search

code-pixelz-media / locatepress

GNU General Public License v2.0
0 stars 0 forks source link

Data Must be Sanitized, Escaped, and Validated #8

Closed cpmrohit closed 2 years ago

cpmrohit commented 3 years ago

Sanitize, escape, and validate every data for every POST/GET/REQUEST/FILE request

Also, we should escape all the variables that we echo such as echo '<img src="' . $image . '"><div>'; should be echo '<img src="' . esc_url( $image ) . '"><div>';

https://developer.wordpress.org/plugins/security/securing-input/ https://developer.wordpress.org/plugins/security/securing-output/

cpmraman commented 3 years ago

Data in locatepress-addons.php is escaped with localization.

cpmrohit commented 3 years ago

Please check in entire plugin files, including shorcodes, page templates, forms and all. @cpmraman

cpmraman commented 3 years ago

I have checked entire plugin files line by line and added escaping and sanitization.

cpmraman commented 3 years ago

Again, i have added sanitization on user input fields that i missed before.

cpmrohit commented 3 years ago

Still needs to be sanitized and escaped. For example locatepress-master/admin/class-locatepress-term-meta.php:52: $image = $_POST['listing_type-icon']; locatepress-master/admin/class-locatepress-term-meta.php:91: $image = $_POST['listing_type-icon']; locatepress-master/public/class-locatepress-public.php:255: $idArr = array_unique($_POST['data']); locatepress-master/public/class-locatepress-shortcodes.php:198: $get_lisitng_types = ( isset( $_GET[ 'lp_search_filter_loctype' ] ) && $_GET ['lp_search_filter_loctype' ] ) ? $_GET ['lp_search_filter_loctype'] : ''; locatepress-master/public/class-locatepress-shortcodes.php:199: $get_categories = ( isset( $_GET ['lp_search_filter_cat'] ) && $_GET ['lp_search_filter_cat'] ) ? $_GET ['lp_search_filter_cat'] : ''; locatepress-master/public/class-locatepress-shortcodes.php:388: $listing_type = $_GET['lp_search_filter_loctype']; locatepress-master/public/class-locatepress-shortcodes.php:394: $category_type = $_GET['lp_search_filter_cat']; locatepress-master/public/class-locatepress-shortcodes.php:464: return $_GET[$name];

locatepress-master/public/class-locatepress-shortcodes.php:311: echo '

  • '; locatepress-master/public/class-locatepress-shortcodes.php:313: echo '

    ' . $value['title'] . '

    ';

    Please check the entire plugin and fix those issues. @cpmraman

    • cpmrohit commented 2 years ago

    Issue fixed.