WordPress.org
Get WordPress

Plugin Directory

Changeset 694870


Ignore:
Timestamp:
04/09/2013 11:54:45 PM (13 years ago)
Author:
ethoseo
Message:

Fix to a possible XSS attack.

Location:
track-everything
Files:
10 edited
1 copied

Legend:

Unmodified
Added
Removed

  • track-everything/tags/1.1.2/inc/screens/dictionary.php

    r639533 r694870  
    22    <div id="icon-track-everything" class="icon32"><br /></div><h2>Track Everything > Labels</h2>
    33    <?php
    4         if($_POST['submit'] == "Save Changes"){
     4        if($_POST['submit'] == "Save Changes" && wp_verify_nonce($_POST['ethoseo_te_nonce'], plugin_basename( __FILE__ ))){
    55            update_option("ethoseo_te_dictionary", stripslashes_deep($_POST['dictionary']) );
    66
    … …  
    3232        <?php } ?>
    3333        </table>
     34        <?php wp_nonce_field( plugin_basename( __FILE__ ), 'ethoseo_te_nonce'); ?>
    3435        <p class="submit"><input type="submit" name="submit" id="submit" class="button-primary" value="Save Changes"    /></p>
    3536    </form>

  • track-everything/tags/1.1.2/inc/screens/settings.php

    r691761 r694870  
    1717    <div id="icon-track-everything" class="icon32"><br /></div><h2>Track Everything</h2>
    1818    <?php
    19         if($_POST['submit'] == "Save Changes"){
     19        if($_POST['submit'] == "Save Changes" && wp_verify_nonce($_POST['ethoseo_te_nonce'], plugin_basename( __FILE__ ))){
    2020            update_option("ethoseo_te_trackforms", $_POST['trackforms']);
    2121            update_option("ethoseo_te_trackoutbound", $_POST['trackoutbound']);
    … …  
    9696            </tr>
    9797        </table>
     98        <?php wp_nonce_field( plugin_basename( __FILE__ ), 'ethoseo_te_nonce'); ?>
    9899        <p class="submit"><input type="submit" name="submit" id="submit" class="button-primary" value="Save Changes"    /></p>
    99100    </form>

  • track-everything/tags/1.1.2/inc/screens/special.php

    r639533 r694870  
    22    <div id="icon-track-everything" class="icon32"><br /></div><h2>Track Everything > Specifics</h2>
    33    <?php
    4         if($_POST['submit'] == "Save Changes"){
     4        if($_POST['submit'] == "Save Changes" && wp_verify_nonce($_POST['ethoseo_te_nonce'], plugin_basename( __FILE__ ))){
    55            update_option("ethoseo_te_special", stripslashes_deep($_POST['special']) );
    66
    … …  
    4343            <?php } ?>
    4444        </table>
     45        <?php wp_nonce_field( plugin_basename( __FILE__ ), 'ethoseo_te_nonce'); ?>
    4546        <p class="submit"><input type="submit" name="submit" id="submit" class="button-primary" value="Save Changes"    /></p>
    4647    </form>

  • track-everything/tags/1.1.2/index.php

    r691761 r694870  
    55Description: A plugin capable of adding Google Analytics Event Tracking to <em>everything</em> on a website.
    66Author: Ethoseo Internet Marketing
    7 Version: 1.1.1
     7Version: 1.1.2
    88Author URI: http://www.ethoseo.com/
    99License: MIT License
    … …  
    1919*/
    2020
    21 $ethoseo_te_version = "1.0";
     21$ethoseo_te_version = "1.1.2";
    2222define( 'ETHOSEO_TE_PATH', plugin_dir_path(__FILE__) );
    2323define( 'ETHOSEO_TE_FILE', __FILE__);

  • track-everything/tags/1.1.2/readme.txt

    r691761 r694870  
    44Requires at least: 3.0.1
    55Tested up to: 3.5.1
    6 Stable tag: 1.1.1
     6Stable tag: 1.1.2
    77License: MIT
    88License URI: http://opensource.org/licenses/MIT
    … …  
    4747== Changelog ==
    4848
     49= 1.1.2 =
     50* Remedied the possibility of an XSS attack.
     51
    4952= 1.1.1 =
    5053* Introduced the ability to track Google Rank
    … …  
    6972== Upgrade Notice ==
    7073
     74=== 1.1.2 ===
     75This version is security fix. Please upgrade to prevent the possibility of an attack being directed against your site.
     76
    7177= 1.1.1 =
    7278Track Everything can now track Google Rank! It also allows for using Analytics.js if you're a really early adopter.

  • track-everything/trunk/inc/screens/dictionary.php

    r639533 r694870  
    22    <div id="icon-track-everything" class="icon32"><br /></div><h2>Track Everything > Labels</h2>
    33    <?php
    4         if($_POST['submit'] == "Save Changes"){
     4        if($_POST['submit'] == "Save Changes" && wp_verify_nonce($_POST['ethoseo_te_nonce'], plugin_basename( __FILE__ ))){
    55            update_option("ethoseo_te_dictionary", stripslashes_deep($_POST['dictionary']) );
    66
    … …  
    3232        <?php } ?>
    3333        </table>
     34        <?php wp_nonce_field( plugin_basename( __FILE__ ), 'ethoseo_te_nonce'); ?>
    3435        <p class="submit"><input type="submit" name="submit" id="submit" class="button-primary" value="Save Changes"    /></p>
    3536    </form>

  • track-everything/trunk/inc/screens/settings.php

    r691761 r694870  
    1717    <div id="icon-track-everything" class="icon32"><br /></div><h2>Track Everything</h2>
    1818    <?php
    19         if($_POST['submit'] == "Save Changes"){
     19        if($_POST['submit'] == "Save Changes" && wp_verify_nonce($_POST['ethoseo_te_nonce'], plugin_basename( __FILE__ ))){
    2020            update_option("ethoseo_te_trackforms", $_POST['trackforms']);
    2121            update_option("ethoseo_te_trackoutbound", $_POST['trackoutbound']);
    … …  
    9696            </tr>
    9797        </table>
     98        <?php wp_nonce_field( plugin_basename( __FILE__ ), 'ethoseo_te_nonce'); ?>
    9899        <p class="submit"><input type="submit" name="submit" id="submit" class="button-primary" value="Save Changes"    /></p>
    99100    </form>

  • track-everything/trunk/inc/screens/special.php

    r639533 r694870  
    22    <div id="icon-track-everything" class="icon32"><br /></div><h2>Track Everything > Specifics</h2>
    33    <?php
    4         if($_POST['submit'] == "Save Changes"){
     4        if($_POST['submit'] == "Save Changes" && wp_verify_nonce($_POST['ethoseo_te_nonce'], plugin_basename( __FILE__ ))){
    55            update_option("ethoseo_te_special", stripslashes_deep($_POST['special']) );
    66
    … …  
    4343            <?php } ?>
    4444        </table>
     45        <?php wp_nonce_field( plugin_basename( __FILE__ ), 'ethoseo_te_nonce'); ?>
    4546        <p class="submit"><input type="submit" name="submit" id="submit" class="button-primary" value="Save Changes"    /></p>
    4647    </form>

  • track-everything/trunk/index.php

    r691761 r694870  
    55Description: A plugin capable of adding Google Analytics Event Tracking to <em>everything</em> on a website.
    66Author: Ethoseo Internet Marketing
    7 Version: 1.1.1
     7Version: 1.1.2
    88Author URI: http://www.ethoseo.com/
    99License: MIT License
    … …  
    1919*/
    2020
    21 $ethoseo_te_version = "1.0";
     21$ethoseo_te_version = "1.1.2";
    2222define( 'ETHOSEO_TE_PATH', plugin_dir_path(__FILE__) );
    2323define( 'ETHOSEO_TE_FILE', __FILE__);

  • track-everything/trunk/readme.txt

    r691761 r694870  
    44Requires at least: 3.0.1
    55Tested up to: 3.5.1
    6 Stable tag: 1.1.1
     6Stable tag: 1.1.2
    77License: MIT
    88License URI: http://opensource.org/licenses/MIT
    … …  
    4747== Changelog ==
    4848
     49= 1.1.2 =
     50* Remedied the possibility of an XSS attack.
     51
    4952= 1.1.1 =
    5053* Introduced the ability to track Google Rank
    … …  
    6972== Upgrade Notice ==
    7073
     74=== 1.1.2 ===
     75This version is security fix. Please upgrade to prevent the possibility of an attack being directed against your site.
     76
    7177= 1.1.1 =
    7278Track Everything can now track Google Rank! It also allows for using Analytics.js if you're a really early adopter.
Note: See TracChangeset for help on using the changeset viewer.