Skip to content

Commit 9e9b0fc

Browse files
circuscodecircuscode
committed
Escaping
1 parent e21ba1d commit 9e9b0fc

File tree

4 files changed

+63
-38
lines changed

4 files changed

+63
-38
lines changed

‎tootpress_blog.php‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ function tootpress_paint_image($tootid){
9494
}
9595

9696
$image_html.='">';
97-
$image_html.=tootpress_paint_image_tag($toot_image[$i]['attachment_file'],$toot_image[$i]['attachment_description'],$amount_of_images,($i+1));
97+
$image_html.=tootpress_paint_image_tag($toot_image[$i]['attachment_file'],$toot_image[$i]['attachment_description'],$toot_image[$i]['attachment_width'],$toot_image[$i]['attachment_height'],$amount_of_images,($i+1));
9898
$image_html.='</div>';
9999

100100
}
@@ -109,20 +109,22 @@ function tootpress_paint_image($tootid){
109109
*
110110
* @param string Image File Name
111111
* @param string Image Description
112+
* @param int Image Width
113+
* @param int Image Height
112114
* @param int Amount of Images
113115
* @param int Image Number
114116
* @return string Image Tag
115117
*/
116118

117-
function tootpress_paint_image_tag($filename, $description, $amount_of_images, $image_number) {
119+
function tootpress_paint_image_tag($filename, $description, $width, $height, $amount_of_images, $image_number) {
118120

119121
$image_tag='<img ';
120122
$image_tag.='src="';
121-
$image_tag.=tootpress_get_url_image_directory();
122-
$image_tag.=$filename;
123+
$image_tag.=esc_url(tootpress_get_url_image_directory());
124+
$image_tag.=esc_html($filename);
123125
$image_tag.='" ';
124126
$image_tag.='alt="';
125-
$image_tag.=$description;
127+
$image_tag.=esc_html($description);
126128
//$image_tag.='" ';
127129
//$image_tag.='width="';
128130
//$image_tag.=$toot_image[0]['attachment_width'];
@@ -131,7 +133,7 @@ function tootpress_paint_image_tag($filename, $description, $amount_of_images, $
131133
//$image_html.=$toot_image[0]['attachment_height'];
132134
$image_tag.='" />';
133135

134-
$image_tag=tootpress_image_filter_apply($image_tag,$amount_of_images,$image_number);
136+
$image_tag=tootpress_image_filter_apply($image_tag,$filename,$description, $width,$height,tootpress_get_url_image_directory(),$amount_of_images,$image_number);
135137

136138
return $image_tag;
137139

‎tootpress_hooks.php‎

Lines changed: 40 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,13 @@ function tootpress_fire_toots_update() {
3838
*
3939
* @since 0.4
4040
*
41-
* @param string Empty
42-
* @return string Filtered Preample
41+
* @param string Preamble
42+
* @return html Filtered Preamble
4343
*/
4444

4545
function tootpress_preamble_filter_apply($preamble) {
4646
$preamble=apply_filters( 'tootpress_preamble_filter', $preamble );
47+
$preamble=wp_kses_post($preamble);
4748
return $preamble;
4849
}
4950

@@ -54,12 +55,13 @@ function tootpress_preamble_filter_apply($preamble) {
5455
*
5556
* @since 0.5
5657
*
57-
* @param string Empty
58-
* @return string Filtered Content
58+
* @param string Closing
59+
* @return html Filtered Closing
5960
*/
6061

6162
function tootpress_closing_filter_apply($content) {
6263
$content=apply_filters( 'tootpress_closing_filter', $content );
64+
$content=wp_kses_post($content);
6365
return $content;
6466
}
6567

@@ -76,6 +78,7 @@ function tootpress_closing_filter_apply($content) {
7678

7779
function tootpress_menu_forward_filter_apply($label) {
7880
$label=apply_filters( 'tootpress_menu_forward_label', $label );
81+
$label=esc_html($label);
7982
return $label;
8083
}
8184

@@ -86,12 +89,13 @@ function tootpress_menu_forward_filter_apply($label) {
8689
*
8790
* @since 0.5
8891
*
89-
* @param string Original Backward
92+
* @param string Original Label
9093
* @return string New Label
9194
*/
9295

9396
function tootpress_menu_backward_filter_apply($label) {
9497
$label=apply_filters( 'tootpress_menu_backward_label', $label );
98+
$label=esc_html($label);
9599
return $label;
96100
}
97101

@@ -103,9 +107,9 @@ function tootpress_menu_backward_filter_apply($label) {
103107
*
104108
* @since 0.5
105109
*
106-
* @param string empty
110+
* @param string Content
107111
* @param int TootPress Current Page Number
108-
* @return string Content
112+
* @return html Content
109113
*/
110114

111115
function tootpress_beforeloop_filter_apply($content, $current_page_number) {
@@ -114,6 +118,8 @@ function tootpress_beforeloop_filter_apply($content, $current_page_number) {
114118

115119
$content=apply_filters( 'tootpress_beforeloop_filter', $content, $current_page_number, $last_page_number );
116120

121+
$content=wp_kses_post($content);
122+
117123
return $content;
118124
}
119125

@@ -125,9 +131,9 @@ function tootpress_beforeloop_filter_apply($content, $current_page_number) {
125131
*
126132
* @since 0.5
127133
*
128-
* @param string empty
134+
* @param string Content
129135
* @param int TootPress Current Page Number
130-
* @return string Content
136+
* @return html Content
131137
*/
132138

133139
function tootpress_afterloop_filter_apply($content, $current_page_number) {
@@ -136,6 +142,8 @@ function tootpress_afterloop_filter_apply($content, $current_page_number) {
136142

137143
$content=apply_filters( 'tootpress_afterloop_filter', $content, $current_page_number, $last_page_number );
138144

145+
$content=wp_kses_post($content);
146+
139147
return $content;
140148
}
141149

@@ -146,12 +154,13 @@ function tootpress_afterloop_filter_apply($content, $current_page_number) {
146154
*
147155
* @since 0.5
148156
*
149-
* @param string img HTML Tag (Mastodon Logo)
150-
* @return string img HTML Tag (Custom Logo)
157+
* @param html Mastodon Logo
158+
* @return html Custom Logo
151159
*/
152160

153161
function tootpress_mastodon_logo_filter_apply($img) {
154162
$img=apply_filters( 'tootpress_mastodon_logo_filter', $img );
163+
$img=wp_kses_post($img);
155164
return $img;
156165
}
157166

@@ -162,12 +171,13 @@ function tootpress_mastodon_logo_filter_apply($img) {
162171
*
163172
* @since 0.5
164173
*
165-
* @param string Empty
166-
* @return string Between Content
174+
* @param string Content
175+
* @return html Between Content
167176
*/
168177

169178
function tootpress_between_filter_apply($content) {
170179
$content=apply_filters( 'tootpress_between_filter', $content );
180+
$content=wp_kses_post($content);
171181
return $content;
172182
}
173183

@@ -178,12 +188,13 @@ function tootpress_between_filter_apply($content) {
178188
*
179189
* @since 0.5
180190
*
181-
* @param string Content
182-
* @return string Filtered Content
191+
* @param html Content
192+
* @return html Filtered Content
183193
*/
184194

185195
function tootpress_toot_content_filter_apply($content) {
186-
$content=apply_filters( 'tootpress_toot_content_filter', $content );
196+
$content=apply_filters( 'tootpress_toot_content_filter', $content );
197+
$content=wp_kses_post($content);
187198
return $content;
188199
}
189200

@@ -211,6 +222,8 @@ function tootpress_date_filter_apply($date) {
211222

212223
$date=apply_filters( 'tootpress_date_filter', $date, $year, $month, $day, $hour, $minute, $second );
213224

225+
$date=esc_html($date);
226+
214227
return $date;
215228
}
216229

@@ -221,15 +234,22 @@ function tootpress_date_filter_apply($date) {
221234
*
222235
* @since 0.5
223236
*
224-
* @param string Image Tag
237+
* @param html Image Tag
238+
* @param string Image File Name
239+
* @param string Image Description
240+
* @param int Image Width
241+
* @param int Image Height
242+
* @param url TootPress Image Directory
225243
* @param int Amount of Images
226244
* @param int Image Number
227-
* @return string Filtered Image Tag
245+
* @return html Filtered Image Tag
228246
*/
229247

230-
function tootpress_image_filter_apply($img_tag,$amount_of_images,$image_number) {
248+
function tootpress_image_filter_apply($img_tag,$filename,$description,$width,$height,$image_directory_path,$amount_of_images,$image_number) {
249+
250+
$img_tag=apply_filters( 'tootpress_image_filter',$img_tag,$filename,$description,$width,$height,$image_directory_path,$amount_of_images,$image_number);
231251

232-
$img_tag=apply_filters( 'tootpress_image_filter', $img_tag, $amount_of_images, $image_number);
252+
$img_tag=wp_kses_post($img_tag);
233253

234254
return $img_tag;
235255
}

‎tootpress_menu.php‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -65,26 +65,26 @@ function tootpress_generate_nav_standard($current_page) {
6565
if($current_page>1) {
6666

6767
$menu_html.='<a href="';
68-
$menu_html.=tootpress_blog_url();
68+
$menu_html.=esc_url(tootpress_blog_url());
6969
if($current_page==2) {
7070
// Special Case: Page 2
7171
$menu_html.='"';
7272
} else {
7373
// Page 3 to n
7474
if($is_perma_enabled) {
7575
// Perma
76-
$menu_html.=($current_page-1);
76+
$menu_html.=(int)($current_page-1);
7777
$menu_html.='/"';
7878
} else {
7979
// Simple
8080
$menu_html.='&tootpress=';
81-
$menu_html.=($current_page-1);
81+
$menu_html.=(int)($current_page-1);
8282
$menu_html.='"';
8383
}
8484
}
8585
$menu_html.='class="tootpress_nav_standard_newer_toots"';
8686
$menu_html.='>';
87-
$menu_html.=tootpress_label_newer_toots();
87+
$menu_html.=esc_html(tootpress_label_newer_toots());
8888
$menu_html.='</a>';
8989

9090
}
@@ -93,20 +93,20 @@ function tootpress_generate_nav_standard($current_page) {
9393
if($current_page<$amount_of_pages) {
9494

9595
$menu_html.='<a href="';
96-
$menu_html.=tootpress_blog_url();
96+
$menu_html.=esc_url(tootpress_blog_url());
9797
if($is_perma_enabled) {
9898
// Perma
99-
$menu_html.=($current_page+1);
99+
$menu_html.=(int)($current_page+1);
100100
$menu_html.='/" ';
101101
} else {
102102
// Simple
103103
$menu_html.='&tootpress=';
104-
$menu_html.=($current_page+1);
104+
$menu_html.=(int)($current_page+1);
105105
$menu_html.='" ';
106106
}
107107
$menu_html.='class="tootpress_nav_standard_older_toots"';
108108
$menu_html.='>';
109-
$menu_html.=tootpress_label_older_toots();
109+
$menu_html.=esc_html(tootpress_label_older_toots());
110110
$menu_html.='</a>';
111111

112112
}
@@ -136,24 +136,24 @@ function tootpress_generate_nav_numbers($current_page) {
136136

137137
if(tootpress_nav_numbers_condition_number($current_number, $current_page, $amount_of_pages)) {
138138
$menu_html.='<a href="';
139-
$menu_html.=tootpress_blog_url();
139+
$menu_html.=esc_url(tootpress_blog_url());
140140
if($i==0) {
141141
$menu_html.='" '; // Special Case Number 1 (Perma & Simple)
142142
}else{
143143
if($is_perma_enabled){
144144
// Perma
145-
$menu_html.=($current_number);
145+
$menu_html.=(int)($current_number);
146146
$menu_html.='/" ';
147147
} else {
148148
// Simple
149149
$menu_html.='&tootpress=';
150-
$menu_html.=($current_number).'" ';
150+
$menu_html.=(int)($current_number).'" ';
151151
}
152152
}
153153
$menu_html.='class="tootpress_nav_number ';
154154
if($current_page==($current_number)) {$menu_html.=' active'; }
155155
$menu_html.='">';
156-
$menu_html.=$current_number;
156+
$menu_html.=(int)$current_number;
157157
$menu_html.='</a>';
158158
}
159159

‎tootpress_url.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@ function tootpress_get_query_var() {
4444
// If Query Var is not set
4545
if ($qvar=="") {$qvar="1";}
4646

47+
// Security
48+
$qvar=(int)$qvar;
49+
4750
return $qvar;
4851

4952
}

0 commit comments

Comments
 (0)