Changes in pixabay-images/trunk/pixabay-images.php [926633:1067992]

File:

• pixabay-images/trunk/pixabay-images.php (modified) (13 diffs)

pixabay-images/trunk/pixabay-images.php

@@ -1 @@
-<?
+<?php
 
 /*
@@ -5 +5 @@
 Plugin URI: http://pixabay.com/blog/posts/p-36/
 Description: Find quality public domain images from Pixabay and upload them with just one click.
-Version: 2.0
+Version: 2.4
 Author: Simon Steinberger
 Author URI: http://pixabay.com/users/Simon/
@@ -13 +13 @@
 
 // i18n
+function pixabay_images_load_textdomain() { load_plugin_textdomain('pixabay_images', false, dirname(plugin_basename(__FILE__ )).'/langs/'); }
 add_action('plugins_loaded', 'pixabay_images_load_textdomain');
-function pixabay_images_load_textdomain() {
-    load_plugin_textdomain('pixabay_images', false, dirname(plugin_basename(__FILE__ )).'/langs/');
-}
 
 
@@ -24 +22 @@
 
 // add tab to media upload window
-add_filter('media_upload_tabs', function($tabs){ $tabs['pixabaytab'] = __('Pixabay Images', 'pixabay_images'); return $tabs; });
+function media_upload_tabs_handler($tabs) { $tabs['pixabaytab'] = __('Pixabay Images', 'pixabay_images'); return $tabs; }
+add_filter('media_upload_tabs', 'media_upload_tabs_handler');
 
 
 // add button next to "Add Media"
 $pixabay_images_settings = get_option('pixabay_images_options');
-if (!$pixabay_images_settings['button'] | $pixabay_images_settings['button']=='true')
-    add_filter('media_buttons_context', function($editor_id=''){ return '<a href="'.add_query_arg('tab', 'pixabaytab', esc_url(get_upload_iframe_src())).'" id="'.esc_attr($editor_id).'-add_media" class="thickbox button" title="'.esc_attr__('Pixabay Images', 'pixabay_images').'"><img style="position:relative;top:-1px" src="'.plugin_dir_url(__FILE__).'favicon.ico'.'"> Pixabay</a>'; });
+if (!$pixabay_images_settings['button'] | $pixabay_images_settings['button']=='true') {
+    function media_buttons_context_handler($editor_id='') { return '<a href="'.add_query_arg('tab', 'pixabaytab', esc_url(get_upload_iframe_src())).'" id="'.esc_attr($editor_id).'-add_media" class="thickbox button" title="'.esc_attr__('Pixabay Images', 'pixabay_images').'"><img style="position:relative;top:-2px" src="'.plugin_dir_url(__FILE__).'favicon.png'.'"> Pixabay</a>'; }
+    add_filter('media_buttons_context', 'media_buttons_context_handler');
+}
 
 
@@ -60 +61 @@
                 <p><input id="q" type="text" value="" style="width:100%;max-width:500px;padding:7px 9px"></p>
                 <p>
-                    <label style="margin-right:15px"><input type="checkbox" id="filter_photos"<?= $pixabay_images_settings['image_type']=='clipart'?'':' checked="checked"'; ?>><?_e('Photos', 'pixabay_images');?></label>
-                    <label style="margin-right:20px"><input type="checkbox" id="filter_cliparts"<?= $pixabay_images_settings['image_type']=='photo'?'':' checked="checked"'; ?>><?_e('Cliparts', 'pixabay_images');?></label>
+                    <label style="margin-right:15px"><input type="checkbox" id="filter_photos"<?= $pixabay_images_settings['image_type']=='clipart'?'':' checked="checked"'; ?>><?= _e('Photos', 'pixabay_images'); ?></label>
+                    <label style="margin-right:20px"><input type="checkbox" id="filter_cliparts"<?= $pixabay_images_settings['image_type']=='photo'?'':' checked="checked"'; ?>><?= _e('Cliparts', 'pixabay_images'); ?></label>
                     <span style="margin-right:20px">|</span>
-                    <label style="margin-right:15px"><input type="checkbox" id="filter_horizontal"<?= $pixabay_images_settings['orientation']=='vertical'?'':' checked="checked"'; ?>><?_e('Horizontal', 'pixabay_images');?></label>
-                    <label style="margin-right:25px"><input type="checkbox" id="filter_vertical"<?= $pixabay_images_settings['orientation']=='horizontal'?'':' checked="checked"'; ?>><?_e('Vertical', 'pixabay_images');?></label>
-                    <a href="options-general.php?page=pixabay_images_settings" target="_blank"><?_e('Settings', 'pixabay_images');?></a>
+                    <label style="margin-right:15px"><input type="checkbox" id="filter_horizontal"<?= $pixabay_images_settings['orientation']=='vertical'?'':' checked="checked"'; ?>><?= _e('Horizontal', 'pixabay_images'); ?></label>
+                    <label style="margin-right:25px"><input type="checkbox" id="filter_vertical"<?= $pixabay_images_settings['orientation']=='horizontal'?'':' checked="checked"'; ?>><?= _e('Vertical', 'pixabay_images'); ?></label>
+                    <a href="options-general.php?page=pixabay_images_settings" target="_blank"><?= _e('Settings', 'pixabay_images'); ?></a>
                 </p>
-                <input id="submit_search" class="button" type="submit" value="<?_e('Search', 'pixabay_images');?>">
+                <input id="submit_search" class="button" type="submit" value="<?= _e('Search', 'pixabay_images'); ?>">
             </form>
             <div id="pixabay_results" style="margin-top:25px;padding-top:25px;border-top:1px solid #ddd"></div>
@@ -73 +74 @@
         <script>
             function crossDomainAjax(c,a){if("XDomainRequest" in window&&window.XDomainRequest!==null){var b=new XDomainRequest();b.open("get",c);b.onload=function(){var e=new ActiveXObject("Microsoft.XMLDOM"),d=$.parseJSON(b.responseText);e.async=false;if(d==null||typeof(d)=="undefined"){d=$.parseJSON(data.firstChild.textContent)}a(d)};b.onerror=function(){_result=false};b.send()}else{if(navigator.userAgent.indexOf('MSIE')!=-1&&parseInt(navigator.userAgent.match(/MSIE ([\d.]+)/)[1])<8){return false}else{$.ajax({url:c,cache:false,dataType:"json",type:"GET",async:false,success:function(d,e){a(d)}})}}};
-            function escapeJS(s){return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,"\\'");}
+            function escapejs(s){return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,"\\'");}
             // hoverIntent r7
             (function(e){e.fn.hoverIntent=function(t,n,r){var i={interval:100,sensitivity:7,timeout:0};if(typeof t==="object"){i=e.extend(i,t)}else if(e.isFunction(n)){i=e.extend(i,{over:t,out:n,selector:r})}else{i=e.extend(i,{over:t,out:t,selector:n})}var s,o,u,a;var f=function(e){s=e.pageX;o=e.pageY};var l=function(t,n){n.hoverIntent_t=clearTimeout(n.hoverIntent_t);if(Math.abs(u-s)+Math.abs(a-o)<i.sensitivity){e(n).off("mousemove.hoverIntent",f);n.hoverIntent_s=1;return i.over.apply(n,[t])}else{u=s;a=o;n.hoverIntent_t=setTimeout(function(){l(t,n)},i.interval)}};var c=function(e,t){t.hoverIntent_t=clearTimeout(t.hoverIntent_t);t.hoverIntent_s=0;return i.out.apply(t,[e])};var h=function(t){var n=jQuery.extend({},t);var r=this;if(r.hoverIntent_t){r.hoverIntent_t=clearTimeout(r.hoverIntent_t)}if(t.type=="mouseenter"){u=n.pageX;a=n.pageY;e(r).on("mousemove.hoverIntent",f);if(r.hoverIntent_s!=1){r.hoverIntent_t=setTimeout(function(){l(n,r)},i.interval)}}else{e(r).off("mousemove.hoverIntent",f);if(r.hoverIntent_s==1){r.hoverIntent_t=setTimeout(function(){c(n,r)},i.timeout)}}};return this.on({"mouseenter.hoverIntent":h,"mouseleave.hoverIntent":h},i.selector)}})(jQuery)
 
-            var $=jQuery, post_id=<?=absint($_REQUEST['post_id'])?>,
+            var $=jQuery, post_id=<?=absint($_REQUEST['post_id']) ?>,
                 lang='<?= $pixabay_images_settings['language']?$pixabay_images_settings['language']:substr(get_locale(), 0, 2) ?>',
-                per_page=<?=$pixabay_images_settings['per_page']?$pixabay_images_settings['per_page']:30?>,
+                per_page=<?=$pixabay_images_settings['per_page']?$pixabay_images_settings['per_page']:30 ?>,
                 form = $('#pixabay_images_form'), hits, cache, resizeTimer, q, image_type, orientation;
 
@@ -124 +125 @@
                     s += '<span class="button disabled">Prev</span>';
                 else
-                    s += '<a href="#" onclick="return call_api(\''+escapeJS(q)+'\', '+(p-1)+');" class="button">Prev</a>';
+                    s += '<a href="#" onclick="return call_api(\''+escapejs(q)+'\', '+(p-1)+');" class="button">Prev</a>';
                 for (i=1; i < pages+1; i++) {
-                    s += '<a href="#" onclick="return call_api(\''+escapeJS(q)+'\', '+i+');" class="button'+(p==i?' disabled':'')+'">'+i+'</a>';
+                    s += '<a href="#" onclick="return call_api(\''+escapejs(q)+'\', '+i+');" class="button'+(p==i?' disabled':'')+'">'+i+'</a>';
                 }
                 if (p==pages)
-                    s += '<span class="button disabled">Prev</span>';
+                    s += '<span class="button disabled">Next</span>';
                 else
-                    s += '<a href="#" onclick="return call_api(\''+escapeJS(q)+'\', '+(p+1)+');" class="button">Next</a>';
+                    s += '<a href="#" onclick="return call_api(\''+escapejs(q)+'\', '+(p+1)+');" class="button">Next</a>';
                 s += '</div>';
                 $('#pixabay_results').html(s);
@@ -166 +167 @@
 
                         preview = $('<div data-idx="'+idx+'" class="preview">\
-                            <div title="<?=_e('Insert image')?>" style="padding:4px 5px 6px;margin:0 0 5px;text-align:left;border-bottom:1px solid #ddd">\
+                            <div title="<?= _e('Insert image') ?>" style="padding:4px 5px 6px;margin:0 0 5px;text-align:left;border-bottom:1px solid #ddd">\
                                 <a href="#" class="upload 150px" style="margin-right:15px">'+img.width()+' x '+img.height()+'</a>\
                                 <a href="#" class="upload 640px" style="margin-right:15px">'+width640+' x '+height640+'</a>\
                                 <a href="#" class="upload 1280px">'+width1280+' x '+height1280+'</a>\
                             </div>\
-                            <a title="<?=_e('Insert image')?>" href="#" class="upload 640px" style="display:block;margin:auto;position:relative;width:'+parseInt(width640/2)+'px;height:'+parseInt(height640/2)+'px;">\
+                            <a title="<?= _e('Insert image') ?>" href="#" class="upload 640px" style="display:block;margin:auto;position:relative;width:'+parseInt(width640/2)+'px;height:'+parseInt(height640/2)+'px;">\
                                 <img src="'+img.attr('src')+'" style="width:'+parseInt(width640/2)+'px !important;height:'+parseInt(height640/2)+'px !important;">\
                                 <img src="'+hits[idx].webformatURL+'" style="width:'+parseInt(width640/2)+'px !important;height:'+parseInt(height640/2)+'px !important;">\
                             </a>\
-                            <div style="padding:6px 5px 4px;margin:5px 0 0;text-align:left;border-top:1px solid #ddd"><?_e('CC0 Image by', 'pixabay_images');?> <a href="http://pixabay.com/users/'+hits[idx].user+'/" target="_blank">'+hits[idx].user+'</a> / <a href="http://pixabay.com/'+lang+'/photos/?image_type='+image_type+'&orientation='+orientation+'&q='+escapeJS(q)+'" target="_blank">Pixabay</a></div>\
+                            <div style="padding:6px 5px 4px;margin:5px 0 0;text-align:left;border-top:1px solid #ddd"><?= _e('CC0 Image by', 'pixabay_images'); ?> <a href="http://pixabay.com/users/'+hits[idx].user+'/" target="_blank">'+hits[idx].user+'</a> / <a href="http://pixabay.com/'+lang+'/photos/?image_type='+image_type+'&orientation='+orientation+'&q='+escapejs(q)+'" target="_blank">Pixabay</a></div>\
                         </div>');
                         thumb.append(preview);
@@ -208 +209 @@
             });
         </script>
-    <?
+    <?php
 }
-add_action('media_upload_pixabaytab', function(){ wp_iframe('media_pixabay_images_tab'); });
+function media_upload_pixabaytab_handler() { wp_iframe('media_pixabay_images_tab'); }
+add_action('media_upload_pixabaytab', 'media_upload_pixabaytab_handler');
 
 
@@ -217 +219 @@
     $pixabay_images_settings = get_option('pixabay_images_options');
 
-    # "pluggable.php" is required for current_user_can() and other upload relevant functions
+    # "pluggable.php" is required for current_user_can() and other upload relevant functions
     require_once(ABSPATH.'wp-includes/pluggable.php');
-    if (!is_admin() or !current_user_can('edit_post', $post_id) ) die("You don't have permission to edit this post.");
+    if (!is_user_logged_in() or !current_user_can('edit_post', $post_id)) die("You don't have permission to edit this post.");
+
+    // parse image_url
+    $url = parse_url($_POST['image_url']);
+    if(strcmp($url['host'], "pixabay.com")){
+    die("Error: wrong host in url (must be pixabay.com)");
+    }
 
     // get image file
@@ -227 +235 @@
     $q_tags = explode(' ' , $_POST['q']);
     array_splice($q_tags, 2);
-    foreach ($q_tags as $k=>$v) $q_tags[$k] = trim($v);
+    foreach ($q_tags as $k=>$v) {
+        // Remove ../../../..
+        $v = str_replace("..","",$v);
+        $q_tags[$k] = trim($v);
+    }
     $path_info = pathinfo($_POST['image_url']);
     $file_name = implode('_', $q_tags).'_'.time().'.'.$path_info['extension'];
@@ -242 +254 @@
     $result = @file_put_contents($target_file_name, $response['body']);
     unset($response['body']);
-    if ($result === false) die('Error: Failed to write file - '.$target_file_name);
+    if ($result === false) die('Error: Failed to write file: '.$target_file_name);
+
+    // are we dealing with an image
+    require_once(ABSPATH.'wp-admin/includes/image.php');
+    if (!wp_read_image_metadata($target_file_name)) {
+        unlink($target_file_name);
+        die('Error: File is not an image.');
+    }
+
     $image_title = ucwords(implode(', ', $q_tags));
     $attachment_caption = '';
     if (!$pixabay_images_settings['attribution'] | $pixabay_images_settings['attribution']=='true')
-        $attachment_caption = '<a href="http://pixabay.com/users/'.$_POST['image_user'].'/">'.$_POST['image_user'].'</a> / Pixabay';
+        $attachment_caption = '<a href="http://pixabay.com/users/'.htmlentities($_POST['image_user']).'/">'.htmlentities($_POST['image_user']).'</a> / Pixabay';
 
     // insert attachment
@@ -259 +279 @@
     if ($attach_id == 0) die('Error: File attachment error');
 
-    require_once(ABSPATH.'wp-admin/includes/image.php');
     $attach_data = wp_generate_attachment_metadata($attach_id, $target_file_name);
     $result = wp_update_attachment_metadata($attach_id, $attach_data);