v3.2.9

wpcodefactory · Feb 17, 2024 · a35b2a2 · a35b2a2
1 parent 06124ed
commit a35b2a2
Show file tree

Hide file tree

Showing 5 changed files with 27 additions and 16 deletions.
diff --git a/cost-of-goods-for-woocommerce.php b/cost-of-goods-for-woocommerce.php
@@ -3,7 +3,7 @@
 Plugin Name: Cost of Goods for WooCommerce
 Plugin URI: https://wpfactory.com/item/cost-of-goods-for-woocommerce/
 Description: Save product purchase costs (cost of goods) in WooCommerce. Beautifully.
-Version: 3.2.8
+Version: 3.2.9
 Author: WPFactory
 Author URI: https://wpfactory.com
 Text Domain: cost-of-goods-for-woocommerce

diff --git a/includes/class-alg-wc-cog.php b/includes/class-alg-wc-cog.php
@@ -35,7 +35,7 @@ final class Alg_WC_Cost_of_Goods {
 		 * @since 1.0.0
 		 * @var   string
 		 */
-		public $version = '3.2.8';
+		public $version = '3.2.9';
 
 		/**
 		 * @since 1.0.0

diff --git a/includes/tools/class-alg-wc-cog-bulk-edit-tool.php b/includes/tools/class-alg-wc-cog-bulk-edit-tool.php
@@ -2,7 +2,7 @@
 /**
  * Cost of Goods for WooCommerce - Bulk Edit Tool Class.
  *
- * @version 2.9.7
+ * @version 3.2.9
  * @since   1.2.0
  * @author  WPFactory
  */
@@ -58,6 +58,15 @@ class Alg_WC_Cost_of_Goods_Bulk_Edit_Tool {
 		 */
 		public $update_variation_costs_bkg_process;
 
+		/**
+         * $wp_list_bulk_edit_tool.
+         *
+         * @since 3.2.9
+         *
+		 * @var
+		 */
+        public $wp_list_bulk_edit_tool;
+
 		/**
 		 * Constructor.
 		 *
@@ -591,7 +600,7 @@ function display_bulk_edit_costs_manually() {
 		/**
 		 * Display section navs HTML.
 		 *
-		 * @version 2.6.1
+		 * @version 3.2.9
 		 * @since   2.5.1
 		 */
 		function display_section_navs_html() {
@@ -607,7 +616,7 @@ function display_section_navs_html() {
 				$is_current  = $section === $key ? 'current' : '';
 				$section_url = admin_url( sprintf( 'tools.php?page=%s&section=%s', str_replace('tools_page_', '', $current_screen->base ), $key ) );
 
-				$tabs_nav_html[] = sprintf( '<li><a href="%s" class="%s">%s</a></li>', $section_url, $is_current, $label );
+				$tabs_nav_html[] = sprintf( '<li><a href="%s" class="%s">%s</a></li>', esc_url( $section_url ), $is_current, $label );
 			}
 
 			printf( '<ul class="subsubsub no-float">%s</ul>', implode( ' | ', $tabs_nav_html ) );
@@ -616,7 +625,7 @@ function display_section_navs_html() {
 		/**
 		 * display_wp_list_tool.
 		 *
-		 * @version 2.7.4
+		 * @version 3.2.9
 		 * @since   2.3.1
 		 */
 		function display_bulk_edit_tools() {
@@ -667,27 +676,26 @@ function display_bulk_edit_tools() {
 			}
 
 			// Wrap up section content
-			printf( '<div class="notice is-dismissible alg_wc_cog_notice"><p></p></div><'.$container_elem_type.' method="post" action="" class="bulk-edit-form %s" data-type="%s" data-tool-type="%s"><div class="wrap alg_wc_cog_bulk_edit">%s</div></'.$container_elem_type.'>',
-				$this->get_current_section( 'form_class' ),
-				$this->get_current_section( 'id' ),
-                $tool_type,
+			printf( '<div class="notice is-dismissible alg_wc_cog_notice"><p></p></div><' . $container_elem_type . ' method="post" action="" class="bulk-edit-form %s" data-type="%s" data-tool-type="%s"><div class="wrap alg_wc_cog_bulk_edit">%s</div></' . $container_elem_type . '>',
+				esc_attr( $this->get_current_section( 'form_class' ) ),
+				esc_attr( $this->get_current_section( 'id' ) ),
+				esc_attr( $tool_type ),
 				ob_get_clean()
 			);
 		}
 
 		/**
 		 * Return current section or any argument value of current section.
 		 *
-		 * @version 2.5.1
-		 * @since 2.5.1
+		 * @version 3.2.9
+		 * @since   2.5.1
 		 *
 		 * @param string $arg
 		 * @return int|mixed|string|null
 		 */
 		function get_current_section( $arg = '' ) {
-
 			$nav_sections = $this->get_section_nav_items();
-			$section      = isset( $_GET['section'] ) ? sanitize_text_field( $_GET['section'] ) : key( $nav_sections );
+			$section      = isset( $_GET['section'] ) ? rawurlencode( sanitize_text_field( $_GET['section'] ) ) : key( $nav_sections );
 
 			if ( $arg === 'id' ) {
 				return $section;

diff --git a/includes/tools/class-alg-wc-cog-import-tool.php b/includes/tools/class-alg-wc-cog-import-tool.php
@@ -20,7 +20,6 @@ class Alg_WC_Cost_of_Goods_Import_Tool {
 		 */
 		public $import_tool_bkg_process;
 
-
 		/**
 		 * Constructor.
 		 *

diff --git a/readme.txt b/readme.txt
@@ -3,7 +3,7 @@ Contributors: wpcodefactory, omardabbas, karzin, anbinder, algoritmika, kousikmu
 Tags: woocommerce, cost, cost of goods, profit, profit calculator
 Requires at least: 6.1
 Tested up to: 6.4
-Stable tag: 3.2.8
+Stable tag: 3.2.9
 License: GNU General Public License v3.0
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
 
@@ -365,6 +365,10 @@ Once activated, access the plugin's settings by navigating to “WooCommerce > S
 
 == Changelog ==
 
+= 3.2.9 - 17/02/2024 =
+* Fix - Vulnerability problem.
+* Fix - Creation of dynamic property Alg_WC_Cost_of_Goods_Bulk_Edit_Tool::$wp_list_bulk_edit_tool.
+
 = 3.2.8 - 14/02/2024 =
 * Fix - Call to a member function is_type() on bool in class-alg-wc-cog-products.php:504.
-Original file line number
+Diff line change
@@ Expand Up / @@ -20,7 +20,6 @@ class Alg_WC_Cost_of_Goods_Import_Tool { @@
     		 */
     		public $import_tool_bkg_process;
     		/**
     		 * Constructor.
     		 *
@@ Expand Down @@