Changeset 722264

Timestamp:

06/03/2013 09:03:22 PM (13 years ago)

Author:

jkmassel

Message:

Adding version 1.09. Fixes a security bug.
And also a typo

Location:

underconstruction

Files:

• tags/1.09 (added)
• tags/1.09/ajax-loader.gif (added)
• tags/1.09/defaultMessage.php (added)
• tags/1.09/readme.txt (added)
• tags/1.09/screenshot-1.png (added)
• tags/1.09/screenshot-2.png (added)
• tags/1.09/screenshot-3.png (added)
• tags/1.09/screenshot-4.png (added)
• tags/1.09/ucOptions.php (added)
• tags/1.09/underConstruction.php (added)
• tags/1.09/underconstruction.dev.js (added)
• tags/1.09/underconstruction.min.js (added)
• trunk/readme.txt (modified) (2 diffs)
• trunk/ucOptions.php (modified) (3 diffs)
• trunk/underConstruction.php (modified) (1 diff)

underconstruction/trunk/readme.txt

@@ -4 +4 @@
 Tags: construction, under construction, private, preview, security, coming soon
 Requires at least: 2.7
-Tested up to: 3.4.2
-Stable tag: 1.08
+Tested up to: 3.5.1
+Stable tag: 1.09
 
 Creates a 'Coming Soon' page that will show for all users who are not logged in
@@ -43 +43 @@
 
 == Changelog ==
+
+= 1.09 =
+* Fixed an issue identified Charlie Eriksen. Listed as Secunia Advisory SA52881. Fixes a security issue that could possibly result in the plugin being inadvertently deactivated.
+* Fixes a typo on the options screen
 
 = 1.08 =

underconstruction/trunk/ucOptions.php

@@ -1 +1 @@
 <?php
+
+if($_SERVER['REQUEST_METHOD'] == "POST"){
+    if(!wp_verify_nonce($_POST['save_options_field'], 'save_options')){
+        die("Sorry, but this request is invalid");
+    }
+}
+
 if (isset($_GET['turnOnUnderConstructionMode']))
 {
@@ -293 +300 @@
                             value="1" id="displayOption1"
                             <?php if ($this->displayStatusCodeIs(1)) { echo ' checked="checked"'; } ?>>
-                            Display the default under construction page , but use custom text
+                            Display the default under construction page, but use custom text
                         </label> <br /> <label title="HTTP503"> <input type="radio"
                             name="display_options" value="2" id="displayOption2"
@@ -338 +345 @@
         </div>
         <p class="submit">
+               <?php wp_nonce_field('save_options','save_options_field'); ?>
+
+        
             <input type="submit" name="Submit" class="button-primary"
                 value="Save Changes" id="submitChangesToUnderConstructionPlugin" />

underconstruction/trunk/underConstruction.php

@@ -4 +4 @@
  Plugin URI: http://www.masseltech.com/
  Description: Makes it so your site can only be accessed by users who log in. Useful for developing a site on a live server, without the world being able to see it
- Version: 1.08
+ Version: 1.09
  Author: Jeremy Massel
  Author URI: http://www.masseltech.com/