From 95dbb97a89b88f89b96195816eb91d9854a625f7 Mon Sep 17 00:00:00 2001 From: "R. Atik Islam" <93109120+R-Atik@users.noreply.github.com> Date: Wed, 2 Aug 2023 03:53:00 -0700 Subject: [PATCH] int 1.4.5 ### Stable - Security Release - Enhanced security measures. - It is crucial to update Educare to version 1.4.5 immediately. - Please see the changelog v1.4.4 for list of previous updates. **Note:** Sometimes users may need to clear browsing data to load the updated script (After update). --- Educare.php | 6 +- assets/js/educare.js | 17 +-- changelog.md | 9 ++ includes/admin/menu.php | 5 + includes/functions.php | 187 ++++++++++++++++++++++----- includes/support/grading-systems.php | 12 +- readme.txt | 11 +- 7 files changed, 190 insertions(+), 57 deletions(-) diff --git a/Educare.php b/Educare.php index 91bb611..a28808f 100644 --- a/Educare.php +++ b/Educare.php @@ -1,7 +1,7 @@ * @copyright GPL-2.0+ * @link http://github.com/fixbd/educare @@ -10,7 +10,7 @@ * Plugin Name: Educare * Plugin URI: http://github.com/fixbd/educare * Description: Educare is a powerful online School/College students & results management system dev by FixBD. This plugin allows you to manage and publish students results. You can easily Add/Edit/Delete Students, Results, Class, Exam, Year Custom field and much more... Also you can import & export unlimited students and results just a click! - * Version: 1.4.4 + * Version: 1.4.5 * Author: FixBD * Author URI: http://github.com/fixbd * License: GPL-2.0+ @@ -44,7 +44,7 @@ // Make it simple! (Define Educare Name-Space) // Plugin Version - define('EDUCARE_VERSION', '1.4.4'); + define('EDUCARE_VERSION', '1.4.5'); // Settings Version define('EDUCARE_SETTINGS_VERSION', '1.0'); define('EDUCARE_RESULTS_VERSION', '1.0'); diff --git a/assets/js/educare.js b/assets/js/educare.js index 962fb22..9892538 100644 --- a/assets/js/educare.js +++ b/assets/js/educare.js @@ -22,7 +22,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_process_content', - nonce: educareAjax.nonce, form_data: form_data, active_menu: active_menu, action_for @@ -65,7 +64,7 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_proccess_grade_system', - nonce: educareAjax.nonce, + nonce: educareNonce.edit_grade_system, class: class_name }, beforeSend:function(event) { @@ -96,7 +95,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_save_grade_system', - nonce: educareAjax.nonce, form_data: form_data, update_grade_rules: true }, @@ -165,7 +163,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_proccess_promote_students', - nonce: educareAjax.nonce, form_data: form_data }, beforeSend: function(data) { @@ -302,7 +299,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_process_marks', - nonce: educareAjax.nonce, form_data: form_data, action_for: action_for }, @@ -338,7 +334,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_process_marks', - nonce: educareAjax.nonce, form_data: form_data, action_for }, @@ -466,7 +461,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_class', - nonce: educareAjax.nonce, class: class_name, id: id_no, form_data: form_data, @@ -609,7 +603,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_class', - nonce: educareAjax.nonce, class: class_name, id: id_no, form_data: form_data, @@ -662,7 +655,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_get_data_from_students', - nonce: educareAjax.nonce, form_data: form_data }, beforeSend: function(data) { @@ -767,7 +759,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_process_content', - nonce: educareAjax.nonce, form_data: form_data, action_for }, @@ -852,7 +843,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_process_content', - nonce: educareAjax.nonce, form_data: form_data, action_for }, @@ -888,7 +878,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_process_content', - nonce: educareAjax.nonce, form_data: form_data, action_for }, @@ -917,7 +906,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_process_content', - nonce: educareAjax.nonce, form_data: form_data, action_for }, @@ -949,7 +937,6 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_process_content', - nonce: educareAjax.nonce, form_data: form_data, action_for }, @@ -993,7 +980,7 @@ jQuery(document).ready(function($) { type: 'POST', data: { action: 'educare_demo', - nonce: educareAjax.nonce, + nonce: educareNonce.demo_nonce, Class: class_name, total_demo: total_demo, data_for: students, diff --git a/changelog.md b/changelog.md index 3111df8..9c38e78 100644 --- a/changelog.md +++ b/changelog.md @@ -1,3 +1,12 @@ +## [1.4.5] + +### Stable - Security Release +- Enhanced security measures. +- It is crucial to update Educare to version 1.4.5 immediately. +- Please see the changelog v1.4.4 for list of previous updates. + +**Note:** Sometimes users may need to clear browsing data to load the updated script (After update). + ## [1.4.4] ### Stable - Security Release diff --git a/includes/admin/menu.php b/includes/admin/menu.php index 0611929..e51ab7c 100644 --- a/includes/admin/menu.php +++ b/includes/admin/menu.php @@ -146,6 +146,11 @@ function educare_enqueue_styles( $hook) { 'photos' => educare_check_status('photos'), 'group_subject' => educare_check_status('group_subject'), ) ); + + wp_localize_script( 'educare-admin', 'educareNonce', array( + 'demo_nonce' => wp_create_nonce( 'educare_demo_nonce' ), + 'edit_grade_system' => wp_create_nonce( 'edit_grade_system' ), + ) ); } diff --git a/includes/functions.php b/includes/functions.php index 5be476b..3734612 100644 --- a/includes/functions.php +++ b/includes/functions.php @@ -1356,9 +1356,11 @@ function notice($msgs, $print = null, $add_students = null) { // Security nonce for form requests. $nonce = wp_create_nonce( 'educare_form_nonce' ); + $crud_nonce = wp_create_nonce( 'educare_crud_data' ); $forms = "
+ @@ -1389,7 +1391,7 @@ function educare_insert_data($add_students = null) { } // Verify the nonce to ensure the request originated from the expected source - educare_verify_nonce(); + educare_verify_nonce('educare_crud_data'); global $wpdb, $table_name, $requred_fields; @@ -1510,7 +1512,12 @@ function educare_insert_data($add_students = null) { } // Verify the nonce to ensure the request originated from the expected source - educare_verify_nonce(); + if (isset($_POST['delete_nonce'])) { + educare_verify_nonce('educare_crud_data', 'delete_nonce'); + } else { + educare_verify_nonce('educare_crud_data'); + } + $query = $wpdb->prepare("DELETE FROM $table_name WHERE id = %d", $id); $wpdb->query($query); @@ -1617,7 +1624,7 @@ function educare_get_results_forms($print, $add_students = null) { '; if (isset($_POST['edit']) or isset($_POST['edit_by_id']) or $import_from) { @@ -2249,6 +2256,16 @@ function educare_get_tab_management($action_for) { + '; + echo ''; + echo ''; + ?> +
@@ -2287,7 +2304,7 @@ function educare_get_tab_management($action_for) { } // Verify the nonce to ensure the request originated from the expected source - educare_verify_nonce(); + educare_verify_nonce('educare_default_photos'); $attachment_id = sanitize_text_field($_POST['educare_attachment_id']); update_option( 'educare_files_selector', absint($attachment_id) ); @@ -2297,7 +2314,7 @@ function educare_get_tab_management($action_for) {
'; educare_files_selector('set_default', ''); @@ -2497,7 +2514,7 @@ function educare_all_view($students = null, $on_load = null) { '; ?> @@ -2613,7 +2630,7 @@ function educare_all_view($students = null, $on_load = null) { // Check request if (!isset($_POST['on_load'])) { // Verify the nonce to ensure the request originated from the expected source - educare_verify_nonce(); + educare_verify_nonce('educare_view_results'); } $table = sanitize_text_field($_POST['table']); @@ -2811,10 +2828,12 @@ function educare_all_view($students = null, $on_load = null) {
- + + '; @@ -2829,7 +2848,7 @@ function educare_all_view($students = null, $on_load = null) { '; + echo ''; ?> @@ -2881,7 +2900,7 @@ function educare_all_view($students = null, $on_load = null) { '; ?> @@ -3097,15 +3116,15 @@ function educare_class() { exit; } - // Verify nonce to ensure the request is secure - educare_verify_nonce(); - // Get data from the AJAX request $class = sanitize_text_field($_POST['class']); $add_students = sanitize_text_field($_POST['add_students']); $id = sanitize_text_field($_POST['id']); wp_parse_str($_POST['form_data'], $_POST); + // Verify nonce to ensure the request is secure + educare_verify_nonce('educare_crud_data'); + // Check if the 'Group' field exists in the POST data if (key_exists('Group', $_POST)) { $Group = sanitize_text_field($_POST['Group']); @@ -3164,7 +3183,7 @@ function educare_demo($demo_key = null) { // Verify the nonce to ensure the request originated from the expected source if (!$demo_key) { // because, this is for import proccess, we have allready define nonce there - educare_verify_nonce(); + educare_verify_nonce('educare_demo_nonce'); } @@ -3391,7 +3410,7 @@ function educare_import_result($data_for = null) { } // Verify the nonce to ensure the request originated from the expected source - educare_verify_nonce(); + educare_verify_nonce('educare_import_data'); // Begin import results function global $wpdb; @@ -3544,7 +3563,7 @@ function educare_import_result($data_for = null) { '; ?> @@ -3826,7 +3845,11 @@ function educare_process_settings($list) { if ($in_list == 'Extra_field') { $check = strtolower(substr(strstr($check, ' '), 1)); } - + + // Create nonce for update or remove forms + $update_nonce = wp_create_nonce( 'educare_update_'.esc_attr($in_list) ); + $remove_nonce = wp_create_nonce( 'remove_'.esc_attr($in_list) ); + if ($in_list == 'Extra_field') { $data_type = strtok($target, ' '); $Target = substr(strstr($target, ' '), 1); @@ -3860,12 +3883,17 @@ function educare_process_settings($list) {
- + " class="educare_button remove" value=""> + '; + echo ''; + ?> +

@@ -3887,11 +3915,16 @@ function educare_process_settings($list) { Edit - :
- + " class="educare_button remove" value=""> + + '; + echo ''; + ?>

@@ -4434,6 +4467,12 @@ function educare_settings_form() { echo ''; echo ''; } + + $update_settings = wp_create_nonce( 'educare_update_settings_status' ); + $reset_settings = wp_create_nonce( 'educare_reset_default_settings' ); + + echo ''; + echo ''; ?> @@ -4600,6 +4639,14 @@ function educare_process_class($list) { + + '; + echo ''; + ?>

@@ -4622,6 +4669,12 @@ function educare_process_class($list) { + '; + ?> +

@@ -4884,8 +4937,22 @@ function educare_setting_subject($list, $form = null) {
- -
+ + + + + + + + '; + echo ''; + ?> + + @@ -4914,6 +4981,7 @@ function educare_setting_subject($list, $form = null) {
+ @@ -4923,6 +4991,14 @@ function educare_setting_subject($list, $form = null) { " class="button error proccess_" value=""> + + '; + echo ''; + ?>
@@ -4979,6 +5055,11 @@ function educare_setting_subject($list, $form = null) { + '; + ?> + @@ -4996,6 +5077,11 @@ function educare_setting_subject($list, $form = null) {
+ + '; + ?> @@ -5079,6 +5165,14 @@ function educare_content($list, $form = null) { " class="button error remove" value=""> + + '; + echo ''; + ?> @@ -5118,6 +5212,9 @@ function educare_content($list, $form = null) { } if ($form) { + // Create nonce for this form + $nonce = wp_create_nonce( 'educare_add_'.esc_attr($list) ); + if ($list == 'Extra_field') { ?>
@@ -5141,6 +5238,11 @@ function educare_content($list, $form = null) { + '; + ?> +
@@ -5154,6 +5256,11 @@ function educare_content($list, $form = null) { : + + '; + ?> @@ -5211,9 +5318,6 @@ function educare_process_content() { exit; } - // verify is request comming from valid sources - educare_verify_nonce(); - $action_for = sanitize_text_field($_POST['action_for']); // $currenTab = sanitize_text_field($_POST['currenTab']); @@ -5226,6 +5330,9 @@ function educare_process_content() { wp_parse_str($_POST['form_data'], $_POST); $_POST[$action_for] = $action_for; $_POST['active_menu'] = $active_menu; + + // verify is request comming from valid sources + educare_verify_nonce($action_for, $action_for.'_nonce'); if (isset($_POST['educare_process_Class'])) { educare_process_class('Class'); @@ -5609,7 +5716,7 @@ function educare_get_students_list($Class = null, $Year = null) {
@@ -5618,6 +5725,12 @@ function educare_get_students_list($Class = null, $Year = null) {
Mark not visible when print?
Please, fill up students marks and save. Then, select Students List and print marksheet (Save then Print).
'; + echo ''; } ?> @@ -6203,9 +6316,6 @@ function educare_process_marks() { if (!current_user_can('manage_options')) { exit; } - - // Verify the nonce to ensure the request originated from the expected source - educare_verify_nonce(); // Sanitize and parse necessary data from the AJAX request $action_for = sanitize_text_field($_POST['action_for']); @@ -6214,6 +6324,9 @@ function educare_process_marks() { $_POST[$action_for] = $action_for; $_POST['data_for'] = $data_for; + // Verify the nonce to ensure the request originated from the expected source + educare_verify_nonce($action_for, $action_for.'_nonce'); + // Sanitize other data for marks processing $Class = sanitize_text_field($_POST['Class']); $Group = sanitize_text_field($_POST['Group']); @@ -6628,7 +6741,7 @@ function educare_promote_students() { } // Verify the nonce to ensure the request originated from the expected source - educare_verify_nonce(); + educare_verify_nonce('educare_promote_nonce'); $requred = array ( 'Class', @@ -6860,7 +6973,7 @@ function educare_promote_students() {
'; ?> @@ -6969,6 +7082,7 @@ function educare_enqueue_ajax_script() { * * @param string $nonce (optional) A unique string representing the action or context for which the nonce was generated. * Default is 'educare_form_nonce' if not provided. + * @param string $nonce_field for specific nonce field * * @return void The function displays an error message if the nonce is missing or invalid. Execution terminates * immediately after displaying the error, preventing further processing of the form submission. @@ -6980,9 +7094,12 @@ function educare_enqueue_ajax_script() { * Your form submission processing code comes here * ... */ -function educare_verify_nonce($nonce = 'educare_form_nonce') { +function educare_verify_nonce($nonce = 'educare_form_nonce', $nonce_field = 'nonce') { + $nonce = sanitize_text_field( $nonce ); + $nonce_field = sanitize_text_field( $nonce_field ); + // check_ajax_referer( 'educare_form_nonce', 'nonce' ); - if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], $nonce ) ) { + if ( ! isset( $_POST[$nonce_field] ) || ! wp_verify_nonce( $_POST[$nonce_field], $nonce ) ) { // Nonce is not valid, handle error or unauthorized access echo educare_show_msg('Invalid Request', false); die; diff --git a/includes/support/grading-systems.php b/includes/support/grading-systems.php index 97ce944..2ca2721 100644 --- a/includes/support/grading-systems.php +++ b/includes/support/grading-systems.php @@ -175,7 +175,7 @@ function educare_proccess_grade_system() { exit; } - educare_verify_nonce(); + educare_verify_nonce('edit_grade_system'); $rules = sanitize_text_field($_POST['class']); @@ -243,6 +243,12 @@ function educare_add_grade_system($rules = null, $point = null, $grade = null) { ' class='addButton educare_button' title='Add more field'>
+ + '; + ?>
@@ -277,10 +283,10 @@ function educare_save_grade_system() { exit; } - educare_verify_nonce(); - // Parse/get forms data wp_parse_str($_POST['form_data'], $_POST); + // Verify the nonce to ensure the request originated from the expected source + educare_verify_nonce('update_grade_rules'); // Save data educare_save_results_system(); diff --git a/readme.txt b/readme.txt index a7718ec..535033b 100644 --- a/readme.txt +++ b/readme.txt @@ -6,7 +6,7 @@ Tags: Result management, Academic, Results, Students, Education, Requires at least: 3.8 Tested up to: 6.2.2 Requires PHP: 5.2.4 -Stable tag: 1.4.4 +Stable tag: 1.4.5 License: GPLv2 or later License URI: http://www.gnu.org/licenses/gpl-2.0.html @@ -397,6 +397,15 @@ Please: You only need to give us 5 stars! == Changelog == += [1.4.5] = + += Stable - Security Release = +* Enhanced security measures. +* It is crucial to update Educare to version 1.4.5 immediately. +* Please see the changelog v1.4.4 for list of previous updates. + +**Note:** Sometimes users may need to clear browsing data to load the updated script (After update). + = [1.4.4] = = Stable - Security Release =