Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/filebird/filebird.php
+++ b/filebird/filebird.php
@@ -3,7 +3,7 @@
* Plugin Name: FileBird Lite
* Plugin URI: https://ninjateam.org/wordpress-media-library-folders/
* Description: Organize thousands of WordPress media files into folders/ categories at ease.
- * Version: 6.4.7
+ * Version: 6.4.9
* Author: Ninja Team
* Author URI: https://ninjateam.org
* Text Domain: filebird
@@ -32,7 +32,7 @@
}
if ( ! defined( 'NJFB_VERSION' ) ) {
- define( 'NJFB_VERSION', '6.4.7' );
+ define( 'NJFB_VERSION', '6.4.9' );
}
if ( ! defined( 'NJFB_PLUGIN_FILE' ) ) {
--- a/filebird/includes/Admin/Settings.php
+++ b/filebird/includes/Admin/Settings.php
@@ -84,6 +84,7 @@
'wpml' => array(
'display_sync' => ! empty( $wpmlActiveLanguages ),
),
+ 'is_fbdl_activated' => class_exists( 'FileBird_Document_Library\DocumentLibrary' )
)
);
}
--- a/filebird/includes/I18n.php
+++ b/filebird/includes/I18n.php
@@ -280,6 +280,8 @@
'activation' => __( 'Activation', 'filebird' ),
'tools' => __( 'Tools', 'filebird' ),
'import_export' => __( 'Import/Export', 'filebird' ),
+ 'document_library' => __( 'Document Library', 'filebird' ),
+ 'enable_cache_optimization' => __( 'Enable cache optimization', 'filebird' ),
'select_theme' => __( 'Select theme', 'filebird' ),
'by' => __( 'By', 'filebird' ),
'lifetime_license' => __( 'Lifetime license', 'filebird' ),
--- a/filebird/includes/Model/Folder.php
+++ b/filebird/includes/Model/Folder.php
@@ -17,18 +17,32 @@
//TODO need to convert ord to number using +0
global $wpdb;
- $conditions = array(
- '1 = 1',
- 'created_by = ' . apply_filters( 'fbv_folder_created_by', 0 ),
- );
+ $allowed_columns = array( '*', 'id', 'name', 'parent', 'type', 'created_by', 'ord' );
+ $select_parts = array_map( 'trim', explode( ',', $select ) );
+ foreach ( $select_parts as $part ) {
+ if ( ! in_array( $part, $allowed_columns, true ) ) {
+ $select = '*';
+ break;
+ }
+ }
+ $created_by = apply_filters( 'fbv_folder_created_by', 0 );
+
if ( ! empty( $search ) ) {
- $conditions[] = "name LIKE '%" . $wpdb->esc_like( $search ) . "%'";
+ $sql = $wpdb->prepare(
+ "SELECT $select FROM " . self::getTable( self::$folder_table ) .
+ " WHERE 1 = 1 AND created_by = %d AND name LIKE %s ORDER BY `ord` ASC",
+ $created_by,
+ '%' . $wpdb->esc_like( $search ) . '%'
+ );
+ } else {
+ $sql = $wpdb->prepare(
+ "SELECT $select FROM " . self::getTable( self::$folder_table ) .
+ " WHERE 1 = 1 AND created_by = %d ORDER BY `ord` ASC",
+ $created_by
+ );
}
- $conditions = implode( ' AND ', $conditions );
- $sql = "SELECT $select FROM " . self::getTable( self::$folder_table ) . ' WHERE ' . $conditions . ' ORDER BY `ord` ASC';
- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared
$folders = $wpdb->get_results( $sql );
if ( 'name' === $order_by && in_array( $order, array( 'asc', 'desc' ), true ) ) {
--- a/filebird/includes/Model/SettingModel.php
+++ b/filebird/includes/Model/SettingModel.php
@@ -32,6 +32,10 @@
'get' => 'getFolderSearchMethod',
'set' => 'setFolderSearchMethod',
),
+ 'enable_cache_optimization' => array(
+ 'get' => 'getEnableCacheOptimization',
+ 'set' => 'setEnableCacheOptimization',
+ ),
);
}
@@ -86,4 +90,15 @@
public function setFolderSearchMethod( $value ) {
update_option( 'njt_fbv_is_search_using_api', $value );
}
-}
No newline at end of file
+
+ public function getEnableCacheOptimization() {
+ $settings = (array) get_option( 'fbv_settings', array() );
+ return isset( $settings['enable_cache_optimization'] ) ? (string) $settings['enable_cache_optimization'] : "0";
+ }
+
+ public function setEnableCacheOptimization( $value ) {
+ $settings = (array) get_option( 'fbv_settings', array() );
+ $settings['enable_cache_optimization'] = $value;
+ update_option( 'fbv_settings', $settings );
+ }
+}
--- a/filebird/includes/Utils/Vite.php
+++ b/filebird/includes/Utils/Vite.php
@@ -3,7 +3,7 @@
namespace FileBirdUtils;
class Vite {
- const HOST = 'https://localhost:3000/';
+ const HOST = 'http://localhost:3000/';
const SCRIPT_HANDLE = 'module/filebird/vite';
const CLIENT_SCRIPT_HANDLE = 'module/filebird/vite-client';
--- a/filebird/vendor/autoload.php
+++ b/filebird/vendor/autoload.php
@@ -14,10 +14,7 @@
echo $err;
}
}
- trigger_error(
- $err,
- E_USER_ERROR
- );
+ throw new RuntimeException($err);
}
require_once __DIR__ . '/composer/autoload_real.php';
--- a/filebird/vendor/composer/InstalledVersions.php
+++ b/filebird/vendor/composer/InstalledVersions.php
@@ -27,12 +27,23 @@
class InstalledVersions
{
/**
+ * @var string|null if set (by reflection by Composer), this should be set to the path where this class is being copied to
+ * @internal
+ */
+ private static $selfDir = null;
+
+ /**
* @var mixed[]|null
* @psalm-var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>}|array{}|null
*/
private static $installed;
/**
+ * @var bool
+ */
+ private static $installedIsLocalDir;
+
+ /**
* @var bool|null
*/
private static $canGetVendors;
@@ -309,6 +320,24 @@
{
self::$installed = $data;
self::$installedByVendor = array();
+
+ // when using reload, we disable the duplicate protection to ensure that self::$installed data is
+ // always returned, but we cannot know whether it comes from the installed.php in __DIR__ or not,
+ // so we have to assume it does not, and that may result in duplicate data being returned when listing
+ // all installed packages for example
+ self::$installedIsLocalDir = false;
+ }
+
+ /**
+ * @return string
+ */
+ private static function getSelfDir()
+ {
+ if (self::$selfDir === null) {
+ self::$selfDir = strtr(__DIR__, '\', '/');
+ }
+
+ return self::$selfDir;
}
/**
@@ -322,19 +351,27 @@
}
$installed = array();
+ $copiedLocalDir = false;
if (self::$canGetVendors) {
+ $selfDir = self::getSelfDir();
foreach (ClassLoader::getRegisteredLoaders() as $vendorDir => $loader) {
+ $vendorDir = strtr($vendorDir, '\', '/');
if (isset(self::$installedByVendor[$vendorDir])) {
$installed[] = self::$installedByVendor[$vendorDir];
} elseif (is_file($vendorDir.'/composer/installed.php')) {
/** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
$required = require $vendorDir.'/composer/installed.php';
- $installed[] = self::$installedByVendor[$vendorDir] = $required;
- if (null === self::$installed && strtr($vendorDir.'/composer', '\', '/') === strtr(__DIR__, '\', '/')) {
- self::$installed = $installed[count($installed) - 1];
+ self::$installedByVendor[$vendorDir] = $required;
+ $installed[] = $required;
+ if (self::$installed === null && $vendorDir.'/composer' === $selfDir) {
+ self::$installed = $required;
+ self::$installedIsLocalDir = true;
}
}
+ if (self::$installedIsLocalDir && $vendorDir.'/composer' === $selfDir) {
+ $copiedLocalDir = true;
+ }
}
}
@@ -350,7 +387,7 @@
}
}
- if (self::$installed !== array()) {
+ if (self::$installed !== array() && !$copiedLocalDir) {
$installed[] = self::$installed;
}
--- a/filebird/vendor/composer/installed.php
+++ b/filebird/vendor/composer/installed.php
@@ -3,7 +3,7 @@
'name' => 'ninjateam/filebird',
'pretty_version' => 'dev-main',
'version' => 'dev-main',
- 'reference' => 'c7cb035cc0855f50cd4aba1421148823806dd660',
+ 'reference' => 'ae24a56b4431bdbd79dd6c27c3c16365a472d9c0',
'type' => 'library',
'install_path' => __DIR__ . '/../../',
'aliases' => array(),
@@ -22,7 +22,7 @@
'ninjateam/filebird' => array(
'pretty_version' => 'dev-main',
'version' => 'dev-main',
- 'reference' => 'c7cb035cc0855f50cd4aba1421148823806dd660',
+ 'reference' => 'ae24a56b4431bdbd79dd6c27c3c16365a472d9c0',
'type' => 'library',
'install_path' => __DIR__ . '/../../',
'aliases' => array(),
--- a/filebird/views/settings/header.php
+++ b/filebird/views/settings/header.php
@@ -36,13 +36,13 @@
</div>
</div>
<div id="filebird-admin-actions">
- <a href="https://ninjateam.gitbook.io/filebird/features/interface" target="_blank" rel="noopener noreferrer">
+ <a class="focus:fb-shadow-admin-button" href="https://ninjateam.gitbook.io/filebird/features/interface" target="_blank" tabindex="0" rel="noopener noreferrer">
<?php esc_html_e( 'Docs', 'filebird' ); ?>
</a>
- <a href="https://ninjateam.org/support/" target="_blank" rel="noopener noreferrer">
+ <a class="focus:fb-shadow-admin-button" href="https://ninjateam.org/support/" target="_blank" tabindex="0" rel="noopener noreferrer">
<?php esc_html_e( 'Support', 'filebird' ); ?>
</a>
- <a href="https://ninjateam.gitbook.io/filebird/other-links/changelog" target="_blank" rel="noopener noreferrer">
+ <a class="focus:fb-shadow-admin-button" href="https://ninjateam.gitbook.io/filebird/other-links/changelog" target="_blank" tabindex="0" rel="noopener noreferrer">
<?php esc_html_e( 'Changelog', 'filebird' ); ?>
</a>
</div>
