WordPress.org
Get WordPress

Plugin Directory

Changeset 3732073


Ignore:
Timestamp:
10/07/2026 08:07:29 AM (2 weeks ago)
Author:
altesin
Message:

release 3.6.15

Location:
final-tiles-grid-gallery-lite
Files:
322 added
4 edited

Legend:

Unmodified
Added
Removed

  • final-tiles-grid-gallery-lite/trunk/FinalTilesGalleryLite.php

    r3722824 r3732073  
    44 * Plugin Name:              Final Tiles Grid Gallery - Image Gallery
    55 * Description:              WordPress Plugin for creating responsive image galleries.
    6  * Version:                  3.6.14
     6 * Version:                  3.6.15
    77 * Author:                   WPChill
    88 * Author URI:               https://wpchill.com
    … …  
    2626 *
    2727 */
    28 define( 'FTGVERSION', '3.6.14' );
     28define( 'FTGVERSION', '3.6.15' );
    2929// Create a helper function for easy SDK access.
    3030if ( !function_exists( 'ftg_fs' ) ) {
    … …  
    565565                    wp_die( 'Invalid JSON configuration data. Error: ' . json_last_error_msg() );
    566566                }
    567                 if ( is_object( $decoded ) && isset( $decoded->script ) && !current_user_can( 'unfiltered_html' ) ) {
    568                     $decoded->script = '';
     567                if ( is_object( $decoded ) && !current_user_can( 'unfiltered_html' ) ) {
     568                    // Fields rendered as raw JavaScript: cannot be escaped, only gated by capability.
     569                    foreach ( array('script', 'lightboxOptions', 'lightboxOptionsMobile') as $raw_js_field ) {
     570                        if ( isset( $decoded->{$raw_js_field} ) ) {
     571                            $decoded->{$raw_js_field} = '';
     572                        }
     573                    }
     574                    // Fields rendered as raw HTML: match save_gallery sanitization.
     575                    foreach ( array('beforeGalleryText', 'afterGalleryText', 'captionCustomFields') as $html_field ) {
     576                        if ( isset( $decoded->{$html_field} ) ) {
     577                            $decoded->{$html_field} = ( is_string( $decoded->{$html_field} ) ? wp_kses_post( $decoded->{$html_field} ) : '' );
     578                        }
     579                    }
     580                    if ( isset( $decoded->style ) ) {
     581                        $decoded->style = ( is_string( $decoded->style ) ? sanitize_textarea_field( $decoded->style ) : '' );
     582                    }
    569583                    $config = wp_json_encode( $decoded );
    570584                }
    … …  
    969983            foreach ( explode( ',', $ids ) as $sid ) {
    970984                $image = $this->FinalTilesdb->getImage( absint( $sid ) );
    971                 if ( !$image || !$this->FinalTilesdb->canUserEdit( $image->gid ) ) {
     985                if ( $image && !$this->FinalTilesdb->canUserEdit( $image->gid ) ) {
    972986                    wp_die( 'Forbidden', 403 );
    973987                }

  • final-tiles-grid-gallery-lite/trunk/changelog.txt

    r3722824 r3732073  
     1= 3.6.15 - 07.10.2026 =
     2- Fixed: Security update (thanks to Ala Bouali)
     3
    14= 3.6.14 - 01.10.2026 =
    25- Fixed: Security update

  • final-tiles-grid-gallery-lite/trunk/lib/gallery-class.php

    r3722824 r3732073  
    128128            $rid = $this->id;
    129129            $gallery = $this->gallery;
     130            // Raw-JS fields (script, lightboxOptions) are emitted only when the gallery author may store unfiltered JS.
     131            $ftg_gallery_author = ( isset( $gallery->author_id ) ? absint( $gallery->author_id ) : 0 );
     132            $ftg_allow_raw_js = $ftg_gallery_author && user_can( $ftg_gallery_author, 'unfiltered_html' );
    130133            $lightbox = ( wp_is_mobile() ? ( $gallery->mobileLightbox == "desktop" ? $gallery->lightbox : $gallery->mobileLightbox ) : $gallery->lightbox );
    131134            $javascript = "<script type='text/javascript'>\n";
    … …  
    137140            $javascript .= "\tjQuery('#ftg-" . absint( $this->id . $rid ) . "').finalTilesGallery({\n";
    138141            $javascript .= "\t\tminTileWidth: " . absint( $gallery->minTileWidth ) . ",\n";
    139             if ( strlen( $gallery->script ) ) {
     142            if ( $ftg_allow_raw_js && strlen( $gallery->script ) ) {
    140143                $javascript .= "\t\tonComplete: function () { " . esc_js( $gallery->script ) . "},\n";
    141144            }
    … …  
    145148                $jsLoadMethod = 'lazy';
    146149            }
    147             $javascript .= "\t\tloadMethod: '" . esc_attr( $jsLoadMethod ) . "',\n";
     150            $javascript .= "\t\tloadMethod: '" . esc_js( $jsLoadMethod ) . "',\n";
    148151            if ( $gallery->ajaxLoading == 'T' ) {
    149152                $javascript .= "\t\tautoLoadURL: '" . admin_url( 'admin-ajax.php' ) . "',\n";
    … …  
    153156            $javascript .= "\t\tgalleryId: '" . absint( $this->id ) . "',\n";
    154157            $javascript .= "\t\tsetupFilters: " . (( $gallery->filterClick == 'F' ? "true" : "false" )) . ",\n";
    155             $javascript .= "\t\tlayout: '" . esc_attr( $gallery->layout ) . "',\n";
     158            $javascript .= "\t\tlayout: '" . esc_js( $gallery->layout ) . "',\n";
    156159            $javascript .= "\t\tdebug: " . (( empty( $_GET['debug'] ) ? "false" : "true" )) . ",\n";
    157160            $javascript .= "\t\tgridSize: " . absint( $gallery->gridCellSize ) . ",\n";
    … …  
    165168                    $_ = explode( ",", $isf );
    166169                    if ( !empty( $_[0] ) ) {
    167                         $javascript .= "\t\t\t,[" . esc_attr( $_[0] ) . ", " . absint( $_[1] ) / 100 . "]\n";
     170                        $javascript .= "\t\t\t,[" . absint( $_[0] ) . ", " . absint( $_[1] ) / 100 . "]\n";
    168171                    }
    169172                }
    … …  
    171174            }
    172175            if ( isset( $scrollEffect ) ) {
    173                 $javascript .= "\t\tscrollEffect: '" . esc_attr( $gallery->scrollEffect ) . "',\n";
     176                $javascript .= "\t\tscrollEffect: '" . esc_js( $gallery->scrollEffect ) . "',\n";
    174177            }
    175178            $javascript .= "\t\tselectedFilter: '" . $this->slugify( $gallery->defaultFilter ) . "'\n";
    … …  
    200203            $javascript .= "\t})();\n";
    201204            $lightbox_options = ( wp_is_mobile() ? $gallery->lightboxOptionsMobile : $gallery->lightboxOptions );
     205            if ( !$ftg_allow_raw_js ) {
     206                $lightbox_options = '';
     207            }
    202208            switch ( $lightbox ) {
    203209                case 'magnific':

  • final-tiles-grid-gallery-lite/trunk/readme.txt

    r3722824 r3732073  
    44Requires at least: 5.2
    55Tested up to: 7.1
    6 Stable tag: 3.6.14
     6Stable tag: 3.6.15
    77License: GPLv3 or later
    88License URI: http://www.gnu.org/licenses/gpl-3.0.html
    … …  
    129129
    130130== Changelog ==
     131= 3.6.15 - 07.10.2026 =
     132- Fixed: Security update (thanks to Ala Bouali)
     133
    131134= 3.6.14 - 01.10.2026 =
    132135- Fixed: Security update
Note: See TracChangeset for help on using the changeset viewer.