Changeset 3105342

Timestamp:

06/20/2024 08:01:57 PM (7 weeks ago)

Author:

dglingren

Message:

Mitigate cross-site scripting risk in Media/Assistant when orderby=rml.

Location:

media-library-assistant/trunk

Files:

• includes/class-mla-core.php (modified) (1 diff)
• includes/class-mla-list-table.php (modified) (1 diff)
• index.php (modified) (1 diff)
• readme.txt (modified) (1 diff)

media-library-assistant/trunk/includes/class-mla-core.php

@@ -31 +31 @@
      * @var string
      */
-    const MLA_DEVELOPMENT_VERSION = '';
+    const MLA_DEVELOPMENT_VERSION = '';
 
     /**

media-library-assistant/trunk/includes/class-mla-list-table.php

@@ -1846 +1846 @@
                     $orderby = sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) );
                     if ( 'rml' === $orderby ) {
-                        $order = isset( $_REQUEST['order'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : 'asc';
+                        if ( isset( $_REQUEST['order'] ) ) {
+                            $field = strtolower( wp_unslash( $_REQUEST['order'] ) );
+                            $order['order'] = ( 'desc' === $field ) ? 'desc' : 'asc';
+                        } else {
+                            $order = 'asc';
+                        }
 
                         $base_url .= '&orderby=' . $orderby . '&order=' . $order;

media-library-assistant/trunk/index.php

@@ -16 +16 @@
 Plugin Name: Media Library Assistant
 Plugin URI: http://davidlingren.com/#two
-Description: Enhances the Media Library; powerful [mla_gallery] [mla_tag_cloud] [mla_term_list], taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.
+Description: Enhances the Media Library; powerful [mla_gallery] [mla_tag_cloud] [mla_term_list], taxonomy support, IPTC/EXIF/XMP/PDF processing, bulk/quick edit.
 Version: 3.17
 Requires at least: 4.1

media-library-assistant/trunk/readme.txt

@@ -187 +187 @@
 
 == Changelog ==
+
+
+
 
 = 3.17 =