WordPress.org
Get WordPress

Plugin Directory

Changeset 3772987


Ignore:
Timestamp:
10/29/2026 01:05:10 PM (12 days ago)
Author:
murgroland
Message:

2.1.0.7 - Security Fixes

Location:
wp-booking-system
Files:
412 added
8 edited

Legend:

Unmodified
Added
Removed

  • wp-booking-system/trunk/includes/base/admin/form/views/view-edit-form.php

    r3730163 r3772987  
    1414
    1515$tabs         = $this->get_tabs();
    16 $active_tab = (! empty($_GET['tab']) ? sanitize_text_field($_GET['tab']) : 'form-builder');
     16$active_tab = (! empty($_GET['tab']) ? esc_attr($_GET['tab']) : 'form-builder');
    1717
    1818$settings = get_option('wpbs_settings', array());

  • wp-booking-system/trunk/includes/base/form/class-form-handler.php

    r3732620 r3772987  
    248248
    249249        // Only create events if auto_pending is set to true
    250         if ($this->post_data['form']['auto_pending'] != 1) {
     250        if ($this->form_args['auto_pending'] != 1) {
    251251            return false;
    252252        }
    253253
    254         $selection_style = $this->post_data['form']['selection_style'];
     254        $selection_style = $this->form_args['selection_style'];
    255255        wpbs_update_booking_meta($this->booking_id, 'selection_style', $selection_style);
    256256

  • wp-booking-system/trunk/includes/base/form/class-form-outputter.php

    r3730163 r3772987  
    185185            $form_html_data .= 'data-' . $arg . '="' . esc_attr($val) . '" ';
    186186        }
     187
     188        // Sign the restricting arguments so they can't be altered when the form is submitted
     189        $form_html_data .= 'data-args_signature="' . esc_attr(wpbs_get_form_args_signature($this->form->get('id'), $this->calendar_id, $this->args)) . '" ';
    187190
    188191        $enctype = apply_filters('wpbs_enable_file_upload_field', false) ? ' enctype="multipart/form-data"' : '';

  • wp-booking-system/trunk/includes/base/form/class-form-validator.php

    r3730163 r3772987  
    434434        }
    435435
     436        // Do not allow bookings in the past, unless it's a manual booking made by an administrator.
     437        if (empty($form_args['manual_booking']) && date('Ymd', $calendar_args['start_date']) < current_time('Ymd')) {
     438            $this->has_errors = true;
     439            $this->form_fields['form_error'] = wpbs_get_form_default_string($this->form->get('id'), 'invalid_selection', $this->language);
     440            return false;
     441        }
     442
    436443        /**
    437444         * Check if dates are available
    438          * 
     445         *
    439446         */
    440447        if (wpbs_check_if_date_range_is_bookable($this->calendar->get('id'), date('Ymd', $calendar_args['start_date']), date('Ymd', $calendar_args['end_date'])) === false) {

  • wp-booking-system/trunk/includes/base/form/functions-ajax.php

    r3730163 r3772987  
    4848    }
    4949
    50     // Set the form arguments
    51     $form_args = array(
    52         'minimum_days' => (int) $_POST['form']['minimum_days'],
    53         'maximum_days' => (int) $_POST['form']['maximum_days'],
    54         'booking_start_day' => (int) $_POST['form']['booking_start_day'],
    55         'booking_end_day' => (int) $_POST['form']['booking_end_day'],
    56         'selection_type' => $_POST['form']['selection_type'],
    57         'selection_style' => $_POST['form']['selection_style'],
    58         'auto_pending' => $_POST['form']['auto_pending'],
    59         'show_date_selection' => (int) $_POST['form']['show_date_selection'],
    60         'language' => ($_POST['form']['language'] == 'auto' ? wpbs_get_site_language() : $_POST['form']['language']),
    61         'manual_booking' => $manual_booking,
    62     );
     50    // Set the form arguments, only if they match the ones the form was rendered with
     51    $form_args = wpbs_get_form_args_from_request($_POST['form'], $form_id, $calendar_id, $manual_booking);
     52
     53    if ($form_args === false) {
     54        $response = array('success' => false);
     55        $response['html'] = '<div class="wpbs-form-general-error">' . __('The booking form is no longer valid. Please refresh the page and try again.', 'wp-booking-system') . '</div>';
     56        echo json_encode($response);
     57        wp_die();
     58    }
    6359
    6460    // Validate Form
    … …  
    6662    $form_validator->sanitize_fields();
    6763    $form_validator->validate_fields($form_args, $_POST['calendar']);
    68     $form_validator->validate_dates($_POST['form'], $_POST['calendar']);
     64    $form_validator->validate_dates($form_args, $_POST['calendar']);
    6965    $form_validator->set_error_message();
    7066
    … …  
    140136    }
    141137
     138    // Set the form arguments, only if they match the ones the form was rendered with
     139    $form_args = wpbs_get_form_args_from_request($_POST['form'], $form_id, $calendar_id, $manual_booking);
     140
     141    if ($form_args === false) {
     142        $response = array('success' => false);
     143        $response['html'] = '<div class="wpbs-form-general-error">' . __('The booking form is no longer valid. Please refresh the page and try again.', 'wp-booking-system') . '</div>';
     144        echo json_encode($response);
     145        wp_die();
     146    }
     147
    142148    // Validate Form
    143149    $form_validator = new WPBS_Form_Validator($form, $calendar, $_POST['form_data'], $_POST['form']['language']);
    144150    $form_validator->sanitize_fields();
    145     $form_validator->validate_dates($_POST['form'], $_POST['calendar']);
     151    $form_validator->validate_dates($form_args, $_POST['calendar']);
    146152    $form_validator->set_error_message();
    147153
    148154    // Get form fields after sanitization and validation
    149155    $form_fields = $form_validator->get_form_fields();
    150 
    151     // Set the form arguments
    152     $form_args = array(
    153         'minimum_days' => (int) $_POST['form']['minimum_days'],
    154         'maximum_days' => (int) $_POST['form']['maximum_days'],
    155         'booking_start_day' => (int) $_POST['form']['booking_start_day'],
    156         'booking_end_day' => (int) $_POST['form']['booking_end_day'],
    157         'selection_type' => $_POST['form']['selection_type'],
    158         'selection_style' => $_POST['form']['selection_style'],
    159         'auto_pending' => $_POST['form']['auto_pending'],
    160         'show_date_selection' => (int) $_POST['form']['show_date_selection'],
    161         'language' => ($_POST['form']['language'] == 'auto' ? wpbs_get_site_language() : $_POST['form']['language']),
    162         'manual_booking' => $manual_booking,
    163     );
    164156
    165157    if ($form_validator->has_errors() === true) {

  • wp-booking-system/trunk/includes/base/form/functions.php

    r3730163 r3772987  
    299299
    300300    return $args;
     301
     302}
     303
     304/**
     305 * Returns the form arguments that restrict a booking and must not be altered by the visitor
     306 *
     307 * @return array
     308 *
     309 */
     310function wpbs_get_form_signed_args_keys()
     311{
     312
     313    return array('minimum_days', 'maximum_days', 'booking_start_day', 'booking_end_day', 'selection_type', 'selection_style', 'auto_pending', 'show_date_selection');
     314
     315}
     316
     317/**
     318 * Normalizes the restricting form arguments so they produce the same signature
     319 * when rendered in the page and when sent back through ajax
     320 *
     321 * @param array $args
     322 *
     323 * @return array
     324 *
     325 */
     326function wpbs_normalize_form_signed_args($args)
     327{
     328
     329    $normalized = array();
     330
     331    foreach (wpbs_get_form_signed_args_keys() as $key) {
     332
     333        $value = isset($args[$key]) && is_scalar($args[$key]) ? (string) $args[$key] : '';
     334
     335        if (in_array($key, array('minimum_days', 'maximum_days', 'booking_start_day', 'booking_end_day', 'show_date_selection'))) {
     336            $value = (int) $value;
     337        }
     338
     339        $normalized[$key] = $value;
     340    }
     341
     342    return $normalized;
     343
     344}
     345
     346/**
     347 * Returns the signature of the restricting form arguments, bound to the form and calendar
     348 *
     349 * @param int   $form_id
     350 * @param int   $calendar_id
     351 * @param array $args
     352 *
     353 * @return string
     354 *
     355 */
     356function wpbs_get_form_args_signature($form_id, $calendar_id, $args)
     357{
     358
     359    $data = wp_json_encode(array((int) $form_id, (int) $calendar_id, wpbs_normalize_form_signed_args($args)));
     360
     361    return hash_hmac('sha256', $data, wp_salt('auth'));
     362
     363}
     364
     365/**
     366 * Builds the form arguments from an ajax request.
     367 *
     368 * The restricting arguments (auto pending, minimum/maximum days, etc.) are only accepted
     369 * if they match the signature generated when the form was rendered.
     370 *
     371 * @param array $post_form   The $_POST['form'] data
     372 * @param int   $form_id
     373 * @param int   $calendar_id
     374 * @param bool  $manual_booking
     375 *
     376 * @return array|false
     377 *
     378 */
     379function wpbs_get_form_args_from_request($post_form, $form_id, $calendar_id, $manual_booking)
     380{
     381
     382    if (!is_array($post_form)) {
     383        return false;
     384    }
     385
     386    $signature = (!empty($post_form['args_signature']) && is_string($post_form['args_signature'])) ? $post_form['args_signature'] : '';
     387
     388    if (!hash_equals(wpbs_get_form_args_signature($form_id, $calendar_id, $post_form), $signature)) {
     389        return false;
     390    }
     391
     392    $form_args = wpbs_normalize_form_signed_args($post_form);
     393
     394    $language = (isset($post_form['language']) && is_string($post_form['language'])) ? sanitize_text_field($post_form['language']) : 'auto';
     395
     396    $form_args['language'] = ($language == 'auto' ? wpbs_get_site_language() : $language);
     397    $form_args['manual_booking'] = $manual_booking;
     398
     399    return $form_args;
    301400
    302401}

  • wp-booking-system/trunk/readme.txt

    r3765778 r3772987  
    44Requires at least: 4.7
    55Tested up to: 7.1.3
    6 Stable tag: 2.1.0.6
     6Stable tag: 2.1.0.7
    77Requires PHP: 5.6
    88License: GPLv2
    … …  
    211211== Changelog ==
    212212
     213= 2.1.0.7 =
     214* Fixed: Security improvements, credits to Sebi2030.
     215* Fixed: Security improvements, credits to Andrew Wilke.
     216
    213217= 2.1.0.6 =
    214218* Fixed: Security improvements, credits to Aaron.

  • wp-booking-system/trunk/wp-booking-system.php

    r3765778 r3772987  
    55 * Plugin URI: https://www.wpbookingsystem.com/
    66 * Description: A set-and-forget booking calendar for your rental business.
    7  * Version: 2.1.0.6
     7 * Version: 2.1.0.7
    88 * Author: Veribo, Roland Murg
    99 * Author URI: https://www.wpbookingsystem.com/
    … …  
    6363
    6464        // Defining constants
    65         define('WPBS_VERSION', '2.1.0.6');
     65        define('WPBS_VERSION', '2.1.0.7');
    6666        define('WPBS_FILE', __FILE__);
    6767        define('WPBS_BASENAME', plugin_basename(__FILE__));
Note: See TracChangeset for help on using the changeset viewer.