Get WordPress

Plugin Directory

Changeset 3069819

Timestamp:
04/13/2024 12:42:02 AM (4 months ago)
Author:
dglingren
Message:

Fix SQL Injection and Reflected Cross Site Scripting issues, add custom:* to MLA Multi-search Example plugin.

Location:
media-library-assistant/trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • media-library-assistant/trunk/examples/plugins/mla-multi-search-example.php

    r1926030 r3069819  
    66 *
    77 * 1. A custom "multi_search" parameter names one or more "search keys", e.g.
    8  *    multi_search="keyword:,custom:Country,custom:City"
    9  *
    10  * 2. Each custom field is queried for a LIKE match with the content of the "s" parameter.
     8 *        multi_search="keyword:,custom:Country,custom:City"
     9 *    Where "keyword:" performs the usual Keyword(s) search
     10 *    and "custom:" searches the custom fields names in the list.
     11 *    You can code "custom:*" to search ALL custom fields without naming them.
     12 *
     13 * 2. Each custom field is queried for a LIKE match with the content of the "s" parameter.<br />
     14 *    Note that this is more limited than the logic provided by the Keyword(s) Search function.
    1115 *
    1216 * 3. Matches from the custom field search(es) are added to any keyword(s) search matches,
    … …  
    2024 * https://wordpress.org/support/topic/gallery-layout-with-thumbnails/
    2125 *
     26
     27
     28
     29
    2230 * @package MLA Multi-search Example
    23  * @version 1.01
     31 * @version 1.0
    2432 */
    2533
    … …  
    2937Description: Adds custom field search(es) to the [mla_gallery] keyword(s) search results
    3038Author: David Lingren
    31 Version: 1.01
     39Version: 1.0
    3240Author URI: http://davidlingren.com/
    3341
    34 Copyright 2016 David Lingren
     42Copyright 2016 David Lingren
    3543
    3644    This program is free software; you can redistribute it and/or modify
    … …  
    5967class MLAMultiSearchExample {
    6068    /**
     69
     70
     71
     72
     73
     74
     75
     76
     77
     78
     79
     80
     81
     82
     83
     84
     85
     86
    6187     * Initialization function, similar to __construct()
    6288     *
    … …  
    91117     */
    92118    public static function mla_gallery_attributes( $shortcode_attributes ) {
    93         //error_log( 'MLAMultiSearchExample::mla_gallery_attributes $shortcode_attributes = ' . var_export( $shortcode_attributes, true ), 0 );
     119        if ( isset( $shortcode_attributes['multi_search'] ) ) {
     120            MLACore::mla_debug_add( __LINE__ . " MLAMultiSearchExample::mla_gallery_attributes \$shortcode_attributes = " . var_export( $shortcode_attributes, true ), self::MLA_DEBUG_CATEGORY );
     121        }
     122
    94123        // Save the attributes for use in the later filters
    95124        self::$shortcode_attributes = $shortcode_attributes;
    … …  
    98127        return $shortcode_attributes;
    99128    } // mla_gallery_attributes
     129
     130
     131
     132
     133
     134
     135
     136
     137
     138
     139
     140
     141
     142
     143
     144
     145
     146
     147
     148
     149
    100150
    101151    /**
    … …  
    119169            global $post;
    120170           
     171
     172
    121173            $multi_search = self::$shortcode_attributes['multi_search'];
    122174            unset( self::$shortcode_attributes['multi_search'] );
    … …  
    141193           
    142194            $results = array();
    143             $search_value = !empty( self::$shortcode_attributes['s'] ) ? trim( self::$shortcode_attributes['s'] ) : '';
     195            $search_value = !empty( self::$shortcode_attributes['s'] ) ? trim( self::$shortcode_attributes['s'] ) : '';
    144196            $search_keys = explode( ',', $multi_search );
     197
     198
     199
     200
     201
     202
     203
     204
     205
     206
     207
     208
    145209
    146210            foreach( $search_keys as $search_key ) {
    147211                $tokens = array_map( 'trim', explode( ':', $search_key ) );
     212
    148213                switch ( $tokens[0] ) {
    149214                    case 'keyword':
    … …  
    166231
    167232                if ( is_string( $attachments ) ) {
     233
    168234                    $attachments = array();
     235
     236
    169237                }
    170 
     238               
    171239                unset( $attachments['found_rows'] );
    172240                unset( $attachments['max_num_pages'] );
    … …  
    179247            if ( count( $results ) ) {         
    180248                $all_query_parameters['include'] = implode( ',', $results );
     249
    181250            } else {
    182251                $all_query_parameters['include'] = '1';
    … …  
    190259} // Class MLAMultiSearchExample
    191260
    192 /*
    193  * Install the filters at an early opportunity
    194  */
     261// Install the filters at an early opportunity
    195262add_action('init', 'MLAMultiSearchExample::initialize');
    196263?>

  • media-library-assistant/trunk/includes/class-mla-core.php

    r3060779 r3069819  
    3131     * @var string
    3232     */
    33     const MLA_DEVELOPMENT_VERSION = '';
     33    const MLA_DEVELOPMENT_VERSION = '';
    3434
    3535    /**
    … …  
    793793        if ( ( false !== strpos( $location, 'upload.php?' ) ) || ( false !== strpos( $location, 'post.php?' ) ) ) {
    794794            if ( isset( $_REQUEST['mla_source'] ) ) {
    795                 $location = add_query_arg( array( 'mla_source' => sanitize_text_field( wp_unslash( $_REQUEST['mla_source'] ) ) ), $location );
     795                $location = add_query_arg( array( 'mla_source' => ) ) ), $location );
    796796            }
    797797        }

  • media-library-assistant/trunk/includes/class-mla-edit-media.php

    r2988720 r3069819  
    10781078        $view_args = array( 'page' => MLACore::ADMIN_PAGE_SLUG, 'mla_item_ID' => $post->ID );
    10791079        if ( isset( $_REQUEST['mla_source'] ) ) {
    1080             $view_args['mla_source'] = sanitize_text_field( wp_unslash( $_REQUEST['mla_source'] ) );
     1080            $view_args['mla_source'] = ) );
    10811081       
    1082             // apply_filters( 'get_delete_post_link', wp_nonce_url( $delete_link, "$action-post_{$post->ID}" ), $post->ID, $force_delete ) in /wp-includes/link-template.php
    10831082            add_filter( 'get_delete_post_link', 'MLAEdit::get_delete_post_link_filter', 10, 3 );
    10841083        }
    10851084       
    10861085        if ( isset( $_REQUEST['lang'] ) ) {
    1087             $view_args['lang'] = sanitize_text_field( wp_unslash( $_REQUEST['lang'] ) );
     1086            $view_args['lang'] = ) );
    10881087        }
    10891088

  • media-library-assistant/trunk/includes/class-mla-shortcode-custom-list.php

    r3057514 r3069819  
    11<?php
    22/**
    3  * Media Library Assistant Term List Shortcode
     3 * Media Library Assistant List Shortcode
    44 *
    55 * @package Media Library Assistant
    … …  
    18011801        $clause_parameters = array( $arguments['meta_key'] );
    18021802        $clause = array ( $wpdb->prepare( 'm.meta_key = \'' . join( ',', $placeholders ) . '\'', $clause_parameters ) ); // phpcs:ignore
    1803 //      $clause = array( "m.meta_key = '" . $arguments['meta_key'] . "'" );
    18041803
    18051804        $clause_parameters = array();
    … …  
    18071806
    18081807        /*
    1809          * The "ids" parameter can build an item-specific cloud.
    1810          * Compile a list of all the terms assigned to the items.
     1808         * The "ids" parameter can build an item-specific .
     1809         * Compile a list of all the s assigned to the items.
    18111810         */
    18121811        if ( ! empty( $arguments['ids'] ) ) {
    18131812            $ids = wp_parse_id_list( $arguments['ids'] );
    1814             $placeholders = implode( "','", $ids );
    1815             $clause[] = "AND m.post_id IN ( '{$placeholders}' )";
     1813            $ = implode( "','", $ids );
     1814            $clause[] = "AND m.post_id IN ( '{$}' )";
    18161815
    18171816            $includes = array();
    … …  
    18271826            // Apply a non-empty argument before we replace it.
    18281827            if ( ! empty( $arguments['include'] ) ) {
    1829                 $includes = array_intersect( $includes, wp_parse_id_list( $arguments['include'] ) );
    1830             }
    1831 
    1832             // If there are no values we want an empty cloud
     1828                $includes = array_intersect( $includes, ( $arguments['include'] ) );
     1829            }
     1830
     1831            // If there are no values we want an empty
    18331832            if ( empty( $includes ) ) {
    18341833                $arguments['include'] = (string) 0x7FFFFFFF;
    … …  
    18391838        }
    18401839
    1841         // Add include/exclude and parent constraints to WHERE cluse
     1840        // Add include/exclude constraints to WHERE cluse
    18421841        if ( ! empty( $arguments['include'] ) ) {
    1843             $placeholders = implode( "','", str_getcsv( $arguments['include'] ) );
    1844             $clause[] = "AND m.meta_value IN ( '{$placeholders}' )";
     1842            $includes = str_getcsv( $arguments['include'] );
     1843            foreach ( $includes as $include ) {
     1844                $placeholders[] = '%s';
     1845                $clause_parameters[] = $include;
     1846            }
     1847
     1848            $clause[] = 'AND m.meta_value IN (' . join( ',', $placeholders ) . ')';
    18451849        } elseif ( ! empty( $arguments['exclude'] ) ) {
    1846             $placeholders = implode( "','", str_getcsv( $arguments['exclude'] ) );
    1847             $clause[] = "AND m.meta_value NOT IN ( '{$placeholders}' )";
     1850            $excludes = str_getcsv( $arguments['exclude'] );
     1851            foreach ( $excludes as $exclude ) {
     1852                $placeholders[] = '%s';
     1853                $clause_parameters[] = $exclude;
     1854            }
     1855
     1856            $clause[] = 'AND m.meta_value NOT IN (' . join( ',', $placeholders ) . ')';
    18481857        }
    18491858

  • media-library-assistant/trunk/index.php

    r3060779 r3069819  
    1616Plugin Name: Media Library Assistant
    1717Plugin URI: http://davidlingren.com/#two
    18 Description: Enhances the Media Library; powerful [mla_gallery] [mla_tag_cloud] [mla_term_list], taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.
     18Description: Enhances the Media Library; powerful [mla_gallery] [mla_tag_cloud] [mla_term_list], taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.
    1919Version: 3.15
    2020Requires at least: 4.1

  • media-library-assistant/trunk/readme.txt

    r3060779 r3069819  
    187187
    188188== Changelog ==
     189
     190
     191
     192
     193
     194
    189195
    190196= 3.15 =
Note: See TracChangeset for help on using the changeset viewer.