Skip to content

Commit f1b8fd8

Browse files
support-xylusthemessupport-xylusthemes
authored
Merge pull request #177 from xylusthemes/enhance_xss_protection
Enhanced XSS Protection
2 parents 6284e62 + c0ba72d commit f1b8fd8

9 files changed

+34
-34
lines changed

‎includes/class-wp-event-aggregator-admin.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -393,7 +393,7 @@ function render_dashboard_widget( $posts = 10 ) {
393393
* @return void
394394
*/
395395
public function add_event_aggregator_credit( $footer_text ){
396-
$page = isset( $_GET['page'] ) ? sanitize_text_field( $_GET['page'] ) : '';
396+
$page = isset( $_GET['page'] ) ? esc_attr( sanitize_text_field( $_GET['page'] ) ) : '';
397397
if ( $page != '' && $page == 'import_events' ) {
398398
$rate_url = 'https://wordpress.org/support/plugin/wp-event-aggregator/reviews/?rate=5#new-post';
399399

@@ -470,9 +470,9 @@ public function get_wporg_plugin( $slug ){
470470
* @return void
471471
*/
472472
public function get_selected_tab_submenu( $submenu_file ){
473-
if( !empty( $_GET['page'] ) && sanitize_text_field( wp_unslash( $_GET['page'] ) ) == 'import_events' ){
473+
if( !empty( $_GET['page'] ) && esc_attr( sanitize_text_field( wp_unslash( $_GET['page'] ) ) ) == 'import_events' ){
474474
$allowed_tabs = array( 'eventbrite', 'meetup', 'facebook', 'ical', 'scheduled', 'history', 'settings', 'shortcodes', 'support' );
475-
$tab = isset( $_GET['tab'] ) ? sanitize_text_field( $_GET['tab'] ) : 'eventbrite';
475+
$tab = isset( $_GET['tab'] ) ? esc_attr( sanitize_text_field( $_GET['tab'] ) ) : 'eventbrite';
476476
if( in_array( $tab, $allowed_tabs ) ){
477477
$submenu_file = admin_url( 'admin.php?page=import_events&tab='.$tab );
478478
}

‎includes/class-wp-event-aggregator-list-table.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ function column_default( $item, $column_name ) {
5757
function column_title( $item ) {
5858
global $importevents;
5959
$wpea_url_delete_args = array(
60-
'page' => sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ),
60+
'page' => esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) ),
6161
'wpea_action' => 'wpea_simport_delete',
6262
'import_id' => absint( $item['ID'] ),
6363
);
@@ -118,7 +118,7 @@ function column_title( $item ) {
118118
function column_action( $item ) {
119119

120120
$xtmi_run_import_args = array(
121-
'page' => sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ),
121+
'page' => esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) ),
122122
'wpea_action' => 'wpea_run_import',
123123
'import_id' => $item['ID'],
124124
);
@@ -441,8 +441,8 @@ function column_default( $item, $column_name ) {
441441
function column_title( $item ) {
442442

443443
$wpea_url_delete_args = array(
444-
'page' => sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ),
445-
'tab' => sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ),
444+
'page' => esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) ),
445+
'tab' => esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) ),
446446
'wpea_action' => 'wpea_history_delete',
447447
'history_id' => absint( $item['ID'] ),
448448
);
@@ -574,8 +574,8 @@ public function extra_tablenav( $which ) {
574574
return;
575575
}
576576
$wpea_url_all_delete_args = array(
577-
'page' => wp_unslash( $_REQUEST['page'] ),
578-
'tab' => wp_unslash( $_REQUEST['tab'] ),
577+
'page' => esc_attr( wp_unslash( $_REQUEST['page'] ) ),
578+
'tab' => esc_attr( wp_unslash( $_REQUEST['tab'] ) ),
579579
'wpea_action' => 'wpea_all_history_delete',
580580
);
581581

‎includes/class-wp-event-aggregator-manage-import.php‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -117,8 +117,8 @@ public function handle_listtable_oprations() {
117117
global $wpea_success_msg;
118118
if ( isset( $_GET['wpea_action'] ) && $_GET['wpea_action'] == 'wpea_simport_delete' && isset($_GET['_wpnonce']) && wp_verify_nonce($_GET['_wpnonce'], 'wpea_delete_import_nonce') ) {
119119
$import_id = $_GET['import_id'];
120-
$page = isset($_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : 'import_events';
121-
$tab = isset($_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : 'scheduled';
120+
$page = isset($_GET['page'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_GET['page'] ) ) ) : 'import_events';
121+
$tab = isset($_GET['tab'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_GET['tab'] ) ) ) : 'scheduled';
122122
$wp_redirect = admin_url( 'admin.php?page='.$page );
123123
if ( $import_id > 0 ) {
124124
$post_type = get_post_type( $import_id );
@@ -133,8 +133,8 @@ public function handle_listtable_oprations() {
133133

134134
if ( isset( $_GET['wpea_action'] ) && $_GET['wpea_action'] == 'wpea_history_delete' && isset($_GET['_wpnonce']) && wp_verify_nonce($_GET['_wpnonce'], 'wpea_delete_history_nonce' ) ) {
135135
$history_id = (int)sanitize_text_field( wp_unslash( $_GET['history_id'] ) );
136-
$page = isset($_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : 'import_events';
137-
$tab = isset($_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : 'history';
136+
$page = isset($_GET['page'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_GET['page'] ) ) ) : 'import_events';
137+
$tab = isset($_GET['tab'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_GET['tab'] ) ) ) : 'history';
138138
$wp_redirect = admin_url( 'admin.php?page='.$page );
139139
if ( $history_id > 0 ) {
140140
wp_delete_post( $history_id, true );
@@ -146,8 +146,8 @@ public function handle_listtable_oprations() {
146146

147147
if ( isset( $_GET['wpea_action'] ) && $_GET['wpea_action'] == 'wpea_run_import' && isset($_GET['_wpnonce']) && wp_verify_nonce($_GET['_wpnonce'], 'wpea_run_import_nonce') ) {
148148
$import_id = (int)$_GET['import_id'];
149-
$page = isset($_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : 'import_events';
150-
$tab = isset($_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : 'scheduled';
149+
$page = isset($_GET['page'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_GET['page'] ) ) ) : 'import_events';
150+
$tab = isset($_GET['tab'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_GET['tab'] ) ) ) : 'scheduled';
151151
$wp_redirect = admin_url( 'admin.php?page='.$page );
152152
if ( $import_id > 0 ) {
153153
do_action( 'xt_run_scheduled_import', $import_id );
@@ -160,7 +160,7 @@ public function handle_listtable_oprations() {
160160
$is_bulk_delete = ( ( isset( $_GET['action'] ) && sanitize_text_field( wp_unslash( $_GET['action'] ) ) == 'delete' ) || ( isset( $_GET['action2'] ) && sanitize_text_field( wp_unslash( $_GET['action2'] ) ) == 'delete' ) );
161161

162162
if ( $is_bulk_delete && isset($_GET['_wpnonce']) && wp_verify_nonce($_GET['_wpnonce'], 'bulk-xt_scheduled_imports') ) {
163-
$tab = isset($_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : 'scheduled';
163+
$tab = isset($_GET['tab'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_GET['tab'] ) ) ) : 'scheduled';
164164
$wp_redirect = get_site_url() . urldecode( sanitize_text_field( $_REQUEST['_wp_http_referer'] ) );
165165
$delete_ids = array_map( 'sanitize_text_field', $_REQUEST['xt_scheduled_import'] );
166166
if( !empty( $delete_ids ) ){
@@ -178,7 +178,7 @@ public function handle_listtable_oprations() {
178178
}
179179

180180
if ( $is_bulk_delete && isset($_GET['_wpnonce']) && wp_verify_nonce($_GET['_wpnonce'], 'bulk-import_histories') ) {
181-
$tab = isset($_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : 'history';
181+
$tab = isset( $_GET['tab'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_GET['tab'] ) ) ) : 'history';
182182
$wp_redirect = get_site_url() . urldecode( sanitize_text_field( $_REQUEST['_wp_http_referer'] ) ); $delete_ids = array_map( 'sanitize_text_field', $_REQUEST['import_history'] );
183183
if( !empty( $delete_ids ) ){
184184
foreach ($delete_ids as $delete_id ) {
@@ -192,8 +192,8 @@ public function handle_listtable_oprations() {
192192

193193
// Delete All History Data
194194
if ( isset( $_GET['wpea_action'] ) && $_GET['wpea_action'] === 'wpea_all_history_delete' && isset( $_GET['_wpnonce'] ) && wp_verify_nonce( $_GET['_wpnonce'], 'wpea_delete_all_history_nonce' ) ) {
195-
$page = isset( $_GET['page'] ) ? $_GET['page'] : 'import_events';
196-
$tab = isset( $_GET['tab'] ) ? $_GET['tab'] : 'history';
195+
$page = isset( $_GET['page'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_GET['page'] ) ) ) : 'import_events';
196+
$tab = isset( $_GET['tab'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_GET['tab'] ) ) ) : 'history';
197197
$wp_redirect = admin_url( 'admin.php?page=' . $page );
198198
$delete_ids = get_posts( array( 'numberposts' => -1,'fields' => 'ids', 'post_type' => 'wpea_import_history' ) );
199199

‎languages/wp-event-aggregator.pot‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ msgstr ""
99
"MIME-Version: 1.0\n"
1010
"Content-Type: text/plain; charset=UTF-8\n"
1111
"Content-Transfer-Encoding: 8bit\n"
12-
"POT-Creation-Date: 2025-01-09T07:03:50+00:00\n"
12+
"POT-Creation-Date: 2025-01-09T07:05:13+00:00\n"
1313
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
1414
"X-Generator: WP-CLI 2.11.0\n"
1515
"X-Domain: wp-event-aggregator\n"

‎templates/admin/eventbrite-import-events.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -110,9 +110,9 @@
110110
<?php } elseif( $ntab == 'scheduled_import' ){
111111
?>
112112
<form id="scheduled-import" method="get">
113-
<input type="hidden" name="page" value="<?php echo sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ); ?>" />
114-
<input type="hidden" name="tab" value="<?php echo $tab = isset($_REQUEST['tab'])? sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) : 'eventbrite' ?>" />
115-
<input type="hidden" name="ntab" value="<?php echo sanitize_text_field( wp_unslash( $_REQUEST['ntab'] ) ); ?>" />
113+
<input type="hidden" name="page" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) ); ?>" />
114+
<input type="hidden" name="tab" value="<?php echo $tab = isset($_REQUEST['tab'])? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) ) : 'eventbrite' ?>" />
115+
<input type="hidden" name="ntab" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['ntab'] ) ) ); ?>" />
116116
<?php
117117
if( wpea_is_pro() ){
118118
$listtable = new WP_Event_Aggregator_List_Table();

‎templates/admin/facebook-import-events.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -120,9 +120,9 @@
120120
<?php } elseif( $ntab == 'scheduled_import' ){
121121
?>
122122
<form id="scheduled-import" method="get">
123-
<input type="hidden" name="page" value="<?php echo sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ); ?>" />
124-
<input type="hidden" name="tab" value="<?php echo $tab = isset($_REQUEST['tab'])? sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) : 'eventbrite' ?>" />
125-
<input type="hidden" name="ntab" value="<?php echo sanitize_text_field( wp_unslash( $_REQUEST['ntab'] ) ); ?>" />
123+
<input type="hidden" name="page" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) ); ?>" />
124+
<input type="hidden" name="tab" value="<?php echo $tab = isset($_REQUEST['tab'])? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) ) : 'eventbrite' ?>" />
125+
<input type="hidden" name="ntab" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['ntab'] ) ) ); ?>" />
126126
<?php
127127
if( wpea_is_pro() ){
128128
$listtable = new WP_Event_Aggregator_List_Table();

‎templates/admin/ical-import-events.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,9 +113,9 @@
113113
<?php } elseif( $ntab == 'scheduled_import' ){
114114
?>
115115
<form id="scheduled-import" method="get">
116-
<input type="hidden" name="page" value="<?php echo sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ); ?>" />
117-
<input type="hidden" name="tab" value="<?php echo $tab = isset($_REQUEST['tab'])? sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) : 'ical' ?>" />
118-
<input type="hidden" name="ntab" value="<?php echo sanitize_text_field( wp_unslash( $_REQUEST['ntab'] ) ); ?>" />
116+
<input type="hidden" name="page" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) ); ?>" />
117+
<input type="hidden" name="tab" value="<?php echo $tab = isset($_REQUEST['tab'])? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) ) : 'ical' ?>" />
118+
<input type="hidden" name="ntab" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['ntab'] ) ) ); ?>" />
119119
<?php
120120
if( wpea_is_pro() ){
121121
$listtable = new WP_Event_Aggregator_List_Table();

‎templates/admin/meetup-import-events.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -102,9 +102,9 @@
102102
<?php } elseif( $ntab == 'scheduled_import' ){
103103
?>
104104
<form id="scheduled-import" method="get">
105-
<input type="hidden" name="page" value="<?php echo sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ); ?>" />
106-
<input type="hidden" name="tab" value="<?php echo $tab = isset($_REQUEST['tab'])? sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) : 'eventbrite' ?>" />
107-
<input type="hidden" name="ntab" value="<?php echo sanitize_text_field( wp_unslash( $_REQUEST['ntab'] ) ); ?>" />
105+
<input type="hidden" name="page" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) ); ?>" />
106+
<input type="hidden" name="tab" value="<?php echo $tab = isset($_REQUEST['tab'])? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) ) : 'eventbrite' ?>" />
107+
<input type="hidden" name="ntab" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['ntab'] ) ) ); ?>" />
108108
<?php
109109
if( wpea_is_pro() ){
110110
$listtable = new WP_Event_Aggregator_List_Table();

‎templates/admin/wp-event-aggregator-history.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@
1111
<div class="wpea_row">
1212
<div class="">
1313
<form id="import-history" method="get">
14-
<input type="hidden" name="page" value="<?php echo sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ); ?>" />
15-
<input type="hidden" name="tab" value="<?php echo $tab = isset($_REQUEST['tab'])? sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) : 'history' ?>" />
14+
<input type="hidden" name="page" value="<?php echo esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ) ); ?>" />
15+
<input type="hidden" name="tab" value="<?php echo $tab = isset($_REQUEST['tab'])? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['tab'] ) ) ) : 'history' ?>" />
1616
<input type="hidden" name="ntab" value="" />
1717
<?php
1818
$listtable->display();

0 commit comments

Comments
 (0)