tmdinosaurcenter
/
tainacan
mirror of https://github.com/tainacan/tainacan
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Sanitizes evil scripts for collections, metadatum and items

This commit is contained in:
Rodrigo de Oliveira 2021-03-11 04:37:37 -03:00
parent 64d45ca4ed
commit de90e70487
4 changed files with 16 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/classes/repositories/class-tainacan-collections.php
View File

@ -304,7 +304,7 @@ class Collections extends Repository {
*/
public function insert( $collection ) {
$this->pre_process( $collection );
$this->handle_parent_order_clone( $collection );
$this->handle_parent_order_clone( $collection );
$new_collection = parent::insert( $collection );

4
src/classes/repositories/class-tainacan-metadata.php
View File

@ -304,7 +304,6 @@ class Metadata extends Repository {
}
}
/**
* fetch metadatum based on ID or WP_Query args
*
@ -676,7 +675,6 @@ class Metadata extends Repository {
);
}
/**
* That function update the core metadatum meta key, in case of changing the collection parent
*
@ -1001,7 +999,6 @@ class Metadata extends Repository {
return false;
}
/**
* create a metadatum entity and insert by an associative array ( attribute => value )
*
@ -1026,7 +1023,6 @@ class Metadata extends Repository {
}
}
/**
* Return all possible values for a metadatum
*

13
src/classes/repositories/class-tainacan-repository.php
View File

@ -136,7 +136,6 @@ abstract class Repository {
do_action( "tainacan-pre-insert-$obj_post_type", $obj );
$map = $this->get_map();
// First iterate through native post properties
foreach ( $map as $prop => $mapped ) {
if ( $mapped['map'] != 'meta' && $mapped['map'] != 'meta_multi' ) {
@ -153,6 +152,9 @@ abstract class Repository {
}
if ( $obj instanceof Entities\Item ) {
$sanitized_title = $this->sanitize_value($obj->get('title'));
$sanitized_desc = $this->sanitize_value($obj->get('description'));
// get collection to determine post type
$collection = $obj->get_collection();
@ -162,10 +164,17 @@ abstract class Repository {
$post_t = $collection->get_db_identifier();
$obj->WP_Post->post_type = $post_t;
$obj->WP_Post->post_title = $sanitized_title;
$obj->WP_Post->post_content = $sanitized_desc;
$obj_post_type = 'tainacan-item';
do_action( "tainacan-pre-insert-$obj_post_type", $obj );
}
if ($obj instanceof Entities\Collection || $obj instanceof Entities\Metadatum) {
$sanitized = $this->sanitize_value($obj->get('name'));
$obj->WP_Post->post_title = $sanitized;
}
$id = wp_insert_post( $obj->WP_Post );
if ($id instanceof \WP_Error || 0 === $id) {
return false;
@ -916,7 +925,7 @@ abstract class Repository {
$allowed_html = wp_kses_allowed_html('post');
unset($allowed_html["a"]);
return wp_kses(trim($content), $allowed_html);
return trim(wp_kses($content, $allowed_html));
}
}

8
tests/test-html-injection.php
View File

@ -40,7 +40,7 @@ class HTML_Injection extends TAINACAN_UnitTestCase
true
);
$collection = $Tainacan_Collections->fetch($collection->get_id());
// $this->assertEquals($collection->get_name(), 'collection name link link2');
$this->assertEquals($collection->get_name(), 'collection name link link2');
$metadatum = $this->tainacan_entity_factory->create_entity(
'metadatum',
@ -53,7 +53,7 @@ class HTML_Injection extends TAINACAN_UnitTestCase
true
);
$metadatum = $Tainacan_Metadata->fetch($metadatum->get_id());
// $this->assertEquals($metadatum->get_name(), 'metadatum name link');
$this->assertEquals($metadatum->get_name(), 'metadatum name link');
$item = $this->tainacan_entity_factory->create_entity(
'item',
@ -65,8 +65,8 @@ class HTML_Injection extends TAINACAN_UnitTestCase
true
);
$item = $Tainacan_Items->fetch($item->get_id());
// $this->assertEquals($item->get_title(), 'title item console.log("XSS")');
// $this->assertEquals($item->get_description(), 'description item');
$this->assertEquals($item->get_title(), 'title item console.log("XSS")');
$this->assertEquals($item->get_description(), 'description item');
// Test metadata
$item_metadata = new \Tainacan\Entities\Item_Metadata_Entity($item, $metadatum);