WordPress.org
Get WordPress

Plugin Directory

Changeset 630271


Ignore:
Timestamp:
11/26/2012 07:05:31 PM (13 years ago)
Author:
fillup17
Message:

Updating to version 0.6 - fixing potential XSS bug.

Location:
video-lead-form
Files:
2 added
2 edited

Legend:

Unmodified
Added
Removed

  • video-lead-form/trunk/VideoLeadForm.php

    r628381 r630271  
    44Plugin URI: http://video-lead-form.com/wordpress-plugin
    55Description: Video Lead Form turns your videos into lead generation machines. By automatically embedding a lead form directly into the video users have a clean experience of watching your video and providing you with their information. This plugin provides the ability to upload, manage, and embed your videos from directly within wordpress.
    6 Version: 0.5
     6Version: 0.6
    77Author: Sumilux
    88Author URI: http://video-lead-form.com/
    … …  
    3131define('VLF_API_URL','http://www.video-lead-form.com/app');
    3232define('VLF_FRAME_URL','https://www.video-lead-form.com/app');
     33
     34/*
     35 * Check if session is already started, if not start one
     36 */
     37if ( !session_id() ){
     38    session_start();
     39}
    3340
    3441/*
    … …  
    7683function vlf_login_page($errMsg = false, $successMsg = false){
    7784   
    78     $errMsg = getRequestVar('errMsg',false);
    79     $successMsg = getRequestVar('successMsg',false);
     85    $currentMessage = getCurrentMessage();
     86    clearCurrentMessage();
     87    if(is_array($currentMessage)){
     88        if($currentMessage['type'] == 'error'){
     89            $errMsg = $currentMessage['msg'];
     90        } elseif($currentMessage['type'] == 'success') {
     91            $successMsg = $currentMessage['msg'];
     92        }
     93    }
    8094   
    8195?>
    … …  
    194208   
    195209    if(!$vlf_email_address || !$vlf_api_token){
    196         $errMsg = 'Please provide a valid User Name and API Token.';
     210        setCurrentMessage('Please provide a valid Email Address and API Token.');
    197211    } else {
    198212       
    … …  
    203217       
    204218        if(is_wp_error($results)){
    205             $errMsg = 'An error occured while trying to call the VLF API.';
     219            setCurrentMessage('An error occured while trying to call the VLF API.');
    206220        } elseif(!$results['response'] || !$results['response']['code'] || $results['response']['code'] != 200){
    207             $errMsg = 'The VLF API returned a server level error.';
     221            setCurrentMessage('The VLF API returned a server level error.');
    208222        } else {
    209223            $userData = json_decode($results['body'],true);
    210224            if(!is_array($userData)){
    211                 $errMsg = 'The API results from the VLF API are not formed properly.';
     225                setCurrentMessage('The API results from the VLF API are not formed properly.');
    212226            } elseif($userData['validUser'] && $userData['validUser'] == true){
    213227                update_option('vlf_email_address',$vlf_email_address);
    214228                update_option('vlf_api_token',$vlf_api_token);
    215229            } else {
    216                 $errMsg = 'Invalid email address or api token, please check the values and try again.';
     230                setCurrentMessage('Invalid email address or api token, please check the values and try again.');
    217231            }
    218232        }
    … …  
    220234    }
    221235    require_once(ABSPATH . 'wp-includes/pluggable.php');
    222     wp_redirect( $_SERVER['HTTP_REFERER'] .'&errMsg='.urlencode($errMsg) );
     236    wp_redirect( $_SERVER['HTTP_REFERER'] );
    223237    exit();
    224238   
    … …  
    236250   
    237251    if(!$vlf_first_name || !$vlf_last_name || !$vlf_email_address){
    238         $errMsg = 'Missing either First Name, Last Name, or Email Address.';
     252        setCurrentMessage('Missing either First Name, Last Name, or Email Address.');
    239253    } else {
    240254        /*
    … …  
    245259       
    246260        if(is_wp_error($results)){
    247             $errMsg = 'An error occured while trying to call the VLF API.';
     261            setCurrentMessage('An error occured while trying to call the VLF API.');
    248262        } elseif(!$results['response'] || !$results['response']['code'] || $results['response']['code'] != 200){
    249             $errMsg = 'The VLF API returned a server level error.';
     263            setCurrentMessage('The VLF API returned a server level error.');
    250264        } else {
    251265            $userData = json_decode($results['body'],true);
    252266           
    253267            if(!is_array($userData)){
    254                 $errMsg = 'The API results from the VLF API are not formed properly.';
     268                setCurrentMessage('The API results from the VLF API are not formed properly.');
    255269            } elseif($userData['registrationSuccessful'] && $userData['registrationSuccessful'] == true){
    256                 $successMsg = 'Registration successful. Please check your email to retreive your API Token and then return to this page to log in.';
     270                setCurrentMessage('Registration successful. Please check your email to retreive your API Token and then return to this page to log in.','success');
    257271            } else {
    258                 $errMsg = 'A problem occured during registration, please check your information and try again.';
     272                setCurrentMessage('A problem occured during registration, please check your information and try again.');
    259273            }
    260274        }
    … …  
    262276   
    263277    require_once(ABSPATH . 'wp-includes/pluggable.php');
    264     wp_redirect( $_SERVER['HTTP_REFERER'] .'&errMsg='.urlencode($errMsg).'&successMsg='.urlencode($successMsg) );
     278    wp_redirect( $_SERVER['HTTP_REFERER'] );
    265279    exit();
    266280}
    … …  
    272286    delete_option('vlf_email_address');
    273287    delete_option('vlf_api_token');
     288    clearCurrentMessage();
    274289}
    275290

  • video-lead-form/trunk/readme.txt

    r628381 r630271  
    1 === Plugin Name ===
     1=== Video Lead Form ===
    22Contributors: fillup17
    33Tags: contact form, lead form, video player
    … …  
    5454== Screenshots ==
    5555
    56 1. Register or login page.
    57 2. Manage videos page.
     561. Register or login page (screenshot-1.png).
     572. Manage videos page (screenshot-2.png).
    5858
    5959== Changelog ==
     60
     61= 0.6 =
     62* Fixed XSS bug in admin register/login page
    6063
    6164= 0.5 =
    … …  
    6467== Upgrade Notice ==
    6568
     69= 0.6 =
     70* Fixes XSS bug in admin register/login page. It is recommended you upgrade.
     71
    6672= 0.5 =
    6773* Initial Release
Note: See TracChangeset for help on using the changeset viewer.