WP Photo Album Plus - Version 8.0.10.005

Version Description

= 8.0.10 =

  • This version addresses various bug fixes, feature requests and security fixes.
Download this release

Release Info

Developer opajaap
Plugin Icon wp plugin WP Photo Album Plus
Version 8.0.10.005
Comparing to
See all releases

Code changes from version 8.0.10.004 to 8.0.10.005

Files changed (6) hide show
  1. changelog.txt +2 -0
  2. readme.txt +1 -1
  3. wppa-ajax.php +7 -47
  4. wppa-input.php +6 -5
  5. wppa-utils.php +8 -3
  6. wppa.php +2 -2
changelog.txt CHANGED
@@ -2,6 +2,7 @@ WP Photo Album Plus Changelog
2
 
3
  = 8.0.10 =
4
 
 
5
  * Added option 'Same as filmthumb' to the links on slideshow images.
6
  This makes sense only for links on filmthubs to lightbox. This construction will transfer the click on slide image to filmstrip image.
7
  This is to overcome the restriction that links from slideshow to lightbox do not support zoomable and panoramic images.
@@ -22,6 +23,7 @@ If you want to show your own zipfile only: Tick Advanced settings -> System -> I
22
  * When the 'Admins choice' selection includes tagging the photo, it will now be tagged by the users displayname rather than user-<userid>.
23
  * Added maintenance procedure Advanced settings -> Maintenance -> III: One time conversions -> Item 3 to convert old style Choice generated tags to new style tags.
24
  * Corrected (lowered) wheel zoom sensitivity on panoramic and zoomable images for browsers other than chrome.
 
25
 
26
  = 8.0.09 =
27
 
2
 
3
  = 8.0.10 =
4
 
5
+ * Security fix: The logfile was prone to XSS attacks. Fixed.
6
  * Added option 'Same as filmthumb' to the links on slideshow images.
7
  This makes sense only for links on filmthubs to lightbox. This construction will transfer the click on slide image to filmstrip image.
8
  This is to overcome the restriction that links from slideshow to lightbox do not support zoomable and panoramic images.
23
  * When the 'Admins choice' selection includes tagging the photo, it will now be tagged by the users displayname rather than user-<userid>.
24
  * Added maintenance procedure Advanced settings -> Maintenance -> III: One time conversions -> Item 3 to convert old style Choice generated tags to new style tags.
25
  * Corrected (lowered) wheel zoom sensitivity on panoramic and zoomable images for browsers other than chrome.
26
+ * On new sites one did not have the rights to change the photo of the day settings. Fixed.
27
 
28
  = 8.0.09 =
29
 
readme.txt CHANGED
@@ -5,7 +5,7 @@ Tags: photo, album, slideshow, video, audio, lightbox, iptc, exif, cloudinary, f
5
  Requires at least: 3.9
6
  Tested up to: 5.8
7
  Requires PHP: 5.5
8
- Stable tag: 8.0.09.003
9
  License: GPLv2 or later
10
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
 
5
  Requires at least: 3.9
6
  Tested up to: 5.8
7
  Requires PHP: 5.5
8
+ Stable tag: 8.0.10.005
9
  License: GPLv2 or later
10
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
11
 
wppa-ajax.php CHANGED
@@ -2,7 +2,7 @@
2
  /* wppa-ajax.php
3
  *
4
  * Functions used in ajax requests
5
- * Version 8.0.10.002
6
  *
7
  */
8
 
@@ -3003,10 +3003,14 @@ global $wppa;
3003
  case 'update-option':
3004
 
3005
  // Verify that we are legally here
 
 
 
 
3006
  $nonce = wppa_get( 'nonce' );
3007
  if ( ! wp_verify_nonce( $nonce, 'wppa-nonce' ) ) {
3008
- echo '||1||'.__( 'You do not have the rights to update settings' , 'wp-photo-album-plus');
3009
- wppa_exit(); // Nonce check failed
3010
  }
3011
 
3012
  // Initialize
@@ -3019,50 +3023,6 @@ global $wppa;
3019
  wppa( 'error', '0' ); //
3020
  $title = ''; //
3021
 
3022
- // Check for potd settings
3023
- $potdarr = array( 'wppa_potd_title',
3024
- 'wppa_potd_widget_width',
3025
- 'wppa_potd_align',
3026
- 'wppa_potd_linkurl',
3027
- 'wppa_potd_linktitle',
3028
- 'wppa_potd_subtitle',
3029
- 'wppa_potd_counter',
3030
- 'wppa_potd_counter_link',
3031
- 'wppa_potd_album_type',
3032
- 'wppa_potd_album',
3033
- 'wppa_potd_include_subs',
3034
- 'wppa_potd_status_filter',
3035
- 'wppa_potd_inverse',
3036
- 'wppa_potd_method',
3037
- 'wppa_potd_period',
3038
- 'wppa_potd_offset',
3039
- 'wppa_potd_photo',
3040
- );
3041
-
3042
- // Settings for edit photo tag
3043
- $edit_tag_arr = array( 'wppa_tag_to_edit',
3044
- 'wppa_new_tag_value',
3045
- 'wppa_edit_tag',
3046
- );
3047
-
3048
- if ( in_array( $option, $potdarr ) ) {
3049
- if ( ! current_user_can( 'wppa_potd' ) ) {
3050
- echo '||1||'.__( 'You do not have the rights to update photo of the day settings' , 'wp-photo-album-plus');
3051
- wppa_exit();
3052
- }
3053
- }
3054
- elseif ( in_array( $option, $edit_tag_arr ) ) {
3055
- if ( ! current_user_can( 'wppa_settings' ) && ! current_user_can( 'wppa_edit_tags' ) ) {
3056
- echo '||1||'.__( 'You do not have the rights to update settings' , 'wp-photo-album-plus') . ' (et)';
3057
- wppa_exit();
3058
- }
3059
- }
3060
- else {
3061
- if ( ! current_user_can( 'wppa_settings' ) ) {
3062
- echo '||1||'.__( 'You do not have the rights to update settings' , 'wp-photo-album-plus');
3063
- wppa_exit();
3064
- }
3065
- }
3066
 
3067
  // If it is a font family, change all double quotes into single quotes as this destroys much more than you would like
3068
  if ( strpos( $option, 'wppa_fontfamily_' ) !== false ) $value = str_replace( '"', "'", $value );
2
  /* wppa-ajax.php
3
  *
4
  * Functions used in ajax requests
5
+ * Version 8.0.10.005
6
  *
7
  */
8
 
3003
  case 'update-option':
3004
 
3005
  // Verify that we are legally here
3006
+ if ( ! current_user_can( 'wppa_settings' ) ) {
3007
+ echo '||1||'.__( 'You do not have the rights to update settings', 'wp-photo-album-plus' );
3008
+ wppa_exit();
3009
+ }
3010
  $nonce = wppa_get( 'nonce' );
3011
  if ( ! wp_verify_nonce( $nonce, 'wppa-nonce' ) ) {
3012
+ echo '||1||'.__( 'Security check failure', 'wp-photo-album-plus' );
3013
+ wppa_exit();
3014
  }
3015
 
3016
  // Initialize
3023
  wppa( 'error', '0' ); //
3024
  $title = ''; //
3025
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3026
 
3027
  // If it is a font family, change all double quotes into single quotes as this destroys much more than you would like
3028
  if ( strpos( $option, 'wppa_fontfamily_' ) !== false ) $value = str_replace( '"', "'", $value );
wppa-input.php CHANGED
@@ -3,7 +3,7 @@
3
  * Package: wp-photo-album-plus
4
  *
5
  * Contains functions for sanitizing and formatting user input
6
- * Version 8.0.10.002
7
  *
8
  */
9
 
@@ -129,6 +129,7 @@ function wppa_get_get_filter( $name ) {
129
  case 'bulk':
130
  case 'applynewdesc':
131
  case 'remakealbum':
 
132
  $result = 'bool';
133
  break;
134
 
@@ -360,13 +361,13 @@ global $wpdb;
360
  break;
361
 
362
  case 'raw':
363
- $result = $value;
364
- wppa_log( 'obs', 'Unfiltered (raw) querystring arg= ' . $name . ', value= ' . var_export( $value, true ) );
365
  break;
366
 
367
  default:
368
- $result = $value;
369
- wppa_log( 'obs', 'Unknown filter for querystring arg= ' . $name . ', value= ' . var_export( $value, true ) );
370
  break;
371
  }
372
 
3
  * Package: wp-photo-album-plus
4
  *
5
  * Contains functions for sanitizing and formatting user input
6
+ * Version 8.0.10.005
7
  *
8
  */
9
 
129
  case 'bulk':
130
  case 'applynewdesc':
131
  case 'remakealbum':
132
+ case 'search-submit':
133
  $result = 'bool';
134
  break;
135
 
361
  break;
362
 
363
  case 'raw':
364
+ wppa_log( 'obs', 'Unfiltered (raw) querystring arg = ' . $name . ', value = ' . var_export( $value, true ) );
365
+ $result = $value ? '1' : '0';
366
  break;
367
 
368
  default:
369
+ wppa_log( 'obs', 'Unknown filter for querystring arg = ' . $name . ', value = ' . var_export( $value, true ) );
370
+ $result = $value ? '1' : '0';
371
  break;
372
  }
373
 
wppa-utils.php CHANGED
@@ -3,7 +3,7 @@
3
  * Package: wp-photo-album-plus
4
  *
5
  * Contains low-level utility routines
6
- * Version 8.0.10.002
7
  *
8
  */
9
 
@@ -1565,6 +1565,13 @@ static $repeat_count;
1565
  return;
1566
  }
1567
 
 
 
 
 
 
 
 
1568
  // Test for recursive logging
1569
  if ( $busy ) {
1570
  update_option( 'wppa_recursive_log', $xtype . ' ' . $msg );
@@ -1726,8 +1733,6 @@ static $repeat_count;
1726
  }
1727
 
1728
  // Write log message
1729
- $msg = strip_tags( $msg );
1730
- $msg = wppa_nl2sp( $msg );
1731
  if ( $err && $wppa_current_shortcode ) {
1732
  $msg .= ' related shortcode: ' . $wppa_current_shortcode;
1733
  }
3
  * Package: wp-photo-album-plus
4
  *
5
  * Contains low-level utility routines
6
+ * Version 8.0.10.005
7
  *
8
  */
9
 
1565
  return;
1566
  }
1567
 
1568
+ // Sanitize message
1569
+ $msg = strip_tags( $msg );
1570
+ $msg = wppa_nl2sp( $msg );
1571
+ $msg = htmlspecialchars( $msg, ENT_QUOTES );
1572
+ $msg = str_replace( ['{', '}'], ['&#123;', '&#125;'], $msg );
1573
+ $msg = str_replace( ['&#123;b&#125;', '&#123;/b&#125;'], ['{b}', '{/b}'], $msg );
1574
+
1575
  // Test for recursive logging
1576
  if ( $busy ) {
1577
  update_option( 'wppa_recursive_log', $xtype . ' ' . $msg );
1733
  }
1734
 
1735
  // Write log message
 
 
1736
  if ( $err && $wppa_current_shortcode ) {
1737
  $msg .= ' related shortcode: ' . $wppa_current_shortcode;
1738
  }
wppa.php CHANGED
@@ -2,7 +2,7 @@
2
  /*
3
  * Plugin Name: WP Photo Album Plus
4
  * Description: Easily manage and display your photo albums and slideshows within your WordPress site.
5
- * Version: 8.0.10.004
6
  * Author: J.N. Breetvelt a.k.a. OpaJaap
7
  * Author URI: http://wppa.opajaap.nl/
8
  * Plugin URI: http://wordpress.org/extend/plugins/wp-photo-album-plus/
@@ -24,7 +24,7 @@ global $wp_version;
24
 
25
  /* WPPA GLOBALS */
26
  global $wppa_api_version;
27
- $wppa_api_version = '8.0.10.004'; // WPPA software version
28
  global $wppa_revno;
29
  $wppa_revno = str_replace( '.', '', $wppa_api_version ); // WPPA db version
30
 
2
  /*
3
  * Plugin Name: WP Photo Album Plus
4
  * Description: Easily manage and display your photo albums and slideshows within your WordPress site.
5
+ * Version: 8.0.10.005
6
  * Author: J.N. Breetvelt a.k.a. OpaJaap
7
  * Author URI: http://wppa.opajaap.nl/
8
  * Plugin URI: http://wordpress.org/extend/plugins/wp-photo-album-plus/
24
 
25
  /* WPPA GLOBALS */
26
  global $wppa_api_version;
27
+ $wppa_api_version = '8.0.10.005'; // WPPA software version
28
  global $wppa_revno;
29
  $wppa_revno = str_replace( '.', '', $wppa_api_version ); // WPPA db version
30