Changeset 1175403

Timestamp:

06/05/2015 03:40:09 PM (10 years ago)

Author:

lisa_westlund

Message:

Version 1.05 carries out a security bug-fix.

Location:

portfolio-by-lisa-westlund/trunk

Files:

• inc/options-page-wrapper.php (modified) (1 diff)
• lisawestlund-instagram-portfolio.php (modified) (3 diffs)
• readme.txt (modified) (2 diffs)

portfolio-by-lisa-westlund/trunk/inc/options-page-wrapper.php

@@ -54 +54 @@
                                 </fieldset>
                                 <br>
+                                <?php wp_nonce_field( 'my_wplw_update_check', 'wplw-update-check' ); ?>
                                 <input class="button-primary" type="submit" name="wplw_settings_submit" value="Save" />
                             </form>

portfolio-by-lisa-westlund/trunk/lisawestlund-instagram-portfolio.php

@@ -51 +51 @@
         
         /* Save form input data to $options array */    
+                
         if( isset( $_POST['wplw_form_submitted'] ) ){
-            $hidden_field = esc_html($_POST['wplw_form_submitted']);
-            
-            if( $hidden_field == 'Y' ){
-                $wplw_instagram_access_token = esc_html($_POST['wplw_instagram_access_token']);
-                $wplw_instagram_userID = esc_html($_POST['wplw_instagram_userID']);
-                $wplw_hashtag = esc_html($_POST['wplw_hashtag']);
-                                
-                if( isset($_POST['wplw_portfolio_date']) ){
-                    $wplw_portfolio_date = 'checked';   
-                }
-                
-                if( isset($_POST['wplw_portfolio_description']) ){
-                    $wplw_portfolio_description = 'checked';    
-                }
-                                
-                $options = array(
-                    'wplw_instagram_access_token' => $wplw_instagram_access_token,
-                    'wplw_instagram_userID' => $wplw_instagram_userID,
-                    'wplw_hashtag' => $wplw_hashtag,
-                    'wplw_portfolio_date' => $wplw_portfolio_date,
-                    'wplw_portfolio_description' => $wplw_portfolio_description
-                );
-                
-                update_option( 'wplw_instagram_portfolio', $options );
-            }
-        }
-        
+            
+            if ( ! isset( $_POST['wplw-update-check'] ) || ! wp_verify_nonce( $_POST['wplw-update-check'], 'my_wplw_update_check' ) ) {
+
+                print 'Sorry, your nonce did not verify.';
+                exit;
+
+            } 
+    
+            else {
+        
+                $hidden_field = esc_html($_POST['wplw_form_submitted']);
+                
+                if( $hidden_field == 'Y' ){
+                    $wplw_instagram_access_token = esc_html($_POST['wplw_instagram_access_token']);
+                    $wplw_instagram_userID = esc_html($_POST['wplw_instagram_userID']);
+                    $wplw_hashtag = esc_html($_POST['wplw_hashtag']);
+                                    
+                    if( isset($_POST['wplw_portfolio_date']) ){
+                        $wplw_portfolio_date = 'checked';   
+                    }
+                    
+                    if( isset($_POST['wplw_portfolio_description']) ){
+                        $wplw_portfolio_description = 'checked';    
+                    }
+                                    
+                    $options = array(
+                        'wplw_instagram_access_token' => $wplw_instagram_access_token,
+                        'wplw_instagram_userID' => $wplw_instagram_userID,
+                        'wplw_hashtag' => $wplw_hashtag,
+                        'wplw_portfolio_date' => $wplw_portfolio_date,
+                        'wplw_portfolio_description' => $wplw_portfolio_description
+                    );
+                    
+                    update_option( 'wplw_instagram_portfolio', $options );
+                }
+            }
+        }
+            
         $options = get_option( 'wplw_instagram_portfolio' );
         if( $options != '' ){
+    
             $wplw_instagram_access_token = $options['wplw_instagram_access_token'];
             $wplw_instagram_userID = $options['wplw_instagram_userID'];
@@ -87 +100 @@
             $wplw_portfolio_description = $options['wplw_portfolio_description'];
         }
+        
         require( 'inc/options-page-wrapper.php' ); 
     }
@@ -212 +226 @@
     }
          
- ?> 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
+ ?>

portfolio-by-lisa-westlund/trunk/readme.txt

@@ -5 +5 @@
 Requires at least:
 Tested up to: 4.2.2
+Stable tag: 1.05
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -44 +45 @@
 
 == Changelog ==
+= 1.05 =
+* This update carries a security bug-fix.
+
 = 1.0 =
 * This is the first version of the plugin.