Skip to content

Commit 928fe80

Browse files
alextuanalextuan
committed
Release new version 2.4.11
= 2.4.11 - 2021/07/13 = * This maintenance release has more code security hardening * Security - Add more variable, options and html escaping * Tweak - Skipped version 2.4.10 to avoid PHP misread
1 parent eb9beb7 commit 928fe80

File tree

7 files changed

+176
-168
lines changed

7 files changed

+176
-168
lines changed

‎admin/admin-init.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ public function admin_settings_page( $page_data = array() ) {
228228
$tab_data = $tab;
229229
}
230230
echo ' ' . esc_attr( sanitize_title( $tab['name'] ) );
231-
echo '">' . $tab['label'] . '</a>';
231+
echo '">' . esc_html( $tab['label'] ) . '</a>';
232232
}
233233

234234
do_action( $this->plugin_name . '-' . $current_page . '_settings_tabs' );
@@ -281,15 +281,15 @@ public function admin_settings_tab( $current_page = '', $tab_data = array() ) {
281281
$separate_text = '';
282282
$activated_first_subtab = false;
283283
foreach ( $subtabs as $subtab ) {
284-
echo '<li>' . $separate_text . '<a href="#' . trim( $subtab['name'] ) . '" class="';
284+
echo '<li>' . $separate_text . '<a href="#' . trim( esc_attr( $subtab['name'] ) ) . '" class="';
285285
if ( $current_subtab == '' && $activated_first_subtab === false ) {
286286
echo 'current';
287287
$activated_first_subtab = true;
288288
$current_subtab = $subtab['name'];
289289
} elseif ( $current_subtab == $subtab['name'] ) {
290290
echo 'current';
291291
}
292-
echo '">' . $subtab['label'] . '</a></li>' . "\n";
292+
echo '">' . esc_html( $subtab['label'] ) . '</a></li>' . "\n";
293293

294294
$separate_text = ' | ';
295295
}

‎admin/admin-interface.php

Lines changed: 149 additions & 149 deletions
Large diffs are not rendered by default.

‎admin/settings/general-settings.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ public function init_form_fields() {
310310
'default' => '',
311311
),
312312
array( 'id' => 'total_text_after',
313-
'name' => ' <span class="description"> ' .__( 'Empty Field = Nothing Shows', 'page-views-count' ) . '</span>',
313+
'name' => __( 'Empty Field = Nothing Shows', 'page-views-count' ),
314314
'css' => 'width:200px;',
315315
'default' => __( 'total views', 'page-views-count' )
316316
),
@@ -327,7 +327,7 @@ public function init_form_fields() {
327327
'default' => '',
328328
),
329329
array( 'id' => 'today_text_after',
330-
'name' => ' <span class="description"> ' .__( 'Empty Field = Nothing Shows', 'page-views-count' ) . '</span>',
330+
'name' => __( 'Empty Field = Nothing Shows', 'page-views-count' ),
331331
'css' => 'width:200px;',
332332
'default' => __( 'views today', 'page-views-count' )
333333
),

‎readme.txt

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Contributors: a3rev, a3rev Software, nguyencongtuan
33
Tags: wordpress page view, page view count , post views, post view count, gutenberg
44
Requires at least: 5.0
55
Tested up to: 5.8
6-
Stable tag: 2.4.9
6+
Stable tag: 2.4.11
77
License: GPLv3
88
License URI: http://www.gnu.org/licenses/gpl-3.0.html
99

@@ -103,6 +103,11 @@ The manual installation method involves down loading our plugin and uploading it
103103

104104
== Changelog ==
105105

106+
= 2.4.11 - 2021/07/13 =
107+
* This maintenance release has more code security hardening
108+
* Security - Add more variable, options and html escaping
109+
* Tweak - Skipped version 2.4.10 to avoid PHP misread
110+
106111
= 2.4.9 - 2021/07/10 =
107112
* This maintenance release has code rewrites for WordPress 5.8 compatibility plus a Security patch
108113
* Tweak - Test for compatibility with WordPress 5.8
@@ -463,6 +468,9 @@ The manual installation method involves down loading our plugin and uploading it
463468

464469
== Upgrade Notice ==
465470

471+
= 2.4.11 =
472+
This maintenance release has more code security hardening.
473+
466474
= 2.4.9 =
467475
This maintenance release has code rewrites for WordPress 5.8 compatibility plus a Security patch
468476

‎src/metabox/class-pvc-metabox.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,11 +69,11 @@ class="a3_pvc_activated"
6969
<div class="a3_pvc_activated_container">
7070
<p>
7171
<label for="a3_pvc_total_views" style="display: inline-block; width: 100px;"><?php _e( 'All Time Views', 'page-views-count' ) ?></label>
72-
<input type="text" name="a3_pvc_total_views" id="a3_pvc_total_views" value="<?php echo $total_views; ?>" style="width: 100px;" />
72+
<input type="text" name="a3_pvc_total_views" id="a3_pvc_total_views" value="<?php echo esc_attr( $total_views ); ?>" style="width: 100px;" />
7373
</p>
7474
<p>
7575
<label for="a3_pvc_today_views" style="display: inline-block; width: 100px;"><?php _e( 'Today Views', 'page-views-count' ) ?></label>
76-
<input type="text" name="a3_pvc_today_views" id="a3_pvc_today_views" value="<?php echo $today_views; ?>" style="width: 100px;" />
76+
<input type="text" name="a3_pvc_today_views" id="a3_pvc_today_views" value="<?php echo esc_attr( $today_views ); ?>" style="width: 100px;" />
7777
</p>
7878
</div>
7979
</div>

‎src/pvc_class.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -230,10 +230,10 @@ public static function register_plugin_scripts() {
230230
<?php // phpcs:disable ?>
231231
<!-- PVC Template -->
232232
<script type="text/template" id="pvc-stats-view-template">
233-
<i class="pvc-stats-icon <?php echo $pvc_settings['icon_size']; ?>" aria-hidden="true"><?php echo ( 'eye' == $pvc_settings['icon'] ? self::$eye_icon : self::$chart_icon ); ?></i>
234-
<?php echo $pvc_settings['total_text_before']; ?> <%= total_view %> <?php echo $pvc_settings['total_text_after']; ?>
233+
<i class="pvc-stats-icon <?php echo esc_attr( $pvc_settings['icon_size'] ); ?>" aria-hidden="true"><?php echo ( 'eye' == $pvc_settings['icon'] ? self::$eye_icon : self::$chart_icon ); ?></i>
234+
<?php echo esc_html( $pvc_settings['total_text_before'] ); ?> <%= total_view %> <?php echo esc_html( $pvc_settings['total_text_after'] ); ?>
235235
<% if ( today_view > 0 ) { %>
236-
<span class="views_today">, <?php echo $pvc_settings['today_text_before']; ?> <%= today_view %> <?php echo $pvc_settings['today_text_after']; ?></span>
236+
<span class="views_today">, <?php echo esc_html( $pvc_settings['today_text_before'] ); ?> <%= today_view %> <?php echo esc_html( $pvc_settings['today_text_after'] ); ?></span>
237237
<% } %>
238238
</span>
239239
</script>

‎src/pvc_widget.php

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -97,21 +97,21 @@ function form( $instance ) {
9797
$show_views_today = intval( $instance['show_views_today'] );
9898
?>
9999
<p>
100-
<label for="<?php echo $this->get_field_id('title'); ?>"><?php _e('Title', 'page-views-count' ); ?>:</label>
101-
<input class="widefat" id="<?php echo $this->get_field_id('title'); ?>" name="<?php echo $this->get_field_name('title'); ?>" type="text" value="<?php echo $title; ?>" />
100+
<label for="<?php echo esc_attr( $this->get_field_id('title') ); ?>"><?php _e('Title', 'page-views-count' ); ?>:</label>
101+
<input class="widefat" id="<?php echo esc_attr( $this->get_field_id('title') ); ?>" name="<?php echo esc_attr( $this->get_field_name('title') ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>" />
102102
</p>
103103
<p>
104-
<label for="<?php echo $this->get_field_id('postid'); ?>"><?php _e('Post/Page ID', 'page-views-count' ); ?>:</label>
105-
<input style="width:50px;" id="<?php echo $this->get_field_id('postid'); ?>" name="<?php echo $this->get_field_name('postid'); ?>" type="text" value="<?php echo $postid; ?>" /> <br />
104+
<label for="<?php echo esc_attr( $this->get_field_id('postid') ); ?>"><?php _e('Post/Page ID', 'page-views-count' ); ?>:</label>
105+
<input style="width:50px;" id="<?php echo esc_attr( $this->get_field_id('postid') ); ?>" name="<?php echo esc_attr( $this->get_field_name('postid') ); ?>" type="text" value="<?php echo esc_attr( $postid ); ?>" /> <br />
106106
<span class="description"><?php _e( 'Post/Page ID want to show stats, leave empty for use ID of current post.', 'page-views-count' ); ?></span>
107107
</p>
108108
<p>
109-
<input type="checkbox" <?php checked( $increase, 1 ); ?> id="<?php echo $this->get_field_id('increase'); ?>" name="<?php echo $this->get_field_name('increase'); ?>" value="1" />
110-
<label for="<?php echo $this->get_field_id('increase'); ?>"><?php _e( 'Increase count', 'page-views-count' ); ?></label>
109+
<input type="checkbox" <?php checked( $increase, 1 ); ?> id="<?php echo esc_attr( $this->get_field_id('increase') ); ?>" name="<?php echo esc_attr( $this->get_field_name('increase') ); ?>" value="1" />
110+
<label for="<?php echo esc_attr( $this->get_field_id('increase') ); ?>"><?php _e( 'Increase count', 'page-views-count' ); ?></label>
111111
</p>
112112
<p>
113-
<input type="checkbox" <?php checked( $show_views_today, 1 ); ?> id="<?php echo $this->get_field_id('show_views_today'); ?>" name="<?php echo $this->get_field_name('show_views_today'); ?>" value="1" />
114-
<label for="<?php echo $this->get_field_id('show_views_today'); ?>"><?php _e( 'Show Views Today', 'page-views-count' ); ?></label>
113+
<input type="checkbox" <?php checked( $show_views_today, 1 ); ?> id="<?php echo esc_attr( $this->get_field_id('show_views_today') ); ?>" name="<?php echo esc_attr( $this->get_field_name('show_views_today') ); ?>" value="1" />
114+
<label for="<?php echo esc_attr( $this->get_field_id('show_views_today') ); ?>"><?php _e( 'Show Views Today', 'page-views-count' ); ?></label>
115115
</p>
116116
<?php
117117
}

0 commit comments

Comments
 (0)