diff --git a/README.md b/README.md index b68610e..f9d825f 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ Transcoding services for ANY WordPress website. Convert audio/video files of any
-* **Contributors:** [rtcamp](http://profiles.wordpress.org/rtcamp), [mangeshp](http://profiles.wordpress.org/mangeshp), [chandrapatel](http://profiles.wordpress.org/chandrapatel), [manishsongirkar36](http://profiles.wordpress.org/manishsongirkar36), [bhargavbhandari90](http://profiles.wordpress.org/bhargavbhandari90), [kiranpotphode](http://profiles.wordpress.org/kiranpotphode), [thrijith](http://profiles.wordpress.org/thrijith), [devikvekariya](http://profiles.wordpress.org/devikvekariya), [sagarnasit](http://profiles.wordpress.org/sagarnasit), [sudhiryadav](http://profiles.wordpress.org/sudhiryadav), [sid177](https://profiles.wordpress.org/sid177/), [pooja1210](https://profiles.wordpress.org/pooja1210/), [vaishu.agola27](https://profiles.wordpress.org/vaishuagola27/), [ravatparmar](https://profiles.wordpress.org/ravatparmar/), [tremidkhar](https://profiles.wordpress.org/tremidkhar/), [utsavladani](https://profiles.wordpress.org/utsavladani/), [vishalkakadiya](https://profiles.wordpress.org/vishalkakadiya/), [pavanpatil1](https://profiles.wordpress.org/pavanpatil1/), [akrocks](https://profiles.wordpress.org/akrocks/), [hrithikd](https://profiles.wordpress.org/hrithikd/) +* **Contributors:** [rtcamp](http://profiles.wordpress.org/rtcamp), [mangeshp](http://profiles.wordpress.org/mangeshp), [chandrapatel](http://profiles.wordpress.org/chandrapatel), [manishsongirkar36](http://profiles.wordpress.org/manishsongirkar36), [bhargavbhandari90](http://profiles.wordpress.org/bhargavbhandari90), [kiranpotphode](http://profiles.wordpress.org/kiranpotphode), [thrijith](http://profiles.wordpress.org/thrijith), [devikvekariya](http://profiles.wordpress.org/devikvekariya), [sagarnasit](http://profiles.wordpress.org/sagarnasit), [sudhiryadav](http://profiles.wordpress.org/sudhiryadav), [sid177](https://profiles.wordpress.org/sid177/), [pooja1210](https://profiles.wordpress.org/pooja1210/), [vaishu.agola27](https://profiles.wordpress.org/vaishuagola27/), [ravatparmar](https://profiles.wordpress.org/ravatparmar/), [tremidkhar](https://profiles.wordpress.org/tremidkhar/), [utsavladani](https://profiles.wordpress.org/utsavladani/), [vishalkakadiya](https://profiles.wordpress.org/vishalkakadiya/), [pavanpatil1](https://profiles.wordpress.org/pavanpatil1/), [akrocks](https://profiles.wordpress.org/akrocks/), [hrithikd](https://profiles.wordpress.org/hrithikd/), [sohampate1](https://profiles.wordpress.org/sohampate1/) * **License:** [GPL v2 or later]( http://www.gnu.org/licenses/gpl-2.0.html) @@ -65,6 +65,13 @@ Read [Documentation](https://rtmedia.io/docs/transcoder/?utm_source=readme&utm_m 1. Transcoder Settings ## Changelog ## +#### 1.3.6 [February 27, 2024] #### + +* FIXED + + * Enhance security checks. + + #### 1.3.5 [October 20, 2023] #### * FIXED diff --git a/admin/js/rt-transcoder-admin.js b/admin/js/rt-transcoder-admin.js index e173247..2ca9061 100644 --- a/admin/js/rt-transcoder-admin.js +++ b/admin/js/rt-transcoder-admin.js @@ -45,7 +45,8 @@ if ( confirm( rt_transcoder_script.disable_encoding ) ) { var data = { - action: 'rt_disable_transcoding' + action: 'rt_disable_transcoding', + rt_transcoder_nonce: rt_transcoder_script.security_nonce_for_disabling_encoding }; if ( $( this ).next( 'img' ).length === 0 ) { @@ -84,7 +85,8 @@ if ( confirm( rt_transcoder_script.enable_encoding ) ) { var data = { - action: 'rt_enable_transcoding' + action: 'rt_enable_transcoding', + rt_transcoder_nonce: rt_transcoder_script.security_nonce_for_enabling_encoding }; if ( $( this ).next( 'img' ).length === 0 ) { diff --git a/admin/js/rt-transcoder-admin.min.js b/admin/js/rt-transcoder-admin.min.js index e07a19a..b107490 100644 --- a/admin/js/rt-transcoder-admin.min.js +++ b/admin/js/rt-transcoder-admin.min.js @@ -3,4 +3,4 @@ * @package Transcoder */ -!function(a){a(document).ready(function(){a(document).on("click","#api-key-submit",function(b){if(!document.getElementById("new-api-key").value){a("#api-key-error").remove();var c=a("",{id:"api-key-error",class:"error"});a("h1:first").after(c.html(a("").text(rt_transcoder_script.error_empty_key))),b.preventDefault()}}),a(document).on("click","#disable-transcoding",function(b){if(b.preventDefault(),confirm(rt_transcoder_script.disable_encoding)){var c={action:"rt_disable_transcoding"};0===a(this).next("img").length&&a(this).after(a("").attr("src",rt_transcoder_script.loader_image).addClass("rtt-loader")),a.post(ajaxurl,c,function(b){b&&(a("#rtt-settings_updated").length>0&&(a("#rtt-settings_updated p").text(b),a("#rtt-settings_updated").show()),a("#disable-transcoding").next("img").remove(),a("#disable-transcoding").hide(),a("#enable-transcoding").css("display","inline"))})}}),a(document).on("click","#enable-transcoding",function(b){if(b.preventDefault(),confirm(rt_transcoder_script.enable_encoding)){var c={action:"rt_enable_transcoding"};0===a(this).next("img").length&&a(this).after(a("").attr("src",rt_transcoder_script.loader_image).addClass("rtt-loader")),a.post(ajaxurl,c,function(b){b?(a("#rtt-settings_updated").length>0&&(a("#rtt-settings_updated p").text(b),a("#rtt-settings_updated").show()),a("#enable-transcoding").next("img").remove(),a("#enable-transcoding").hide(),a("#disable-transcoding").css("display","inline")):a("#settings-error-transcoding-disabled").remove()})}})})}(jQuery); \ No newline at end of file +!function(a){a(document).ready(function(){a(document).on("click","#api-key-submit",function(b){if(!document.getElementById("new-api-key").value){a("#api-key-error").remove();var c=a("",{id:"api-key-error",class:"error"});a("h1:first").after(c.html(a("").text(rt_transcoder_script.error_empty_key))),b.preventDefault()}}),a(document).on("click","#disable-transcoding",function(b){if(b.preventDefault(),confirm(rt_transcoder_script.disable_encoding)){var c={action:"rt_disable_transcoding",rt_transcoder_nonce:rt_transcoder_script.security_nonce_for_disabling_encoding};0===a(this).next("img").length&&a(this).after(a("").attr("src",rt_transcoder_script.loader_image).addClass("rtt-loader")),a.post(ajaxurl,c,function(b){b&&(a("#rtt-settings_updated").length>0&&(a("#rtt-settings_updated p").text(b),a("#rtt-settings_updated").show()),a("#disable-transcoding").next("img").remove(),a("#disable-transcoding").hide(),a("#enable-transcoding").css("display","inline"))})}}),a(document).on("click","#enable-transcoding",function(b){if(b.preventDefault(),confirm(rt_transcoder_script.enable_encoding)){var c={action:"rt_enable_transcoding",rt_transcoder_nonce:rt_transcoder_script.security_nonce_for_enabling_encoding};0===a(this).next("img").length&&a(this).after(a("").attr("src",rt_transcoder_script.loader_image).addClass("rtt-loader")),a.post(ajaxurl,c,function(b){b?(a("#rtt-settings_updated").length>0&&(a("#rtt-settings_updated p").text(b),a("#rtt-settings_updated").show()),a("#enable-transcoding").next("img").remove(),a("#enable-transcoding").hide(),a("#disable-transcoding").css("display","inline")):a("#settings-error-transcoding-disabled").remove()})}})})}(jQuery); \ No newline at end of file diff --git a/admin/rt-transcoder-admin.php b/admin/rt-transcoder-admin.php index 7e8d718..570d759 100755 --- a/admin/rt-transcoder-admin.php +++ b/admin/rt-transcoder-admin.php @@ -196,12 +196,14 @@ public function enqueue_scripts_styles() { wp_register_script( 'rt-transcoder-main', RT_TRANSCODER_URL . 'admin/js/rt-transcoder-admin' . $suffix . '.js', array( 'jquery' ), RT_TRANSCODER_VERSION, true ); $localize_script_data = array( - 'admin_url' => esc_url( admin_url() ), - 'loader_image' => esc_url( admin_url( 'images/loading.gif' ) ), - 'disable_encoding' => esc_html__( 'Are you sure you want to disable the transcoding service?', 'transcoder' ), - 'enable_encoding' => esc_html__( 'Are you sure you want to enable the transcoding service?', 'transcoder' ), - 'something_went_wrong' => esc_html__( 'Something went wrong. Please ', 'transcoder' ) . '' . esc_html__( 'refresh', 'transcoder' ) . '' . esc_html__( ' page.', 'transcoder' ), - 'error_empty_key' => esc_html__( 'Please enter the license key.', 'transcoder' ), + 'admin_url' => esc_url( admin_url() ), + 'loader_image' => esc_url( admin_url( 'images/loading.gif' ) ), + 'disable_encoding' => esc_html__( 'Are you sure you want to disable the transcoding service?', 'transcoder' ), + 'enable_encoding' => esc_html__( 'Are you sure you want to enable the transcoding service?', 'transcoder' ), + 'something_went_wrong' => esc_html__( 'Something went wrong. Please ', 'transcoder' ) . '' . esc_html__( 'refresh', 'transcoder' ) . '' . esc_html__( ' page.', 'transcoder' ), + 'error_empty_key' => esc_html__( 'Please enter the license key.', 'transcoder' ), + 'security_nonce_for_enabling_encoding' => wp_create_nonce( 'rt_enable_transcoding' ), + 'security_nonce_for_disabling_encoding' => wp_create_nonce( 'rt_disable_transcoding' ), ); wp_localize_script( 'rt-transcoder-main', 'rt_transcoder_script', $localize_script_data ); diff --git a/admin/rt-transcoder-handler.php b/admin/rt-transcoder-handler.php index 27bed37..c155f2e 100755 --- a/admin/rt-transcoder-handler.php +++ b/admin/rt-transcoder-handler.php @@ -180,8 +180,6 @@ public function __construct( $no_init = false ) { } add_action( 'init', array( $this, 'handle_callback' ), 20 ); - add_action( 'wp_ajax_rt_hide_transcoding_notice', array( $this, 'hide_transcoding_notice' ), 1 ); - add_action( 'wp_ajax_rt_enter_api_key', array( $this, 'enter_api_key' ), 1 ); add_action( 'wp_ajax_rt_disable_transcoding', array( $this, 'disable_transcoding' ), 1 ); add_action( 'wp_ajax_rt_enable_transcoding', array( $this, 'enable_transcoding' ), 1 ); add_action( 'add_attachment', array( $this, 'after_upload_pdf' ) ); @@ -1263,39 +1261,13 @@ public function handle_callback() { do_action( 'rtt_handle_callback_finished', $attachment_id, $job_id ); } - /** - * Hide notices. - * - * @since 1.0.0 - */ - public function hide_transcoding_notice() { - update_site_option( 'rt-transcoding-service-notice', true ); - update_site_option( 'rt-transcoding-expansion-notice', true ); - echo true; - die(); - } - - /** - * Check whether key is entered or not. - * - * @since 1.0 - */ - public function enter_api_key() { - $apikey = transcoder_filter_input( INPUT_GET, 'apikey', FILTER_SANITIZE_FULL_SPECIAL_CHARS ); - if ( ! empty( $apikey ) ) { - echo wp_json_encode( array( 'apikey' => $apikey ) ); - } else { - echo wp_json_encode( array( 'error' => esc_html__( 'Please enter the license key.', 'transcoder' ) ) ); - } - die(); - } - /** * Disable transcoding. * * @since 1.0.0 */ public function disable_transcoding() { + check_ajax_referer( 'rt_disable_transcoding', 'rt_transcoder_nonce', true ); update_site_option( 'rt-transcoding-api-key', '' ); esc_html_e( 'Transcoding disabled successfully.', 'transcoder' ); die(); @@ -1307,6 +1279,7 @@ public function disable_transcoding() { * @since 1.0.0 */ public function enable_transcoding() { + check_ajax_referer( 'rt_enable_transcoding', 'rt_transcoder_nonce', true ); update_site_option( 'rt-transcoding-api-key', $this->stored_api_key ); esc_html_e( 'Transcoding enabled successfully.', 'transcoder' ); die(); diff --git a/languages/transcoder.pot b/languages/transcoder.pot index 486cc8a..8b6433d 100644 --- a/languages/transcoder.pot +++ b/languages/transcoder.pot @@ -1,14 +1,14 @@ -# Copyright (C) 2023 +# Copyright (C) 2024 # This file is distributed under the same license as the package. msgid "" msgstr "" "Project-Id-Version: \n" "Report-Msgid-Bugs-To: http://community.rtcamp.com/\n" -"POT-Creation-Date: 2023-10-19 10:13:00+00:00\n" +"POT-Creation-Date: 2024-02-27 06:14:22+00:00\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=utf-8\n" "Content-Transfer-Encoding: 8bit\n" -"PO-Revision-Date: 2023-MO-DA HO:MI+ZONE\n" +"PO-Revision-Date: 2024-MO-DA HO:MI+ZONE\n" "Last-Translator: Transcoder