sanitizing

GuduleLapointe · Dec 29, 2021 · 7fe8c9c · 7fe8c9c
1 parent bb32c95
commit 7fe8c9c
Show file tree

Hide file tree

Showing 5 changed files with 17 additions and 15 deletions.
diff --git a/.distignore b/.distignore
@@ -45,3 +45,4 @@ yarn.lock
 .distignore.wp
 .version
 README.md
+tmp/
diff --git a/.gitignore b/.gitignore
@@ -4,3 +4,4 @@
 .#*
 ._*
 sources/
+tmp/
diff --git a/admin/admin-init.php b/admin/admin-init.php
@@ -162,10 +162,10 @@ function w4os_users_filter_avatars($position)
   );
   foreach($options as $value => $label) {
     $options_html .= sprintf(
-      '<option value=%1$s %3$s>%2$s</option>',
-      $value,
-      $label,
-      ( $_GET['filter_avatar_'. $position ] == $value ) ? 'selected' : '',
+      '<option value="%1$s" %3$s>%2$s</option>',
+      esc_attr($value),
+      esc_attr($label),
+      esc_html(( $_GET['filter_avatar_'. $position ] == $value ) ? 'selected' : ''),
     );
   }
 
@@ -174,7 +174,7 @@ function w4os_users_filter_avatars($position)
       <option value="">%2$s</option>
       %3$s
     </select>',
-    $position,
+    esc_attr($position),
     __( 'Filter users...' ),
     $options_html
   );
@@ -261,11 +261,12 @@ function w4os_process_actions($args = array()) {
 
   // w4os_transient_admin_notice(__FUNCTION__ . '<pre>' . print_r($_REQUEST, true) . '</pre>');
   if($_REQUEST['action'] == 'create_page' && isset(W4OS_PAGES[$_REQUEST['helper']])) {
-    $slug = $_REQUEST['slug'];
-    $helper = $_REQUEST['helper'];
-    $guid = $_REQUEST['guid'];
+    $action = sanitize_title($_REQUEST['action']);
+    $slug = sanitize_title($_REQUEST['slug']);
+    $helper = sanitize_title($_REQUEST['helper']);
+    $guid = sanitize_title($_REQUEST['guid']);
 
-    if (!check_admin_referer( $_REQUEST['action'] . '_'. $_REQUEST['helper'])) {
+    if (!check_admin_referer( $action . '_'. $helper)) {
       w4os_transient_admin_notice(__('The followed link has expired, please try again', 'w4os'));
       wp_redirect(admin_url( "admin.php?page=".$_GET["page"] ));
       exit;
@@ -275,8 +276,7 @@ function w4os_process_actions($args = array()) {
     if(!is_wp_error($page) &! empty($page)) {
       w4os_transient_admin_notice(sprintf(__('Page %s already exists.', 'w4os'), W4OS_PAGES[$helper]['name']), 'error');
     } else {
-      $data = W4OS_PAGES[$_REQUEST['helper']];
-      $guid = $_REQUEST['guid'];
+      $data = W4OS_PAGES[$helper];
       // (empty($_REQUEST['guid'])) ? site_url() . "/$slug" : $_REQUEST['guid'];
       $page_id = wp_insert_post(array(
         'post_name' => $slug,

diff --git a/admin/settings.php b/admin/settings.php
@@ -288,12 +288,12 @@ function w4os_settings_field($args, $user = false) {
 	switch ($args['type']) {
 		case 'url':
 		if($args['readonly']) {
-			if(!empty($value)) echo sprintf('<a href="%1$s">%1$s</a>', $value);
+			if(!empty($value)) echo sprintf('<a href="%1$s">%1$s</a>', esc_html($value));
 			break;
 		}
 
 		case 'string':
-		echo "<input type='text' class='regular-text input-${args['type']}' id='$field_id' name='$field_id' value='" . $value . "' " . join(' ', $parameters) . " />";
+		echo "<input type='text' class='regular-text input-${args['type']}' id='$field_id' name='$field_id' value='" . esc_attr($value) . "' " . join(' ', $parameters) . " />";
 		break;
 
 		case 'password':

diff --git a/includes/profile.php b/includes/profile.php
@@ -680,8 +680,8 @@ function w4os_avatar_creation_form ($user) {
   $action = 'w4os_create_avatar';
 
   if(isset($_REQUEST['w4os_firstname']) && isset($_REQUEST['w4os_lastname'])) {
-    $firstname = $_REQUEST['w4os_firstname'];
-    $lastname = $_REQUEST['w4os_lastname'];
+    $firstname = sanitize_text_field($_REQUEST['w4os_firstname']);
+    $lastname = sanitize_text_field($_REQUEST['w4os_lastname']);
   } else if (!empty(get_user_meta( $user->ID, 'first_name', true )) &! !empty(get_user_meta( $user->ID, 'last_name', true )) ) {
     $firstname = get_user_meta( $user->ID, 'first_name', true );
     $lastname = get_user_meta( $user->ID, 'last_name', true );
-Original file line number
+Diff line change
@@ Expand Up / @@ -4,3 +4,4 @@ @@
     .#*
     ._*
     sources/
+    tmp/