Skip to content

Commit

Permalink
Security: Harden URL escaping. Version bump.
Browse files Browse the repository at this point in the history
  • Loading branch information
@dennisnissle
dennisnissle committed May 31, 2022
1 parent 3e40b10 commit 7dbc2b9
Show file tree
Hide file tree
Showing 5 changed files with 14 additions and 14 deletions.
6 changes: 3 additions & 3 deletions includes/class-vd-admin-license-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -88,13 +88,13 @@ public function column_product_expires( $item ) {
if ( $item->get_expiration_date() ) {

if ( $item->has_expired() && $item->supports_renewals() ) {
$return = '<a href="' . $item->get_renewal_url() . '" class="button button-primary wc-gzd-button" target="_blank">' . __( 'renew now', 'vendidero-helper' ) . '</a>';
$return = '<a href="' . esc_url( $item->get_renewal_url() ) . '" class="button button-primary wc-gzd-button" target="_blank">' . __( 'renew now', 'vendidero-helper' ) . '</a>';
} else {
$return = $item->get_expiration_date();
}

if ( $item->supports_renewals() ) {
$return .= '<a class="refresh-expiration" href="' . wp_nonce_url( admin_url( 'admin-post.php?action=vd_refresh_license_status&product_id=' . esc_attr( $item->id ) ), 'vd-refresh-license-status' ) . '">' . __( 'Refresh', 'vendidero-helper' ) . '</a>';
$return .= '<a class="refresh-expiration" href="' . esc_url( wp_nonce_url( admin_url( 'admin-post.php?action=vd_refresh_license_status&product_id=' . esc_attr( $item->id ) ), 'vd-refresh-license-status' ) ) . '">' . __( 'Refresh', 'vendidero-helper' ) . '</a>';
}

return $return;
Expand All @@ -121,7 +121,7 @@ public function column_product_version( $item ) {
$new_version = __( 'Newest version:', 'vendidero-helper' ) . ' <span class="version version-latest">' . $latest->version . '</span>';

if ( ! $item->has_expired() ) {
$new_version .= '<br/>' . '<a class="button button-secondary" href="' . $update_url . '">' . __( 'Check for updates', 'vendidero-helper' ) . '</a>';
$new_version .= '<br/>' . '<a class="button button-secondary" href="' . esc_url( $update_url ) . '">' . __( 'Check for updates', 'vendidero-helper' ) . '</a>';
}
}
}
Expand Down
10 changes: 5 additions & 5 deletions includes/class-vd-admin.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ public function refresh_license_status() {
$product->refresh_expiration_date( true );
}

wp_safe_redirect( VD()->get_helper_url() );
wp_safe_redirect( esc_url_raw( VD()->get_helper_url() ) );
exit();
}
}
Expand Down Expand Up @@ -96,7 +96,7 @@ public function set_upgrade_notice() {
$product->refresh_expiration_date();

if ( $product->has_expired() && $product->supports_renewals() ) {
echo '<div class="vd-upgrade-notice" data-for="' . md5( $product->Name ) .'" style="display: none"><span class="vd-inline-upgrade-expire-notice">' . sprintf( __( 'Seems like your update- and support flat has expired. Please %s your license before updating.', 'vendidero-helper' ), '<a href="' . VD()->get_helper_url() . '">' . __( 'check', 'vendidero-helper' ) . '</a>' ) . '</span></div>';
echo '<div class="vd-upgrade-notice" data-for="' . md5( $product->Name ) .'" style="display: none"><span class="vd-inline-upgrade-expire-notice">' . sprintf( __( 'Seems like your update- and support flat has expired. Please %s your license before updating.', 'vendidero-helper' ), '<a href="' . esc_url( VD()->get_helper_url() ) . '">' . __( 'check', 'vendidero-helper' ) . '</a>' ) . '</span></div>';
}
}
}
Expand All @@ -110,7 +110,7 @@ public function set_upgrade_notice() {
$product->refresh_expiration_date();

if ( $product->has_expired() && $product->supports_renewals() ) {
echo '<div class="vd-upgrade-notice" data-for="' . md5( $product->Name ) .'" style="display: none"><span class="vd-inline-upgrade-expire-notice">' . sprintf( __( 'Seems like your update- and support flat has expired. Please %s your license before updating.', 'vendidero-helper' ), '<a href="' . VD()->get_helper_url() . '">' . __( 'check', 'vendidero-helper' ) . '</a>' ) . '</span></div>';
echo '<div class="vd-upgrade-notice" data-for="' . md5( $product->Name ) .'" style="display: none"><span class="vd-inline-upgrade-expire-notice">' . sprintf( __( 'Seems like your update- and support flat has expired. Please %s your license before updating.', 'vendidero-helper' ), '<a href="' . esc_url( VD()->get_helper_url() ) . '">' . __( 'check', 'vendidero-helper' ) . '</a>' ) . '</span></div>';
}
}
}
Expand Down Expand Up @@ -252,7 +252,7 @@ public function process_register() {

VD()->api->flush_cache();

wp_safe_redirect( VD()->get_helper_url() );
wp_safe_redirect( esc_url_raw( VD()->get_helper_url() ) );
exit();
}

Expand All @@ -273,7 +273,7 @@ public function process_unregister() {

VD()->api->flush_cache();

wp_safe_redirect( VD()->get_helper_url() );
wp_safe_redirect( esc_url_raw( VD()->get_helper_url() ) );
exit();
}

Expand Down
4 changes: 2 additions & 2 deletions includes/class-vd-request.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,15 +49,15 @@ public function do_request() {
if ( 'GET' === $this->args['method'] ) {
$url = add_query_arg( $this->args, $this->get_endpoint() );

$this->raw = wp_remote_get( $url, array(
$this->raw = wp_remote_get( esc_url_raw( $url ), array(
'redirection' => 5,
'blocking' => true,
'headers' => array( 'user-agent' => 'Vendidero/' . VD()->version ),
'cookies' => array(),
'sslverify' => false
) );
} else {
$this->raw = wp_remote_post( $this->get_endpoint(), array(
$this->raw = wp_remote_post( esc_url_raw( $this->get_endpoint() ), array(
'method' => 'POST',
'redirection' => 5,
'blocking' => true,
Expand Down
4 changes: 2 additions & 2 deletions screens/screen-notice-expire.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,14 +36,14 @@
<p><?php printf( __( '%1$s expires on %2$s', 'vendidero-helper' ), '<strong>' . esc_attr( $product->Name ) . '</strong>', $product->get_expiration_date( get_option( 'date_format' ) ) ); ?></p>
<?php endif; ?>

<a class="button button-primary wc-gzd-button" href="<?php echo $product->get_renewal_url();?>" target="_blank"><?php _e( 'renew now', 'vendidero-helper' );?></a>
<a class="button button-primary wc-gzd-button" href="<?php echo esc_url( $product->get_renewal_url() ); ?>" target="_blank"><?php _e( 'renew now', 'vendidero-helper' );?></a>
<?php endforeach; ?>

<p class="alignleft wc-gzd-button-wrapper"></p>

<p class="alignright">
<a class="" href="https://vendidero.de/vendidero-service" target="_blank"><?php _e( 'Learn more', 'vendidero-helper' );?></a> |
<a class="" href="<?php echo VD()->get_helper_url(); ?>"><?php _e( 'See license details', 'vendidero-helper' );?></a> |
<a class="" href="<?php echo esc_url( VD()->get_helper_url() ); ?>"><?php _e( 'See license details', 'vendidero-helper' );?></a> |
<a href="<?php echo esc_url( $dismiss_url );?>" class="vendidero-helper-dismiss"><?php _e( 'Hide this notice', 'vendidero-helper' ); ?></a>
</p>
<div class="clear"></div>
Expand Down
4 changes: 2 additions & 2 deletions vendidero-helper.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
* Plugin Name: Vendidero Helper
* Plugin URI: http://vendidero.de
* Description: Will help vendidero users to manage their licenses and receive automatic updates
* Version: 2.1.4
* Version: 2.1.5
* Author: Vendidero
* Author URI: http://vendidero.de
* License: GPL version 2 or later - http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
Expand All @@ -25,7 +25,7 @@ final class Vendidero_Helper {
*/
protected static $_instance = null;

public $version = '2.1.4';
public $version = '2.1.5';

/**
* @var VD_API $api
Expand Down

0 comments on commit 7dbc2b9

Please sign in to comment.