WordPress.org
Get WordPress

Plugin Directory

Changeset 2949021


Ignore:
Timestamp:
08/08/2023 02:51:12 AM (2 years ago)
Author:
grimmdude
Message:

4.5 - Address XSS vulnerability.

Location:
social-share-boost
Files:
24 added
4 edited

Legend:

Unmodified
Added
Removed

  • social-share-boost/trunk/common_lib.php

    r2478626 r2949021  
    100100                $curval='';
    101101                            $curval = stripslashes( $curval);
    102                             $html.='<tr valign="top"><th scope="row"><label for="'.$field['id'].'">'.$field['title'].'</label></th><td>';
     102                            $html.='<tr valign="top"><th scope="row"><label for="'.esc_attr($field['id']).'">'.esc_html($field['title']).'</label></th><td>';
    103103
    104104                switch($field['type'])
    105105                {
    106106                    case 'textarea':
    107                         $html.='<textarea style="width: 25em;" rows=4 id="'.$field['id'].'" name="'.$optn_val.'['.$field['id'].']" class="regular-text">'. $curval.'</textarea>';
     107                        $html.='<textarea style="width: 25em;" rows=4 id="'.esc_attr($field['id']).'" name="'.$optn_val.'['.$field['id'].']" class="regular-text">'. esc_textarea($curval).'</textarea>';
    108108                                    break;
    109109                                case 'text':
    110                                     $html.='<input id="'.$field['id'].'" type="text" name="'.$optn_val.'['.$field['id'].']" value="'. $curval.'" class="regular-text" />';
     110                                    $html.='<input id="'.$field['id'].'" type="text" name="'.$optn_val.'['.$field['id'].']" value="'. esc_attr($curval).'" class="regular-text" />';
    111111                                    break;
    112112                                case 'checkbox':

  • social-share-boost/trunk/readme.txt

    r2764903 r2949021  
    33Tags: social, share, share buttons, social boost, social share, facebook, twitter, google plus, sharing, SEO, addthis, sharethis
    44Requires at least: 2.5
    5 Tested up to: 6.0
    6 Stable tag: 4.4
     5Tested up to: 6.2
     6Stable tag: 4.5
    77License: GPLv2 or later
    88
    … …  
    7878== Changelog ==
    7979
     80= 4.5 =
     81* Address XSS vulnerability
    8082
    8183= 4.1 =

  • social-share-boost/trunk/social-share-boost.php

    r2478626 r2949021  
    33Plugin URI: http://sumo.com/
    44Description: Boost Your Social Sharing by automatically adding various social share tools above or below the posts, page and excerpts. This plug-in also provides the functionality to show the social tools using a simple shortcode.
    5 Version: 4.4
     5Version: 4.5
    66Author: Sumo
    7 Author URI: http://sumo.com/
     7Author URI: https://sumo.com/
    88License: GPLv2 or later
    99*/

  • social-share-boost/trunk/ssb_widgets.php

    r2478624 r2949021  
    8888        $linkedin = esc_attr($instance['linkedin']);
    8989        $scoopit = esc_attr($instance['scoopit']);
    90         echo'<p><label for="'. $this->get_field_id('title').'">Title:</label><input class="widefat" id="'. $this->get_field_id('title').'" name="'. $this->get_field_name('title').'>" type="text" value="'. $title.'" /></p>';
    91         echo'<p><label for="'. $this->get_field_id('url').'">Url to share(leave empty to use homeurl):</label><input class="widefat" id="'. $this->get_field_id('url').'" name="'. $this->get_field_name('url').'>" type="text" value="'. $url.'" /></p>';
    92 
    93         echo'<p><label for="'. $this->get_field_id('fb_like').'">Facebook Like:</label> &nbsp;&nbsp;<input class="widefat" id="'. $this->get_field_id('fb_like').'" name="'. $this->get_field_name('fb_like').'>" type="checkbox" ';
     90        echo'<p><label for="'. esc_attr($this->get_field_id('title')).'">Title:</label><input class="widefat" id="'. esc_attr($this->get_field_id('title')).'" name="'. esc_attr($this->get_field_name('title')).'>" type="text" value="'. esc_attr($title).'" /></p>';
     91        echo'<p><label for="'. esc_attr($this->get_field_id('url')).'">Url to share(leave empty to use homeurl):</label><input class="widefat" id="'. esc_attr($this->get_field_id('url')).'" name="'. esc_attr($this->get_field_name('url')).'>" type="text" value="'. esc_attr($url).'" /></p>';
     92
     93        echo'<p><label for="'. esc_attr($this->get_field_id('fb_like')).'">Facebook Like:</label> &nbsp;&nbsp;<input class="widefat" id="'. esc_attr($this->get_field_id('fb_like')).'" name="'. esc_attr($this->get_field_name('fb_like')).'>" type="checkbox" ';
    9494        if ($fb_like)
    9595            echo ' checked=checked ';
    9696        echo'value="1" /></p>';
    9797
    98            echo'<p><label for="'. $this->get_field_id('fb_share').'">Facebook Share:</label> &nbsp;&nbsp;<input class="widefat" id="'. $this->get_field_id('fb_share').'" name="'. $this->get_field_name('fb_share').'>" type="checkbox" ';
     98           echo'<p><label for="'. esc_attr($this->get_field_id('fb_share')).'">Facebook Share:</label> &nbsp;&nbsp;<input class="widefat" id="'. esc_attr($this->get_field_id('fb_share')).'" name="'. esc_attr($this->get_field_name('fb_share')).'>" type="checkbox" ';
    9999        if ($fb_share)
    100100            echo ' checked=checked ';
    … …  
    102102
    103103
    104            echo'<p><label for="'. $this->get_field_id('twtr').'">Tweeter:</label> &nbsp;&nbsp;<input class="widefat" id="'. $this->get_field_id('twtr').'" name="'. $this->get_field_name('twtr').'>" type="checkbox" ';
     104           echo'<p><label for="'. esc_attr($this->get_field_id('twtr')).'">Tweeter:</label> &nbsp;&nbsp;<input class="widefat" id="'. esc_attr($this->get_field_id('twtr')).'" name="'. esc_attr($this->get_field_name('twtr')).'>" type="checkbox" ';
    105105        if ($twtr)
    106106            echo ' checked=checked ';
    107107        echo'value="1" /></p>';
    108108
    109            echo'<p><label for="'. $this->get_field_id('gplus').'">Google Plus:</label> &nbsp;&nbsp; <input class="widefat" id="'. $this->get_field_id('gplus').'" name="'. $this->get_field_name('gplus').'>" type="checkbox" ';
     109           echo'<p><label for="'. esc_attr($this->get_field_id('gplus')).'">Google Plus:</label> &nbsp;&nbsp; <input class="widefat" id="'. esc_attr($this->get_field_id('gplus')).'" name="'. esc_attr($this->get_field_name('gplus')).'>" type="checkbox" ';
    110110        if ($gplus)
    111111            echo ' checked=checked ';
    112112        echo'value="1" /></p>';
    113113
    114            echo'<p><label for="'. $this->get_field_id('pint').'">Pinterest:</label> &nbsp;&nbsp; <input class="widefat" id="'. $this->get_field_id('pint').'" name="'. $this->get_field_name('pint').'>" type="checkbox" ';
     114           echo'<p><label for="'. esc_attr($this->get_field_id('pint')).'">Pinterest:</label> &nbsp;&nbsp; <input class="widefat" id="'. esc_attr($this->get_field_id('pint')).'" name="'. esc_attr($this->get_field_name('pint')).'>" type="checkbox" ';
    115115        if ($pint)
    116116            echo ' checked=checked ';
    117117        echo'value="1" /></p>';
    118118
    119            echo'<p><label for="'. $this->get_field_id('stmbl').'">Stumbleupon:</label> &nbsp;&nbsp; <input class="widefat" id="'. $this->get_field_id('stmbl').'" name="'. $this->get_field_name('stmbl').'>" type="checkbox" ';
     119           echo'<p><label for="'. esc_attr($this->get_field_id('stmbl')).'">Stumbleupon:</label> &nbsp;&nbsp; <input class="widefat" id="'. esc_attr($this->get_field_id('stmbl')).'" name="'. esc_attr($this->get_field_name('stmbl')).'>" type="checkbox" ';
    120120        if ($stmbl)
    121121            echo ' checked=checked ';
    122122        echo'value="1" /></p>';
    123123
    124            echo'<p><label for="'. $this->get_field_id('tumblr').'">Tumblr:</label> &nbsp;&nbsp; <input class="widefat" id="'. $this->get_field_id('tumblr').'" name="'. $this->get_field_name('tumblr').'>" type="checkbox" ';
     124           echo'<p><label for="'. esc_attr($this->get_field_id('tumblr')).'">Tumblr:</label> &nbsp;&nbsp; <input class="widefat" id="'. esc_attr($this->get_field_id('tumblr')).'" name="'. esc_attr($this->get_field_name('tumblr')).'>" type="checkbox" ';
    125125        if ($tumblr)
    126126            echo ' checked=checked ';
    127127        echo'value="1" /></p>';
    128128
    129            echo'<p><label for="'. $this->get_field_id('linkedin').'">LinkedIn:</label> &nbsp;&nbsp; <input class="widefat" id="'. $this->get_field_id('linkedin').'" name="'. $this->get_field_name('linkedin').'>" type="checkbox" ';
     129           echo'<p><label for="'. esc_attr($this->get_field_id('linkedin')).'">LinkedIn:</label> &nbsp;&nbsp; <input class="widefat" id="'. esc_attr($this->get_field_id('linkedin')).'" name="'. esc_attr($this->get_field_name('linkedin')).'>" type="checkbox" ';
    130130        if ($linkedin)
    131131            echo ' checked=checked ';
    132132        echo'value="1" /></p>';
    133          echo'<p><label for="'. $this->get_field_id('scoopit').'">Scoop it:</label> &nbsp;&nbsp; <input class="widefat" id="'. $this->get_field_id('scoopit').'" name="'. $this->get_field_name('scoopit').'>" type="checkbox" ';
     133         echo'<p><label for="'. esc_attr($this->get_field_id('scoopit')).'">Scoop it:</label> &nbsp;&nbsp; <input class="widefat" id="'. esc_attr($this->get_field_id('scoopit')).'" name="'. esc_attr($this->get_field_name('scoopit')).'>" type="checkbox" ';
    134134        if ($scoopit)
    135135            echo ' checked=checked ';
    … …  
    171171
    172172
    173         echo '<iframe src="//www.facebook.com/plugins/likebox.php?href='.urlencode($url).'&amp;width='.$width.'&amp;height='.$height.'&amp;colorscheme=';
     173        echo '<iframe src="//www.facebook.com/plugins/likebox.php?href='.esc_attr(urlencode($url)).'&amp;width='.esc_attr($width).'&amp;height='.esc_attr($height).'&amp;colorscheme=';
    174174
    175175        if(!$dark)
    … …  
    204204
    205205
    206           echo '&amp;appId=307091639398582" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:'.$width.'px; height:'.$height.'px;" allowTransparency="true"></iframe>';
     206          echo '&amp;appId=307091639398582" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:'.esc_attr($width).'px; height:'.esc_attr($height).'px;" allowTransparency="true"></iframe>';
    207207
    208208
    … …  
    242242
    243243
    244         echo'<p><label for="'. $this->get_field_id('title').'">Title:</label><input class="widefat" id="'. $this->get_field_id('title').'" name="'. $this->get_field_name('title').'>" type="text" value="'. $title.'" /></p>';
    245 
    246         echo'<p><label for="'. $this->get_field_id('url').'">FB page URL:</label><input class="widefat" id="'. $this->get_field_id('url').'" name="'. $this->get_field_name('url').'>" type="text" value="'. $url.'" /></p>';
    247 
    248  
    249 
    250 
    251         echo'<p><label for="'. $this->get_field_id('height').'">Like Box Height:</label><input class="widefat" id="'. $this->get_field_id('height').'" name="'. $this->get_field_name('height').'>" type="text" value="'. $height.'" /></p>';
    252 
    253         echo'<p><label for="'. $this->get_field_id('width').'">Like Box Width:</label><input class="widefat" id="'. $this->get_field_id('width').'" name="'. $this->get_field_name('width').'>" type="text" value="'. $width.'" /></p>';
    254  
    255 
    256 
    257 
    258 
    259            echo'<p><label for="'. $this->get_field_id('faces').'">Show Faces:</label> &nbsp;&nbsp;<input class="widefat" id="'. $this->get_field_id('faces').'" name="'. $this->get_field_name('faces').'>" type="checkbox" ';
     244        echo'<p><label for="'. esc_attr($this->get_field_id('title')).'">Title:</label><input class="widefat" id="'. esc_attr($this->get_field_id('title')).'" name="'. esc_attr($this->get_field_name('title')).'>" type="text" value="'. esc_attr($title).'" /></p>';
     245
     246        echo'<p><label for="'. esc_attr($this->get_field_id('url')).'">FB page URL:</label><input class="widefat" id="'. esc_attr($this->get_field_id('url')).'" name="'. esc_attr($this->get_field_name('url')).'>" type="text" value="'. esc_attr($url).'" /></p>';
     247
     248 
     249
     250
     251        echo'<p><label for="'. esc_attr($this->get_field_id('height')).'">Like Box Height:</label><input class="widefat" id="'. esc_attr($this->get_field_id('height')).'" name="'. esc_attr($this->get_field_name('height')).'>" type="text" value="'. esc_attr($height).'" /></p>';
     252
     253        echo'<p><label for="'. esc_attr($this->get_field_id('width')).'">Like Box Width:</label><input class="widefat" id="'. esc_attr($this->get_field_id('width')).'" name="'. esc_attr($this->get_field_name('width')).'>" type="text" value="'. esc_attr($width).'" /></p>';
     254 
     255
     256
     257
     258
     259           echo'<p><label for="'. esc_attr($this->get_field_id('faces')).'">Show Faces:</label> &nbsp;&nbsp;<input class="widefat" id="'. esc_attr($this->get_field_id('faces')).'" name="'. esc_attr($this->get_field_name('faces')).'>" type="checkbox" ';
    260260        if ($faces)
    261261            echo ' checked=checked ';
    262262        echo'value="1" /></p>';
    263263
    264            echo'<p><label for="'. $this->get_field_id('feed').'">Show Posts:</label> &nbsp;&nbsp;<input class="widefat" id="'. $this->get_field_id('feed').'" name="'. $this->get_field_name('feed').'>" type="checkbox" ';
     264           echo'<p><label for="'. esc_attr($this->get_field_id('feed')).'">Show Posts:</label> &nbsp;&nbsp;<input class="widefat" id="'. esc_attr($this->get_field_id('feed')).'" name="'. esc_attr($this->get_field_name('feed')).'>" type="checkbox" ';
    265265        if ($feed)
    266266            echo ' checked=checked ';
    267267        echo'value="1" /></p>';
    268            echo'<p><label for="'. $this->get_field_id('header').'">Hide Box Header:</label> &nbsp;&nbsp;<input class="widefat" id="'. $this->get_field_id('header').'" name="'. $this->get_field_name('header').'>" type="checkbox" ';
     268           echo'<p><label for="'. esc_attr($this->get_field_id('header')).'">Hide Box Header:</label> &nbsp;&nbsp;<input class="widefat" id="'. esc_attr($this->get_field_id('header')).'" name="'. esc_attr($this->get_field_name('header')).'>" type="checkbox" ';
    269269        if ($header)
    270270            echo ' checked=checked ';
    271271        echo'value="1" /></p>';
    272            echo'<p><label for="'. $this->get_field_id('border').'">Hide Box Border:</label> &nbsp;&nbsp;<input class="widefat" id="'. $this->get_field_id('border').'" name="'. $this->get_field_name('border').'>" type="checkbox" ';
     272           echo'<p><label for="'. esc_attr($this->get_field_id('border')).'">Hide Box Border:</label> &nbsp;&nbsp;<input class="widefat" id="'. esc_attr($this->get_field_id('border')).'" name="'. esc_attr($this->get_field_name('border')).'>" type="checkbox" ';
    273273        if ($border)
    274274            echo ' checked=checked ';
    275         echo'value="1" /></p>';    echo'<p><label for="'. $this->get_field_id('dark').'">Use Dark Theme:</label> &nbsp;&nbsp;<input class="widefat" id="'. $this->get_field_id('dark').'" name="'. $this->get_field_name('dark').'>" type="checkbox" ';
     275        echo'value="1" /></p>';    echo'<p><label for="'. esc_attr($this->get_field_id('dark')).'">Use Dark Theme:</label> &nbsp;&nbsp;<input class="widefat" id="'. esc_attr($this->get_field_id('dark')).'" name="'. esc_attr($this->get_field_name('dark')).'>" type="checkbox" ';
    276276        if ($dark)
    277277            echo ' checked=checked ';
    … …  
    315315            if($value!="")
    316316            {
    317                 echo '<li><a href="'.$value.'" target="_blank"><img src="'.plugins_url('images/'.$key.'.png', __FILE__).'" /></li>';
     317                echo '<li><a href="'.esc_attr($value).'" target="_blank"><img src="'.esc_attr(plugins_url('images/'.$key.'.png', __FILE__)).'" /></li>';
    318318            }
    319319        }
    … …  
    353353        $ico_r['linkd_url'] = array('LinkedIn',esc_attr($instance['linkd_url'])); 
    354354
    355         echo'<p><label for="'. $this->get_field_id('title').'">Title:</label><input class="widefat" id="'. $this->get_field_id('title').'" name="'. $this->get_field_name('title').'>" type="text" value="'. $title.'" /></p>';
     355        echo'<p><label for="'. $this->get_field_id('title').'">Title:</label><input class="widefat" id="'. esc_attr($this->get_field_id('title')).'" name="'. esc_attr($this->get_field_name('title')).'>" type="text" value="'. esc_attr($title).'" /></p>';
    356356
    357357
    358358        foreach ($ico_r as $key => $value)
    359359        {
    360             echo'<p><label for="'. $this->get_field_id($key).'">'.$value[0].' Profile URL:</label><input class="widefat" id="'. $this->get_field_id($key).'" name="'. $this->get_field_name($key).'>" type="text" value="'. $value[1].'" /></p>';
     360            echo'<p><label for="'. esc_attr($this->get_field_id($key)).'">'.esc_attr($value[0]).' Profile URL:</label><input class="widefat" id="'. esc_attr($this->get_field_id($key)).'" name="'. esc_attr($this->get_field_name($key)).'>" type="text" value="'. esc_attr($value[1]).'" /></p>';
    361361        }
    362362    }
Note: See TracChangeset for help on using the changeset viewer.