Skip to content

Commit

Permalink
Merge pull request #172 from Automattic/fix_xss_on_settings_page
Browse files Browse the repository at this point in the history 
Set/Validate/escape these parameters in the settings page
  • Loading branch information
@donnchawp
donnchawp authored Jan 31, 2017
2 parents 094b2bd + 13ac3c4 commit 99037db
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 5 deletions.
4 changes: 3 additions & 1 deletion ossdl-cdn.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,8 @@ function scossdl_off_options() {
update_option('ossdl_off_include_dirs', $_POST['ossdl_off_include_dirs'] == '' ? 'wp-content,wp-includes' : $_POST['ossdl_off_include_dirs']);
update_option('ossdl_off_exclude', $_POST['ossdl_off_exclude']);
update_option('ossdl_cname', $_POST['ossdl_cname']);
if ( !isset( $_POST[ 'ossdl_https' ] ) )
$_POST[ 'ossdl_https' ] = 0;
update_option('ossdl_https', (int)$_POST['ossdl_https']);
if ( isset( $_POST[ 'ossdlcdn' ] ) ) {
$ossdlcdn = 1;
Expand Down Expand Up @@ -163,7 +165,7 @@ function scossdl_off_options() {
<tr valign="top">
<th scope="row"><label for="ossdl_off_cdn_url"><?php _e( 'Off-site URL', 'wp-super-cache' ); ?></label></th>
<td>
<input type="text" name="ossdl_off_cdn_url" value="<?php echo(get_option('ossdl_off_cdn_url')); ?>" size="64" class="regular-text code" /><br />
<input type="text" name="ossdl_off_cdn_url" value="<?php echo esc_url( get_option( 'ossdl_off_cdn_url' ) ); ?>" size="64" class="regular-text code" /><br />
<span class="description"><?php printf( __( 'The new URL to be used in place of %1$s for rewriting. No trailing <code>/</code> please.<br />Example: <code>%2$s</code>.', 'wp-super-cache' ), get_option( 'siteurl' ), $example_cdn_uri ); ?></span>
</td>
</tr>
Expand Down
12 changes: 8 additions & 4 deletions wp-cache.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1704,7 +1704,11 @@ function wp_cache_edit_max_time () {
} elseif ( $valid_nonce ) { // clock
wp_clear_scheduled_hook( 'wp_cache_gc' );
$cache_schedule_type = 'time';
if ( !isset( $_POST[ 'cache_scheduled_time' ] ) || $_POST[ 'cache_scheduled_time' ] == '' )
if ( !isset( $_POST[ 'cache_scheduled_time' ] ) ||
$_POST[ 'cache_scheduled_time' ] == '' ||
5 != strlen( $_POST[ 'cache_scheduled_time' ] ) ||
":" != substr( $_POST[ 'cache_scheduled_time' ], 2, 1 )
)
$_POST[ 'cache_scheduled_time' ] = '00:00';
$cache_scheduled_time = $_POST[ 'cache_scheduled_time' ];
$schedules = wp_get_schedules();
Expand Down Expand Up @@ -1753,12 +1757,12 @@ function wp_cache_edit_max_time () {
echo '<input name="action" value="expirytime" type="hidden" />';
echo '<table class="form-table">';
echo '<tr><td><label for="wp_max_time"><strong>' . __( 'Cache Timeout', 'wp-super-cache' ) . '</strong></label></td>';
echo "<td><input type='text' id='wp_max_time' size=6 name='wp_max_time' value='$cache_max_time' /> " . __( "seconds", 'wp-super-cache' ) . "</td></tr>\n";
echo "<td><input type='text' id='wp_max_time' size=6 name='wp_max_time' value='" . esc_attr( $cache_max_time ) . "' /> " . __( "seconds", 'wp-super-cache' ) . "</td></tr>\n";
echo "<tr><td></td><td>" . __( 'How long should cached pages remain fresh? Set to 0 to disable garbage collection. A good starting point is 3600 seconds.', 'wp-super-cache' ) . "</td></tr>\n";
echo '<tr><td valign="top"><strong>' . __( 'Scheduler', 'wp-super-cache' ) . '</strong></td><td><table cellpadding=0 cellspacing=0><tr><td valign="top"><input type="radio" id="schedule_interval" name="cache_schedule_type" value="interval" ' . checked( 'interval', $cache_schedule_type, false ) . ' /></td><td valign="top"><label for="cache_interval_time">' . __( 'Timer:', 'wp-super-cache' ) . '</label></td>';
echo "<td><input type='text' id='cache_interval_time' size=6 name='cache_time_interval' value='$cache_time_interval' /> " . __( "seconds", 'wp-super-cache' ) . '<br />' . __( 'Check for stale cached files every <em>interval</em> seconds.', 'wp-super-cache' ) . "</td></tr>";
echo "<td><input type='text' id='cache_interval_time' size=6 name='cache_time_interval' value='" . esc_attr( $cache_time_interval ) . "' /> " . __( "seconds", 'wp-super-cache' ) . '<br />' . __( 'Check for stale cached files every <em>interval</em> seconds.', 'wp-super-cache' ) . "</td></tr>";
echo '<tr><td valign="top"><input type="radio" id="schedule_time" name="cache_schedule_type" value="time" ' . checked( 'time', $cache_schedule_type, false ) . ' /></td><td valign="top"><label for="schedule_time">' . __( 'Clock:', 'wp-super-cache' ) . '</label></td>';
echo "<td><input type=\"text\" size=5 id='cache_scheduled_time' name='cache_scheduled_time' value=\"$cache_scheduled_time\" /> " . __( "HH:MM", 'wp-super-cache' ) . "<br />" . __( 'Check for stale cached files at this time <strong>(UTC)</strong> or starting at this time every <em>interval</em> below.', 'wp-super-cache' ) . "</td></tr>";
echo "<td><input type=\"text\" size=5 id='cache_scheduled_time' name='cache_scheduled_time' value=\"" . esc_attr( $cache_scheduled_time ) . "\" /> " . __( "HH:MM", 'wp-super-cache' ) . "<br />" . __( 'Check for stale cached files at this time <strong>(UTC)</strong> or starting at this time every <em>interval</em> below.', 'wp-super-cache' ) . "</td></tr>";
$schedules = wp_get_schedules();
echo "<tr><td><br /></td><td><label for='cache_scheduled_select'>" . __( 'Interval:', 'wp-super-cache' ) . "</label></td><td><select id='cache_scheduled_select' name='cache_schedule_interval' size=1>";
foreach( $schedules as $desc => $details ) {
Expand Down

0 comments on commit 99037db

Please sign in to comment.