Changeset 3085036

Timestamp:

05/11/2024 07:35:30 PM (23 months ago)

Author:

wpkube

Message:

trunk 20240511

Location:

simple-basic-contact-form/trunk

Files:

• readme.txt (modified) (1 diff)
• simple-basic-contact-form.php (modified) (3 diffs)

simple-basic-contact-form/trunk/readme.txt

@@ -145 +145 @@
 
 == Changelog ==
+
+**20240511**
+
+* Fixed security issues
 
 **20240502**

simple-basic-contact-form/trunk/simple-basic-contact-form.php

@@ -10 +10 @@
     Requires at least: 4.1
     Tested up to: 6.5
-    Version: 20240502
+    Version: 20240511
     Requires PHP: 5.2
     Text Domain: scf
@@ -39 +39 @@
 
 $scf_wp_vers = '4.1';
-$scf_version = '20240502';
+$scf_version = '20240511';
 $scf_plugin  = esc_html__('Simple Basic Contact Form', 'scf');
 $scf_options = get_option('scf_options');
@@ -541 +541 @@
 
     $topic   = (isset($_POST['scf_subject']) && !empty($_POST['scf_subject'])) ? sanitize_text_field( stripslashes(strip_tags(trim($_POST['scf_subject'])))) : $subject;    
+    $topic = strip_shortcodes( $topic );
     $topic = str_replace( '[simple_contact_form_date]', current_time( get_option( 'date_format' ) ), $topic );
 
     $name    = isset($_POST['scf_name']) ? sanitize_text_field( stripslashes(strip_tags(trim($_POST['scf_name']))) ) : '';
+    $name = strip_shortcodes( $name );
     $topic = str_replace( '{name}', $name, $topic );
 
     $message = isset($_POST['scf_message']) ? sanitize_text_field( stripslashes(trim($_POST['scf_message'])) ) : '';
+    $message = strip_shortcodes( $message );
 
     $email   = isset($_POST['scf_email']) ? sanitize_text_field($_POST['scf_email']) : '';
+    $email = strip_shortcodes( $email );
 
     $agent   = isset($_SERVER['HTTP_USER_AGENT']) ? sanitize_text_field($_SERVER['HTTP_USER_AGENT']) : esc_html__('[ undefined ]', 'scf');
+    $agent = sanitize_text_field( $agent );
 
     $form    = isset($_SERVER['HTTP_REFERER']) ? sanitize_text_field($_SERVER['HTTP_REFERER']) : esc_html__('[ undefined ]', 'scf');
+    $form = sanitize_text_field( $form );
 
     $host    = isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(gethostbyaddr($_SERVER['REMOTE_ADDR'])) : esc_html__('[ undefined ]', 'scf');
+    $host = sanitize_text_field( $host );
 
     $from    = !empty($recipfrom) ? $recipfrom : $email;