WP125 - Version 1.4.5

Version Description

Download this release

Release Info

Developer redwallhp
Plugin Icon wp plugin WP125
Version 1.4.5
Comparing to
See all releases

Code changes from version 1.4.4 to 1.4.5

Files changed (3) hide show
  1. adminmenus.php +39 -11
  2. readme.txt +3 -2
  3. wp125.php +6 -2
adminmenus.php CHANGED
@@ -4,6 +4,7 @@ if (function_exists('wp_enqueue_style')) {
4
  wp_enqueue_script('jquery');
5
  wp_enqueue_script('thickbox');
6
  wp_enqueue_style('thickbox');
 
7
  }
8
 
9
  //Write Manage Menu
@@ -13,27 +14,35 @@ echo '<div class="wrap">
13
 
14
  //Handle deactivations
15
  if ($_GET['wp125action'] == "deactivate") {
16
- $theid = $_GET['theid'];
17
  echo '<div id="message" class="updated fade"><p>'.__('Are you sure you want to deactivate the ad?', 'wp125').' <a href="admin.php?page=wp125/wp125.php&wp125action=deactivateconf&theid='.$theid.'">'.__('Yes', 'wp125').'</a> &nbsp; <a href="admin.php?page=wp125/wp125.php">'.__('No!', 'wp125').'</a></p></div>';
18
  }
19
  if ($_GET['wp125action'] == "deactivateconf") {
20
- $theid = $_GET['theid'];
21
  global $wpdb, $table_prefix;
22
  $adtable_name = $wpdb->prefix . "wp125_ads";
23
- $wpdb->query("UPDATE $adtable_name SET status = '0' WHERE id = '$theid'");
 
 
 
 
24
  echo '<div id="message" class="updated fade"><p>'.__('Ad deactivated.', 'wp125').'</p></div>';
25
  }
26
 
27
  //Handle REactivations
28
  if ($_GET['wp125action'] == "activate") {
29
- $theid = $_GET['theid'];
30
  echo '<div id="message" class="updated fade"><p>'.__('Are you sure you want to reactivate the ad?', 'wp125').' <a href="admin.php?page=wp125/wp125.php&showmanage=inactive&wp125action=activateconf&theid='.$theid.'">'.__('Yes', 'wp125').'</a> &nbsp; <a href="admin.php?page=wp125/wp125.php&showmanage=inactive">'.__('No!', 'wp125').'</a></p></div>';
31
  }
32
  if ($_GET['wp125action'] == "activateconf") {
33
- $theid = $_GET['theid'];
34
  global $wpdb, $table_prefix;
35
  $adtable_name = $wpdb->prefix . "wp125_ads";
36
- $wpdb->query("UPDATE $adtable_name SET status = '1' AND pre_exp_email='0' WHERE id = '$theid'");
 
 
 
 
37
  echo '<div id="message" class="updated fade"><p>'.__('Ad activated.', 'wp125').'</p></div>';
38
  }
39
 
@@ -101,8 +110,11 @@ $setting_emailonexp = get_option("wp125_emailonexp");
101
  $setting_defaultad = get_option("wp125_defaultad");
102
  //If post is being edited, grab current info
103
  if ($_GET['editad']!='') {
104
- $theid = $_GET['editad'];
105
- $editingad = $wpdb->get_row("SELECT * FROM $adtable_name WHERE id = '$theid'", OBJECT);
 
 
 
106
  }
107
  ?><div class="wrap">
108
 
@@ -142,7 +154,7 @@ $post_editedad = $wpdb->escape($_POST['editedad']);
142
  echo '<div id="message" class="updated fade"><p>'.__('Do you really want to delete this ad record? This action cannot be undone.', 'wp125').' <a href="admin.php?page=wp125_addedit&deletead='.$post_editedad.'">'.__('Yes', 'wp125').'</a> &nbsp; <a href="admin.php?page=wp125_addedit&editad='.$post_editedad.'">'.__('No!', 'wp125').'</a></p></div>';
143
  }
144
  if ($_GET['deletead']!='') {
145
- $thead=$_GET['deletead'];
146
  $updatedb = "DELETE FROM $adtable_name WHERE id='$thead'";
147
  $results = $wpdb->query($updatedb);
148
  echo '<div id="message" class="updated fade"><p>'.__('Ad deleted.', 'wp125').'</p></div>';
@@ -154,7 +166,7 @@ echo '<div id="message" class="updated fade"><p>'.__('Ad deleted.', 'wp125').'</
154
  <form method="post" action="admin.php?page=wp125_addedit">
155
  <table class="form-table">
156
 
157
- <?php if ($_GET['editad']!='') { echo '<input name="editedad" type="hidden" value="'.$_GET['editad'].'" />'; } ?>
158
 
159
  <tr valign="top">
160
  <th scope="row"><?php _e('Name', 'wp125'); ?></th>
@@ -219,9 +231,25 @@ document.getElementById("adexp-date").style.display = "none";
219
 
220
  <tr valign="top">
221
  <th scope="row"><?php _e('Ad Image', 'wp125'); ?></th>
222
- <td><input name="adimage" type="text" id="adimage" value="<?php if ($editingad->image_url!='') { echo $editingad->image_url; } else { echo 'http://'; } ?>" size="40" /></td>
223
  </tr>
224
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
225
  </table>
226
  <p class="submit"><input type="submit" name="Submit" value="<?php _e('Save Ad', 'wp125'); ?>" /> &nbsp; <?php if ($_GET['editad']!='') { ?><input type="submit" name="deletead" value="<?php _e('Delete Ad', 'wp125'); ?>" /><?php } ?></p>
227
  </form>
4
  wp_enqueue_script('jquery');
5
  wp_enqueue_script('thickbox');
6
  wp_enqueue_style('thickbox');
7
+ wp_enqueue_script('media-upload');
8
  }
9
 
10
  //Write Manage Menu
14
 
15
  //Handle deactivations
16
  if ($_GET['wp125action'] == "deactivate") {
17
+ $theid = intval($_GET['theid']);
18
  echo '<div id="message" class="updated fade"><p>'.__('Are you sure you want to deactivate the ad?', 'wp125').' <a href="admin.php?page=wp125/wp125.php&wp125action=deactivateconf&theid='.$theid.'">'.__('Yes', 'wp125').'</a> &nbsp; <a href="admin.php?page=wp125/wp125.php">'.__('No!', 'wp125').'</a></p></div>';
19
  }
20
  if ($_GET['wp125action'] == "deactivateconf") {
21
+ $theid = intval($_GET['theid']);
22
  global $wpdb, $table_prefix;
23
  $adtable_name = $wpdb->prefix . "wp125_ads";
24
+ $wpdb->update(
25
+ $adtable_name,
26
+ array('status' => '0'),
27
+ array('id' => $theid)
28
+ );
29
  echo '<div id="message" class="updated fade"><p>'.__('Ad deactivated.', 'wp125').'</p></div>';
30
  }
31
 
32
  //Handle REactivations
33
  if ($_GET['wp125action'] == "activate") {
34
+ $theid = intval($_GET['theid']);
35
  echo '<div id="message" class="updated fade"><p>'.__('Are you sure you want to reactivate the ad?', 'wp125').' <a href="admin.php?page=wp125/wp125.php&showmanage=inactive&wp125action=activateconf&theid='.$theid.'">'.__('Yes', 'wp125').'</a> &nbsp; <a href="admin.php?page=wp125/wp125.php&showmanage=inactive">'.__('No!', 'wp125').'</a></p></div>';
36
  }
37
  if ($_GET['wp125action'] == "activateconf") {
38
+ $theid = intval($_GET['theid']);
39
  global $wpdb, $table_prefix;
40
  $adtable_name = $wpdb->prefix . "wp125_ads";
41
+ $wpdb->update(
42
+ $adtable_name,
43
+ array('status' => '1', 'pre_exp_email' => '0'),
44
+ array('id' => $theid)
45
+ );
46
  echo '<div id="message" class="updated fade"><p>'.__('Ad activated.', 'wp125').'</p></div>';
47
  }
48
 
110
  $setting_defaultad = get_option("wp125_defaultad");
111
  //If post is being edited, grab current info
112
  if ($_GET['editad']!='') {
113
+ $theid = intval($_GET['editad']);
114
+ $editingad = $wpdb->get_row($wpdb->prepare(
115
+ "SELECT * FROM {$adtable_name} WHERE id = %d",
116
+ $theid
117
+ ));
118
  }
119
  ?><div class="wrap">
120
 
154
  echo '<div id="message" class="updated fade"><p>'.__('Do you really want to delete this ad record? This action cannot be undone.', 'wp125').' <a href="admin.php?page=wp125_addedit&deletead='.$post_editedad.'">'.__('Yes', 'wp125').'</a> &nbsp; <a href="admin.php?page=wp125_addedit&editad='.$post_editedad.'">'.__('No!', 'wp125').'</a></p></div>';
155
  }
156
  if ($_GET['deletead']!='') {
157
+ $thead = intval($_GET['deletead']);
158
  $updatedb = "DELETE FROM $adtable_name WHERE id='$thead'";
159
  $results = $wpdb->query($updatedb);
160
  echo '<div id="message" class="updated fade"><p>'.__('Ad deleted.', 'wp125').'</p></div>';
166
  <form method="post" action="admin.php?page=wp125_addedit">
167
  <table class="form-table">
168
 
169
+ <?php if ($_GET['editad']!='') { echo '<input name="editedad" type="hidden" value="'.intval($_GET['editad']).'" />'; } ?>
170
 
171
  <tr valign="top">
172
  <th scope="row"><?php _e('Name', 'wp125'); ?></th>
231
 
232
  <tr valign="top">
233
  <th scope="row"><?php _e('Ad Image', 'wp125'); ?></th>
234
+ <td><input name="adimage" type="text" id="adimage" value="<?php if ($editingad->image_url!='') { echo $editingad->image_url; } else { echo 'http://'; } ?>" size="40" /> <input id="upload_image_button" type="button" class="button" value="Upload Image" /></td>
235
  </tr>
236
 
237
+ <script type="text/javascript">
238
+ jQuery(document).ready(function() {
239
+ jQuery('#upload_image_button').click(function() {
240
+ formfield = jQuery('#adimage').attr('name');
241
+ tb_show('', 'media-upload.php?type=image&amp;TB_iframe=true');
242
+ return false;
243
+ });
244
+
245
+ window.send_to_editor = function(html) {
246
+ imgurl = jQuery('img',html).attr('src');
247
+ jQuery('#adimage').val(imgurl);
248
+ tb_remove();
249
+ }
250
+ });
251
+ </script>
252
+
253
  </table>
254
  <p class="submit"><input type="submit" name="Submit" value="<?php _e('Save Ad', 'wp125'); ?>" /> &nbsp; <?php if ($_GET['editad']!='') { ?><input type="submit" name="deletead" value="<?php _e('Delete Ad', 'wp125'); ?>" /><?php } ?></p>
255
  </form>
readme.txt CHANGED
@@ -6,7 +6,7 @@ Donate link: http://www.webmaster-source.com/donate/?plugin=wp125
6
  Tags: ads, 125x125, management, advertisement
7
  Requires at least: 2.8
8
  Tested up to: 3.4.2
9
- Stable tag: 1.4.4
10
 
11
  Easy management of 125x125 ads on your blog. Ads can be run for a specified number of days, and will automatically be taken down. Track clicks too.
12
 
@@ -122,4 +122,5 @@ If you're having a problem with the plugin, try posting on the official WordPres
122
  * 1.4.1 - Added German translation and fixed a stylesheet enqueue bug for WP 3.3.
123
  * 1.4.2 - Now with support for multiple widgets!
124
  * 1.4.3 - Added Romanian translation.
125
- * 1.4.4 - Fixed a race condition that could cause many duplicate expiration emails to be sent on high-traffic sites.
 
6
  Tags: ads, 125x125, management, advertisement
7
  Requires at least: 2.8
8
  Tested up to: 3.4.2
9
+ Stable tag: 1.4.5
10
 
11
  Easy management of 125x125 ads on your blog. Ads can be run for a specified number of days, and will automatically be taken down. Track clicks too.
12
 
122
  * 1.4.1 - Added German translation and fixed a stylesheet enqueue bug for WP 3.3.
123
  * 1.4.2 - Now with support for multiple widgets!
124
  * 1.4.3 - Added Romanian translation.
125
+ * 1.4.4 - Fixed a race condition that could cause many duplicate expiration emails to be sent on high-traffic sites.
126
+ * 1.4.5 - Added uploader, plus fixed some potential vulnerabilities. (Thanks to Charlie Eriksen via Secunia SVCRP.)
wp125.php CHANGED
@@ -5,7 +5,7 @@ Plugin URI: http://www.webmaster-source.com/wp125-ad-plugin-wordpress/
5
  Description: Easily manage 125x125 ads within your WordPress Dashboard.
6
  Author: Matt Harzewski (redwall_hp)
7
  Author URI: http://www.webmaster-source.com
8
- Version: 1.4.4
9
  */
10
 
11
 
@@ -24,7 +24,11 @@ function wp125_adclick() {
24
  $theid = $_GET['adclick'];
25
  global $wpdb;
26
  $adtable_name = $wpdb->prefix . "wp125_ads";
27
- $thead = $wpdb->get_row("SELECT target FROM $adtable_name WHERE id = '$theid'", OBJECT);
 
 
 
 
28
  $update = "UPDATE ". $adtable_name ." SET clicks=clicks+1 WHERE id='$theid'";
29
  $results = $wpdb->query( $update );
30
  header("Location: $thead->target");
5
  Description: Easily manage 125x125 ads within your WordPress Dashboard.
6
  Author: Matt Harzewski (redwall_hp)
7
  Author URI: http://www.webmaster-source.com
8
+ Version: 1.4.5
9
  */
10
 
11
 
24
  $theid = $_GET['adclick'];
25
  global $wpdb;
26
  $adtable_name = $wpdb->prefix . "wp125_ads";
27
+ $thead = $wpdb->get_row($wpdb->prepare(
28
+ "SELECT target FROM {$adtable_name} WHERE id = %d",
29
+ $theid
30
+ ));
31
+ $theid = $wpdb->escape($theid);
32
  $update = "UPDATE ". $adtable_name ." SET clicks=clicks+1 WHERE id='$theid'";
33
  $results = $wpdb->query( $update );
34
  header("Location: $thead->target");