WordPress.org
Get WordPress

Plugin Directory

Changeset 664524


Ignore:
Timestamp:
02/06/2013 08:37:21 PM (13 years ago)
Author:
finalcut
Message:

addressed a security vulnerability

Location:
feedlist/trunk/feedList
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • feedlist/trunk/feedList/feedlist.php

    r487789 r664524  
    66    Author: Bill Rawlinson
    77    Author URI: http://blog.rawlinson.us/
    8     Version: 2.61.03
     8    Version: 2.70.00
    99*/
    1010
    … …  
    2121            $relroot = ABSPATH . '/';
    2222            require_once('feedListExtensions.php');
    23            
     23
    2424
    2525
    … …  
    4444    // end
    4545
    46    
    47    
     46
     47
    4848    class FeedList {
    4949            var $dateFormat = "F j, Y, g:i a";
    … …  
    105105                        $feedUrl = trim($urlAndTitle[0]);
    106106                        $feedTitle = trim($urlAndTitle[1]);
    107                        
     107
    108108                        $this->rs = $this->GetFeed($feedUrl);
    109109
    … …  
    122122                                if($this->args['show_date']){
    123123                                    $this->output .= '<div class="feedDate">updated: '.
    124                                     $this->NormalizeDate($this->rs) . '</div>'; 
     124                                    $this->NormalizeDate($this->rs) . '</div>';
    125125            //                      fl_tz_convert($this->rs->last_modified,0,Date('I')).'</div>';
    126126                                }
    … …  
    138138                if($this->args['mergeFeeds']){
    139139                    $this->output.=$this->Draw($feed,$this->args);
    140                 } 
    141            
     140                }
     141
    142142                $this->output .= '</ul>';
    143143
    … …  
    178178                $connectionTimeout = 15;    // 15 seconds is default
    179179                $showRSSLinkListJS = true;
    180                
     180
    181181                $Language = 'en_US'; // Choose your language (from the available languages below,in the translations):
    182                
    183                
     182
     183
    184184                $Translations = array(); // Please send in your suggestions/translations:
    185185
    … …  
    195195                    $Translations['fr_FR'] = array();
    196196                    $Translations['fr_FR']['ReadMore'] = 'Lisez davantage';
    197                
     197
    198198                $feedListFile = ABSPATH .  'wp-content\plugins\feeds.txt'; // IF you are going to use the random feedlist generator make sure this holds the correct name for your feed file:
    199199
    … …  
    239239                            'language'=> $settings['language']
    240240                        );
    241            
     241
    242242            }
    243243        /* end basic settings */
    … …  
    313313                            $thisDescription = $item['content']['encoded'];
    314314                        }
    315                        
     315
    316316                        // Handle max_characters and max_char_wordbreak before the htmlentities makes it more complicated:
    317317                        if (!empty($this->args['max_characters']) && is_numeric($this->args['max_characters']))
    … …  
    327327                                    $thisDescription = substr($thisDescription, 0, $max_char_pos);
    328328                                }
    329                             } 
    330 
    331                         } else if ($encoding) { 
     329                            }
     330
     331                        } else if ($encoding) {
    332332                            //further really weak attempt at internationalization
    333333                            $thisDescription = html_entity_decode($thisDescription, ENT_QUOTES, "UTF-8");
    … …  
    338338                        $linkTitle = str_replace(array("\n", "\t", '"'), array('', '', "'"), $linkTitle);
    339339                        $linkTitle = substr($linkTitle, 0, 300);
    340    
     340
    341341                        // if we are only showing the description we don't need the separator..
    342342                        if (strlen(trim($thisDescription)) && !$this->args['show_description_only'])
    … …  
    444444                }
    445445                return $newItems;
    446             } 
     446            }
    447447
    448448            function NormalizeDate($item){
    … …  
    464464            function TimezoneConvert($datetime,$tz_from,$tz_to,$format='d M Y h:ia T'){
    465465               return date($format,strtotime($datetime)+(3600*($tz_to - $tz_from)));
    466             } 
     466            }
    467467
    468468            function MakeNumericOnly($val){
    … …  
    507507                    array_multisort($sortByLower, $sort[1], $sort[2], $this->items);
    508508                }
    509                
     509
    510510                return $this->items;
    511511            }
    512512
    513513            function LoadFile($file){
    514                 /* 
     514                /*
    515515                    load the $feedListFile  contents into an array, using the --NEXT-- text as
    516516                    a delimeter between feeds and a tilde (~) between URL and TITLE
    … …  
    524524                $a = array();
    525525                foreach($this->args as $d=>$v){
    526                     if($this->args[$d] === 'true') { 
     526                    if($this->args[$d] === 'true') {
    527527                        $a[$d] = 1;
    528528                    }else if($this->args[$d] === 'false'){
    … …  
    571571                }
    572572                return $this->feed;
    573                
     573
    574574            }
    575575
    … …  
    649649            return $feed->FeedListFile();
    650650        }
    651        
     651
    652652        function feedListFilter($args){
    653653            $args = explode(",",$args[1]);
    … …  
    707707
    708708
    709        
     709
    710710        if(function_exists('register_deactivation_hook'))
    711711        {
    712             register_deactivation_hook(__FILE__, 'cleanupFeedlistCache'); 
     712            register_deactivation_hook(__FILE__, 'cleanupFeedlistCache');
    713713        }
    714714
    … …  
    720720
    721721
    722 if(function_exists('add_action')) { 
    723           function rssLinkList_JS(){ 
    724      
    725                 $jsstring = '<script type="text/javascript"><!-- 
    726      
    727                 function addEvent(elm, evType, fn, useCapture) 
    728                 // addEvent and removeEvent 
    729                 // cross-browser event handling for IE5+,  NS6 and Mozilla 
    730                 // By Scott Andrew 
    731                 { 
    732                   if (elm.addEventListener){ 
    733                       elm.addEventListener(evType, fn, useCapture); 
    734                       return true; 
    735                   } else if (elm.attachEvent){ 
    736                       var r = elm.attachEvent("on"+evType, fn); 
    737                       return r; 
    738                   } else { 
    739                       // alert("Handler could not be removed"); 
    740                   } 
    741                 } 
    742                 function externalLinks() { 
    743                  if (!document.getElementsByTagName) return; 
    744                  var anchors = document.getElementsByTagName("a"); 
     722if(function_exists('add_action')) {
     723          function rssLinkList_JS(){
     724
     725                $jsstring = '<script type="text/javascript"><!--
     726
     727                function addEvent(elm, evType, fn, useCapture)
     728                // addEvent and removeEvent
     729                // cross-browser event handling for IE5+,  NS6 and Mozilla
     730                // By Scott Andrew
     731                {
     732                  if (elm.addEventListener){
     733                      elm.addEventListener(evType, fn, useCapture);
     734                      return true;
     735                  } else if (elm.attachEvent){
     736                      var r = elm.attachEvent("on"+evType, fn);
     737                      return r;
     738                  } else {
     739                      // alert("Handler could not be removed");
     740                  }
     741                }
     742                function externalLinks() {
     743                 if (!document.getElementsByTagName) return;
     744                 var anchors = document.getElementsByTagName("a");
    745745                 var newwindows =0;
    746                  for (var i=0; i<anchors.length; i++) { 
    747                    var anchor = anchors[i]; 
     746                 for (var i=0; i<anchors.length; i++) {
     747                   var anchor = anchors[i];
    748748                   if (anchor.getAttribute("href") && anchor.getAttribute("rel") == "external") {
    749                             anchor.setAttribute("target","_blank"); 
     749                            anchor.setAttribute("target","_blank");
    750750                            newwindows++;
    751751                    }
    752                  } 
    753                 } 
    754      
    755                 addEvent(window, "load", externalLinks); 
    756 
    757                 //--> 
    758                 </script> 
    759                 '; 
    760      
    761      
    762                 echo $jsstring; 
     752                 }
     753                }
     754
     755                addEvent(window, "load", externalLinks);
     756
     757                //-->
     758                </script>
     759                ';
     760
     761
     762                echo $jsstring;
    763763          }
    764764
    … …  
    766766    $jsFeed = new FeedList('');
    767767    $settings = $jsFeed->GetSettings();
    768      
    769     if($settings["showRSSLinkListJS"]){ 
    770           add_action('wp_head', 'rssLinkList_JS'); 
    771     } 
     768
     769    if($settings["showRSSLinkListJS"]){
     770          add_action('wp_head', 'rssLinkList_JS');
     771    }
    772772}
    773      
    774      
     773
     774
    775775?>

  • feedlist/trunk/feedList/handler_image.php

    r305767 r664524  
    33
    44require_once('simplepie.inc');
    5 SimplePie_Misc::display_cached_file($_GET['i'], '../../cache', 'spi');
     5SimplePie_Misc::display_cached_file(SimplePie_Sanitize::sanitize($_GET['i'],SIMPLEPIE_CONSTRUCT_IRI), '../../cache', 'spi');
    66?>

  • feedlist/trunk/feedList/readme.txt

    r664275 r664524  
    55Requires at least: 1.5
    66Tested up to: 3.3  (php 5.3.5)
    7 Stable tag: 2.61.03
     7Stable tag: 2.70.00
    88License: GPLv2 or later (same as wordpress uses).  Truth be told I don't really understand all of the different open source licenseing options.  See the Description for more info.
    99
    … …  
    3838    UPGRADING:
    3939
    40     1.) jot down your configuration information in feedList.php 
     40    1.) jot down your configuration information in feedList.php
    4141
    4242    2.) Overwrite your feedlist.php file
    … …  
    5555
    5656== Change Log ==
    57     DATE                    MODIFICATION                       
     57    DATE                    MODIFICATION
    5858        AUTHOR
    5959-------------------------------------------------------------------------------------------------------
    60 12 October 2005         Initial Version                     
     6012 October 2005         Initial Version
    6161        Bill Rawlinson - released version 2.0B
    62                             rewrite of rssLinkedList  NOTE a 
    63 major change - the caching is handled 
    64 by Wordpress now so you don't need a 
     62                            rewrite of rssLinkedList  NOTE a
     63major change - the caching is handled
     64by Wordpress now so you don't need a
    6565cache directory.
    6666
    … …  
    6868    06 Nov 2005         Simplified Interface and Rewrite Docs
    6969
    70     15 Nov 2005         Fixed some bugs 
     70    15 Nov 2005         Fixed some bugs
    7171
    7272    01 Dec 2005         Fixed a bug where the description wasn't being shown for atom feeds
    … …  
    109109
    110110    29 Oct 2010         Made the language option request specific while keeping the global setting as the default choice
    111    
     111
    112112    09 Jan 2012         Fixed mistake that was causing eof error when php demands <?php instead of just a <? on line 37
    113    
     113
    114114    10 Jan 2012         prior tag was broken.. need to fix directory structure.
     115
     116    06 Feb 2013         Fix security vulnerability that allowed potential cross site scripting attack http://secunia.com/advisories/42197/
    115117-------------------------------------------------------------------------------------------------------
    116  
     118
    117119== LICENSE ==
    118     This program is free software; you can redistribute it and/or 
    119 modify it under the terms of the GNU General Public License 
    120 (GPL) as published by the Free Software Foundation; either 
    121 version 2 of the License, or (at your option) any later 
     120    This program is free software; you can redistribute it and/or
     121modify it under the terms of the GNU General Public License
     122(GPL) as published by the Free Software Foundation; either
     123version 2 of the License, or (at your option) any later
    122124version.
    123125
    124126
    125127== POTENTIAL ISSUES ==
    126     May not handle internationalization very well.  Has seen very 
     128    May not handle internationalization very well.  Has seen very
    127129limited testing with non UTF-8 encoding.
    128130
    … …  
    132134
    133135== USAGE ==
    134     From anywhere in your WordPress template, call the function 
    135 "feedList(...)", which takes the following parameters (all 
     136    From anywhere in your WordPress template, call the function
     137"feedList(...)", which takes the following parameters (all
    136138parameters have default values) you can pass in either a named array of parameters or
    137139pass the parameters in order as follows:
    … …  
    142144    * show_description (default: true) - Whether or not to display the "description" field
    143145    * random (default: false) - Whether or not to randomize the items
    144     * before (default: "<li>") - Tag placed before the item 
    145     * after (default: "</li>") - Tag placed after the item 
     146    * before (default: "<li>") - Tag placed before the item
     147    * after (default: "</li>") - Tag placed after the item
    146148    * description_separator (default: " - ") - Between the link and the item
    147149    * encoding (default: false) - Change to true if you are reading in a ISO-8859-1 formatted file.  Basically, if you see a bunch of question marks (?) in your titles set this to true and see if it fixes the problem.
    … …  
    172174                           "additional_fields"=>'summary~dc.subject'
    173175                           )
    174            
     176
    175177            In this example the list of fields is summary and dc.subject - dc.subject drills down into the rss structure to reach the node <item><dc><subject></subject></dc></title> - del.icio.us currently exports the list of tags
    176178            in the dc.subject field.
    … …  
    179181
    180182    * max_char_wordbreak - Used only if max_characters is NOT 0.  Prevent breaking up words.
    181             true - we cut on the last space before max_characters. 
     183            true - we cut on the last space before max_characters.
    182184            false - cuts right at the max_characters point
    183185
    … …  
    193195                nl_NL - Dutch [shows, lees verder]
    194196                en_US - US English [shows, Read more...]
    195                
     197
    196198    FILTER USAGE
    197199
    198200        * basic:
    199             <!--rss:[URL]--> 
     201            <!--rss:[URL]-->
    200202
    201203            NOTE if you aren't using named parameters with the fitler then ONLY provide the url after the rss: or else it won't work.  Left as rss: for backwards compatability but will work with ATOM feeds as well.
    … …  
    204206            <!--rss:rss_feed_url:=http://del.icio.us/rss/finalcut/wishlist,num_items:=5,random:=true-->
    205207
    206             NOTE when using the filter and named parameters ALL parameters including the URL must be named. Also note that if you are providing different HTML for the before or after parameter you must escape it.  For instance if you want before='<li>' then you must pass before='&lt;li&gt;' 
     208            NOTE when using the filter and named parameters ALL parameters including the URL must be named. Also note that if you are providing different HTML for the before or after parameter you must escape it.  For instance if you want before='<li>' then you must pass before='&lt;li&gt;'
    207209
    208210            Finally note the whole thing must be on ONE line.  No line breaks or else it won't work.
    … …  
    214216            NOTE: if you aren't using named parameters with the filter only provide the full path to the file or else it won't work.
    215217            NOTE: if you don't provide a filepath the default one set in the file, feedlist.php near line 187 will be used (typically siteroot\wp-content\plugins\feeds.txt)
    216            
     218
    217219            * Named Parameters
    218220            <!--rssFile:feedsToShow:=1,num_items:=3,file:=c:\dev\websites\wordpress\wp-content\plugins\feeds2.txt-->
    … …  
    225227    NAMED PARAMETER EXAMPLE -- PREFERRED METHOD
    226228        <ol>
    227         <?php 
     229        <?php
    228230            feedList(array("rss_feed_url"=>"http://www.auf-der-hoehe.de/index.php?id=23&type=333&feed_id=71&no_cache=1",
    229231                            "num_items"=>10,
    … …  
    234236                            "show_date"=>true
    235237                    )
    236             ); 
     238            );
    237239        ?>
    238240        </ol>
    … …  
    240242    BASIC
    241243        <ol>
    242          <?php 
    243             feedList("http://del.icio.us/rss/finalcut"); 
     244         <?php
     245            feedList("http://del.icio.us/rss/finalcut");
    244246         ?>
    245247        </ol>
    … …  
    253255
    254256        <ol>
    255          <?php 
    256             feedList("http://del.icio.us/rss/finalcut"); 
     257         <?php
     258            feedList("http://del.icio.us/rss/finalcut");
    257259            feedList("http://www.43things.com/rss/uber/author?username=FinalCut");
    258260         ?>
    … …  
    301303
    302304
    303     ADVANCED: 
     305    ADVANCED:
    304306        <?php randomFeedList("feedsToShow=2&num_items=3") ?>
    305307
    306308        there are ALOT of parameters you can pass into randomFeedList.  I am taking a different approach to it here than I do elsewhere in the feedList plugin.
    307         If you want to pass parameters they must be passed in as shown separating each additional name/value pair with an ampersand &. 
    308 
    309    
     309        If you want to pass parameters they must be passed in as shown separating each additional name/value pair with an ampersand &.
     310
     311
    310312    PARAMETERS
    311313    file - the path to your feedfile (default: '.wp-content/plugins/feeds.txt')
    … …  
    326328
    327329
    328    
     330
    329331    CRAZY ADVANCED CALLING:
    330332
Note: See TracChangeset for help on using the changeset viewer.