Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/addfunc-head-footer-code/addfunc-head-footer-code.php
+++ b/addfunc-head-footer-code/addfunc-head-footer-code.php
@@ -1,12 +1,13 @@
-<?php
+<?php if ( ! defined( 'ABSPATH' ) ) exit;
/*
Plugin Name: AddFunc Head & Footer Code
Plugin URI:
Description: Allows administrators to add code to the <head> and/or <footer> of an individual post and/or site-wide. Ideal for scripts such as Google Analytics conversion tracking codes and any other general or page-specific JavaScript.
- Version: 2.3
+ Version: 2.4
Author: AddFunc
Author URI: http://profiles.wordpress.org/addfunc
- License: Public Domain
+ Text Domain: addfunc-head-footer-code
+ License: GPLv2 or later
@since 3.0.1
______
_ | ___/ _ _ __ ____
@@ -27,84 +28,93 @@
if(!class_exists('aFHFCClass')) :
define('AFHDFTRCD_ID', 'aFhfc');
define('AFHDFTRCD_NICK', 'Head & Footer Code');
- class aFHFCClass
- {
- public static function file_path($file)
- {
+ class aFHFCClass {
+ public static function file_path($file) {
return plugin_dir_path(__FILE__).$file;
}
- public static function register()
- {
+ public static function register() {
register_setting(AFHDFTRCD_ID.'_options', 'aFhfc_site_wide_head_code');
register_setting(AFHDFTRCD_ID.'_options', 'aFhfc_head_code_priority');
register_setting(AFHDFTRCD_ID.'_options', 'aFhfc_site_wide_body_code');
register_setting(AFHDFTRCD_ID.'_options', 'aFhfc_site_wide_footer_code');
register_setting(AFHDFTRCD_ID.'_options', 'aFhfc_footer_code_priority');
}
- public static function menu()
- {
+ public static function register_meta_keys() {
+ register_meta('post', 'aFhfc_head_code', array(
+ 'auth_callback' => function() { return current_user_can('manage_options'); },
+ 'sanitize_callback' => 'wp_kses_post',
+ 'show_in_rest' => false,
+ ));
+ register_meta('post', 'aFhfc_body_code', array(
+ 'auth_callback' => function() { return current_user_can('manage_options'); },
+ 'sanitize_callback' => 'wp_kses_post',
+ 'show_in_rest' => false,
+ ));
+ register_meta('post', 'aFhfc_footer_code', array(
+ 'auth_callback' => function() { return current_user_can('manage_options'); },
+ 'sanitize_callback' => 'wp_kses_post',
+ 'show_in_rest' => false,
+ ));
+ }
+ public static function menu() {
add_options_page(AFHDFTRCD_NICK.' Plugin Options', AFHDFTRCD_NICK, 'manage_options', AFHDFTRCD_ID.'_options', array('aFHFCClass', 'options_page'));
}
- public static function options_page()
- {
+ public static function options_page() {
if (!current_user_can('manage_options'))
{
- wp_die(__('You do not have sufficient permissions to access this page.'));
+ wp_die(__('You do not have sufficient permissions to access this page.', 'addfunc-head-footer-code'));
}
$plugin_id = AFHDFTRCD_ID;
include(self::file_path('options.php'));
}
- public static function output_head_code()
- {
+ public static function output_head_code() {
$site_head_code = get_option('aFhfc_site_wide_head_code');
$meta_head_code = ((is_archive()) || (is_author()) || (is_category()) || (is_tag()) || (is_home()) || (is_search()) || (is_404())) ? '' : get_post_meta(get_the_ID(),'aFhfc_head_code',true);
$head_replace = get_post_meta(get_the_ID(),'aFhfc_head_replace',true);
- if(!empty($head_replace)){
+ if(!empty($head_replace)) {
echo $meta_head_code."n";
}else{
echo $site_head_code."n".$meta_head_code."n";
}
}
- public static function output_body_code()
- {
+ public static function output_body_code() {
$site_body_code = get_option('aFhfc_site_wide_body_code');
$meta_body_code = ((is_archive()) || (is_author()) || (is_category()) || (is_tag()) || (is_home()) || (is_search()) || (is_404())) ? '' : get_post_meta(get_the_ID(),'aFhfc_body_code',true);
$body_replace = get_post_meta(get_the_ID(),'aFhfc_body_replace',true);
- if(!empty($body_replace)){
+ if(!empty($body_replace)) {
return $meta_body_code."n";
}else{
return $site_body_code."n".$meta_body_code."n";
}
}
- public static function output_footer_code()
- {
+ public static function output_footer_code() {
$site_footer_code = get_option('aFhfc_site_wide_footer_code');
$meta_footer_code = ((is_archive()) || (is_author()) || (is_category()) || (is_tag()) || (is_home()) || (is_search()) || (is_404())) ? '' : get_post_meta(get_the_ID(),'aFhfc_footer_code',true);
$footer_replace = get_post_meta(get_the_ID(),'aFhfc_footer_replace',true);
- if(!empty($footer_replace)){
+ if(!empty($footer_replace)) {
echo $meta_footer_code."n";
}else{
echo $site_footer_code."n".$meta_footer_code."n";
}
}
}
- if (is_admin())
- {
+ add_action('init', array('aFHFCClass','register_meta_keys'));
+ if (is_admin()) {
add_action('admin_init', array('aFHFCClass','register'));
add_action('admin_menu', array('aFHFCClass','menu'));
}
$head_code_prior = get_option('aFhfc_head_code_priority');
- if(!empty($head_code_prior)){
+ if(!empty($head_code_prior)) {
add_action('wp_head', array('aFHFCClass','output_head_code'),$head_code_prior);
}
else {
add_action('wp_head', array('aFHFCClass','output_head_code'));
}
- function aFHFCBuffRec(){
+ function aFHFCBuffRec() {
ob_start();
}
add_action('wp_head','aFHFCBuffRec');
- function aFHFCBuffPlay(){
+ function aFHFCBuffPlay() {
$body_code = new aFHFCClass;
$pattern = '/<[bB][oO][dD][yY]s[A-Za-z]{2,5}[A-Za-z0-9 "_,=%*'/():;[]-.]+>|<body>/';
$queue = array();
@@ -115,7 +125,7 @@
}
add_action('wp_print_footer_scripts','aFHFCBuffPlay');
$footer_code_prior = get_option('aFhfc_footer_code_priority');
- if(!empty($footer_code_prior)){
+ if(!empty($footer_code_prior)) {
add_action('wp_footer', array('aFHFCClass','output_footer_code'),$footer_code_prior);
}
else {
@@ -128,20 +138,19 @@
/*
M E T A B O X F O R P O S T S
=================================
- Metabox w/head & footer fields for all post types (including custom)
+ Metabox w/head & footer fields for
+ all post types (including custom)
*/
add_action('add_meta_boxes','aFhfc_add');
-function aFhfc_add()
-{
- if(current_user_can('manage_options')){
+function aFhfc_add() {
+ if(current_user_can('manage_options')) {
$args = array('public'=>true);
$post_types = get_post_types($args);
add_meta_box('aFhfcMetaBox','Head & Footer Code','aFhfc_mtbx',$post_types,'normal','low');
}
}
-function aFhfc_mtbx($post)
-{
+function aFhfc_mtbx($post) {
$values = get_post_custom($post->ID);
$head_text = isset($values['aFhfc_head_code']) ? esc_attr($values['aFhfc_head_code'][0]) : '';
$head_replace = isset($values['aFhfc_head_replace']) ? esc_attr($values['aFhfc_head_replace'][0]) : '';
@@ -172,8 +181,7 @@
<?php
}
add_action('save_post','aFhfc_save');
-function aFhfc_save($post_id)
-{
+function aFhfc_save($post_id) {
if(defined('DOING_AUTOSAVE') && DOING_AUTOSAVE)return;
if(!isset($_POST['aFhfc_mb_nonce']) || !wp_verify_nonce($_POST['aFhfc_mb_nonce'],'aFhfc_nonce'))return;
if(!current_user_can('manage_options'))return;
--- a/addfunc-head-footer-code/options.php
+++ b/addfunc-head-footer-code/options.php
@@ -1,3 +1,4 @@
+<?php if ( ! defined( 'ABSPATH' ) ) exit; ?>
<div class="wrap">
<h2>Head & Footer Code</h2>
<div id="poststuff">
