Changeset 3708608

Timestamp:

09/23/2026 06:21:21 AM (4 weeks ago)

Author:

metaphorcreations

Message:

security fix

Location:

ditty-news-ticker

Files:

• tags/3.1.71 (copied) (copied from ditty-news-ticker/trunk )
• tags/3.1.71/ditty-news-ticker.php (modified) (2 diffs)
• tags/3.1.71/includes/class-ditty-singles.php (modified) (2 diffs)
• tags/3.1.71/includes/helpers.php (modified) (1 diff)
• tags/3.1.71/readme.txt (modified) (2 diffs)
• trunk/ditty-news-ticker.php (modified) (2 diffs)
• trunk/includes/class-ditty-singles.php (modified) (2 diffs)
• trunk/includes/helpers.php (modified) (1 diff)
• trunk/readme.txt (modified) (2 diffs)

ditty-news-ticker/tags/3.1.71/ditty-news-ticker.php

@@ -5 +5 @@
  * Plugin URI:        https://www.metaphorcreations.com/ditty
  * Description:       Ditty offers a range of content display options, including its signature news ticker and customizable layouts.
- * Version:           3.1.70
+ * Version:           3.1.71
  * Author:            Metaphor Creations
  * Author URI:        https://www.metaphorcreations.com
@@ -24 +24 @@
 // Plugin version.
 if ( ! defined( 'DITTY_VERSION' ) ) {
-        define( 'DITTY_VERSION', '3.1.70' );
+        define( 'DITTY_VERSION', '3.1.71' );
 }
 

ditty-news-ticker/tags/3.1.71/includes/class-ditty-singles.php

@@ -188 +188 @@
                 if ( '' != $display_settings && 'false' != $display_settings ) {
                         parse_str( html_entity_decode( $display_settings ), $custom_display_settings );
+                        $custom_display_settings = ditty_sanitize_custom_display_settings( $custom_display_settings );
                         if ( is_array( $custom_display_settings ) && count( $custom_display_settings ) > 0 ) {
                                 foreach ( $custom_display_settings as $key => $value ) {
+                                        if ( is_array( $value ) ) {
+                                                continue;
+                                        }
                                         $parts = explode( '|', $value );
                                         if ( is_array( $parts ) && count( $parts ) > 0 ) {
@@ -368 +372 @@
           $display_type = $custom_display_array['type'];
         }
-        if ( isset( $custom_display_array['settings'] ) ) {
-          $args = wp_parse_args( $custom_display_array['settings'], $args );
+        if ( isset( $custom_display_array['settings'] ) && is_array( $custom_display_array['settings'] ) ) {
+          $custom_display_settings_array = ditty_sanitize_custom_display_settings( $custom_display_array['settings'] );
+          $args = wp_parse_args( $custom_display_settings_array, $args );
         }
       } else {

ditty-news-ticker/tags/3.1.71/includes/helpers.php

@@ -1588 +1588 @@
 
 /**
+ * Return setting keys that can't be set through custom display settings
+ *
+ * These values are always generated by Ditty. The display scripts render some
+ * of them as HTML, so they can't be overwritten from a shortcode, block or
+ * ajax request.
+ * *
+ * @since   3.1.70
+ */
+function ditty_protected_display_setting_keys() {
+        return apply_filters( 'ditty_protected_display_setting_keys', array(
+                'id',
+                'uniqid',
+                'title',
+                'status',
+                'display',
+                'items',
+                'showEditor',
+        ) );
+}
+
+/**
+ * Sanitize custom display settings from a shortcode, block or ajax request
+ * *
+ * @since   3.1.70
+ */
+function ditty_sanitize_custom_display_settings( $settings, $depth = 0 ) {
+        if ( ! is_array( $settings ) || $depth > 5 ) {
+                return array();
+        }
+
+        $protected_keys = array_map( 'strtolower', ditty_protected_display_setting_keys() );
+        $sanitized_settings = array();
+        foreach ( $settings as $key => $value ) {
+                if ( is_string( $key ) ) {
+                        $key = preg_replace( '/[^a-zA-Z0-9_\-]/', '', $key );
+                        if ( '' === $key ) {
+                                continue;
+                        }
+                        if ( 0 === $depth && in_array( strtolower( $key ), $protected_keys, true ) ) {
+                                continue;
+                        }
+                } elseif ( ! is_int( $key ) ) {
+                        continue;
+                }
+
+                if ( is_array( $value ) ) {
+                        $sanitized_settings[$key] = ditty_sanitize_custom_display_settings( $value, $depth + 1 );
+                } elseif ( is_bool( $value ) || is_int( $value ) || is_float( $value ) || is_null( $value ) ) {
+                        $sanitized_settings[$key] = $value;
+                } else {
+                        $sanitized_settings[$key] = sanitize_text_field( $value );
+                }
+        }
+        return $sanitized_settings;
+}
+
+/**
  * Make sure an image url is safe
  */

ditty-news-ticker/tags/3.1.71/readme.txt

@@ -6 +6 @@
 Requires PHP: 7.4
 Tested up to: 7.1.1
-Stable tag: 3.1.70
+Stable tag: 3.1.71
 License: GPL2
 
@@ -135 +135 @@
 
 == Changelog ==
+
+= 3.1.71 [2026-09-23] =
+* Security fix: sanitize custom display settings and block protected keys passed via shortcodes, blocks and AJAX
 
 = 3.1.70 [2026-09-21] =

ditty-news-ticker/trunk/ditty-news-ticker.php

@@ -5 +5 @@
  * Plugin URI:        https://www.metaphorcreations.com/ditty
  * Description:       Ditty offers a range of content display options, including its signature news ticker and customizable layouts.
- * Version:           3.1.70
+ * Version:           3.1.71
  * Author:            Metaphor Creations
  * Author URI:        https://www.metaphorcreations.com
@@ -24 +24 @@
 // Plugin version.
 if ( ! defined( 'DITTY_VERSION' ) ) {
-        define( 'DITTY_VERSION', '3.1.70' );
+        define( 'DITTY_VERSION', '3.1.71' );
 }
 

ditty-news-ticker/trunk/includes/class-ditty-singles.php

@@ -188 +188 @@
                 if ( '' != $display_settings && 'false' != $display_settings ) {
                         parse_str( html_entity_decode( $display_settings ), $custom_display_settings );
+                        $custom_display_settings = ditty_sanitize_custom_display_settings( $custom_display_settings );
                         if ( is_array( $custom_display_settings ) && count( $custom_display_settings ) > 0 ) {
                                 foreach ( $custom_display_settings as $key => $value ) {
+                                        if ( is_array( $value ) ) {
+                                                continue;
+                                        }
                                         $parts = explode( '|', $value );
                                         if ( is_array( $parts ) && count( $parts ) > 0 ) {
@@ -368 +372 @@
           $display_type = $custom_display_array['type'];
         }
-        if ( isset( $custom_display_array['settings'] ) ) {
-          $args = wp_parse_args( $custom_display_array['settings'], $args );
+        if ( isset( $custom_display_array['settings'] ) && is_array( $custom_display_array['settings'] ) ) {
+          $custom_display_settings_array = ditty_sanitize_custom_display_settings( $custom_display_array['settings'] );
+          $args = wp_parse_args( $custom_display_settings_array, $args );
         }
       } else {

ditty-news-ticker/trunk/includes/helpers.php

@@ -1588 +1588 @@
 
 /**
+ * Return setting keys that can't be set through custom display settings
+ *
+ * These values are always generated by Ditty. The display scripts render some
+ * of them as HTML, so they can't be overwritten from a shortcode, block or
+ * ajax request.
+ * *
+ * @since   3.1.70
+ */
+function ditty_protected_display_setting_keys() {
+        return apply_filters( 'ditty_protected_display_setting_keys', array(
+                'id',
+                'uniqid',
+                'title',
+                'status',
+                'display',
+                'items',
+                'showEditor',
+        ) );
+}
+
+/**
+ * Sanitize custom display settings from a shortcode, block or ajax request
+ * *
+ * @since   3.1.70
+ */
+function ditty_sanitize_custom_display_settings( $settings, $depth = 0 ) {
+        if ( ! is_array( $settings ) || $depth > 5 ) {
+                return array();
+        }
+
+        $protected_keys = array_map( 'strtolower', ditty_protected_display_setting_keys() );
+        $sanitized_settings = array();
+        foreach ( $settings as $key => $value ) {
+                if ( is_string( $key ) ) {
+                        $key = preg_replace( '/[^a-zA-Z0-9_\-]/', '', $key );
+                        if ( '' === $key ) {
+                                continue;
+                        }
+                        if ( 0 === $depth && in_array( strtolower( $key ), $protected_keys, true ) ) {
+                                continue;
+                        }
+                } elseif ( ! is_int( $key ) ) {
+                        continue;
+                }
+
+                if ( is_array( $value ) ) {
+                        $sanitized_settings[$key] = ditty_sanitize_custom_display_settings( $value, $depth + 1 );
+                } elseif ( is_bool( $value ) || is_int( $value ) || is_float( $value ) || is_null( $value ) ) {
+                        $sanitized_settings[$key] = $value;
+                } else {
+                        $sanitized_settings[$key] = sanitize_text_field( $value );
+                }
+        }
+        return $sanitized_settings;
+}
+
+/**
  * Make sure an image url is safe
  */

ditty-news-ticker/trunk/readme.txt

@@ -6 +6 @@
 Requires PHP: 7.4
 Tested up to: 7.1.1
-Stable tag: 3.1.70
+Stable tag: 3.1.71
 License: GPL2
 
@@ -135 +135 @@
 
 == Changelog ==
+
+= 3.1.71 [2026-09-23] =
+* Security fix: sanitize custom display settings and block protected keys passed via shortcodes, blocks and AJAX
 
 = 3.1.70 [2026-09-21] =