MapPress Easy Google Maps - Version 2.54.6

Version Description

  • Fixed: added additional security to template display function
Download this release

Release Info

Developer chrisvrichardson
Plugin Icon 128x128 MapPress Easy Google Maps
Version 2.54.6
Comparing to
See all releases

Code changes from version 2.54.5 to 2.54.6

languages/mappress-google-maps-for-wordpress.pot CHANGED
@@ -2,14 +2,14 @@
2
  # This file is distributed under the same license as the MapPress Maps for WordPress plugin.
3
  msgid ""
4
  msgstr ""
5
- "Project-Id-Version: MapPress Maps for WordPress 2.54.5\n"
6
  "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/mappress-google-maps-for-wordpress\n"
7
  "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
8
  "Language-Team: LANGUAGE <LL@li.org>\n"
9
  "MIME-Version: 1.0\n"
10
  "Content-Type: text/plain; charset=UTF-8\n"
11
  "Content-Transfer-Encoding: 8bit\n"
12
- "POT-Creation-Date: 2020-05-04T19:55:13+00:00\n"
13
  "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
14
  "X-Generator: WP-CLI 2.4.0\n"
15
 
2
  # This file is distributed under the same license as the MapPress Maps for WordPress plugin.
3
  msgid ""
4
  msgstr ""
5
+ "Project-Id-Version: MapPress Maps for WordPress 2.54.6\n"
6
  "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/mappress-google-maps-for-wordpress\n"
7
  "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
8
  "Language-Team: LANGUAGE <LL@li.org>\n"
9
  "MIME-Version: 1.0\n"
10
  "Content-Type: text/plain; charset=UTF-8\n"
11
  "Content-Transfer-Encoding: 8bit\n"
12
+ "POT-Creation-Date: 2020-05-06T02:27:32+00:00\n"
13
  "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
14
  "X-Generator: WP-CLI 2.4.0\n"
15
 
mappress.php CHANGED
@@ -4,7 +4,7 @@ Plugin Name: MapPress Maps for WordPress
4
  Plugin URI: https://www.mappresspro.com/mappress
5
  Author URI: https://www.mappresspro.com/chris-contact
6
  Description: MapPress makes it easy to add Google and Leaflet Maps to WordPress
7
- Version: 2.54.5
8
  Author: Chris Richardson
9
  Text Domain: mappress-google-maps-for-wordpress
10
  Thanks to all the translators and to Matthias Stasiak for his wonderful icons (http://code.google.com/p/google-maps-icons/)
@@ -35,7 +35,7 @@ if (is_dir(dirname( __FILE__ ) . '/pro')) {
35
  }
36
 
37
  class Mappress {
38
- const VERSION = '2.54.5';
39
 
40
  static
41
  $baseurl,
4
  Plugin URI: https://www.mappresspro.com/mappress
5
  Author URI: https://www.mappresspro.com/chris-contact
6
  Description: MapPress makes it easy to add Google and Leaflet Maps to WordPress
7
+ Version: 2.54.6
8
  Author: Chris Richardson
9
  Text Domain: mappress-google-maps-for-wordpress
10
  Thanks to all the translators and to Matthias Stasiak for his wonderful icons (http://code.google.com/p/google-maps-icons/)
35
  }
36
 
37
  class Mappress {
38
+ const VERSION = '2.54.6';
39
 
40
  static
41
  $baseurl,
mappress_template.php CHANGED
@@ -58,13 +58,21 @@ class Mappress_Template extends Mappress_Obj {
58
 
59
  static function ajax_get() {
60
  check_ajax_referer('mappress', 'nonce');
61
- $name = (isset($_GET['name'])) ? $_GET['name'] : null;
62
 
63
- $filename = $name . '.php';
64
- $filepath = get_stylesheet_directory() . '/' . $filename;
65
 
 
 
 
66
  $html = @file_get_contents($filepath);
67
- $standard = @file_get_contents(Mappress::$basedir . "/templates/$filename");
 
 
 
 
 
 
68
 
69
  if (!$standard)
70
  Mappress::ajax_response('Invalid template');
58
 
59
  static function ajax_get() {
60
  check_ajax_referer('mappress', 'nonce');
 
61
 
62
+ if (!current_user_can('manage_options'))
63
+ Mappress::ajax_response('Not authorized');
64
 
65
+ $name = (isset($_GET['name'])) ? $_GET['name'] : null;
66
+ $filename = basename($name) . '.php';
67
+ $filepath = get_stylesheet_directory() . '/' . $filename;
68
  $html = @file_get_contents($filepath);
69
+
70
+ // Verify legitimate path
71
+ $standard_path = realpath(Mappress::$basedir . "/templates/$filename");
72
+ if (strpos($standard_path, realpath(Mappress::$basedir)) !== 0)
73
+ Mappress::ajax_response('Invalid template path');
74
+
75
+ $standard = @file_get_contents($standard_path);
76
 
77
  if (!$standard)
78
  Mappress::ajax_response('Invalid template');
readme.txt CHANGED
@@ -4,13 +4,12 @@ Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_i
4
  Tags: leaflet, openstreetmap, osm, mapbox, map box, google maps,google,map,maps,easy,poi,mapping,mapper,gps,lat,lon,latitude,longitude,geocoder,geocoding,georss,geo rss,geo,v3,marker,mashup,mash,api,v3,buddypress,mashup,geo,wp-geo,geo mashup,simplemap,simple,wpml
5
  Requires at least: 4.5
6
  Tested up to: 5.5
7
- Stable tag: 2.54.5
8
 
9
  == Description ==
10
  MapPress adds beautiful, interactive Google or Leaflet maps to WordPress.
11
 
12
  When editing a post or page just enter any addresses you'd like to map and the plugin will automatically insert an interactive map into your blog.
13
-
14
  The free version supports unlimited maps and multiple maps per post.
15
 
16
  For additional features, try [MapPress Pro](https://mappresspro.com/mappress)
@@ -86,6 +85,9 @@ Please see the plugin documentation pages:
86
 
87
  == Changelog ==
88
 
 
 
 
89
  = 2.54.5 =
90
  * Fixed: error is media JS on post/page list screen
91
 
4
  Tags: leaflet, openstreetmap, osm, mapbox, map box, google maps,google,map,maps,easy,poi,mapping,mapper,gps,lat,lon,latitude,longitude,geocoder,geocoding,georss,geo rss,geo,v3,marker,mashup,mash,api,v3,buddypress,mashup,geo,wp-geo,geo mashup,simplemap,simple,wpml
5
  Requires at least: 4.5
6
  Tested up to: 5.5
7
+ Stable tag: 2.54.6
8
 
9
  == Description ==
10
  MapPress adds beautiful, interactive Google or Leaflet maps to WordPress.
11
 
12
  When editing a post or page just enter any addresses you'd like to map and the plugin will automatically insert an interactive map into your blog.
 
13
  The free version supports unlimited maps and multiple maps per post.
14
 
15
  For additional features, try [MapPress Pro](https://mappresspro.com/mappress)
85
 
86
  == Changelog ==
87
 
88
+ = 2.54.6 =
89
+ * Fixed: added additional security to template display function
90
+
91
  = 2.54.5 =
92
  * Fixed: error is media JS on post/page list screen
93