Skip to content

Commit 8a821f9

Browse files
hunkhunk
committed
add nonce in forms, thanks Burak Kelebek for the report
1 parent 14c0a54 commit 8a821f9

File tree

8 files changed

+132
-63
lines changed

8 files changed

+132
-63
lines changed

‎.htaccess‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<FilesMatch "^(mf_upload|phpThumb)\.php$">
2+
<IfModule !mod_authz_core.c>
3+
Order allow,deny
4+
Allow from all
5+
</IfModule>
6+
<IfModule mod_authz_core.c>
7+
Require all granted
8+
</IfModule>
9+
</FilesMatch>

‎admin/mf_admin.php‎

Lines changed: 60 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -260,7 +260,7 @@ public function get_custom_field_by_name($name_custom_field, $post_type){
260260
$field = $wpdb->get_row( $query, ARRAY_A);
261261
return $field;
262262
}
263-
263+
264264
public function mf_resolve_linebreaks($data = NULL){
265265
$data = preg_replace(array("/\r\n/","/\r/","/\n/"),"\\n",$data);
266266
return $data;
@@ -375,7 +375,7 @@ public function import($file_path,$overwrite){
375375
$post_type['label']['name'] = $temp_name;
376376
$post_type['label']['menu_name'] = $temp_name;
377377
}
378-
378+
379379
$post_type['core']['id'] = NULL;
380380

381381
$this->new_posttype($post_type);
@@ -398,7 +398,7 @@ public function import($file_path,$overwrite){
398398
unset($tmp_group);
399399
$tmp_group['core'] = $group;
400400
$this->update_custom_group($tmp_group);
401-
401+
402402
foreach($fields as $field){
403403
$tmp_field = $this->get_custom_field_by_name($field['name'],$name);
404404

@@ -416,7 +416,7 @@ public function import($file_path,$overwrite){
416416
$tmp_field['option'] = unserialize( $field['options'] );
417417
$this->new_custom_field($tmp_field);
418418
}
419-
419+
420420
}
421421

422422
}else{
@@ -453,7 +453,7 @@ public function import($file_path,$overwrite){
453453
foreach($taxonomies as $taxonomy){
454454
if($overwrite){
455455
$t_type = $taxonomy['core']['type'];
456-
456+
457457
$tmp_taxonomy = $this->get_custom_taxonomy_by_type($t_type);
458458

459459
if($tmp_taxonomy){
@@ -468,9 +468,9 @@ public function import($file_path,$overwrite){
468468

469469
}else{
470470
$t_type = $taxonomy['core']['type'];
471-
471+
472472
$tmp_taxonomy = $this->get_custom_taxonomy_by_type($t_type);
473-
473+
474474
if($tmp_taxonomy){
475475
$i = 2;
476476
$temp_name = $t_type . "_1";
@@ -490,7 +490,7 @@ public function import($file_path,$overwrite){
490490
$this->new_custom_taxonomy($taxonomy);
491491
}
492492
}
493-
493+
494494
}
495495
/* end register custom taxonomies */
496496

@@ -503,12 +503,47 @@ function escape_data(&$value){
503503
// quick fix for ' character
504504
/** @todo have a proper function escaping all these */
505505
if(is_string($value)){
506+
$value = htmlspecialchars_decode($value);
507+
$value = self::strip_html_tags($value);
508+
$value = htmlentities($value);
506509
$value = stripslashes($value);
507510
$value = preg_replace('/\'/','´', $value);
508511
$value = addslashes($value);
512+
pr($value);
509513
}
510514
}
511515

516+
public static function strip_html_tags( $text ) {
517+
$text = preg_replace(
518+
array(
519+
// Remove invisible content
520+
'@<head[^>]*?>.*?</head>@siu',
521+
'@<style[^>]*?>.*?</style>@siu',
522+
'@<script[^>]*?.*?</script>@siu',
523+
'@<object[^>]*?.*?</object>@siu',
524+
'@<embed[^>]*?.*?</embed>@siu',
525+
'@<applet[^>]*?.*?</applet>@siu',
526+
'@<noframes[^>]*?.*?</noframes>@siu',
527+
'@<noscript[^>]*?.*?</noscript>@siu',
528+
'@<noembed[^>]*?.*?</noembed>@siu',
529+
// Add line breaks before and after blocks
530+
'@</?((address)|(blockquote)|(center)|(del))@iu',
531+
'@</?((div)|(h[1-9])|(ins)|(isindex)|(p)|(pre))@iu',
532+
'@</?((dir)|(dl)|(dt)|(dd)|(li)|(menu)|(ol)|(ul))@iu',
533+
'@</?((table)|(th)|(td)|(caption))@iu',
534+
'@</?((form)|(button)|(fieldset)|(legend)|(input))@iu',
535+
'@</?((label)|(select)|(optgroup)|(option)|(textarea))@iu',
536+
'@</?((frameset)|(frame)|(iframe))@iu',
537+
),
538+
array(
539+
' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ',
540+
"\n\$0", "\n\$0", "\n\$0", "\n\$0", "\n\$0", "\n\$0",
541+
"\n\$0", "\n\$0",
542+
),
543+
$text );
544+
return strip_tags( $text );
545+
}
546+
512547
/* function save and update for post type */
513548

514549
/**
@@ -545,7 +580,7 @@ public function update_post_type($data){
545580

546581
// escape all the strings
547582
array_walk_recursive($data, array($this, 'escape_data'));
548-
583+
549584
$sql = $wpdb->prepare(
550585
"Update " . MF_TABLE_POSTTYPES .
551586
" SET type = %s, name = %s, description = %s, arguments = %s " .
@@ -567,10 +602,10 @@ public function update_post_type($data){
567602
*/
568603
public function new_custom_group($data){
569604
global $wpdb;
570-
605+
571606
// escape all the strings
572607
array_walk_recursive($data, array($this, 'escape_data'));
573-
608+
574609
$sql = $wpdb->prepare(
575610
"INSERT INTO ". MF_TABLE_CUSTOM_GROUPS .
576611
" (name, label, post_type, duplicated, expanded) ".
@@ -582,7 +617,7 @@ public function new_custom_group($data){
582617
1
583618
);
584619
$wpdb->query($sql);
585-
620+
586621
$postTypeId = $wpdb->insert_id;
587622
return $postTypeId;
588623
}
@@ -596,7 +631,7 @@ public function update_custom_group($data){
596631
//ToDo: falta sanitizar variables
597632
// podriamos crear un mettodo para hacerlo
598633
// la funcion podria pasarle como primer parametro los datos y como segundo un array con los campos que se va a sanitizar o si se quiere remplazar espacios por _ o quitar caracteres extraños
599-
634+
600635
// escape all the strings
601636
array_walk_recursive($data, array($this, 'escape_data'));
602637

@@ -610,7 +645,7 @@ public function update_custom_group($data){
610645
1,
611646
$data['core']['id']
612647
);
613-
648+
614649
$wpdb->query($sql);
615650
}
616651

@@ -619,7 +654,7 @@ public function new_custom_field($data){
619654
global $wpdb;
620655

621656
if( !isset($data['option']) ) $data['option'] = array();
622-
657+
623658
// escape all the strings
624659
array_walk_recursive($data, array($this, 'escape_data'));
625660

@@ -632,7 +667,7 @@ public function new_custom_field($data){
632667
$data['core']['name'] = str_replace(" ","_",$data['core']['name']);
633668

634669
$sql = $wpdb->prepare(
635-
"INSERT INTO ". MF_TABLE_CUSTOM_FIELDS .
670+
"INSERT INTO ". MF_TABLE_CUSTOM_FIELDS .
636671
" (name, label, description, post_type, custom_group_id, type, required_field, duplicated, options) ".
637672
" VALUES (%s, %s, %s, %s, %d, %s, %d, %d, %s)",
638673
$data['core']['name'],
@@ -656,7 +691,7 @@ public function update_custom_field($data){
656691
global $wpdb;
657692

658693
if( !isset($data['option']) ) $data['option'] = array();
659-
694+
660695
// escape all the strings
661696
array_walk_recursive($data, array($this, 'escape_data'));
662697

@@ -669,7 +704,7 @@ public function update_custom_field($data){
669704
$data['core']['name'] = str_replace(" ","_",$data['core']['name']);
670705

671706
$sql = $wpdb->prepare(
672-
"UPDATE ". MF_TABLE_CUSTOM_FIELDS .
707+
"UPDATE ". MF_TABLE_CUSTOM_FIELDS .
673708
" SET name = %s, label = %s, description = %s, type = %s, required_field = %d, ".
674709
" duplicated = %d, options = %s ".
675710
" WHERE id = %d",
@@ -686,13 +721,13 @@ public function update_custom_field($data){
686721
}
687722

688723
/* function for save and update custom taxonomies */
689-
724+
690725
/**
691726
* Save a new custom taxonomy
692727
*/
693728
public function new_custom_taxonomy($data){
694729
global $wpdb;
695-
730+
696731
// escape all the strings
697732
array_walk_recursive($data, array($this, 'escape_data'));
698733

@@ -708,7 +743,7 @@ public function new_custom_taxonomy($data){
708743
1
709744
);
710745

711-
$wpdb->query($sql);
746+
$wpdb->query($sql);
712747
$custom_taxonomy_id = $wpdb->insert_id;
713748
return $custom_taxonomy_id;
714749
}
@@ -718,7 +753,7 @@ public function new_custom_taxonomy($data){
718753
*/
719754
public function update_custom_taxonomy($data){
720755
global $wpdb;
721-
756+
722757
// escape all the strings
723758
array_walk_recursive($data, array($this, 'escape_data'));
724759

@@ -737,7 +772,7 @@ public function update_custom_taxonomy($data){
737772
}
738773

739774
public static function mf_unregister_post_type( $post_type ) {
740-
/* Ideally we should just unset the post type from the array
775+
/* Ideally we should just unset the post type from the array
741776
but wordpress 3.2.1 this doesn't work */
742777

743778
//global $wp_post_types;
@@ -746,8 +781,8 @@ public static function mf_unregister_post_type( $post_type ) {
746781
// return true;
747782
//}
748783

749-
/* So, we are only remove the item from the menu (this is not a
750-
real unregister post_type but for at least we not will see
784+
/* So, we are only remove the item from the menu (this is not a
785+
real unregister post_type but for at least we not will see
751786
the post or page menu)
752787
*/
753788
if( $post_type == "post" ) {

‎admin/mf_custom_fields.php‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ public function get_properties() {
3939
public function get_options($options = NULL,$name){
4040
global $mf_domain;
4141

42-
print '<div class="desc_field">';
42+
print '<div class="desc_field">';
4343
printf('<p>%s</p>',$this->description);
4444
printf('<p>%s:</p>',__('Preview',$mf_domain));
4545
printf('<p><img src="%sfield_types/%s/preview.jpg" /></p>',MF_URL,$name);
@@ -53,7 +53,7 @@ public function get_options($options = NULL,$name){
5353
@$this->options['option'][$k]['value'] = $v;
5454
}
5555
}
56-
$this->form_options();
56+
$this->form_options();
5757
}
5858

5959

@@ -94,11 +94,11 @@ function fields_list() {
9494
print '<h2>';
9595
print $post_type->label;
9696
print ' ';
97-
97+
9898
print '<span style="font-size:small">';
9999
printf('<a href="admin.php?page=mf_dispatcher&noheader=true&mf_section=mf_posttype&mf_action=export_post_type&post_type=%s ">%s</a>',$post_type->name,__('Export',$mf_domain) );
100100
print '</span>';
101-
101+
102102
if(in_array($post_type->name,$mf_pt_register)):
103103
print '<span style="font-size:small">';
104104
print ' | ';
@@ -142,7 +142,7 @@ function fields_list() {
142142
$name = $group['label'];
143143
if($name != 'Magic Fields'){
144144
$name = sprintf('<a class="edit-group-h2" href="admin.php?page=mf_dispatcher&mf_section=mf_custom_group&mf_action=edit_group&custom_group_id=%s">%s</a>',$group['id'],$name);
145-
145+
146146
$add = sprintf('admin.php?page=mf_dispatcher&mf_section=mf_custom_fields&mf_action=add_field&post_type=%s&custom_group_id=%s',$post_type->name,$group['id']);
147147

148148
$name .= sprintf(' <span class="mf_add_group_field">(<a href="%s">create field</a>)</span>',$add);
@@ -154,7 +154,7 @@ function fields_list() {
154154
$name .= sprintf( ' <span class="mf_delete_group_field mf-delete">(<a alt="%s" class="mf_confirm" href="%s">delete group</a>)</span>', $delete_msg, $delete_link );
155155
}
156156
else {
157-
$name .= sprintf( ' <span class="mf_add_group_field">(<a href="admin.php?page=mf_dispatcher&mf_section=mf_custom_fields&mf_action=add_field&post_type=%s">create field</a>)</span>',$post_type->name );
157+
$name .= sprintf( ' <span class="mf_add_group_field">(<a href="admin.php?page=mf_dispatcher&mf_section=mf_custom_fields&mf_action=add_field&post_type=%s">create field</a>)</span>',$post_type->name );
158158
}
159159
//return all fields for group
160160
$fields = $this->get_custom_fields_by_group($group['id']);
@@ -231,8 +231,6 @@ function add_field() {
231231

232232
$data = $this->fields_form();
233233
$this->form_custom_field($data);
234-
?>
235-
<?php
236234
}
237235

238236
/**
@@ -242,8 +240,6 @@ function edit_field() {
242240
global $mf_domain;
243241

244242
//check param custom_field_id
245-
246-
247243
$data = $this->fields_form();
248244
$field = $this->get_custom_field($_GET['custom_field_id']);
249245

@@ -265,9 +261,16 @@ function edit_field() {
265261
}
266262

267263
function save_custom_field(){
264+
check_admin_referer('save_custom_field');
268265

269266
//save custom field
270267
$mf = $_POST['mf_field'];
268+
// array_walk_recursive($mf, function (&$value) {
269+
// $value = strip_tags($value);
270+
// });
271+
272+
array_walk_recursive($data, array($this, 'escape_data'));
273+
271274
if($mf['core']['id']){
272275
//update
273276
$this->update_name_field($mf);
@@ -426,7 +429,7 @@ public function fields_form() {
426429

427430
function form_custom_field( $data ) {
428431
global $mf_domain;
429-
432+
430433
$name_group = '';
431434
if($data['core']['custom_group_id']['value']){
432435
$group = $this->get_group( $data['core']['custom_group_id']['value'] );
@@ -438,14 +441,18 @@ function form_custom_field( $data ) {
438441
<div id="message_mf_error" class="error below-h2" style="display:none;"><p></p></div>
439442
<div id="icon-edit-pages" class="icon32 icon32-posts-page"><br></div>
440443
<?php if( !$data['core']['id']['value'] ): ?>
441-
<h2><?php _e('Create Custom Field', $mf_domain);?></h2>
442-
<?php else: ?>
443-
<h2><?php _e('Edit Custom Field', $mf_domain); echo ' - '.$data['core']['label']['value'];?></h2>
444+
<h2><?php _e('Create Custom Field', $mf_domain);?></h2>
445+
<?php else: ?>
446+
<h2><?php _e('Edit Custom Field', $mf_domain); echo ' - '.$data['core']['label']['value'];?></h2>
444447
<?php endif; ?>
445448

446-
<form id="addCustomField" method="post" action="admin.php?page=mf_dispatcher&init=true&mf_section=mf_custom_fields&mf_action=save_custom_field" class="validate mf_form_admin">
449+
<form id="addCustomField" method="post" action="admin.php?page=mf_dispatcher&init=true&mf_section=mf_custom_fields&mf_action=save_custom_field" class="validate mf_form_admin">
450+
451+
<?php wp_nonce_field('save_custom_field'); ?>
452+
447453
<div class="alignleft fixed" style="width: 40%;" id="mf_add_custom_field">
448-
<?php foreach( $data['core'] as $core ):?>
454+
<?php foreach( $data['core'] as $core ): ?>
455+
<?php $core['value'] = htmlentities($core['value']); ?>
449456
<?php if( $core['type'] == 'hidden' ): ?>
450457
<?php mf_form_hidden($core); ?>
451458
<?php elseif( $core['type'] == 'text' ):?>
@@ -643,7 +650,7 @@ public function display_field( $field, $group_index = 1, $field_index = 1 ) {
643650
public function upload($custom_field_id, $type = 'image',$callback = 'mf_callback_upload'){
644651
$iframe_src = sprintf('%sadmin/mf_upload.php?input_name=%s&callback=%s&type=%s',MF_BASENAME,$custom_field_id,$callback,$type);
645652
$out = sprintf('<iframe id="iframe_upload_%s" src="%s" height="45" scrolling="no" ></iframe>',$custom_field_id,$iframe_src);
646-
653+
647654
return $out;
648655
}
649656
}

0 commit comments

Comments
 (0)