WordPress.org
Get WordPress

Plugin Directory

Changeset 3337681


Ignore:
Timestamp:
08/01/2025 09:22:17 AM (8 months ago)
Author:
petredobrescu
Message:

Version 3.10.5

🔒 The Security Hardening Update

Release Date: August 1, 2025

🛡️ Security Fix

  • XSS Vulnerability Patched: Fixed a Cross-Site Scripting (XSS) vulnerability reported by the WordFence team. This issue affected multisite installations and sites where unfiltered_html is disabled.

We strongly recommend updating to benefit from the latest security improvements. Thank you to the WordFence team for the responsible disclosure! 🙏

Location:
shortpixel-adaptive-images
Files:
8 edited
1 copied

Legend:

Unmodified
Added
Removed

  • shortpixel-adaptive-images/tags/3.10.5/includes/actions/page.actions.class.php

    r3209129 r3337681  
    5151
    5252                //sanitize
    53                 if(isset($options->behaviour->api_url)) {
    54                     $options->behaviour->api_url = trim($options->behaviour->api_url);
    55                     if(parse_url($options->behaviour->api_url, PHP_URL_HOST) === NULL) {
    56                         $options->behaviour->api_url = ShortPixelAI::DEFAULT_API_AI . ShortPixelAI::DEFAULT_API_AI_PATH;
     53                if (isset($options->behaviour->api_url)) {
     54                    $url = trim($options->behaviour->api_url);
     55                    if (parse_url($url, PHP_URL_HOST) === NULL) {
     56                        $url = ShortPixelAI::DEFAULT_API_AI . ShortPixelAI::DEFAULT_API_AI_PATH;
    5757                    }
     58                    $url = sanitize_text_field($url);
     59                    $options->behaviour->api_url = $url;
    5860                }
    5961
    60                 //translate simple meta options
     62
     63                //translate simple meta options
    6164                $options = ShortPixelAI::translateSimpleOptions( $options );
    6265

  • shortpixel-adaptive-images/tags/3.10.5/includes/front/vanilla-js-loader.class.php

    r3209129 r3337681  
    4343                    s.src = "https://<?= $scriptDomain ?>/assets/js/bundles/spai-lib-bg<?= $convert === 'detect' ? '-webp' : '' ?>" + v
    4444                        + ".<?=$vjsVer?><?=($dbg ? '.dev' : '')?>.min.js?v=<?= SHORTPIXEL_AI_VERSION ?>";
    45                     w.spaiDomain = "<?= $spaiDomain ?>";
     45                    w.spaiDomain = "<?= esc_js($spaiDomain) ?>";
    4646                    w.spaiData = {
    47                         version: "<?= SHORTPIXEL_AI_VERSION ?>",
    48                         key: "<?= end($apiUrlParts)?>",
    49                         quality: "<?= $this->settings->compression->level ?>",
    50                         convert: "<?= $convert ?>",
     47                        version: "<?= esc_js(SHORTPIXEL_AI_VERSION) ?>",
     48                        key: "<?= esc_js(end($apiUrlParts)) ?>",
     49                        quality: "<?= esc_js($this->settings->compression->level) ?>",
     50                        convert: "<?= esc_js($convert) ?>",
    5151                        lqip: <?= $this->settings->behaviour->lqip ? 'true' : 'false' ?>,
    5252                        <?php
    … …  
    7474                        exclusions: "__SPAI_EXCLUSIONS__",
    7575                        sizeFromImageSuffix: <?php echo(defined('SPAI_FILENAME_RESOLUTION_UNSAFE') ? 'false' : 'true'); ?>,
    76                         ajax_url: "<?= admin_url( 'admin-ajax.php' ) ?>",
     76                        ajax_url: "<?= esc_js(admin_url('admin-ajax.php')) ?>"
    7777                    };
    7878                    b.appendChild(s);

  • shortpixel-adaptive-images/tags/3.10.5/readme.txt

    r3310531 r3337681  
    55Tested up to: 6.8
    66Requires PHP: 5.6.40
    7 Stable tag: 3.10.4
     7Stable tag: 3.10.5
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    249249
    250250== Changelog ==
     251
     252= 3.10.5 =
     253
     254🔒 The Security Hardening Update
     255
     256Release Date: August 1, 2025
     257
     258🛡️ Security Fix
     259
     260* XSS Vulnerability Patched: Fixed a Cross-Site Scripting (XSS) vulnerability reported by the WordFence team. This issue affected multisite installations and sites where `unfiltered_html` is disabled.
     261
     262We strongly recommend updating to benefit from the latest security improvements. Thank you to the WordFence team for the responsible disclosure! 🙏
    251263
    252264= 3.10.4 =

  • shortpixel-adaptive-images/tags/3.10.5/short-pixel-ai.php

    r3310531 r3337681  
    44     * Plugin URI: https://shortpixel.com/
    55     * Description: Display properly sized, smart cropped and optimized images on your website. Images are processed on the fly and served from our CDN.
    6      * Version: 3.10.4
     6     * Version: 3.10.5
    77     * Author: ShortPixel
    88     * GitHub Plugin URI: https://github.com/short-pixel-optimizer/shortpixel-adaptive-images
    … …  
    1616
    1717    if ( !class_exists( 'ShortPixelAI' ) ) {
    18         define( 'SHORTPIXEL_AI_VERSION', '3.10.4' );
     18        define( 'SHORTPIXEL_AI_VERSION', '3.10.5' );
    1919        define( 'SPAI_SNIP_VERSION', '3.1.0' );
    2020        define( 'SHORTPIXEL_AI_VANILLAJS_VER', '1.1' );

  • shortpixel-adaptive-images/trunk/includes/actions/page.actions.class.php

    r3209129 r3337681  
    5151
    5252                //sanitize
    53                 if(isset($options->behaviour->api_url)) {
    54                     $options->behaviour->api_url = trim($options->behaviour->api_url);
    55                     if(parse_url($options->behaviour->api_url, PHP_URL_HOST) === NULL) {
    56                         $options->behaviour->api_url = ShortPixelAI::DEFAULT_API_AI . ShortPixelAI::DEFAULT_API_AI_PATH;
     53                if (isset($options->behaviour->api_url)) {
     54                    $url = trim($options->behaviour->api_url);
     55                    if (parse_url($url, PHP_URL_HOST) === NULL) {
     56                        $url = ShortPixelAI::DEFAULT_API_AI . ShortPixelAI::DEFAULT_API_AI_PATH;
    5757                    }
     58                    $url = sanitize_text_field($url);
     59                    $options->behaviour->api_url = $url;
    5860                }
    5961
    60                 //translate simple meta options
     62
     63                //translate simple meta options
    6164                $options = ShortPixelAI::translateSimpleOptions( $options );
    6265

  • shortpixel-adaptive-images/trunk/includes/front/vanilla-js-loader.class.php

    r3209129 r3337681  
    4343                    s.src = "https://<?= $scriptDomain ?>/assets/js/bundles/spai-lib-bg<?= $convert === 'detect' ? '-webp' : '' ?>" + v
    4444                        + ".<?=$vjsVer?><?=($dbg ? '.dev' : '')?>.min.js?v=<?= SHORTPIXEL_AI_VERSION ?>";
    45                     w.spaiDomain = "<?= $spaiDomain ?>";
     45                    w.spaiDomain = "<?= esc_js($spaiDomain) ?>";
    4646                    w.spaiData = {
    47                         version: "<?= SHORTPIXEL_AI_VERSION ?>",
    48                         key: "<?= end($apiUrlParts)?>",
    49                         quality: "<?= $this->settings->compression->level ?>",
    50                         convert: "<?= $convert ?>",
     47                        version: "<?= esc_js(SHORTPIXEL_AI_VERSION) ?>",
     48                        key: "<?= esc_js(end($apiUrlParts)) ?>",
     49                        quality: "<?= esc_js($this->settings->compression->level) ?>",
     50                        convert: "<?= esc_js($convert) ?>",
    5151                        lqip: <?= $this->settings->behaviour->lqip ? 'true' : 'false' ?>,
    5252                        <?php
    … …  
    7474                        exclusions: "__SPAI_EXCLUSIONS__",
    7575                        sizeFromImageSuffix: <?php echo(defined('SPAI_FILENAME_RESOLUTION_UNSAFE') ? 'false' : 'true'); ?>,
    76                         ajax_url: "<?= admin_url( 'admin-ajax.php' ) ?>",
     76                        ajax_url: "<?= esc_js(admin_url('admin-ajax.php')) ?>"
    7777                    };
    7878                    b.appendChild(s);

  • shortpixel-adaptive-images/trunk/readme.txt

    r3310531 r3337681  
    55Tested up to: 6.8
    66Requires PHP: 5.6.40
    7 Stable tag: 3.10.4
     7Stable tag: 3.10.5
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    249249
    250250== Changelog ==
     251
     252= 3.10.5 =
     253
     254🔒 The Security Hardening Update
     255
     256Release Date: August 1, 2025
     257
     258🛡️ Security Fix
     259
     260* XSS Vulnerability Patched: Fixed a Cross-Site Scripting (XSS) vulnerability reported by the WordFence team. This issue affected multisite installations and sites where `unfiltered_html` is disabled.
     261
     262We strongly recommend updating to benefit from the latest security improvements. Thank you to the WordFence team for the responsible disclosure! 🙏
    251263
    252264= 3.10.4 =

  • shortpixel-adaptive-images/trunk/short-pixel-ai.php

    r3310531 r3337681  
    44     * Plugin URI: https://shortpixel.com/
    55     * Description: Display properly sized, smart cropped and optimized images on your website. Images are processed on the fly and served from our CDN.
    6      * Version: 3.10.4
     6     * Version: 3.10.5
    77     * Author: ShortPixel
    88     * GitHub Plugin URI: https://github.com/short-pixel-optimizer/shortpixel-adaptive-images
    … …  
    1616
    1717    if ( !class_exists( 'ShortPixelAI' ) ) {
    18         define( 'SHORTPIXEL_AI_VERSION', '3.10.4' );
     18        define( 'SHORTPIXEL_AI_VERSION', '3.10.5' );
    1919        define( 'SPAI_SNIP_VERSION', '3.1.0' );
    2020        define( 'SHORTPIXEL_AI_VANILLAJS_VER', '1.1' );
Note: See TracChangeset for help on using the changeset viewer.