Skip to content

Commit 52b2bdf

Browse files
alextuanalextuan
committed
Release new version 2.5.2
* This maintenance release contains more code security hardening updates – please run it now. * Security - Define new esc_attribute_array_e function to escape attribute array late for echo * Security - Escape $default_color late for echo * Security - Put $-variable additional with html include into wp_kses_post * Security - Turn off display_errors to prevent malformed JSON from API for when WP_DEBUG is set to off OR WP_DEBUG_DISPLAY is set to off * Framework - Allow filters output of CSS are generated from plugin framework * Framework - Upgrade Plugin Framework to version 2.6.0
1 parent 63e8dd2 commit 52b2bdf

File tree

8 files changed

+151
-124
lines changed

8 files changed

+151
-124
lines changed

‎admin/admin-init.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ public function admin_settings_tab( $current_page = '', $tab_data = array() ) {
281281
$separate_text = '';
282282
$activated_first_subtab = false;
283283
foreach ( $subtabs as $subtab ) {
284-
echo '<li>' . $separate_text . '<a href="#' . trim( esc_attr( $subtab['name'] ) ) . '" class="';
284+
echo '<li>' . esc_html( $separate_text ) . '<a href="#' . trim( esc_attr( $subtab['name'] ) ) . '" class="';
285285
if ( $current_subtab == '' && $activated_first_subtab === false ) {
286286
echo 'current';
287287
$activated_first_subtab = true;

‎admin/admin-interface.php

Lines changed: 114 additions & 107 deletions
Large diffs are not rendered by default.

‎admin/admin-ui.php

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ class Admin_UI
3333
* You must change to correct plugin name that you are working
3434
*/
3535

36-
public $framework_version = '2.5.0';
36+
public $framework_version = '2.6.0';
3737
public $plugin_name = A3_PVC_KEY;
3838
public $plugin_path = A3_PVC_PLUGIN_NAME;
3939
public $google_api_key_option = '';
@@ -259,7 +259,7 @@ public function plugin_premium_video_box( $echo = true ) {
259259
$output = apply_filters( $this->plugin_name . '_plugin_premium_video', $output );
260260

261261
if ( $echo )
262-
echo $output;
262+
echo wp_kses_post( $output );
263263
else
264264
return $output;
265265
}
@@ -280,7 +280,7 @@ public function plugin_premium_video( $echo = false ) {
280280
$output .= '</div>';
281281

282282
if ( $echo )
283-
echo $output;
283+
echo wp_kses_post( $output );
284284
else
285285
return $output;
286286
}
@@ -298,7 +298,7 @@ public function plugin_premium_video_text( $echo = false ) {
298298
}
299299

300300
if ( $echo )
301-
echo $output;
301+
echo wp_kses_post( $output );
302302
else
303303
return $output;
304304
}
@@ -332,7 +332,7 @@ public function plugin_extension_boxes( $echo = false ) {
332332
}
333333

334334
if ( $echo )
335-
echo $output;
335+
echo wp_kses_post( $output );
336336
else
337337
return $output;
338338
}
@@ -353,7 +353,7 @@ public function plugin_extension_start( $echo = true ) {
353353
$output = apply_filters( $this->plugin_name . '_plugin_extension_start', $output );
354354

355355
if ( $echo )
356-
echo $output;
356+
echo wp_kses_post( $output );
357357
else
358358
return $output;
359359
}
@@ -369,7 +369,7 @@ public function plugin_extension_end( $echo = true ) {
369369
$output = apply_filters( $this->plugin_name . '_plugin_extension_end', $output );
370370

371371
if ( $echo )
372-
echo $output;
372+
echo wp_kses_post( $output );
373373
else
374374
return $output;
375375

@@ -389,7 +389,7 @@ public function upgrade_top_message( $echo = false, $setting_id = '' ) {
389389

390390
$upgrade_top_message = apply_filters( $this->plugin_name . '_upgrade_top_message', $upgrade_top_message, $setting_id );
391391

392-
if ( $echo ) echo $upgrade_top_message;
392+
if ( $echo ) echo wp_kses_post( $upgrade_top_message );
393393
else return $upgrade_top_message;
394394

395395
}

‎admin/includes/fonts_face.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -620,10 +620,14 @@ public function generate_font_css( $option, $em = '1.2' ) {
620620
$line_height = $option['line_height'];
621621
}
622622

623+
$font_css = '';
624+
623625
if ( !@$option['style'] && !@$option['size'] && !@$option['color'] )
624-
return 'font-family: '.stripslashes($option["face"]).' !important;';
626+
$font_css = 'font-family: '.stripslashes($option["face"]).' !important;';
625627
else
626-
return 'font:'.$option['style'].' '.$option['size'].'/' . $line_height . ' ' .stripslashes($option['face']).' !important; color:'.$option['color'].' !important;';
628+
$font_css = 'font:'.$option['style'].' '.$option['size'].'/' . $line_height . ' ' .stripslashes($option['face']).' !important; color:'.$option['color'].' !important;';
629+
630+
return apply_filters( $this->plugin_name . '_generate_font_css', $font_css, $option, $em );
627631
}
628632

629633

‎page-views-count.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
/*
33
Plugin Name: Page Views Count
44
Description: Show front end users all time views and views today on posts, pages, index pages and custom post types with the Page Views Count Plugin. Use the Page Views Count function to add page views to any content type or object created by your theme or plugins.
5-
Version: 2.5.1
5+
Version: 2.5.2
66
Requires at least: 5.6
77
Tested up to: 5.9.1
88
Author: a3rev Software
@@ -23,7 +23,7 @@
2323

2424
define( 'A3_PVC_KEY', 'a3_page_view_count' );
2525
define( 'A3_PVC_PREFIX', 'wp_pvc_' );
26-
define( 'A3_PVC_VERSION', '2.5.1' );
26+
define( 'A3_PVC_VERSION', '2.5.2' );
2727
define( 'A3_PVC_G_FONTS', false );
2828

2929
use \A3Rev\PageViewsCount\FrameWork;

‎readme.txt

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Contributors: a3rev, a3rev Software, nguyencongtuan
33
Tags: wordpress page view, page view count , post views, post view count, gutenberg
44
Requires at least: 5.6
55
Tested up to: 5.9.1
6-
Stable tag: 2.5.1
6+
Stable tag: 2.5.2
77
License: GPLv3
88
License URI: http://www.gnu.org/licenses/gpl-3.0.html
99

@@ -102,6 +102,15 @@ The manual installation method involves down loading our plugin and uploading it
102102

103103
== Changelog ==
104104

105+
= 2.5.2 - 2022/03/07 =
106+
* This maintenance release contains more code security hardening updates � please run it now.
107+
* Security - Define new esc_attribute_array_e function to escape attribute array late for echo
108+
* Security - Escape $default_color late for echo
109+
* Security - Put $-variable additional with html include into wp_kses_post
110+
* Security - Turn off display_errors to prevent malformed JSON from API for when WP_DEBUG is set to off OR WP_DEBUG_DISPLAY is set to off
111+
* Framework - Allow filters output of CSS are generated from plugin framework
112+
* Framework - Upgrade Plugin Framework to version 2.6.0
113+
105114
= 2.5.1 - 2022/02/25 =
106115
* This maintenance release contains security hardening updates - please run it now.
107116
* Security - Apply wp_kses_post for $-variables that include html before output
@@ -501,6 +510,9 @@ The manual installation method involves down loading our plugin and uploading it
501510

502511
== Upgrade Notice ==
503512

513+
= 2.5.2 =
514+
This maintenance release contains more code security hardening updates � please run it now.
515+
504516
= 2.5.1 =
505517
This maintenance release contains security hardening updates - please run it now.
506518

‎src/api/pvc-api.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,9 @@ public function get_stats( $ids = array() ) {
6363
}
6464

6565
public function increase_stats( \WP_REST_Request $request ) {
66-
@ini_set( 'display_errors', false );
66+
if ( ! WP_DEBUG || ( WP_DEBUG && ! WP_DEBUG_DISPLAY ) ) {
67+
@ini_set( 'display_errors', false ); // Turn off display_errors to prevent malformed JSON.
68+
}
6769

6870
$post_ids_text = $request->get_param( 'post_ids' );
6971

@@ -102,7 +104,9 @@ public function increase_stats( \WP_REST_Request $request ) {
102104
}
103105

104106
public function view_stats( \WP_REST_Request $request ) {
105-
@ini_set( 'display_errors', false );
107+
if ( ! WP_DEBUG || ( WP_DEBUG && ! WP_DEBUG_DISPLAY ) ) {
108+
@ini_set( 'display_errors', false ); // Turn off display_errors to prevent malformed JSON.
109+
}
106110

107111
$post_ids_text = $request->get_param( 'post_ids' );
108112

‎src/pvc_shortcode.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ public function parse_shortcode( $attr = array() ) {
2626
'show_views_today' => 1,
2727
), $attr );
2828

29-
$postid = esc_attr( $attr['postid'] ); // XSS ok
29+
$postid = esc_attr( $attr['postid'] );
3030
$increase = intval( $attr['increase'] );
3131
$show_views_today = intval( $attr['show_views_today'] );
3232

0 commit comments

Comments
 (0)