WordPress.org
Get WordPress

Plugin Directory

Changeset 2745551


Ignore:
Timestamp:
06/20/2022 09:42:04 PM (4 years ago)
Author:
grimmdude
Message:

1.4.2 - Add CSRF protection, fix misc PHP notices.

Location:
sharebar
Files:
44 added
3 edited

Legend:

Unmodified
Added
Removed

  • sharebar/trunk/readme.txt

    r2045495 r2745551  
    33Tags: sharing, social networks, marketing, social media, sharebar, sharebox, sharethis, facebook share, twitter, pinterest, reddit, stumbleupon, social buttons, marketing
    44Requires at least: 2.0
    5 Tested up to: 5.1
    6 Stable tag: 1.4.1
     5Tested up to: 6.0
     6Stable tag: 1.4.2
    77
    88Sharebar adds a dynamic and fully customizable vertical box to the left of a blog post that contains links/buttons to popular social networking sites.
    … …  
    6161
    6262== Changelog ==
     63= 1.4.2 =
     64* Add CSRF protection to admin forms.
     65* Fix misc PHP notices.
     66
    6367= 1.4.1 =
    6468* Use enqueue_scripts for frontend CSS.

  • sharebar/trunk/sharebar-admin.php

    r1164351 r2745551  
    2020        exit();
    2121    }
    22     $id = sanitize($_GET['id'] ? $_GET['id'] : $_POST['id']);
    23     $pos = sanitize($_GET['pos'] ? $_GET['pos'] : $_POST['pos']);
    24     $status = sanitize($_GET['status'] ? $_GET['status'] : $_POST['status']);
    25     $task = sanitize($_GET['t'] ? $_GET['t'] : $_POST['t']);
    26     $do = sanitize($_POST['do']);
     22
     23    $id = sanitize(isset($_REQUEST['id']) ? $_REQUEST['id'] : null);
     24    $pos = sanitize(isset($_REQUEST['pos']) ? $_REQUEST['pos'] : null);
     25    $status = sanitize(isset($_REQUEST['status']) ? $_REQUEST['status'] : null);
     26    $task = sanitize(isset($_REQUEST['t']) ? $_REQUEST['t'] : null);
     27    $do = sanitize(isset($_REQUEST['do']) ? $_REQUEST['do'] : null);
    2728   
    2829    if($id) $item = $wpdb->get_row($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."sharebar WHERE id=%d", $id));
    2930
    30     if($do == 'update') $wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."sharebar SET enabled='%d', position='%d', name='%s', big='". $_POST['big'] ."', small='". $_POST['small'] ."' WHERE id='%d'", sanitize($_POST['enabled']), sanitize($_POST['position']), sanitize($_POST['name']), $id));
    31     elseif($do == 'add') $wpdb->query($wpdb->prepare("INSERT INTO ".$wpdb->prefix."sharebar (position, name, big, small) VALUES('%d','%s', '". $_POST['big'] ."', '". $_POST['small'] ."')", sanitize($_POST['position']), sanitize($_POST['name'])));
    32     elseif($do == 'delete') $wpdb->query($wpdb->prepare("DELETE FROM ".$wpdb->prefix."sharebar WHERE id=%d LIMIT 1", $id));
    33     elseif($do == 'reset') sharebar_reset();
     31    if($do == 'update') {
     32        check_admin_referer( 'wp_sharebar_add_update' );
     33        $wpdb->query($wpdb->prepare("UPDATE ".$wpdb->prefix."sharebar SET enabled='%d', position='%d', name='%s', big='%s', small='%s' WHERE id='%d'", sanitize($_POST['enabled']), sanitize($_POST['position']), $_POST['name'], $_POST['big'], $_POST['small'], $id));
     34    }
     35    elseif($do == 'add') {
     36        check_admin_referer( 'wp_sharebar_add_update' );
     37        $wpdb->query($wpdb->prepare("INSERT INTO ".$wpdb->prefix."sharebar (position, name, big, small) VALUES('%d','%s', '%s', '%s')", sanitize($_POST['position']), $_POST['name'], $_POST['big'], $_POST['small']));
     38    }
     39    elseif($do == 'delete') {
     40        check_admin_referer( 'wp_sharebar_delete' );
     41        $wpdb->query($wpdb->prepare("DELETE FROM ".$wpdb->prefix."sharebar WHERE id=%d LIMIT 1", $id));
     42    }
     43    elseif($do == 'reset') {
     44        check_admin_referer( 'wp_sharebar_reset' );
     45        sharebar_reset();
     46    }
    3447    elseif($do == 'settings'){
     48        check_admin_referer( 'wp_sharebar_settings' );
    3549        $binaries = array("auto_posts","auto_pages","horizontal","credit");
    36         foreach($binaries as $binary) $_POST[$binary] = $_POST[$binary] ? 1:0;
     50        foreach($binaries as $binary) $_POST[$binary] = isset($_POST[$binary]) ? 1:0;
    3751        $_POST['width'] = $_POST['width'] ? $_POST['width']:1000;
    3852        sharebar_settings($_POST);
    3953        foreach($sharebar_options as $option) $$option = get_option('sharebar_'.$option);
    4054    }elseif($do == 'update-all'){
     55        check_admin_referer( 'wp_sharebar_update_all' );
    4156        $buttons = $_POST['buttons'];
    4257        $uptask = $_POST['update-task'];
    … …  
    132147        if($task == 'edit'){
    133148            echo '<table class="thebutton">';
    134             echo "<tr><th class='name'><strong>".$item->name.":</strong></th></tr>";
    135             echo "<tr><td>".$item->big."</td>";
    136             echo "<td>".$item->small."</td></tr>";
     149            echo "<tr><th class='name'><strong>".esc_html($item->name).":</strong></th></tr>";
     150            echo "<tr><td>".($item->big)."</td>";
     151            echo "<td>".($item->small)."</td></tr>";
    137152            echo '</table>';
    138153        }
    139         if($item->enabled) $enabled = " checked='true'";
     154        if(isset($item) && $item->enabled) $enabled = " checked='true'";
    140155    ?>
    141156    <form action="?page=<?php echo $_GET['page']; ?>" method="post">
     157        <?php wp_nonce_field( 'wp_sharebar_add_update' ); ?>
    142158        <p class="mediumtext alignleft">
    143159            <label for="name" class="wide">Name:</label>
    144             <input type="text" name="name" id="name" value="<?php echo $item->name; ?>" class="mediumtext" />
     160            <input type="text" name="name" id="name" value="<?php echo isset($item) ? esc_attr($item->name) : ''; ?>" class="mediumtext" />
    145161        </p>
    146162        <p class="smalltext alignleft">
    147163            <label for="position" class="wide">Position:</label>
    148             <input type="text" name="position" id="position" value="<?php echo $item->position; ?>" class="smalltext" />
     164            <input type="number" name="position" min="0" id="position" value="<?php echo isset($item) ? esc_attr($item->position) : ''; ?>" class="smalltext" />
    149165        </p>
    150166        <p class="checkfield alignleft">
    … …  
    155171        <p>
    156172            <label for="big" class="wide">Big Button:</label>
    157             <textarea name="big" id="big" class="text" rows=5><?php echo $item->big; ?></textarea>
     173            <textarea name="big" id="big" class="text" rows=5><?php echo isset($item) ? esc_attr($item->big) : ''; ?></textarea>
    158174        </p>
    159175        <p>
    160176            <label for="small" class="wide">Small Button:</label>
    161             <textarea name="small" id="small" class="text" rows=5><?php echo $item->small; ?></textarea>
     177            <textarea name="small" id="small" class="text" rows=5><?php echo isset($item) ? esc_attr($item->small) : ''; ?></textarea>
    162178        </p>
    163179        <input type="hidden" name="do" value="<?php if($task == 'edit') echo "update"; else echo "add"; ?>" />
    164         <input type="hidden" name="id" value="<?php echo $item->id; ?>" />
     180        <input type="hidden" name="id" value="<?php echo esc_attr($item->id); ?>" />
    165181        <input type="hidden" name="status" value="Share button has been <?php if($task == 'edit') echo "updated"; else echo "added"; ?>." />
    166182        <input type="submit" value="<?php if($task == 'edit') echo "Update Button"; else echo "Add Button"; ?>" class="alignleft button-primary" />
    … …  
    173189    <?php
    174190        echo '<table class="thebutton">';
    175         echo "<tr><th class='name'><strong>".$item->name.":</strong></th></tr>";
     191        echo "<tr><th class='name'><strong>".esc_html($item->name).":</strong></th></tr>";
    176192        echo "<tr><td>".$item->big."</td>";
    177193        echo "<td>".$item->small."</td></tr>";
    … …  
    179195    ?>
    180196    <p>Are you sure you want to delete this button?</p>
    181     <form action="?page=<?php echo $_GET['page']; ?>" method="post">
     197    <form action="?page=<?php echo esc_attr($_GET['page']); ?>" method="post">
     198        <?php wp_nonce_field( 'wp_sharebar_delete' ); ?>
    182199        <input type="hidden" name="do" value="delete" />
    183         <input type="hidden" name="id" value="<?php echo $item->id; ?>" />
     200        <input type="hidden" name="id" value="<?php echo esc_attr($item->id); ?>" />
    184201        <input type="hidden" name="status" value="Button has been deleted." />
    185202        <input type="submit" value="Delete" class="alignleft button-primary" />
    186203    </form>
    187     <a href="?page=<?php echo $_GET['page']; ?>" class="alignleft" style="margin: 2px 0 0 10px;">Cancel</a>
     204    <a href="?page=<?php echo esc_attr($_GET['page']); ?>" class="alignleft" style="margin: 2px 0 0 10px;">Cancel</a>
    188205       
    189206<?php }elseif($task == 'reset'){ ?>
    … …  
    192209    <p>Are you sure you want to reset <strong>ALL</strong> share buttons?  This cannot be undone and you will lose any customizations - all buttons will be reset to defaults.</p>
    193210    <form action="?page=<?php echo $_GET['page']; ?>" method="post">
     211        <?php wp_nonce_field( 'wp_sharebar_reset' ); ?>
    194212        <input type="hidden" name="do" value="reset" />
    195213        <input type="hidden" name="status" value="All buttons have been reset to inital configuration." />
    196214        <input type="submit" value="Reset ALL Buttons" class="alignleft button-primary" />
    197215    </form>
    198     <a href="?page=<?php echo $_GET['page']; ?>" class="alignleft" style="margin: 2px 0 0 10px;">Cancel</a>
     216    <a href="?page=<?php echo esc_attr($_GET['page']); ?>" class="alignleft" style="margin: 2px 0 0 10px;">Cancel</a>
    199217       
    200218<?php }elseif($task == 'settings'){ ?>
    … …  
    202220    <h3>Sharebar Settings</h3>
    203221    <form action="?page=<?php echo $_GET['page']; ?>&t=settings" method="post">
     222        <?php wp_nonce_field( 'wp_sharebar_settings' ); ?>
    204223        <h4>Add Sharebar</h4>
    205224        <p>The following settings allow you to automatically add the Sharebars to your posts and pages.  If you would like to add them manually, make sure that both are unchecked and paste the PHP code into your template instead.</p>
    … …  
    225244        </p>
    226245        <p>
    227             <input type="text" name="leftoffset" id="leftoffset" class="minitext" value="<?php echo $leftoffset; ?>" /><label for="leftoffset">Left Offset (used when positioned to left)</label>
    228         </p>
    229         <p>
    230             <input type="text" name="rightoffset" id="rightoffset" class="minitext" value="<?php echo $rightoffset; ?>" /><label for="rightoffset">Right Offset (used when positioned to right)</label>
     246            <input type="text" name="leftoffset" id="leftoffset" class="minitext" value="<?php echo esc_attr($leftoffset); ?>" /><label for="leftoffset">Left Offset (used when positioned to left)</label>
     247        </p>
     248        <p>
     249            <input type="text" name="rightoffset" id="rightoffset" class="minitext" value="<?php echo esc_attr($rightoffset); ?>" /><label for="rightoffset">Right Offset (used when positioned to right)</label>
    231250        </p>
    232251        <p>
    … …  
    244263        <p>
    245264            <label for="twitter_username">Sharebar Background Color:</label>
    246             <input type="text" name="sbg" id="sbg" class="smalltext" value="<?php echo $sbg; ?>" />
     265            <input type="text" name="sbg" id="sbg" class="smalltext" value="<?php echo esc_attr($sbg); ?>" />
    247266        </p>
    248267        <p>
    249268            <label for="twitter_username">Sharebar Border Color:</label>
    250             <input type="text" name="sborder" id="sborder" class="smalltext" value="<?php echo $sborder; ?>" />
     269            <input type="text" name="sborder" id="sborder" class="smalltext" value="<?php echo esc_attr($sborder); ?>" />
    251270        </p>
    252271        <br />
    … …  
    255274        <input type="submit" value="Update Settings" class="alignleft button-primary" />
    256275    </form>
    257     <a href="?page=<?php echo $_GET['page']; ?>" class="alignleft" style="margin: 2px 0 0 10px;">Cancel</a>
     276    <a href="?page=<?php echo esc_attr($_GET['page']); ?>" class="alignleft" style="margin: 2px 0 0 10px;">Cancel</a>
    258277       
    259278<?php }elseif($task == 'donate'){ ?>
    … …  
    318337   
    319338    <form action="?page=<?php echo $_GET['page']; ?>" method="post">
     339    <?php wp_nonce_field( 'wp_sharebar_update_all' ); ?>
    320340    <table id="sharebar-tl">
    321341        <thead><tr><th><a href="/" class="toggle-all">All</a></th><th class='leftj'>Name</th><th>Position</th><th>Big Button</th><th>Small Button</th><th>Actions</th></tr></thead>
    … …  
    330350                $name = $result->name;
    331351            }
    332             echo "\t\t<tr$dis><td><input type='checkbox' name='buttons[]' id='buttons' value='".$result->id."' class='checkbox c23' /></td><td class='leftj'>".$name."</td><td>".$result->position."<a href='?page=Sharebar&pos=moveup&id=".$result->id."'><img src='" . plugins_url() ."/sharebar/images/up.gif'/></a><a href='?page=Sharebar&pos=movedown&id=".$result->id."'><img src='" . plugins_url() ."/sharebar/images/down.gif'/></a></td><td>".$result->big."</td><td>".$result->small."</td><td><a href='?page=".$_GET['page']."&t=edit&id=".$result->id."'>Edit</a> | <a href='?page=".$_GET['page']."&t=delete&id=".$result->id."'>Delete</a></td></tr>\n";
     352            echo "\t\t<tr$dis><td><input type='checkbox' name='buttons[]' id='buttons' value='".$result->id."' class='checkbox c23' /></td><td class='leftj'>".$name."</td><td>".$result->position."<a href='?page=Sharebar&pos=moveup&id=".$result->id."'><img src='" . plugins_url() ."/sharebar/images/up.gif'/></a><a href='?page=Sharebar&pos=movedown&id=".$result->id."'><img src='" . plugins_url() ."/sharebar/images/down.gif'/></a></td><td>".$result->big."</td><td>".$result->small."</td><td><a href='?page=".esc_attr($_GET['page'])."&t=edit&id=".esc_attr($result->id)."'>Edit</a> | <a href='?page=".esc_attr($_GET['page'])."&t=delete&id=".esc_attr($result->id)."'>Delete</a></td></tr>\n";
    333353        } ?>
    334354        </tbody>

  • sharebar/trunk/sharebar.php

    r1629553 r2745551  
    44Plugin URI: http://devgrow.com/sharebar-wordpress-plugin/
    55Description: Adds a dynamic bar with sharing icons (Facebook, Twitter, etc.) that changes based on browser size and page location.
    6 Version: 1.4.1
     6Version: 1.4.2
    77Author: Monji Dolon
    88Author URI: http://mdolon.com/
    … …  
    115115        $credit = get_option('sharebar_credit');
    116116        $str = '<ul id="sharebar" style="background:#'.$sbg.';border-color:#'.$sborder.';">';
    117         $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."sharebar WHERE enabled=1 ORDER BY position, id ASC", null)); $str .= "\n";
     117        $results = $wpdb->get_results("SELECT * FROM ".$wpdb->prefix."sharebar WHERE enabled=1 ORDER BY position, id ASC"); $str .= "\n";
    118118        foreach($results as $result){ $str .= '<li>'.sharebar_filter($result->big).'</li>'; }
    119119        if($credit) $str .= '<li class="credit"><a rel="nofollow" href="http://sumo.com/" target="_blank">Sumo</a></li>';
    … …  
    127127        global $wpdb;
    128128        $str = '<ul id="sharebarx">';
    129         $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."sharebar WHERE enabled=1 ORDER BY position, id ASC", null)); $str .= "\n";
     129        $results = $wpdb->get_results("SELECT * FROM ".$wpdb->prefix."sharebar WHERE enabled=1 ORDER BY position, id ASC"); $str .= "\n";
    130130        foreach($results as $result) { $str .= '<li>'.sharebar_filter($result->small).'</li>'; }
    131131        $str .= '</ul>';
    … …  
    136136function sharebar_button($name, $size = 'big'){
    137137    global $wpdb;
    138     $item = $wpdb->get_row($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."sharebar WHERE name='$name'"));
     138    $item = $wpdb->get_row($wpdb->prepare("SELECT * FROM ".$wpdb->prefix."sharebar WHERE name='%s'", $name));
    139139    if($size == 'big') echo stripslashes($item->big); else echo stripslashes($item->small);
    140140}
    … …  
    173173 
    174174function sharebar_admin_actions(){
    175     if(current_user_can('manage_options')) add_options_page("Sharebar", "Sharebar", 1, "Sharebar", "sharebar_menu");
     175    if(current_user_can('manage_options')) add_options_page("Sharebar", "Sharebar", 'manage_options', "Sharebar", "sharebar_menu");
    176176}
    177177
    … …  
    247247    }
    248248    else {
     249        /*
    249250        if (get_magic_quotes_gpc()) {
    250251            $input = stripslashes($input);
    251252        }
     253        */
    252254        $input  = cleanInput($input);
    253255        $output = esc_sql($input);
Note: See TracChangeset for help on using the changeset viewer.