The Events Calendar - Version 4.0.5

Version Description

Download this release

Release Info

Developer borkweb
Plugin Icon The Events Calendar
Version 4.0.5
Comparing to
See all releases

Code changes from version 4.0.4 to 4.0.5

Files changed (11) hide show
  1. common/src/Tribe/Date_Utils.php +17 -0
  2. common/src/Tribe/Main.php +1 -1
  3. common/src/functions/template-tags/general.php +21 -2
  4. readme.txt +6 -2
  5. src/Tribe/Google_Data_Markup.php +3 -3
  6. src/Tribe/Main.php +1 -1
  7. src/Tribe/Template/Month.php +1 -1
  8. src/functions/template-tags/loop.php +2 -2
  9. src/functions/template-tags/organizer.php +3 -3
  10. src/functions/template-tags/venue.php +2 -2
  11. the-events-calendar.php +1 -1
common/src/Tribe/Date_Utils.php CHANGED
@@ -782,6 +782,23 @@ if ( ! class_exists( 'Tribe__Date_Utils' ) ) {
782
  return mktime( 0, 0, 0, $month, $startday + $offset, $year );
783
  }
784
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
785
  // @codingStandardsIgnoreEnd
786
  }
787
 
782
  return mktime( 0, 0, 0, $month, $startday + $offset, $year );
783
  }
784
 
785
+ /**
786
+ * Unescapes date format strings to be used in functions like `date`.
787
+ *
788
+ * Double escaping happens when storing a date format in the database.
789
+ *
790
+ * @param mixed $date_format A date format string.
791
+ *
792
+ * @return mixed Either the original input or an unescaped date format string.
793
+ */
794
+ public static function unescape_date_format( $date_format ) {
795
+ if ( ! is_string( $date_format ) ) {
796
+ return $date_format;
797
+ }
798
+
799
+ // Why so simple? Let's handle other cases as those come up. We have tests in place!
800
+ return str_replace( '\\\\', '\\', $date_format );
801
+ }
802
  // @codingStandardsIgnoreEnd
803
  }
804
 
common/src/Tribe/Main.php CHANGED
@@ -17,7 +17,7 @@ class Tribe__Main {
17
  const OPTIONNAME = 'tribe_events_calendar_options';
18
  const OPTIONNAMENETWORK = 'tribe_events_calendar_network_options';
19
 
20
- const VERSION = '4.0.2';
21
  const FEED_URL = 'https://theeventscalendar.com/feed/';
22
 
23
  protected $plugin_context;
17
  const OPTIONNAME = 'tribe_events_calendar_options';
18
  const OPTIONNAMENETWORK = 'tribe_events_calendar_network_options';
19
 
20
+ const VERSION = '4.0.5';
21
  const FEED_URL = 'https://theeventscalendar.com/feed/';
22
 
23
  protected $plugin_context;
common/src/functions/template-tags/general.php CHANGED
@@ -153,9 +153,9 @@ if ( ! function_exists( 'tribe_get_date_format' ) ) {
153
  */
154
  function tribe_get_date_format( $with_year = false ) {
155
  if ( $with_year ) {
156
- $format = tribe_get_option( 'dateWithYearFormat', get_option( 'date_format' ) );
157
  } else {
158
- $format = tribe_get_option( 'dateWithoutYearFormat', 'F j' );
159
  }
160
 
161
  // Strip slashes - otherwise the slashes for escaped characters will themselves be escaped
@@ -436,3 +436,22 @@ if ( ! function_exists( 'tribe_format_currency' ) ) {
436
 
437
  }
438
  }//end if
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
153
  */
154
  function tribe_get_date_format( $with_year = false ) {
155
  if ( $with_year ) {
156
+ $format = tribe_get_date_option( 'dateWithYearFormat', get_option( 'date_format' ) );
157
  } else {
158
+ $format = tribe_get_date_option( 'dateWithoutYearFormat', 'F j' );
159
  }
160
 
161
  // Strip slashes - otherwise the slashes for escaped characters will themselves be escaped
436
 
437
  }
438
  }//end if
439
+
440
+ if ( ! function_exists( 'tribe_get_date_option' ) ) {
441
+ /**
442
+ * Get a date option.
443
+ *
444
+ * Retrieve an option value taking care to escape it to preserve date format slashes.
445
+ *
446
+ * @category Events
447
+ * @param string $optionName Name of the option to retrieve.
448
+ * @param string $default Value to return if no such option is found.
449
+ *
450
+ * @return mixed Value of the option if found
451
+ */
452
+ function tribe_get_date_option( $optionName, $default = '' ) {
453
+ $value = tribe_get_option( $optionName, $default );
454
+
455
+ return Tribe__Date_Utils::unescape_date_format($value);
456
+ }
457
+ }
readme.txt CHANGED
@@ -4,8 +4,8 @@ Contributors: ModernTribe, borkweb, zbtirrell, barry.hughes, bordoni, brianjesse
4
  Tags: events, calendar, event, venue, organizer, dates, date, google maps, conference, workshop, concert, meeting, seminar, summit, class, modern tribe, tribe, widget
5
  Donate link: http://m.tri.be/29
6
  Requires at least: 3.9
7
- Tested up to: 4.4
8
- Stable tag: 4.0.4
9
  License: GPLv2 or later
10
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
 
@@ -309,6 +309,10 @@ At no point during the 3.0 lifecycle will the major version change. But you can
309
 
310
  == Changelog ==
311
 
 
 
 
 
312
  = [4.0.4] 2015-12-23 =
313
 
314
  * Tweak - Including the latest embedded Event Tickets release for backward compatibility
4
  Tags: events, calendar, event, venue, organizer, dates, date, google maps, conference, workshop, concert, meeting, seminar, summit, class, modern tribe, tribe, widget
5
  Donate link: http://m.tri.be/29
6
  Requires at least: 3.9
7
+ Tested up to: 4.4.1
8
+ Stable tag: 4.0.5
9
  License: GPLv2 or later
10
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
 
309
 
310
  == Changelog ==
311
 
312
+ = [4.0.5] 2016-01-15 =
313
+
314
+ * Security - Security fix with Venues and Organizers (props to grantdayjames for reporting this!)
315
+
316
  = [4.0.4] 2015-12-23 =
317
 
318
  * Tweak - Including the latest embedded Event Tickets release for backward compatibility
src/Tribe/Google_Data_Markup.php CHANGED
@@ -20,12 +20,12 @@ abstract class Tribe__Events__Google_Data_Markup {
20
  $data[ $id ] = new stdClass();
21
  $data[ $id ]->{'@context'} = 'http://schema.org';
22
  $data[ $id ]->{'@type'} = 'Thing';
23
- $data[ $id ]->name = get_the_title();
24
- $data[ $id ]->description = tribe_events_get_the_excerpt( $post );
25
  if ( has_post_thumbnail() ) {
26
  $data[ $id ]->image = wp_get_attachment_url( get_post_thumbnail_id( $id ) );
27
  }
28
- $data[ $id ]->url = get_permalink( $id );
29
 
30
  return $data;
31
  }
20
  $data[ $id ] = new stdClass();
21
  $data[ $id ]->{'@context'} = 'http://schema.org';
22
  $data[ $id ]->{'@type'} = 'Thing';
23
+ $data[ $id ]->name = esc_js( get_the_title() );
24
+ $data[ $id ]->description = esc_js( tribe_events_get_the_excerpt( $post ) );
25
  if ( has_post_thumbnail() ) {
26
  $data[ $id ]->image = wp_get_attachment_url( get_post_thumbnail_id( $id ) );
27
  }
28
+ $data[ $id ]->url = esc_url_raw( get_permalink( $id ) );
29
 
30
  return $data;
31
  }
src/Tribe/Main.php CHANGED
@@ -32,7 +32,7 @@ if ( ! class_exists( 'Tribe__Events__Main' ) ) {
32
  const VENUE_POST_TYPE = 'tribe_venue';
33
  const ORGANIZER_POST_TYPE = 'tribe_organizer';
34
 
35
- const VERSION = '4.0.4';
36
  const MIN_ADDON_VERSION = '4.0';
37
  const WP_PLUGIN_URL = 'http://wordpress.org/extend/plugins/the-events-calendar/';
38
 
32
  const VENUE_POST_TYPE = 'tribe_venue';
33
  const ORGANIZER_POST_TYPE = 'tribe_organizer';
34
 
35
+ const VERSION = '4.0.5';
36
  const MIN_ADDON_VERSION = '4.0';
37
  const WP_PLUGIN_URL = 'http://wordpress.org/extend/plugins/the-events-calendar/';
38
 
src/Tribe/Template/Month.php CHANGED
@@ -300,7 +300,7 @@ if ( ! class_exists( 'Tribe__Events__Template__Month' ) ) {
300
  $new_title = parent::get_title( $original_title, $sep );
301
  if ( get_query_var( 'eventDate' ) && has_filter( 'tribe_month_grid_view_title' ) ) {
302
  _deprecated_function( "The 'tribe_month_grid_view_title' filter", '3.8', " the 'tribe_get_events_title' filter" );
303
- $title_date = date_i18n( tribe_get_option( 'monthAndYearFormat', 'F Y' ), strtotime( get_query_var( 'eventDate' ) ) );
304
  $new_title = apply_filters( 'tribe_month_grid_view_title', $new_title, $sep, $title_date );
305
  } elseif ( has_filter( 'tribe_events_this_month_title' ) ) {
306
  _deprecated_function( "The 'tribe_events_this_month_title' filter", '3.8', " the 'tribe_get_events_title' filter" );
300
  $new_title = parent::get_title( $original_title, $sep );
301
  if ( get_query_var( 'eventDate' ) && has_filter( 'tribe_month_grid_view_title' ) ) {
302
  _deprecated_function( "The 'tribe_month_grid_view_title' filter", '3.8', " the 'tribe_get_events_title' filter" );
303
+ $title_date = date_i18n( tribe_get_date_option( 'monthAndYearFormat', 'F Y' ), strtotime( get_query_var( 'eventDate' ) ) );
304
  $new_title = apply_filters( 'tribe_month_grid_view_title', $new_title, $sep, $title_date );
305
  } elseif ( has_filter( 'tribe_events_this_month_title' ) ) {
306
  _deprecated_function( "The 'tribe_events_this_month_title' filter", '3.8', " the 'tribe_get_events_title' filter" );
src/functions/template-tags/loop.php CHANGED
@@ -151,7 +151,7 @@ if ( class_exists( 'Tribe__Events__Main' ) ) {
151
  $title = sprintf(
152
  esc_html__( '%1$s for %2$s', 'the-events-calendar' ),
153
  $events_label_plural,
154
- date_i18n( tribe_get_option( 'monthAndYearFormat', 'F Y' ), strtotime( tribe_get_month_view_date() ) )
155
  );
156
  }
157
 
@@ -321,7 +321,7 @@ if ( class_exists( 'Tribe__Events__Main' ) ) {
321
 
322
  $event_year = tribe_get_start_date( $post, false, 'Y' );
323
  $event_month = tribe_get_start_date( $post, false, 'm' );
324
- $month_year_format = tribe_get_option( 'monthAndYearFormat', 'F Y' );
325
 
326
  if ( $wp_query->current_post > 0 ) {
327
  $prev_post = $wp_query->posts[ $wp_query->current_post - 1 ];
151
  $title = sprintf(
152
  esc_html__( '%1$s for %2$s', 'the-events-calendar' ),
153
  $events_label_plural,
154
+ date_i18n( tribe_get_date_option( 'monthAndYearFormat', 'F Y' ), strtotime( tribe_get_month_view_date() ) )
155
  );
156
  }
157
 
321
 
322
  $event_year = tribe_get_start_date( $post, false, 'Y' );
323
  $event_month = tribe_get_start_date( $post, false, 'm' );
324
+ $month_year_format = tribe_get_date_option( 'monthAndYearFormat', 'F Y' );
325
 
326
  if ( $wp_query->current_post > 0 ) {
327
  $prev_post = $wp_query->posts[ $wp_query->current_post - 1 ];
src/functions/template-tags/organizer.php CHANGED
@@ -218,7 +218,7 @@ if ( class_exists( 'Tribe__Events__Main' ) ) {
218
  if ( ! function_exists( 'tribe_get_organizer_website_url' ) ) { // wrapped in if function exists to maintain compatibility with community events 3.0.x. wrapper not needed after 3.1.x.
219
  function tribe_get_organizer_website_url( $postId = null ) {
220
  $postId = Tribe__Events__Main::postIdHelper( $postId );
221
- $output = esc_url( tribe_get_event_meta( tribe_get_organizer_id( $postId ), '_OrganizerWebsite', true ) );
222
 
223
  return apply_filters( 'tribe_get_organizer_website_url', $output );
224
  }
@@ -247,9 +247,9 @@ if ( class_exists( 'Tribe__Events__Main' ) ) {
247
  }
248
  $html = sprintf(
249
  '<a href="%s" target="%s">%s</a>',
250
- esc_url( $url ),
251
  apply_filters( 'tribe_get_organizer_website_link_target', '_self' ),
252
- apply_filters( 'tribe_get_organizer_website_link_label', $label )
253
  );
254
  } else {
255
  $html = '';
218
  if ( ! function_exists( 'tribe_get_organizer_website_url' ) ) { // wrapped in if function exists to maintain compatibility with community events 3.0.x. wrapper not needed after 3.1.x.
219
  function tribe_get_organizer_website_url( $postId = null ) {
220
  $postId = Tribe__Events__Main::postIdHelper( $postId );
221
+ $output = esc_url( esc_html( tribe_get_event_meta( tribe_get_organizer_id( $postId ), '_OrganizerWebsite', true ) ) );
222
 
223
  return apply_filters( 'tribe_get_organizer_website_url', $output );
224
  }
247
  }
248
  $html = sprintf(
249
  '<a href="%s" target="%s">%s</a>',
250
+ esc_attr( esc_url( $url ) ),
251
  apply_filters( 'tribe_get_organizer_website_link_target', '_self' ),
252
+ apply_filters( 'tribe_get_organizer_website_link_label', esc_html( $label ) )
253
  );
254
  } else {
255
  $html = '';
src/functions/template-tags/venue.php CHANGED
@@ -410,9 +410,9 @@ if ( class_exists( 'Tribe__Events__Main' ) ) {
410
  }
411
  $html = sprintf(
412
  '<a href="%s" target="%s">%s</a>',
413
- esc_url( $url ),
414
  apply_filters( 'tribe_get_venue_website_link_target', '_self' ),
415
- apply_filters( 'tribe_get_venue_website_link_label', $label )
416
  );
417
  } else {
418
  $html = '';
410
  }
411
  $html = sprintf(
412
  '<a href="%s" target="%s">%s</a>',
413
+ esc_attr( esc_url( $url ) ),
414
  apply_filters( 'tribe_get_venue_website_link_target', '_self' ),
415
+ apply_filters( 'tribe_get_venue_website_link_label', esc_html( $label ) )
416
  );
417
  } else {
418
  $html = '';
the-events-calendar.php CHANGED
@@ -2,7 +2,7 @@
2
  /*
3
  Plugin Name: The Events Calendar
4
  Description: The Events Calendar is a carefully crafted, extensible plugin that lets you easily share your events. Beautiful. Solid. Awesome.
5
- Version: 4.0.4
6
  Author: Modern Tribe, Inc.
7
  Author URI: http://m.tri.be/1x
8
  Text Domain: the-events-calendar
2
  /*
3
  Plugin Name: The Events Calendar
4
  Description: The Events Calendar is a carefully crafted, extensible plugin that lets you easily share your events. Beautiful. Solid. Awesome.
5
+ Version: 4.0.5
6
  Author: Modern Tribe, Inc.
7
  Author URI: http://m.tri.be/1x
8
  Text Domain: the-events-calendar