Changeset 3148752

Timestamp:

09/09/2024 02:14:50 PM (19 months ago)

Author:

babbardel

Message:

Version 2.1.8: Fixed stored XSS vulnerability in the 'align' attribute of the 'wp:separator' block. Improved sanitization and escaping to enhance security. Removed unnecessary .map files to reduce plugin size.

Location:

nova-blocks/trunk

Files:

• languages/nova-blocks.pot (modified) (2 diffs)
• nova-blocks.php (modified) (1 diff)
• packages/core/src/blocks/core/separator/init.php (modified) (2 diffs)
• readme.txt (modified) (2 diffs)

nova-blocks/trunk/languages/nova-blocks.pot

@@ -3 +3 @@
 msgid ""
 msgstr ""
-"Project-Id-Version: Nova Blocks 2.1.7\n"
+"Project-Id-Version: Nova Blocks 2.1.8\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/nova-blocks\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
@@ -10 +10 @@
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"POT-Creation-Date: 2024-05-03T09:50:48+00:00\n"
+"POT-Creation-Date: 2024-09-09T13:11:17+00:00\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "X-Generator: WP-CLI 2.9.0\n"

nova-blocks/trunk/nova-blocks.php

@@ -4 +4 @@
  * Plugin URI: https://github.com/pixelgrade/nova-blocks/
  * Description: Nova Blocks is a collection of <strong>distinctive Gutenberg blocks</strong>, committed to making your site shine like a newborn star. It is taking a design-driven approach to help you made the right decisions and showcase your content in the best shape.
- * Version: 2.1.7
+ * Version: 2.1.8
  * Author: Pixelgrade
  * Author URI: https://www.pixelgrade.com

nova-blocks/trunk/packages/core/src/blocks/core/separator/init.php

@@ -36 +36 @@
         $classes = [
             'wp-block-separator',
-            'align' . $attributes['align']
+            'align' . sanitize_html_class( $attributes['align'] )
         ];
 
@@ -50 +50 @@
 
         <div <?php echo $data_attributes; ?>
-            class="<?php echo join( ' ', $classes ) ?>"
+            class="<?php echo esc_attr( join( ' ', $classes ) ); ?>"
             style="<?php echo esc_attr( $style ); ?>">
             <?php

nova-blocks/trunk/readme.txt

@@ -3 +3 @@
 Tags: blocks, editor, gutenberg, gutenberg blocks, page builder, block enabled, page building, full site editing, site editor, posts collection
 Requires at least: 5.9
-Tested up to: 6.5.3
-Stable tag: 2.1.7
+Tested up to: 6.6.1
+Stable tag: 2.1.8
 Requires PHP: 7.4
 License: GPLv2 or later
@@ -94 +94 @@
 
 == Changelog ==
+
+= 2.1.8 =
+* Fixed an authenticated (Contributor+) stored cross-site scripting (XSS) vulnerability via the 'align' attribute of the 'wp:separator' Gutenberg block.
+* Improved sanitization and escaping of the 'align' attribute to prevent potential XSS attacks.
 
 = 2.1.7 =