Link Library - Version 7.2.9

Version Description

  • Fixed additional potential security issues
Download this release

Release Info

Developer jackdewey
Plugin Icon 128x128 Link Library
Version 7.2.9
Comparing to
See all releases

Code changes from version 7.2.8 to 7.2.9

Files changed (10) hide show
  1. link-library-admin.php +27 -20
  2. link-library.php +12 -4
  3. readme.txt +4 -1
  4. render-link-library-addlink-sc.php +1 -1
  5. render-link-library-alpha-filter.php +1 -1
  6. render-link-library-cats-sc.php +6 -6
  7. render-link-library-sc.php +19 -19
  8. render-link-library-search-sc.php +5 -5
  9. render-link-library-tag-filter-sc.php +4 -4
  10. render-rss-library-sc.php +1 -1
link-library-admin.php CHANGED
@@ -596,11 +596,10 @@ class link_library_plugin_admin {
596
  */
597
 
598
  function action_admin_init() {
599
-
600
- if ( isset($_GET['page']) && $_GET['page'] == 'link-library-faq' ) {
601
  wp_redirect( 'https://github.com/ylefebvre/link-library/wiki' );
602
  exit();
603
- } elseif ( isset($_GET['page']) && $_GET['page'] == 'link-library-donate' ) {
604
  wp_redirect( 'https://ylefebvre.github.io/wordpress-plugins/link-library/' );
605
  exit();
606
  } elseif ( !empty( $_GET['linkurl'] ) && !empty( $_GET['action'] ) ) {
@@ -909,14 +908,14 @@ wp_editor( $post->post_content, 'content', $editor_config );
909
  //we need the global screen column value to beable to have a sidebar in WordPress 2.8
910
  global $screen_layout_columns;
911
 
912
- $settings = ( isset( $_GET['settings'] ) && is_int( intval( $_GET['settings'] ) ) ? $_GET['settings'] : 1 );
913
 
914
  if ( isset( $_GET['settingscopy'] ) ) {
915
  check_admin_referer( 'llsettingscopy' );
916
 
917
- if ( is_int( intval( $_GET['settingscopy'] ) ) && is_int( intval( $_GET['source'] ) ) ) {
918
- $destination = $_GET['settingscopy'];
919
- $source = $_GET['source'];
920
 
921
  $sourcesettingsname = 'LinkLibraryPP' . $source;
922
  $sourceoptions = get_option( $sourcesettingsname );
@@ -931,11 +930,9 @@ wp_editor( $post->post_content, 'content', $editor_config );
931
  if ( isset( $_GET['deletesettings'] ) ) {
932
  check_admin_referer( 'link-library-delete' );
933
 
934
- if ( is_int( intval( $_GET['deletesettings'] ) ) ) {
935
- $settings = $_GET['deletesettings'];
936
- $deletesettingsname = 'LinkLibraryPP' . $settings;
937
- $options = delete_option( $deletesettingsname );
938
- }
939
 
940
  $settings = 1;
941
  }
@@ -958,6 +955,14 @@ wp_editor( $post->post_content, 'content', $editor_config );
958
  }
959
 
960
  if ( isset( $_GET['genthumbs'] ) || isset( $_GET['genfavicons'] ) || isset( $_GET['genthumbsingle'] ) || isset( $_GET['genfaviconsingle'] ) ) {
 
 
 
 
 
 
 
 
961
  if ( isset( $_GET['genthumbs'] ) || isset( $_GET['genthumbsingle'] ) ) {
962
  $filepath = "link-library-images";
963
  } elseif ( isset( $_GET['genfavicons'] ) || isset( $_GET['genfaviconsingle'] ) ) {
@@ -1032,6 +1037,7 @@ wp_editor( $post->post_content, 'content', $editor_config );
1032
  }
1033
  }
1034
  } elseif ( isset( $_GET['deleteallthumbs'] ) ) {
 
1035
  $uploads = wp_upload_dir();
1036
 
1037
  if ( file_exists( $uploads['basedir'] ) ) {
@@ -1043,6 +1049,7 @@ wp_editor( $post->post_content, 'content', $editor_config );
1043
  }
1044
  }
1045
  } elseif ( isset( $_GET['deleteallicons'] ) ) {
 
1046
  $uploads = wp_upload_dir();
1047
 
1048
  if ( file_exists( $uploads['basedir'] ) ) {
@@ -1068,7 +1075,7 @@ wp_editor( $post->post_content, 'content', $editor_config );
1068
  } else if ( isset( $_GET['message'] ) && $_GET['message'] == '8' ) {
1069
  echo "<div id='message' class='updated fade'><p><strong>" . __( 'Failed to import Global Options', 'link-library' ) . "</strong></p></div>";
1070
  } else if ( isset( $_GET['message'] ) && $_GET['message'] == '9' ) {
1071
- echo "<div id='message' class='updated fade'><p><strong>" . $_GET['importrowscount'] . " " . __( 'row(s) found', 'link-library' ) . ". " . ( isset( $_GET['successimportcount'] ) ? intval( $_GET['successimportcount'] ) : '0' ) . " " . __( 'link(s) imported', 'link-library' ) . ", " . ( isset( $_GET['successupdatecount'] ) ? intval( $_GET['successupdatecount'] ): '0' ) . " " . __( 'link(s) updated', 'link-library' ) . ".</strong></p></div>";
1072
  }
1073
 
1074
  $formvalue = 'save_link_library_general';
@@ -6311,16 +6318,16 @@ function general_custom_fields_meta_box( $data ) {
6311
  <td><?php _e( 'Generate Images / Favorite Icons', 'link-library' ); ?></td>
6312
  <td class="lltooltip" title="<?php if ( $genoptions['thumbnailgenerator'] == 'thumbshots' && empty( $genoptions['thumbshotscid'] ) ) {
6313
  _e( 'This button is only available when a valid API key is entered under the Link Library General Settings.', 'link-library' );
6314
- } ?>"><INPUT class="button" type="button" name="genthumbs" <?php disabled( $genoptions['thumbnailgenerator'] == 'thumbshots' && empty( $genoptions['thumbshotscid'] ) ); ?> value="<?php _e( 'Generate Thumbnails and Store locally', 'link-library' ); ?>" onClick="window.location= 'admin.php?page=link-library-settingssets&amp;settings=<?php echo $settings; ?>&amp;genthumbs=<?php echo $settings; ?>'">
6315
  </td>
6316
  <td>
6317
- <INPUT class="button" type="button" name="genfavicons" value="<?php _e( 'Generate Favorite Icons and Store locally', 'link-library' ); ?>" onClick="window.location= 'admin.php?page=link-library-settingssets&amp;settings=<?php echo $settings; ?>&amp;genfavicons=<?php echo $settings; ?>'">
6318
  </td>
6319
  </tr>
6320
  <tr>
6321
  <td><?php _e( 'Delete all local thumbnails and icons', 'link-library' ); ?></td>
6322
- <td><INPUT class="button" type="button" name="deleteallthumbs" value="<?php _e( 'Delete all local thumbnails', 'link-library' ); ?>" onClick="window.location= 'admin.php?page=link-library-settingssets&amp;deleteallthumbs=1'"></td>
6323
- <td><INPUT class="button" type="button" name="deleteallicons" value="<?php _e( 'Delete all local icons', 'link-library' ); ?>" onClick="window.location= 'admin.php?page=link-library-settingssets&amp;deleteallicons=1'"></td>
6324
  </tr>
6325
  </table>
6326
  </div>
@@ -7348,10 +7355,10 @@ function general_custom_fields_meta_box( $data ) {
7348
  }
7349
 
7350
  $link_description = get_post_meta( $link->ID, 'link_description', true );
7351
- $link_description = htmlentities( $link_description );
7352
 
7353
  if ( empty( $link_description ) && isset( $_GET['link_description'] ) ) {
7354
- $link_description = urldecode( $_GET['link_description'] );
7355
  }
7356
 
7357
  $link_textfield = get_post_meta( $link->ID, 'link_textfield', true );
@@ -7369,7 +7376,7 @@ function general_custom_fields_meta_box( $data ) {
7369
  }
7370
 
7371
  $link_notes = get_post_meta( $link->ID, 'link_notes', true );
7372
- $link_notes = htmlentities( $link_notes );
7373
  wp_nonce_field( plugin_basename( __FILE__ ), 'link_edit_nonce' );
7374
 
7375
  if ( isset( $_GET['existinglink'] ) && 'true' == $_GET['existinglink'] ) {
596
  */
597
 
598
  function action_admin_init() {
599
+ if ( isset( $_GET['page'] ) && $_GET['page'] == 'link-library-faq' ) {
 
600
  wp_redirect( 'https://github.com/ylefebvre/link-library/wiki' );
601
  exit();
602
+ } elseif ( isset( $_GET['page'] ) && $_GET['page'] == 'link-library-donate' ) {
603
  wp_redirect( 'https://ylefebvre.github.io/wordpress-plugins/link-library/' );
604
  exit();
605
  } elseif ( !empty( $_GET['linkurl'] ) && !empty( $_GET['action'] ) ) {
908
  //we need the global screen column value to beable to have a sidebar in WordPress 2.8
909
  global $screen_layout_columns;
910
 
911
+ $settings = ( isset( $_GET['settings'] ) ? intval( $_GET['settings'] ) : 1 );
912
 
913
  if ( isset( $_GET['settingscopy'] ) ) {
914
  check_admin_referer( 'llsettingscopy' );
915
 
916
+ if ( isset( $_GET['settingscopy'] ) && isset( $_GET['source'] ) ) {
917
+ $destination = intval( $_GET['settingscopy'] );
918
+ $source = intval( $_GET['source'] );
919
 
920
  $sourcesettingsname = 'LinkLibraryPP' . $source;
921
  $sourceoptions = get_option( $sourcesettingsname );
930
  if ( isset( $_GET['deletesettings'] ) ) {
931
  check_admin_referer( 'link-library-delete' );
932
 
933
+ $settings = intval( $_GET['deletesettings'] );
934
+ $deletesettingsname = 'LinkLibraryPP' . $settings;
935
+ $options = delete_option( $deletesettingsname );
 
 
936
 
937
  $settings = 1;
938
  }
955
  }
956
 
957
  if ( isset( $_GET['genthumbs'] ) || isset( $_GET['genfavicons'] ) || isset( $_GET['genthumbsingle'] ) || isset( $_GET['genfaviconsingle'] ) ) {
958
+ if ( isset( $_GET['genthumbs'] ) ) {
959
+ check_admin_referer( 'llgenthumbs' );
960
+ }
961
+
962
+ if ( isset( $_GET['genfavicons'] ) ) {
963
+ check_admin_referer( 'llgenfavicons' );
964
+ }
965
+
966
  if ( isset( $_GET['genthumbs'] ) || isset( $_GET['genthumbsingle'] ) ) {
967
  $filepath = "link-library-images";
968
  } elseif ( isset( $_GET['genfavicons'] ) || isset( $_GET['genfaviconsingle'] ) ) {
1037
  }
1038
  }
1039
  } elseif ( isset( $_GET['deleteallthumbs'] ) ) {
1040
+ check_admin_referer( 'lldeleteallthumbs' );
1041
  $uploads = wp_upload_dir();
1042
 
1043
  if ( file_exists( $uploads['basedir'] ) ) {
1049
  }
1050
  }
1051
  } elseif ( isset( $_GET['deleteallicons'] ) ) {
1052
+ check_admin_referer( 'lldeleteallicons' );
1053
  $uploads = wp_upload_dir();
1054
 
1055
  if ( file_exists( $uploads['basedir'] ) ) {
1075
  } else if ( isset( $_GET['message'] ) && $_GET['message'] == '8' ) {
1076
  echo "<div id='message' class='updated fade'><p><strong>" . __( 'Failed to import Global Options', 'link-library' ) . "</strong></p></div>";
1077
  } else if ( isset( $_GET['message'] ) && $_GET['message'] == '9' ) {
1078
+ echo "<div id='message' class='updated fade'><p><strong>" . intval( $_GET['importrowscount'] ) . " " . __( 'row(s) found', 'link-library' ) . ". " . ( isset( $_GET['successimportcount'] ) ? intval( $_GET['successimportcount'] ) : '0' ) . " " . __( 'link(s) imported', 'link-library' ) . ", " . ( isset( $_GET['successupdatecount'] ) ? intval( $_GET['successupdatecount'] ): '0' ) . " " . __( 'link(s) updated', 'link-library' ) . ".</strong></p></div>";
1079
  }
1080
 
1081
  $formvalue = 'save_link_library_general';
6318
  <td><?php _e( 'Generate Images / Favorite Icons', 'link-library' ); ?></td>
6319
  <td class="lltooltip" title="<?php if ( $genoptions['thumbnailgenerator'] == 'thumbshots' && empty( $genoptions['thumbshotscid'] ) ) {
6320
  _e( 'This button is only available when a valid API key is entered under the Link Library General Settings.', 'link-library' );
6321
+ } ?>"><INPUT class="button" type="button" name="genthumbs" <?php disabled( $genoptions['thumbnailgenerator'] == 'thumbshots' && empty( $genoptions['thumbshotscid'] ) ); ?> value="<?php _e( 'Generate Thumbnails and Store locally', 'link-library' ); ?>" onClick="window.location= 'admin.php?page=link-library-settingssets&amp;settings=<?php echo $settings; ?>&amp;_wpnonce=<?php echo wp_create_nonce( 'llgenthumbs' ); ?>&amp;genthumbs=<?php echo $settings; ?>'">
6322
  </td>
6323
  <td>
6324
+ <INPUT class="button" type="button" name="genfavicons" value="<?php _e( 'Generate Favorite Icons and Store locally', 'link-library' ); ?>" onClick="window.location= 'admin.php?page=link-library-settingssets&amp;settings=<?php echo $settings; ?>&amp;_wpnonce=<?php echo wp_create_nonce( 'llgenfavicons' ); ?>&amp;genfavicons=<?php echo $settings; ?>'">
6325
  </td>
6326
  </tr>
6327
  <tr>
6328
  <td><?php _e( 'Delete all local thumbnails and icons', 'link-library' ); ?></td>
6329
+ <td><INPUT class="button" type="button" name="deleteallthumbs" value="<?php _e( 'Delete all local thumbnails', 'link-library' ); ?>" onClick="window.location= 'admin.php?page=link-library-settingssets&amp;deleteallthumbs=1&amp;_wpnonce=<?php echo wp_create_nonce( 'lldeleteallthumbs' ); ?>'"></td>
6330
+ <td><INPUT class="button" type="button" name="deleteallicons" value="<?php _e( 'Delete all local icons', 'link-library' ); ?>" onClick="window.location= 'admin.php?page=link-library-settingssets&amp;deleteallicons=1&amp;_wpnonce=<?php echo wp_create_nonce( 'lldeleteallicons' ); ?>'"></td>
6331
  </tr>
6332
  </table>
6333
  </div>
7355
  }
7356
 
7357
  $link_description = get_post_meta( $link->ID, 'link_description', true );
7358
+ $link_description = esc_html( $link_description );
7359
 
7360
  if ( empty( $link_description ) && isset( $_GET['link_description'] ) ) {
7361
+ $link_description = sanitize_text_field( urldecode( $_GET['link_description'] ) );
7362
  }
7363
 
7364
  $link_textfield = get_post_meta( $link->ID, 'link_textfield', true );
7376
  }
7377
 
7378
  $link_notes = get_post_meta( $link->ID, 'link_notes', true );
7379
+ $link_notes = esc_html( $link_notes );
7380
  wp_nonce_field( plugin_basename( __FILE__ ), 'link_edit_nonce' );
7381
 
7382
  if ( isset( $_GET['existinglink'] ) && 'true' == $_GET['existinglink'] ) {
link-library.php CHANGED
@@ -3,7 +3,7 @@
3
  Plugin Name: Link Library
4
  Plugin URI: http://wordpress.org/extend/plugins/link-library/
5
  Description: Display links on pages with a variety of options
6
- Version: 7.2.8
7
  Author: Yannick Lefebvre
8
  Author URI: http://ylefebvre.github.io/
9
  Text Domain: link-library
@@ -763,11 +763,19 @@ class link_library_plugin {
763
 
764
  require plugin_dir_path( __FILE__ ) . 'link-library-update-60.php';
765
  link_library_60_update( $this );
766
- } elseif ( isset( $_GET['continue60update'] ) ) {
 
 
 
 
767
  require plugin_dir_path( __FILE__ ) . 'link-library-update-60.php';
768
  link_library_60_update( $this, true );
769
- } else {
770
  if ( ( false == $link_library_60_update && !empty( $genoptions ) ) ) {
 
 
 
 
771
  require plugin_dir_path( __FILE__ ) . 'link-library-update-60.php';
772
  link_library_60_update( $this );
773
  }
@@ -1026,7 +1034,7 @@ class link_library_plugin {
1026
  $genoptions = get_option( 'LinkLibraryGeneral' );
1027
 
1028
  $categoryname = ( isset( $wp_query->query_vars['cat_name'] ) ? $wp_query->query_vars['cat_name'] : '' );
1029
- $catid = ( isset( $_GET['cat_id'] ) ? intval($_GET['cat_id']) : '' );
1030
 
1031
  $linkcatquery = 'SELECT t.name ';
1032
  $linkcatquery .= 'FROM ' . $this->db_prefix() . 'terms t LEFT JOIN ' . $this->db_prefix(). 'term_taxonomy tt ON (t.term_id = tt.term_id) ';
3
  Plugin Name: Link Library
4
  Plugin URI: http://wordpress.org/extend/plugins/link-library/
5
  Description: Display links on pages with a variety of options
6
+ Version: 7.2.9
7
  Author: Yannick Lefebvre
8
  Author URI: http://ylefebvre.github.io/
9
  Text Domain: link-library
763
 
764
  require plugin_dir_path( __FILE__ ) . 'link-library-update-60.php';
765
  link_library_60_update( $this );
766
+ } /* elseif ( isset( $_GET['continue60update'] ) ) {
767
+ if ( !current_user_can( 'manage_options' ) ) {
768
+ return;
769
+ }
770
+
771
  require plugin_dir_path( __FILE__ ) . 'link-library-update-60.php';
772
  link_library_60_update( $this, true );
773
+ } */ else {
774
  if ( ( false == $link_library_60_update && !empty( $genoptions ) ) ) {
775
+ if ( !current_user_can( 'manage_options' ) ) {
776
+ return;
777
+ }
778
+
779
  require plugin_dir_path( __FILE__ ) . 'link-library-update-60.php';
780
  link_library_60_update( $this );
781
  }
1034
  $genoptions = get_option( 'LinkLibraryGeneral' );
1035
 
1036
  $categoryname = ( isset( $wp_query->query_vars['cat_name'] ) ? $wp_query->query_vars['cat_name'] : '' );
1037
+ $catid = ( isset( $_GET['cat_id'] ) ? intval( $_GET['cat_id'] ) : '' );
1038
 
1039
  $linkcatquery = 'SELECT t.name ';
1040
  $linkcatquery .= 'FROM ' . $this->db_prefix() . 'terms t LEFT JOIN ' . $this->db_prefix(). 'term_taxonomy tt ON (t.term_id = tt.term_id) ';
readme.txt CHANGED
@@ -4,7 +4,7 @@ Donate link: https://ylefebvre.github.io/wordpress-plugins/link-library/
4
  Tags: link, list, directory, page, library, AJAX, RSS, feeds, inline, search, paging, add, submit, import, batch, pop-up
5
  Requires at least: 4.4
6
  Tested up to: 5.8
7
- Stable tag: 7.2.8
8
 
9
  The purpose of this plugin is to add the ability to output a list of link categories and a complete list of links with notes and descriptions.
10
 
@@ -48,6 +48,9 @@ Further configuration is available under the Link Library Settings panel.
48
 
49
  == Changelog ==
50
 
 
 
 
51
  = 7.2.8 =
52
  * Fixed potential security issues in plugin admin section
53
 
4
  Tags: link, list, directory, page, library, AJAX, RSS, feeds, inline, search, paging, add, submit, import, batch, pop-up
5
  Requires at least: 4.4
6
  Tested up to: 5.8
7
+ Stable tag: 7.2.9
8
 
9
  The purpose of this plugin is to add the ability to output a list of link categories and a complete list of links with notes and descriptions.
10
 
48
 
49
  == Changelog ==
50
 
51
+ = 7.2.9 =
52
+ * Fixed additional potential security issues
53
+
54
  = 7.2.8 =
55
  * Fixed potential security issues in plugin admin section
56
 
render-link-library-addlink-sc.php CHANGED
@@ -877,7 +877,7 @@ function RenderLinkLibraryAddLinkForm( $LLPluginClass, $generaloptions, $library
877
  if ( !empty( $categorysluglist ) ) {
878
  $link_categories_query_args['slug'] = explode( ',', $categorysluglist );
879
  } elseif ( isset( $_GET['catslug'] ) ) {
880
- $link_categories_query_args['slug'] = $_GET['catslug'];
881
  }
882
  $link_categories_query_args['include'] = array();
883
  $link_categories_query_args['exclude'] = array();
877
  if ( !empty( $categorysluglist ) ) {
878
  $link_categories_query_args['slug'] = explode( ',', $categorysluglist );
879
  } elseif ( isset( $_GET['catslug'] ) ) {
880
+ $link_categories_query_args['slug'] = sanitize_text_field( $_GET['catslug'] );
881
  }
882
  $link_categories_query_args['include'] = array();
883
  $link_categories_query_args['exclude'] = array();
render-link-library-alpha-filter.php CHANGED
@@ -55,7 +55,7 @@ function RenderLinkLibraryAlphaFilter( $LLPluginClass, $generaloptions, $library
55
  $currentcatletter = '';
56
  if ( isset( $_GET['catletter'] ) && 'normal' == $searchmode ) {
57
  if ( isset( $_GET['catletter'] ) && strlen( $_GET['catletter'] ) == 1 ) {
58
- $currentcatletter = $_GET['catletter'];
59
  }
60
  } elseif ( 'normal' == $searchmode ) {
61
  if ( $cat_letter_filter_autoselect ) {
55
  $currentcatletter = '';
56
  if ( isset( $_GET['catletter'] ) && 'normal' == $searchmode ) {
57
  if ( isset( $_GET['catletter'] ) && strlen( $_GET['catletter'] ) == 1 ) {
58
+ $currentcatletter = sanitize_text_field( $_GET['catletter'] );
59
  }
60
  } elseif ( 'normal' == $searchmode ) {
61
  if ( $cat_letter_filter_autoselect ) {
render-link-library-cats-sc.php CHANGED
@@ -47,7 +47,7 @@ function RenderLinkLibraryCategories( $LLPluginClass, $generaloptions, $libraryo
47
  if ( isset($_GET['cat_id'] ) ) {
48
  $categoryid = intval( $_GET['cat_id'] );
49
  } elseif ( isset( $_GET['catname'] ) ) {
50
- $categoryterm = get_term_by( 'name', urldecode( $_GET['catname'] ), 'link_library_category' );
51
  $categoryid = $categoryterm->term_id;
52
  } elseif ( $showonecatonly ) {
53
  $categoryid = $defaultsinglecat_cpt;
@@ -300,7 +300,7 @@ function RenderLinkLibraryCategories( $LLPluginClass, $generaloptions, $libraryo
300
  }
301
 
302
  if ( isset( $_GET['searchll'] ) ) {
303
- $searchstring = $_GET['searchll'];
304
  if ( !empty( $searchstring ) ) {
305
  $link_query_args['s'] = $searchstring;
306
  }
@@ -390,7 +390,7 @@ function RenderLinkLibraryCategories( $LLPluginClass, $generaloptions, $libraryo
390
 
391
  $cattargetaddress = add_query_arg( 'cat_id', $catname->term_id, '');
392
  if ( $searchfiltercats && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
393
- $cattargetaddress = add_query_arg( 'searchll', $_GET['searchll'], $cattargetaddress );
394
  }
395
 
396
  $cattext .= $cattargetaddress;
@@ -405,7 +405,7 @@ function RenderLinkLibraryCategories( $LLPluginClass, $generaloptions, $libraryo
405
 
406
  $cattargetaddress = add_query_arg( 'catslug', $catname->slug, '');
407
  if ( $searchfiltercats && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
408
- $cattargetaddress = add_query_arg( 'searchll', $_GET['searchll'], $cattargetaddress );
409
  }
410
 
411
  $cattext .= $cattargetaddress;
@@ -439,7 +439,7 @@ function RenderLinkLibraryCategories( $LLPluginClass, $generaloptions, $libraryo
439
 
440
  $cattargetaddress = esc_url( site_url() . '/' . $rewritepage . '/' . $catname->slug );
441
  if ( $searchfiltercats && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
442
- $cattargetaddress = add_query_arg( 'searchll', $_GET['searchll'], $cattargetaddress );
443
  }
444
 
445
  $cattext .= $cattargetaddress;
@@ -455,7 +455,7 @@ function RenderLinkLibraryCategories( $LLPluginClass, $generaloptions, $libraryo
455
  }
456
 
457
  if ( $searchfiltercats && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
458
- $cattext .= '?searchll=' . $_GET['searchll'] . '&cat_id=' . $catname->term_id;
459
  } elseif ( 'toggles' != $flatlist ) {
460
  $cattext .= '#' . $catname->slug;
461
  }
47
  if ( isset($_GET['cat_id'] ) ) {
48
  $categoryid = intval( $_GET['cat_id'] );
49
  } elseif ( isset( $_GET['catname'] ) ) {
50
+ $categoryterm = get_term_by( 'name', sanitize_text_field( urldecode( $_GET['catname'] ) ), 'link_library_category' );
51
  $categoryid = $categoryterm->term_id;
52
  } elseif ( $showonecatonly ) {
53
  $categoryid = $defaultsinglecat_cpt;
300
  }
301
 
302
  if ( isset( $_GET['searchll'] ) ) {
303
+ $searchstring = sanitize_text_field( $_GET['searchll'] );
304
  if ( !empty( $searchstring ) ) {
305
  $link_query_args['s'] = $searchstring;
306
  }
390
 
391
  $cattargetaddress = add_query_arg( 'cat_id', $catname->term_id, '');
392
  if ( $searchfiltercats && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
393
+ $cattargetaddress = add_query_arg( 'searchll', sanitize_text_field( $_GET['searchll'] ), $cattargetaddress );
394
  }
395
 
396
  $cattext .= $cattargetaddress;
405
 
406
  $cattargetaddress = add_query_arg( 'catslug', $catname->slug, '');
407
  if ( $searchfiltercats && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
408
+ $cattargetaddress = add_query_arg( 'searchll', sanitize_text_field( $_GET['searchll'] ), $cattargetaddress );
409
  }
410
 
411
  $cattext .= $cattargetaddress;
439
 
440
  $cattargetaddress = esc_url( site_url() . '/' . $rewritepage . '/' . $catname->slug );
441
  if ( $searchfiltercats && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
442
+ $cattargetaddress = add_query_arg( 'searchll', sanitize_text_field( $_GET['searchll'] ), $cattargetaddress );
443
  }
444
 
445
  $cattext .= $cattargetaddress;
455
  }
456
 
457
  if ( $searchfiltercats && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
458
+ $cattext .= '?searchll=' . sanitize_text_field( $_GET['searchll'] ) . '&cat_id=' . $catname->term_id;
459
  } elseif ( 'toggles' != $flatlist ) {
460
  $cattext .= '#' . $catname->slug;
461
  }
render-link-library-sc.php CHANGED
@@ -38,11 +38,11 @@ function link_library_get_breadcrumb_path( $slug, $rewritepage, $level = 0 ) {
38
 
39
  $new_link = esc_url( home_url() . '/' . $rewritepage . '/' . $slug );
40
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
41
- $new_link = add_query_arg( 'link_tags', $_GET['link_tags'], $new_link );
42
  }
43
 
44
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
45
- $new_link = add_query_arg( 'link_price', $_GET['link_price'], $new_link );
46
  }
47
 
48
  if ( $level != 0 ) {
@@ -52,10 +52,10 @@ function link_library_get_breadcrumb_path( $slug, $rewritepage, $level = 0 ) {
52
  $new_top_link = esc_url( home_url() . '/' . $rewritepage );
53
 
54
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
55
- $new_top_link = add_query_arg( 'link_tags', $_GET['link_tags'], $new_top_link );
56
  }
57
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
58
- $new_top_link = add_query_arg( 'link_price', $_GET['link_price'], $new_top_link );
59
  }
60
 
61
  $cat_path = '<a href="' . $new_top_link . '">Home</a> - ' . $cat_path;
@@ -291,7 +291,7 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
291
 
292
  if ( $level == 0 && ( ( isset( $_GET['cat_name'] ) && !empty( $_GET['cat_name'] ) ) || ( isset( $wp_query->query_vars['cat_name'] ) && !empty( $wp_query->query_vars['cat_name'] ) ) ) ) {
293
  if ( !empty( $_GET['cat_name'] ) ) {
294
- $category_entry = get_term_by( 'slug', $_GET['cat_name'], 'link_library_category', OBJECT );
295
  } elseif ( !empty( $wp_query->query_vars['cat_name'] ) ) {
296
  $last_slash_pos = strripos( $wp_query->query_vars['cat_name'], '/' );
297
  if ( $last_slash_pos != 0 ) {
@@ -389,9 +389,9 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
389
  $categorylist_cpt = intval( $_GET['cat_id'] );
390
  $AJAXcatid = $categorylist_cpt;
391
  } elseif ( ( $showonecatonly && 'HTMLGETSLUG' == $showonecatmode && isset( $_GET['catslug'] ) && ( !isset( $_GET['searchll'] ) || ( isset( $_GET['searchll'] ) && empty( $_GET['searchll'] ) ) ) ) || ( $searchfiltercats && isset( $_GET['catslug'] ) && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) ) {
392
- $categorysluglist = $_GET['catslug'];
393
  } elseif ( ( $showonecatonly && 'HTMLGETCATNAME' == $showonecatmode && isset( $_GET['catname'] ) && ( !isset( $_GET['searchll'] ) || ( isset( $_GET['searchll'] ) && empty( $_GET['searchll'] ) ) ) ) || ( $searchfiltercats && isset( $_GET['catname'] ) && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) ) {
394
- $categorynamelist = $_GET['catname'];
395
  } elseif ( $showonecatonly && 'HTMLGETPERM' == $showonecatmode && empty( $_GET['searchll'] ) ) {
396
  global $wp_query;
397
 
@@ -403,7 +403,7 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
403
  $AJAXcatid = $categoryname;
404
  $categorysluglist = '';
405
  if ( isset( $_GET['catslug'] ) ) {
406
- $categorysluglist = $_GET['catslug'];
407
  }
408
  } elseif ( $showonecatonly && ( !isset( $AJAXcatid ) || empty( $AJAXcatid ) ) && !empty( $defaultsinglecat_cpt ) && ( !isset( $_GET['searchll'] ) || ( isset( $_GET['searchll'] ) && empty( $_GET['searchll'] ) ) ) ) {
409
  $categorylist_cpt = $defaultsinglecat_cpt;
@@ -444,7 +444,7 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
444
  if ( !empty( $categorysluglist ) ) {
445
  $show_one_cat_query_args['slug'] = explode( ',', $categorysluglist );
446
  } elseif ( isset( $_GET['catslug'] ) ) {
447
- $show_one_cat_query_args['slug'] = isset( $_GET['catslug'] );
448
  }
449
 
450
  }
@@ -491,7 +491,7 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
491
 
492
  if ( ( isset($_GET['searchll'] ) && !empty( $_GET['searchll'] ) || ( isset( $_POST['searchll'] ) && !empty( $_POST['searchll'] ) ) ) && empty( $singlelinkid ) ) {
493
  if ( isset( $_GET['searchll'] ) ) {
494
- $searchstring = $_GET['searchll'];
495
  } elseif ( isset( $_POST['searchll'] ) ) {
496
  $searchstring = $_POST['searchll'];
497
  }
@@ -568,7 +568,7 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
568
  if ( !empty( $categorysluglist ) ) {
569
  $link_categories_query_args['slug'] = explode( ',', $categorysluglist );
570
  } elseif ( isset( $_GET['catslug'] ) ) {
571
- $link_categories_query_args['slug'] = $_GET['catslug'];
572
  }
573
  $link_categories_query_args['include'] = array();
574
  $link_categories_query_args['exclude'] = array();
@@ -653,7 +653,7 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
653
  $tag_array = array();
654
 
655
  if ( ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) ) {
656
- $tag_array = explode( '.', $_GET['link_tags'] );
657
  } elseif( !empty( $taglist_cpt ) ) {
658
  $tag_array = explode( ',', $taglist_cpt );
659
  }
@@ -709,7 +709,7 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
709
  if ( isset( $_POST['linkresultpage'] ) ) {
710
  $pagenumber = $_POST['linkresultpage'];
711
  } elseif ( isset( $_GET['linkresultpage'] ) ) {
712
- $pagenumber = $_GET['linkresultpage'];
713
  }
714
  $startingitem = ( $pagenumber - 1 ) * $linksperpage + 1;
715
  } else {
@@ -794,7 +794,7 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
794
  $tag_array = array();
795
 
796
  if ( ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) ) {
797
- $tag_array = explode( '.', $_GET['link_tags'] );
798
  } elseif( !empty( $taglist_cpt ) ) {
799
  $tag_array = explode( ',', $taglist_cpt );
800
  }
@@ -952,7 +952,7 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
952
  }
953
 
954
  if ( isset( $_GET['link_letter'] ) && !empty( $_GET['link_letter'] ) ) {
955
- $link_query_args['link_starts_with'] = $_GET['link_letter'];
956
  }
957
 
958
  if ( true == $debugmode ) {
@@ -1166,11 +1166,11 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
1166
  $cat_path = $link_category->slug;
1167
 
1168
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
1169
- $cat_path = add_query_arg( 'link_tags', $_GET['link_tags'], $cat_path );
1170
  }
1171
 
1172
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
1173
- $cat_path = add_query_arg( 'link_price', $_GET['link_price'], $cat_path );
1174
  }
1175
 
1176
  $catlink .= '<a href="' . esc_url( site_url() . '/' . $rewritepage . $cat_path ) . '">';
@@ -1354,11 +1354,11 @@ function RenderLinkLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $s
1354
  }
1355
  $sort_url = add_query_arg( $sorting_labels[$display_item], $sort_direction, '' );
1356
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
1357
- $sort_url = add_query_arg( 'link_tags', $_GET['link_tags'], $sort_url );
1358
  }
1359
 
1360
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
1361
- $sort_url = add_query_arg( 'link_price', $_GET['link_price'], $sort_url );
1362
  }
1363
 
1364
  $catstartlist .= '<a href="' . $sort_url . '">';
38
 
39
  $new_link = esc_url( home_url() . '/' . $rewritepage . '/' . $slug );
40
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
41
+ $new_link = add_query_arg( 'link_tags', sanitize_text_field( $_GET['link_tags'] ), $new_link );
42
  }
43
 
44
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
45
+ $new_link = add_query_arg( 'link_price', sanitize_text_field( $_GET['link_price'] ), $new_link );
46
  }
47
 
48
  if ( $level != 0 ) {
52
  $new_top_link = esc_url( home_url() . '/' . $rewritepage );
53
 
54
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
55
+ $new_top_link = add_query_arg( 'link_tags', sanitize_text_field( $_GET['link_tags'] ), $new_top_link );
56
  }
57
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
58
+ $new_top_link = add_query_arg( 'link_price', sanitize_text_field( $_GET['link_price'] ), $new_top_link );
59
  }
60
 
61
  $cat_path = '<a href="' . $new_top_link . '">Home</a> - ' . $cat_path;
291
 
292
  if ( $level == 0 && ( ( isset( $_GET['cat_name'] ) && !empty( $_GET['cat_name'] ) ) || ( isset( $wp_query->query_vars['cat_name'] ) && !empty( $wp_query->query_vars['cat_name'] ) ) ) ) {
293
  if ( !empty( $_GET['cat_name'] ) ) {
294
+ $category_entry = get_term_by( 'slug', sanitize_text_field( $_GET['cat_name'] ), 'link_library_category', OBJECT );
295
  } elseif ( !empty( $wp_query->query_vars['cat_name'] ) ) {
296
  $last_slash_pos = strripos( $wp_query->query_vars['cat_name'], '/' );
297
  if ( $last_slash_pos != 0 ) {
389
  $categorylist_cpt = intval( $_GET['cat_id'] );
390
  $AJAXcatid = $categorylist_cpt;
391
  } elseif ( ( $showonecatonly && 'HTMLGETSLUG' == $showonecatmode && isset( $_GET['catslug'] ) && ( !isset( $_GET['searchll'] ) || ( isset( $_GET['searchll'] ) && empty( $_GET['searchll'] ) ) ) ) || ( $searchfiltercats && isset( $_GET['catslug'] ) && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) ) {
392
+ $categorysluglist = sanitize_text_field( $_GET['catslug'] );
393
  } elseif ( ( $showonecatonly && 'HTMLGETCATNAME' == $showonecatmode && isset( $_GET['catname'] ) && ( !isset( $_GET['searchll'] ) || ( isset( $_GET['searchll'] ) && empty( $_GET['searchll'] ) ) ) ) || ( $searchfiltercats && isset( $_GET['catname'] ) && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) ) {
394
+ $categorynamelist = sanitize_text_field( $_GET['catname'] );
395
  } elseif ( $showonecatonly && 'HTMLGETPERM' == $showonecatmode && empty( $_GET['searchll'] ) ) {
396
  global $wp_query;
397
 
403
  $AJAXcatid = $categoryname;
404
  $categorysluglist = '';
405
  if ( isset( $_GET['catslug'] ) ) {
406
+ $categorysluglist = sanitize_text_field( $_GET['catslug'] );
407
  }
408
  } elseif ( $showonecatonly && ( !isset( $AJAXcatid ) || empty( $AJAXcatid ) ) && !empty( $defaultsinglecat_cpt ) && ( !isset( $_GET['searchll'] ) || ( isset( $_GET['searchll'] ) && empty( $_GET['searchll'] ) ) ) ) {
409
  $categorylist_cpt = $defaultsinglecat_cpt;
444
  if ( !empty( $categorysluglist ) ) {
445
  $show_one_cat_query_args['slug'] = explode( ',', $categorysluglist );
446
  } elseif ( isset( $_GET['catslug'] ) ) {
447
+ $show_one_cat_query_args['slug'] = sanitize_text_field( $_GET['catslug'] );
448
  }
449
 
450
  }
491
 
492
  if ( ( isset($_GET['searchll'] ) && !empty( $_GET['searchll'] ) || ( isset( $_POST['searchll'] ) && !empty( $_POST['searchll'] ) ) ) && empty( $singlelinkid ) ) {
493
  if ( isset( $_GET['searchll'] ) ) {
494
+ $searchstring = sanitize_text_field( $_GET['searchll'] );
495
  } elseif ( isset( $_POST['searchll'] ) ) {
496
  $searchstring = $_POST['searchll'];
497
  }
568
  if ( !empty( $categorysluglist ) ) {
569
  $link_categories_query_args['slug'] = explode( ',', $categorysluglist );
570
  } elseif ( isset( $_GET['catslug'] ) ) {
571
+ $link_categories_query_args['slug'] = sanitize_text_field( $_GET['catslug'] );
572
  }
573
  $link_categories_query_args['include'] = array();
574
  $link_categories_query_args['exclude'] = array();
653
  $tag_array = array();
654
 
655
  if ( ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) ) {
656
+ $tag_array = explode( '.', sanitize_text_field( $_GET['link_tags'] ) );
657
  } elseif( !empty( $taglist_cpt ) ) {
658
  $tag_array = explode( ',', $taglist_cpt );
659
  }
709
  if ( isset( $_POST['linkresultpage'] ) ) {
710
  $pagenumber = $_POST['linkresultpage'];
711
  } elseif ( isset( $_GET['linkresultpage'] ) ) {
712
+ $pagenumber = intval( $_GET['linkresultpage'] );
713
  }
714
  $startingitem = ( $pagenumber - 1 ) * $linksperpage + 1;
715
  } else {
794
  $tag_array = array();
795
 
796
  if ( ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) ) {
797
+ $tag_array = explode( '.', sanitize_text_field( $_GET['link_tags'] ) );
798
  } elseif( !empty( $taglist_cpt ) ) {
799
  $tag_array = explode( ',', $taglist_cpt );
800
  }
952
  }
953
 
954
  if ( isset( $_GET['link_letter'] ) && !empty( $_GET['link_letter'] ) ) {
955
+ $link_query_args['link_starts_with'] = sanitize_text_field( $_GET['link_letter'] );
956
  }
957
 
958
  if ( true == $debugmode ) {
1166
  $cat_path = $link_category->slug;
1167
 
1168
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
1169
+ $cat_path = add_query_arg( 'link_tags', sanitize_text_field( $_GET['link_tags'] ), $cat_path );
1170
  }
1171
 
1172
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
1173
+ $cat_path = add_query_arg( 'link_price', sanitize_text_field( $_GET['link_price'] ), $cat_path );
1174
  }
1175
 
1176
  $catlink .= '<a href="' . esc_url( site_url() . '/' . $rewritepage . $cat_path ) . '">';
1354
  }
1355
  $sort_url = add_query_arg( $sorting_labels[$display_item], $sort_direction, '' );
1356
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
1357
+ $sort_url = add_query_arg( 'link_tags', sanitize_text_field( $_GET['link_tags'] ), $sort_url );
1358
  }
1359
 
1360
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
1361
+ $sort_url = add_query_arg( 'link_price', sanitize_text_field( $_GET['link_price'] ), $sort_url );
1362
  }
1363
 
1364
  $catstartlist .= '<a href="' . $sort_url . '">';
render-link-library-search-sc.php CHANGED
@@ -30,7 +30,7 @@ function RenderLinkLibrarySearchForm( $libraryoptions ) {
30
  $output .= "<input type='text' onfocus=\"this.value=''\" value='";
31
 
32
  if ( $searchtextinsearchbox && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
33
- $output .= $_GET['searchll'];
34
  } else {
35
  $output .= $searchfieldtext;
36
  }
@@ -38,17 +38,17 @@ function RenderLinkLibrarySearchForm( $libraryoptions ) {
38
  $output .= "' name='searchll' id='searchll' />";
39
 
40
  if ( isset( $_GET['page_id'] ) && !empty( $_GET['page_id'] ) ) {
41
- $output .= '<input type="hidden" name="page_id" value="' . $_GET['page_id'] . '" />';
42
  } elseif ( isset( $_GET['p'] ) && !empty( $_GET['p'] ) ) {
43
- $output .= '<input type="hidden" name="p" value="' . $_GET['p'] . '" />';
44
  }
45
 
46
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
47
- $output .= '<input type="hidden" name="link_price" value="' . $_GET['link_price'] . '" />';
48
  }
49
 
50
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
51
- $output .= '<input type="hidden" name="link_tags" value="' . $_GET['link_tags'] . '" />';
52
  }
53
 
54
  $output .= "<input type='submit' id='searchbutton' value='" . $searchlabel . "' />";
30
  $output .= "<input type='text' onfocus=\"this.value=''\" value='";
31
 
32
  if ( $searchtextinsearchbox && isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
33
+ $output .= sanitize_text_field( $_GET['searchll'] );
34
  } else {
35
  $output .= $searchfieldtext;
36
  }
38
  $output .= "' name='searchll' id='searchll' />";
39
 
40
  if ( isset( $_GET['page_id'] ) && !empty( $_GET['page_id'] ) ) {
41
+ $output .= '<input type="hidden" name="page_id" value="' . intval( $_GET['page_id'] ) . '" />';
42
  } elseif ( isset( $_GET['p'] ) && !empty( $_GET['p'] ) ) {
43
+ $output .= '<input type="hidden" name="p" value="' . intval( $_GET['p'] ) . '" />';
44
  }
45
 
46
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
47
+ $output .= '<input type="hidden" name="link_price" value="' . sanitize_text_field( $_GET['link_price'] ) . '" />';
48
  }
49
 
50
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
51
+ $output .= '<input type="hidden" name="link_tags" value="' . sanitize_text_field( $_GET['link_tags'] ) . '" />';
52
  }
53
 
54
  $output .= "<input type='submit' id='searchbutton' value='" . $searchlabel . "' />";
render-link-library-tag-filter-sc.php CHANGED
@@ -16,19 +16,19 @@ function RenderLinkLibraryFilterBox( $LLPluginClass, $generaloptions, $libraryop
16
  $output .= '<legend>' . __( 'Filters', 'link-library' ) . '</legend>';
17
 
18
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
19
- $prev_link_price = $_GET['link_price'];
20
  } else {
21
  $prev_link_price = '';
22
  }
23
 
24
  if ( isset( $_GET['link_letter'] ) && !empty( $_GET['link_letter'] ) ) {
25
- $prev_link_letter = $_GET['link_letter'];
26
  } else {
27
  $prev_link_letter = '';
28
  }
29
 
30
  if ( isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
31
- $searchstring = $_GET['searchll'];
32
  } else {
33
  $searchstring = '';
34
  }
@@ -40,7 +40,7 @@ function RenderLinkLibraryFilterBox( $LLPluginClass, $generaloptions, $libraryop
40
  $link_terms = get_terms( array( 'taxonomy' => 'link_library_tags', 'include' => $include_tags, 'exclude' => $exclude_tags ) );
41
 
42
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
43
- $prev_link_tags = $_GET['link_tags'];
44
  } else {
45
  $prev_link_tags = '';
46
  }
16
  $output .= '<legend>' . __( 'Filters', 'link-library' ) . '</legend>';
17
 
18
  if ( isset( $_GET['link_price'] ) && !empty( $_GET['link_price'] ) ) {
19
+ $prev_link_price = sanitize_text_field( $_GET['link_price'] );
20
  } else {
21
  $prev_link_price = '';
22
  }
23
 
24
  if ( isset( $_GET['link_letter'] ) && !empty( $_GET['link_letter'] ) ) {
25
+ $prev_link_letter = sanitize_text_field( $_GET['link_letter'] );
26
  } else {
27
  $prev_link_letter = '';
28
  }
29
 
30
  if ( isset( $_GET['searchll'] ) && !empty( $_GET['searchll'] ) ) {
31
+ $searchstring = sanitize_text_field( $_GET['searchll'] );
32
  } else {
33
  $searchstring = '';
34
  }
40
  $link_terms = get_terms( array( 'taxonomy' => 'link_library_tags', 'include' => $include_tags, 'exclude' => $exclude_tags ) );
41
 
42
  if ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) {
43
+ $prev_link_tags = sanitize_text_field( $_GET['link_tags'] );
44
  } else {
45
  $prev_link_tags = '';
46
  }
render-rss-library-sc.php CHANGED
@@ -177,7 +177,7 @@ function RenderRSSLibrary( $LLPluginClass, $generaloptions, $libraryoptions, $se
177
  $tag_array = array();
178
 
179
  if ( ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) ) {
180
- $tag_array = explode( '.', $_GET['link_tags'] );
181
  } elseif( !empty( $taglist_cpt ) ) {
182
  $tag_array = explode( ',', $taglist_cpt );
183
  }
177
  $tag_array = array();
178
 
179
  if ( ( isset( $_GET['link_tags'] ) && !empty( $_GET['link_tags'] ) ) ) {
180
+ $tag_array = explode( '.', sanitize_text_field( $_GET['link_tags'] ) );
181
  } elseif( !empty( $taglist_cpt ) ) {
182
  $tag_array = explode( ',', $taglist_cpt );
183
  }