Skip to content

Commit

Permalink
security issue fixed
Browse files Browse the repository at this point in the history
  • Loading branch information
delower186 committed Feb 12, 2024
1 parent acb67ad commit 23915ac
Show file tree
Hide file tree
Showing 63 changed files with 36,383 additions and 8 deletions.
8 changes: 5 additions & 3 deletions inc/Base/Model.php
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@ public static function wptodo_notice($raw_notice) {
public static function wptodo_addtask(array $newdata) {
$wptodo_table = self::$wpdb->prefix . "wptodo";
$today_date = gmdate('Y-m-d');
$wptodo_query = "INSERT INTO `".$wptodo_table."` (`id`, `date`, `title`, `desc`, `from`, `for`, `until`,`status`,`priority`,`notify`)VALUES (NULL , '$today_date', '".$newdata['wptodo_title']."','".$newdata['wptodo_description']."','".$newdata['wptodo_from']."','".$newdata['wptodo_for']."','".$newdata['wptodo_deadline']."','".$newdata['wptodo_status']."','".$newdata['wptodo_priority']."','".!empty($newdata['wptodo_notify'])."')";
$wptodo_query = "INSERT INTO `".$wptodo_table."` (`id`, `date`, `title`, `desc`, `from`, `for`, `until`,`status`,`priority`,`notify`)VALUES (NULL , '$today_date', '".htmlentities(strip_tags($newdata['wptodo_title']))."','".htmlentities($newdata['wptodo_description'])."','".$newdata['wptodo_from']."','".$newdata['wptodo_for']."','".$newdata['wptodo_deadline']."','".$newdata['wptodo_status']."','".$newdata['wptodo_priority']."','".!empty($newdata['wptodo_notify'])."')";
self::$wpdb->query($wptodo_query);
self::wptodo_email();
}
Expand All @@ -201,7 +201,7 @@ public static function wptodo_addtask(array $newdata) {
*/
public static function wptodo_updatetask(array $newdata) {
$wptodo_table = self::$wpdb->prefix . "wptodo";
$wptodo_query = "UPDATE `".$wptodo_table."` SET `title`='".$newdata['wptodo_title']."', `desc`='".$newdata['wptodo_description']."', `for`='".$newdata['wptodo_for']."', `until`='".$newdata['wptodo_deadline']."', `status`='".$newdata['wptodo_status']."', `priority`='".$newdata['wptodo_priority']."', `notify`='".!empty($newdata['wptodo_notify'])."' WHERE `id`='".$newdata['wptodo_taskid']."'";
$wptodo_query = "UPDATE `".$wptodo_table."` SET `title`='".htmlentities(strip_tags($newdata['wptodo_title']))."', `desc`='".htmlentities($newdata['wptodo_description'])."', `for`='".$newdata['wptodo_for']."', `until`='".$newdata['wptodo_deadline']."', `status`='".$newdata['wptodo_status']."', `priority`='".$newdata['wptodo_priority']."', `notify`='".!empty($newdata['wptodo_notify'])."' WHERE `id`='".$newdata['wptodo_taskid']."'";
self::$wpdb->query($wptodo_query);
self::wptodo_email();

Expand Down Expand Up @@ -349,5 +349,7 @@ public static function wptodo_tasks(){
echo "";
$num++;
}
}
}


}
8 changes: 6 additions & 2 deletions readme.txt
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@
Contributors: delower186
Tags: todo, task, project management, to do list, todo list, project management, todo, todo list, task, basecamp, milestone, message, file, comment, client, team, tracking, planning, lists, reporting, project management plugin for wordpress, project manager, project manager plugin for wordpress, wordpress project management
Requires at least: 5.4 or higher
Tested up to: 6.2.2
Stable tag: 1.2.8
Tested up to: 6.4.3
Stable tag: 1.3.0
Requires PHP: 6.8
License: GPLv2
License URI: http://www.gnu.org/licenses/gpl-2.0.html
Expand Down Expand Up @@ -64,6 +64,10 @@ A. Found any bugs? Please create an [issue](https://github.com/delower186/wp-tod

== Changelog ==

= 1.2.9 =

* Security issue fixed

= 1.2.8 =

* Bug Fixed
Expand Down
17 changes: 17 additions & 0 deletions vendor/composer.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{
"name": "WP To Do",
"description": "Wordpress To Do list for users",
"type": "project",
"license": "GPLv2 or later",
"authors": [
{
"name": "Delower",
"email": "admin@247-assistant.com"
}
],
"minimum-stability": "dev",
"require": {},
"autoload":{
"psr-4": {"Inc\\": "./inc"}
}
}
46 changes: 46 additions & 0 deletions vendor/inc/Api/SettingsApi.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
<?php
/**
* @package wptodo
*/
namespace Inc\Api;

class SettingsApi
{
public $admin_pages = array();
public $admin_subpages = array();

public function register(){
if ( ! empty($this->admin_pages ) ){
add_action( 'admin_menu', array( $this, 'AddAdminMenu') );
if(! empty($this->admin_subpages)){
add_action( 'admin_menu', array( $this, 'AddAdminSubMenu') );
}
}
}

public function AddPage( array $pages) {

$this->admin_pages = $pages;

return $this;
}

public function AddSubPage( array $subpages) {

$this->admin_subpages = $subpages;

return $this;
}

public function AddAdminMenu(){
foreach( $this->admin_pages as $page ){
add_menu_page( $page['page_title'], $page['menu_title'], $page['capability'], $page['menu_slug'], $page['callback'], $page['icon_url'], $page['position'] );
}
}

public function AddAdminSubMenu(){
foreach( $this->admin_subpages as $subpage ){
add_submenu_page( $subpage['parent_slug'], $subpage['page_title'], $subpage['menu_title'], $subpage['capability'], $subpage['menu_slug'], $subpage['function'] );
}
}
}
11 changes: 11 additions & 0 deletions vendor/inc/Base/Activate.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
<?php
/**
* @package wptodo
*/
namespace Inc\Base;
class Activate{
public static function activate(){
flush_rewrite_rules();
Model::wptodo_install();
}
}
19 changes: 19 additions & 0 deletions vendor/inc/Base/BaseController.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
<?php
/**
* @package wptodo
*/
namespace Inc\Base;


class BaseController
{
public static $plugin_path;
public static $plugin_url;
public static $plugin;

public function __construct(){
self::$plugin_path = plugin_dir_path( dirname( __FILE__ , 2 ) );
self::$plugin_url = plugin_dir_url( dirname( __FILE__ , 2 ) );
self::$plugin = plugin_basename( dirname( __FILE__ , 3 ) ) . '/wp-todo.php';
}
}
10 changes: 10 additions & 0 deletions vendor/inc/Base/Deactivate.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
<?php
/**
*@package wptodo
*/
namespace Inc\Base;
class Deactivate{
public static function deactivate(){
flush_rewrite_rules();
}
}
33 changes: 33 additions & 0 deletions vendor/inc/Base/Enqueue.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
<?php
/**
* @package wptodo
*/
namespace Inc\Base;

use \Inc\Base\BaseController;

class Enqueue extends BaseController
{

public function register(){
//enqueue scripts in the admin panel
add_action('admin_enqueue_scripts', array($this, 'enqueue'),9999);

//enqueue scripts in the frontend
add_action('wp_enqueue_scripts', array($this, 'enqueue'),9999);
}

public function enqueue(){
//css stylesheets
wp_enqueue_style('datatable', parent::$plugin_url . 'scripts/DataTables/datatables.min.css');
wp_enqueue_style('style', parent::$plugin_url . 'scripts/css/style.css');
wp_enqueue_style('jquery-ui', parent::$plugin_url . 'scripts/jquery-ui-1.12.1/jquery-ui.min.css');
wp_enqueue_style('flipclock', parent::$plugin_url . 'scripts/css/flipclock.css');
//js scripts
wp_enqueue_script('jquery-3.6.0', parent::$plugin_url . 'scripts/js/jquery-3.6.0.min.js',false,array(), false, false);
wp_enqueue_script('datatable', parent::$plugin_url . 'scripts/DataTables/datatables.min.js', array(), false, true);
wp_enqueue_script('flipclock', parent::$plugin_url . 'scripts/js/flipclock.min.js', array(), false, true);
wp_enqueue_script('jquery-ui', parent::$plugin_url . 'scripts/jquery-ui-1.12.1/jquery-ui.min.js', array(), false, true);
}

}
Loading

0 comments on commit 23915ac

Please sign in to comment.