Get WordPress

Plugin Directory

Changeset 2955166

Timestamp:
08/18/2023 04:11:46 AM (12 months ago)
Author:
sayful
Message:

Fix a security issue related to plugin data tracking consent option.

Location:
carousel-slider/trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • carousel-slider/trunk/carousel-slider.php

    r2949400 r2955166  
    44 * Plugin URI: https://sayfulislam.com/?utm_source=wp-plugins&utm_campaign=plugin-uri&utm_medium=wp-dash
    55 * Description: <strong>Carousel Slider</strong> allows you to create beautiful, touch enabled, responsive carousels and sliders. It let you create SEO friendly Image carousel from Media Library or from custom URL, Video carousel using Youtube and Vimeo video, Post carousel, Hero banner slider and various types of WooCommerce products carousels.
    6  * Version: 2.2.2
     6 * Version: 2.2.
    77 * Author: Sayful Islam
    88 * Author URI: https://sayfulislam.com/?utm_source=wp-plugins&utm_campaign=author-uri&utm_medium=wp-dash
    … …  
    5353         * @var string
    5454         */
    55         private $version = '2.2.2';
     55        private $version = '2.2.';
    5656
    5757        /**

  • carousel-slider/trunk/includes/Admin/Feedback.php

    r2841739 r2955166  
    4242
    4343            add_action( 'wp_ajax_carousel_slider_deactivate_feedback', [ self::$instance, 'deactivate_feedback' ] );
     44
    4445
    4546            add_action( 'admin_notices', [ self::$instance, 'admin_notice' ] );
    46             add_action( 'admin_init', [ self::$instance, 'handle_optin_optout' ] );
    4747
    4848            add_filter( 'cron_schedules', [ self::$instance, 'add_weekly_schedule' ] );
    … …  
    5656     * Add weekly cron schedule
    5757     *
    58      * @param array $schedules List of schedules.
     58     * @param List of schedules.
    5959     *
    6060     * @return array
    … …  
    9191     */
    9292    public function deactivate_feedback() {
    93         if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], '_carousel_slider_deactivate_feedback_nonce' ) ) {
     93        if ( ! isset( $_POST['_wpnonce'] ) ||
     94             ! wp_verify_nonce( $_POST['_wpnonce'], '_carousel_slider_deactivate_feedback_nonce' )
     95        ) {
    9496            wp_send_json_error();
    9597        }
    … …  
    159161            'not_working'            => [
    160162                'title'             => esc_html__( 'I couldn\'t get the plugin to work', 'carousel-slider' ),
    161                 'input_placeholder' => esc_html__( 'Could you tell us a bit more whats not working?', 'carousel-slider' ),
     163                'input_placeholder' => esc_html__(
     164                    'Could you tell us a bit more whats not working?',
     165                    'carousel-slider'
     166                ),
    162167            ],
    163168            'missing_a_feature'      => [
    … …  
    171176            'carousel_slider_pro'    => [
    172177                'title' => esc_html__( 'I have Carousel Slider Pro', 'carousel-slider' ),
    173                 'alert' => esc_html__( 'Wait! Don\'t deactivate Carousel Slider. You have to activate both Carousel Slider and Carousel Slider Pro in order for the plugin to work.', 'carousel-slider' ),
     178                'alert' => esc_html__(
     179                    'Wait! Don\'t deactivate Carousel Slider. You have to activate both Carousel Slider and Carousel Slider Pro in order for the plugin to work.',
     180                    'carousel-slider'
     181                ),
    174182            ],
    175183            'other'                  => [
    … …  
    190198
    191199                    <div class="feedback-dialog__form-caption">
    192                         <?php echo esc_html__( 'If you have a moment, please share why you are deactivating Carousel Slider:', 'carousel-slider' ); ?>
     200                        <?php
     201                        echo esc_html__(
     202                            'If you have a moment, please share why you are deactivating Carousel Slider:',
     203                            'carousel-slider'
     204                        );
     205                        ?>
    193206                    </div>
    194207                    <div class="feedback-dialog__form-body">
    … …  
    203216                                <?php if ( ! empty( $reason['input_placeholder'] ) ) : ?>
    204217                                    <textarea
    205                                         class="carousel-slider-feedback-text"
    206                                         name="reason_<?php echo esc_attr( $reason_key ); ?>"
    207                                         placeholder="<?php echo esc_attr( $reason['input_placeholder'] ); ?>"
    208                                         rows="2"
     218                                        class="carousel-slider-feedback-text"
     219                                        name="reason_<?php echo esc_attr( $reason_key ); ?>"
     220                                        placeholder="<?php echo esc_attr( $reason['input_placeholder'] ); ?>"
     221                                        rows="2"
    209222                                    ></textarea>
    210223                                <?php endif; ?>
    … …  
    237250
    238251    /**
     252
     253
     254
     255
     256
     257
     258
     259
     260
     261
     262
     263
     264
     265
     266
     267
     268
    239269     * Show tracker notice to admin
    240270     *
    … …  
    250280
    251281        /* translators: 1 - Plugin name */
    252         $message = sprintf( __( 'Want to help make <strong>%1$s</strong> even more awesome? Allow %1$s to collect non-sensitive diagnostic data and usage information.', 'carousel-slider' ), 'Carousel Slider' );
    253 
    254         $message .= ' (<a class="carousel-slider-insights-data-we-collect" href="#">' . __( 'what we collect', 'carousel-slider' ) . '</a>)';
    255         $message .= '<p class="description" style="display:none;">' . implode( ', ', $this->data_we_collect() ) . '. No sensitive data is tracked. ';
     282        $message = sprintf(
     283            __(
     284                'Want to help make <strong>%1$s</strong> even more awesome? Allow %1$s to collect non-sensitive diagnostic data and usage information.',
     285                'carousel-slider'
     286            ),
     287            'Carousel Slider'
     288        );
     289
     290        $message .= ' (<a class="carousel-slider-insights-data-we-collect" href="#">' . __(
     291            'what we collect',
     292            'carousel-slider'
     293        ) . '</a>)';
     294        $message .= '<p class="description" style="display:none;">' . implode(
     295            ', ',
     296            $this->data_we_collect()
     297        ) . '. No sensitive data is tracked. ';
    256298        $message .= '<a href="' . Api::PRIVACY_URL . '" target="_blank">Learn more</a> about how Carousel Slider collects and handle your data.</p>';
    257299
    258         $optin_url  = add_query_arg( 'carousel_slider_tracker_optin', 'true' );
    259         $optout_url = add_query_arg( 'carousel_slider_tracker_optout', 'true' );
     300        $optin_url  = );
     301        $optout_url = );
    260302
    261303        $html  = '<div class="updated"><p>';
    262304        $html .= $message;
    263305        $html .= '</p><p class="submit">';
    264         $html .= '&nbsp;<a href="' . esc_url( $optin_url ) . '" class="button-primary button-large">' . __( 'Allow', 'carousel-slider' ) . '</a>';
    265         $html .= '&nbsp;<a href="' . esc_url( $optout_url ) . '" class="button-secondary button-large">' . __( 'No thanks', 'carousel-slider' ) . '</a>';
     306        $html .= '&nbsp;<a href="' . esc_url( $optin_url ) . '" class="button-primary button-large">' . __(
     307            'Allow',
     308            'carousel-slider'
     309        ) . '</a>';
     310        $html .= '&nbsp;<a href="' . esc_url( $optout_url ) . '" class="button-secondary button-large">' . __(
     311            'No thanks',
     312            'carousel-slider'
     313        ) . '</a>';
    266314        $html .= '</p></div>';
    267315
    … …  
    283331     */
    284332    public function handle_optin_optout() {
    285         // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    286         if ( isset( $_GET['carousel_slider_tracker_optin'] ) && 'true' === $_GET['carousel_slider_tracker_optin'] ) {
    287             $this->optin();
    288 
    289             // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
    290             wp_redirect( remove_query_arg( 'carousel_slider_tracker_optin' ) );
    291             exit;
    292         }
    293 
    294         // phpcs:ignore WordPress.Security.NonceVerification.Recommended
    295         if ( isset( $_GET['carousel_slider_tracker_optout'] ) && 'true' === $_GET['carousel_slider_tracker_optout'] ) {
    296             $this->optout();
    297 
    298             // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
    299             wp_redirect( remove_query_arg( 'carousel_slider_tracker_optout' ) );
    300             exit;
     333        if (
     334            current_user_can( 'manage_options' ) &&
     335            isset( $_GET['_token'] ) &&
     336            wp_verify_nonce( $_GET['_token'], 'carousel_slider_tracker' )
     337        ) {
     338            if ( isset( $_GET['carousel_slider_tracker_optin'] ) && 'true' === $_GET['carousel_slider_tracker_optin'] ) {
     339                $this->optin();
     340
     341                wp_safe_redirect( admin_url() );
     342                exit;
     343            }
     344
     345            if ( isset( $_GET['carousel_slider_tracker_optout'] ) && 'true' === $_GET['carousel_slider_tracker_optout'] ) {
     346                $this->optout();
     347
     348                wp_safe_redirect( admin_url() );
     349                exit;
     350            }
    301351        }
    302352    }
    … …  
    411461     * Send tracking data to server
    412462     *
    413      * @param boolean $override Re-sent even if it is already sent data.
     463     * @param Re-sent even if it is already sent data.
    414464     *
    415465     * @return void

  • carousel-slider/trunk/readme.txt

    r2949401 r2955166  
    66Tested up to: 6.3
    77Requires PHP: 7.0
    8 Stable tag: 2.2.2
     8Stable tag: 2.2.
    99License: GPLv3
    1010License URI: https://www.gnu.org/licenses/gpl-3.0.txt
    … …  
    9797== Changelog ==
    9898
     99
     100
     101
    99102= version 2.2.2 - 2023-08-08 =
    100103* Dev - Tested with WordPress 6.3 and WooCommerce 7.9
Note: See TracChangeset for help on using the changeset viewer.