setting), array('tr', 'td', 'th', 'select', 'option'));
    94105        } elseif ($setting->type == 'text') {
    95             echo self::settings_text($setting);
     106            echo wp_kses(self::settings_text($setting), array('tr', 'td', 'th', 'textarea'));
    96107        } elseif ($setting->type == 'title') {
    97             echo self::settings_row($setting);
     108            echo wp_kses(self::settings_row($setting), array('tr', 'td', 'th'));
    98109        } else {
    99             echo self::settings_input($setting);
     110            echo wp_kses(self::settings_input($setting), array('tr', 'td', 'th', 'input'));
    100111        }
    101112    }
    102113    public static function settings_row($setting, $html = '') {
    103114        return '
    104         <tr valign="top" class="'.$setting->id.'">
     115        <tr valign="top" class="'.esc_attr($setting->id).'">
    105116            <th scope="row">'.esc_html($setting->title).($setting->type=='text'&&$setting->description?'<div style="font-weight:normal;">'.esc_html($setting->description).'</div>':'').'</th>
    106117            <td>'.$html.'</td>
    … …  
    129140    public static function settings_input($setting) {
    130141        $html = '<input style="width:520px;" placeholder="'.esc_attr($setting->description).'" type="'.($setting->type=='password'?'password':'text').'" name="'.esc_attr($setting->id).'" value="'.esc_attr(get_option($setting->id)).'" />';
    131         //$html .= '<div>'.$setting->description.'</div>';
    132142        return self::settings_row($setting, $html);
    133143    }
    … …  
    139149    }
    140150    public function menu_page() {
    141         echo '<h1>'.$this->name.'</h1>';
     151        echo '<h1>'.esc_html($this->name).'</h1>';
    142152        echo $this->html;
    143153        $nounce = $this->group;

  • pageapp/trunk/inc/utilslib.php

    r2914535 r3469278  
    11<?php
     2/*
     3 * File: utilslib.php
     4 * Date: 20250225
     5 * Author: James D. Low
     6 * URL: http://jameslow.com
     7 * About: Generic PHP utility functions
     8 */
    29if (!class_exists('UtilsLib')) {
    310    class UtilsLib {

  • pageapp/trunk/pageapp-json.php

    r3168966 r3469278  
    11<?php
     2 if (!defined( 'ABSPATH')) exit;
    23require_once 'inc/jsonlib.php';
    34class PageAppJson extends JsonLib {
    … …  
    163164        }
    164165        foreach ($list as $url) {
     166            //This is echoing a list of raw URLs over an API endpoint, it does not need to be escaped
    165167            echo $url."\n";
    166168        }
    … …  
    170172    protected function roku_cache() {
    171173        $url = self::assert_param('url');
    172         echo json_encode(PageApp::cache_json($url));
     174        echo wp_json_encode(PageApp::cache_json($url));
    173175        exit;
    174176    }
    … …  
    176178    protected function fire_links() {
    177179        $list = preg_split("/[\s,]+/", get_option('pageapp_firetv_feeds'));
     180        //This is echoing a list of raw URLs over an API endpoint, it does not need to be escaped
    178181        foreach ($list as $url) {
    179182            echo $url."\n";
    … …  
    184187    protected function fire_cache() {
    185188        $url = self::assert_param('url');
     189        //This is echoing raw xml directly over an API endpoint, it does not need to be escaped
    186190        echo PageApp::cache_xml($url)->asXML();
    187191        exit;
    … …  
    247251        if ($result) {
    248252            //TODO: content header
     253            //This is echoing raw xml directly over an API endpoint, it does not need to be escaped
    249254            echo $result;
    250255            exit;

  • pageapp/trunk/pageapp.php

    r3464734 r3469278  
    44Plugin URI: https://wordpress.org/plugins/pageapp/
    55Description: Extensions to Wordpress wp-json for the PageApp API and mobile framework
    6 Version: 1.4.7
     6Version: 1.4.8
    77Author: PageApp
    8 Author URI: https://www.pageapp.com
    9 License: © 2023 Thirteen32 Pty Ltd
     8Author URI: https://www.thirteen.com/
     9License: MIT License
    1010*/
     11if (!defined( 'ABSPATH')) exit;
    1112class PageApp {
    1213    public static $name = self::class;
    … …  
    215216        ?>
    216217        <p>
    217             <label for="password"><?php _e('Password'); ?><br />
     218            <label for="password">Password<br />
    218219                <input type="password" name="password" id="password" class="input" value="<?php echo esc_attr(wp_unslash($_POST['password'])); ?>" size="25" />
    219220            </label>

  • pageapp/trunk/readme.txt

    r3464734 r3469278  
    11=== PageApp ===
    22Contributors: jamesdlow
    3 Tags: pageapp, wp-json, relevanssi, search, api, rest api, post, meta, post meta
     3Tags: pageapp, wp-json, relevanssi, search, rest, post meta
    44Requires at least: 4.0
    5 Tested up to: 6.9.0
    6 Stable tag: trunk
    7 License: © 2024 Thireen32 Pty Ltd
     5Tested up to: 6.9.1
     6Stable tag: 1.4.8
     7License: MIT License
    88Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=K6VKWB3HZB2T2&item_name=Donation%20to%20jameslow%2ecom&currency_code=USD&bn=PP%2dDonationsBF&charset=UTF%2d8
    99
    … …  
    2828
    2929== Changelog ==
     30
     31= 1.4.8 =
     32* Update/fixes for Wordpress best practices:
     33    * No GPL-compatible license declared
     34    * Sanitization for register_setting()
     35    * Internationalization: Don't use variables or defines as text, context or text domain parameters.
     36    * Variables and options must be escaped when echo'd
     37    * Allowing direct file access to plugin files
     38    * TODO: Unsafe SQL calls
     39    * Plugin Check Report fixes:
     40        * ERROR: trunk_stable_tag
     41        * ERROR: readme_parser_warnings_too_many_tags
     42        * ERROR: WordPress.WP.I18n.NonSingularStringLiteralText
     43        * ERROR: WordPress.WP.I18n.TextDomainMismatch
    3044
    3145= 1.4.7 =
Note: See TracChangeset for help on using the changeset viewer.