WordPress.org
Get WordPress

Plugin Directory

Changeset 3370739


Ignore:
Timestamp:
09/30/2025 10:15:50 PM (6 months ago)
Author:
jeremyfelt
Message:

Update to version 1.2.2 from GitHub

Location:
clariti
Files:
12 edited
1 copied

Legend:

Unmodified
Added
Removed

  • clariti/tags/1.2.2/clariti.php

    r3062842 r3370739  
    77 * Text Domain:       clariti
    88 * Domain Path:       /languages
    9  * Version:           1.2.1
     9 * Version:           1.2.2
    1010 * Requires at least: 6.0
    1111 * Requires PHP:      7.4
    … …  
    2020 */
    2121add_action( 'admin_menu', array( 'Clariti\Admin', 'action_admin_menu' ) );
    22 add_action( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( 'Clariti\Admin', 'filter_plugin_action_links' ) );
    23 add_action( 'rest_index', array( 'Clariti\REST_API', 'filter_rest_index' ) );
     22add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( 'Clariti\Admin', 'filter_plugin_action_links' ) );
     23add_filter( 'rest_index', array( 'Clariti\REST_API', 'filter_rest_index' ) );
    2424add_action( 'rest_api_init', array( 'Clariti\REST_API', 'register_routes' ) );
    2525/**
    … …  
    7676 */
    7777function clariti_get_supported_post_types() {
    78     $post_types = get_post_types( array(), 'object' );
     78    $post_types = get_post_types( array(), 'objects' );
    7979    $skipped    = array(
    8080        'nav_menu_item',
    … …  
    8989            continue;
    9090        }
    91         // Has to public=true && show_in_rest=true.
     91
     92        // Post type must be public and have REST API support.
    9293        if ( empty( $post_type->public ) || empty( $post_type->show_in_rest ) ) {
    9394            continue;
    9495        }
    95         // Has to support 'title' and 'editor'.
     96
     97        // Post type must support 'title' and 'editor'.
    9698        if ( ! post_type_supports( $post_type->name, 'title' ) || ! post_type_supports( $post_type->name, 'editor' ) ) {
    9799            continue;

  • clariti/tags/1.2.2/inc/class-admin.php

    r3045960 r3370739  
    9595        $key = self::get_api_key();
    9696
    97         if ( ! empty( $_GET['verify'] ) && $key ) {
     97        if ( ! empty( $_GET['verify'] ) && $key ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    9898            Notifier::action_updated_option( self::API_KEY_OPTION, $key, $key );
    9999        }
    … …  
    105105            self::PAGE_SLUG
    106106        );
    107         if ( ! empty( $_GET['advanced'] ) || get_option( self::API_HOST_OPTION ) ) {
     107        if ( ! empty( $_GET['advanced'] ) || get_option( self::API_HOST_OPTION ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    108108            add_settings_field(
    109109                self::API_HOST_OPTION,
    … …  
    137137                <?php submit_button(); ?>
    138138            </form>
    139             <?php if ( isset( $_GET['advanced'] ) && $_GET['advanced'] ) : ?>
     139            <?php if ( isset( $_GET['advanced'] ) && (int) $_GET['advanced'] ) : // phpcs:ignore WordPress.Security.NonceVerification.Recommended ?>
    140140                <form method="post" action="admin-post.php">
    141141                    <table class="form-table" role="presentation">
    … …  
    151151                    <input type="hidden" name="action" value="clear_secret">
    152152                    <input type="hidden" name="clear-secret" value="1">
     153                    <?php wp_nonce_field( 'clear_secret', 'clear_secret_nonce' ); ?>
    153154                    <?php submit_button( 'Clear Secret' ); ?>
    154155                </form>
    … …  
    267268     */
    268269    public static function clear_secret(): void {
    269         delete_option( Admin::API_SECRET_OPTION );
     270        delete_option( self::API_SECRET_OPTION );
    270271    }
    271272
    … …  
    276277     */
    277278    public static function get_api_key(): string {
    278         $value = get_option( Admin::API_KEY_OPTION, '' );
     279        $value = get_option( self::API_KEY_OPTION, '' );
    279280
    280281        return (string) $value;

  • clariti/tags/1.2.2/inc/class-notifier.php

    r3062842 r3370739  
    8585            }
    8686
    87             error_log( 'CLARITI:ERROR - action_added_option - ' . $exception->getMessage() );
     87            error_log( 'CLARITI:ERROR - action_added_option - ' . $exception->getMessage() ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
    8888        }
    8989    }
    … …  
    138138            }
    139139
    140             error_log( 'CLARITI:ERROR - action_updated_option - ' . $exception->getMessage() );
     140            error_log( 'CLARITI:ERROR - action_updated_option - ' . $exception->getMessage() ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
    141141        }
    142142    }
    … …  
    246246     * Inform Clariti when an approved comment is updated.
    247247     *
    248      * @param integer    $id      The comment ID.
    249      * @param WP_Comment $comment Comment object.
     248     * @param integer     $id      The comment ID.
     249     * @param \WP_Comment $comment Comment object.
    250250     */
    251251    public static function action_wp_insert_comment( $id, $comment ) {
    … …  
    393393            self::send_clariti_payload( $payload );
    394394        } catch ( \Exception $exception ) {
    395             error_log( 'CLARITI:ERROR - action_updated_option - ' . $exception->getMessage() );
     395            error_log( 'CLARITI:ERROR - action_updated_option - ' . $exception->getMessage() ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
    396396        }
    397397    }
    … …  
    407407        } elseif ( get_option( Admin::API_HOST_OPTION, '' ) ) {
    408408            $host = get_option( Admin::API_HOST_OPTION, '' );
    409         } elseif ( ! empty( $_POST[ Admin::API_HOST_OPTION ] ) && ! Admin::is_valid_api_host( $_POST[ Admin::API_HOST_OPTION ] ) ) {
    410             $host = $_POST[ Admin::API_HOST_OPTION ];
     409        } elseif ( ! empty( $_POST[ Admin::API_HOST_OPTION ] ) && ! Admin::is_valid_api_host( sanitize_text_field( wp_unslash( $_POST[ Admin::API_HOST_OPTION ] ) ) ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
     410            $host = sanitize_text_field( wp_unslash( $_POST[ Admin::API_HOST_OPTION ] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
    411411        } else {
    412412            $host = self::API_HOST_DEFAULT;
    … …  
    456456
    457457        if ( $response instanceof \WP_Error ) {
    458             throw new \Exception( $response->get_error_message() );
     458            throw new \Exception( esc_html( $response->get_error_message() ) );
    459459        }
    460460
    461461        $data = json_decode( $response['body'], true );
    462462
    463         if ( ! $data || is_wp_error( $data ) ) {
     463        if ( ! $data || ! is_array( $data ) ) {
    464464            throw new \Exception( 'Could not read response from Clariti' );
    465465        }
    466466
    467         if ( false === ( (bool) $data['ok'] ?? false ) ) {
     467        if ( false === (bool) ( $data['ok'] ?? false ) ) {
    468468            // If Clariti replies with a 601 error code, clear the secret and
    469469            // prevent further requests until a new API key is added.
    470             if ( 601 === ( (int) $data['error']['code'] ?? null ) ) {
     470            if ( 601 === (int) ( $data['error']['code'] ?? null ) ) {
    471471                Admin::clear_secret();
    472472            }
    473473
    474             throw new \Exception( "{$data['error']['code']} - {$data['error']['message']}" );
     474            throw new \Exception( esc_html( "{$data['error']['code']} - {$data['error']['message']}" ) );
    475475        }
    476476
    … …  
    527527     */
    528528    public static function clear_secret_option() {
     529        check_admin_referer( 'clear_secret', 'clear_secret_nonce' );
     530
     531        if ( ! current_user_can( Admin::CAPABILITY ) ) {
     532            wp_die( esc_html__( 'You are not authorized to perform this action.', 'clariti' ) );
     533        }
     534
    529535        Admin::clear_secret();
    530536        Admin::send_admin_notification( 'clariti-updated-option', 'clariti-updated-option-success', 'Clariti Secret cleared!', 'success' );

  • clariti/tags/1.2.2/inc/class-rest-api.php

    r3045960 r3370739  
    4141     * Filters the REST API index to include our own data.
    4242     *
    43      * @param WP_REST_Response $response Existing response object.
     43     * @param \WP_REST_Response $response Existing response object.
    4444     * @return object
    4545     */
    … …  
    164164        }
    165165
    166         $key = admin::get_api_key();
     166        $key = Admin::get_api_key();
    167167
    168168        return array(

  • clariti/tags/1.2.2/inc/integrations/class-the-blog-fixer.php

    r2997887 r3370739  
    1818     * Fires after an operation has been performed on a post.
    1919     *
    20      * @param object $po   Post operation object.
    21      * @param object $post Post.
     20     * @param object   $po   Post operation object.
     21     * @param \WP_Post $post Post.
    2222     */
    2323    public static function action_tbf_after_post_operation_execution( $po, $post ) {

  • clariti/tags/1.2.2/readme.txt

    r3370647 r3370739  
    44Requires at least: 6.0
    55Tested up to: 6.8
    6 Stable tag: 1.2.1
     6Stable tag: 1.2.2
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    2828== Frequently Asked Questions ==
    2929
    30 = Where do I report security bugs found in this plugin? =
     30= Where do I report security bugs? =
    3131
    32 Please report security bugs found in the source code of the Clariti plugin through the [Patchstack Vulnerability Disclosure  Program](https://patchstack.com/database/vdp/ce756ba9-6201-4854-bf28-499d3c2422fd). The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.
     32Please report security bugs found in the source code of the Clariti plugin to security@clariti.com.
    3333
    3434== Installation ==
    … …  
    4949
    5050== Changelog ==
     51
     52= 1.2.2 (September 30, 2025) =
     53
     54* Fix an issue where a secondary key used in the connection to Clariti could be deleted by an authenticated user.
     55* Improve nonce verification.
    5156
    5257= 1.2.1 (April 2, 2024) =

  • clariti/trunk/clariti.php

    r3062842 r3370739  
    77 * Text Domain:       clariti
    88 * Domain Path:       /languages
    9  * Version:           1.2.1
     9 * Version:           1.2.2
    1010 * Requires at least: 6.0
    1111 * Requires PHP:      7.4
    … …  
    2020 */
    2121add_action( 'admin_menu', array( 'Clariti\Admin', 'action_admin_menu' ) );
    22 add_action( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( 'Clariti\Admin', 'filter_plugin_action_links' ) );
    23 add_action( 'rest_index', array( 'Clariti\REST_API', 'filter_rest_index' ) );
     22add_filter( 'plugin_action_links_' . plugin_basename( __FILE__ ), array( 'Clariti\Admin', 'filter_plugin_action_links' ) );
     23add_filter( 'rest_index', array( 'Clariti\REST_API', 'filter_rest_index' ) );
    2424add_action( 'rest_api_init', array( 'Clariti\REST_API', 'register_routes' ) );
    2525/**
    … …  
    7676 */
    7777function clariti_get_supported_post_types() {
    78     $post_types = get_post_types( array(), 'object' );
     78    $post_types = get_post_types( array(), 'objects' );
    7979    $skipped    = array(
    8080        'nav_menu_item',
    … …  
    8989            continue;
    9090        }
    91         // Has to public=true && show_in_rest=true.
     91
     92        // Post type must be public and have REST API support.
    9293        if ( empty( $post_type->public ) || empty( $post_type->show_in_rest ) ) {
    9394            continue;
    9495        }
    95         // Has to support 'title' and 'editor'.
     96
     97        // Post type must support 'title' and 'editor'.
    9698        if ( ! post_type_supports( $post_type->name, 'title' ) || ! post_type_supports( $post_type->name, 'editor' ) ) {
    9799            continue;

  • clariti/trunk/inc/class-admin.php

    r3045960 r3370739  
    9595        $key = self::get_api_key();
    9696
    97         if ( ! empty( $_GET['verify'] ) && $key ) {
     97        if ( ! empty( $_GET['verify'] ) && $key ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    9898            Notifier::action_updated_option( self::API_KEY_OPTION, $key, $key );
    9999        }
    … …  
    105105            self::PAGE_SLUG
    106106        );
    107         if ( ! empty( $_GET['advanced'] ) || get_option( self::API_HOST_OPTION ) ) {
     107        if ( ! empty( $_GET['advanced'] ) || get_option( self::API_HOST_OPTION ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    108108            add_settings_field(
    109109                self::API_HOST_OPTION,
    … …  
    137137                <?php submit_button(); ?>
    138138            </form>
    139             <?php if ( isset( $_GET['advanced'] ) && $_GET['advanced'] ) : ?>
     139            <?php if ( isset( $_GET['advanced'] ) && (int) $_GET['advanced'] ) : // phpcs:ignore WordPress.Security.NonceVerification.Recommended ?>
    140140                <form method="post" action="admin-post.php">
    141141                    <table class="form-table" role="presentation">
    … …  
    151151                    <input type="hidden" name="action" value="clear_secret">
    152152                    <input type="hidden" name="clear-secret" value="1">
     153                    <?php wp_nonce_field( 'clear_secret', 'clear_secret_nonce' ); ?>
    153154                    <?php submit_button( 'Clear Secret' ); ?>
    154155                </form>
    … …  
    267268     */
    268269    public static function clear_secret(): void {
    269         delete_option( Admin::API_SECRET_OPTION );
     270        delete_option( self::API_SECRET_OPTION );
    270271    }
    271272
    … …  
    276277     */
    277278    public static function get_api_key(): string {
    278         $value = get_option( Admin::API_KEY_OPTION, '' );
     279        $value = get_option( self::API_KEY_OPTION, '' );
    279280
    280281        return (string) $value;

  • clariti/trunk/inc/class-notifier.php

    r3062842 r3370739  
    8585            }
    8686
    87             error_log( 'CLARITI:ERROR - action_added_option - ' . $exception->getMessage() );
     87            error_log( 'CLARITI:ERROR - action_added_option - ' . $exception->getMessage() ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
    8888        }
    8989    }
    … …  
    138138            }
    139139
    140             error_log( 'CLARITI:ERROR - action_updated_option - ' . $exception->getMessage() );
     140            error_log( 'CLARITI:ERROR - action_updated_option - ' . $exception->getMessage() ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
    141141        }
    142142    }
    … …  
    246246     * Inform Clariti when an approved comment is updated.
    247247     *
    248      * @param integer    $id      The comment ID.
    249      * @param WP_Comment $comment Comment object.
     248     * @param integer     $id      The comment ID.
     249     * @param \WP_Comment $comment Comment object.
    250250     */
    251251    public static function action_wp_insert_comment( $id, $comment ) {
    … …  
    393393            self::send_clariti_payload( $payload );
    394394        } catch ( \Exception $exception ) {
    395             error_log( 'CLARITI:ERROR - action_updated_option - ' . $exception->getMessage() );
     395            error_log( 'CLARITI:ERROR - action_updated_option - ' . $exception->getMessage() ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
    396396        }
    397397    }
    … …  
    407407        } elseif ( get_option( Admin::API_HOST_OPTION, '' ) ) {
    408408            $host = get_option( Admin::API_HOST_OPTION, '' );
    409         } elseif ( ! empty( $_POST[ Admin::API_HOST_OPTION ] ) && ! Admin::is_valid_api_host( $_POST[ Admin::API_HOST_OPTION ] ) ) {
    410             $host = $_POST[ Admin::API_HOST_OPTION ];
     409        } elseif ( ! empty( $_POST[ Admin::API_HOST_OPTION ] ) && ! Admin::is_valid_api_host( sanitize_text_field( wp_unslash( $_POST[ Admin::API_HOST_OPTION ] ) ) ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
     410            $host = sanitize_text_field( wp_unslash( $_POST[ Admin::API_HOST_OPTION ] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing
    411411        } else {
    412412            $host = self::API_HOST_DEFAULT;
    … …  
    456456
    457457        if ( $response instanceof \WP_Error ) {
    458             throw new \Exception( $response->get_error_message() );
     458            throw new \Exception( esc_html( $response->get_error_message() ) );
    459459        }
    460460
    461461        $data = json_decode( $response['body'], true );
    462462
    463         if ( ! $data || is_wp_error( $data ) ) {
     463        if ( ! $data || ! is_array( $data ) ) {
    464464            throw new \Exception( 'Could not read response from Clariti' );
    465465        }
    466466
    467         if ( false === ( (bool) $data['ok'] ?? false ) ) {
     467        if ( false === (bool) ( $data['ok'] ?? false ) ) {
    468468            // If Clariti replies with a 601 error code, clear the secret and
    469469            // prevent further requests until a new API key is added.
    470             if ( 601 === ( (int) $data['error']['code'] ?? null ) ) {
     470            if ( 601 === (int) ( $data['error']['code'] ?? null ) ) {
    471471                Admin::clear_secret();
    472472            }
    473473
    474             throw new \Exception( "{$data['error']['code']} - {$data['error']['message']}" );
     474            throw new \Exception( esc_html( "{$data['error']['code']} - {$data['error']['message']}" ) );
    475475        }
    476476
    … …  
    527527     */
    528528    public static function clear_secret_option() {
     529        check_admin_referer( 'clear_secret', 'clear_secret_nonce' );
     530
     531        if ( ! current_user_can( Admin::CAPABILITY ) ) {
     532            wp_die( esc_html__( 'You are not authorized to perform this action.', 'clariti' ) );
     533        }
     534
    529535        Admin::clear_secret();
    530536        Admin::send_admin_notification( 'clariti-updated-option', 'clariti-updated-option-success', 'Clariti Secret cleared!', 'success' );

  • clariti/trunk/inc/class-rest-api.php

    r3045960 r3370739  
    4141     * Filters the REST API index to include our own data.
    4242     *
    43      * @param WP_REST_Response $response Existing response object.
     43     * @param \WP_REST_Response $response Existing response object.
    4444     * @return object
    4545     */
    … …  
    164164        }
    165165
    166         $key = admin::get_api_key();
     166        $key = Admin::get_api_key();
    167167
    168168        return array(

  • clariti/trunk/inc/integrations/class-the-blog-fixer.php

    r2997887 r3370739  
    1818     * Fires after an operation has been performed on a post.
    1919     *
    20      * @param object $po   Post operation object.
    21      * @param object $post Post.
     20     * @param object   $po   Post operation object.
     21     * @param \WP_Post $post Post.
    2222     */
    2323    public static function action_tbf_after_post_operation_execution( $po, $post ) {

  • clariti/trunk/readme.txt

    r3370647 r3370739  
    44Requires at least: 6.0
    55Tested up to: 6.8
    6 Stable tag: 1.2.1
     6Stable tag: 1.2.2
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    2828== Frequently Asked Questions ==
    2929
    30 = Where do I report security bugs found in this plugin? =
     30= Where do I report security bugs? =
    3131
    32 Please report security bugs found in the source code of the Clariti plugin through the [Patchstack Vulnerability Disclosure  Program](https://patchstack.com/database/vdp/ce756ba9-6201-4854-bf28-499d3c2422fd). The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.
     32Please report security bugs found in the source code of the Clariti plugin to security@clariti.com.
    3333
    3434== Installation ==
    … …  
    4949
    5050== Changelog ==
     51
     52= 1.2.2 (September 30, 2025) =
     53
     54* Fix an issue where a secondary key used in the connection to Clariti could be deleted by an authenticated user.
     55* Improve nonce verification.
    5156
    5257= 1.2.1 (April 2, 2024) =
Note: See TracChangeset for help on using the changeset viewer.