From 402e34ac284d4e1c765e1ac580f5390db179e5c2 Mon Sep 17 00:00:00 2001 From: Amir Hossain Date: Mon, 24 Jun 2024 17:30:36 +0600 Subject: [PATCH 1/2] Fixed the security issues --- admin/notices/admin-notices.php | 3 +- admin/notices/notice.php | 2 +- elements/advanced-tab/template/view.php | 2 +- elements/animation-text/template/view.php | 6 - elements/carousel/template/view.php | 6 +- elements/content-carousel/template/view.php | 258 ++++++++++-------- elements/countdown/template/config.php | 2 +- elements/gallery/template/view.php | 18 +- elements/hover-image/template/view.php | 10 +- elements/image-compare/template/view.php | 4 +- elements/image-feature/template/view.php | 13 +- elements/portfolio/template/view.php | 2 +- elements/pricing-1/template/view.php | 9 +- elements/pricing-2/template/view.php | 4 +- elements/pricing-tab/template/view.php | 30 +- elements/site-social/template/view.php | 2 +- elements/slider-1/template/config.php | 2 - elements/slider-1/template/view.php | 146 +++++----- elements/slider-2/template/view.php | 245 +++++++++-------- elements/slider-3/template/view.php | 53 ++-- elements/social-share-1/template/view.php | 4 +- elements/social-share-2/template/view.php | 7 +- elements/team-1/template/view.php | 6 +- elements/team-2/template/view.php | 4 +- elements/team-3/template/view.php | 7 +- elements/team-4/template/view.php | 6 +- elements/team/template/config.php | 22 ++ elements/team/template/view.php | 76 +----- elements/testimonial/template/config.php | 21 +- .../testimonial/template/layout/default.php | 4 +- .../testimonial/template/layout/layout-1.php | 4 +- .../testimonial/template/layout/layout-2.php | 5 +- .../testimonial/template/layout/layout-3.php | 4 +- .../testimonial/template/layout/layout-4.php | 5 +- .../testimonial/template/layout/layout-5.php | 5 +- elements/testimonial/template/view.php | 10 +- elements/tilt-box/template/view.php | 4 +- includes/dependency.php | 11 +- 38 files changed, 488 insertions(+), 534 deletions(-) diff --git a/admin/notices/admin-notices.php b/admin/notices/admin-notices.php index b7f4836..5b15fab 100644 --- a/admin/notices/admin-notices.php +++ b/admin/notices/admin-notices.php @@ -13,7 +13,8 @@ function wk_td_admin_ads()

- Try ThriveDesk', 'widgetkit'); ?> + + Try ThriveDesk

- + diff --git a/elements/animation-text/template/view.php b/elements/animation-text/template/view.php index a5916dd..2bf7c70 100644 --- a/elements/animation-text/template/view.php +++ b/elements/animation-text/template/view.php @@ -1,12 +1,6 @@ get_settings(); - - ?> - -

- - <?php echo esc_attr($project['project_title']); ?> + + <?php echo esc_attr($project['project_title']); ?> @@ -24,7 +24,7 @@
- +
diff --git a/elements/content-carousel/template/view.php b/elements/content-carousel/template/view.php index 485adca..412201f 100644 --- a/elements/content-carousel/template/view.php +++ b/elements/content-carousel/template/view.php @@ -1,153 +1,179 @@ get_settings(); - $id = $this->get_id(); - $header_tag_arr_for_content_carousel = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'span', 'p']; - $content_carousel_custom_header_tag = esc_html(wp_kses($contents['custom_header_tag'], $header_tag_arr_for_content_carousel)); - $content_carousel_post_header_tag = esc_html(wp_kses($contents['post_header_tag'], $header_tag_arr_for_content_carousel)); - use Elementor\Group_Control_Image_Size; - ?> -
-
- -
    - -
      +
      + +
        + +
          + wk-child-width-1-@l + wk-child-width-1-@m + wk-child-width-1-@s" wk-grid> - - -
        • -
          - - -
          - > - - <?php echo esc_attr($content['content_title']); ?> - - <?php echo esc_attr($content['content_title']); ?> - - -
          - - - + + +
        • +
          + + +
          + > + + <?php echo esc_attr($content['content_title']); ?> + + <?php echo esc_attr($content['content_title']); ?> + + +
          + + +
          - + - - - < class="wk-card-title wk-margin-remove"> - - > - - - - > - - + add_render_attribute('content_title', 'class', 'wk-card-title wk-margin-remove'); + $this->add_inline_editing_attributes('content_title', 'none'); + + $title_html = esc_html($content['content_title']); + if (!empty($content['content_demo_link']['url'])) { + $title_html = 'get_render_attribute_string(' link') . '>' . $title_html . ''; + } + $html = sprintf( + '<%1$s %2$s>%3$s', + Utils::validate_html_tag($settings['custom_header_tag']), + $this->get_render_attribute_string('content_title'), + $title_html + ); + + Utils::print_unescaped_internal_string($html); + } + ?> + +

          - - -
          - > - - <?php echo esc_attr($content['content_title']); ?> - - <?php echo esc_html($content['content_title']); ?> - - -
          - - -
          -
          • - - - 'post', - 'category__in' => $contents['cat_multiple_id'], - 'order' => $contents['items_order'], - 'orderby' => $contents['items_orderby'], - 'post_status' => 'publish', - 'posts_per_page' =>$contents['post_show'], - 'ignore_sticky_posts' => 1 - ); - $content_query = new WP_Query( $content ); - if($content_query->have_posts()): - while($content_query->have_posts()): - $content_query->the_post(); - ?> + + +
          + > + + <?php echo esc_attr($content['content_title']); ?> + + <?php echo esc_html($content['content_title']); ?> + + +
          + + +
      + + + + 'post', + 'category__in' => $contents['cat_multiple_id'], + 'order' => $contents['items_order'], + 'orderby' => $contents['items_orderby'], + 'post_status' => 'publish', + 'posts_per_page' => $contents['post_show'], + 'ignore_sticky_posts' => 1 + ); + $content_query = new WP_Query($content); + if ($content_query->have_posts()) : + while ($content_query->have_posts()) : + $content_query->the_post(); + ?>
    • - - + +
      - - - <?php the_title(); ?> + + + <?php the_title(); ?>
      - - + + - + - - < class="wk-card-title wk-margin-remove"> - - - > - + add_render_attribute('title_word', 'class', 'wk-card-title wk-margin-remove'); + $this->add_inline_editing_attributes('title_word', 'none'); + + $title_html = esc_html($contents['title_word']); + if (!empty($contents['content_demo_link']['url'])) { + $title_html = 'get_render_attribute_string(' link') . '>' . $title_html . ''; + } + $html = sprintf( + '<%1$s %2$s>%3$s', + Utils::validate_html_tag($settings['post_header_tag']), + $this->get_render_attribute_string('title_word'), + $title_html + ); + + Utils::print_unescaped_internal_string($html); + } + ?> +

      - +

      - +
      - - - <?php the_title(); ?> + + + <?php the_title(); ?>
      • - - -
    - - - + - -
- -
    + + + + -
    +
    + +
      + - +

      + \ No newline at end of file diff --git a/elements/countdown/template/config.php b/elements/countdown/template/config.php index 7080e0a..a96472e 100644 --- a/elements/countdown/template/config.php +++ b/elements/countdown/template/config.php @@ -84,7 +84,7 @@ protected function register_controls() { 'picker_options' => [ 'format' => 'Ym/d H:m:s' ], - 'default' => date( "Y/m/d H:m:s", strtotime("+ 1 Day") ), + 'default' => gmdate( "Y/m/d H:m:s", strtotime("+ 1 Day") ), 'description' => esc_html__( 'Date format is (yyyy/mm/dd). Time format is (hh:mm:ss). Example: 2020-01-01 09:30.', 'widgetkit-for-elementor' ) ] ); diff --git a/elements/gallery/template/view.php b/elements/gallery/template/view.php index 91fecf0..5302acd 100644 --- a/elements/gallery/template/view.php +++ b/elements/gallery/template/view.php @@ -58,12 +58,12 @@ - <?php echo esc_attr($gallery['gallery_title']);?> + <?php echo esc_attr($gallery['gallery_title']);?>
      - > + >
      @@ -80,7 +80,7 @@
      - > + > @@ -98,10 +98,10 @@ > - <?php echo esc_attr($gallery['gallery_title']);?> + <?php echo esc_attr($gallery['gallery_title']);?> - <?php echo esc_attr($gallery['gallery_title']);?> + <?php echo esc_attr($gallery['gallery_title']);?> @@ -109,11 +109,11 @@
      - > + > - > + > > @@ -121,7 +121,7 @@ - > + >
      @@ -129,7 +129,7 @@
      - > + >
      diff --git a/elements/hover-image/template/view.php b/elements/hover-image/template/view.php index 8a1ef3a..8731197 100644 --- a/elements/hover-image/template/view.php +++ b/elements/hover-image/template/view.php @@ -1,8 +1,6 @@ get_settings(); ?> - -
      @@ -10,8 +8,8 @@
      - - hover-image + + hover-image
      @@ -27,8 +25,8 @@ - - hover-image + + hover-image
      diff --git a/elements/image-compare/template/view.php b/elements/image-compare/template/view.php index 6ca093d..2400387 100755 --- a/elements/image-compare/template/view.php +++ b/elements/image-compare/template/view.php @@ -6,8 +6,8 @@
      - before - After + before + After
      diff --git a/elements/image-feature/template/view.php b/elements/image-feature/template/view.php index b26debc..4abb75e 100644 --- a/elements/image-feature/template/view.php +++ b/elements/image-feature/template/view.php @@ -1,13 +1,8 @@ get_settings(); - ?> - - -
      @@ -22,7 +17,7 @@ rel="nofollow" - href=""> + href="">

      @@ -36,7 +31,7 @@ - <?php the_title(); ?> + <?php the_title(); ?> @@ -56,7 +51,7 @@ - <?php the_title(); ?> + <?php the_title(); ?> @@ -82,7 +77,7 @@ rel="nofollow" - href=""> + href="">

      diff --git a/elements/portfolio/template/view.php b/elements/portfolio/template/view.php index 329681a..3214424 100644 --- a/elements/portfolio/template/view.php +++ b/elements/portfolio/template/view.php @@ -178,7 +178,7 @@
      + href=""> diff --git a/elements/pricing-1/template/view.php b/elements/pricing-1/template/view.php index dd653df..c99020b 100644 --- a/elements/pricing-1/template/view.php +++ b/elements/pricing-1/template/view.php @@ -50,7 +50,7 @@ - + @@ -61,21 +61,20 @@ - + - + - + -
      diff --git a/elements/pricing-2/template/view.php b/elements/pricing-2/template/view.php index e7f4cd6..349ef07 100644 --- a/elements/pricing-2/template/view.php +++ b/elements/pricing-2/template/view.php @@ -29,7 +29,7 @@
      - <?php echo esc_attr($settings['pricing_2_pricing_title']); ?> + <?php echo esc_attr($settings['pricing_2_pricing_title']); ?>
      @@ -72,7 +72,7 @@
      - +
      diff --git a/elements/pricing-tab/template/view.php b/elements/pricing-tab/template/view.php index 6db73fe..d38e595 100644 --- a/elements/pricing-tab/template/view.php +++ b/elements/pricing-tab/template/view.php @@ -8,7 +8,6 @@ ?>
      - > @@ -30,8 +29,6 @@ - -
      @@ -75,7 +72,7 @@
      - + <img src=" alt=" " />
      @@ -107,7 +104,7 @@
      - +
      @@ -116,9 +113,6 @@
      - - -
      - +
      - <?php echo esc_attr($item['pricing_title_2']); ?> + <?php echo esc_attr($item['pricing_title_2']); ?>
      -
      -

      @@ -178,8 +170,6 @@

      - -
      @@ -187,23 +177,19 @@
      -
      - +
      - -
      @@ -237,11 +223,9 @@
      - -
      - <?php echo esc_attr($item['pricing_title_3']); ?> + <?php echo esc_attr($item['pricing_title_3']); ?>
      @@ -268,7 +252,7 @@
      - +
      diff --git a/elements/site-social/template/view.php b/elements/site-social/template/view.php index a80991c..d15905e 100644 --- a/elements/site-social/template/view.php +++ b/elements/site-social/template/view.php @@ -20,7 +20,7 @@ foreach($site_social_default_list as $site_social): $site_social_hover_color = $site_social["site_social_platform_hover_color"]; ?> - + diff --git a/elements/slider-1/template/config.php b/elements/slider-1/template/config.php index 3c7954d..212d1b7 100644 --- a/elements/slider-1/template/config.php +++ b/elements/slider-1/template/config.php @@ -1,6 +1,4 @@ get_settings(); - $id = $this->get_id(); - - $header_tag_arr_for_slider_1 = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'span', 'p']; - $slider_1_header_tag = esc_html(wp_kses($settings['heading_tag'], $header_tag_arr_for_slider_1)); +// Silence pro 1 +use Elementor\Utils; +$settings = $this->get_settings(); +$id = $this->get_id(); ?> +
      + +
      + \ No newline at end of file diff --git a/elements/slider-2/template/view.php b/elements/slider-2/template/view.php index a43674d..431dad0 100644 --- a/elements/slider-2/template/view.php +++ b/elements/slider-2/template/view.php @@ -1,142 +1,145 @@ get_settings(); - $id = $this->get_id(); - $header_tag_arr_for_slider_2 = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'span', 'p']; - $slider_2_header_tag = esc_html(wp_kses($settings['heading_tag'], $header_tag_arr_for_slider_2)); +use Elementor\Utils; +$settings = $this->get_settings(); +$id = $this->get_id(); ?> - -
      -
      -
      - - + }); + \ No newline at end of file diff --git a/elements/slider-3/template/view.php b/elements/slider-3/template/view.php index fe1c3fb..f4ddc8e 100644 --- a/elements/slider-3/template/view.php +++ b/elements/slider-3/template/view.php @@ -1,48 +1,61 @@ get_settings(); - $header_tag_arr_for_slider_3 = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'span', 'p']; - $slider_3_header_tag = esc_html(wp_kses($settings['heading_tag'], $header_tag_arr_for_slider_3)); + +use Elementor\Utils; +$settings = $this->get_settings(); ?> -
      -
      -
      +
      +
      +
      - - -
      -
      + + +
      +
      - - < class="slide__title">> - + add_render_attribute('tgx_slider_3_title', 'class', 'slide__title'); + + $title_html = esc_html($sliders['tgx_slider_3_title']); + $html = sprintf( + '<%1$s %2$s>%3$s', + Utils::validate_html_tag($settings['heading_tag']), + $this->get_render_attribute_string('tgx_slider_3_title'), + $title_html + ); + + Utils::print_unescaped_internal_string($html); + endif; + ?> - +

      - +
      - +