Skip to content

Commit a206ac5

Browse files
alextuanalextuan
committed
Release new version 2.5.0
* This release is for compatibility with WordPress major version 6.0 plus includes various tweaks to harden the plugins security. * Tweak - Test for compatibility with WordPress 6.0 * Framework – Upgrade Plugin Framework to version 2.6.0 * Security - Various code hardening tweaks. * Security - Escape all $-variable * Security - Sanitize all $_REQUEST, $_GET, $_POST * Security - Apply wp_unslash before sanitize
1 parent cdcabc1 commit a206ac5

File tree

7 files changed

+446
-334
lines changed

7 files changed

+446
-334
lines changed

‎a3-lazy-load.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22
/*
33
Plugin Name: a3 Lazy Load
44
Description: Speed up your site and enhance frontend user's visual experience in PC's, Tablets and mobile with a3 Lazy Load.
5-
Version: 2.4.9
5+
Version: 2.5.0
66
Author: a3rev Software
77
Author URI: https://a3rev.com/
88
Requires at least: 5.6
9-
Tested up to: 5.9
9+
Tested up to: 6.0
1010
Text Domain: a3-lazy-load
1111
Domain Path: /languages
1212
License: GPLv2 or later
@@ -31,7 +31,7 @@
3131

3232
define( 'A3_LAZY_LOAD_KEY', 'a3_lazy_load' );
3333
define( 'A3_LAZY_LOAD_PREFIX', 'a3_lazy_load_' );
34-
define( 'A3_LAZY_VERSION', '2.4.9' );
34+
define( 'A3_LAZY_VERSION', '2.5.0' );
3535
define( 'A3_LAZY_LOAD_G_FONTS', false );
3636

3737
use \A3Rev\LazyLoad\FrameWork;

‎admin/admin-init.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ public function admin_settings_page( $page_data = array() ) {
199199
<?php
200200
if ( $page_data !== false) {
201201
echo esc_html( $page_data['page_title'] );
202-
if ( isset( $page_data['view_doc'] ) ) echo $page_data['view_doc'];
202+
if ( isset( $page_data['view_doc'] ) ) echo wp_kses_post( $page_data['view_doc'] );
203203
}
204204
?>
205205
</h1>
@@ -281,7 +281,7 @@ public function admin_settings_tab( $current_page = '', $tab_data = array() ) {
281281
$separate_text = '';
282282
$activated_first_subtab = false;
283283
foreach ( $subtabs as $subtab ) {
284-
echo '<li>' . $separate_text . '<a href="#' . trim( esc_attr( $subtab['name'] ) ) . '" class="';
284+
echo '<li>' . esc_html( $separate_text ) . '<a href="#' . trim( esc_attr( $subtab['name'] ) ) . '" class="';
285285
if ( $current_subtab == '' && $activated_first_subtab === false ) {
286286
echo 'current';
287287
$activated_first_subtab = true;

‎admin/admin-interface.php

+352-285
Large diffs are not rendered by default.

‎admin/admin-ui.php

+16-11
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ class Admin_UI
3333
* You must change to correct plugin name that you are working
3434
*/
3535

36-
public $framework_version = '2.5.0';
36+
public $framework_version = '2.6.0';
3737
public $plugin_name = A3_LAZY_LOAD_KEY;
3838
public $plugin_path = A3_LAZY_LOAD_NAME;
3939
public $google_api_key_option = '';
@@ -87,8 +87,6 @@ public function __construct() {
8787
}
8888

8989
$this->support_url = 'https://wordpress.org/support/plugin/a3-lazy-load/';
90-
91-
$this->update_google_map_api_key();
9290
}
9391

9492

@@ -182,13 +180,20 @@ public function validate_google_map_api_key( $g_key = '' ) {
182180
}
183181

184182
public function update_google_map_api_key() {
183+
if ( ! current_user_can( 'manage_options' ) ) {
184+
return false;
185+
}
186+
187+
check_admin_referer( 'save_settings_' . $this->plugin_name );
188+
185189
// Enable Google Map API Key
186190
if ( isset( $_POST[ $this->google_map_api_key_option . '_enable' ] ) ) {
191+
187192
$old_google_map_api_key_enable = get_option( $this->google_map_api_key_option . '_enable', 0 );
188193

189194
update_option( $this->google_map_api_key_option . '_enable', 1 );
190195

191-
$option_value = trim( sanitize_text_field( $_POST[ $this->google_map_api_key_option ] ) );
196+
$option_value = trim( sanitize_text_field( wp_unslash( $_POST[ $this->google_map_api_key_option ] ) ) );
192197
update_option( $this->google_map_api_key_option, $option_value );
193198

194199
if ( 1 != $old_google_map_api_key_enable ) {
@@ -203,7 +208,7 @@ public function update_google_map_api_key() {
203208

204209
update_option( $this->google_map_api_key_option . '_enable', 0 );
205210

206-
$option_value = trim( sanitize_text_field( $_POST[ $this->google_map_api_key_option ] ) );
211+
$option_value = trim( sanitize_text_field( wp_unslash( $_POST[ $this->google_map_api_key_option ] ) ) );
207212
update_option( $this->google_map_api_key_option, $option_value );
208213

209214
if ( 0 != $old_google_map_api_key_enable ) {
@@ -254,7 +259,7 @@ public function plugin_premium_video_box( $echo = true ) {
254259
$output = apply_filters( $this->plugin_name . '_plugin_premium_video', $output );
255260

256261
if ( $echo )
257-
echo $output;
262+
echo wp_kses_post( $output );
258263
else
259264
return $output;
260265
}
@@ -275,7 +280,7 @@ public function plugin_premium_video( $echo = false ) {
275280
$output .= '</div>';
276281

277282
if ( $echo )
278-
echo $output;
283+
echo wp_kses_post( $output );
279284
else
280285
return $output;
281286
}
@@ -293,7 +298,7 @@ public function plugin_premium_video_text( $echo = false ) {
293298
}
294299

295300
if ( $echo )
296-
echo $output;
301+
echo wp_kses_post( $output );
297302
else
298303
return $output;
299304
}
@@ -327,7 +332,7 @@ public function plugin_extension_boxes( $echo = false ) {
327332
}
328333

329334
if ( $echo )
330-
echo $output;
335+
echo wp_kses_post( $output );
331336
else
332337
return $output;
333338
}
@@ -364,7 +369,7 @@ public function plugin_extension_end( $echo = true ) {
364369
$output = apply_filters( $this->plugin_name . '_plugin_extension_end', $output );
365370

366371
if ( $echo )
367-
echo $output;
372+
echo wp_kses_post( $output );
368373
else
369374
return $output;
370375

@@ -384,7 +389,7 @@ public function upgrade_top_message( $echo = false, $setting_id = '' ) {
384389

385390
$upgrade_top_message = apply_filters( $this->plugin_name . '_upgrade_top_message', $upgrade_top_message, $setting_id );
386391

387-
if ( $echo ) echo $upgrade_top_message;
392+
if ( $echo ) echo wp_kses_post( $upgrade_top_message );
388393
else return $upgrade_top_message;
389394

390395
}

‎admin/includes/fonts_face.php

+51-29
Original file line numberDiff line numberDiff line change
@@ -364,13 +364,46 @@ public function __construct() {
364364
return;
365365
}
366366

367+
if ( apply_filters( $this->plugin_name . '_new_google_fonts_enable', true ) ) {
368+
$this->is_valid_google_api_key();
369+
$google_fonts = get_option( $this->plugin_name . '_google_font_list', array() );
370+
} else {
371+
$google_fonts = array();
372+
}
373+
374+
if ( ! is_array( $google_fonts ) || count( $google_fonts ) < 1 ) {
375+
$google_fonts = apply_filters( $this->plugin_name . '_google_fonts', $this->google_fonts );
376+
}
377+
378+
sort( $google_fonts );
379+
380+
$new_google_fonts = array();
381+
foreach ( $google_fonts as $row ) {
382+
$new_google_fonts[$row['name']] = $row;
383+
}
384+
385+
$this->google_fonts = $new_google_fonts;
386+
387+
}
388+
389+
public function update_google_font_api_key() {
390+
if ( ! current_user_can( 'manage_options' ) ) {
391+
return false;
392+
}
393+
394+
check_admin_referer( 'save_settings_' . $this->plugin_name );
395+
396+
if ( ! $this->is_load_google_fonts ) {
397+
return;
398+
}
399+
367400
// Enable Google Font API Key
368401
if ( isset( $_POST[ $this->google_api_key_option . '_enable' ] ) ) {
369402
$old_google_api_key_enable = get_option( $this->google_api_key_option . '_enable', 0 );
370403

371404
update_option( $this->google_api_key_option . '_enable', 1 );
372405

373-
$option_value = trim( sanitize_text_field( $_POST[ $this->google_api_key_option ] ) );
406+
$option_value = trim( sanitize_text_field( wp_unslash( $_POST[ $this->google_api_key_option ] ) ) );
374407

375408
$old_google_api_key_option = get_option( $this->google_api_key_option );
376409

@@ -388,35 +421,14 @@ public function __construct() {
388421

389422
update_option( $this->google_api_key_option . '_enable', 0 );
390423

391-
$option_value = trim( sanitize_text_field( $_POST[ $this->google_api_key_option ] ) );
424+
$option_value = trim( sanitize_text_field( wp_unslash( $_POST[ $this->google_api_key_option ] ) ) );
392425
update_option( $this->google_api_key_option, $option_value );
393426

394427
if ( 0 != $old_google_api_key_enable ) {
395428
// Clear cached of google api key status
396429
delete_transient( $this->google_api_key_option . '_status' );
397430
}
398431
}
399-
400-
if ( apply_filters( $this->plugin_name . '_new_google_fonts_enable', true ) ) {
401-
$this->is_valid_google_api_key();
402-
$google_fonts = get_option( $this->plugin_name . '_google_font_list', array() );
403-
} else {
404-
$google_fonts = array();
405-
}
406-
407-
if ( ! is_array( $google_fonts ) || count( $google_fonts ) < 1 ) {
408-
$google_fonts = apply_filters( $this->plugin_name . '_google_fonts', $this->google_fonts );
409-
}
410-
411-
sort( $google_fonts );
412-
413-
$new_google_fonts = array();
414-
foreach ( $google_fonts as $row ) {
415-
$new_google_fonts[$row['name']] = $row;
416-
}
417-
418-
$this->google_fonts = $new_google_fonts;
419-
420432
}
421433

422434
public function validate_google_api_key( $g_key = '' ) {
@@ -608,10 +620,14 @@ public function generate_font_css( $option, $em = '1.2' ) {
608620
$line_height = $option['line_height'];
609621
}
610622

623+
$font_css = '';
624+
611625
if ( !@$option['style'] && !@$option['size'] && !@$option['color'] )
612-
return 'font-family: '.stripslashes($option["face"]).' !important;';
626+
$font_css = 'font-family: '.stripslashes($option["face"]).' !important;';
613627
else
614-
return 'font:'.$option['style'].' '.$option['size'].'/' . $line_height . ' ' .stripslashes($option['face']).' !important; color:'.$option['color'].' !important;';
628+
$font_css = 'font:'.$option['style'].' '.$option['size'].'/' . $line_height . ' ' .stripslashes($option['face']).' !important; color:'.$option['color'].' !important;';
629+
630+
return apply_filters( $this->plugin_name . '_generate_font_css', $font_css, $option, $em );
615631
}
616632

617633

@@ -641,14 +657,20 @@ public function generate_google_webfonts( $my_google_fonts = array(), $echo = tr
641657
// Output google font css in header
642658
if ( trim( $fonts ) != '' ) {
643659
$fonts = str_replace( " ","+",$fonts);
644-
$output .= "\n<!-- Google Webfonts -->\n";
645-
$output .= '<link href="http'. ( is_ssl() ? 's' : '' ) .'://fonts.googleapis.com/css?family=' . $fonts .'" rel="stylesheet" type="text/css" />'."\n";
646-
$output = str_replace( '|"','"',$output);
660+
661+
if ( $echo ) {
662+
echo "\n<!-- Google Webfonts -->\n";
663+
echo '<link href="http'. ( is_ssl() ? 's' : '' ) .'://fonts.googleapis.com/css?family=' . esc_attr( $fonts ) .'" rel="stylesheet" type="text/css" />'."\n";
664+
} else {
665+
$output .= "\n<!-- Google Webfonts -->\n";
666+
$output .= '<link href="http'. ( is_ssl() ? 's' : '' ) .'://fonts.googleapis.com/css?family=' . esc_attr( $fonts ) .'" rel="stylesheet" type="text/css" />'."\n";
667+
$output = str_replace( '|"','"',$output);
668+
}
647669
}
648670
}
649671

650672
if ( $echo )
651-
echo $output;
673+
echo '';
652674
else
653675
return $output;
654676

‎admin/includes/uploader/class-uploader.php

+8-2
Original file line numberDiff line numberDiff line change
@@ -85,15 +85,20 @@ public function uploader_style () {
8585
/*-----------------------------------------------------------------------------------*/
8686
/* Get Upload Input Field */
8787
/*-----------------------------------------------------------------------------------*/
88-
public function upload_input ( $name_attribute, $id_attribute = '', $value = '', $attachment_id = 0, $default_value = '', $field_name = '', $class = '', $css = '', $description = '', $strip_methods = true ) {
88+
public function upload_input ( $name_attribute, $id_attribute = '', $value = '', $attachment_id = 0, $default_value = '', $field_name = '', $class = '', $css = '', $description = '', $strip_methods = true, $size = 'original' ) {
8989
$output = '';
9090

9191
if ( trim( $value ) == '' ) $value = trim( $default_value );
9292

9393
if ( strstr( $name_attribute, ']' ) ) {
9494
$attachment_id_name_attribute = substr_replace( $name_attribute, '_attachment_id', -1, 0 );
95+
96+
$attachment_size_name_attribute = substr_replace( $name_attribute, '_attachment_size', -1, 0 );
97+
9598
} else {
9699
$attachment_id_name_attribute = $name_attribute.'_attachment_id';
100+
101+
$attachment_size_name_attribute = $name_attribute.'_attachment_size';
97102
}
98103

99104
if ( $strip_methods === false ) {
@@ -103,6 +108,7 @@ public function upload_input ( $name_attribute, $id_attribute = '', $value = '',
103108
}
104109

105110
$output .= '<input type="hidden" name="'.$attachment_id_name_attribute.'" id="'.$id_attribute.'_attachment_id" value="'.$attachment_id.'" class=" a3_upload_attachment_id" />';
111+
$output .= '<input type="hidden" name="'.$attachment_size_name_attribute.'" id="'.$id_attribute.'_attachment_size" value="'.$size.'" class=" a3_upload_attachment_size" />';
106112
$output .= '<input data-strip-methods="'.$strip_methods.'" type="text" name="'.$name_attribute.'" id="'.$id_attribute.'" value="'.esc_attr( $value ).'" class="'.$id_attribute. ' ' .$class.' a3_upload" style="'.$css.'" rel="'.$field_name.'" /> ';
107113
$output .= '<input id="upload_'.$id_attribute.'" class="a3rev-ui-upload-button a3_upload_button button" type="button" value="'.__( 'Upload', 'a3-lazy-load' ).'" /> '.$description;
108114

@@ -126,7 +132,7 @@ public function upload_input ( $name_attribute, $id_attribute = '', $value = '',
126132

127133
$title = __( 'View File', 'a3-lazy-load' );
128134

129-
$output .= '<div class="a3_no_image"><span class="a3_file_link"><a href="'.esc_url( $value ).'" target="_blank" rel="a3_external">'.$title.'</a></span>'.$remove.'</div>';
135+
$output .= '<div class="a3_no_image"><span class="a3_file_link"><a href="'.esc_url( $value ).'" target="_blank" rel="noopener">'.$title.'</a></span>'.$remove.'</div>';
130136

131137
}
132138
}

‎readme.txt

+14-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
Contributors: a3rev, a3rev Software, nguyencongtuan
33
Tags: a3 lazy load, Lazy Loading, image lazy load, lazyload
44
Requires at least: 5.6
5-
Tested up to: 5.9
6-
Stable tag: 2.4.9
5+
Tested up to: 6.0
6+
Stable tag: 2.5.0
77
License: GPLv3
88
License URI: http://www.gnu.org/licenses/gpl-3.0.html
99

@@ -198,6 +198,15 @@ Filter tags to add to class name of theme to exclude lazy load on images or vide
198198

199199
== Changelog ==
200200

201+
= 2.5.0 - 2022/05/24 =
202+
* This release is for compatibility with WordPress major version 6.0 plus includes various tweaks to harden the plugins security.
203+
* Tweak - Test for compatibility with WordPress 6.0
204+
* Framework – Upgrade Plugin Framework to version 2.6.0
205+
* Security - Various code hardening tweaks.
206+
* Security - Escape all $-variable
207+
* Security - Sanitize all $_REQUEST, $_GET, $_POST
208+
* Security - Apply wp_unslash before sanitize
209+
201210
= 2.4.9 - 2022/01/21 =
202211
* This is a maintenance release for compatibility with WordPress major version 5.9
203212
* Tweak - Test for compatibility with WordPress 5.9
@@ -591,6 +600,9 @@ Filter tags to add to class name of theme to exclude lazy load on images or vide
591600

592601
== Upgrade Notice ==
593602

603+
= 2.5.0 =
604+
This release is for compatibility with WordPress major version 6.0 plus includes various tweaks to harden the plugins security
605+
594606
= 2.4.9 =
595607
This is a maintenance release for compatibility with WordPress major version 5.9
596608

0 commit comments

Comments
 (0)