Post SMTP Mailer/Email Log - Version 2.0.3

Version Description

  • 2019-08-21
  • Fixed: A few security issues.
Download this release

Release Info

Developer yehudah
Plugin Icon 128x128 Post SMTP Mailer/Email Log
Version 2.0.3
Comparing to
See all releases

Code changes from version 2.0.2 to 2.0.3

Files changed (77) hide show
  1. Postman/Phpmailer/PostsmtpMailer.php +3 -0
  2. Postman/Postman-Auth/PostmanAbstractAuthenticationManager.php +3 -0
  3. Postman/Postman-Auth/PostmanAuthenticationManager.php +3 -0
  4. Postman/Postman-Auth/PostmanAuthenticationManagerFactory.php +3 -0
  5. Postman/Postman-Auth/PostmanGoogleAuthenticationManager.php +3 -0
  6. Postman/Postman-Auth/PostmanMicrosoftAuthenticationManager.php +3 -0
  7. Postman/Postman-Auth/PostmanNonOAuthAuthenticationManager.php +3 -0
  8. Postman/Postman-Auth/PostmanStateIdMissingException.php +3 -0
  9. Postman/Postman-Auth/PostmanYahooAuthenticationManager.php +3 -0
  10. Postman/Postman-Configuration/PostmanConfigurationController.php +24 -0
  11. Postman/Postman-Configuration/PostmanImportableConfiguration.php +4 -0
  12. Postman/Postman-Configuration/PostmanRegisterConfigurationSettings.php +5 -1
  13. Postman/Postman-Configuration/PostmanSmtpDiscovery.php +4 -0
  14. Postman/Postman-Configuration/postman_manual_config.js +2 -0
  15. Postman/Postman-Configuration/postman_wizard.js +15 -7
  16. Postman/Postman-Connectivity-Test/Postman-PortTest.php +4 -0
  17. Postman/Postman-Connectivity-Test/PostmanConnectivityTestController.php +18 -0
  18. Postman/Postman-Connectivity-Test/postman_port_test.js +8 -4
  19. Postman/Postman-Controller/PostmanAdminPointer.php +4 -0
  20. Postman/Postman-Controller/PostmanDashboardWidgetController.php +4 -0
  21. Postman/Postman-Controller/PostmanManageConfigurationAjaxHandler.php +4 -0
  22. Postman/Postman-Controller/PostmanWelcomeController.php +3 -0
  23. Postman/Postman-Diagnostic-Test/PostmanDiagnosticTestController.php +12 -0
  24. Postman/Postman-Diagnostic-Test/postman_diagnostics.js +2 -1
  25. Postman/Postman-Email-Log/PostmanEmailLogController.php +17 -5
  26. Postman/Postman-Email-Log/PostmanEmailLogPostType.php +3 -0
  27. Postman/Postman-Email-Log/PostmanEmailLogService.php +4 -0
  28. Postman/Postman-Email-Log/PostmanEmailLogView.php +8 -2
  29. Postman/Postman-Mail/PostmanContactForm7.php +3 -0
  30. Postman/Postman-Mail/PostmanDefaultModuleTransport.php +4 -0
  31. Postman/Postman-Mail/PostmanEmailAddress.php +4 -0
  32. Postman/Postman-Mail/PostmanGmailApiModuleTransport.php +4 -0
  33. Postman/Postman-Mail/PostmanGmailApiModuleZendMailTransport.php +4 -0
  34. Postman/Postman-Mail/PostmanMailEngine.php +4 -0
  35. Postman/Postman-Mail/PostmanMailgunMailEngine.php +4 -0
  36. Postman/Postman-Mail/PostmanMailgunTransport.php +7 -3
  37. Postman/Postman-Mail/PostmanMandrillMailEngine.php +4 -0
  38. Postman/Postman-Mail/PostmanMandrillTransport.php +4 -0
  39. Postman/Postman-Mail/PostmanMessage.php +4 -0
  40. Postman/Postman-Mail/PostmanModuleTransport.php +5 -1
  41. Postman/Postman-Mail/PostmanMyMailConnector.php +4 -0
  42. Postman/Postman-Mail/PostmanSendGridMailEngine.php +3 -0
  43. Postman/Postman-Mail/PostmanSendGridTransport.php +4 -0
  44. Postman/Postman-Mail/PostmanSmtpModuleTransport.php +4 -0
  45. Postman/Postman-Mail/PostmanTransportRegistry.php +4 -0
  46. Postman/Postman-Mail/PostmanWooCommerce.php +3 -0
  47. Postman/Postman-Mail/PostmanZendMailEngine.php +4 -0
  48. Postman/Postman-Mail/PostmanZendMailTransportConfigurationFactory.php +4 -0
  49. Postman/Postman-Send-Test-Email/PostmanSendTestEmailController.php +9 -0
  50. Postman/Postman-Send-Test-Email/postman_send_test_email.js +2 -1
  51. Postman/Postman.php +7 -29
  52. Postman/PostmanAdminController.php +4 -0
  53. Postman/PostmanAjaxController.php +4 -0
  54. Postman/PostmanConfigTextHelper.php +4 -0
  55. Postman/PostmanEmailLogs.php +3 -1
  56. Postman/PostmanInputSanitizer.php +3 -0
  57. Postman/PostmanInstaller.php +4 -0
  58. Postman/PostmanLogger.php +4 -0
  59. Postman/PostmanMessageHandler.php +3 -0
  60. Postman/PostmanOAuthToken.php +3 -0
  61. Postman/PostmanOptions.php +4 -1
  62. Postman/PostmanPluginFeedback.php +4 -2
  63. Postman/PostmanPreRequisitesCheck.php +3 -0
  64. Postman/PostmanSession.php +3 -0
  65. Postman/PostmanState.php +3 -0
  66. Postman/PostmanUtils.php +6 -2
  67. Postman/PostmanViewController.php +7 -7
  68. Postman/PostmanWpMail.php +4 -2
  69. Postman/PostmanWpMailBinder.php +3 -0
  70. Postman/notifications/INotify.php +3 -0
  71. Postman/notifications/PostmanMailNotify.php +3 -1
  72. Postman/notifications/PostmanNotify.php +3 -0
  73. Postman/notifications/PostmanPushoverNotify.php +3 -1
  74. Postman/notifications/PostmanSlackNotify.php +3 -1
  75. postman-smtp.php +6 -2
  76. readme.txt +7 -4
  77. script/postman.js +9 -0
Postman/Phpmailer/PostsmtpMailer.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  require_once ABSPATH . WPINC . '/class-phpmailer.php';
3
  require_once ABSPATH . WPINC . '/class-smtp.php';
4
 
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  require_once ABSPATH . WPINC . '/class-phpmailer.php';
6
  require_once ABSPATH . WPINC . '/class-smtp.php';
7
 
Postman/Postman-Auth/PostmanAbstractAuthenticationManager.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( "PostmanAbstractAuthenticationManager" )) {
3
 
4
  require_once 'PostmanAuthenticationManager.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( "PostmanAbstractAuthenticationManager" )) {
6
 
7
  require_once 'PostmanAuthenticationManager.php';
Postman/Postman-Auth/PostmanAuthenticationManager.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! interface_exists ( "PostmanAuthenticationManager" )) {
3
  interface PostmanAuthenticationManager {
4
  const POSTMAN_AUTHORIZATION_IN_PROGRESS = 'request_oauth_permission';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! interface_exists ( "PostmanAuthenticationManager" )) {
6
  interface PostmanAuthenticationManager {
7
  const POSTMAN_AUTHORIZATION_IN_PROGRESS = 'request_oauth_permission';
Postman/Postman-Auth/PostmanAuthenticationManagerFactory.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( "PostmanAuthenticationManagerFactory" )) {
3
 
4
  require_once 'PostmanGoogleAuthenticationManager.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( "PostmanAuthenticationManagerFactory" )) {
6
 
7
  require_once 'PostmanGoogleAuthenticationManager.php';
Postman/Postman-Auth/PostmanGoogleAuthenticationManager.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( "PostmanGoogleAuthenticationManager" )) {
3
 
4
  require_once 'PostmanAbstractAuthenticationManager.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( "PostmanGoogleAuthenticationManager" )) {
6
 
7
  require_once 'PostmanAbstractAuthenticationManager.php';
Postman/Postman-Auth/PostmanMicrosoftAuthenticationManager.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( "PostmanMicrosoftAuthenticationManager" )) {
3
 
4
  require_once 'PostmanAbstractAuthenticationManager.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( "PostmanMicrosoftAuthenticationManager" )) {
6
 
7
  require_once 'PostmanAbstractAuthenticationManager.php';
Postman/Postman-Auth/PostmanNonOAuthAuthenticationManager.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( "PostmanNonOAuthAuthenticationManager" )) {
3
 
4
  require_once 'PostmanAuthenticationManager.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( "PostmanNonOAuthAuthenticationManager" )) {
6
 
7
  require_once 'PostmanAuthenticationManager.php';
Postman/Postman-Auth/PostmanStateIdMissingException.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( 'PostmanStateIdMissingException' )) {
3
  class PostmanStateIdMissingException extends Exception {
4
  }
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( 'PostmanStateIdMissingException' )) {
6
  class PostmanStateIdMissingException extends Exception {
7
  }
Postman/Postman-Auth/PostmanYahooAuthenticationManager.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( "PostmanYahooAuthenticationManager" )) {
3
 
4
  require_once 'PostmanAbstractAuthenticationManager.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( "PostmanYahooAuthenticationManager" )) {
6
 
7
  require_once 'PostmanAbstractAuthenticationManager.php';
Postman/Postman-Configuration/PostmanConfigurationController.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once( 'PostmanRegisterConfigurationSettings.php' );
3
  class PostmanConfigurationController {
4
  const CONFIGURATION_SLUG = 'postman/configuration';
@@ -207,6 +211,9 @@ class PostmanConfigurationController {
207
  print '</ul>';
208
 
209
  print '<form method="post" action="options.php">';
 
 
 
210
  // This prints out all hidden setting fields
211
  settings_fields( PostmanAdminController::SETTINGS_GROUP_NAME );
212
 
@@ -235,6 +242,9 @@ class PostmanConfigurationController {
235
  print '<div id="mailgun_settings" class="authentication_setting non-basic non-oauth2">';
236
  do_settings_sections( PostmanMailgunTransport::MAILGUN_AUTH_OPTIONS );
237
  print '</div>';
 
 
 
238
  print '</section>';
239
  // end account config
240
  ?>
@@ -438,6 +448,8 @@ class PostmanConfigurationController {
438
  printf( '<input type="hidden" id="input_%2$s" name="%1$s[%2$s]" value="%3$s" />', PostmanOptions::POSTMAN_OPTIONS, PostmanOptions::STEALTH_MODE, $this->options->isStealthModeEnabled() );
439
  printf( '<input type="hidden" id="input_%2$s" name="%1$s[%2$s]" value="%3$s" />', PostmanOptions::POSTMAN_OPTIONS, PostmanOptions::TEMPORARY_DIRECTORY, $this->options->getTempDirectory() );
440
 
 
 
441
  // display the setting text
442
  settings_fields( PostmanAdminController::SETTINGS_GROUP_NAME );
443
 
@@ -619,6 +631,9 @@ class PostmanGetHostnameByEmailAjaxController extends PostmanAbstractAjaxHandler
619
  * This Ajax function retrieves the smtp hostname for a give e-mail address
620
  */
621
  function getAjaxHostnameByEmail() {
 
 
 
622
  $goDaddyHostDetected = $this->getBooleanRequestParameter( 'go_daddy' );
623
  $email = $this->getRequestParameter( 'email' );
624
  $d = new PostmanSmtpDiscovery( $email );
@@ -653,6 +668,9 @@ class PostmanManageConfigurationAjaxHandler extends PostmanAbstractAjaxHandler {
653
  * @throws Exception
654
  */
655
  function getManualConfigurationViaAjax() {
 
 
 
656
  $queryTransportType = $this->getTransportTypeFromRequest();
657
  $queryAuthType = $this->getAuthenticationTypeFromRequest();
658
  $queryHostname = $this->getHostnameFromRequest();
@@ -683,6 +701,9 @@ class PostmanManageConfigurationAjaxHandler extends PostmanAbstractAjaxHandler {
683
  * The UI response is built so the user may choose a different socket with different options.
684
  */
685
  function getWizardConfigurationViaAjax() {
 
 
 
686
  $this->logger->debug( 'in getWizardConfiguration' );
687
  $originalSmtpServer = $this->getRequestParameter( 'original_smtp_server' );
688
  $queryHostData = $this->getHostDataFromRequest();
@@ -892,6 +913,9 @@ class PostmanImportConfigurationAjaxController extends PostmanAbstractAjaxHandle
892
  * and pushes them into the Postman configuration screen.
893
  */
894
  function getConfigurationFromExternalPluginViaAjax() {
 
 
 
895
  $importableConfiguration = new PostmanImportableConfiguration();
896
  $plugin = $this->getRequestParameter( 'plugin' );
897
  $this->logger->debug( 'Looking for config=' . $plugin );
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once( 'PostmanRegisterConfigurationSettings.php' );
7
  class PostmanConfigurationController {
8
  const CONFIGURATION_SLUG = 'postman/configuration';
211
  print '</ul>';
212
 
213
  print '<form method="post" action="options.php">';
214
+
215
+ wp_nonce_field('post-smtp', 'security');
216
+
217
  // This prints out all hidden setting fields
218
  settings_fields( PostmanAdminController::SETTINGS_GROUP_NAME );
219
 
242
  print '<div id="mailgun_settings" class="authentication_setting non-basic non-oauth2">';
243
  do_settings_sections( PostmanMailgunTransport::MAILGUN_AUTH_OPTIONS );
244
  print '</div>';
245
+
246
+ do_action( 'post_smtp_settings_sections' );
247
+
248
  print '</section>';
249
  // end account config
250
  ?>
448
  printf( '<input type="hidden" id="input_%2$s" name="%1$s[%2$s]" value="%3$s" />', PostmanOptions::POSTMAN_OPTIONS, PostmanOptions::STEALTH_MODE, $this->options->isStealthModeEnabled() );
449
  printf( '<input type="hidden" id="input_%2$s" name="%1$s[%2$s]" value="%3$s" />', PostmanOptions::POSTMAN_OPTIONS, PostmanOptions::TEMPORARY_DIRECTORY, $this->options->getTempDirectory() );
450
 
451
+ wp_nonce_field('post-smtp', 'security' );
452
+
453
  // display the setting text
454
  settings_fields( PostmanAdminController::SETTINGS_GROUP_NAME );
455
 
631
  * This Ajax function retrieves the smtp hostname for a give e-mail address
632
  */
633
  function getAjaxHostnameByEmail() {
634
+
635
+ check_admin_referer('post-smtp', 'security');
636
+
637
  $goDaddyHostDetected = $this->getBooleanRequestParameter( 'go_daddy' );
638
  $email = $this->getRequestParameter( 'email' );
639
  $d = new PostmanSmtpDiscovery( $email );
668
  * @throws Exception
669
  */
670
  function getManualConfigurationViaAjax() {
671
+
672
+ check_admin_referer('post-smtp', 'security');
673
+
674
  $queryTransportType = $this->getTransportTypeFromRequest();
675
  $queryAuthType = $this->getAuthenticationTypeFromRequest();
676
  $queryHostname = $this->getHostnameFromRequest();
701
  * The UI response is built so the user may choose a different socket with different options.
702
  */
703
  function getWizardConfigurationViaAjax() {
704
+
705
+ check_admin_referer('post-smtp', 'security');
706
+
707
  $this->logger->debug( 'in getWizardConfiguration' );
708
  $originalSmtpServer = $this->getRequestParameter( 'original_smtp_server' );
709
  $queryHostData = $this->getHostDataFromRequest();
913
  * and pushes them into the Postman configuration screen.
914
  */
915
  function getConfigurationFromExternalPluginViaAjax() {
916
+
917
+ check_admin_referer('post-smtp', 'security');
918
+
919
  $importableConfiguration = new PostmanImportableConfiguration();
920
  $plugin = $this->getRequestParameter( 'plugin' );
921
  $this->logger->debug( 'Looking for config=' . $plugin );
Postman/Postman-Configuration/PostmanImportableConfiguration.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if (! interface_exists ( 'PostmanPluginOptions' )) {
3
  interface PostmanPluginOptions {
4
  public function getPluginSlug();
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if (! interface_exists ( 'PostmanPluginOptions' )) {
7
  interface PostmanPluginOptions {
8
  public function getPluginSlug();
Postman/Postman-Configuration/PostmanRegisterConfigurationSettings.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  class PostmanSettingsRegistry {
3
 
4
  private $options;
@@ -11,7 +15,7 @@ class PostmanSettingsRegistry {
11
  * Fires on the admin_init method
12
  */
13
  public function on_admin_init() {
14
- $this->registerSettings();
15
  }
16
 
17
  /**
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  class PostmanSettingsRegistry {
7
 
8
  private $options;
15
  * Fires on the admin_init method
16
  */
17
  public function on_admin_init() {
18
+ $this->registerSettings();
19
  }
20
 
21
  /**
Postman/Postman-Configuration/PostmanSmtpDiscovery.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if (! class_exists ( 'PostmanSmtpMappings' )) {
3
  class PostmanSmtpMappings {
4
  // if an email is in this domain array, it is a known smtp server (easy lookup)
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if (! class_exists ( 'PostmanSmtpMappings' )) {
7
  class PostmanSmtpMappings {
8
  // if an email is in this domain array, it is a known smtp server (easy lookup)
Postman/Postman-Configuration/postman_manual_config.js CHANGED
@@ -77,11 +77,13 @@ function reloadOauthSection() {
77
  var hostname = jQuery(postman_hostname_element_name).val();
78
  var transport = jQuery('#input_transport_type').val();
79
  var authtype = jQuery('select#input_auth_type').val();
 
80
  var data = {
81
  'action' : 'manual_config',
82
  'auth_type' : authtype,
83
  'hostname' : hostname,
84
  'transport' : transport,
 
85
  };
86
  jQuery.post(ajaxurl, data, function(response) {
87
  if (response.success) {
77
  var hostname = jQuery(postman_hostname_element_name).val();
78
  var transport = jQuery('#input_transport_type').val();
79
  var authtype = jQuery('select#input_auth_type').val();
80
+ var security = jQuery('#security').val();
81
  var data = {
82
  'action' : 'manual_config',
83
  'auth_type' : authtype,
84
  'hostname' : hostname,
85
  'transport' : transport,
86
+ 'security' : security
87
  };
88
  jQuery.post(ajaxurl, data, function(response) {
89
  if (response.success) {
Postman/Postman-Configuration/postman_wizard.js CHANGED
@@ -33,7 +33,8 @@ function checkGoDaddyAndCheckEmail(email) {
33
  'action' : 'postman_wizard_port_test',
34
  'hostname' : 'relay-hosting.secureserver.net',
35
  'port' : 25,
36
- 'timeout' : 3
 
37
  };
38
  goDaddy = 'unknown';
39
  checkedEmail = false;
@@ -50,7 +51,8 @@ function checkEmail(goDaddyHostDetected, email) {
50
  var data = {
51
  'action' : 'postman_check_email',
52
  'go_daddy' : goDaddyHostDetected,
53
- 'email' : email
 
54
  };
55
  jQuery.post(
56
  ajaxurl,
@@ -282,7 +284,8 @@ function getHostsToCheck(hostname) {
282
  var data = {
283
  'action' : 'postman_get_hosts_to_test',
284
  'hostname' : hostname,
285
- 'original_smtp_server' : smtpDiscovery.hostname
 
286
  };
287
  jQuery.post(ajaxurl, data, function(response) {
288
  if (postmanValidateAjaxResponseWithPopup(response)) {
@@ -311,7 +314,8 @@ function handleHostsToCheckResponse(response) {
311
  'action' : 'postman_wizard_port_test',
312
  'hostname' : hostname,
313
  'port' : port,
314
- 'transport' : transport
 
315
  };
316
  postThePortTest(hostname, port, data);
317
  }
@@ -358,6 +362,7 @@ function handlePortTestResponse(hostname, port, data, response) {
358
  } else {
359
  // SMTP failed, try again on the SMTPS port
360
  data['action'] = 'postman_wizard_port_test_smtps';
 
361
  postThePortTest(hostname, port, data);
362
  }
363
  }
@@ -386,7 +391,8 @@ function afterPortsChecked() {
386
  var data = {
387
  'action' : 'get_wizard_configuration_options',
388
  'original_smtp_server' : smtpDiscovery.hostname,
389
- 'host_data' : connectivtyTestResults
 
390
  };
391
  postTheConfigurationRequest(data);
392
  hide('#connectivity_test_status');
@@ -403,7 +409,8 @@ function userOverrideMenu() {
403
  "input:radio[name='user_socket_override']:checked").val(),
404
  'user_auth_override' : jQuery(
405
  "input:radio[name='user_auth_override']:checked").val(),
406
- 'host_data' : connectivtyTestResults
 
407
  };
408
  postTheConfigurationRequest(data);
409
  }
@@ -544,7 +551,8 @@ function getConfiguration() {
544
  if (plugin != '') {
545
  var data = {
546
  'action' : 'import_configuration',
547
- 'plugin' : plugin
 
548
  };
549
  jQuery
550
  .post(
33
  'action' : 'postman_wizard_port_test',
34
  'hostname' : 'relay-hosting.secureserver.net',
35
  'port' : 25,
36
+ 'timeout' : 3,
37
+ 'security' : jQuery('#security').val(),
38
  };
39
  goDaddy = 'unknown';
40
  checkedEmail = false;
51
  var data = {
52
  'action' : 'postman_check_email',
53
  'go_daddy' : goDaddyHostDetected,
54
+ 'email' : email,
55
+ 'security' : jQuery('#security').val()
56
  };
57
  jQuery.post(
58
  ajaxurl,
284
  var data = {
285
  'action' : 'postman_get_hosts_to_test',
286
  'hostname' : hostname,
287
+ 'original_smtp_server' : smtpDiscovery.hostname,
288
+ 'security' : jQuery('#security').val(),
289
  };
290
  jQuery.post(ajaxurl, data, function(response) {
291
  if (postmanValidateAjaxResponseWithPopup(response)) {
314
  'action' : 'postman_wizard_port_test',
315
  'hostname' : hostname,
316
  'port' : port,
317
+ 'transport' : transport,
318
+ 'security' : jQuery('#security').val(),
319
  };
320
  postThePortTest(hostname, port, data);
321
  }
362
  } else {
363
  // SMTP failed, try again on the SMTPS port
364
  data['action'] = 'postman_wizard_port_test_smtps';
365
+ data['security'] = jQuery('#security').val();
366
  postThePortTest(hostname, port, data);
367
  }
368
  }
391
  var data = {
392
  'action' : 'get_wizard_configuration_options',
393
  'original_smtp_server' : smtpDiscovery.hostname,
394
+ 'host_data' : connectivtyTestResults,
395
+ 'security': jQuery('#security').val()
396
  };
397
  postTheConfigurationRequest(data);
398
  hide('#connectivity_test_status');
409
  "input:radio[name='user_socket_override']:checked").val(),
410
  'user_auth_override' : jQuery(
411
  "input:radio[name='user_auth_override']:checked").val(),
412
+ 'host_data' : connectivtyTestResults,
413
+ 'security' : jQuery('#security').val()
414
  };
415
  postTheConfigurationRequest(data);
416
  }
551
  if (plugin != '') {
552
  var data = {
553
  'action' : 'import_configuration',
554
+ 'plugin' : plugin,
555
+ '_wpnonce' : jQuery('#_wpnonce').val(),
556
  };
557
  jQuery
558
  .post(
Postman/Postman-Connectivity-Test/Postman-PortTest.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once ("registered-domain-libs-master/PHP/effectiveTLDs.inc.php");
3
  require_once ("registered-domain-libs-master/PHP/regDomain.inc.php");
4
 
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once ("registered-domain-libs-master/PHP/effectiveTLDs.inc.php");
7
  require_once ("registered-domain-libs-master/PHP/regDomain.inc.php");
8
 
Postman/Postman-Connectivity-Test/PostmanConnectivityTestController.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
 
3
  class PostmanConnectivityTestController {
4
 
@@ -137,6 +140,9 @@ class PostmanConnectivityTestController {
137
  print '<p>';
138
  print __( 'This test determines which well-known ports are available for Postman to use.', 'post-smtp' );
139
  print '<form id="port_test_form_id" method="post">';
 
 
 
140
  printf( '<label for="hostname">%s</label>', __( 'Outgoing Mail Server Hostname', 'post-smtp' ) );
141
  $this->port_test_hostname_callback();
142
  submit_button( _x( 'Begin Test', 'Button Label', 'post-smtp' ), 'primary', 'begin-port-test', true );
@@ -205,6 +211,9 @@ class PostmanPortTestAjaxController {
205
  * combinations to run the connectivity test on
206
  */
207
  function getPortsToTestViaAjax() {
 
 
 
208
  $queryHostname = PostmanUtils::getRequestParameter( 'hostname' );
209
  // originalSmtpServer is what SmtpDiscovery thinks the SMTP server should be, given an email address
210
  $originalSmtpServer = PostmanUtils::getRequestParameter( 'original_smtp_server' );
@@ -222,6 +231,9 @@ class PostmanPortTestAjaxController {
222
  * This Ajax function retrieves whether a TCP port is open or not
223
  */
224
  function runPortQuizTest() {
 
 
 
225
  $hostname = 'portquiz.net';
226
  $port = intval( PostmanUtils::getRequestParameter( 'port' ) );
227
  $this->logger->debug( 'testing TCP port: hostname ' . $hostname . ' port ' . $port );
@@ -235,6 +247,9 @@ class PostmanPortTestAjaxController {
235
  * This is called by both the Wizard and Port Test
236
  */
237
  function runSmtpTest() {
 
 
 
238
  $hostname = trim( PostmanUtils::getRequestParameter( 'hostname' ) );
239
  $port = intval( PostmanUtils::getRequestParameter( 'port' ) );
240
  $transport = trim( PostmanUtils::getRequestParameter( 'transport' ) );
@@ -258,6 +273,9 @@ class PostmanPortTestAjaxController {
258
  * This Ajax function retrieves whether a TCP port is open or not
259
  */
260
  function runSmtpsTest() {
 
 
 
261
  $hostname = trim( PostmanUtils::getRequestParameter( 'hostname' ) );
262
  $port = intval( PostmanUtils::getRequestParameter( 'port' ) );
263
  $transport = trim( PostmanUtils::getRequestParameter( 'transport' ) );
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
 
6
  class PostmanConnectivityTestController {
7
 
140
  print '<p>';
141
  print __( 'This test determines which well-known ports are available for Postman to use.', 'post-smtp' );
142
  print '<form id="port_test_form_id" method="post">';
143
+
144
+ wp_nonce_field('post-smtp', 'security' );
145
+
146
  printf( '<label for="hostname">%s</label>', __( 'Outgoing Mail Server Hostname', 'post-smtp' ) );
147
  $this->port_test_hostname_callback();
148
  submit_button( _x( 'Begin Test', 'Button Label', 'post-smtp' ), 'primary', 'begin-port-test', true );
211
  * combinations to run the connectivity test on
212
  */
213
  function getPortsToTestViaAjax() {
214
+
215
+ check_admin_referer('post-smtp', 'security');
216
+
217
  $queryHostname = PostmanUtils::getRequestParameter( 'hostname' );
218
  // originalSmtpServer is what SmtpDiscovery thinks the SMTP server should be, given an email address
219
  $originalSmtpServer = PostmanUtils::getRequestParameter( 'original_smtp_server' );
231
  * This Ajax function retrieves whether a TCP port is open or not
232
  */
233
  function runPortQuizTest() {
234
+
235
+ check_admin_referer('post-smtp', 'security');
236
+
237
  $hostname = 'portquiz.net';
238
  $port = intval( PostmanUtils::getRequestParameter( 'port' ) );
239
  $this->logger->debug( 'testing TCP port: hostname ' . $hostname . ' port ' . $port );
247
  * This is called by both the Wizard and Port Test
248
  */
249
  function runSmtpTest() {
250
+
251
+ check_admin_referer('post-smtp', 'security');
252
+
253
  $hostname = trim( PostmanUtils::getRequestParameter( 'hostname' ) );
254
  $port = intval( PostmanUtils::getRequestParameter( 'port' ) );
255
  $transport = trim( PostmanUtils::getRequestParameter( 'transport' ) );
273
  * This Ajax function retrieves whether a TCP port is open or not
274
  */
275
  function runSmtpsTest() {
276
+
277
+ check_admin_referer('post-smtp', 'security');
278
+
279
  $hostname = trim( PostmanUtils::getRequestParameter( 'hostname' ) );
280
  $port = intval( PostmanUtils::getRequestParameter( 'port' ) );
281
  $transport = trim( PostmanUtils::getRequestParameter( 'transport' ) );
Postman/Postman-Connectivity-Test/postman_port_test.js CHANGED
@@ -23,7 +23,8 @@ jQuery(document).ready(function() {
23
  var hostname = jQuery(postman_hostname_element_name).val();
24
  var data = {
25
  'action' : 'postman_get_hosts_to_test',
26
- 'hostname' : hostname
 
27
  };
28
 
29
  totalPortsTested = 0;
@@ -71,7 +72,8 @@ function portQuizTest(socket, hostname, port) {
71
  var data = {
72
  'action' : 'postman_port_quiz_test',
73
  'hostname' : hostname,
74
- 'port' : port
 
75
  };
76
  jQuery.post(
77
  ajaxurl,
@@ -104,7 +106,8 @@ function firstServiceTest(socket, hostname, port, open) {
104
  var data = {
105
  'action' : 'postman_test_port',
106
  'hostname' : hostname,
107
- 'port' : port
 
108
  };
109
  jQuery
110
  .post(
@@ -197,7 +200,8 @@ function portTest3(socket, hostname, port, open) {
197
  var data = {
198
  'action' : 'postman_test_smtps',
199
  'hostname' : hostname,
200
- 'port' : port
 
201
  };
202
  jQuery
203
  .post(
23
  var hostname = jQuery(postman_hostname_element_name).val();
24
  var data = {
25
  'action' : 'postman_get_hosts_to_test',
26
+ 'hostname' : hostname,
27
+ 'security' : jQuery('#security').val(),
28
  };
29
 
30
  totalPortsTested = 0;
72
  var data = {
73
  'action' : 'postman_port_quiz_test',
74
  'hostname' : hostname,
75
+ 'port' : port,
76
+ '_wpnonce' : jQuery('#_wpnonce').val(),
77
  };
78
  jQuery.post(
79
  ajaxurl,
106
  var data = {
107
  'action' : 'postman_test_port',
108
  'hostname' : hostname,
109
+ 'port' : port,
110
+ 'security' : jQuery('#security').val(),
111
  };
112
  jQuery
113
  .post(
200
  var data = {
201
  'action' : 'postman_test_smtps',
202
  'hostname' : hostname,
203
+ 'port' : port,
204
+ '_wpnonce' : jQuery('#_wpnonce').val(),
205
  };
206
  jQuery
207
  .post(
Postman/Postman-Controller/PostmanAdminPointer.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if (! class_exists ( 'PostmanAdminPointer' )) {
3
 
4
  /**
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if (! class_exists ( 'PostmanAdminPointer' )) {
7
 
8
  /**
Postman/Postman-Controller/PostmanDashboardWidgetController.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if (! class_exists ( "PostmanDashboardWidgetController" )) {
3
 
4
  //
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if (! class_exists ( "PostmanDashboardWidgetController" )) {
7
 
8
  //
Postman/Postman-Controller/PostmanManageConfigurationAjaxHandler.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  class PostmanWizardSocket {
3
 
4
  // these variables are populated by the Port Test
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  class PostmanWizardSocket {
7
 
8
  // these variables are populated by the Port Test
Postman/Postman-Controller/PostmanWelcomeController.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
 
3
  class PostmanWelcomeController {
4
 
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
 
6
  class PostmanWelcomeController {
7
 
Postman/Postman-Diagnostic-Test/PostmanDiagnosticTestController.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  class PostmanDiagnosticTestController {
3
  const DIAGNOSTICS_SLUG = 'postman/diagnostics';
4
 
@@ -100,6 +103,12 @@ class PostmanDiagnosticTestController {
100
 
101
  PostmanViewController::outputChildPageHeader( __( 'Diagnostic Test', 'post-smtp' ) );
102
 
 
 
 
 
 
 
103
  printf( '<h4>%s</h4>', __( 'Are you having issues with Postman?', 'post-smtp' ) );
104
  /* translators: where %1$s and %2$s are the URLs to the Troubleshooting and Support Forums on WordPress.org */
105
  printf( '<p style="margin:0 10px">%s</p>', sprintf( __( 'Please check the <a href="%1$s">troubleshooting and error messages</a> page and the <a href="%2$s">support forum</a>.', 'post-smtp' ), 'https://wordpress.org/plugins/post-smtp/other_notes/', 'https://wordpress.org/support/plugin/post-smtp' ) );
@@ -208,6 +217,9 @@ class PostmanGetDiagnosticsViaAjax {
208
  /**
209
  */
210
  public function getDiagnostics() {
 
 
 
211
  $curl = curl_version();
212
  $transportRegistry = PostmanTransportRegistry::getInstance();
213
  $this->addToDiagnostics( 'Mailer', PostmanOptions::getInstance()->getSmtpMailer() );
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  class PostmanDiagnosticTestController {
6
  const DIAGNOSTICS_SLUG = 'postman/diagnostics';
7
 
103
 
104
  PostmanViewController::outputChildPageHeader( __( 'Diagnostic Test', 'post-smtp' ) );
105
 
106
+ ?>
107
+ <form>
108
+ <?php wp_nonce_field('post-smtp', 'security' ); ?>
109
+ </form>
110
+ <?php
111
+
112
  printf( '<h4>%s</h4>', __( 'Are you having issues with Postman?', 'post-smtp' ) );
113
  /* translators: where %1$s and %2$s are the URLs to the Troubleshooting and Support Forums on WordPress.org */
114
  printf( '<p style="margin:0 10px">%s</p>', sprintf( __( 'Please check the <a href="%1$s">troubleshooting and error messages</a> page and the <a href="%2$s">support forum</a>.', 'post-smtp' ), 'https://wordpress.org/plugins/post-smtp/other_notes/', 'https://wordpress.org/support/plugin/post-smtp' ) );
217
  /**
218
  */
219
  public function getDiagnostics() {
220
+
221
+ check_admin_referer('post-smtp', 'security');
222
+
223
  $curl = curl_version();
224
  $transportRegistry = PostmanTransportRegistry::getInstance();
225
  $this->addToDiagnostics( 'Mailer', PostmanOptions::getInstance()->getSmtpMailer() );
Postman/Postman-Diagnostic-Test/postman_diagnostics.js CHANGED
@@ -6,7 +6,8 @@ jQuery(document).ready(function() {
6
  */
7
  function getDiagnosticData() {
8
  var data = {
9
- 'action' : 'postman_diagnostics'
 
10
  };
11
  jQuery.post(ajaxurl, data, function(response) {
12
  if (response.success) {
6
  */
7
  function getDiagnosticData() {
8
  var data = {
9
+ 'action' : 'postman_diagnostics',
10
+ 'security' : jQuery('#security').val()
11
  };
12
  jQuery.post(ajaxurl, data, function(response) {
13
  if (response.success) {
Postman/Postman-Email-Log/PostmanEmailLogController.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once dirname(__DIR__) . '/PostmanEmailLogs.php';
3
  require_once 'PostmanEmailLogService.php';
4
  require_once 'PostmanEmailLogView.php';
@@ -73,7 +77,7 @@ class PostmanEmailLogController {
73
  /**
74
  */
75
  public function resendMail() {
76
- check_ajax_referer( 'resend', 'security' );
77
 
78
  // get the email address of the recipient from the HTTP Request
79
  $postid = $this->getRequestParameter( 'email' );
@@ -200,8 +204,13 @@ class PostmanEmailLogController {
200
  // only do this for administrators
201
  if ( PostmanUtils::isAdmin() ) {
202
  $this->logger->trace( 'handling view item' );
203
- $postid = $_REQUEST ['email'];
204
  $post = get_post( $postid );
 
 
 
 
 
205
  $meta_values = PostmanEmailLogs::get_data( $postid );
206
  // https://css-tricks.com/examples/hrs/
207
  print '<html><head><style>body {font-family: monospace;} hr {
@@ -369,18 +378,21 @@ class PostmanEmailLogController {
369
  ?>
370
 
371
  <form id="postman-email-log-filter" method="post">
 
 
 
372
  <div id="email-log-filter" class="postman-log-row">
373
  <div class="form-control">
374
  <label for="from_date"><?php _e( 'From Date', 'post-smtp' ); ?></label>
375
- <input id="from_date" class="email-log-date" value="<?php echo $from_date; ?>" type="text" name="from_date" placeholder="<?php _e( 'From Date', 'post-smtp' ); ?>">
376
  </div>
377
  <div class="form-control">
378
  <label for="to_date"><?php _e( 'To Date', 'post-smtp' ); ?></label>
379
- <input id="to_date" class="email-log-date" value="<?php echo $to_date; ?>" type="text" name="to_date" placeholder="<?php _e( 'To Date', 'post-smtp' ); ?>">
380
  </div>
381
  <div class="form-control">
382
  <label for="search"><?php _e( 'Search', 'post-smtp' ); ?></label>
383
- <input id="search" type="text" name="search" value="<?php echo $search; ?>" placeholder="<?php _e( 'Search', 'post-smtp' ); ?>">
384
  </div>
385
  <div class="form-control">
386
  <label id="postman_page_records"><?php _e( 'Records per page', 'post-smtp' ); ?></label>
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once dirname(__DIR__) . '/PostmanEmailLogs.php';
7
  require_once 'PostmanEmailLogService.php';
8
  require_once 'PostmanEmailLogView.php';
77
  /**
78
  */
79
  public function resendMail() {
80
+ check_admin_referer( 'resend', 'security' );
81
 
82
  // get the email address of the recipient from the HTTP Request
83
  $postid = $this->getRequestParameter( 'email' );
204
  // only do this for administrators
205
  if ( PostmanUtils::isAdmin() ) {
206
  $this->logger->trace( 'handling view item' );
207
+ $postid = absint( $_REQUEST ['email'] );
208
  $post = get_post( $postid );
209
+
210
+ if ( $post->post_type !== 'postman_sent_mail' ) {
211
+ return;
212
+ }
213
+
214
  $meta_values = PostmanEmailLogs::get_data( $postid );
215
  // https://css-tricks.com/examples/hrs/
216
  print '<html><head><style>body {font-family: monospace;} hr {
378
  ?>
379
 
380
  <form id="postman-email-log-filter" method="post">
381
+ <input type="hidden" action="post-smtp-filter" value="1">
382
+ <?php wp_nonce_field('post-smtp', 'post-smtp-log'); ?>
383
+
384
  <div id="email-log-filter" class="postman-log-row">
385
  <div class="form-control">
386
  <label for="from_date"><?php _e( 'From Date', 'post-smtp' ); ?></label>
387
+ <input id="from_date" class="email-log-date" value="<?php echo esc_attr($from_date); ?>" type="text" name="from_date" placeholder="<?php _e( 'From Date', 'post-smtp' ); ?>">
388
  </div>
389
  <div class="form-control">
390
  <label for="to_date"><?php _e( 'To Date', 'post-smtp' ); ?></label>
391
+ <input id="to_date" class="email-log-date" value="<?php echo esc_attr($to_date); ?>" type="text" name="to_date" placeholder="<?php _e( 'To Date', 'post-smtp' ); ?>">
392
  </div>
393
  <div class="form-control">
394
  <label for="search"><?php _e( 'Search', 'post-smtp' ); ?></label>
395
+ <input id="search" type="text" name="search" value="<?php echo esc_attr($search); ?>" placeholder="<?php _e( 'Search', 'post-smtp' ); ?>">
396
  </div>
397
  <div class="form-control">
398
  <label id="postman_page_records"><?php _e( 'Records per page', 'post-smtp' ); ?></label>
Postman/Postman-Email-Log/PostmanEmailLogPostType.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( 'PostmanEmailLogPostType' )) {
3
 
4
  /**
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( 'PostmanEmailLogPostType' )) {
6
 
7
  /**
Postman/Postman-Email-Log/PostmanEmailLogService.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if ( ! class_exists( 'PostmanEmailLog' ) ) {
3
  class PostmanEmailLog {
4
  public $sender;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if ( ! class_exists( 'PostmanEmailLog' ) ) {
7
  class PostmanEmailLog {
8
  public $sender;
Postman/Postman-Email-Log/PostmanEmailLogView.php CHANGED
@@ -1,5 +1,7 @@
1
  <?php
2
-
 
 
3
  require_once dirname(__DIR__) . '/PostmanEmailLogs.php';
4
 
5
  /**
@@ -260,8 +262,12 @@ class PostmanEmailLogView extends WP_List_Table {
260
  * ************************************************************************
261
  */
262
  function prepare_items() {
 
 
 
 
263
 
264
- /**
265
  * First, lets decide how many records per page to show
266
  */
267
  $per_page = isset( $_POST['postman_page_records'] ) ? absint( $_POST['postman_page_records'] ) : 10;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  require_once dirname(__DIR__) . '/PostmanEmailLogs.php';
6
 
7
  /**
262
  * ************************************************************************
263
  */
264
  function prepare_items() {
265
+ if ( isset( $_POST['action'] ) && $_POST['action'] == 'post-smtp-filter' ) {
266
+ if ( ! wp_verify_nonce( $_REQUEST['post-smtp-log'], 'post-smtp' ) )
267
+ die( 'Security check' );
268
+ }
269
 
270
+ /**
271
  * First, lets decide how many records per page to show
272
  */
273
  $per_page = isset( $_POST['postman_page_records'] ) ? absint( $_POST['postman_page_records'] ) : 10;
Postman/Postman-Mail/PostmanContactForm7.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  class Postsmtp_ContactForm7 {
3
 
4
  private $result_error;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  class Postsmtp_ContactForm7 {
6
 
7
  private $result_error;
Postman/Postman-Mail/PostmanDefaultModuleTransport.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once 'PostmanModuleTransport.php';
3
  if (! class_exists ( 'PostmanSmtpModuleTransport' )) {
4
  class PostmanDefaultModuleTransport extends PostmanAbstractZendModuleTransport implements PostmanZendModuleTransport {
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once 'PostmanModuleTransport.php';
7
  if (! class_exists ( 'PostmanSmtpModuleTransport' )) {
8
  class PostmanDefaultModuleTransport extends PostmanAbstractZendModuleTransport implements PostmanZendModuleTransport {
Postman/Postman-Mail/PostmanEmailAddress.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if (! class_exists ( 'PostmanEmailAddress' )) {
3
  class PostmanEmailAddress {
4
  private $name;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if (! class_exists ( 'PostmanEmailAddress' )) {
7
  class PostmanEmailAddress {
8
  private $name;
Postman/Postman-Mail/PostmanGmailApiModuleTransport.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once 'PostmanModuleTransport.php';
3
 
4
  /**
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once 'PostmanModuleTransport.php';
7
 
8
  /**
Postman/Postman-Mail/PostmanGmailApiModuleZendMailTransport.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  /**
3
  * Zend Framework
4
  *
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  /**
7
  * Zend Framework
8
  *
Postman/Postman-Mail/PostmanMailEngine.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if (! interface_exists ( "PostmanMailEngine" )) {
3
 
4
  interface PostmanMailEngine {
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if (! interface_exists ( "PostmanMailEngine" )) {
7
 
8
  interface PostmanMailEngine {
Postman/Postman-Mail/PostmanMailgunMailEngine.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once 'mailgun/mailgun.php';
3
 
4
  use Mailgun\Mailgun;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once 'mailgun/mailgun.php';
7
 
8
  use Mailgun\Mailgun;
Postman/Postman-Mail/PostmanMailgunTransport.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once 'PostmanModuleTransport.php';
3
  /**
4
  * Postman Mailgun module
@@ -154,9 +158,9 @@ class PostmanMailgunTransport extends PostmanAbstractModuleTransport implements
154
  // push the authentication options into the $overrideItem structure
155
  $overrideItem ['auth_items'] = array(
156
  array(
157
- 'selected' => true,
158
- 'name' => __( 'API Key', 'post-smtp' ),
159
- 'value' => 'api_key',
160
  ),
161
  );
162
  return $overrideItem;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once 'PostmanModuleTransport.php';
7
  /**
8
  * Postman Mailgun module
158
  // push the authentication options into the $overrideItem structure
159
  $overrideItem ['auth_items'] = array(
160
  array(
161
+ 'selected' => true,
162
+ 'name' => __( 'API Key', 'post-smtp' ),
163
+ 'value' => 'api_key',
164
  ),
165
  );
166
  return $overrideItem;
Postman/Postman-Mail/PostmanMandrillMailEngine.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if ( ! class_exists( 'PostmanMandrillMailEngine' ) ) {
3
 
4
  require_once 'mailchimp-mandrill-api-php-da3adc10042e/src/Mandrill.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if ( ! class_exists( 'PostmanMandrillMailEngine' ) ) {
7
 
8
  require_once 'mailchimp-mandrill-api-php-da3adc10042e/src/Mandrill.php';
Postman/Postman-Mail/PostmanMandrillTransport.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once 'PostmanModuleTransport.php';
3
  /**
4
  * Postman Mandrill module
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once 'PostmanModuleTransport.php';
7
  /**
8
  * Postman Mandrill module
Postman/Postman-Mail/PostmanMessage.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if ( ! class_exists( 'PostmanMessage' ) ) {
3
 
4
  require_once 'PostmanEmailAddress.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if ( ! class_exists( 'PostmanMessage' ) ) {
7
 
8
  require_once 'PostmanEmailAddress.php';
Postman/Postman-Mail/PostmanModuleTransport.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  /**
3
  * Keep the interface_exists check here for Postman Gmail API Extension users!
4
  *
@@ -78,7 +82,7 @@ abstract class PostmanAbstractModuleTransport implements PostmanModuleTransport
78
 
79
  /**
80
  */
81
- public function __construct($rootPluginFilenameAndPath) {
82
  $this->logger = new PostmanLogger ( get_class ( $this ) );
83
  $this->options = PostmanOptions::getInstance ();
84
  $this->rootPluginFilenameAndPath = $rootPluginFilenameAndPath;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  /**
7
  * Keep the interface_exists check here for Postman Gmail API Extension users!
8
  *
82
 
83
  /**
84
  */
85
+ public function __construct($rootPluginFilenameAndPath = null) {
86
  $this->logger = new PostmanLogger ( get_class ( $this ) );
87
  $this->options = PostmanOptions::getInstance ();
88
  $this->rootPluginFilenameAndPath = $rootPluginFilenameAndPath;
Postman/Postman-Mail/PostmanMyMailConnector.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  define( 'MAILSTER_POSTMAN_REQUIRED_VERSION', '2.0' );
3
  define( 'MAILSTER_POSTMAN_ID', 'postman' );
4
 
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  define( 'MAILSTER_POSTMAN_REQUIRED_VERSION', '2.0' );
7
  define( 'MAILSTER_POSTMAN_ID', 'postman' );
8
 
Postman/Postman-Mail/PostmanSendGridMailEngine.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
 
3
  if ( ! class_exists( 'PostmanSendGridMailEngine' ) ) {
4
 
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
 
6
  if ( ! class_exists( 'PostmanSendGridMailEngine' ) ) {
7
 
Postman/Postman-Mail/PostmanSendGridTransport.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once 'PostmanModuleTransport.php';
3
  /**
4
  * Postman SendGrid module
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once 'PostmanModuleTransport.php';
7
  /**
8
  * Postman SendGrid module
Postman/Postman-Mail/PostmanSmtpModuleTransport.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once 'PostmanModuleTransport.php';
3
 
4
  /**
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once 'PostmanModuleTransport.php';
7
 
8
  /**
Postman/Postman-Mail/PostmanTransportRegistry.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once 'PostmanModuleTransport.php';
3
  require_once 'PostmanZendMailTransportConfigurationFactory.php';
4
 
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once 'PostmanModuleTransport.php';
7
  require_once 'PostmanZendMailTransportConfigurationFactory.php';
8
 
Postman/Postman-Mail/PostmanWooCommerce.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
 
3
  if ( ! class_exists( 'PostmanWoocommerce' ) ) {
4
  class PostmanWoocommerce {
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
 
6
  if ( ! class_exists( 'PostmanWoocommerce' ) ) {
7
  class PostmanWoocommerce {
Postman/Postman-Mail/PostmanZendMailEngine.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if ( ! class_exists( 'PostmanZendMailEngine' ) ) {
3
 
4
  require_once 'Zend-1.12.10/Loader.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if ( ! class_exists( 'PostmanZendMailEngine' ) ) {
7
 
8
  require_once 'Zend-1.12.10/Loader.php';
Postman/Postman-Mail/PostmanZendMailTransportConfigurationFactory.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if (! interface_exists ( 'PostmanZendMailTransportConfigurationFactory' )) {
3
  interface PostmanZendMailTransportConfigurationFactory {
4
  static function createConfig(PostmanTransport $transport);
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if (! interface_exists ( 'PostmanZendMailTransportConfigurationFactory' )) {
7
  interface PostmanZendMailTransportConfigurationFactory {
8
  static function createConfig(PostmanTransport $transport);
Postman/Postman-Send-Test-Email/PostmanSendTestEmailController.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  class PostmanSendTestEmailController {
3
  const EMAIL_TEST_SLUG = 'postman/email_test';
4
  const RECIPIENT_EMAIL_FIELD_NAME = 'postman_recipient_email';
@@ -127,6 +131,8 @@ class PostmanSendTestEmailController {
127
 
128
  printf( '<form id="postman_test_email_wizard" method="post" action="%s">', PostmanUtils::getSettingsPageUrl() );
129
 
 
 
130
  // Step 1
131
  printf( '<h5>%s</h5>', __( 'Specify the Recipient', 'post-smtp' ) );
132
  print '<fieldset>';
@@ -199,6 +205,9 @@ class PostmanSendTestEmailAjaxController extends PostmanAbstractAjaxHandler {
199
  * This Ajax sends a test email
200
  */
201
  function sendTestEmailViaAjax() {
 
 
 
202
  // get the email address of the recipient from the HTTP Request
203
  $email = $this->getRequestParameter( 'email' );
204
 
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  class PostmanSendTestEmailController {
7
  const EMAIL_TEST_SLUG = 'postman/email_test';
8
  const RECIPIENT_EMAIL_FIELD_NAME = 'postman_recipient_email';
131
 
132
  printf( '<form id="postman_test_email_wizard" method="post" action="%s">', PostmanUtils::getSettingsPageUrl() );
133
 
134
+ wp_nonce_field('post-smtp', 'security' );
135
+
136
  // Step 1
137
  printf( '<h5>%s</h5>', __( 'Specify the Recipient', 'post-smtp' ) );
138
  print '<fieldset>';
205
  * This Ajax sends a test email
206
  */
207
  function sendTestEmailViaAjax() {
208
+
209
+ check_admin_referer('post-smtp', 'security');
210
+
211
  // get the email address of the recipient from the HTTP Request
212
  $email = $this->getRequestParameter( 'email' );
213
 
Postman/Postman-Send-Test-Email/postman_send_test_email.js CHANGED
@@ -107,7 +107,8 @@ function postHandleStepChange(event, currentIndex, priorIndex, myself) {
107
  jQuery('li').addClass('disabled');
108
  var data = {
109
  'action' : 'postman_send_test_email',
110
- 'email' : jQuery(postman_email_test.recipient).val()
 
111
  };
112
  jQuery('#postman_test_message_status').html(postman_email_test.sending);
113
  jQuery('#postman_test_message_status').css('color', 'blue');
107
  jQuery('li').addClass('disabled');
108
  var data = {
109
  'action' : 'postman_send_test_email',
110
+ 'email' : jQuery(postman_email_test.recipient).val(),
111
+ 'security' : jQuery('#security').val()
112
  };
113
  jQuery('#postman_test_message_status').html(postman_email_test.sending);
114
  jQuery('#postman_test_message_status').css('color', 'blue');
Postman/Postman.php CHANGED
@@ -1,5 +1,7 @@
1
  <?php
2
-
 
 
3
  /**
4
  * Postman execution begins here:
5
  * - the default Postman transports are loaded
@@ -35,6 +37,8 @@ class Postman {
35
  private $pluginData;
36
  private $rootPluginFilenameAndPath;
37
 
 
 
38
  /**
39
  * The constructor
40
  *
@@ -45,6 +49,7 @@ class Postman {
45
  assert( ! empty( $rootPluginFilenameAndPath ) );
46
  assert( ! empty( $version ) );
47
  $this->rootPluginFilenameAndPath = $rootPluginFilenameAndPath;
 
48
 
49
  // load the dependencies
50
  require_once 'PostmanOptions.php';
@@ -152,9 +157,6 @@ class Postman {
152
  $active_plugins = (array)get_option('active_plugins', array());
153
  if (in_array('sitepress-multilingual-cms/sitepress.php', $active_plugins) && !get_option('postman_wpml_fixed')) {
154
  add_action('admin_notices', array($this, 'post_smtp_wpml_admin_notice'));
155
-
156
- // Temp: Just a quick solution, need to find a better option.
157
- add_action('admin_init', array($this, 'postman_fix_wpml'));
158
  }
159
  }
160
 
@@ -178,30 +180,6 @@ class Postman {
178
 
179
  }
180
 
181
- public function post_smtp_wpml_admin_notice() {
182
- $class = 'notice notice-error';
183
- $title = __( 'Post SMTP notice!', 'post-smtp' );
184
- $intro = __( 'WPML is installed and has a known bug with Post SMTP and few other plugins - you better upgrade, but we can try to fix it.', 'post-smtp' );
185
- $text = __( 'Click here to fix', 'post-smtp' );
186
- $message = '<br><a href="' . esc_url( add_query_arg( 'action', 'postman_fix_wpml', get_permalink() ) ) . '">' . $text . '</a>';
187
-
188
- printf( '<div class="%1$s"><h2>%2$s</h2><p>%3$s</p><p>%4$s</p></div>', esc_attr( $class ), $title, $intro, $message );
189
- }
190
-
191
- public function postman_fix_wpml() {
192
- if ( isset( $_GET['action'] ) && $_GET['action'] == 'postman_fix_wpml' ) {
193
- $wpml_file_path = WP_PLUGIN_DIR . '/sitepress-multilingual-cms/inc/utilities/wpml-data-encryptor.class.php';
194
-
195
- if ( file_exists( $wpml_file_path ) ) {
196
- $content = file_get_contents( $wpml_file_path );
197
- $content = str_replace( "require_once ABSPATH . '/wp-includes/pluggable.php';", "//require_once ABSPATH . '/wp-includes/pluggable.php';", $content );
198
- file_put_contents( $wpml_file_path, $content );
199
- }
200
-
201
- update_option( 'postman_wpml_fixed', true );
202
- wp_redirect( esc_url( remove_query_arg( 'action' ) ) );
203
- }
204
- }
205
 
206
  /**
207
  * Functions to execute on the plugins_loaded event
@@ -433,7 +411,7 @@ class Postman {
433
  $message .= (sprintf( ' %s | %s', $goToEmailLog, $goToSettings ));
434
  $message .= '<input type="hidden" name="security" class="security" value="' . wp_create_nonce('postsmtp') . '">';
435
 
436
- $hide = get_option('postman_release_version_not_configured' );
437
 
438
  if ( $msg['error'] == true && ! $hide ) {
439
  $this->messageHandler->printMessage( $message, 'postman-not-configured-notice notice notice-error is-dismissible' );
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  /**
6
  * Postman execution begins here:
7
  * - the default Postman transports are loaded
37
  private $pluginData;
38
  private $rootPluginFilenameAndPath;
39
 
40
+ public static $rootPlugin;
41
+
42
  /**
43
  * The constructor
44
  *
49
  assert( ! empty( $rootPluginFilenameAndPath ) );
50
  assert( ! empty( $version ) );
51
  $this->rootPluginFilenameAndPath = $rootPluginFilenameAndPath;
52
+ self::$rootPlugin = $rootPluginFilenameAndPath;
53
 
54
  // load the dependencies
55
  require_once 'PostmanOptions.php';
157
  $active_plugins = (array)get_option('active_plugins', array());
158
  if (in_array('sitepress-multilingual-cms/sitepress.php', $active_plugins) && !get_option('postman_wpml_fixed')) {
159
  add_action('admin_notices', array($this, 'post_smtp_wpml_admin_notice'));
 
 
 
160
  }
161
  }
162
 
180
 
181
  }
182
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
183
 
184
  /**
185
  * Functions to execute on the plugins_loaded event
411
  $message .= (sprintf( ' %s | %s', $goToEmailLog, $goToSettings ));
412
  $message .= '<input type="hidden" name="security" class="security" value="' . wp_create_nonce('postsmtp') . '">';
413
 
414
+ $hide = get_option('postman_release_version' );
415
 
416
  if ( $msg['error'] == true && ! $hide ) {
417
  $this->messageHandler->printMessage( $message, 'postman-not-configured-notice notice notice-error is-dismissible' );
Postman/PostmanAdminController.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if ( ! class_exists( 'PostmanAdminController' ) ) {
3
 
4
  require_once 'PostmanOptions.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if ( ! class_exists( 'PostmanAdminController' ) ) {
7
 
8
  require_once 'PostmanOptions.php';
Postman/PostmanAjaxController.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if (! class_exists ( 'PostmanAbstractAjaxHandler' )) {
3
 
4
  require_once ('PostmanPreRequisitesCheck.php');
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if (! class_exists ( 'PostmanAbstractAjaxHandler' )) {
7
 
8
  require_once ('PostmanPreRequisitesCheck.php');
Postman/PostmanConfigTextHelper.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if ( ! interface_exists( 'PostmanConfigTextHelper' ) ) {
3
  interface PostmanConfigTextHelper {
4
  public function isOauthHost();
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if ( ! interface_exists( 'PostmanConfigTextHelper' ) ) {
7
  interface PostmanConfigTextHelper {
8
  public function isOauthHost();
Postman/PostmanEmailLogs.php CHANGED
@@ -1,5 +1,7 @@
1
  <?php
2
-
 
 
3
  class PostmanEmailLogs {
4
 
5
  private $db;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  class PostmanEmailLogs {
6
 
7
  private $db;
Postman/PostmanInputSanitizer.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if ( ! class_exists( 'PostmanInputSanitizer' ) ) {
3
  class PostmanInputSanitizer {
4
  private $logger;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if ( ! class_exists( 'PostmanInputSanitizer' ) ) {
6
  class PostmanInputSanitizer {
7
  private $logger;
Postman/PostmanInstaller.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  require_once( 'PostmanOAuthToken.php' );
3
  require_once( 'PostmanOptions.php' );
4
 
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  require_once( 'PostmanOAuthToken.php' );
7
  require_once( 'PostmanOptions.php' );
8
 
Postman/PostmanLogger.php CHANGED
@@ -1,4 +1,8 @@
1
  <?php
 
 
 
 
2
  if (! class_exists ( "PostmanLogger" )) {
3
 
4
  //
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
+
6
  if (! class_exists ( "PostmanLogger" )) {
7
 
8
  //
Postman/PostmanMessageHandler.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( 'PostmanMessageHandler' )) {
3
 
4
  require_once ('PostmanSession.php');
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( 'PostmanMessageHandler' )) {
6
 
7
  require_once ('PostmanSession.php');
Postman/PostmanOAuthToken.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( 'PostmanOAuthToken.php' )) {
3
 
4
  class PostmanOAuthToken {
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( 'PostmanOAuthToken.php' )) {
6
 
7
  class PostmanOAuthToken {
Postman/PostmanOptions.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if ( ! interface_exists( 'PostmanOptionsInterface' ) ) {
3
  interface PostmanOptionsInterface {
4
  /**
@@ -172,7 +175,7 @@ if ( ! class_exists( 'PostmanOptions' ) ) {
172
  $this->load();
173
  }
174
 
175
- private function load() {
176
 
177
  $options = get_option( self::POSTMAN_OPTIONS );
178
 
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if ( ! interface_exists( 'PostmanOptionsInterface' ) ) {
6
  interface PostmanOptionsInterface {
7
  /**
175
  $this->load();
176
  }
177
 
178
+ public function load() {
179
 
180
  $options = get_option( self::POSTMAN_OPTIONS );
181
 
Postman/PostmanPluginFeedback.php CHANGED
@@ -1,5 +1,7 @@
1
  <?php
2
-
 
 
3
  class PostmanPluginFeedback {
4
  function __construct() {
5
  add_filter( 'plugin_action_links_' . plugin_basename( POST_BASE ), array( $this, 'insert_deactivate_link_id' ) );
@@ -152,4 +154,4 @@ class PostmanPluginFeedback {
152
  <?php
153
  }
154
  }
155
- new PostmanPluginFeedback;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  class PostmanPluginFeedback {
6
  function __construct() {
7
  add_filter( 'plugin_action_links_' . plugin_basename( POST_BASE ), array( $this, 'insert_deactivate_link_id' ) );
154
  <?php
155
  }
156
  }
157
+ //new PostmanPluginFeedback;
Postman/PostmanPreRequisitesCheck.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( 'PostmanPreRequisitesCheck' )) {
3
  class PostmanPreRequisitesCheck {
4
  public static function checkIconv() {
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( 'PostmanPreRequisitesCheck' )) {
6
  class PostmanPreRequisitesCheck {
7
  public static function checkIconv() {
Postman/PostmanSession.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( 'PostmanSession' )) {
3
 
4
  /**
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( 'PostmanSession' )) {
6
 
7
  /**
Postman/PostmanState.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( "PostmanState" )) {
3
 
4
  /**
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( "PostmanState" )) {
6
 
7
  /**
Postman/PostmanUtils.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  require_once 'PostmanLogger.php';
3
  require_once 'PostmanState.php';
4
 
@@ -368,9 +371,9 @@ class PostmanUtils {
368
  */
369
  static function postmanGetServerName() {
370
  if ( ! empty( $_SERVER ['SERVER_NAME'] ) ) {
371
- $serverName = $_SERVER ['SERVER_NAME'];
372
  } else if ( ! empty( $_SERVER ['HTTP_HOST'] ) ) {
373
- $serverName = $_SERVER ['HTTP_HOST'];
374
  } else {
375
  $serverName = 'localhost.localdomain';
376
  }
@@ -410,6 +413,7 @@ class PostmanUtils {
410
  * @param mixed $callbackName
411
  */
412
  public static function registerAjaxHandler( $actionName, $class, $callbackName ) {
 
413
  if ( is_admin() ) {
414
  $fullname = 'wp_ajax_' . $actionName;
415
  // $this->logger->debug ( 'Registering ' . 'wp_ajax_' . $fullname . ' Ajax handler' );
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  require_once 'PostmanLogger.php';
6
  require_once 'PostmanState.php';
7
 
371
  */
372
  static function postmanGetServerName() {
373
  if ( ! empty( $_SERVER ['SERVER_NAME'] ) ) {
374
+ $serverName = sanitize_text_field($_SERVER ['SERVER_NAME']);
375
  } else if ( ! empty( $_SERVER ['HTTP_HOST'] ) ) {
376
+ $serverName = sanitize_text_field($_SERVER ['HTTP_HOST']);
377
  } else {
378
  $serverName = 'localhost.localdomain';
379
  }
413
  * @param mixed $callbackName
414
  */
415
  public static function registerAjaxHandler( $actionName, $class, $callbackName ) {
416
+
417
  if ( is_admin() ) {
418
  $fullname = 'wp_ajax_' . $actionName;
419
  // $this->logger->debug ( 'Registering ' . 'wp_ajax_' . $fullname . ' Ajax handler' );
Postman/PostmanViewController.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if ( ! class_exists( 'PostmanViewController' ) ) {
3
  class PostmanViewController {
4
  private $logger;
@@ -46,19 +49,19 @@ if ( ! class_exists( 'PostmanViewController' ) ) {
46
 
47
 
48
  function dismiss_version_notify() {
49
- check_ajax_referer( 'postsmtp', 'security' );
50
 
51
  $result = update_option('postman_release_version', true );
52
  }
53
 
54
  function dismiss_donation_notify() {
55
- check_ajax_referer( 'postsmtp', 'security' );
56
 
57
  $result = update_option('postman_dismiss_donation', true );
58
  }
59
 
60
  function delete_lock_file() {
61
- check_ajax_referer( 'postman', 'security' );
62
 
63
  if ( ! PostmanUtils::lockFileExists() ) {
64
  echo __('No lock file found.', 'post-smtp' );
@@ -295,7 +298,7 @@ if ( ! class_exists( 'PostmanViewController' ) ) {
295
  print '</section>';
296
  print '<section id="delete_settings">';
297
  printf( '<h3><span>%s<span></h3>', $resetTitle );
298
- print '<form method="POST" action="' . get_admin_url() . 'admin-post.php">';
299
  wp_nonce_field( PostmanAdminController::PURGE_DATA_SLUG );
300
  printf( '<input type="hidden" name="action" value="%s" />', PostmanAdminController::PURGE_DATA_SLUG );
301
  printf( '<p><span>%s</span></p><p><span>%s</span></p>', __( 'This will purge all of Postman\'s settings, including account credentials and the email log.', 'post-smtp' ), __( 'Are you sure?', 'post-smtp' ) );
@@ -375,9 +378,6 @@ if ( ! class_exists( 'PostmanViewController' ) ) {
375
  printf( '<li><img class="align-middle" src="' . plugins_url( 'style/images/new.gif', dirname( __DIR__ ) . '/postman-smtp.php' ) . '"><a target="blank" class="align-middle" href="https://postmansmtp.com/category/guides/" class="welcome-icon postman_guides">%s</a></li>', __( 'Guides', 'post-smtp' ) );
376
  print '</ul></div></div></div></div>';
377
  ?>
378
- <div class="twitter-iframe-wrap" style="min-width: 300px;">
379
- <a class="twitter-timeline" data-height="304" href="https://twitter.com/PostSMTP?ref_src=twsrc%5Etfw">Tweets by PostSMTP</a> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
380
- </div>
381
  </div>
382
  <?php
383
  }
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if ( ! class_exists( 'PostmanViewController' ) ) {
6
  class PostmanViewController {
7
  private $logger;
49
 
50
 
51
  function dismiss_version_notify() {
52
+ check_admin_referer( 'postsmtp', 'security' );
53
 
54
  $result = update_option('postman_release_version', true );
55
  }
56
 
57
  function dismiss_donation_notify() {
58
+ check_admin_referer( 'postsmtp', 'security' );
59
 
60
  $result = update_option('postman_dismiss_donation', true );
61
  }
62
 
63
  function delete_lock_file() {
64
+ check_admin_referer( 'postman', 'security' );
65
 
66
  if ( ! PostmanUtils::lockFileExists() ) {
67
  echo __('No lock file found.', 'post-smtp' );
298
  print '</section>';
299
  print '<section id="delete_settings">';
300
  printf( '<h3><span>%s<span></h3>', $resetTitle );
301
+ print '<form class="post-smtp-reset-options" method="POST" action="' . get_admin_url() . 'admin-post.php">';
302
  wp_nonce_field( PostmanAdminController::PURGE_DATA_SLUG );
303
  printf( '<input type="hidden" name="action" value="%s" />', PostmanAdminController::PURGE_DATA_SLUG );
304
  printf( '<p><span>%s</span></p><p><span>%s</span></p>', __( 'This will purge all of Postman\'s settings, including account credentials and the email log.', 'post-smtp' ), __( 'Are you sure?', 'post-smtp' ) );
378
  printf( '<li><img class="align-middle" src="' . plugins_url( 'style/images/new.gif', dirname( __DIR__ ) . '/postman-smtp.php' ) . '"><a target="blank" class="align-middle" href="https://postmansmtp.com/category/guides/" class="welcome-icon postman_guides">%s</a></li>', __( 'Guides', 'post-smtp' ) );
379
  print '</ul></div></div></div></div>';
380
  ?>
 
 
 
381
  </div>
382
  <?php
383
  }
Postman/PostmanWpMail.php CHANGED
@@ -1,5 +1,7 @@
1
  <?php
2
-
 
 
3
  if ( ! class_exists( 'PostmanWpMail' ) ) {
4
 
5
  /**
@@ -75,7 +77,7 @@ if ( ! class_exists( 'PostmanWpMail' ) ) {
75
  $id = md5(uniqid(time()));
76
 
77
  if (isset($_SERVER["SERVER_NAME"])) {
78
- $hostName = $_SERVER["SERVER_NAME"];
79
  } else {
80
  $hostName = php_uname('n');
81
  }
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if ( ! class_exists( 'PostmanWpMail' ) ) {
6
 
7
  /**
77
  $id = md5(uniqid(time()));
78
 
79
  if (isset($_SERVER["SERVER_NAME"])) {
80
+ $hostName = sanitize_text_field($_SERVER["SERVER_NAME"]);
81
  } else {
82
  $hostName = php_uname('n');
83
  }
Postman/PostmanWpMailBinder.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  if (! class_exists ( 'PostmanWpMailBinder' )) {
3
  class PostmanWpMailBinder {
4
  private $logger;
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  if (! class_exists ( 'PostmanWpMailBinder' )) {
6
  class PostmanWpMailBinder {
7
  private $logger;
Postman/notifications/INotify.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  interface Postman_Notify {
3
  public function send_message( $message );
4
  }
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  interface Postman_Notify {
6
  public function send_message( $message );
7
  }
Postman/notifications/PostmanMailNotify.php CHANGED
@@ -1,5 +1,7 @@
1
  <?php
2
-
 
 
3
  class PostmanMailNotify implements Postman_Notify {
4
 
5
  public function send_message($message)
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  class PostmanMailNotify implements Postman_Notify {
6
 
7
  public function send_message($message)
Postman/notifications/PostmanNotify.php CHANGED
@@ -1,4 +1,7 @@
1
  <?php
 
 
 
2
  require_once 'INotify.php';
3
  require_once 'PostmanMailNotify.php';
4
  require_once 'PostmanPushoverNotify.php';
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  require_once 'INotify.php';
6
  require_once 'PostmanMailNotify.php';
7
  require_once 'PostmanPushoverNotify.php';
Postman/notifications/PostmanPushoverNotify.php CHANGED
@@ -1,5 +1,7 @@
1
  <?php
2
-
 
 
3
  class PostmanPushoverNotify implements Postman_Notify {
4
 
5
  public function send_message($message)
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  class PostmanPushoverNotify implements Postman_Notify {
6
 
7
  public function send_message($message)
Postman/notifications/PostmanSlackNotify.php CHANGED
@@ -1,5 +1,7 @@
1
  <?php
2
-
 
 
3
  class PostmanSlackNotify implements Postman_Notify {
4
 
5
  public function send_message($message)
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  class PostmanSlackNotify implements Postman_Notify {
6
 
7
  public function send_message($message)
postman-smtp.php CHANGED
@@ -1,9 +1,12 @@
1
  <?php
 
 
 
2
  /*
3
  * Plugin Name: Post SMTP
4
  * Plugin URI: https://wordpress.org/plugins/post-smtp/
5
  * Description: Email not reliable? Post SMTP is the first and only WordPress SMTP plugin to implement OAuth 2.0 for Gmail, Hotmail and Yahoo Mail. Setup is a breeze with the Configuration Wizard and integrated Port Tester. Enjoy worry-free delivery even if your password changes!
6
- * Version: 2.0.2
7
  * Author: Yehuda Hassine
8
  * Text Domain: post-smtp
9
  * Author URI: https://postmansmtp.com
@@ -41,7 +44,7 @@
41
  define( 'POST_BASE', __FILE__ );
42
  define( 'POST_PATH', __DIR__ );
43
  define( 'POST_URL', plugins_url('', POST_BASE ) );
44
- define( 'POST_SMTP_VER', '2.0.2' );
45
 
46
  $postman_smtp_exist = in_array( 'postman-smtp/postman-smtp.php', (array) get_option( 'active_plugins', array() ) );
47
  $required_php_version = version_compare( PHP_VERSION, '5.6.0', '<' );
@@ -129,4 +132,5 @@ function post_start( $startingMemory ) {
129
  function post_setupPostman() {
130
  require_once 'Postman/Postman.php';
131
  $kevinCostner = new Postman( __FILE__, POST_SMTP_VER );
 
132
  }
1
  <?php
2
+ if ( ! defined( 'ABSPATH' ) ) {
3
+ exit; // Exit if accessed directly
4
+ }
5
  /*
6
  * Plugin Name: Post SMTP
7
  * Plugin URI: https://wordpress.org/plugins/post-smtp/
8
  * Description: Email not reliable? Post SMTP is the first and only WordPress SMTP plugin to implement OAuth 2.0 for Gmail, Hotmail and Yahoo Mail. Setup is a breeze with the Configuration Wizard and integrated Port Tester. Enjoy worry-free delivery even if your password changes!
9
+ * Version: 2.0.3
10
  * Author: Yehuda Hassine
11
  * Text Domain: post-smtp
12
  * Author URI: https://postmansmtp.com
44
  define( 'POST_BASE', __FILE__ );
45
  define( 'POST_PATH', __DIR__ );
46
  define( 'POST_URL', plugins_url('', POST_BASE ) );
47
+ define( 'POST_SMTP_VER', '2.0.3' );
48
 
49
  $postman_smtp_exist = in_array( 'postman-smtp/postman-smtp.php', (array) get_option( 'active_plugins', array() ) );
50
  $required_php_version = version_compare( PHP_VERSION, '5.6.0', '<' );
132
  function post_setupPostman() {
133
  require_once 'Postman/Postman.php';
134
  $kevinCostner = new Postman( __FILE__, POST_SMTP_VER );
135
+ do_action( 'post_smtp_init');
136
  }
readme.txt CHANGED
@@ -3,8 +3,8 @@ Contributors: yehudah
3
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=yehuda@myinbox.in&item_name=Donation+for+PostSMTP
4
  Tags: postman smtp, postman, smtp, email, mail, mailer, email log, oauth2, gmail, google apps, hotmail, yahoo, mandrill api, sendgrid api, elastic email, office365, mailgun
5
  Requires at least: 3.9
6
- Tested up to: 5.2
7
- Stable tag: 2.0.2
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
@@ -12,8 +12,8 @@ Send, log and troubleshoot your Outgoing Email easily. Supports everything: SMTP
12
 
13
  == Description ==
14
 
15
- = Version 2.0.2 released - Sendgrid code fix and default delivery changes =
16
- [Read the detailes here](https://postmansmtp.com/post-smtp-2-0-2-sendgrid-code-fix/)
17
 
18
  = The Only SMTP plugin with chrome Notifications =
19
  Get notified if your emails are failing inside your Chrome browser. [Download here](https://chrome.google.com/webstore/detail/post-smtp-notifications/npklmbkpbknkmbohdbpikeidiaekjoch?hl=en-US)
@@ -289,6 +289,9 @@ To avoid being flagged as spam, you need to prove your email isn't forged. On a
289
 
290
  == Changelog ==
291
 
 
 
 
292
  = 2.0.2 - 2019-05-19
293
  * Fixed: Sendgrid code fix.
294
  * Fixed: Default method (nothing configured) will use the default mail on the server and not SMTP.
3
  Donate link: https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=yehuda@myinbox.in&item_name=Donation+for+PostSMTP
4
  Tags: postman smtp, postman, smtp, email, mail, mailer, email log, oauth2, gmail, google apps, hotmail, yahoo, mandrill api, sendgrid api, elastic email, office365, mailgun
5
  Requires at least: 3.9
6
+ Tested up to: 5.2.2
7
+ Stable tag: 2.0.3
8
  License: GPLv2 or later
9
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
10
 
12
 
13
  == Description ==
14
 
15
+ = Version 2.0.3 released - Security Fix =
16
+ I fixed a few security issues - I still need to fix one more thing (minor), so another version bump will coming soon.
17
 
18
  = The Only SMTP plugin with chrome Notifications =
19
  Get notified if your emails are failing inside your Chrome browser. [Download here](https://chrome.google.com/webstore/detail/post-smtp-notifications/npklmbkpbknkmbohdbpikeidiaekjoch?hl=en-US)
289
 
290
  == Changelog ==
291
 
292
+ = 2.0.3 - 2019-08-21
293
+ * Fixed: A few security issues.
294
+
295
  = 2.0.2 - 2019-05-19
296
  * Fixed: Sendgrid code fix.
297
  * Fixed: Default method (nothing configured) will use the default mail on the server and not SMTP.
script/postman.js CHANGED
@@ -1,6 +1,15 @@
1
  jQuery(document).ready(function($) {
2
  $( ".email-log-date" ).datepicker();
3
 
 
 
 
 
 
 
 
 
 
4
  $('.notice-dismiss.postman-release-message').on('click', function() {
5
  var $this = $(this);
6
  var args = {
1
  jQuery(document).ready(function($) {
2
  $( ".email-log-date" ).datepicker();
3
 
4
+ $('.post-smtp-reset-options').on('submit', function(e) {
5
+ var result = confirm('Are you sure?');
6
+
7
+ if ( ! result ) {
8
+ e.preventDefault();
9
+ return false;
10
+ }
11
+ });
12
+
13
  $('.notice-dismiss.postman-release-message').on('click', function() {
14
  var $this = $(this);
15
  var args = {