WordPress.org
Get WordPress

Plugin Directory

Changeset 3752945


Ignore:
Timestamp:
10/18/2026 11:33:21 AM (30 hours ago)
Author:
rosell.dk
Message:

0.25.16

Location:
webp-express
Files:
20 edited
1 copied

Legend:

Unmodified
Added
Removed

  • webp-express/tags/0.25.16/README.txt

    r3578701 r3752945  
    55Requires at least: 4.0
    66Tested up to: 6.9
    7 Stable tag: 0.25.15
     7Stable tag: 0.25.16
    88Requires PHP: 5.6
    99License: GPLv3
    … …  
    174174**Persons who recently contributed with [ko-fi](https://ko-fi.com/rosell) - Thanks!**
    175175
     176* 20 Sep: Greg
     177* 5 Aug: Abilio Varjao
     178* 23 Mar: hung minh dang
    176179* 5 Jan: Joel
    177 * 24 Dec: Patrick Müller
    178 * 16 Dec: Dragos
    179 * 9 Aug: Tanzi
    180 * 3 Jul: Jen
    181 * 26 Jun: Per
    182 * 16 May: Erick Danzer
    183 * 8 May: Mike
    184 * 31 May: parallactic
    185 * 14 May: Gitte Rebsdorf
    186 * 9 May: La Braud
     180* 24 Dec 2025: Patrick Müller
    187181
    188182**Persons who recently contributed on [github sponsors](https://github.com/sponsors/rosell-dk) - Thanks!**
    … …  
    832826== Changelog ==
    833827
     828= 0.25.16 =
     829(released 18 Oct 2026)
     830* Fixed vulnerability in dom parser library used for altering html. Credit goes to Jakub Herman for discovering the problem. Also fixed a loophole that made it possible to use the web service (if activated) with carefully crafted inputs, even without an api key. Thanks to the third party that found and reported this to the Wordpress security team - and thanks to the security team for bringing the issue to my attention
     831
    834832= 0.25.15 =
    835833(released 19 May 2026)
    … …  
    903901
    904902== Upgrade Notice ==
     903= 0.25.16 =
     904* Fixed vulnerability in dom parser library used for altering html. Credit goes to Jakub Herman for discovering the problem. Also fixed a loophole that made it possible to use the web service (if activated) with carefully crafted inputs, even without an api key. Thanks to the third party that found and reported this to the Wordpress security team - and thanks to the security team for bringing the issue to my attention
    905905
    906906= 0.25.15 =

  • webp-express/tags/0.25.16/docs/publishing.md

    r3578701 r3752945  
    9797   - https://lutzenmanagement.dk/wp-admin/plugin-install.php
    9898   - http://mystress.dk/wp-admin/plugin-install.php
     99   - fabeldyr.dk
    99100   ... etc
    100101
    … …  
    113114```
    114115cd svn
    115 svn cp trunk tags/0.25.14       (this will copy trunk into a new tag)
     116svn cp trunk tags/0.25.15       (this will copy trunk into a new tag)
    116117```
    117118
    118119And commit!
    119120```
    120 svn ci -m '0.25.14'
     121svn ci -m '0.25.15'
    121122```
    122123

  • webp-express/tags/0.25.16/lib/classes/ConvertHelperIndependent.php

    r3578701 r3752945  
    572572
    573573        // TODO: Put version number somewhere else. Ie \WebPExpress\VersionNumber::version
    574         $text = 'WebP Express 0.25.15. ' . $msgTop . ', ' . date("Y-m-d H:i:s") . "\n\r\n\r" . $text;
     574        $text = 'WebP Express 0.25.16. ' . $msgTop . ', ' . date("Y-m-d H:i:s") . "\n\r\n\r" . $text;
    575575
    576576        $logFile = self::getLogFilename($source, $logDir);

  • webp-express/tags/0.25.16/vendor/composer/installed.json

    r3578701 r3752945  
    210210        {
    211211            "name": "rosell-dk/dom-util-for-webp",
    212             "version": "0.7.1",
    213             "version_normalized": "0.7.1.0",
     212            "version": "0.7.2",
     213            "version_normalized": "0.7.2.0",
    214214            "source": {
    215215                "type": "git",
    216216                "url": "https://github.com/rosell-dk/dom-util-for-webp.git",
    217                 "reference": "4f9102e404ee137a781c8580b829a340c5a5d428"
    218             },
    219             "dist": {
    220                 "type": "zip",
    221                 "url": "https://api.github.com/repos/rosell-dk/dom-util-for-webp/zipball/4f9102e404ee137a781c8580b829a340c5a5d428",
    222                 "reference": "4f9102e404ee137a781c8580b829a340c5a5d428",
     217                "reference": "a69c667eb7a2449e402147586d3863d932f3f660"
     218            },
     219            "dist": {
     220                "type": "zip",
     221                "url": "https://api.github.com/repos/rosell-dk/dom-util-for-webp/zipball/a69c667eb7a2449e402147586d3863d932f3f660",
     222                "reference": "a69c667eb7a2449e402147586d3863d932f3f660",
    223223                "shasum": ""
    224224            },
    … …  
    232232                "squizlabs/php_codesniffer": "3.*"
    233233            },
    234             "time": "2023-10-20T12:10:28+00:00",
     234            "time": "2026-10-18T08:43:30+00:00",
    235235            "type": "library",
    236236            "extra": {
    237237                "scripts-descriptions": {
    238238                    "ci": "Run tests before CI",
     239                    "test": "Launches the preconfigured PHPUnit",
    239240                    "phpcs": "Checks coding styles (PSR2) of file/dir, which you must supply. To check all, supply 'src'",
     241                    "cs-fix": "Fix the coding style of a PHP file or directory, which you must specify.",
    240242                    "phpcbf": "Fix coding styles (PSR2) of file/dir, which you must supply. To fix all, supply 'src'",
    241                     "cs-fix-all": "Fix the coding style of all the source files, to comply with the PSR-2 coding standard",
    242                     "cs-fix": "Fix the coding style of a PHP file or directory, which you must specify.",
    243                     "test": "Launches the preconfigured PHPUnit"
     243                    "cs-fix-all": "Fix the coding style of all the source files, to comply with the PSR-2 coding standard"
    244244                }
    245245            },
    … …  
    270270            "support": {
    271271                "issues": "https://github.com/rosell-dk/dom-util-for-webp/issues",
    272                 "source": "https://github.com/rosell-dk/dom-util-for-webp/tree/0.7.1"
     272                "source": "https://github.com/rosell-dk/dom-util-for-webp/tree/0.7.2"
    273273            },
    274274            "funding": [

  • webp-express/tags/0.25.16/vendor/composer/installed.php

    r3578701 r3752945  
    44        'pretty_version' => 'dev-master',
    55        'version' => 'dev-master',
    6         'reference' => '9637ca4242e885f3d44b1382db5409fec8d5919d',
     6        'reference' => 'b5aba85e45f5c3a40987de3c96f1cbe43f8e99d5',
    77        'type' => 'wordpress-plugin',
    88        'install_path' => __DIR__ . '/../../',
    … …  
    3030        ),
    3131        'rosell-dk/dom-util-for-webp' => array(
    32             'pretty_version' => '0.7.1',
    33             'version' => '0.7.1.0',
    34             'reference' => '4f9102e404ee137a781c8580b829a340c5a5d428',
     32            'pretty_version' => '0.7.2',
     33            'version' => '0.7.2.0',
     34            'reference' => 'a69c667eb7a2449e402147586d3863d932f3f660',
    3535            'type' => 'library',
    3636            'install_path' => __DIR__ . '/../rosell-dk/dom-util-for-webp',
    … …  
    113113            'pretty_version' => 'dev-master',
    114114            'version' => 'dev-master',
    115             'reference' => '9637ca4242e885f3d44b1382db5409fec8d5919d',
     115            'reference' => 'b5aba85e45f5c3a40987de3c96f1cbe43f8e99d5',
    116116            'type' => 'wordpress-plugin',
    117117            'install_path' => __DIR__ . '/../../',

  • webp-express/tags/0.25.16/vendor/rosell-dk/dom-util-for-webp/README.md

    r2981697 r3752945  
    66[![Coverage](https://img.shields.io/endpoint?url=https://little-b.it/dom-util-for-webp/code-coverage/coverage-badge.json)](http://little-b.it/dom-util-for-webp/code-coverage/coverage/index.html)
    77[![Software License](https://img.shields.io/badge/license-MIT-brightgreen.svg?style=flat-square)](https://github.com/rosell-dk/dom-util-for-webp/blob/master/LICENSE)
     8[![Dependents](http://poser.pugx.org/rosell-dk/dom-util-for-webp/dependents)](https://packagist.org/packages/rosell-dk/dom-util-for-webp/dependents?order_by=downloads)
    89
    910*Replace image URLs found in HTML*

  • webp-express/tags/0.25.16/vendor/rosell-dk/dom-util-for-webp/src/ImageUrlReplacer.php

    r2981697 r3752945  
    180180        }
    181181
     182        // The parser (simple_html_dom) lifts content out of the HTML (script, style, code, comments,
     183        // CDATA, PHP tags...) and leaves placeholders starting with "___noise___" in its place. It
     184        // restores them later, in text and in attribute values, without escaping, and it keeps
     185        // expanding until no marker is left.
     186        //
     187        // Input that contains the marker, or that ends in the start of it right before something the
     188        // parser replaces with a placeholder (ie "___noise<![CDATA[x]]>"), breaks that assumption:
     189        // - an attacker can make the parser restore a <code> body into an attribute value, which
     190        //   breaks out of the quotes (stored XSS via comments)
     191        // - a marker that cannot be resolved makes restore_noise() loop forever (denial of service)
     192        //
     193        // Real pages never contain "___noise", so leave such HTML untouched rather than risk it.
     194        // This check mitigates the vulnerability discovered by Jakub Herman       
     195        if (stripos($html, '___noise') !== false) {
     196            return $html;
     197        }
     198
    182199        // https://stackoverflow.com/questions/4812691/preserve-line-breaks-simple-html-dom-parser
    183200

  • webp-express/tags/0.25.16/vendor/rosell-dk/webp-convert-cloud-service/src/AccessCheck.php

    r1971426 r3752945  
    4747
    4848                if (isset($_POST['salt']) && isset($_POST['api-key-crypted'])) {
    49                     if (CRYPT_BLOWFISH == 1) {
    50                         // Strip off the first 28 characters (the first 6 are always "$2y$10$". The next 22 is the salt)
    51                         $cryptedKey = substr(crypt($whitelistItem['api-key'], '$2y$10$' . $_POST['salt'] . '$'), 28);
    52                         if ($_POST['api-key-crypted'] == $cryptedKey) {
    53                             // Access granted!
    54                             return;
    55                         }
    56                     } else {
    57                         // trouble...
    58                     }
    59                 } else {
     49                  if (CRYPT_BLOWFISH == 1) {
     50                      $salt = $_POST['salt'];
     51                      $apiKeyCrypted = $_POST['api-key-crypted'];
     52             
     53                      // Step 1: salt must be exactly 22 bcrypt-alphabet characters
     54                      if (!is_string($salt) || !preg_match('/^[.\/0-9A-Za-z]{22}$/D', $salt)) {
     55                          continue;
     56                      }
     57             
     58                      // Step 2a: the submitted crypted key must be a non-empty string
     59                      if (!is_string($apiKeyCrypted) || $apiKeyCrypted === '') {
     60                          continue;
     61                      }
     62             
     63                      $fullHash = crypt($whitelistItem['api-key'], '$2y$10$' . $salt . '$');
     64             
     65                      // Step 2b: crypt() must have returned a genuine bcrypt hash.
     66                      // (On failure it returns "*0" or "*1")
     67                      if (!is_string($fullHash) || strlen($fullHash) !== 60 || strpos($fullHash, '$2y$10$') !== 0) {
     68                          continue;
     69                      }
     70             
     71                      // Strip off the first 28 characters (7 for "$2y$10$", then the 22-char salt)
     72                      $cryptedKey = substr($fullHash, 28);
     73                      if (hash_equals($cryptedKey, $apiKeyCrypted)) {
     74                          // Access granted!
     75                          return;
     76                      }
     77                  } else {
     78                      // crypt_blowfish not available, access cannot be granted
     79                      // we fail silently
     80                  }
     81              } else {
    6082                    $hashingRequired = (
    6183                        isset($whitelistItem['require-api-key-to-be-crypted-in-transfer']) &&
    … …  
    6385                    );
    6486                    if (!$hashingRequired && isset($_POST['api-key'])) {
    65                         if ($_POST['api-key'] == $whitelistItem['api-key']) {
    66                             // Access granted!
    67                             return;
    68                         }
    69                     }
     87                      if (
     88                          is_string($_POST['api-key']) &&
     89                          is_string($whitelistItem['api-key']) &&
     90                          hash_equals($whitelistItem['api-key'], $_POST['api-key'])
     91                      ) {
     92                          // Access granted!
     93                          return;
     94                      }
     95                  }
    7096                }
    7197            }

  • webp-express/tags/0.25.16/vendor/rosell-dk/webp-convert-cloud-service/src/Serve.php

    r2114927 r3752945  
    120120
    121121            try {
    122                 WebPConvert::convert($source, $destination, $convertOptions);
    123                 header('Content-type: application/octet-stream');
    124                 echo file_get_contents($destination);
     122              WebPConvert::convert($source, $destination, $convertOptions);
     123              header('Content-type: application/octet-stream');
     124              echo file_get_contents($destination);
     125            } catch (\Exception $e) {
     126              echo 'Conversion failed!';
     127              //echo $e->getMessage();  // disabled, in order to be sure we dont leak server paths. TODO: provide a safe alternative
     128            } finally {
     129              // Always remove the uploaded file and any partial output,
     130              // whether conversion succeeded, failed, or threw something
     131              // other than \Exception (e.g. a \Throwable/\Error on PHP 7+).
     132              if (file_exists($source)) {
     133                  @unlink($source);
     134              }
     135              if (file_exists($destination)) {
     136                  @unlink($destination);
     137              }
     138          }
    125139
    126                 unlink($source);
    127                 unlink($destination);
    128             } catch (\Exception $e) {
    129                 echo 'Conversion failed!';
    130                 echo $e->getMessage();
    131             }
    132140        } else {
    133141            // Possible file upload attack!

  • webp-express/tags/0.25.16/webp-express.php

    r3578701 r3752945  
    44 * Plugin URI: https://github.com/rosell-dk/webp-express
    55 * Description: Serve autogenerated WebP images instead of jpeg/png to browsers that supports WebP. Works on anything (media library images, galleries, theme images etc).
    6  * Version: 0.25.15
     6 * Version: 0.25.16
    77 * Author: Bjørn Rosell
    88 * Author URI: https://www.bitwise-it.dk

  • webp-express/trunk/README.txt

    r3578701 r3752945  
    55Requires at least: 4.0
    66Tested up to: 6.9
    7 Stable tag: 0.25.15
     7Stable tag: 0.25.16
    88Requires PHP: 5.6
    99License: GPLv3
    … …  
    174174**Persons who recently contributed with [ko-fi](https://ko-fi.com/rosell) - Thanks!**
    175175
     176* 20 Sep: Greg
     177* 5 Aug: Abilio Varjao
     178* 23 Mar: hung minh dang
    176179* 5 Jan: Joel
    177 * 24 Dec: Patrick Müller
    178 * 16 Dec: Dragos
    179 * 9 Aug: Tanzi
    180 * 3 Jul: Jen
    181 * 26 Jun: Per
    182 * 16 May: Erick Danzer
    183 * 8 May: Mike
    184 * 31 May: parallactic
    185 * 14 May: Gitte Rebsdorf
    186 * 9 May: La Braud
     180* 24 Dec 2025: Patrick Müller
    187181
    188182**Persons who recently contributed on [github sponsors](https://github.com/sponsors/rosell-dk) - Thanks!**
    … …  
    832826== Changelog ==
    833827
     828= 0.25.16 =
     829(released 18 Oct 2026)
     830* Fixed vulnerability in dom parser library used for altering html. Credit goes to Jakub Herman for discovering the problem. Also fixed a loophole that made it possible to use the web service (if activated) with carefully crafted inputs, even without an api key. Thanks to the third party that found and reported this to the Wordpress security team - and thanks to the security team for bringing the issue to my attention
     831
    834832= 0.25.15 =
    835833(released 19 May 2026)
    … …  
    903901
    904902== Upgrade Notice ==
     903= 0.25.16 =
     904* Fixed vulnerability in dom parser library used for altering html. Credit goes to Jakub Herman for discovering the problem. Also fixed a loophole that made it possible to use the web service (if activated) with carefully crafted inputs, even without an api key. Thanks to the third party that found and reported this to the Wordpress security team - and thanks to the security team for bringing the issue to my attention
    905905
    906906= 0.25.15 =

  • webp-express/trunk/docs/publishing.md

    r3578701 r3752945  
    9797   - https://lutzenmanagement.dk/wp-admin/plugin-install.php
    9898   - http://mystress.dk/wp-admin/plugin-install.php
     99   - fabeldyr.dk
    99100   ... etc
    100101
    … …  
    113114```
    114115cd svn
    115 svn cp trunk tags/0.25.14       (this will copy trunk into a new tag)
     116svn cp trunk tags/0.25.15       (this will copy trunk into a new tag)
    116117```
    117118
    118119And commit!
    119120```
    120 svn ci -m '0.25.14'
     121svn ci -m '0.25.15'
    121122```
    122123

  • webp-express/trunk/lib/classes/ConvertHelperIndependent.php

    r3578701 r3752945  
    572572
    573573        // TODO: Put version number somewhere else. Ie \WebPExpress\VersionNumber::version
    574         $text = 'WebP Express 0.25.15. ' . $msgTop . ', ' . date("Y-m-d H:i:s") . "\n\r\n\r" . $text;
     574        $text = 'WebP Express 0.25.16. ' . $msgTop . ', ' . date("Y-m-d H:i:s") . "\n\r\n\r" . $text;
    575575
    576576        $logFile = self::getLogFilename($source, $logDir);

  • webp-express/trunk/vendor/composer/installed.json

    r3578701 r3752945  
    210210        {
    211211            "name": "rosell-dk/dom-util-for-webp",
    212             "version": "0.7.1",
    213             "version_normalized": "0.7.1.0",
     212            "version": "0.7.2",
     213            "version_normalized": "0.7.2.0",
    214214            "source": {
    215215                "type": "git",
    216216                "url": "https://github.com/rosell-dk/dom-util-for-webp.git",
    217                 "reference": "4f9102e404ee137a781c8580b829a340c5a5d428"
    218             },
    219             "dist": {
    220                 "type": "zip",
    221                 "url": "https://api.github.com/repos/rosell-dk/dom-util-for-webp/zipball/4f9102e404ee137a781c8580b829a340c5a5d428",
    222                 "reference": "4f9102e404ee137a781c8580b829a340c5a5d428",
     217                "reference": "a69c667eb7a2449e402147586d3863d932f3f660"
     218            },
     219            "dist": {
     220                "type": "zip",
     221                "url": "https://api.github.com/repos/rosell-dk/dom-util-for-webp/zipball/a69c667eb7a2449e402147586d3863d932f3f660",
     222                "reference": "a69c667eb7a2449e402147586d3863d932f3f660",
    223223                "shasum": ""
    224224            },
    … …  
    232232                "squizlabs/php_codesniffer": "3.*"
    233233            },
    234             "time": "2023-10-20T12:10:28+00:00",
     234            "time": "2026-10-18T08:43:30+00:00",
    235235            "type": "library",
    236236            "extra": {
    237237                "scripts-descriptions": {
    238238                    "ci": "Run tests before CI",
     239                    "test": "Launches the preconfigured PHPUnit",
    239240                    "phpcs": "Checks coding styles (PSR2) of file/dir, which you must supply. To check all, supply 'src'",
     241                    "cs-fix": "Fix the coding style of a PHP file or directory, which you must specify.",
    240242                    "phpcbf": "Fix coding styles (PSR2) of file/dir, which you must supply. To fix all, supply 'src'",
    241                     "cs-fix-all": "Fix the coding style of all the source files, to comply with the PSR-2 coding standard",
    242                     "cs-fix": "Fix the coding style of a PHP file or directory, which you must specify.",
    243                     "test": "Launches the preconfigured PHPUnit"
     243                    "cs-fix-all": "Fix the coding style of all the source files, to comply with the PSR-2 coding standard"
    244244                }
    245245            },
    … …  
    270270            "support": {
    271271                "issues": "https://github.com/rosell-dk/dom-util-for-webp/issues",
    272                 "source": "https://github.com/rosell-dk/dom-util-for-webp/tree/0.7.1"
     272                "source": "https://github.com/rosell-dk/dom-util-for-webp/tree/0.7.2"
    273273            },
    274274            "funding": [

  • webp-express/trunk/vendor/composer/installed.php

    r3578701 r3752945  
    44        'pretty_version' => 'dev-master',
    55        'version' => 'dev-master',
    6         'reference' => '9637ca4242e885f3d44b1382db5409fec8d5919d',
     6        'reference' => 'b5aba85e45f5c3a40987de3c96f1cbe43f8e99d5',
    77        'type' => 'wordpress-plugin',
    88        'install_path' => __DIR__ . '/../../',
    … …  
    3030        ),
    3131        'rosell-dk/dom-util-for-webp' => array(
    32             'pretty_version' => '0.7.1',
    33             'version' => '0.7.1.0',
    34             'reference' => '4f9102e404ee137a781c8580b829a340c5a5d428',
     32            'pretty_version' => '0.7.2',
     33            'version' => '0.7.2.0',
     34            'reference' => 'a69c667eb7a2449e402147586d3863d932f3f660',
    3535            'type' => 'library',
    3636            'install_path' => __DIR__ . '/../rosell-dk/dom-util-for-webp',
    … …  
    113113            'pretty_version' => 'dev-master',
    114114            'version' => 'dev-master',
    115             'reference' => '9637ca4242e885f3d44b1382db5409fec8d5919d',
     115            'reference' => 'b5aba85e45f5c3a40987de3c96f1cbe43f8e99d5',
    116116            'type' => 'wordpress-plugin',
    117117            'install_path' => __DIR__ . '/../../',

  • webp-express/trunk/vendor/rosell-dk/dom-util-for-webp/README.md

    r2981697 r3752945  
    66[![Coverage](https://img.shields.io/endpoint?url=https://little-b.it/dom-util-for-webp/code-coverage/coverage-badge.json)](http://little-b.it/dom-util-for-webp/code-coverage/coverage/index.html)
    77[![Software License](https://img.shields.io/badge/license-MIT-brightgreen.svg?style=flat-square)](https://github.com/rosell-dk/dom-util-for-webp/blob/master/LICENSE)
     8[![Dependents](http://poser.pugx.org/rosell-dk/dom-util-for-webp/dependents)](https://packagist.org/packages/rosell-dk/dom-util-for-webp/dependents?order_by=downloads)
    89
    910*Replace image URLs found in HTML*

  • webp-express/trunk/vendor/rosell-dk/dom-util-for-webp/src/ImageUrlReplacer.php

    r2981697 r3752945  
    180180        }
    181181
     182        // The parser (simple_html_dom) lifts content out of the HTML (script, style, code, comments,
     183        // CDATA, PHP tags...) and leaves placeholders starting with "___noise___" in its place. It
     184        // restores them later, in text and in attribute values, without escaping, and it keeps
     185        // expanding until no marker is left.
     186        //
     187        // Input that contains the marker, or that ends in the start of it right before something the
     188        // parser replaces with a placeholder (ie "___noise<![CDATA[x]]>"), breaks that assumption:
     189        // - an attacker can make the parser restore a <code> body into an attribute value, which
     190        //   breaks out of the quotes (stored XSS via comments)
     191        // - a marker that cannot be resolved makes restore_noise() loop forever (denial of service)
     192        //
     193        // Real pages never contain "___noise", so leave such HTML untouched rather than risk it.
     194        // This check mitigates the vulnerability discovered by Jakub Herman       
     195        if (stripos($html, '___noise') !== false) {
     196            return $html;
     197        }
     198
    182199        // https://stackoverflow.com/questions/4812691/preserve-line-breaks-simple-html-dom-parser
    183200

  • webp-express/trunk/vendor/rosell-dk/webp-convert-cloud-service/src/AccessCheck.php

    r1971426 r3752945  
    4747
    4848                if (isset($_POST['salt']) && isset($_POST['api-key-crypted'])) {
    49                     if (CRYPT_BLOWFISH == 1) {
    50                         // Strip off the first 28 characters (the first 6 are always "$2y$10$". The next 22 is the salt)
    51                         $cryptedKey = substr(crypt($whitelistItem['api-key'], '$2y$10$' . $_POST['salt'] . '$'), 28);
    52                         if ($_POST['api-key-crypted'] == $cryptedKey) {
    53                             // Access granted!
    54                             return;
    55                         }
    56                     } else {
    57                         // trouble...
    58                     }
    59                 } else {
     49                  if (CRYPT_BLOWFISH == 1) {
     50                      $salt = $_POST['salt'];
     51                      $apiKeyCrypted = $_POST['api-key-crypted'];
     52             
     53                      // Step 1: salt must be exactly 22 bcrypt-alphabet characters
     54                      if (!is_string($salt) || !preg_match('/^[.\/0-9A-Za-z]{22}$/D', $salt)) {
     55                          continue;
     56                      }
     57             
     58                      // Step 2a: the submitted crypted key must be a non-empty string
     59                      if (!is_string($apiKeyCrypted) || $apiKeyCrypted === '') {
     60                          continue;
     61                      }
     62             
     63                      $fullHash = crypt($whitelistItem['api-key'], '$2y$10$' . $salt . '$');
     64             
     65                      // Step 2b: crypt() must have returned a genuine bcrypt hash.
     66                      // (On failure it returns "*0" or "*1")
     67                      if (!is_string($fullHash) || strlen($fullHash) !== 60 || strpos($fullHash, '$2y$10$') !== 0) {
     68                          continue;
     69                      }
     70             
     71                      // Strip off the first 28 characters (7 for "$2y$10$", then the 22-char salt)
     72                      $cryptedKey = substr($fullHash, 28);
     73                      if (hash_equals($cryptedKey, $apiKeyCrypted)) {
     74                          // Access granted!
     75                          return;
     76                      }
     77                  } else {
     78                      // crypt_blowfish not available, access cannot be granted
     79                      // we fail silently
     80                  }
     81              } else {
    6082                    $hashingRequired = (
    6183                        isset($whitelistItem['require-api-key-to-be-crypted-in-transfer']) &&
    … …  
    6385                    );
    6486                    if (!$hashingRequired && isset($_POST['api-key'])) {
    65                         if ($_POST['api-key'] == $whitelistItem['api-key']) {
    66                             // Access granted!
    67                             return;
    68                         }
    69                     }
     87                      if (
     88                          is_string($_POST['api-key']) &&
     89                          is_string($whitelistItem['api-key']) &&
     90                          hash_equals($whitelistItem['api-key'], $_POST['api-key'])
     91                      ) {
     92                          // Access granted!
     93                          return;
     94                      }
     95                  }
    7096                }
    7197            }

  • webp-express/trunk/vendor/rosell-dk/webp-convert-cloud-service/src/Serve.php

    r2114927 r3752945  
    120120
    121121            try {
    122                 WebPConvert::convert($source, $destination, $convertOptions);
    123                 header('Content-type: application/octet-stream');
    124                 echo file_get_contents($destination);
     122              WebPConvert::convert($source, $destination, $convertOptions);
     123              header('Content-type: application/octet-stream');
     124              echo file_get_contents($destination);
     125            } catch (\Exception $e) {
     126              echo 'Conversion failed!';
     127              //echo $e->getMessage();  // disabled, in order to be sure we dont leak server paths. TODO: provide a safe alternative
     128            } finally {
     129              // Always remove the uploaded file and any partial output,
     130              // whether conversion succeeded, failed, or threw something
     131              // other than \Exception (e.g. a \Throwable/\Error on PHP 7+).
     132              if (file_exists($source)) {
     133                  @unlink($source);
     134              }
     135              if (file_exists($destination)) {
     136                  @unlink($destination);
     137              }
     138          }
    125139
    126                 unlink($source);
    127                 unlink($destination);
    128             } catch (\Exception $e) {
    129                 echo 'Conversion failed!';
    130                 echo $e->getMessage();
    131             }
    132140        } else {
    133141            // Possible file upload attack!

  • webp-express/trunk/webp-express.php

    r3578701 r3752945  
    44 * Plugin URI: https://github.com/rosell-dk/webp-express
    55 * Description: Serve autogenerated WebP images instead of jpeg/png to browsers that supports WebP. Works on anything (media library images, galleries, theme images etc).
    6  * Version: 0.25.15
     6 * Version: 0.25.16
    77 * Author: Bjørn Rosell
    88 * Author URI: https://www.bitwise-it.dk
Note: See TracChangeset for help on using the changeset viewer.