Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram - Version 1.9.19

Version Description

Secured Icegram from XSS vulnerability

Download this release

Release Info

Developer Icegram
Plugin Icon 128x128 Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram
Version 1.9.19
Comparing to
See all releases

Code changes from version 1.9.18 to 1.9.19

Files changed (5) hide show
  1. about-icegram.php +7 -10
  2. classes/compat/class-icegram-compat-icegram-rainmaker.php +1 -1
  3. icegram.php +16 -28
  4. readme.txt +7 -2
  5. settings.php +2 -2
about-icegram.php CHANGED
@@ -13,27 +13,23 @@ function icegram_support_ticket_content() {
13
 
14
  if ( $pagenow != 'edit.php' ) return;
15
  if ( $typenow != 'ig_campaign') return;
16
- if ( !( $current_user instanceof WP_User ) ) return;
17
 
18
  if( isset( $_POST['submit_query'] ) && $_POST['submit_query'] == "Send" && !empty($_POST['client_email'])){
19
-
20
  $additional_info = ( isset( $_POST['additional_information'] ) && !empty( $_POST['additional_information'] ) ) ? sanitize_text_field( $_POST['additional_information'] ) : '';
21
  $additional_info = str_replace( '###', '<br />', $additional_info );
22
  $additional_info = str_replace( array( '[', ']' ), '', $additional_info );
23
 
24
  $from = 'From: ';
25
  $from .= ( isset( $_POST['client_name'] ) && !empty( $_POST['client_name'] ) ) ? sanitize_text_field( $_POST['client_name'] ) : '';
26
- $from .= ' <' . sanitize_text_field( $_POST['client_email'] ) . '>' . "\r\n";
27
  $headers .= $from;
28
  $headers .= str_replace('From: ', 'Reply-To: ', $from);
29
  $headers .= 'MIME-Version: 1.0' . "\r\n";
30
  $headers .= 'Content-type: text/html; charset=UTF-8' . "\r\n";
31
-
32
- ob_start();
33
- echo $additional_info . '<br /><br />';
34
- echo nl2br($_POST['message']) ;
35
- $message = ob_get_clean();
36
- wp_mail( 'hello@icegram.com', $_POST['subject'], $message, $headers );
37
  header('Location: ' . $_SERVER['HTTP_REFERER'] );
38
 
39
  }
@@ -100,7 +96,7 @@ function icegram_support_ticket_content() {
100
 
101
  });
102
 
103
- jQuery(".icegram-contact-us a.thickbox").click( function(){
104
  setTimeout(function() {
105
  jQuery('#TB_ajaxWindowTitle').text('Send your query');
106
  }, 0 );
@@ -150,6 +146,7 @@ function icegram_support_ticket_content() {
150
  <td><input type="submit" class="button" id="icegram_submit_query" name="submit_query" value="Send" /></td>
151
  </tr>
152
  </table>
 
153
  <input type="hidden" id="current_plugin" name="additional_info[current_plugin]" value="Icegram <?php echo $icegram->version; ?>" />
154
  </form>
155
  </div>
13
 
14
  if ( $pagenow != 'edit.php' ) return;
15
  if ( $typenow != 'ig_campaign') return;
16
+ if ( !( $current_user instanceof WP_User ) || !current_user_can( 'manage_options' )) return;
17
 
18
  if( isset( $_POST['submit_query'] ) && $_POST['submit_query'] == "Send" && !empty($_POST['client_email'])){
19
+ check_admin_referer( 'icegram-submit-query' );
20
  $additional_info = ( isset( $_POST['additional_information'] ) && !empty( $_POST['additional_information'] ) ) ? sanitize_text_field( $_POST['additional_information'] ) : '';
21
  $additional_info = str_replace( '###', '<br />', $additional_info );
22
  $additional_info = str_replace( array( '[', ']' ), '', $additional_info );
23
 
24
  $from = 'From: ';
25
  $from .= ( isset( $_POST['client_name'] ) && !empty( $_POST['client_name'] ) ) ? sanitize_text_field( $_POST['client_name'] ) : '';
26
+ $from .= ' <' . sanitize_email( $_POST['client_email'] ) . '>' . "\r\n";
27
  $headers .= $from;
28
  $headers .= str_replace('From: ', 'Reply-To: ', $from);
29
  $headers .= 'MIME-Version: 1.0' . "\r\n";
30
  $headers .= 'Content-type: text/html; charset=UTF-8' . "\r\n";
31
+ $message = $additional_info . '<br /><br />'.nl2br(sanitize_text_field($_POST['message'])) ;
32
+ wp_mail( 'hello@icegram.com', sanitize_text_field($_POST['subject']), $message, $headers );
 
 
 
 
33
  header('Location: ' . $_SERVER['HTTP_REFERER'] );
34
 
35
  }
96
 
97
  });
98
 
99
+ jQuery(".icegram-contact-us a.thickbox").click( function(){
100
  setTimeout(function() {
101
  jQuery('#TB_ajaxWindowTitle').text('Send your query');
102
  }, 0 );
146
  <td><input type="submit" class="button" id="icegram_submit_query" name="submit_query" value="Send" /></td>
147
  </tr>
148
  </table>
149
+ <?php wp_nonce_field( 'icegram-submit-query'); ?>
150
  <input type="hidden" id="current_plugin" name="additional_info[current_plugin]" value="Icegram <?php echo $icegram->version; ?>" />
151
  </form>
152
  </div>
classes/compat/class-icegram-compat-icegram-rainmaker.php CHANGED
@@ -41,7 +41,7 @@ if ( !class_exists( 'Icegram_Compat_icegram_rainmaker' ) ) {
41
  msg.el.trigger('form_success.ig_cta', [msg]);
42
  } else if(msg.data.cta === 'form' || !msg.data.cta){
43
  response_text = '<div class="ig_form_response_text">'+ (msg.data.response_text || msg.el.find('.rm_form_message').html() || '') +'</div>';
44
- msg.el.find('.ig_form_container, .ig_message, .ig_headline').fadeOut();
45
  var appendTo = msg.el.filter('.ig_container');
46
  if(jQuery.inArray(msg.data.type, ['interstitial', 'messenger']) !== -1){
47
  appendTo = msg.el.find('.ig_message');
41
  msg.el.trigger('form_success.ig_cta', [msg]);
42
  } else if(msg.data.cta === 'form' || !msg.data.cta){
43
  response_text = '<div class="ig_form_response_text">'+ (msg.data.response_text || msg.el.find('.rm_form_message').html() || '') +'</div>';
44
+ msg.el.find('.ig_form_container, .ig_message, .ig_headline').hide();
45
  var appendTo = msg.el.filter('.ig_container');
46
  if(jQuery.inArray(msg.data.type, ['interstitial', 'messenger']) !== -1){
47
  appendTo = msg.el.find('.ig_message');
icegram.php CHANGED
@@ -3,7 +3,7 @@
3
  * Plugin Name: Icegram - Popups, Optins, CTAs & lot more...
4
  * Plugin URI: http://www.icegram.com/
5
  * Description: All in one solution to inspire, convert and engage your audiences. Action bars, Popup windows, Messengers, Toast notifications and more. Awesome themes and powerful rules.
6
- * Version: 1.9.18
7
  * Author: icegram
8
  * Author URI: http://www.icegram.com/
9
  *
@@ -35,7 +35,7 @@ class Icegram {
35
 
36
  function __construct() {
37
 
38
- $this->version = "1.9.18";
39
  $this->shortcode_instances = array();
40
  $this->mode = 'local';
41
  $this->plugin_url = untrailingslashit( plugins_url( '/', __FILE__ ) );
@@ -192,7 +192,7 @@ class Icegram {
192
  //analytics
193
  $admin_notice_text = "<span style='padding:0.5em;'>Measure performance of your Icegram messages with the <b>free Analytics addon</b>.<a class='ig-admin-btn' style='display:inline-block' href='http://www.icegram.com/addons/analytics/?utm_source=inapp&utm_campaign=freebonus&utm_medium=notices' target='_blank'>Cool, Let's begin</a></span>";
194
  $no_offer_text = __('No, I don\'t like offers...','icegram');
195
- $option_name = 'dismiss_admin_notice_from_icegram';
196
  }
197
  $offer_content = array();
198
  $offer_content = apply_filters('ig_in_app_offers', $offer_content);
@@ -214,17 +214,18 @@ class Icegram {
214
  }
215
  //Admin notice for Rainmaker
216
  $admin_notice_for_rm = '';
217
- if(current_user_can('install_plugins') && !in_array('icegram-rainmaker/icegram-rainmaker.php', $active_plugins)){
218
  $url = wp_nonce_url(self_admin_url('update.php?action=install-plugin&plugin=' . 'icegram-rainmaker'), 'install-plugin_' . 'icegram-rainmaker');
219
- $admin_notice_text_for_rm = "Icegram reccomends <b>Rainmaker</b>";
220
- echo '<div class="notice notice-warning is-dismissible"> <p> '.$admin_notice_text_for_rm.'<a style="display:inline-block" class="ig-admin-btn ig-admin-btn-secondary" href="'.$url.'">'.__('Begin installation','icegram').'</a></p></div>';
221
  }
222
 
223
 
224
  }
225
  public function dismiss_admin_notice(){
226
  if(isset($_GET['dismiss_admin_notice']) && $_GET['dismiss_admin_notice'] == '1' && isset($_GET['option_name'])){
227
- update_option($_GET['option_name'], true);
 
228
  wp_safe_redirect($_SERVER['HTTP_REFERER']);
229
  exit();
230
  }
@@ -232,20 +233,6 @@ class Icegram {
232
 
233
  //add in app promotion offers here
234
  public function add_in_app_offer($offer_content){
235
- $active_plugins = get_option( 'active_plugins', array() );
236
- $screen = get_current_screen();
237
- if ( !in_array( $screen->id, array( 'ig_campaign', 'ig_message','edit-ig_message','edit-ig_campaign' ), true ) ) return '';
238
- //set offer according to day
239
- $timezone_format = _x('Y-m-d', 'timezone date format');
240
- $current_wp_date = date_create(date_i18n($timezone_format));
241
-
242
- // offer 1: 16th - 30th May 2016 PAP
243
- $offer_1_start = date_create('2016-05-15');
244
- $offer_1_finish = date_create('2016-05-30');
245
- if ( ( $current_wp_date >= $offer_1_start ) && ( $current_wp_date <= $offer_1_finish )) {
246
- $offer_content['admin_notice_text'] = '<b>'.__('Buy Icegram\'s Pro Addons -').'</b><a href="http://www.icegram.com/?page_id=10130&utm_source=ig_in_app&utm_medium=banner&utm_term=pap&utm_campaign=deep-disscount", target="_icegram_offer">'. '<b>' . __(' Pro Add-ons Pack', 'icegram') . ' </b></a><b> - '.__('Hurry, buy before prices shoot up','icegram').'</b>';
247
- $offer_content['option_name'] = 'dismiss_pro_addon_pack_notice';
248
- }
249
  return $offer_content;
250
  }
251
 
@@ -378,6 +365,7 @@ class Icegram {
378
  jQuery('#icegram_housekeeping_response').text("");
379
  params = jQuery("form[name=icegram_housekeeping]").serializeArray();
380
  params.push( {name: 'action', value: 'icegram_run_housekeeping' });
 
381
 
382
  jQuery.ajax({
383
  method: 'POST',
@@ -397,11 +385,11 @@ class Icegram {
397
  }
398
  }
399
  public function run_housekeeping() {
400
- global $wpdb;
 
401
  $params = $_POST;
402
  $_POST = array();
403
-
404
- if(!empty($params['icegram_remove_shortcodes']) && $params['icegram_remove_shortcodes'] == 'yes') {
405
  // first get all posts with [icegram] shortcode in them
406
  $sql = "SELECT * FROM `$wpdb->posts` WHERE `post_content` LIKE '%[icegram %]%' and `post_type` != 'revision' ";
407
  $posts = $wpdb->get_results($sql, OBJECT);
@@ -581,8 +569,8 @@ class Icegram {
581
  wp_localize_script( 'ig_gallery_js', '_wpThemeSettings', array(
582
  'themes' => array(),
583
  'settings' => array(
584
- 'canInstall' => ( ! is_multisite() && current_user_can( 'install_themes' ) ),
585
- 'installURI' => ( ! is_multisite() && current_user_can( 'install_themes' ) ) ? admin_url( 'theme-install.php' ) : null,
586
  'confirmDelete' => __( "Are you sure you want to delete this theme?\n\nClick 'Cancel' to go back, 'OK' to confirm the delete." ),
587
  'adminUrl' => parse_url( admin_url(), PHP_URL_PATH ),
588
  ),
@@ -639,6 +627,7 @@ class Icegram {
639
  'messages' => '',
640
  'skip_others' => 'no'
641
  ), $atts );
 
642
  $class[] = "ig_shortcode_container";
643
  $html[] = "<div id='icegram_shortcode_{$i}'";
644
  if(!empty($atts['campaigns']) && !empty($content)){
@@ -677,7 +666,6 @@ class Icegram {
677
 
678
  $skip_others = $preview_mode = false;
679
  $campaign_ids = $message_ids = array();
680
-
681
  $this->shortcode_instances = ($this->cache_compatibility == 'yes' && !empty($_REQUEST['shortcodes'])) ? $_REQUEST['shortcodes'] : $this->shortcode_instances;
682
  // Pull in message and campaign IDs from shortcodes - if set
683
  if( !empty( $this->shortcode_instances ) ) {
@@ -691,7 +679,7 @@ class Icegram {
691
  $message_ids = array_merge($message_ids, $mids);
692
  }
693
  }
694
- if( !empty( $_REQUEST['campaign_preview_id'] ) && current_user_can( 'edit_posts' ) ) {
695
  $campaign_ids = array( $_REQUEST['campaign_preview_id'] );
696
  $preview_mode = true;
697
  }
3
  * Plugin Name: Icegram - Popups, Optins, CTAs & lot more...
4
  * Plugin URI: http://www.icegram.com/
5
  * Description: All in one solution to inspire, convert and engage your audiences. Action bars, Popup windows, Messengers, Toast notifications and more. Awesome themes and powerful rules.
6
+ * Version: 1.9.19
7
  * Author: icegram
8
  * Author URI: http://www.icegram.com/
9
  *
35
 
36
  function __construct() {
37
 
38
+ $this->version = "1.9.19";
39
  $this->shortcode_instances = array();
40
  $this->mode = 'local';
41
  $this->plugin_url = untrailingslashit( plugins_url( '/', __FILE__ ) );
192
  //analytics
193
  $admin_notice_text = "<span style='padding:0.5em;'>Measure performance of your Icegram messages with the <b>free Analytics addon</b>.<a class='ig-admin-btn' style='display:inline-block' href='http://www.icegram.com/addons/analytics/?utm_source=inapp&utm_campaign=freebonus&utm_medium=notices' target='_blank'>Cool, Let's begin</a></span>";
194
  $no_offer_text = __('No, I don\'t like offers...','icegram');
195
+ $option_name = 'dismiss_admin_notice_from';
196
  }
197
  $offer_content = array();
198
  $offer_content = apply_filters('ig_in_app_offers', $offer_content);
214
  }
215
  //Admin notice for Rainmaker
216
  $admin_notice_for_rm = '';
217
+ if(('install_plugins') && !in_array('icegram-rainmaker/icegram-rainmaker.php', $active_plugins) && !get_option('ig_rm_notice_icegram')){
218
  $url = wp_nonce_url(self_admin_url('update.php?action=install-plugin&plugin=' . 'icegram-rainmaker'), 'install-plugin_' . 'icegram-rainmaker');
219
+ $admin_notice_text_for_rm = "Icegram recommends <b>Rainmaker</b>";
220
+ echo '<div class="notice notice-warning"> <p> '.$admin_notice_text_for_rm.'<a style="display:inline-block" class="ig-admin-btn" href="'.$url.'">'.__('Begin installation','icegram').'</a><a style="display:inline-block" class="ig-admin-btn ig-admin-btn-secondary" href="?dismiss_admin_notice=1&option_name=ig_rm_notice">'.__('No, I don\'t need it', 'icegram').'</a></p></div>';
221
  }
222
 
223
 
224
  }
225
  public function dismiss_admin_notice(){
226
  if(isset($_GET['dismiss_admin_notice']) && $_GET['dismiss_admin_notice'] == '1' && isset($_GET['option_name'])){
227
+ $option_name = sanitize_text_field($_GET['option_name']);
228
+ update_option($option_name.'_icegram', true);
229
  wp_safe_redirect($_SERVER['HTTP_REFERER']);
230
  exit();
231
  }
233
 
234
  //add in app promotion offers here
235
  public function add_in_app_offer($offer_content){
 
 
 
 
 
 
 
 
 
 
 
 
 
 
236
  return $offer_content;
237
  }
238
 
365
  jQuery('#icegram_housekeeping_response').text("");
366
  params = jQuery("form[name=icegram_housekeeping]").serializeArray();
367
  params.push( {name: 'action', value: 'icegram_run_housekeeping' });
368
+ params.push( {name: 'security', value: <?php echo wp_create_nonce('ig_run_housekeeping'); ?> });
369
 
370
  jQuery.ajax({
371
  method: 'POST',
385
  }
386
  }
387
  public function run_housekeeping() {
388
+ check_ajax_referer('ig_run_housekeeping', 'security');
389
+ global $wpdb, $current_user;
390
  $params = $_POST;
391
  $_POST = array();
392
+ if(current_user_can( 'manage_options' ) && !empty($params['icegram_remove_shortcodes']) && $params['icegram_remove_shortcodes'] == 'yes') {
 
393
  // first get all posts with [icegram] shortcode in them
394
  $sql = "SELECT * FROM `$wpdb->posts` WHERE `post_content` LIKE '%[icegram %]%' and `post_type` != 'revision' ";
395
  $posts = $wpdb->get_results($sql, OBJECT);
569
  wp_localize_script( 'ig_gallery_js', '_wpThemeSettings', array(
570
  'themes' => array(),
571
  'settings' => array(
572
+ 'canInstall' => ( ! is_multisite() && ( 'install_themes' ) ),
573
+ 'installURI' => ( ! is_multisite() && ( 'install_themes' ) ) ? admin_url( 'theme-install.php' ) : null,
574
  'confirmDelete' => __( "Are you sure you want to delete this theme?\n\nClick 'Cancel' to go back, 'OK' to confirm the delete." ),
575
  'adminUrl' => parse_url( admin_url(), PHP_URL_PATH ),
576
  ),
627
  'messages' => '',
628
  'skip_others' => 'no'
629
  ), $atts );
630
+
631
  $class[] = "ig_shortcode_container";
632
  $html[] = "<div id='icegram_shortcode_{$i}'";
633
  if(!empty($atts['campaigns']) && !empty($content)){
666
 
667
  $skip_others = $preview_mode = false;
668
  $campaign_ids = $message_ids = array();
 
669
  $this->shortcode_instances = ($this->cache_compatibility == 'yes' && !empty($_REQUEST['shortcodes'])) ? $_REQUEST['shortcodes'] : $this->shortcode_instances;
670
  // Pull in message and campaign IDs from shortcodes - if set
671
  if( !empty( $this->shortcode_instances ) ) {
679
  $message_ids = array_merge($message_ids, $mids);
680
  }
681
  }
682
+ if( !empty( $_REQUEST['campaign_preview_id'] ) && ( 'edit_posts' ) ) {
683
  $campaign_ids = array( $_REQUEST['campaign_preview_id'] );
684
  $preview_mode = true;
685
  }
readme.txt CHANGED
@@ -3,8 +3,8 @@ Contributors: icegram, storeapps, niravmehta, putler
3
  Donate link: http://www.icegram.com/
4
  Tags: popup, window, hellobar, optin, lead capture, marketing, form, notification, messenger, targeting, monster, ninja ,wordpress lead generation, wordpress lightbox optin, wordpress lightbox optin form, wordpress lightbox optins, wordpress mobile optin forms, wordpress mobile popup, wordpress mobile popups, wordpress optin form, wordpress overlay popup, wordpress popup, wordpress popup form, wordpress popup plugin, wordpress popup solution, wordpress popups , popups, subscribe, wp popups, optin bars, action grabber, constant contact, toast notifications, leads, lists, builder, action bar, floating bar, footer bar, hellobar alternative, pop over, Popup plugin, aweber, campaign monitor, constant contact, email list, exit-intent, getresponse, analytics, Hubspot, icontact, infusionsoft, newsletter, Mailing list pop-up, retargeting, Animation,Popups with Animation ,Responsive Popup, split testing, AB testing
5
  Requires at least: 3.9
6
- Tested up to: 4.5.2
7
- Stable tag: 1.9.18
8
  License: GPLv3
9
  License URI: http://www.gnu.org/licenses/gpl-3.0.html
10
 
@@ -153,6 +153,9 @@ Contact Us, provide as much detail of the problem as you can. We will try to sol
153
  3. Editing an Icegram campaign - add multiple messages, edit them, targeting rules, full HTML editor, themes and more
154
 
155
  == Upgrade Notice ==
 
 
 
156
  = 1.9.18 =
157
  Compatibility with Icegram's CTA addon and Rainmaker
158
 
@@ -284,6 +287,8 @@ Initial Release
284
 
285
 
286
  == Changelog ==
 
 
287
 
288
  = 1.9.18 =
289
  * Fix: Compatibility with Icegram's CTA addon and Rainmaker
3
  Donate link: http://www.icegram.com/
4
  Tags: popup, window, hellobar, optin, lead capture, marketing, form, notification, messenger, targeting, monster, ninja ,wordpress lead generation, wordpress lightbox optin, wordpress lightbox optin form, wordpress lightbox optins, wordpress mobile optin forms, wordpress mobile popup, wordpress mobile popups, wordpress optin form, wordpress overlay popup, wordpress popup, wordpress popup form, wordpress popup plugin, wordpress popup solution, wordpress popups , popups, subscribe, wp popups, optin bars, action grabber, constant contact, toast notifications, leads, lists, builder, action bar, floating bar, footer bar, hellobar alternative, pop over, Popup plugin, aweber, campaign monitor, constant contact, email list, exit-intent, getresponse, analytics, Hubspot, icontact, infusionsoft, newsletter, Mailing list pop-up, retargeting, Animation,Popups with Animation ,Responsive Popup, split testing, AB testing
5
  Requires at least: 3.9
6
+ Tested up to: 4.5.3
7
+ Stable tag: 1.9.19
8
  License: GPLv3
9
  License URI: http://www.gnu.org/licenses/gpl-3.0.html
10
 
153
  3. Editing an Icegram campaign - add multiple messages, edit them, targeting rules, full HTML editor, themes and more
154
 
155
  == Upgrade Notice ==
156
+ = 1.9.19 =
157
+ Secured Icegram from XSS vulnerability
158
+
159
  = 1.9.18 =
160
  Compatibility with Icegram's CTA addon and Rainmaker
161
 
287
 
288
 
289
  == Changelog ==
290
+ = 1.9.19 =
291
+ * Fix: Secured Icegram from XSS vulnerability(Thanks to Ipstenu (Mika Epstein))
292
 
293
  = 1.9.18 =
294
  * Fix: Compatibility with Icegram's CTA addon and Rainmaker
settings.php CHANGED
@@ -3,12 +3,12 @@ if ( !defined( 'ABSPATH' ) ) exit;
3
 
4
  if( isset( $_POST['submit'] ) ) {
5
  if( isset( $_POST['icegram_share_love'] ) ) {
6
- update_option( 'icegram_share_love', $_POST['icegram_share_love'] );
7
  } else {
8
  update_option( 'icegram_share_love', 'no' );
9
  }
10
  if( isset( $_POST['icegram_cache_compatibility'] ) ) {
11
- update_option( 'icegram_cache_compatibility', $_POST['icegram_cache_compatibility'] );
12
  } else {
13
  update_option( 'icegram_cache_compatibility', 'no' );
14
  }
3
 
4
  if( isset( $_POST['submit'] ) ) {
5
  if( isset( $_POST['icegram_share_love'] ) ) {
6
+ update_option( 'icegram_share_love', sanitize_text_field($_POST['icegram_share_love']) );
7
  } else {
8
  update_option( 'icegram_share_love', 'no' );
9
  }
10
  if( isset( $_POST['icegram_cache_compatibility'] ) ) {
11
+ update_option( 'icegram_cache_compatibility', sanitize_text_field($_POST['icegram_cache_compatibility']) );
12
  } else {
13
  update_option( 'icegram_cache_compatibility', 'no' );
14
  }