Changeset 3098232

Timestamp:

06/05/2024 10:41:38 PM (2 months ago)

Author:

dglingren

Message:

Fix SQL Injection risk in shortcodes, update IPTC document links in Documentation.

Location:

media-library-assistant/trunk

Files:

• includes/class-mla-core.php (modified) (1 diff)
• includes/class-mla-shortcode-support.php (modified) (3 diffs)
• index.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• tpls/documentation-settings-tab.tpl (modified) (3 diffs)

media-library-assistant/trunk/includes/class-mla-core.php

@@ -31 +31 @@
      * @var string
      */
-    const MLA_DEVELOPMENT_VERSION = '20240531';
+    const MLA_DEVELOPMENT_VERSION = '20240';
 
     /**

media-library-assistant/trunk/includes/class-mla-shortcode-support.php

@@ -2786 +2786 @@
         $results = array ();
         $order = isset( $query_parameters['order'] ) ? ' ' . trim( strtoupper( $query_parameters['order'] ) ) : '';
+
+
+
+
         $orderby = isset( $query_parameters['orderby'] ) ? $query_parameters['orderby'] : '';
         $meta_key = isset( $query_parameters['meta_key'] ) ? $query_parameters['meta_key'] : '';
@@ -2876 +2880 @@
                         } // switch $matches[1]
 
-                        $results[] = isset( $matches[2] ) ? $matches[1] . $matches[2] : $matches[1] . $order;
+                        $results[] = isset( $matches[2] ) ? $matches[1] . $matches[2] : $matches[1] . $order;
                     } // not 'rand'
                 } // allowed key
@@ -2898 +2902 @@
      */
     private static $mla_get_shortcode_attachments_parameters = array(
-            'order' => 'ASC', // or 'DESC' or 'RAND'
+            'order' => 'ASC', // or 'DESC'
             'orderby' => 'menu_order,ID',
             'id' => NULL,

media-library-assistant/trunk/index.php

@@ -16 +16 @@
 Plugin Name: Media Library Assistant
 Plugin URI: http://davidlingren.com/#two
-Description: 20240531 Enhances the Media Library; powerful [mla_gallery] [mla_tag_cloud] [mla_term_list], taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.
+Description: 20240 Enhances the Media Library; powerful [mla_gallery] [mla_tag_cloud] [mla_term_list], taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.
 Version: 3.16
 Requires at least: 4.1

media-library-assistant/trunk/readme.txt

@@ -4 +4 @@
 Tags: categories, images, media, media library, tags
 Requires at least: 4.1
-Tested up to: 6.5.3
+Tested up to: 6.5.
 Stable tag: 3.16
 Requires PHP: 5.3
@@ -189 +189 @@
 
 = 3.17 =
+
 * Fix: **IMPORTANT: A Reflected Cross-Site Scripting security risk in the Media/Assistant page has been mitigated.**
+
 * Fix: When the "Real Media Library" plugin (Pro version) is active, `orderby=rml` is propegated to the Media/Assistant pagination controls.
 * Fix: For the `[mla_gallery]` shortcode, handling of brace-delimited array values in the `,str_replace(s,r)` format code has been corrected.
 * Fix: For the Media Manager Modal (popup) Window, the Enter key now triggers the MLA Enhanced Search Media function.
 * Fix: When the Elementor page editor is active, buttons on the "Insert Media" popup window are now sized correctly.
+
 
 = 3.16 =

media-library-assistant/trunk/tpls/documentation-settings-tab.tpl

@@ -5891 +5891 @@
         The IPTC (International Press Telecommunications Council) metadata, if any, embedded in the image file. For this category, you can code any of the IPTC DataSet tag and field identifiers, e.g., "2#025" for the Keywords field. You can also use the "friendly name" MLA defines for most of the IPTC fields; see the <a href="#mla_iptc_identifiers">table of identifiers and friendly names</a> below.<br />
         &nbsp;<br />
-        You can find more IPTC information in the <a href="http://www.iptc.org/std/IIM/4.1/specification/IIMV4.1.pdf" title="IPTC-NAA Information Interchange Model Version No. 4.1 specification (PDF)" target="_blank">IPTC-NAA Information Interchange Model Version No. 4.1 specification (PDF document)</a>.
+        You can find more IPTC information in the <a href="http specification (PDF document)</a>.
         <br />&nbsp;<br />
         A special iptc "pseudo-value" is available; <strong>ALL_IPTC</strong> (<code>[+iptc:ALL_IPTC+]</code>). It returns a string representation of all IPTC data. You can use the pseudo-value to examine the metadata in an image, find field names and see what values are embedded in the image.
@@ -6459 +6459 @@
 <h4>Field-level IPTC Identifiers and Friendly Names</h4>
 <p>
-IPTC Photo Metadata provides data about photographs and the values can be processed by software. Each individual metadata entity is called a property and they are grouped into Administrative, Descriptive and Rights-related properties. IPTC Photo Metadata properties have photo specific definitions that are widely supported by imaging software. You can find complete documentation of IPTC properites at the <a href="https://www.iptc.org/std/photometadata/specification/IPTC-PhotoMetadata" title="IPTC Photo Metadata Standard 2019.1" target="_blank">IPTC Photo Metadata Standard 2019.1 web site.</a>
+IPTC Photo Metadata provides data about photographs and the values can be processed by software. Each individual metadata entity is called a property and they are grouped into Administrative, Descriptive and Rights-related properties. IPTC Photo Metadata properties have photo specific definitions that are widely supported by imaging software. You can find complete documentation of IPTC properites at the <a href="https://www.iptc.org/std/photometadata/specification/IPTC-PhotoMetadata" title="IPTC Photo Metadata Standard 20 web site.</a>
 </p>
 <p>
@@ -8625 +8625 @@
 </dd>
 <dt>IPTC Value</dt>
-<dd>The IPTC (International Press Telecommunications Council) metadata, if any, embedded in the image file. For this category, you can select any of the IPTC DataSet tag and field identifiers, e.g., "2#025" for the Keywords field. The dropdown list has the identifier and the "friendly name" MLA defines for most of the IPTC fields; see the table of identifiers and friendly names in the table below. You can find more information in the <a href="http://www.iptc.org/std/IIM/4.1/specification/IIMV4.1.pdf" title="IPTC-NAA Information Interchange Model Version No. 4.1 specification" target="_blank">IPTC-NAA Information Interchange Model Version No. 4.1 specification</a>.
+<dd>The IPTC (International Press Telecommunications Council) metadata, if any, embedded in the image file. For this category, you can select any of the IPTC DataSet tag and field identifiers, e.g., "2#025" for the Keywords field. The dropdown list has the identifier and the "friendly name" MLA defines for most of the IPTC fields; see the table of identifiers and friendly names in the table below. You can find more information in the <a href="http</a>.
 </dd>
 <dt>EXIF/Template Value</dt>