WP Socializer - Version 2.4.3

Version Description

  • XSS Vulnerability issue in the "Services selector" page is fixed.
  • Added nounce to the Admin page forms.
  • Fixed bug in the Twitter social button template.
  • Fixed the collision of the quotes in the excerpt with the HTML tags for the email button.
Download this release

Release Info

Developer vaakash
Plugin Icon 128x128 WP Socializer
Version 2.4.3
Comparing to
See all releases

Code changes from version 2.4.2 to 2.4.3

Files changed (6) hide show
  1. admin/wpsr-admin-floating-bar.php +4 -2
  2. admin/wpsr-admin.php +8 -4
  3. admin/wpsr-services-selector.php +25 -7
  4. includes/wpsr-socialbuttons.php +2 -2
  5. readme.txt +9 -3
  6. wp-socializer.php +5 -5
admin/wpsr-admin-floating-bar.php CHANGED
@@ -21,12 +21,12 @@ function wpsr_floatbts_reset_values(){
21
 
22
  function wpsr_admin_page_floating_bar(){
23
 
24
- if(isset($_POST["wpsr_floatbts_reset"])){
25
  wpsr_floatbts_reset_values();
26
  $reset = 1;
27
  }
28
 
29
- if (isset($_POST["wpsr_floatbts_submit"])){
30
 
31
  $wpsr_floatbts['selectedbts'] = stripslashes($_POST['wpsr_floatbts_selectedbts']);
32
  $wpsr_floatbts['position'] = $_POST['wpsr_floatbts_position'];
@@ -71,6 +71,7 @@ function wpsr_admin_page_floating_bar(){
71
  <ul class="wpsr_share_wrap">
72
  <li class="wpsr_donate" data-width="300" data-height="220" data-url="<?php echo WPSR_ADMIN_URL . 'js/share.php?i=1'; ?>"><a href="#"></a></li>
73
  <li class="wpsr_share" data-width="350" data-height="85" data-url="<?php echo WPSR_ADMIN_URL . 'js/share.php?i=2'; ?>"><a href="#"></a></li>
 
74
  </ul>
75
 
76
  <form id="content" method="post">
@@ -153,6 +154,7 @@ function wpsr_admin_page_floating_bar(){
153
  </div>
154
 
155
  <div class="footer">
 
156
  <input type="hidden" name="wpsr_floatbts_selectedbts" id="wpsr_floatbts_selectedbts" value="<?php echo $wpsr_floatbts['selectedbts']; ?>" />
157
  <input class="button-primary" type="submit" name="wpsr_floatbts_submit" id="wpsr_floatbts_submit" value="<?php _e('Update', 'wpsr'); ?>" />
158
  <input class="button alignright" type="submit" name="wpsr_floatbts_reset" id="wpsr_floatbts_reset" value=" <?php _e('Reset', 'wpsr'); ?> " />
21
 
22
  function wpsr_admin_page_floating_bar(){
23
 
24
+ if(isset($_POST["wpsr_floatbts_reset"]) && check_admin_referer('wpsr_floatbts_main_form')){
25
  wpsr_floatbts_reset_values();
26
  $reset = 1;
27
  }
28
 
29
+ if (isset($_POST["wpsr_floatbts_submit"]) && check_admin_referer('wpsr_floatbts_main_form')){
30
 
31
  $wpsr_floatbts['selectedbts'] = stripslashes($_POST['wpsr_floatbts_selectedbts']);
32
  $wpsr_floatbts['position'] = $_POST['wpsr_floatbts_position'];
71
  <ul class="wpsr_share_wrap">
72
  <li class="wpsr_donate" data-width="300" data-height="220" data-url="<?php echo WPSR_ADMIN_URL . 'js/share.php?i=1'; ?>"><a href="#"></a></li>
73
  <li class="wpsr_share" data-width="350" data-height="85" data-url="<?php echo WPSR_ADMIN_URL . 'js/share.php?i=2'; ?>"><a href="#"></a></li>
74
+ <li class="wpsr_pressthis" title="Share a small post about this plugin in your blog !"><a href="press-this.php" target="_blank"></a></li>
75
  </ul>
76
 
77
  <form id="content" method="post">
154
  </div>
155
 
156
  <div class="footer">
157
+ <?php wp_nonce_field('wpsr_floatbts_main_form'); ?>
158
  <input type="hidden" name="wpsr_floatbts_selectedbts" id="wpsr_floatbts_selectedbts" value="<?php echo $wpsr_floatbts['selectedbts']; ?>" />
159
  <input class="button-primary" type="submit" name="wpsr_floatbts_submit" id="wpsr_floatbts_submit" value="<?php _e('Update', 'wpsr'); ?>" />
160
  <input class="button alignright" type="submit" name="wpsr_floatbts_reset" id="wpsr_floatbts_reset" value=" <?php _e('Reset', 'wpsr'); ?> " />
admin/wpsr-admin.php CHANGED
@@ -343,16 +343,19 @@ function wpsr_admin_page(){
343
  if (function_exists('current_user_can') && !current_user_can('manage_options'))
344
  die(__('Sorry you do not have enough previliges to access this page.'));
345
 
346
- if (isset($_POST['wpsr_reset'])){
 
347
  wpsr_reset_values();
348
  $wpsr_reseted = true;
349
  }
350
 
351
- if (isset($_POST['wpsr_intro_submit'])){
 
352
  update_option("wpsr_version", WPSR_VERSION);
353
  }
354
 
355
- if (isset($_POST["wpsr_submit"])) {
 
356
  ## Addthis options
357
  $wpsr_addthis['username'] = $_POST['wpsr_addthis_username'];
358
  $wpsr_addthis['language'] = $_POST['wpsr_addthis_lang'];
@@ -746,6 +749,7 @@ function wpsr_admin_page(){
746
  </div>
747
 
748
  <div class="footer">
 
749
  <input class="button-primary" type="submit" name="wpsr_submit" id="wpsr_submit" value="<?php _e('Update', 'wpsr'); ?>" />
750
  <input class="button alignright" type="submit" name="wpsr_reset" id="wpsr_reset" value=" <?php _e('Reset', 'wpsr'); ?> " />
751
  </div>
@@ -1198,7 +1202,6 @@ function wpsr_admin_page(){
1198
 
1199
  </div><!-- Window -->
1200
 
1201
-
1202
  </form><!-- Content -->
1203
 
1204
  <div class="bottomInfo">
@@ -1235,6 +1238,7 @@ function wpsr_admin_page(){
1235
  <p class="refLinks"><b><a href="http://www.aakashweb.com/wordpress-plugins/wp-socializer/" target="_blank"><?php _e('Full Features', 'wpsr'); ?></a> | <a href="http://www.aakashweb.com/docs/wp-socializer-docs/" target="_blank"><?php _e('Documentation', 'wpsr'); ?></a> | <a href="http://www.aakashweb.com/forum/" target="_blank"><?php _e('Support', 'wpsr'); ?></a> | <a href="http://www.aakashweb.com/forum/" target="_blank"><?php _e('Bug Report', 'wpsr'); ?></a> | <a href="http://www.aakashweb.com/wordpress-plugins/wp-socializer/#videos" target="_blank"><?php _e('Video Demo & Tutorials', 'wpsr'); ?></a></b></p>
1236
 
1237
  <form class="startForm" method="post">
 
1238
  <input class="button-primary" type="submit" name="wpsr_intro_submit" id="wpsr_intro_submit" value=" <?php _e('Start using WP Socializer', 'wpsr'); echo ' v' . WPSR_VERSION; ?> " />
1239
  </form>
1240
  </div>
343
  if (function_exists('current_user_can') && !current_user_can('manage_options'))
344
  die(__('Sorry you do not have enough previliges to access this page.'));
345
 
346
+ ## Reset form on submit
347
+ if (isset($_POST['wpsr_reset']) && check_admin_referer('wpsr_main_form')){
348
  wpsr_reset_values();
349
  $wpsr_reseted = true;
350
  }
351
 
352
+ ## Version intro form on submit
353
+ if (isset($_POST['wpsr_intro_submit']) && check_admin_referer('wpsr_intro_form')){
354
  update_option("wpsr_version", WPSR_VERSION);
355
  }
356
 
357
+ ## Main form on submit
358
+ if (isset($_POST["wpsr_submit"]) && check_admin_referer('wpsr_main_form')) {
359
  ## Addthis options
360
  $wpsr_addthis['username'] = $_POST['wpsr_addthis_username'];
361
  $wpsr_addthis['language'] = $_POST['wpsr_addthis_lang'];
749
  </div>
750
 
751
  <div class="footer">
752
+ <?php wp_nonce_field('wpsr_main_form'); ?>
753
  <input class="button-primary" type="submit" name="wpsr_submit" id="wpsr_submit" value="<?php _e('Update', 'wpsr'); ?>" />
754
  <input class="button alignright" type="submit" name="wpsr_reset" id="wpsr_reset" value=" <?php _e('Reset', 'wpsr'); ?> " />
755
  </div>
1202
 
1203
  </div><!-- Window -->
1204
 
 
1205
  </form><!-- Content -->
1206
 
1207
  <div class="bottomInfo">
1238
  <p class="refLinks"><b><a href="http://www.aakashweb.com/wordpress-plugins/wp-socializer/" target="_blank"><?php _e('Full Features', 'wpsr'); ?></a> | <a href="http://www.aakashweb.com/docs/wp-socializer-docs/" target="_blank"><?php _e('Documentation', 'wpsr'); ?></a> | <a href="http://www.aakashweb.com/forum/" target="_blank"><?php _e('Support', 'wpsr'); ?></a> | <a href="http://www.aakashweb.com/forum/" target="_blank"><?php _e('Bug Report', 'wpsr'); ?></a> | <a href="http://www.aakashweb.com/wordpress-plugins/wp-socializer/#videos" target="_blank"><?php _e('Video Demo & Tutorials', 'wpsr'); ?></a></b></p>
1239
 
1240
  <form class="startForm" method="post">
1241
+ <?php wp_nonce_field('wpsr_intro_form'); ?>
1242
  <input class="button-primary" type="submit" name="wpsr_intro_submit" id="wpsr_intro_submit" value=" <?php _e('Start using WP Socializer', 'wpsr'); echo ' v' . WPSR_VERSION; ?> " />
1243
  </form>
1244
  </div>
admin/wpsr-services-selector.php CHANGED
@@ -1,11 +1,27 @@
1
  <?php
2
- $id = intval($_GET['id']);
3
- $val = stripslashes($_GET['val']);
4
- $bt = stripslashes($_GET['bt']);
 
 
 
5
 
6
  $addthis_services = array("100zakladok", "2tag", "2linkme", "a1webmarks", "addio", "menu", "adfty", "adifni", "aerosocial", "allmyfaves", "amazonwishlist", "amenme", "aim", "aolmail", "arto", "aviary", "baang", "baidu", "bebo", "bentio", "biggerpockets", "bitly", "bizsugar", "bleetbox", "blinklist", "blip", "blogger", "bloggy", "blogmarks", "blogtrottr", "blurpalicious", "boardlite", "bobrdobr", "bonzobox", "bookmarkedbyus", "socialbookmarkingnet", "bookmarkycz", "bookmerkende", "bordom", "box", "brainify", "bryderi", "buddymarks", "buzzzy", "camyoo", "care2", "chiq", "cirip", "citeulike", "classicalplace", "clickazoo", "clply", "cndig", "colivia", "technerd", "connotea", "cosmiq", "delicious", "designbump", "designmoo", "digthiswebhost", "digaculturanet", "digg", "diggita", "diglog", "digo", "digzign", "diigo", "dipdive", "domelhor", "dosti", "dotnetkicks", "dotnetshoutout", "woscc", "douban", "drimio", "dropjack", "dwellicious", "dzone", "edelight", "efactor", "ekudos", "elefantapl", "email", "mailto", "embarkons", "eucliquei", "evernote", "extraplay", "ezyspot", "fabulously40", "facebook", "informazione", "fark", "farkinda", "fashiolista", "fashionburner", "favable", "faves", "favlogde", "favoritende", "favorites", "favoritus", "flaker", "flosspro", "folkd", "followtags", "forceindya", "thefreedictionary", "fresqui", "friendfeed", "friendster", "funp", "fwisp", "gabbr", "gacetilla", "gamekicker", "givealink", "globalgrind", "gmail", "goodnoows", "google", "googlebuzz", "googlereader", "googletranslate", "gravee", "greaterdebater", "grono", "grumper", "habergentr", "hackernews", "hadashhot", "hatena", "hazarkor", "gluvsnap", "hedgehogs", "hellotxt", "hipstr", "hitmarks", "hotbookmark", "hotklix", "hotmail", "w3validator", "hyves", "idearef", "identica", "igoogle", "ihavegot", "instapaper", "investorlinks", "iorbix", "isociety", "iwiw", "jamespot", "jisko", "joliprint", "jumptags", "zooloo", "kaboodle", "kaevur", "kipup", "kirtsy", "kledy", "kommenting", "latafaneracat", "laaikit", "ladenzeile", "librerio", "linkninja", "linkagogo", "linkedin", "linksgutter", "linkshares", "linkuj", "livefavoris", "livejournal", "lockerblogger", "logger24", "lynki", "mymailru", "markme", "mashbord", "mawindo", "meccho", "meinvz", "mekusharim", "memori", "meneame", "live", "mindbodygreen", "misterwong", "misterwong_de", "mixx", "moemesto", "mototagz", "mrcnetworkit", "multiply", "myaol", "mylinkvault", "myspace", "n4g", "netlog", "netvibes", "netvouz", "newsmeback");
7
 
8
  $sharethis_services = array("facebook", "fark", "faves", "fresqui", "friendfeed", "funp", "gbuzz", "google_bmarks", "kirsty", "linkedin", "meaneame", "messenger", "mister_wong", "mixx", "myspace", "n4g", "newsvine", "oknotizie", "propeller", "reddit", "simpy", "slashdot", "sonico", "sphinn", "stumbleupon", "technorati", "twackle", "twine", "twitter", "windows_live", "xanga", "yahoo_bmarks", "ybuzz", "yigg");
 
 
 
 
 
 
 
 
 
 
 
 
 
9
 
10
  ?>
11
  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
@@ -86,6 +102,7 @@ function moveUp(lst){
86
  lst.options[lst.selectedIndex].text = lst.options[lst.selectedIndex-1].text;
87
  lst.options[lst.selectedIndex-1].text = tempText;
88
  lst.selectedIndex = tempIndex;
 
89
  }
90
  }
91
  return false;
@@ -105,7 +122,8 @@ function moveDown(lst){
105
  var tempText = lst.options[lst.selectedIndex].text;
106
  lst.options[lst.selectedIndex].text = lst.options[lst.selectedIndex+1].text;
107
  lst.options[lst.selectedIndex+1].text = tempText;
108
- lst.selectedIndex = tempIndex;
 
109
  }
110
  }
111
  return false;
@@ -182,7 +200,7 @@ function googleTranslateElementInit() {
182
  <td width="45%">
183
  <select name="sel2" id="sel2" size="20" multiple="multiple" style="width:100%">
184
  <?php
185
- $selVal = $_GET['val'];
186
  if($selVal != ''){
187
  $expSel = explode(',', $selVal);
188
  foreach ($expSel as $eSel){
@@ -196,8 +214,8 @@ function googleTranslateElementInit() {
196
  </tr>
197
  </table>
198
  <br />
199
- <p>Selected services:<br/> <input name="services" type="text" id="services" value="<?php echo $_GET['val']; ?>" size="40"/>
200
- <input type="hidden" id="targetId" name="targetId" value="<?php echo $_GET['id']; ?>"/>
201
 
202
  </form>
203
  </p>
1
  <?php
2
+
3
+ if(empty($_GET['id']) || empty($_GET['val']) || empty($_GET['bt'])) die('<!-- Empty parameters -->');
4
+
5
+ $id = sanitize($_GET['id']);
6
+ $val = sanitize($_GET['val']);
7
+ $bt = sanitize($_GET['bt']);
8
 
9
  $addthis_services = array("100zakladok", "2tag", "2linkme", "a1webmarks", "addio", "menu", "adfty", "adifni", "aerosocial", "allmyfaves", "amazonwishlist", "amenme", "aim", "aolmail", "arto", "aviary", "baang", "baidu", "bebo", "bentio", "biggerpockets", "bitly", "bizsugar", "bleetbox", "blinklist", "blip", "blogger", "bloggy", "blogmarks", "blogtrottr", "blurpalicious", "boardlite", "bobrdobr", "bonzobox", "bookmarkedbyus", "socialbookmarkingnet", "bookmarkycz", "bookmerkende", "bordom", "box", "brainify", "bryderi", "buddymarks", "buzzzy", "camyoo", "care2", "chiq", "cirip", "citeulike", "classicalplace", "clickazoo", "clply", "cndig", "colivia", "technerd", "connotea", "cosmiq", "delicious", "designbump", "designmoo", "digthiswebhost", "digaculturanet", "digg", "diggita", "diglog", "digo", "digzign", "diigo", "dipdive", "domelhor", "dosti", "dotnetkicks", "dotnetshoutout", "woscc", "douban", "drimio", "dropjack", "dwellicious", "dzone", "edelight", "efactor", "ekudos", "elefantapl", "email", "mailto", "embarkons", "eucliquei", "evernote", "extraplay", "ezyspot", "fabulously40", "facebook", "informazione", "fark", "farkinda", "fashiolista", "fashionburner", "favable", "faves", "favlogde", "favoritende", "favorites", "favoritus", "flaker", "flosspro", "folkd", "followtags", "forceindya", "thefreedictionary", "fresqui", "friendfeed", "friendster", "funp", "fwisp", "gabbr", "gacetilla", "gamekicker", "givealink", "globalgrind", "gmail", "goodnoows", "google", "googlebuzz", "googlereader", "googletranslate", "gravee", "greaterdebater", "grono", "grumper", "habergentr", "hackernews", "hadashhot", "hatena", "hazarkor", "gluvsnap", "hedgehogs", "hellotxt", "hipstr", "hitmarks", "hotbookmark", "hotklix", "hotmail", "w3validator", "hyves", "idearef", "identica", "igoogle", "ihavegot", "instapaper", "investorlinks", "iorbix", "isociety", "iwiw", "jamespot", "jisko", "joliprint", "jumptags", "zooloo", "kaboodle", "kaevur", "kipup", "kirtsy", "kledy", "kommenting", "latafaneracat", "laaikit", "ladenzeile", "librerio", "linkninja", "linkagogo", "linkedin", "linksgutter", "linkshares", "linkuj", "livefavoris", "livejournal", "lockerblogger", "logger24", "lynki", "mymailru", "markme", "mashbord", "mawindo", "meccho", "meinvz", "mekusharim", "memori", "meneame", "live", "mindbodygreen", "misterwong", "misterwong_de", "mixx", "moemesto", "mototagz", "mrcnetworkit", "multiply", "myaol", "mylinkvault", "myspace", "n4g", "netlog", "netvibes", "netvouz", "newsmeback");
10
 
11
  $sharethis_services = array("facebook", "fark", "faves", "fresqui", "friendfeed", "funp", "gbuzz", "google_bmarks", "kirsty", "linkedin", "meaneame", "messenger", "mister_wong", "mixx", "myspace", "n4g", "newsvine", "oknotizie", "propeller", "reddit", "simpy", "slashdot", "sonico", "sphinn", "stumbleupon", "technorati", "twackle", "twine", "twitter", "windows_live", "xanga", "yahoo_bmarks", "ybuzz", "yigg");
12
+
13
+ // Clean the GET variables.
14
+ function sanitize($input) {
15
+ $search = array(
16
+ '@<script[^>]*?>.*?</script>@si', // Strip out javascript
17
+ '@<[\/\!]*?[^<>]*?>@si', // Strip out HTML tags
18
+ '@<style[^>]*?>.*?</style>@siU', // Strip style tags properly
19
+ '@<![\s\S]*?--[ \t\n\r]*>@' // Strip multi-line comments
20
+ );
21
+
22
+ $output = htmlspecialchars(preg_replace($search, '', $input));
23
+ return $output;
24
+ } // Thanks to CSS Tricks
25
 
26
  ?>
27
  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
102
  lst.options[lst.selectedIndex].text = lst.options[lst.selectedIndex-1].text;
103
  lst.options[lst.selectedIndex-1].text = tempText;
104
  lst.selectedIndex = tempIndex;
105
+ loopSelected();
106
  }
107
  }
108
  return false;
122
  var tempText = lst.options[lst.selectedIndex].text;
123
  lst.options[lst.selectedIndex].text = lst.options[lst.selectedIndex+1].text;
124
  lst.options[lst.selectedIndex+1].text = tempText;
125
+ lst.selectedIndex = tempIndex;
126
+ loopSelected();
127
  }
128
  }
129
  return false;
200
  <td width="45%">
201
  <select name="sel2" id="sel2" size="20" multiple="multiple" style="width:100%">
202
  <?php
203
+ $selVal = $val;
204
  if($selVal != ''){
205
  $expSel = explode(',', $selVal);
206
  foreach ($expSel as $eSel){
214
  </tr>
215
  </table>
216
  <br />
217
+ <p>Selected services:<br/> <input name="services" type="text" id="services" value="<?php echo $val; ?>" size="40"/>
218
+ <input type="hidden" id="targetId" name="targetId" value="<?php echo $id; ?>"/>
219
 
220
  </form>
221
  </p>
includes/wpsr-socialbuttons.php CHANGED
@@ -1,7 +1,7 @@
1
  <?php
2
  /*
3
  * Social buttons Processor code for WP Socializer Plugin
4
- * Version : 4.5
5
  * Author : Aakash Chakravarthy
6
  */
7
 
@@ -160,7 +160,7 @@ function wpsr_socialbts_processlist($args = ''){
160
  $deTitle = trim($pTitle);
161
 
162
  $excerpt = trim(urlencode($pExcerpt));
163
- $deExcerpt = $pExcerpt;
164
 
165
  $rss = (empty($wpsr_settings['rssurl'])) ? get_bloginfo('rss_url') : $wpsr_settings['rssurl'];
166
  $blogname = urlencode(get_bloginfo('name') . ' - ' . get_bloginfo('description'));
1
  <?php
2
  /*
3
  * Social buttons Processor code for WP Socializer Plugin
4
+ * Version : 4.6
5
  * Author : Aakash Chakravarthy
6
  */
7
 
160
  $deTitle = trim($pTitle);
161
 
162
  $excerpt = trim(urlencode($pExcerpt));
163
+ $deExcerpt = htmlspecialchars($pExcerpt);
164
 
165
  $rss = (empty($wpsr_settings['rssurl'])) ? get_bloginfo('rss_url') : $wpsr_settings['rssurl'];
166
  $blogname = urlencode(get_bloginfo('name') . ' - ' . get_bloginfo('description'));
readme.txt CHANGED
@@ -6,8 +6,8 @@ Tags: social, social bookmarking, bookmarks, bookmarking, bookmarks menu, share,
6
  License: GPLv2 or later
7
  Donate Link: http://bit.ly/wpsrDonate
8
  Requires at least: 2.8
9
- Tested up to: 3.4
10
- Stable tag: 2.4.2
11
 
12
  Super Cool Plugin for inserting all kinds of Social Bookmarking & Sharing buttons. Has customizable Floating Share Bar, Widgets, Shortcodes also.
13
 
@@ -23,7 +23,7 @@ WP Socializer is an advanced plugin for inserting all kinds of Social bookmarkin
23
  * Widgets for inserting FB like box & G+ badges in sidebar.
24
  * Template functions are available for advanced placements.
25
 
26
- (Check out the changelog for the new features and fixes in the version **2.4.2**)
27
 
28
  [youtube="http://www.youtube.com/v/1uimAE8rFYE"]
29
 
@@ -100,6 +100,12 @@ For custom placement in theme files and posts, check out the following documenta
100
 
101
  == Changelog ==
102
 
 
 
 
 
 
 
103
  = 2.4.2 =
104
  * Facebook like button centered in the left float sharing bar.
105
  * Facebook like button iframe CSS zero margin fix is done for themes.
6
  License: GPLv2 or later
7
  Donate Link: http://bit.ly/wpsrDonate
8
  Requires at least: 2.8
9
+ Tested up to: 3.4.1
10
+ Stable tag: 2.4.3
11
 
12
  Super Cool Plugin for inserting all kinds of Social Bookmarking & Sharing buttons. Has customizable Floating Share Bar, Widgets, Shortcodes also.
13
 
23
  * Widgets for inserting FB like box & G+ badges in sidebar.
24
  * Template functions are available for advanced placements.
25
 
26
+ ** Note: v2.4.3 is an important security update, fixing the XSS bug in the plugin. Check the changelog for more info **
27
 
28
  [youtube="http://www.youtube.com/v/1uimAE8rFYE"]
29
 
100
 
101
  == Changelog ==
102
 
103
+ = 2.4.3 =
104
+ * XSS Vulnerability issue in the "Services selector" page is fixed.
105
+ * Added nounce to the Admin page forms.
106
+ * Fixed bug in the Twitter social button template.
107
+ * Fixed the collision of the quotes in the excerpt with the HTML tags for the email button.
108
+
109
  = 2.4.2 =
110
  * Facebook like button centered in the left float sharing bar.
111
  * Facebook like button iframe CSS zero margin fix is done for themes.
wp-socializer.php CHANGED
@@ -1,7 +1,7 @@
1
  <?php
2
  /*
3
  Plugin Name: WP Socializer
4
- Version: 2.4.2
5
  Plugin URI: http://www.aakashweb.com/
6
  Description: WP Socializer is an advanced plugin for inserting all kinds of Social bookmarking & sharing buttons. It has super cool features to insert the buttons into posts, sidebar. It also has Floating sharebar. <a href="http://youtu.be/1uimAE8rFYE" target="_blank">Check out the demo video</a>.
7
  Author: Aakash Chakravarthy
@@ -14,7 +14,7 @@ if(!defined('WP_CONTENT_URL')) {
14
  $wpsr_url = WP_CONTENT_URL . '/plugins/' . plugin_basename(dirname(__FILE__)) . '/';
15
  }
16
 
17
- define('WPSR_VERSION', '2.4.2');
18
  define('WPSR_AUTHOR', 'Aakash Chakravarthy');
19
  define('WPSR_URL', $wpsr_url);
20
  define('WPSR_PUBLIC_URL', WPSR_URL . 'public/');
@@ -198,7 +198,7 @@ $wpsr_socialsites_list = array(
198
  'name' => 'Email',
199
  'titleText' => __('Email this ', 'wpsr') . '',
200
  'icon' => 'email.png',
201
- 'url' => 'mailto:?subject={de-title}&amp;body={de-excerpt} - {de-url}', // Fixed the bug in v2.4.1
202
  'support32px' => 1,
203
  ),
204
 
@@ -753,7 +753,7 @@ $wpsr_socialsites_list = array(
753
  'name' => 'Techmeme',
754
  'titleText' => __('Share this on ', 'wpsr') . 'Techmeme',
755
  'icon' => 'techmeme.png',
756
- 'url' => 'http://twitter.com/home/?status=tip%20@Techmeme%20{url}%20{title}',
757
  ),
758
 
759
  'technorati' => array(
@@ -783,7 +783,7 @@ $wpsr_socialsites_list = array(
783
  'name' => 'Twitter',
784
  'titleText' => __('Tweet this !', 'wpsr') . '',
785
  'icon' => 'twitter.png',
786
- 'url' => 'http://twitter.com/home?status={title}%20-%20{s-url}%20{twitter-username}',
787
  'support32px' => 1,
788
  ),
789
 
1
  <?php
2
  /*
3
  Plugin Name: WP Socializer
4
+ Version: 2.4.3
5
  Plugin URI: http://www.aakashweb.com/
6
  Description: WP Socializer is an advanced plugin for inserting all kinds of Social bookmarking & sharing buttons. It has super cool features to insert the buttons into posts, sidebar. It also has Floating sharebar. <a href="http://youtu.be/1uimAE8rFYE" target="_blank">Check out the demo video</a>.
7
  Author: Aakash Chakravarthy
14
  $wpsr_url = WP_CONTENT_URL . '/plugins/' . plugin_basename(dirname(__FILE__)) . '/';
15
  }
16
 
17
+ define('WPSR_VERSION', '2.4.3');
18
  define('WPSR_AUTHOR', 'Aakash Chakravarthy');
19
  define('WPSR_URL', $wpsr_url);
20
  define('WPSR_PUBLIC_URL', WPSR_URL . 'public/');
198
  'name' => 'Email',
199
  'titleText' => __('Email this ', 'wpsr') . '',
200
  'icon' => 'email.png',
201
+ 'url' => 'mailto:?subject={de-title}&amp;body={de-excerpt} - {de-url}', // Fixed the bug in v2.4.1 & v2.4.3
202
  'support32px' => 1,
203
  ),
204
 
753
  'name' => 'Techmeme',
754
  'titleText' => __('Share this on ', 'wpsr') . 'Techmeme',
755
  'icon' => 'techmeme.png',
756
+ 'url' => 'http://twitter.com/home/?status=tip%20@Techmeme%20{url}%20{de-title}',
757
  ),
758
 
759
  'technorati' => array(
783
  'name' => 'Twitter',
784
  'titleText' => __('Tweet this !', 'wpsr') . '',
785
  'icon' => 'twitter.png',
786
+ 'url' => 'http://twitter.com/home?status={de-title}%20-%20{s-url}%20{twitter-username}',
787
  'support32px' => 1,
788
  ),
789