WordPress.org
Get WordPress

Plugin Directory

Changeset 3241539


Ignore:
Timestamp:
02/16/2025 11:00:47 PM (13 months ago)
Author:
pattihis
Message:

Version 1.4.1

Location:
simple-photo-feed
Files:
34 added
4 edited

Legend:

Unmodified
Added
Removed

  • simple-photo-feed/trunk/README.txt

    r3211228 r3241539  
    44Tags: photo gallery, instagram, feed, social, embed
    55Requires at least: 5.3.0
    6 Tested up to: 6.7.1
     6Tested up to: 6.7.2
    77Requires PHP: 7.2
    8 Stable tag: 1.4.0
     8Stable tag: 1.4.1
    99License: GPLv2 or later
    1010License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    9595== Changelog ==
    9696
     97= 1.4.1 =
     98* Compatibility with WordPress 6.7.2
     99* Add nonce to Ajax calls for improved security
     100
    97101= 1.4.0 =
    98102* Update to Business API after Basic API deprecation

  • simple-photo-feed/trunk/admin/class-simple-photo-feed-admin.php

    r3211228 r3241539  
    7777                'ajax_url'  => admin_url( 'admin-ajax.php' ),
    7878                'theme_uri' => get_stylesheet_directory_uri(),
     79                'nonce'     => wp_create_nonce( 'simple-photo-feed-nonce' ),
    7980            )
    8081        );
    … …  
    195196     */
    196197    public function spf_disconnect_user() {
     198        $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
     199        if ( ! current_user_can('edit_posts') || ! wp_verify_nonce( $nonce, 'simple-photo-feed-nonce' ) ) {
     200            wp_send_json_error( esc_html__( 'Unauthorized!', 'simple-photo-feed' ), 403 );
     201            return;
     202        }
     203
    197204        $options = get_option( 'spf_main_settings', array() );
    198205
    … …  
    218225     */
    219226    public function spf_clear_feed_cache() {
     227        $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
     228        if ( ! current_user_can('edit_posts') || ! wp_verify_nonce( $nonce, 'simple-photo-feed-nonce' ) ) {
     229            wp_send_json_error( esc_html__( 'Unauthorized!', 'simple-photo-feed' ), 403 );
     230            return;
     231        }
    220232
    221233        if ( $this->spf_delete_transients() ) {

  • simple-photo-feed/trunk/admin/js/simple-photo-feed-admin.js

    r3013593 r3241539  
    1414          data = new FormData();
    1515        data.append('action', 'spf_disconnect_user');
     16        data.append('nonce', window.spf.nonce);
    1617        xhr.open('POST', window.spf.ajax_url, true);
    1718        xhr.onreadystatechange = function () {
    … …  
    5253          data = new FormData();
    5354        data.append('action', 'spf_clear_feed_cache');
     55        data.append('nonce', window.spf.nonce);
    5456        xhr.open('POST', window.spf.ajax_url, true);
    5557        xhr.onreadystatechange = function () {

  • simple-photo-feed/trunk/simple-photo-feed.php

    r3211228 r3241539  
    1414 * Plugin URI:        https://wordpress.org/plugins/simple-photo-feed/
    1515 * Description:       Simple Photo Feed provides an easy way to connect to your Instagram account and display your photos in your WordPress site.
    16  * Version:           1.4.0
     16 * Version:           1.4.1
    1717 * Requires at least: 5.3.0
    18  * Tested up to:      6.7.1
     18 * Tested up to:      6.7.2
    1919 * Requires PHP:      7.2
    2020 * Author:            George Pattichis
    … …  
    3434 * Current plugin version
    3535 */
    36 define( 'SPF_VERSION', '1.4.0' );
     36define( 'SPF_VERSION', '1.4.1' );
    3737
    3838/**
Note: See TracChangeset for help on using the changeset viewer.