404 to 301 - Version 2.3.1

Version Description

(27/08/2016) = Bug Fixes

  • Fixed Cross Site Scripting vulnerability - Thanks to Summer of Pwnage & Louis Dion-Marcil.
  • Fixed sorting issue in error log (Changed default order to Date Descending order).
  • Fixed issues when trailing slash found at the end of custom redirect.

Improvements

  • Tested with WordPress 4.6.
Download this release

Release Info

Developer joelcj91
Plugin Icon 128x128 404 to 301
Version 2.3.1
Comparing to
See all releases

Code changes from version 2.3.0 to 2.3.1

Files changed (5) hide show
  1. 404-to-301.php +2 -2
  2. admin/class-404-to-301-admin.php +1 -1
  3. admin/class-404-to-301-logs.php +14 -6
  4. public/class-404-to-301-public.php +9 -3
  5. readme.txt +20 -4
404-to-301.php CHANGED
@@ -3,7 +3,7 @@
3
  * Plugin Name: 404 to 301
4
  * Plugin URI: https://thefoxe.com/products/404-to-301/
5
  * Description: Automatically redirect all <strong>404 errors</strong> to any page using <strong>301 redirect for SEO</strong>. You can <strong>redirect and log</strong> every 404 errors. No more 404 errors in Webmaster tool.
6
- * Version: 2.3.0
7
  * Author: Joel James
8
  * Author URI: https://thefoxe.com/
9
  * Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=XUVWY8HUBUXY4
@@ -49,7 +49,7 @@ if ( ! class_exists( '_404_To_301' ) ) {
49
  'I4T3_HELP_PAGE' => admin_url( 'admin.php?page=i4t3-settings&tab=credits' ),
50
  'I4T3_LOGS_PAGE' => admin_url( 'admin.php?page=i4t3-logs' ),
51
  'I4T3_DB_VERSION' => '8',
52
- 'I4T3_VERSION' => '2.3.0',
53
  'I4T3_TABLE' => $GLOBALS['wpdb']->prefix . '404_to_301',
54
  // Set who all can access 404 settings.
55
  // You can change this if you want to give others access.
3
  * Plugin Name: 404 to 301
4
  * Plugin URI: https://thefoxe.com/products/404-to-301/
5
  * Description: Automatically redirect all <strong>404 errors</strong> to any page using <strong>301 redirect for SEO</strong>. You can <strong>redirect and log</strong> every 404 errors. No more 404 errors in Webmaster tool.
6
+ * Version: 2.3.1
7
  * Author: Joel James
8
  * Author URI: https://thefoxe.com/
9
  * Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=XUVWY8HUBUXY4
49
  'I4T3_HELP_PAGE' => admin_url( 'admin.php?page=i4t3-settings&tab=credits' ),
50
  'I4T3_LOGS_PAGE' => admin_url( 'admin.php?page=i4t3-logs' ),
51
  'I4T3_DB_VERSION' => '8',
52
+ 'I4T3_VERSION' => '2.3.1',
53
  'I4T3_TABLE' => $GLOBALS['wpdb']->prefix . '404_to_301',
54
  // Set who all can access 404 settings.
55
  // You can change this if you want to give others access.
admin/class-404-to-301-admin.php CHANGED
@@ -469,7 +469,7 @@ class _404_To_301_Admin {
469
  }
470
  // get the required values from request
471
  $url_404 = $_POST['url_404'];
472
- $url = $_POST['url'];
473
 
474
  global $wpdb;
475
  // make sure that the errors are hidden
469
  }
470
  // get the required values from request
471
  $url_404 = $_POST['url_404'];
472
+ $url = esc_url( $_POST['url'] );
473
 
474
  global $wpdb;
475
  // make sure that the errors are hidden
admin/class-404-to-301-logs.php CHANGED
@@ -93,7 +93,7 @@ class _404_To_301_Logs extends WP_List_Table_404 {
93
  $orderby = ( isset( $_REQUEST['orderby']) ) ? self::i4t3_get_sort_column_filtered( $_REQUEST['orderby']) : 'date';
94
 
95
  // If no order, default to asc
96
- $order = ( isset( $_REQUEST['order']) && 'desc' == $_REQUEST['order'] ) ? 'DESC' : 'ASC';
97
 
98
  $result = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM " . self::$table . " ORDER BY $orderby $order LIMIT %d OFFSET %d", array( $per_page, $offset ) ), 'ARRAY_A' );
99
 
@@ -268,7 +268,7 @@ class _404_To_301_Logs extends WP_List_Table_404 {
268
 
269
  $title = ( ! empty( $item['redirect'] ) ) ? $item['redirect'] : __( 'Default', '404-to-301' );
270
 
271
- return '<a href="javascript:void(0)" title="' . __('Customize', '404-to-301') . '" class="i4t3_redirect_thickbox" url_404="' . $item['url'] . '">' . $title . '</a>';
272
  }
273
 
274
  /**
@@ -313,9 +313,11 @@ class _404_To_301_Logs extends WP_List_Table_404 {
313
  * @return string $url_data Url column text data.
314
  */
315
  public function column_url( $item ) {
 
 
316
 
317
  // Apply filter - i4t3_log_list_url_column
318
- $url_data = apply_filters( 'i4t3_log_list_url_column', $this->get_empty_text('<p class="i4t3-url-p">' . $item['url'] . '</p>', $item['url']));
319
 
320
  return $url_data;
321
  }
@@ -334,9 +336,11 @@ class _404_To_301_Logs extends WP_List_Table_404 {
334
  * @return string $ref_data Ref column text data.
335
  */
336
  public function column_ref( $item ) {
 
 
337
 
338
  // Apply filter - i4t3_log_list_ref_column
339
- $ref_data = apply_filters( 'i4t3_log_list_ref_column', $this->get_empty_text('<a href="' . $item['ref'] . '" target="_blank">' . $item['ref'] . '</a>', $item['ref'] ) );
340
 
341
  return $ref_data;
342
  }
@@ -356,8 +360,10 @@ class _404_To_301_Logs extends WP_List_Table_404 {
356
  */
357
  public function column_ua($item) {
358
 
 
 
359
  // Apply filter - i4t3_log_list_ref_column
360
- $ua_data = apply_filters( 'i4t3_log_list_ua_column', $this->get_empty_text( $item['ua'], $item['ua'] ) );
361
 
362
  return $ua_data;
363
  }
@@ -377,8 +383,10 @@ class _404_To_301_Logs extends WP_List_Table_404 {
377
  */
378
  public function column_ip( $item ) {
379
 
 
 
380
  // Apply filter - i4t3_log_list_ref_column
381
- $ip = apply_filters( 'i4t3_log_list_ip_column', $this->get_empty_text( $item['ip'], $item['ip'] ) );
382
 
383
  return $ip;
384
  }
93
  $orderby = ( isset( $_REQUEST['orderby']) ) ? self::i4t3_get_sort_column_filtered( $_REQUEST['orderby']) : 'date';
94
 
95
  // If no order, default to asc
96
+ $order = ( isset( $_REQUEST['order']) && 'asc' == $_REQUEST['order'] ) ? 'ASC' : 'DESC';
97
 
98
  $result = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM " . self::$table . " ORDER BY $orderby $order LIMIT %d OFFSET %d", array( $per_page, $offset ) ), 'ARRAY_A' );
99
 
268
 
269
  $title = ( ! empty( $item['redirect'] ) ) ? $item['redirect'] : __( 'Default', '404-to-301' );
270
 
271
+ return '<a href="javascript:void(0)" title="' . __('Customize', '404-to-301') . '" class="i4t3_redirect_thickbox" url_404="' . esc_url( $item['url'] ) . '">' . $title . '</a>';
272
  }
273
 
274
  /**
313
  * @return string $url_data Url column text data.
314
  */
315
  public function column_url( $item ) {
316
+
317
+ $url = sanitize_text_field( $item['url'] );
318
 
319
  // Apply filter - i4t3_log_list_url_column
320
+ $url_data = apply_filters( 'i4t3_log_list_url_column', $this->get_empty_text('<p class="i4t3-url-p">' . $url . '</p>', $url));
321
 
322
  return $url_data;
323
  }
336
  * @return string $ref_data Ref column text data.
337
  */
338
  public function column_ref( $item ) {
339
+
340
+ $ref = sanitize_text_field( $item['ref'] );
341
 
342
  // Apply filter - i4t3_log_list_ref_column
343
+ $ref_data = apply_filters( 'i4t3_log_list_ref_column', $this->get_empty_text('<a href="' . $ref . '" target="_blank">' . $ref . '</a>', $ref ) );
344
 
345
  return $ref_data;
346
  }
360
  */
361
  public function column_ua($item) {
362
 
363
+ $ua = sanitize_text_field( $item['ua'] );
364
+
365
  // Apply filter - i4t3_log_list_ref_column
366
+ $ua_data = apply_filters( 'i4t3_log_list_ua_column', $this->get_empty_text( $ua, $ua ) );
367
 
368
  return $ua_data;
369
  }
383
  */
384
  public function column_ip( $item ) {
385
 
386
+ $ip = sanitize_text_field( $item['ip'] );
387
+
388
  // Apply filter - i4t3_log_list_ref_column
389
+ $ip = apply_filters( 'i4t3_log_list_ip_column', $this->get_empty_text( $ip, $ip ) );
390
 
391
  return $ip;
392
  }
public/class-404-to-301-public.php CHANGED
@@ -186,7 +186,7 @@ class _404_To_301_Public {
186
 
187
  $link = ( ! preg_match("~^(?:f|ht)tps?://~i", $link ) ) ? "http://" . $link : $link;
188
 
189
- return $link;
190
  }
191
 
192
  /**
@@ -263,7 +263,11 @@ class _404_To_301_Public {
263
  $data['ip'] = $this->get_ip();
264
  foreach ( $server as $key => $value ) {
265
  if ( ! empty( $_SERVER[ $value ] ) ) {
266
- $string = $_SERVER[ $value ];
 
 
 
 
267
  } else {
268
  $string = '';
269
  }
@@ -370,7 +374,9 @@ class _404_To_301_Public {
370
  */
371
  private function get_clear_empty($data = null) {
372
 
373
- return ( $data == null || empty($data) ) ? 'N/A' : substr( $data, 0, 512 );
 
 
374
  }
375
 
376
  }
186
 
187
  $link = ( ! preg_match("~^(?:f|ht)tps?://~i", $link ) ) ? "http://" . $link : $link;
188
 
189
+ return trailingslashit( $link );
190
  }
191
 
192
  /**
263
  $data['ip'] = $this->get_ip();
264
  foreach ( $server as $key => $value ) {
265
  if ( ! empty( $_SERVER[ $value ] ) ) {
266
+ if ($key === 'url') {
267
+ $string = trailingslashit( $_SERVER[ $value ] );
268
+ } else {
269
+ $string = $_SERVER[ $value ];
270
+ }
271
  } else {
272
  $string = '';
273
  }
374
  */
375
  private function get_clear_empty($data = null) {
376
 
377
+ $data = ( $data == null || empty($data) ) ? 'N/A' : substr( $data, 0, 512 );
378
+
379
+ return htmlspecialchars( $data );
380
  }
381
 
382
  }
readme.txt CHANGED
@@ -4,7 +4,7 @@ Tags: 404, 301, 302, 307, not found, 404 redirect, 404 to 301, 301 redirect, seo
4
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=XUVWY8HUBUXY4
5
  Requires at least: 3.5
6
  Tested up to: 4.6
7
- Stable tag: 2.3.0
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
@@ -128,6 +128,17 @@ Bug reports for 404 to 301 are always welcome. [Report here](https://thefoxe.com
128
 
129
  == Changelog ==
130
 
 
 
 
 
 
 
 
 
 
 
 
131
  = 2.3.0 (17/08/2016) =
132
  **Bug Fixes**
133
 
@@ -341,8 +352,13 @@ Bug reports for 404 to 301 are always welcome. [Report here](https://thefoxe.com
341
 
342
  == Upgrade Notice ==
343
 
344
- 2.3.0 (17/08/2016) =
345
  **Bug Fixes**
346
 
347
- - Removed unused UAN button from help page.
348
- - Tracking completely removed from the plugin since it was detected as spam. Read more [here](https://thefoxe.com/blog/404-to-301-plugin-detected-by-wordfence-here-is-what-actually-happened/).
 
 
 
 
 
4
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=XUVWY8HUBUXY4
5
  Requires at least: 3.5
6
  Tested up to: 4.6
7
+ Stable tag: 2.3.1
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
128
 
129
  == Changelog ==
130
 
131
+ = 2.3.1 (27/08/2016) =
132
+ **Bug Fixes**
133
+
134
+ - Fixed Cross Site Scripting vulnerability - Thanks to [Summer of Pwnage](https://www.sumofpwn.nl/) & Louis Dion-Marcil.
135
+ - Fixed sorting issue in error log (Changed default order to Date Descending order).
136
+ - Fixed issues when trailing slash found at the end of custom redirect.
137
+
138
+ **Improvements**
139
+
140
+ - Tested with WordPress 4.6.
141
+
142
  = 2.3.0 (17/08/2016) =
143
  **Bug Fixes**
144
 
352
 
353
  == Upgrade Notice ==
354
 
355
+ = 2.3.1 (27/08/2016) =
356
  **Bug Fixes**
357
 
358
+ - Fixed Cross Site Scripting vulnerability - Thanks to [Summer of Pwnage](https://www.sumofpwn.nl/) & Louis Dion-Marcil.
359
+ - Fixed sorting issue in error log (Changed default order to Date Descending order).
360
+ - Fixed issues when trailing slash found at the end of custom redirect.
361
+
362
+ **Improvements**
363
+
364
+ - Tested with WordPress 4.6.