Skip to content

Commit

Permalink
Security patch
Browse files Browse the repository at this point in the history
  • Loading branch information
sc0ttkclark committed May 7, 2024
1 parent a45cf6f commit a525c34
Show file tree
Hide file tree
Showing 7 changed files with 45 additions and 5 deletions.
9 changes: 9 additions & 0 deletions classes/Pods.php
Original file line number Diff line number Diff line change
Expand Up @@ -4051,6 +4051,15 @@ public function form( $params = null, $label = null, $thank_you = null ) {
$fields_only = $params['fields_only'];
$output_type = $params['output_type'];

// Sanitize thank_you for security.
if ( ! empty( $thank_you ) ) {
// Additional sanitization.
$thank_you = sanitize_text_field( $thank_you );

// Fallback to '' so that the logic below can kick in if the thank you URL was not safe.
$thank_you = pods_enforce_safe_url( $thank_you, '' );
}

if ( empty( $output_type ) ) {
$output_type = 'div';
}
Expand Down
20 changes: 20 additions & 0 deletions includes/data.php
Original file line number Diff line number Diff line change
Expand Up @@ -2998,3 +2998,23 @@ function pods_objects_keyed_by_name( $objects ) {

return $new_list;
}

/**
* Enforce a URL as safe and fallback to another URL if it is not safe.
*
* @since 3.1.4.1
*
* @param string $url The URL to enforce as safe.
* @param string|null $fallback_url The fallback URL to use if the URL is not valid.
*
* @return string The safe URL or the fallback URL if that was not valid.
*/
function pods_enforce_safe_url( string $url, ?string $fallback_url = null ) {
$url = wp_sanitize_redirect( $url );

if ( null === $fallback_url ) {
$fallback_url = pods_current_url();
}

return wp_validate_redirect( $url, $fallback_url );
}
4 changes: 2 additions & 2 deletions init.php
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
* Plugin Name: Pods - Custom Content Types and Fields
* Plugin URI: https://pods.io/
* Description: Pods is a framework for creating, managing, and deploying customized content types and fields
* Version: 3.1.4
* Version: 3.1.4.1
* Author: Pods Framework Team
* Author URI: https://pods.io/about/
* Text Domain: pods
Expand Down Expand Up @@ -43,7 +43,7 @@
add_action( 'init', 'pods_deactivate_pods_ui' );
} else {
// Current version.
define( 'PODS_VERSION', '3.1.4' );
define( 'PODS_VERSION', '3.1.4.1' );

// Current database version, this is the last version the database changed.
define( 'PODS_DB_VERSION', '2.3.5' );
Expand Down
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "pods",
"version": "3.1.4",
"version": "3.1.4.1",
"description": "Pods is a development framework for creating, extending, managing, and deploying customized content types in WordPress.",
"author": "Pods Foundation, Inc",
"homepage": "https://pods.io/",
Expand Down
8 changes: 7 additions & 1 deletion readme.txt
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Tags: pods, custom post types, custom taxonomies, content types, custom fields
Requires at least: 6.0
Tested up to: 6.5
Requires PHP: 7.2
Stable tag: 3.1.4
Stable tag: 3.1.4.1
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

Expand Down Expand Up @@ -181,6 +181,12 @@ Pods really wouldn't be where it is without all the contributions from our [dono

== Changelog ==

= 3.1.4.1 - May 8th, 2024 =

*Security Release*

* Security hardening: Enforce safe URLs for Pods form submission confirmation page URLs. Props to the wesley (wcraft) / Wordfence for responsibly reporting this. (@sc0ttkclark)

= 3.1.4 - February 28th, 2024 =

* Fixed: Defaults now show correctly for checkbox groups in the Edit Field modals. (@sc0ttkclark)
Expand Down
5 changes: 5 additions & 0 deletions src/Pods/Blocks/API.php

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion ui/front/form.php
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@
action=""
method="post"
class="pods-submittable pods-form pods-form-front pods-form-pod-<?php echo esc_attr( $pod_name ); ?> pods-submittable-ajax"
data-location="<?php echo esc_attr( $thank_you ); ?>"
data-location="<?php echo esc_attr( pods_enforce_safe_url( $thank_you ) ); ?>"
id="pods-form-<?php echo esc_attr( $pod_name . '-' . $counter ); ?>"
data-pods-pod-name="<?php echo esc_attr( $pod_name ); ?>"
data-pods-item-id="<?php echo esc_attr( $id ); ?>"
Expand Down

0 comments on commit a525c34

Please sign in to comment.