Changeset 3082081

Timestamp:

05/06/2024 06:21:37 PM (3 months ago)

Author:

RavanH

Message:

fix unauthenticated file inclusion

Location:

xml-sitemap-feed/trunk

Files:

• inc/functions-public.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• xml-sitemap.php (modified) (2 diffs)

xml-sitemap-feed/trunk/inc/functions-public.php

@@ -67 +67 @@
      */
 
-    $parts = explode( '-', $feed, 3 );
+    $parts = array();
+    foreach ( \explode( '-', $feed, 3 ) as $part ) {
+        $parts[] = basename( $part ); // Patch unauthenticated file inclusion - CVE-2024-4441 reported by Foxyyy.
+    }
 
     // Possible theme template file names.

xml-sitemap-feed/trunk/readme.txt

@@ -6 +6 @@
 Requires PHP: 5.6
 Tested up to: 6.4.3
-Stable tag: 5.4.8
+Stable tag: 5.4.
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -296 +296 @@
 == Upgrade Notice ==
 
-= 5.4.8 =
-Bugfix: Failing blog_public check.
+= 5.4. =
+.
 
 == Changelog ==
+
+
+
+
 
 = 5.4.8 =

xml-sitemap-feed/trunk/xml-sitemap.php

@@ -4 +4 @@
  * Plugin URI: https://status301.net/wordpress-plugins/xml-sitemap-feed/
  * Description: Feed the hungry spiders in compliance with the XML Sitemap and Google News protocols. Happy with the results? Please leave me a <strong><a href="https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=ravanhagen%40gmail%2ecom&item_name=XML%20Sitemap%20Feed">tip</a></strong> for continued development and support. Thanks :)
- * Version: 5.4.8
+ * Version: 5.4.
  * Text Domain: xml-sitemap-feed
  * Requires at least: 4.4
@@ -14 +14 @@
  */
 
-define( 'XMLSF_VERSION', '5.4.8' );
+define( 'XMLSF_VERSION', '5.4.' );
 
 /**