Changeset 3095922

Timestamp:

06/01/2024 12:23:09 AM (2 months ago)

Author:

dglingren

Message:

Fix Media/Assistant security risk and orderby=rml pagination controls.

Location:

media-library-assistant/trunk

Files:

• includes/class-mla-core.php (modified) (1 diff)
• includes/class-mla-list-table.php (modified) (1 diff)
• includes/class-mla-main.php (modified) (1 diff)
• index.php (modified) (1 diff)
• readme.txt (modified) (1 diff)

media-library-assistant/trunk/includes/class-mla-core.php

@@ -31 +31 @@
      * @var string
      */
-    const MLA_DEVELOPMENT_VERSION = '20240530';
+    const MLA_DEVELOPMENT_VERSION = '2024053';
 
     /**

media-library-assistant/trunk/includes/class-mla-list-table.php

@@ -415 +415 @@
         // Sort arguments (from column header)
         if ( isset( $_REQUEST['order'] ) ) {
-            $field = strtolower( sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) );
+            $field = strtolower(  ) );
             $submenu_arguments['order'] = ( 'desc' === $field ) ? 'desc' : 'asc';
         }
 
         if ( isset( $_REQUEST['orderby'] ) ) {
-            foreach ( MLAQuery::$default_sortable_columns as $sortable_column ) {
-                if ( $sortable_column[0] === $_REQUEST['orderby'] ) {
-                    $submenu_arguments['orderby'] = urlencode( $sortable_column[0] );
+            if ( 'rml' === $_REQUEST['orderby'] ) {
+                $submenu_arguments['orderby'] = 'rml';
+            } else {
+                foreach ( MLAQuery::$default_sortable_columns as $sortable_column ) {
+                    if ( $sortable_column[0] === $_REQUEST['orderby'] ) {
+                        $submenu_arguments['orderby'] = urlencode( $sortable_column[0] );
+                    }
                 }
             }

media-library-assistant/trunk/includes/class-mla-main.php

@@ -1571 +1571 @@
 
         if ( isset( $_REQUEST['order'] ) ) {
-            $_GET['order'] = sanitize_text_field( wp_unslash( $_REQUEST['order'] ) );
+            $_GET['order'] = ;
         }
 
         if ( isset( $_REQUEST['orderby'] ) ) {
-            $_GET['orderby'] = sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) );
+            $_GET['orderby'] = ( wp_unslash( $_REQUEST['orderby'] ) );
         }
 

media-library-assistant/trunk/index.php

@@ -16 +16 @@
 Plugin Name: Media Library Assistant
 Plugin URI: http://davidlingren.com/#two
-Description: 20240530 Enhances the Media Library; powerful [mla_gallery] [mla_tag_cloud] [mla_term_list], taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.
+Description: 2024053 Enhances the Media Library; powerful [mla_gallery] [mla_tag_cloud] [mla_term_list], taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.
 Version: 3.16
 Requires at least: 4.1

media-library-assistant/trunk/readme.txt

@@ -189 +189 @@
 
 = 3.17 =
+
+
 * Fix: For the `[mla_gallery]` shortcode, handling of brace-delimited array values in the `,str_replace(s,r)` format code has been corrected.
 * Fix: For the Media Manager Modal (popup) Window, the Enter key now triggers the MLA Enhanced Search Media function.