WordPress.org
Get WordPress

Plugin Directory

Changeset 3172020


Ignore:
Timestamp:
10/19/2024 03:39:56 PM (17 months ago)
Author:
eemitch
Message:
  • Security Fix for a reflecte cross-site scripting (XSS) issue
  • Security improvements to back-end navigation tabs.
Location:
simple-file-list
Files:
132 added
5 edited

Legend:

Unmodified
Added
Removed

  • simple-file-list/trunk/ee-admin-page.php

    r2885779 r3172020  
    2727
    2828    // Get the new tab's query string value. We will only use values to display tabs that we are expecting.
    29     if( isset( $_GET[ 'tab' ] ) ) { $active_tab = esc_js(sanitize_text_field($_GET[ 'tab' ])); } else { $active_tab = 'file_list'; }
     29    if( isset( $_GET['tab'] ) ) {
     30        $active_tab = sanitize_text_field( $_GET['tab'] ); // Sanitize input
     31    } else {
     32        $active_tab = 'file_list'; // Default tab
     33    }
    3034   
    3135    $eeOutput .= '
    … …  
    3640    // File List
    3741    $eeOutput .= '
    38    
    3942    <span class="nav-tab-wrapper-left">
    40    
    41     <a href="?page=' . eeSFL_BASE_PluginSlug . '&tab=file_list" class="nav-tab '; 
    42     if($active_tab == 'file_list') {$eeOutput .= ' eeActiveTab '; }   
    43     $active_tab == 'file_list' ? 'nav-tab-active' : '';
    44     $eeOutput .= $active_tab . '">' . __('File List', 'ee-simple-file-list') . '</a>';
    45    
     43    <a href="?page=' . esc_attr(eeSFL_BASE_PluginSlug) . '&tab=file_list" class="nav-tab ' . ($active_tab == 'file_list' ? 'nav-tab-active eeActiveTab' : '') . '">' . __('File List', 'ee-simple-file-list') . '</a>';
    4644   
    4745    // Settings
    48     $eeOutput .= '
    49     <a href="?page=' . eeSFL_BASE_PluginSlug . '&tab=settings" class="nav-tab ';   
    50     if($active_tab == 'settings') {$eeOutput .= ' eeActiveTab '; } 
    51     $active_tab == 'settings' ? 'nav-tab-active' : '';
    52     $eeOutput .= $active_tab . '">' . __('List Settings', 'ee-simple-file-list') . '</a>
    53    
    54     <a href="?page=' . eeSFL_BASE_PluginSlug . '&tab=pro" class="nav-tab ';   
    55     if($active_tab == 'pro') {$eeOutput .= ' eeActiveTab '; } 
    56     $active_tab == 'pro' ? 'nav-tab-active' : '';
    57     $eeOutput .= $active_tab . '">' . __('Upgrade Version', 'ee-simple-file-list') . '</a>
    58    
    59    
    60     </span>
    61     <span class="nav-tab-wrapper-right">
    62    
    63    
    64     <a href="?page=' . eeSFL_BASE_PluginSlug . '&tab=author" class="nav-tab ';   
    65     if($active_tab == 'author') {$eeOutput .= ' eeActiveTab '; } 
    66     $active_tab == 'author' ? 'nav-tab-active' : '';
    67     $eeOutput .= $active_tab . '">' . __('Author', 'ee-simple-file-list') . '</a>';
    68    
    69     // Link to Support Form
    70     $eeOutput .= '
    71     <a href="https://simplefilelist.com/get-support/" class="nav-tab" target="_blank">' . __('Get Help', 'ee-simple-file-list') . ' &rarr;</a>
    72    
    73     </span>
    74    
    75     </h2>'; // END Main Tabs   
     46    $eeOutput .= '
     47    <a href="?page=' . esc_attr(eeSFL_BASE_PluginSlug) . '&tab=settings" class="nav-tab ' . ($active_tab == 'settings' ? 'nav-tab-active eeActiveTab' : '') . '">' . __('List Settings', 'ee-simple-file-list') . '</a>';
     48   
     49    // Pro Upgrade
     50    $eeOutput .= '
     51    <a href="?page=' . esc_attr(eeSFL_BASE_PluginSlug) . '&tab=pro" class="nav-tab ' . ($active_tab == 'pro' ? 'nav-tab-active eeActiveTab' : '') . '">' . __('Upgrade Version', 'ee-simple-file-list') . '</a>
     52    </span>';
     53   
     54    // Right Tabs -------
     55    $eeOutput .= '
     56    <span class="nav-tab-wrapper-right">
     57    <a href="?page=' . esc_attr(eeSFL_BASE_PluginSlug) . '&tab=author" class="nav-tab ' . ($active_tab == 'author' ? 'nav-tab-active eeActiveTab' : '') . '">' . __('Author', 'ee-simple-file-list') . '</a>';
     58   
     59    // Link to Support Form
     60    $eeOutput .= '
     61    <a href="https://simplefilelist.com/get-support/" class="nav-tab" target="_blank">' . __('Get Help', 'ee-simple-file-list') . ' &rarr;</a>
     62    </span>
     63    </h2>';
     64    // END Main Tabs
     65   
    7666   
    7767   
    … …  
    168158       
    169159        // Sub Tabs
    170         if( isset( $_GET[ 'subtab' ] ) ) { $active_subtab = esc_js(sanitize_text_field($_GET['subtab'])); } else { $active_subtab = 'list_settings'; }
    171            
    172         $eeOutput .= '
    173        
    174         <h2 class="nav-tab-wrapper">
    175         <div class="ee-nav-sub-tabs">';
     160        if( isset( $_GET['subtab'] ) ) {
     161            $active_subtab = sanitize_text_field( $_GET['subtab'] ); // Sanitize input
     162        } else {
     163            $active_subtab = 'list_settings'; // Default subtab
     164        }
     165       
     166        $eeOutput .= '
     167        <h2 class="nav-tab-wrapper">
     168        <div class="ee-nav-sub-tabs">';
    176169       
    177170        // List Settings
    178         $eeOutput .= '<a href="?page=' . eeSFL_BASE_PluginSlug . '&tab=settings&subtab=list_settings" class="nav-tab '; 
    179         if($active_subtab == 'list_settings') {$eeOutput .= '  eeActiveTab ';}   
    180         $active_subtab == 'list_settings' ? 'nav-tab-active' : '';   
    181         $eeOutput .= $active_subtab . '">' . __('File List Settings', 'ee-simple-file-list') . '</a>';
    182        
    183         // Uploader Settings
    184         $eeOutput .= '<a href="?page=' . eeSFL_BASE_PluginSlug . '&tab=settings&subtab=uploader_settings" class="nav-tab '; 
    185         if($active_subtab == 'uploader_settings') {$eeOutput .= '  eeActiveTab ';}   
    186         $active_subtab == 'uploader_settings' ? 'nav-tab-active' : '';   
    187         $eeOutput .= $active_subtab . '">' . __('File Upload Settings', 'ee-simple-file-list') . '</a>';
    188        
    189         // Notifications Settings
    190         $eeOutput .= '<a href="?page=' . eeSFL_BASE_PluginSlug . '&tab=settings&subtab=email_settings" class="nav-tab '; 
    191         if($active_subtab == 'email_settings') {$eeOutput .= '  eeActiveTab ';}   
    192         $active_subtab == 'email_settings' ? 'nav-tab-active' : '';   
    193         $eeOutput .= $active_subtab . '">' . __('Notification Settings', 'ee-simple-file-list') . '</a>';
    194        
    195         // Extension Settings (Coming Soon)
    196         $eeOutput .= '<a href="?page=' . eeSFL_BASE_PluginSlug . '&tab=settings&subtab=extension_settings" class="nav-tab '; 
    197         if($active_subtab == 'extension_settings') {$eeOutput .= '  eeActiveTab ';}   
    198         $active_subtab == 'extension_settings' ? 'nav-tab-active' : '';   
    199         $eeOutput .= $active_subtab . '">' . __('Extension Settings', 'ee-simple-file-list') . '</a>';
    200        
    201         // END Subtabs
     171        $eeOutput .= '<a href="?page=' . esc_attr(eeSFL_BASE_PluginSlug) . '&tab=settings&subtab=list_settings" class="nav-tab ' . ($active_subtab == 'list_settings' ? 'nav-tab-active' : '') . '">' . __('File List Settings', 'ee-simple-file-list') . '</a>';
     172       
     173        // Uploader Settings
     174        $eeOutput .= '<a href="?page=' . esc_attr(eeSFL_BASE_PluginSlug) . '&tab=settings&subtab=uploader_settings" class="nav-tab ' . ($active_subtab == 'uploader_settings' ? 'nav-tab-active' : '') . '">' . __('File Upload Settings', 'ee-simple-file-list') . '</a>';
     175       
     176        // Notifications Settings
     177        $eeOutput .= '<a href="?page=' . esc_attr(eeSFL_BASE_PluginSlug) . '&tab=settings&subtab=email_settings" class="nav-tab ' . ($active_subtab == 'email_settings' ? 'nav-tab-active' : '') . '">' . __('Notification Settings', 'ee-simple-file-list') . '</a>';
     178       
     179        // Extension Settings (Coming Soon)
     180        $eeOutput .= '<a href="?page=' . esc_attr(eeSFL_BASE_PluginSlug) . '&tab=settings&subtab=extension_settings" class="nav-tab ' . ($active_subtab == 'extension_settings' ? 'nav-tab-active' : '') . '">' . __('Extension Settings', 'ee-simple-file-list') . '</a>';
     181       
     182        // End Subtabs
     183
    202184        $eeOutput .= '
    203185       

  • simple-file-list/trunk/ee-simple-file-list.php

    r3012120 r3172020  
    99Description: A Basic File List Manager with File Uploader
    1010Author: Mitchell Bennis
    11 Version: 6.1.11
     11Version: 6.1.13
    1212Author URI: http://simplefilelist.com
    1313License: GPLv2 or later
    … …  
    2020// CONSTANTS
    2121define('eeSFL_BASE_DevMode', FALSE);
    22 define('eeSFL_BASE_Version', '6.1.11'); // Plugin version
     22define('eeSFL_BASE_Version', '6.1.13'); // Plugin version
    2323define('eeSFL_BASE_PluginName', 'Simple File List');
    2424define('eeSFL_BASE_PluginSlug', 'ee-simple-file-list');

  • simple-file-list/trunk/includes/ee-class.php

    r3012120 r3172020  
    15811581   
    15821582   
    1583     // Get the current URL
     1583    // Get the current URL securely
    15841584    public function eeSFL_GetThisURL($eeIncludeQuery = TRUE) {
    1585        
    1586         // Find what is contained in the address bar?
    1587         // Example: https://mywebsite.com/wordpress/wp-admin/admin.php?page=ee-simple-file-list-pro&eeFolder=WTEA_Curriculum&eeListID=1&ee=1
    1588        
     1585   
    15891586        $eeProtocol = ''; $eeHost = ''; $eeSubFolder = ''; $eeArguments = '';
    1590        
     1587   
    15911588        // If HTTP_HOST is empty, use site_url()
    15921589        if( empty($_SERVER['HTTP_HOST']) ) {
    1593            
    1594             $eeHost = site_url(); // This will contain the path to the WP core files, plus slash
    1595            
     1590   
     1591            $eeHost = esc_url( site_url() ); // This will contain the path to the WP core files, plus slash
     1592   
    15961593            if( strpos($_SERVER['REQUEST_URI'], '?') !== FALSE ) {
    1597                 $eeArray = explode('?', $_SERVER['REQUEST_URI']);
    1598                 if(!empty($eeArray[1])) { $eeArguments = $eeArray[1]; }
    1599             }
    1600        
     1594                $eeArray = explode('?', sanitize_text_field($_SERVER['REQUEST_URI'])); // Sanitize input
     1595                if(!empty($eeArray[1])) {
     1596                    $eeArguments = sanitize_text_field($eeArray[1]); // Sanitize query string arguments
     1597                }
     1598            }
     1599   
    16011600        } else {
    1602            
     1601   
    16031602            $eeProtocol = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://"; // Protocol
    1604             $eeHost = $_SERVER['HTTP_HOST']; // Host
    1605            
    1606             // Get folder path
     1603            $eeHost = sanitize_text_field($_SERVER['HTTP_HOST']); // Sanitize Host
     1604   
     1605            // Get folder path and sanitize the URI
    16071606            if( strpos($_SERVER['REQUEST_URI'], '?') !== false ) {
    1608                
    1609                 $eeArray = explode('?', $_SERVER['REQUEST_URI']);
    1610                 if(!empty($eeArray[0])) { $eeSubFolder = $eeArray[0]; }
    1611                 if(!empty($eeArray[1])) { $eeArguments = $eeArray[1]; }
    1612            
     1607   
     1608                $eeArray = explode('?', sanitize_text_field($_SERVER['REQUEST_URI'])); // Sanitize input
     1609                if(!empty($eeArray[0])) {
     1610                    $eeSubFolder = sanitize_text_field($eeArray[0]); // Sanitize path
     1611                }
     1612                if(!empty($eeArray[1])) {
     1613                    $eeArguments = sanitize_text_field($eeArray[1]); // Sanitize query string arguments
     1614                }
     1615   
    16131616            } else {
    1614                 $eeSubFolder = $_SERVER['REQUEST_URI']; // Just a folder path or a single slash
    1615             }
    1616         }
    1617        
     1617                $eeSubFolder = sanitize_text_field($_SERVER['REQUEST_URI']); // Sanitize the folder path
     1618            }
     1619        }
     1620   
    16181621        // Reassemble the URL
    16191622        $eeURL = $eeProtocol . $eeHost . $eeSubFolder;
    1620        
     1623   
    16211624        // Re-Add the Query if Needed
    1622         if($eeIncludeQuery === TRUE) {
     1625        if($eeIncludeQuery === TRUE && !empty($eeArguments)) {
    16231626            $eeURL .= '?' . $eeArguments;
    1624             $eeURL = remove_query_arg('eeReScan', $eeURL); // Don't want this
    1625         }
    1626    
    1627         return $eeURL;
    1628     }
     1627            $eeURL = esc_url( remove_query_arg('eeReScan', $eeURL) ); // Ensure the URL is escaped and sanitized
     1628        }
     1629   
     1630        return esc_url( $eeURL ); // Return safely escaped URL
     1631    }
     1632
    16291633
    16301634

  • simple-file-list/trunk/includes/ee-email-settings.php

    r2885195 r3172020  
    6161$eeOutput .= '
    6262
    63 <form action="' . admin_url() . '?page=' . eeSFL_BASE_PluginSlug . '&tab=settings&subtab=email_settings" method="post" id="eeSFL_Settings">
     63<form action="' . $eeURL . '" method="post" id="eeSFL_Settings">
    6464<input type="hidden" name="eePost" value="TRUE" />';   
    6565$eeOutput .= wp_nonce_field( 'ee-simple-file-list-settings', 'ee-simple-file-list-settings-nonce', TRUE, FALSE);

  • simple-file-list/trunk/readme.txt

    r3120765 r3172020  
    22Contributors: eemitch
    33Donate link: http://simplefilelist.com
    4 Tags: file list, file sharing, upload files, exchange files, manage files
     4Tags: file list, file sharing, file upload form, upload files, exchange files, host files, zip files, dropbox, ftp
    55Requires at least: 5.0
    6 Requires PHP: 7.4
    7 Tested up to: 6.6
    8 Stable tag: 6.1.11
     6Requires PHP: 7
     7Tested up to: 6.4
     8Stable tag: 6.1.13
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    225225== Upgrade Notice ==
    226226
    227 * 6.1.11 - Improvements
     227* 6.1.13 - Security Fixes
    228228
    229229
    … …  
    236236
    237237== Changelog ==
     238
     239= 6.1.13 =
     240* Security Fix for a reflecte cross-site scripting (XSS) issue
     241* Security improvements to back-end navigation tabs.
    238242
    239243= 6.1.11 =
Note: See TracChangeset for help on using the changeset viewer.