From 28757539c73bd24f57c9b3b2cb9bd8585fabca34 Mon Sep 17 00:00:00 2001 From: Zaman Date: Mon, 8 Nov 2021 16:30:36 +0600 Subject: [PATCH 01/54] Added escaping and sanitization --- core/QUBELY.php | 49 +++++---- core/admin-views/Fields.php | 77 +++++++------- core/admin-views/Getting_Started.php | 72 +++++++------ core/admin-views/Settings.php | 146 +++++++++++++-------------- 4 files changed, 176 insertions(+), 168 deletions(-) diff --git a/core/QUBELY.php b/core/QUBELY.php index dbf2e8a8..c9a8836e 100644 --- a/core/QUBELY.php +++ b/core/QUBELY.php @@ -1405,7 +1405,7 @@ public function enqueue_block_css_file() { $blockJson = file_get_contents( $json_path ); if ( $blockJson != '{}' ) { - echo ''; + echo wp_kses_post( '' ); } } }else{ @@ -1426,7 +1426,7 @@ public function enqueue_block_css_file() { } else { $blockJson = file_get_contents( $json_path ); if ( $blockJson != '{}' ) { - echo ''; + echo $this->custom_sanitization( '' ); } } } @@ -1493,20 +1493,20 @@ public function add_static_css(){ public function add_block_inline_css() { $upload_dir = wp_get_upload_dir(); $upload_css_dir = trailingslashit( $upload_dir['basedir'] ); - if (isset($_GET['preview']) && $_GET['preview'] == true) { + if ( isset( $_GET['preview'] ) && $_GET['preview'] == true ) { $css_path = $upload_css_dir . "qubely/qubely-preview.css"; $json_path = $upload_css_dir . "qubely/qubely-preview.json"; $this->add_static_css(); - if (file_exists($css_path)) { - $blockCss = file_get_contents($css_path); - echo ''; + if ( file_exists( $css_path ) ) { + $blockCss = file_get_contents( $css_path ); + echo $this->custom_sanitization( '' ); } if (file_exists($json_path)) { $blockJson = file_get_contents($json_path); if ($blockJson != '{}') { - echo ''; + echo $this->custom_sanitization( '' ); } } }else{ @@ -1517,9 +1517,9 @@ public function add_block_inline_css() { if ( file_exists( $css_path ) ) { $blockCss = file_get_contents( $css_path ); - echo ''; + echo $this->custom_sanitization( '' ); } else { - echo ''; + echo $this->custom_sanitization( '' ); } if ( ! file_exists( $json_path ) ) { @@ -1527,7 +1527,7 @@ public function add_block_inline_css() { } else { $blockJson = file_get_contents( $json_path ); if ( $blockJson != '{}' ) { - echo ''; + echo $this->custom_sanitization( '' ); } } } @@ -1544,7 +1544,7 @@ public function print_interaction_json_to_header() { $post_id = get_the_ID(); $interactionJson = get_post_meta( $post_id, '_qubely_interaction_json', true ); if ( $interactionJson != '{}' && $interactionJson != '' ) { - echo ''; + echo $this->custom_sanitization( '' ); } } @@ -1846,14 +1846,14 @@ public function qubely_send_form_data() { } // Settings data - $fieldErrorMessage = ( $_POST['field-error-message'] ) ? base64_decode( $_POST['field-error-message'] ) : ''; - $formSuccessMessage = ( $_POST['form-success-message'] ) ? base64_decode( $_POST['form-success-message'] ) : ''; - $formErrorMessage = ( $_POST['form-error-message'] ) ? base64_decode( $_POST['form-error-message'] ) : ''; - $emailReceiver = ( $_POST['email-receiver'] ) ? base64_decode( $_POST['email-receiver'] ) : ''; - $emailHeaders = ( $_POST['email-headers'] ) ? base64_decode( $_POST['email-headers'] ) : ''; - $emailFrom = ( $_POST['email-from'] ) ? base64_decode( $_POST['email-from'] ) : ''; - $emailSubject = ( $_POST['email-subject'] ) ? base64_decode( $_POST['email-subject'] ) : ''; - $emailBody = ( $_POST['email-body'] ) ? base64_decode( $_POST['email-body'] ) : ''; + $fieldErrorMessage = ( $_POST['field-error-message'] ) ? sanitize_text_field( $_POST['field-error-message'] ) : ''; + $formSuccessMessage = ( $_POST['form-success-message'] ) ? sanitize_text_field( $_POST['form-success-message'] ) : ''; + $formErrorMessage = ( $_POST['form-error-message'] ) ? sanitize_text_field( $_POST['form-error-message'] ) : ''; + $emailReceiver = ( $_POST['email-receiver'] ) ? sanitize_email( $_POST['email-receiver'] ) : ''; + $emailHeaders = ( $_POST['email-headers'] ) ? sanitize_text_field( $_POST['email-headers'] ) : ''; + $emailFrom = ( $_POST['email-from'] ) ? sanitize_email( $_POST['email-from'] ) : ''; + $emailSubject = ( $_POST['email-subject'] ) ? sanitize_text_field( $_POST['email-subject'] ) : ''; + $emailBody = ( $_POST['email-body'] ) ? sanitize_text_field( $_POST['email-body'] ) : ''; $fieldNames = array(); $validation = false; @@ -1958,5 +1958,16 @@ public function qubely_add_to_cart() wp_send_json_error($responseData); } } + + /** + * Custom sanitization function + */ + public function custom_sanitization( $element = '' ) { + $allowed_tags = array( + 'style' => array(), + 'script' => array(), + ); + return wp_kses( $element, $allowed_tags ); + } } new QUBELY(); diff --git a/core/admin-views/Fields.php b/core/admin-views/Fields.php index 599de5ed..d11eb151 100644 --- a/core/admin-views/Fields.php +++ b/core/admin-views/Fields.php @@ -1,9 +1,9 @@ - + - - + + - + - $label) { + foreach ( $info['options'] as $key => $label ) { ?> - + - + - + - name="qubely_options[]" - value="" + + name="qubely_options[]" + value="" type="checkbox" > - + ". esc_html($label) .""; + private static function label( $label ) { + if ( isset( $label ) ) { + echo "". esc_html( $label ) .""; } } @@ -128,10 +128,9 @@ private static function label($label) { * @param $description * @since 1.3.91 */ - private static function description($description) { - if(isset($description)){ - echo "

{$description}

"; + private static function description( $description ) { + if ( isset( $description ) ) { + echo '

' . wp_kses_post( $description ) . '

'; } } - -} +} \ No newline at end of file diff --git a/core/admin-views/Getting_Started.php b/core/admin-views/Getting_Started.php index 2a43e814..750a191d 100644 --- a/core/admin-views/Getting_Started.php +++ b/core/admin-views/Getting_Started.php @@ -43,30 +43,28 @@ public function mini_cards() { - +
-
-

+
+

- - +
-

+

- - +
-
-

+
+

@@ -86,8 +84,8 @@ public function social_links() { $value) { ?> - - + +