Skip to content

Commit babe96d

Browse files
alextuanalextuan
committed
Release new version 2.5.3
* This security release follows a full security audit with code refactoring, security hardening including additional escaping and sanitizing. * Security - Define new esc_attribute_name_e function to escape attribute name late for echo * Security - Define new esc_description_e function to escape description late for echo * Security - Escape all $-variable * Security - Sanitize all $_REQUEST, $_GET, $_POST * Security - Apply wp_unslash before sanitize
1 parent 52b2bdf commit babe96d

File tree

12 files changed

+301
-208
lines changed

12 files changed

+301
-208
lines changed

‎admin/admin-init.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ public function admin_settings_page( $page_data = array() ) {
199199
<?php
200200
if ( $page_data !== false) {
201201
echo esc_html( $page_data['page_title'] );
202-
if ( isset( $page_data['view_doc'] ) ) echo $page_data['view_doc'];
202+
if ( isset( $page_data['view_doc'] ) ) echo wp_kses_post( $page_data['view_doc'] );
203203
}
204204
?>
205205
</h1>

‎admin/admin-interface.php

Lines changed: 223 additions & 173 deletions
Large diffs are not rendered by default.

‎admin/admin-ui.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ public function update_google_map_api_key() {
193193

194194
update_option( $this->google_map_api_key_option . '_enable', 1 );
195195

196-
$option_value = trim( sanitize_text_field( $_POST[ $this->google_map_api_key_option ] ) );
196+
$option_value = trim( sanitize_text_field( wp_unslash( $_POST[ $this->google_map_api_key_option ] ) ) );
197197
update_option( $this->google_map_api_key_option, $option_value );
198198

199199
if ( 1 != $old_google_map_api_key_enable ) {
@@ -208,7 +208,7 @@ public function update_google_map_api_key() {
208208

209209
update_option( $this->google_map_api_key_option . '_enable', 0 );
210210

211-
$option_value = trim( sanitize_text_field( $_POST[ $this->google_map_api_key_option ] ) );
211+
$option_value = trim( sanitize_text_field( wp_unslash( $_POST[ $this->google_map_api_key_option ] ) ) );
212212
update_option( $this->google_map_api_key_option, $option_value );
213213

214214
if ( 0 != $old_google_map_api_key_enable ) {

‎admin/includes/fonts_face.php

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -403,7 +403,7 @@ public function update_google_font_api_key() {
403403

404404
update_option( $this->google_api_key_option . '_enable', 1 );
405405

406-
$option_value = trim( sanitize_text_field( $_POST[ $this->google_api_key_option ] ) );
406+
$option_value = trim( sanitize_text_field( wp_unslash( $_POST[ $this->google_api_key_option ] ) ) );
407407

408408
$old_google_api_key_option = get_option( $this->google_api_key_option );
409409

@@ -421,7 +421,7 @@ public function update_google_font_api_key() {
421421

422422
update_option( $this->google_api_key_option . '_enable', 0 );
423423

424-
$option_value = trim( sanitize_text_field( $_POST[ $this->google_api_key_option ] ) );
424+
$option_value = trim( sanitize_text_field( wp_unslash( $_POST[ $this->google_api_key_option ] ) ) );
425425
update_option( $this->google_api_key_option, $option_value );
426426

427427
if ( 0 != $old_google_api_key_enable ) {
@@ -657,14 +657,20 @@ public function generate_google_webfonts( $my_google_fonts = array(), $echo = tr
657657
// Output google font css in header
658658
if ( trim( $fonts ) != '' ) {
659659
$fonts = str_replace( " ","+",$fonts);
660-
$output .= "\n<!-- Google Webfonts -->\n";
661-
$output .= '<link href="http'. ( is_ssl() ? 's' : '' ) .'://fonts.googleapis.com/css?family=' . $fonts .'" rel="stylesheet" type="text/css" />'."\n";
662-
$output = str_replace( '|"','"',$output);
660+
661+
if ( $echo ) {
662+
echo "\n<!-- Google Webfonts -->\n";
663+
echo '<link href="http'. ( is_ssl() ? 's' : '' ) .'://fonts.googleapis.com/css?family=' . esc_attr( $fonts ) .'" rel="stylesheet" type="text/css" />'."\n";
664+
} else {
665+
$output .= "\n<!-- Google Webfonts -->\n";
666+
$output .= '<link href="http'. ( is_ssl() ? 's' : '' ) .'://fonts.googleapis.com/css?family=' . esc_attr( $fonts ) .'" rel="stylesheet" type="text/css" />'."\n";
667+
$output = str_replace( '|"','"',$output);
668+
}
663669
}
664670
}
665671

666672
if ( $echo )
667-
echo $output;
673+
echo '';
668674
else
669675
return $output;
670676

‎admin/plugin-init.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ function add_view_count()
164164

165165
if (function_exists('pvc_stats_update'))
166166
$html .= '<div class="add_view_count' . $class . '">' . pvc_stats_update($postid, 0) . '</div>';
167-
echo $html;
167+
echo wp_kses_post( $html );
168168
}
169169
}
170170

@@ -192,7 +192,7 @@ function pvc_ict_t_e( $name, $string ) {
192192
global $pvc_wpml;
193193
$string = ( function_exists('icl_t') ? icl_t( $pvc_wpml->plugin_wpml_name, $name, $string ) : $string );
194194

195-
echo $string;
195+
echo wp_kses_post( $string );
196196
}
197197

198198
function pvc_ict_t__( $name, $string ) {

‎includes/customized_style.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
}
88
/* Stats Icon */
99
body .pvc-stats-icon, body .pvc-stats-icon svg {
10-
color: <?php echo $pvc_settings['icon_color']; ?> !important;
11-
fill: <?php echo $pvc_settings['icon_color']; ?> !important;
10+
color: <?php echo esc_html( $pvc_settings['icon_color'] ); ?> !important;
11+
fill: <?php echo esc_html( $pvc_settings['icon_color'] ); ?> !important;
1212
}
1313
body .pvc_stats {
1414
<?php if ( 'centre' == $pvc_settings['aligment'] ) { ?>

‎page-views-count.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
/*
33
Plugin Name: Page Views Count
44
Description: Show front end users all time views and views today on posts, pages, index pages and custom post types with the Page Views Count Plugin. Use the Page Views Count function to add page views to any content type or object created by your theme or plugins.
5-
Version: 2.5.2
5+
Version: 2.5.3
66
Requires at least: 5.6
77
Tested up to: 5.9.1
88
Author: a3rev Software
@@ -23,7 +23,7 @@
2323

2424
define( 'A3_PVC_KEY', 'a3_page_view_count' );
2525
define( 'A3_PVC_PREFIX', 'wp_pvc_' );
26-
define( 'A3_PVC_VERSION', '2.5.2' );
26+
define( 'A3_PVC_VERSION', '2.5.3' );
2727
define( 'A3_PVC_G_FONTS', false );
2828

2929
use \A3Rev\PageViewsCount\FrameWork;

‎readme.txt

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Contributors: a3rev, a3rev Software, nguyencongtuan
33
Tags: wordpress page view, page view count , post views, post view count, gutenberg
44
Requires at least: 5.6
55
Tested up to: 5.9.1
6-
Stable tag: 2.5.2
6+
Stable tag: 2.5.3
77
License: GPLv3
88
License URI: http://www.gnu.org/licenses/gpl-3.0.html
99

@@ -102,6 +102,14 @@ The manual installation method involves down loading our plugin and uploading it
102102

103103
== Changelog ==
104104

105+
= 2.5.3 - 2022/03/12 =
106+
* This security release follows a full security audit with code refactoring, security hardening including additional escaping and sanitizing.
107+
* Security - Define new esc_attribute_name_e function to escape attribute name late for echo
108+
* Security - Define new esc_description_e function to escape description late for echo
109+
* Security - Escape all $-variable
110+
* Security - Sanitize all $_REQUEST, $_GET, $_POST
111+
* Security - Apply wp_unslash before sanitize
112+
105113
= 2.5.2 - 2022/03/07 =
106114
* This maintenance release contains more code security hardening updates � please run it now.
107115
* Security - Define new esc_attribute_array_e function to escape attribute array late for echo
@@ -510,6 +518,9 @@ The manual installation method involves down loading our plugin and uploading it
510518

511519
== Upgrade Notice ==
512520

521+
= 2.5.3 =
522+
This security release follows a full security audit with code refactoring, security hardening including additional escaping and sanitizing.
523+
513524
= 2.5.2 =
514525
This maintenance release contains more code security hardening updates � please run it now.
515526

‎src/metabox/class-pvc-metabox.php

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -60,19 +60,19 @@ public function render_meta_box_content( $post ) {
6060
class="a3_pvc_activated"
6161
type="checkbox"
6262
value="true"
63-
checked_label="<?php _e( 'ON', 'page-views-count' ); ?>"
64-
unchecked_label="<?php _e( 'OFF', 'page-views-count' ); ?>"
63+
checked_label="<?php esc_attr_e( 'ON', 'page-views-count' ); ?>"
64+
unchecked_label="<?php esc_attr_e( 'OFF', 'page-views-count' ); ?>"
6565
<?php checked( $is_activated ); ?> />
66-
<label for="a3_pvc_activated"><?php _e( 'Activate on this item', 'page-views-count' ) ?></label>
66+
<label for="a3_pvc_activated"><?php esc_html_e( 'Activate on this item', 'page-views-count' ) ?></label>
6767
</div>
6868
<div style="clear:both;"></div>
6969
<div class="a3_pvc_activated_container">
7070
<p>
71-
<label for="a3_pvc_total_views" style="display: inline-block; width: 100px;"><?php _e( 'All Time Views', 'page-views-count' ) ?></label>
71+
<label for="a3_pvc_total_views" style="display: inline-block; width: 100px;"><?php esc_html_e( 'All Time Views', 'page-views-count' ) ?></label>
7272
<input type="text" name="a3_pvc_total_views" id="a3_pvc_total_views" value="<?php echo esc_attr( $total_views ); ?>" style="width: 100px;" />
7373
</p>
7474
<p>
75-
<label for="a3_pvc_today_views" style="display: inline-block; width: 100px;"><?php _e( 'Today Views', 'page-views-count' ) ?></label>
75+
<label for="a3_pvc_today_views" style="display: inline-block; width: 100px;"><?php esc_html_e( 'Today Views', 'page-views-count' ) ?></label>
7676
<input type="text" name="a3_pvc_today_views" id="a3_pvc_today_views" value="<?php echo esc_attr( $today_views ); ?>" style="width: 100px;" />
7777
</p>
7878
</div>
@@ -114,7 +114,7 @@ public function save( $post_id ) {
114114
if ( ! isset( $_POST['a3_pvc_activation_custom_box_nonce'] ) )
115115
return $post_id;
116116

117-
$nonce = $_POST['a3_pvc_activation_custom_box_nonce'];
117+
$nonce = sanitize_text_field( wp_unslash( $_POST['a3_pvc_activation_custom_box_nonce'] ) );
118118

119119
// Verify that the nonce is valid.
120120
if ( ! wp_verify_nonce( $nonce, 'a3_pvc_activation_custom_box' ) )
@@ -126,7 +126,7 @@ public function save( $post_id ) {
126126
return $post_id;
127127

128128
// Check the user's permissions.
129-
if ( 'page' == $_POST['post_type'] ) {
129+
if ( isset( $_POST['post_type'] ) && 'page' == $_POST['post_type'] ) {
130130

131131
if ( ! current_user_can( 'edit_page', $post_id ) )
132132
return $post_id;
@@ -149,8 +149,8 @@ public function save( $post_id ) {
149149

150150
// Manual change Total Views and Today Views
151151
if ( isset( $_POST['a3_pvc_total_views'] ) && isset( $_POST['a3_pvc_today_views'] ) ) {
152-
$total_views = absint( trim( $_POST['a3_pvc_total_views'] ) );
153-
$today_views = absint( trim( $_POST['a3_pvc_today_views'] ) );
152+
$total_views = sanitize_text_field( absint( $_POST['a3_pvc_total_views'] ) );
153+
$today_views = sanitize_text_field( absint( $_POST['a3_pvc_today_views'] ) );
154154

155155
A3_PVC::pvc_stats_manual_update( $post_id, $total_views, $today_views );
156156
}

‎src/pvc_class.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -323,7 +323,7 @@ public static function pvc_stats_echo(){
323323
$pvc_settings = get_option('pvc_settings', array() );
324324
}
325325
if ( self::pvc_is_activated( $post->ID ) && 'no' != $pvc_settings['show_on_excerpt_content'] ) {
326-
echo self::pvc_stats_counter($post->ID);
326+
echo wp_kses_post( self::pvc_stats_counter($post->ID) );
327327
}
328328
}
329329

@@ -335,13 +335,13 @@ public static function genesis_pvc_stats_echo(){
335335
$pvc_settings = get_option('pvc_settings', array() );
336336
}
337337
if ( self::pvc_is_activated( $post->ID ) && 'no' != $pvc_settings['show_on_excerpt_content'] ) {
338-
echo self::pvc_stats_counter($post->ID);
338+
echo wp_kses_post( self::pvc_stats_counter($post->ID) );
339339
}
340340
}
341341

342342
public static function custom_stats_echo($postid=0, $have_echo = 1, $attributes = array() ){
343343
if($have_echo == 1)
344-
echo self::pvc_stats_counter($postid, false, $attributes );
344+
echo wp_kses_post( self::pvc_stats_counter($postid, false, $attributes ) );
345345
else
346346
return self::pvc_stats_counter($postid, false, $attributes );
347347
}
@@ -359,7 +359,7 @@ public static function custom_stats_update_echo($postid=0, $have_echo=1, $attrib
359359
$output .= self::pvc_stats_counter($postid, true, $attributes );
360360

361361
if ( $have_echo == 1 )
362-
echo $output;
362+
echo wp_kses_post( $output );
363363
else
364364
return $output;
365365
}

‎src/pvc_widget.php

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ function widget( $args, $instance ) {
3636
echo wp_kses_post( $args['before_title'] . $title . $args['after_title'] );
3737
}
3838

39-
echo $pvc_stats_output;
39+
echo wp_kses_post( $pvc_stats_output );
4040

4141
echo wp_kses_post( $args['after_widget'] );
4242
}
@@ -96,21 +96,21 @@ function form( $instance ) {
9696
$show_views_today = intval( $instance['show_views_today'] );
9797
?>
9898
<p>
99-
<label for="<?php echo esc_attr( $this->get_field_id('title') ); ?>"><?php _e('Title', 'page-views-count' ); ?>:</label>
99+
<label for="<?php echo esc_attr( $this->get_field_id('title') ); ?>"><?php esc_html_e('Title', 'page-views-count' ); ?>:</label>
100100
<input class="widefat" id="<?php echo esc_attr( $this->get_field_id('title') ); ?>" name="<?php echo esc_attr( $this->get_field_name('title') ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>" />
101101
</p>
102102
<p>
103-
<label for="<?php echo esc_attr( $this->get_field_id('postid') ); ?>"><?php _e('Post/Page ID', 'page-views-count' ); ?>:</label>
103+
<label for="<?php echo esc_attr( $this->get_field_id('postid') ); ?>"><?php esc_html_e('Post/Page ID', 'page-views-count' ); ?>:</label>
104104
<input style="width:50px;" id="<?php echo esc_attr( $this->get_field_id('postid') ); ?>" name="<?php echo esc_attr( $this->get_field_name('postid') ); ?>" type="text" value="<?php echo esc_attr( $postid ); ?>" /> <br />
105-
<span class="description"><?php _e( 'Post/Page ID want to show stats, leave empty for use ID of current post.', 'page-views-count' ); ?></span>
105+
<span class="description"><?php esc_html_e( 'Post/Page ID want to show stats, leave empty for use ID of current post.', 'page-views-count' ); ?></span>
106106
</p>
107107
<p>
108108
<input type="checkbox" <?php checked( $increase, 1 ); ?> id="<?php echo esc_attr( $this->get_field_id('increase') ); ?>" name="<?php echo esc_attr( $this->get_field_name('increase') ); ?>" value="1" />
109-
<label for="<?php echo esc_attr( $this->get_field_id('increase') ); ?>"><?php _e( 'Increase count', 'page-views-count' ); ?></label>
109+
<label for="<?php echo esc_attr( $this->get_field_id('increase') ); ?>"><?php esc_html_e( 'Increase count', 'page-views-count' ); ?></label>
110110
</p>
111111
<p>
112112
<input type="checkbox" <?php checked( $show_views_today, 1 ); ?> id="<?php echo esc_attr( $this->get_field_id('show_views_today') ); ?>" name="<?php echo esc_attr( $this->get_field_name('show_views_today') ); ?>" value="1" />
113-
<label for="<?php echo esc_attr( $this->get_field_id('show_views_today') ); ?>"><?php _e( 'Show Views Today', 'page-views-count' ); ?></label>
113+
<label for="<?php echo esc_attr( $this->get_field_id('show_views_today') ); ?>"><?php esc_html_e( 'Show Views Today', 'page-views-count' ); ?></label>
114114
</p>
115115
<?php
116116
}

‎vendor/composer/platform_check.php

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<?php
2+
3+
// platform_check.php @generated by Composer
4+
5+
$issues = array();
6+
7+
if (!(PHP_VERSION_ID >= 50600)) {
8+
$issues[] = 'Your Composer dependencies require a PHP version ">= 5.6.0". You are running ' . PHP_VERSION . '.';
9+
}
10+
11+
if ($issues) {
12+
if (!headers_sent()) {
13+
header('HTTP/1.1 500 Internal Server Error');
14+
}
15+
if (!ini_get('display_errors')) {
16+
if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
17+
fwrite(STDERR, 'Composer detected issues in your platform:' . PHP_EOL.PHP_EOL . implode(PHP_EOL, $issues) . PHP_EOL.PHP_EOL);
18+
} elseif (!headers_sent()) {
19+
echo 'Composer detected issues in your platform:' . PHP_EOL.PHP_EOL . str_replace('You are running '.PHP_VERSION.'.', '', implode(PHP_EOL, $issues)) . PHP_EOL.PHP_EOL;
20+
}
21+
}
22+
trigger_error(
23+
'Composer detected issues in your platform: ' . implode(' ', $issues),
24+
E_USER_ERROR
25+
);
26+
}

0 commit comments

Comments
 (0)