WordPress.org
Get WordPress

Plugin Directory

Changeset 3048089


Ignore:
Timestamp:
03/09/2024 12:10:41 AM (22 months ago)
Author:
grimmdude
Message:

v4.0.8 - Properly escape widget output to prevent XSS.

Location:
social-media-widget
Files:
719 added
2 edited

Legend:

Unmodified
Added
Removed

  • social-media-widget/trunk/readme.txt

    r3041602 r3048089  
    44Requires at least: 2.9.2
    55Tested up to: 6.4.2
    6 Stable tag: 4.0.7
     6Stable tag: 4.0.8
    77
    88Adds links to all of your social media and sharing site profiles. Tons of icons come in 3 sizes, 4 icon styles, and 4 animations.
    … …  
    183183== Changelog ==
    184184
     185= 4.0.8 =
     186
     187* Properly escape widget output to prevent XSS.
     188
    185189= 4.0.7 =
    186190

  • social-media-widget/trunk/social-widget.php

    r3041602 r3048089  
    44 * Plugin URI: http://wordpress.org/extend/plugins/social-media-widget/
    55 * Description: Adds links to all of your social media and sharing site profiles. Tons of icons come in 3 sizes, 4 icon styles, and 4 animations.
    6  * Version: 4.0.7
     6 * Version: 4.0.8
    77 * Author: Noah Kagan
    88 * Author URI: https://appsumo.com/search/?tags=wordpress&utm_source=sumo&utm_medium=wp-widget&utm_campaign=social-media-widget
    … …  
    518518            */
    519519            $target= empty( $this->slugtargets[$name] ) ? $this->newtab : 'target="'.$this->slugtargets[$name].'"';
    520             $html .= '<a href="' . $slug . '" ' . ($name == 'googleplus' ? 'rel="publisher"' : $this->nofollow) . ' ' . $target.'>';
    521             $html .= '<img width="' . $this->icon_size .'" height="' . $this->icon_size . '" src="' . $img . '"
     520            $html .= '<a href="' . esc_attr($slug) . '" ' . ($name == 'googleplus' ? 'rel="publisher"' : $this->nofollow) . ' ' . $target.'>';
     521            $html .= '<img width="' . esc_attr($this->icon_size) .'" height="' . esc_attr($this->icon_size) . '" src="' . esc_attr($img) . '"
    522522                alt="' . esc_attr(empty($this->slugalts[$name]) ? "$this->imgcaption $title": $this->slugalts[$name]).'"
    523523                title="' . esc_attr(empty($this->slugtitles[$name]) ? "$this->imgcaption $title" : $this->slugtitles[$name]) . '" ' .
    524                 ($this->animation == 'fade' || $this->animation == 'combo' ? 'style="opacity: ' . $this->icon_opacity . '; -moz-opacity: ' . $this->icon_opacity . ';"' : '') . ' class="' . $this->animation . '" />';
     524                ($this->animation == 'fade' || $this->animation == 'combo' ? 'style="opacity: ' . esc_attr($this->icon_opacity) . '; -moz-opacity: ' . esc_attr($this->icon_opacity) . ';"' : '') . ' class="' . $this->animation . '" />';
    525525            $html .= '</a>';
    526526            /*
Note: See TracChangeset for help on using the changeset viewer.