Release version 2.6.1

* This maintenance release has a security vulnerability patch, please run this update.
* Security – This release has a patch for a security vulnerability identified by Wordfence scan

Author: alextuan

a3-lazy-load.php

@@ -2,7 +2,7 @@
 /*
 Plugin Name: a3 Lazy Load
 Description: Speed up your site and enhance frontend user's visual experience in PC's, Tablets and mobile with a3 Lazy Load.
-Version: 2.6.0
+Version: 2.6.1
 Author: a3rev Software
 Author URI: https://a3rev.com/
 Requires at least: 5.6
@@ -31,7 +31,7 @@
 
 define( 'A3_LAZY_LOAD_KEY', 'a3_lazy_load' );
 define( 'A3_LAZY_LOAD_PREFIX', 'a3_lazy_load_' );
-define( 'A3_LAZY_VERSION', '2.6.0' );
+define( 'A3_LAZY_VERSION', '2.6.1' );
 define( 'A3_LAZY_LOAD_G_FONTS', false );
 
 use \A3Rev\LazyLoad\FrameWork;

admin/admin-interface.php

@@ -618,6 +618,10 @@ public function save_settings( $options, $option_name = '' ) {
 		foreach ( $options as $value ) {
 			if ( ! isset( $value['type'] ) ) continue;
 			if ( in_array( $value['type'], array( 'row', 'column', 'heading', 'ajax_submit', 'ajax_multi_submit' ) ) ) continue;
+			if ( stristr( $value['type'], 'custom_' ) !== false ) {
+				do_action( $this->plugin_name . '_save_setting_' . $value['type'], $value );
+				continue;
+			}
 
 			// Save for global settings of plugin framework
 			switch ( $value['type'] ) {
@@ -1030,6 +1034,14 @@ public function save_settings( $options, $option_name = '' ) {
 	/*-----------------------------------------------------------------------------------*/
 
 	public function reset_settings( $options, $option_name = '', $reset = false, $free_version = false ) {
+
+		if ( $reset ) {
+			check_admin_referer( 'save_settings_' . $this->plugin_name );
+
+			if ( ! current_user_can( 'manage_options' ) ) {
+				return false;
+			}
+		}
 
 		if ( !is_array( $options ) || count( $options ) < 1 ) return;
 
@@ -1089,6 +1101,11 @@ public function reset_settings( $options, $option_name = '', $reset = false, $fr
 			if ( ! isset( $value['id'] ) || trim( $value['id'] ) == '' ) continue;
 			if ( ! isset( $value['default'] ) ) $value['default'] = '';
 			if ( ! isset( $value['free_version'] ) ) $value['free_version'] = false;
+
+			if ( stristr( $value['type'], 'custom_' ) !== false ) {
+				do_action( $this->plugin_name . '_reset_setting_' . $value['type'], $value );
+				continue;
+			}
 
 			// For way it has an option name
 			if ( ! isset( $value['separate_option'] ) ) $value['separate_option'] = false;

admin/admin-ui.php

@@ -33,7 +33,7 @@ class Admin_UI
 	 * You must change to correct plugin name that you are working
 	 */
 
-	public $framework_version      = '2.6.0';
+	public $framework_version      = '2.6.2';
 	public $plugin_name            = A3_LAZY_LOAD_KEY;
 	public $plugin_path            = A3_LAZY_LOAD_NAME;
 	public $google_api_key_option  = '';
@@ -353,7 +353,7 @@ public function plugin_extension_start( $echo = true ) {
 		$output = apply_filters( $this->plugin_name . '_plugin_extension_start', $output );
 
 		if ( $echo )
-			echo $output;
+			echo wp_kses_post( $output );
 		else
 			return $output;
 	}

admin/includes/fonts_face.php

@@ -623,9 +623,9 @@ public function generate_font_css( $option, $em = '1.2' ) {
         $font_css = '';
 
 		if ( !@$option['style'] && !@$option['size'] && !@$option['color'] )
-			$font_css = 'font-family: '.stripslashes($option["face"]).' !important;';
+			$font_css = 'font-family: '.stripslashes( str_replace( array( '"', "'" ), '', $option["face"] ) ).' !important;';
 		else
-			$font_css = 'font:'.$option['style'].' '.$option['size'].'/' . $line_height . ' ' .stripslashes($option['face']).' !important; color:'.$option['color'].' !important;';
+			$font_css = 'font:'.$option['style'].' '.$option['size'].'/' . $line_height . ' ' .stripslashes( str_replace( array( '"', "'" ), '', $option['face'] ) ).' !important; color:'.$option['color'].' !important;';
 
 		return apply_filters( $this->plugin_name . '_generate_font_css', $font_css, $option, $em );
 	}

readme.txt

@@ -3,7 +3,7 @@ Contributors: a3rev, a3rev Software, nguyencongtuan
 Tags: a3 lazy load, Lazy Loading, image lazy load, lazyload
 Requires at least: 5.6
 Tested up to: 6.0
-Stable tag: 2.6.0
+Stable tag: 2.6.1
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
 
@@ -202,6 +202,10 @@ Filter tags to add to class name of theme to exclude lazy load on images or vide
 
 == Changelog ==
 
+= 2.6.1 - 2022/10/04 =
+* This maintenance release has a security vulnerability patch, please run this update.
+* Security – This release has a patch for a security vulnerability identified by Wordfence scan
+
 = 2.6.0 - 2022/07/20 =
 * This release adds the option to switch OFF WordPress Core Lazy Load.
 * Feature - Add Option to completely disable WordPress Core Lazy Load.
@@ -614,6 +618,9 @@ Filter tags to add to class name of theme to exclude lazy load on images or vide
 
 == Upgrade Notice ==
 
+= 2.6.1 =
+This maintenance release has a security vulnerability patch, please run this update.
+
 = 2.6.0 =
 This release adds the option to switch OFF WordPress Core Lazy Load.