WordPress.org
Get WordPress

Plugin Directory

Changeset 3481588


Ignore:
Timestamp:
03/13/2026 12:20:38 AM (2 weeks ago)
Author:
pattihis
Message:

Version 2.0.4

Location:
add-custom-fields-to-media
Files:
26 added
4 edited

Legend:

Unmodified
Added
Removed

  • add-custom-fields-to-media/trunk/add-custom-fields-to-media.php

    r3319543 r3481588  
    1111 * Plugin URI:        https://wordpress.org/plugins/add-custom-fields-to-media/
    1212 * Description:       Allows users to add custom fields to the media uploader and access those fields in template files. Great for adding copyrights, image meta etc.
    13  * Version:           2.0.3
     13 * Version:           2.0.4
    1414 * Author:            George Pattichis
    1515 * Author URI:        https://profiles.wordpress.org/pattihis//
    … …  
    3030 * @since 2.0.0
    3131 */
    32 define( 'ADD_CUSTOM_FIELDS_TO_MEDIA_VERSION', '2.0.3' );
     32define( 'ADD_CUSTOM_FIELDS_TO_MEDIA_VERSION', '2.0.4' );
    3333
    3434/**

  • add-custom-fields-to-media/trunk/admin/partials/add-custom-fields-to-media-admin-display.php

    r3019065 r3481588  
    3737
    3838if ( ( isset( $_GET['delete'] ) && ! empty( $_GET['delete'] ) ) && is_array( $media_custom_fields ) ) {
     39    if ( ! isset( $_GET['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'acfm_delete_field' ) ) {
     40        wp_die( esc_html__( 'Security check failed.', 'add-custom-fields-to-media' ) );
     41    }
     42    $new_custom_fields = array();
    3943    foreach ( $media_custom_fields as $check_for_delete ) {
    4044        if ( urldecode( sanitize_text_field( wp_unslash( $_GET['delete'] ) ) ) !== $check_for_delete['unique_id'] ) {
    … …  
    7074                        <td><?php echo esc_html( $custom_field['name'] ); ?></td>
    7175                        <td><?php echo esc_html( $custom_field['help'] ); ?></td>
    72                         <td><a href="<?php echo esc_url( 'options-general.php?page=add-custom-fields-to-media&delete=' . $custom_field['unique_id'] ); ?>" style="text-decoration: none;" title="Delete Field"><span class="dashicons dashicons-trash"></span></a></td>
     76                        <td><a href="<?php echo esc_url( wp_nonce_url( 'options-general.php?page=add-custom-fields-to-media&delete=' . $custom_field['unique_id'], 'acfm_delete_field' ) ); ?>" style="text-decoration: none;" title="Delete Field"><span class="dashicons dashicons-trash"></span></a></td>
    7377                    </tr>
    7478                <?php } ?>

  • add-custom-fields-to-media/trunk/includes/class-add-custom-fields-to-media.php

    r3319543 r3481588  
    6565            $this->version = ADD_CUSTOM_FIELDS_TO_MEDIA_VERSION;
    6666        } else {
    67             $this->version = '2.0.3';
     67            $this->version = '2.0.4';
    6868        }
    6969        $this->plugin_name = 'add-custom-fields-to-media';

  • add-custom-fields-to-media/trunk/readme.txt

    r3319544 r3481588  
    55Donate link: https://profiles.wordpress.org/pattihis/
    66Requires at least: 5.2
    7 Tested up to: 6.8
     7Tested up to: 6.9.4
    88Requires PHP: 7.2
    9 Stable tag: 2.0.3
     9Stable tag: 2.0.4
    1010License: GPLv2 or later
    1111License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    6464== Changelog ==
    6565
     66= 2.0.4 =
     67* Security: Fix CSRF vulnerability in custom field deletion (CVE-2025-4068)
     68* Compatibility with WordPress v6.9
     69
    6670= 2.0.3 =
    6771* Full compliance with WordPress Coding Standards (PHPCS)
Note: See TracChangeset for help on using the changeset viewer.