Merge pull request #29 from brainstormforce/sanitisation

EPS-612: Improved codebase

README.md

@@ -4,7 +4,7 @@
 **Donate link:** https://www.paypal.me/BrainstormForce
 **Requires at least:** 4.4
 **Tags:** beaver builder, page builder plugin, timed content, php based timed content
-**Stable tag:** 1.0.0
+**Stable tag:** 1.0.4
 **Tested up to:** 6.6
 **License:** GPLv2 or later
 **License URI:** http://www.gnu.org/licenses/gpl-2.0.html  

class-bb-timed-content.php

@@ -62,7 +62,7 @@ function admin_notices_function() {
 			echo '<div class="notice notice-error">';
 
 			/* Translators: Timed Content Module For Beaver Builder */
-				echo '<p>' . sprintf( __( 'The <strong>Timed Content Module For Beaver Builder</strong> plugin requires <strong><a href="%s">Beaver Builder</strong></a> plugin installed & activated.', 'timed-content-for-beaver-builder' ) . '</p>', $url );
+				echo '<p>' . sprintf( __( 'The <strong>Timed Content Module For Beaver Builder</strong> plugin requires <strong><a href="%s">Beaver Builder</strong></a> plugin installed & activated.', 'timed-content-for-beaver-builder' ) . '</p>', esc_url( $url ) );
 
 			echo '</div>';
 		}

readme.txt

@@ -3,7 +3,7 @@ Contributors: pratikchaskar
 Donate link: https://www.paypal.me/BrainstormForce
 Requires at least: 4.4
 Tags: beaver builder, page builder plugin, timed content, php based timed content
-Stable tag: 1.0.3
+Stable tag: 1.0.4
 Tested up to: 6.6
 License: GPLv2 or later  
 License URI: http://www.gnu.org/licenses/gpl-2.0.html  
@@ -70,6 +70,9 @@ Props to <a href="http://www.tlc-online.co.uk/" target="_blank">TLC Online</a> f
 
 ## Changelog ##
 
+### 1.0.4 ###
+- Improvement: Improved codebase for improved security.
+
 ### 1.0.3 ###
 - Improvement: Added compatibility to WordPress 6.1 
 

timed-content-for-beaver-builder.php

@@ -3,7 +3,7 @@
  * Plugin Name: Timed Content for Beaver Builder
  * Plugin URI: https://www.brainstormforce.com/
  * Description: Timed Content For Beaver builder plugin allows users to hide content after given time.
- * Version: 1.0.3
+ * Version: 1.0.4
  * Author: Pratik Chaskar
  * Author URI: https://pratikchaskar.com
  * Text Domain: timed-content-for-beaver-builder

timed-content-module/includes/frontend.css.php

@@ -7,7 +7,7 @@
 
 $display = $module->is_expired( $settings );
 if ( FLBuilderModel::is_builder_active() && ! $display ) { ?>
-	.fl-module-timed-content-module.fl-node-<?php echo $id; ?>::before {
+	.fl-module-timed-content-module.fl-node-<?php echo esc_attr($id); ?>::before {
 		content: "Click here to edit Timed Content Module";
 		position: relative;
 		width: 100%;
@@ -18,34 +18,34 @@
 <?php
 } else {
 	if ( ! $display && 'msg' != $settings->expire_content_action ) { ?>
-		.fl-module-timed-content-module.fl-node-<?php echo $id; ?> {
+		.fl-module-timed-content-module.fl-node-<?php echo esc_attr($id); ?> {
 			display : none;
 		}
 <?php }
 }
 
 if ( ! empty( $settings->timed_msg_font ) && 'Default' != $settings->timed_msg_font['family'] ) { ?>
-.fl-node-<?php echo $id; ?> .timed-content-message p {
+.fl-node-<?php echo esc_attr($id); ?> .timed-content-message p {
 	<?php FLBuilderFonts::font_css( $settings->timed_msg_font ); ?>
 }
 <?php } ?>
 
 .fl-node-<?php echo $id; ?> .timed-content-message p {
-	color: #<?php echo $settings->timed_msg_color; ?>;
-	font-size: <?php echo $settings->timed_msg_size; ?>px;
-	line-height: <?php echo $settings->timed_msg_line_height; ?>px;
-	letter-spacing: <?php echo $settings->timed_msg_letter_spacing; ?>px;
+	color: #<?php echo esc_attr( $settings->timed_msg_color ); ?>;
+	font-size: <?php echo esc_attr( $settings->timed_msg_size ); ?>px;
+	line-height: <?php echo esc_attr( $settings->timed_msg_line_height ); ?>px;
+	letter-spacing: <?php echo esc_attr( $settings->timed_msg_letter_spacing ); ?>px;
 }
 
 <?php if ( ! empty( $settings->timed_content_font ) && 'Default' != $settings->timed_content_font['family'] ) { ?>
-.fl-node-<?php echo $id; ?> .timed-content-wrapper {
+.fl-node-<?php echo esc_attr($id); ?> .timed-content-wrapper {
 	<?php FLBuilderFonts::font_css( $settings->timed_content_font ); ?>
 }
 <?php } ?>
 
 .fl-node-<?php echo $id; ?> .timed-content-wrapper {
-	color: #<?php echo $settings->timed_content_color; ?>;
-	font-size: <?php echo $settings->timed_content_size; ?>px;
-	line-height: <?php echo $settings->timed_content_line_height; ?>px;
-	letter-spacing: <?php echo $settings->timed_content_letter_spacing; ?>px;
+	color: #<?php echo esc_attr($settings->timed_content_color); ?>;
+	font-size: <?php echo esc_attr( $settings->timed_content_size ); ?>px;
+	line-height: <?php echo esc_attr( $settings->timed_content_line_height ); ?>px;
+	letter-spacing: <?php echo esc_attr( $settings->timed_content_letter_spacing ); ?>px;
 }

timed-content-module/includes/frontend.php

@@ -14,6 +14,6 @@
 		echo Timed_Content_Helper::get_timed_content( $settings );
 	}
 } elseif ( isset( $settings->expire_content_action ) && 'msg' == $settings->expire_content_action && $is_start ) {
-	echo '<' . $settings->timed_tag_selection . ' class="timed-content-message">' . $settings->expire_message . '</' . $settings->timed_tag_selection . '>';
+	echo '<' . esc_attr($settings->timed_tag_selection) . ' class="timed-content-message">' . wp_kses_post( $settings->expire_message ). '</' . esc_attr($settings->timed_tag_selection) . '>';
 }
 

timed-content-module/timed-content-module.php

@@ -303,6 +303,7 @@ public function is_start( $settings ) {
 							'type'          => 'select',
 							'label'         => __( 'Message Tag', 'timed-content-for-beaver-builder' ),
 							'default'       => 'h4',
+							'sanitize' => array('FLBuilderUtils::esc_tags', 'h4'),
 							'options'       => array(
 								'h1'      => __( 'H1', 'timed-content-for-beaver-builder' ),
 								'h2'      => __( 'H2', 'timed-content-for-beaver-builder' ),