SendinBlue Subscribe Form And WP SMTP - Version 3.1.37

Version Description

  • Security fix include user input data sanitization.
Download this release

Release Info

Developer gouravgupta24
Plugin Icon 128x128 SendinBlue Subscribe Form And WP SMTP
Version 3.1.37
Comparing to
See all releases

Code changes from version 3.1.36 to 3.1.37

Files changed (5) hide show
  1. inc/SendinblueApiClient.php +1 -1
  2. page/page-form.php +2 -2
  3. page/page-home.php +5 -4
  4. readme.txt +4 -1
  5. sendinblue.php +1 -1
inc/SendinblueApiClient.php CHANGED
@@ -14,7 +14,7 @@ class SendinblueApiClient
14
  const RESPONSE_CODE_CREATED = 201;
15
  const RESPONSE_CODE_ACCEPTED = 202;
16
  const RESPONSE_CODE_UNAUTHORIZED = 401;
17
- const PLUGIN_VERSION = '3.1.36';
18
  const USER_AGENT = 'sendinblue_plugins/wordpress';
19
 
20
  private $apiKey;
14
  const RESPONSE_CODE_CREATED = 201;
15
  const RESPONSE_CODE_ACCEPTED = 202;
16
  const RESPONSE_CODE_UNAUTHORIZED = 401;
17
+ const PLUGIN_VERSION = '3.1.37';
18
  const USER_AGENT = 'sendinblue_plugins/wordpress';
19
 
20
  private $apiKey;
page/page-form.php CHANGED
@@ -253,7 +253,7 @@ if ( ! class_exists( 'SIB_Page_Form' ) ) {
253
  <textarea class="widefat" cols="160" rows="20" id="sibformmarkup"
254
  name="sib_form_html"><?php
255
  // phpcs:ignore
256
- echo stripcslashes( $formData['html'] ); ?></textarea>
257
  <?php
258
  }
259
  ?>
@@ -1080,7 +1080,7 @@ For your information, you cannot select a template with the tag [DOUBLEOPTIN].',
1080
  }
1081
  }
1082
  $formData = array(
1083
- 'html' => isset( $_POST['frmData'] ) ? $_POST['frmData'] : '',// phpcs:ignore
1084
  'css' => isset( $_POST['frmCss'] ) ? sanitize_text_field($_POST['frmCss']) : '',
1085
  'dependTheme' => isset( $_POST['isDepend'] ) ? sanitize_text_field($_POST['isDepend']) : '',
1086
  'gCaptcha' => $gCaptcha,
253
  <textarea class="widefat" cols="160" rows="20" id="sibformmarkup"
254
  name="sib_form_html"><?php
255
  // phpcs:ignore
256
+ echo esc_html( $formData['html'] ); ?></textarea>
257
  <?php
258
  }
259
  ?>
1080
  }
1081
  }
1082
  $formData = array(
1083
+ 'html' => isset( $_POST['frmData'] ) ? wp_kses($_POST['frmData'], SIB_Manager::wordpress_allowed_attributes()) : '',// phpcs:ignore
1084
  'css' => isset( $_POST['frmCss'] ) ? sanitize_text_field($_POST['frmCss']) : '',
1085
  'dependTheme' => isset( $_POST['isDepend'] ) ? sanitize_text_field($_POST['isDepend']) : '',
1086
  'gCaptcha' => $gCaptcha,
page/page-home.php CHANGED
@@ -693,7 +693,8 @@ if ( ! class_exists( 'SIB_Page_Home' ) ) {
693
  public static function ajax_sync_users() {
694
  check_ajax_referer( 'ajax_sib_admin_nonce', 'security' );
695
  // phpcs:ignore
696
- $postData = isset( $_POST['data'] ) ? $_POST['data'] : array();
 
697
  if ( ! isset( $postData['sync_role'] ) ) {
698
  wp_send_json(
699
  array(
@@ -705,7 +706,7 @@ if ( ! class_exists( 'SIB_Page_Home' ) ) {
705
  wp_send_json(
706
  array(
707
  'code' => 'attr_duplicated',
708
- 'message' => sprintf( esc_attr__( 'The attribute %s is duplicated. You can select one at a time.','mailin' ), '<b>' . $postData['errAttr'] . '</b>' ),
709
  )
710
  );}
711
 
@@ -728,7 +729,7 @@ if ( ! class_exists( 'SIB_Page_Home' ) ) {
728
  foreach ( $roles as $role ) {
729
  $users = get_users(
730
  array(
731
- 'role' => $role,
732
  )
733
  );
734
  if ( empty( $users ) ) {
@@ -749,7 +750,7 @@ if ( ! class_exists( 'SIB_Page_Home' ) ) {
749
  }
750
 
751
  }
752
- $contentData .= "\n" . $userData;
753
  }
754
  }
755
  if ( '' == $contentData ) {
693
  public static function ajax_sync_users() {
694
  check_ajax_referer( 'ajax_sib_admin_nonce', 'security' );
695
  // phpcs:ignore
696
+ //Data is being senitized/escaped while accessing
697
+ $postData = isset( $_POST['data'] ) ? $_POST['data'] : array();
698
  if ( ! isset( $postData['sync_role'] ) ) {
699
  wp_send_json(
700
  array(
706
  wp_send_json(
707
  array(
708
  'code' => 'attr_duplicated',
709
+ 'message' => sprintf( esc_attr__( 'The attribute %s is duplicated. You can select one at a time.','mailin' ), '<b>' . esc_html($postData['errAttr']) . '</b>' ),
710
  )
711
  );}
712
 
729
  foreach ( $roles as $role ) {
730
  $users = get_users(
731
  array(
732
+ 'role' => sanitize_text_field($role),
733
  )
734
  );
735
  if ( empty( $users ) ) {
750
  }
751
 
752
  }
753
+ $contentData .= "\n" . strip_tags($userData);
754
  }
755
  }
756
  if ( '' == $contentData ) {
readme.txt CHANGED
@@ -4,7 +4,7 @@ Tags: Email Marketing, Newsletter, Sendinblue, Forms, smtp, marketing automation
4
  Requires at least: 4.4
5
  Tested up to: 5.9
6
  Requires PHP: 5.6
7
- Stable tag: 3.1.36
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
@@ -116,6 +116,9 @@ In order to create a signup form, you need to:
116
 
117
  == Changelog ==
118
 
 
 
 
119
  = 3.1.36 =
120
  * Security fixes include cookies handling, user input data sanitization, and escaping HTML entities from the output.
121
  * Added missing font file for bootstrap 3.4.1
4
  Requires at least: 4.4
5
  Tested up to: 5.9
6
  Requires PHP: 5.6
7
+ Stable tag: 3.1.37
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
116
 
117
  == Changelog ==
118
 
119
+ = 3.1.37 =
120
+ * Security fix include user input data sanitization.
121
+
122
  = 3.1.36 =
123
  * Security fixes include cookies handling, user input data sanitization, and escaping HTML entities from the output.
124
  * Added missing font file for bootstrap 3.4.1
sendinblue.php CHANGED
@@ -3,7 +3,7 @@
3
  * Plugin Name: Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
4
  * Plugin URI: https://www.sendinblue.com/?r=wporg
5
  * Description: Manage your contact lists, subscription forms and all email and marketing-related topics from your wp panel, within one single plugin
6
- * Version: 3.1.36
7
  * Author: Sendinblue
8
  * Author URI: https://www.sendinblue.com/?r=wporg
9
  * License: GPLv2 or later
3
  * Plugin Name: Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
4
  * Plugin URI: https://www.sendinblue.com/?r=wporg
5
  * Description: Manage your contact lists, subscription forms and all email and marketing-related topics from your wp panel, within one single plugin
6
+ * Version: 3.1.37
7
  * Author: Sendinblue
8
  * Author URI: https://www.sendinblue.com/?r=wporg
9
  * License: GPLv2 or later