WordPress.org
Get WordPress

Plugin Directory

Changeset 3766831 for customer-area


Ignore:
Timestamp:
10/26/2026 03:43:07 PM (11 days ago)
Author:
aguilatechnologies
Message:

Release 8.4.1 (security fix)

Location:
customer-area/trunk
Files:
13 edited

Legend:

Unmodified
Added
Removed

  • customer-area/trunk/customer-area.php

    r3756145 r3766831  
    44        Description:    WP Customer Area is a modular all-in-one solution to manage private content with WordPress.
    55        Plugin URI:     https://wp-customerarea.com
    6         Version:                8.4.0
     6        Version:                8.4.1
    77        Author:                 Aguila Technologies
    88        Author URI:     https://wp-customerarea.com
    … …  
    4141define('CUAR_LANGUAGE_DIR', basename(CUAR_PLUGIN_DIR) . '/languages');
    4242
    43 define('CUAR_PLUGIN_VERSION', '8.4.0');
     43define('CUAR_PLUGIN_VERSION', '8.4.1');
    4444define('CUAR_PLUGIN_URL', plugin_dir_url(__FILE__));
    4545define('CUAR_SCRIPTS_URL', CUAR_PLUGIN_URL . 'scripts');

  • customer-area/trunk/readme.txt

    r3756145 r3766831  
    77Requires PHP:       7.2
    88Tested up to:       7.1
    9 Stable tag:         8.4.0
     9Stable tag:         8.4.1
    1010License:            GPLv2 or later
    1111License URI:        http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    104104
    105105== Changelog ==
     106
     107= 8.4.1 (2026/10/26) =
     108
     109* Security: user, group, project and role names are now escaped everywhere they are displayed (Logs screen, content owner links, widgets, account form). Names saved from the account form can no longer contain HTML or double quotes. Updating is recommended.
     110* Thanks to Kuba (Wordfence) for responsibly reporting CVE-2026-116551, fixed in 8.4.1.
     111* Template versions bumped: post-owner-link-usr, -grp, -prj, -rol (1.0.1), widget-content-authors, widget-content-list (3.0.1), widget-terms-cloud, widget-terms-tree (3.1.1). If your theme overrides them, update your copies.
    106112
    107113= 8.4.0 (2026/10/20) =

  • customer-area/trunk/src/php/core-addons/log/log-table.class.php

    r3222378 r3766831  
    204204        if(!empty($user)) {
    205205            $output = sprintf('<span title="%4$s" class="cuar-btn-xs ip">IP</span> <a href="%1$s" title="Profile of %2$s" class="cuar-btn-xs user">%3$s</a>',
    206                 admin_url('user-edit.php?user_id=' . $user_id),
     206                esc_url(admin_url('user-edit.php?user_id=' . $user_id)),
    207207                esc_attr($user->display_name),
    208                 $user->user_login,
    209                 $item->ip);
     208                esc_html($user->user_login),
     209                esc_attr($item->ip));
    210210        } else {
    211211            $output = __('Unknown', 'cuar');
    … …  
    241241
    242242                if (empty($meta['link'])) {
    243                     $fields[] = sprintf('<span title="%1$s" class="cuar-btn-xs %3$s">%2$s</span>', $meta['title'],
    244                         esc_attr($meta['value']), $key);
     243                    $fields[] = sprintf('<span title="%1$s" class="cuar-btn-xs %3$s">%2$s</span>', esc_attr($meta['title']),
     244                        esc_html($meta['value']), esc_attr($key));
    245245                } else {
    246                     $fields[] = sprintf('<a href="%4$s" title="%1$s" class="cuar-btn-xs %3$s">%2$s</a>', $meta['title'],
    247                         esc_attr($meta['value']), $key, esc_attr($meta['link']));
     246                    $fields[] = sprintf('<a href="%4$s" title="%1$s" class="cuar-btn-xs %3$s">%2$s</a>', esc_attr($meta['title']),
     247                        esc_html($meta['value']), esc_attr($key), esc_url($meta['link']));
    248248                }
    249249            }

  • customer-area/trunk/src/php/core-addons/post-owner/templates/post-owner-link-grp.template.php

    r2517454 r3766831  
    11<?php /**
    2  * Template version: 1.0.0
     2 * Template version: 1.0.1
     3 *
     4 * -= 1.0.1 =-
     5 * - Escape the owner name (security fix)
    36 *
    47 * -= 1.0.0 =-
    … …  
    1417$owner_links = $po_addon->get_owner_submenu_links($owner_id, $owner_type);
    1518$owner_data_name = $po_addon->get_owner_display_name($owner_type, $owner_id);
    16 $owner_data_title = sprintf(esc_attr__('This content is assigned to the group: %1s', 'cuar'), $owner_data_name);
     19$owner_data_title = esc_attr(sprintf(__('This content is assigned to the group: %1s', 'cuar'), $owner_data_name));
    1720?>
    1821
    19 <div class="cuar-meta-link cuar-meta-link-<?php echo $owner_type; ?> cuar-js-dropdown-in-overflow pull-left">
     22<div class="cuar-meta-link cuar-meta-link-<?php echo esc_attr($owner_type); ?> cuar-js-dropdown-in-overflow pull-left">
    2023    <a href="#"
    2124       class="btn btn-xs btn-default dropdown-toggle mr5"
    … …  
    2326       aria-expanded="false"
    2427       title="<?php echo $owner_data_title; ?>">
    25         <i class="fa fa-user pn"></i>&nbsp;<?php echo $owner_data_name; ?>
     28        <i class="fa fa-user pn"></i>&nbsp;<?php echo esc_html($owner_data_name); ?>
    2629    </a>
    2730    <?php if ($owner_links) { ?>

  • customer-area/trunk/src/php/core-addons/post-owner/templates/post-owner-link-prj.template.php

    r2517454 r3766831  
    11<?php /**
    2  * Template version: 1.0.0
     2 * Template version: 1.0.1
     3 *
     4 * -= 1.0.1 =-
     5 * - Escape the owner name (security fix)
    36 *
    47 * -= 1.0.0 =-
    … …  
    1417$owner_links = $po_addon->get_owner_submenu_links($owner_id, $owner_type);
    1518$owner_data_name = $po_addon->get_owner_display_name($owner_type, $owner_id);
    16 $owner_data_title = sprintf(esc_attr__('This content is assigned to the project: %1s', 'cuar'), $owner_data_name);
     19$owner_data_title = esc_attr(sprintf(__('This content is assigned to the project: %1s', 'cuar'), $owner_data_name));
    1720?>
    1821
    19 <div class="cuar-meta-link cuar-meta-link-<?php echo $owner_type; ?> cuar-js-dropdown-in-overflow pull-left">
     22<div class="cuar-meta-link cuar-meta-link-<?php echo esc_attr($owner_type); ?> cuar-js-dropdown-in-overflow pull-left">
    2023    <a href="#"
    2124       class="btn btn-xs btn-default dropdown-toggle mr5"
    … …  
    2326       aria-expanded="false"
    2427       title="<?php echo $owner_data_title; ?>">
    25         <i class="fa fa-user pn"></i>&nbsp;<?php echo $owner_data_name; ?>
     28        <i class="fa fa-user pn"></i>&nbsp;<?php echo esc_html($owner_data_name); ?>
    2629    </a>
    2730    <?php if ($owner_links) { ?>

  • customer-area/trunk/src/php/core-addons/post-owner/templates/post-owner-link-rol.template.php

    r2517454 r3766831  
    11<?php /**
    2  * Template version: 1.0.0
     2 * Template version: 1.0.1
     3 *
     4 * -= 1.0.1 =-
     5 * - Escape the owner name (security fix)
    36 *
    47 * -= 1.0.0 =-
    … …  
    1417$owner_links = $po_addon->get_owner_submenu_links($owner_id, $owner_type);
    1518$owner_data_name = $po_addon->get_owner_display_name($owner_type, $owner_id);
    16 $owner_data_title = sprintf(esc_attr__('This content is assigned to the role: %1s', 'cuar'), $owner_data_name);
     19$owner_data_title = esc_attr(sprintf(__('This content is assigned to the role: %1s', 'cuar'), $owner_data_name));
    1720?>
    1821
    19 <div class="cuar-meta-link cuar-meta-link-<?php echo $owner_type; ?> cuar-js-dropdown-in-overflow pull-left">
     22<div class="cuar-meta-link cuar-meta-link-<?php echo esc_attr($owner_type); ?> cuar-js-dropdown-in-overflow pull-left">
    2023    <a href="#"
    2124       class="btn btn-xs btn-default dropdown-toggle mr5"
    … …  
    2326       aria-expanded="false"
    2427       title="<?php echo $owner_data_title; ?>">
    25         <i class="fa fa-user pn"></i>&nbsp;<?php echo $owner_data_name; ?>
     28        <i class="fa fa-user pn"></i>&nbsp;<?php echo esc_html($owner_data_name); ?>
    2629    </a>
    2730    <?php if ($owner_links) { ?>

  • customer-area/trunk/src/php/core-addons/post-owner/templates/post-owner-link-usr.template.php

    r2517454 r3766831  
    11<?php /**
    2  * Template version: 1.0.0
     2 * Template version: 1.0.1
     3 *
     4 * -= 1.0.1 =-
     5 * - Escape the owner name (security fix)
    36 *
    47 * -= 1.0.0 =-
    … …  
    1417$owner_links = $po_addon->get_owner_submenu_links($owner_id, $owner_type);
    1518$owner_data_name = $po_addon->get_owner_display_name($owner_type, $owner_id);
    16 $owner_data_title = sprintf(esc_attr__('This content is assigned to the user: %1s', 'cuar'), $owner_data_name);
     19$owner_data_title = esc_attr(sprintf(__('This content is assigned to the user: %1s', 'cuar'), $owner_data_name));
    1720?>
    1821
    19 <div class="cuar-meta-link cuar-meta-link-<?php echo $owner_type; ?> cuar-js-dropdown-in-overflow pull-left">
     22<div class="cuar-meta-link cuar-meta-link-<?php echo esc_attr($owner_type); ?> cuar-js-dropdown-in-overflow pull-left">
    2023    <a href="#"
    2124       class="btn btn-xs btn-default dropdown-toggle mr5"
    … …  
    2326       aria-expanded="false"
    2427       title="<?php echo $owner_data_title; ?>">
    25         <i class="fa fa-user pn"></i>&nbsp;<?php echo $owner_data_name; ?>
     28        <i class="fa fa-user pn"></i>&nbsp;<?php echo esc_html($owner_data_name); ?>
    2629    </a>
    2730    <?php if ($owner_links) { ?>

  • customer-area/trunk/src/php/core-classes/object-meta/renderer/display-name-field-renderer.class.php

    r2517454 r3766831  
    5454
    5555                                $out = '';
    56                                 $out .= '<select name="' . $id . '" id="' . $id . '" class="form-control">' . "\n";
     56                                $out .= '<select name="' . esc_attr($id) . '" id="' . esc_attr($id) . '" class="form-control">' . "\n";
    5757                                $public_display = array();
    5858                                $public_display['display_nickname'] = $current_user->nickname;
    … …  
    7777
    7878                                foreach ($public_display as $id => $item) {
    79                                         $out .= '<option ' . selected($current_user->display_name, $item, false) . '>' . $item . '</option>' . "\n";
     79                                        $out .= '<option value="' . esc_attr($item) . '" ' . selected($current_user->display_name, $item, false) . '>' . esc_html($item) . '</option>' . "\n";
    8080                                }
    8181                                $out .= '</select>' . "\n";

  • customer-area/trunk/src/php/core-classes/object-meta/storage/user-storage.class.php

    r2517454 r3766831  
    3434        public function update_field_value( $object_id, $field_id, $value ) {
    3535                if ( !in_array( $field_id, self::$VALID_FIELDS ) ) return;
    36                
     36
     37                // Names end up in HTML attributes: no markup and no double quotes
     38                if ( in_array( $field_id, array( 'display_name', 'nickname', 'first_name', 'last_name' ) ) ) {
     39                        $value = str_replace( array( '"', '<', '>' ), '', sanitize_text_field( $value ) );
     40                }
     41
    3742                wp_update_user( array ( 'ID' => $object_id, $field_id => $value ) ) ;
    3843        }

  • customer-area/trunk/src/php/core-classes/templates/widget-content-authors.template.php

    r2517454 r3766831  
    11<?php
    2 /** Template version: 3.0.0
     2/** Template version: 3.0.1
     3 *
     4 * -= 3.0.1 =-
     5 * - Escape the author name (security fix)
    36 *
    47 * -= 3.0.0 =-
    … …  
    1720        // Print the current author
    1821        printf('<a href="%1$s" title="%3$s" class="label label-default label-sm">%4$s %2$s</a>',
    19             $link,
    20             $display_name,
    21             sprintf(esc_attr__('Show all content published by %s', 'cuar'), $display_name),
     22            esc_url($link),
     23            esc_html($display_name),
     24            esc_attr(sprintf(__('Show all content published by %s', 'cuar'), $display_name)),
    2225            get_avatar( $id, 46 )
    2326        );

  • customer-area/trunk/src/php/core-classes/templates/widget-content-list.template.php

    r2517454 r3766831  
    11<?php
    2 /** Template version: 3.0.0
     2/** Template version: 3.0.1
     3 *
     4 * -= 3.0.1 =-
     5 * - Escape the content title in the link title (security fix)
    36 *
    47 * -= 3.0.0 =-
    … …  
    2326                // Print the current term
    2427                printf('<a href="%1$s" title="%3$s" class="list-group-item">%2$s</a>',
    25                     $link,
     28                    esc_url($link),
    2629                    $title,
    27                     sprintf(esc_attr__('Link to %s', 'cuar'), $title)
     30                    esc_attr(sprintf(__('Link to %s', 'cuar'), wp_strip_all_tags($title)))
    2831                );
    2932                ?>

  • customer-area/trunk/src/php/core-classes/templates/widget-terms-cloud.template.php

    r2517454 r3766831  
    11<?php
    2 /** Template version: 3.1.0
     2/** Template version: 3.1.1
     3 *
     4 * -= 3.1.1 =-
     5 * - Escape the term name (security fix)
    36 *
    47 * -= 3.1.0 =-
    … …  
    2629        // Print the current term
    2730        printf('<a href="%1$s" title="%3$s" class="label label-default label-sm">%2$s</a>',
    28             $link,
    29             $term->name,
    30             sprintf(esc_attr__('Show all content categorized under %s', 'cuar'), $term->name)
     31            esc_url($link),
     32            esc_html($term->name),
     33            esc_attr(sprintf(__('Show all content categorized under %s', 'cuar'), $term->name))
    3134        );
    3235    }

  • customer-area/trunk/src/php/core-classes/templates/widget-terms-tree.template.php

    r2517454 r3766831  
    11<?php
    2 /** Template version: 3.1.0
     2/** Template version: 3.1.1
     3 *
     4 * -= 3.1.1 =-
     5 * - Escape the term name (security fix)
    36 *
    47 * -= 3.1.0 =-
    … …  
    3639            // Print the current term
    3740            printf('<a href="%1$s" title="%3$s" target="_self">%2$s</a>',
    38                 $link,
    39                 $term->name,
    40                 sprintf(esc_attr__('Show all content categorized under %s', 'cuar'), $term->name)
     41                esc_url($link),
     42                esc_html($term->name),
     43                esc_attr(sprintf(__('Show all content categorized under %s', 'cuar'), $term->name))
    4144            );
    4245
Note: See TracChangeset for help on using the changeset viewer.