diff --git a/core/logging.php b/core/logging.php
index 566b237..2c9fb08 100644
--- a/core/logging.php
+++ b/core/logging.php
@@ -100,7 +100,7 @@ function do_log($msg, $severity = 3, $do_backtrace = false, $nest = 0) {
echo "$log_prefix:$msg";
echo ($this->eolprint) ? "\n" : "
";
} else {
- if (!filter_input(INPUT_SERVER, 'REMOTE_ADDR') || $this->remoteip != filter_input(INPUT_SERVER, 'REMOTE_ADDR')) {
+ if (!transposh_utils::get_clean_server_var( 'REMOTE_ADDR') || $this->remoteip != transposh_utils::get_clean_server_var( 'REMOTE_ADDR')) {
return;
}
if ((is_array($msg) || is_object($msg)) && $this->show_caller) {
diff --git a/core/utils.php b/core/utils.php
index 993a393..6841aa7 100644
--- a/core/utils.php
+++ b/core/utils.php
@@ -444,7 +444,7 @@ public static function display_flag($path, $flag, $language, $css = false) {
public static function prefered_language($available_languages, $default_lang = "auto", $http_accept_language = "auto") {
// if $http_accept_language was left out, read it from the HTTP-Header
if ($http_accept_language == "auto") {
- $http_accept_language = filter_input(INPUT_SERVER, 'HTTP_ACCEPT_LANGUAGE');
+ $http_accept_language = transposh_utils::get_clean_server_var( 'HTTP_ACCEPT_LANGUAGE');
}
// standard for HTTP_ACCEPT_LANGUAGE is defined under
@@ -521,7 +521,7 @@ public static function language_from_country($available_languages, $country, $de
}
public static function is_bot() {
- return preg_match("#(bot|yandex|validator|google|jeeves|spider|crawler|slurp)#si", filter_input(INPUT_SERVER, 'HTTP_USER_AGENT'));
+ return preg_match("#(bot|yandex|validator|google|jeeves|spider|crawler|slurp)#si", transposh_utils::get_clean_server_var( 'HTTP_USER_AGENT'));
}
public static function allow_cors() {
@@ -552,5 +552,17 @@ public static function wordpress_user_by_by($by) {
}
return $by;
}
+ /**
+ * Return a server var, because of the 15 years old filter_input bug.
+ * @param String $var
+ * @return type
+ */
+ public static function get_clean_server_var($var) {
+ $ret = filter_input(INPUT_SERVER, $var);
+ if (!$ret && isset($_SERVER[$var])) {
+ $ret = $_SERVER[$var];
+ }
+ return $ret;
+ }
}
diff --git a/readme.txt b/readme.txt
index 24c1d55..47c9de5 100644
--- a/readme.txt
+++ b/readme.txt
@@ -3,7 +3,7 @@ Contributors: oferwald
Donate link: http://transposh.org/donate/
Tags: translation, translate, i18n, widget, filter, buddypress, bilingual, multilingual, transposh, language, crowdsourcing, google translate, bing translate, context, wiki, RTL, Hebrew, Spanish, French, Russian, English, Arabic, Portuguese
Requires at least: 5.8
-Tested up to: 5.9
+Tested up to: 6.0.2
Stable tag: %VERSION%
Transposh adds best of breed translation support to wordpress, 117 languages are automatically translated and can be manually corrected with ease.
@@ -122,6 +122,7 @@ This version allows sorting of languages within the widget
* French - [Michel Chaussée](tajimoko.com)
== Changelog ==
+ * Fix for filter_input input_server fcgi bug
= 2022/09/21 - 1.0.9.2 =
* Fix for some bugs added by CSRF protection, including working translate all
* Remove old references to non working places
diff --git a/transposh.php b/transposh.php
index c6b947a..db2f008 100644
--- a/transposh.php
+++ b/transposh.php
@@ -153,7 +153,7 @@ function __construct() {
$this->transposh_plugin_dir = plugin_dir_path(__FILE__);
if ($this->options->debug_enable)
- tp_logger('Transposh object created: ' . filter_input(INPUT_SERVER, 'REQUEST_URI'), 3);
+ tp_logger('Transposh object created: ' . transposh_utils::get_clean_server_var('REQUEST_URI'), 3);
$this->transposh_plugin_basename = plugin_basename(__FILE__);
//Register some functions into wordpress
@@ -256,7 +256,7 @@ function __construct() {
//
// FUTURE add_action('update-custom_transposh', array(&$this, 'update'));
// CHECK TODO!!!!!!!!!!!!
- $this->tgl = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'REQUEST_URI'), $this->home_url);
+ $this->tgl = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('REQUEST_URI'), $this->home_url);
if (!$this->options->is_active_language($this->tgl)) {
$this->tgl = '';
}
@@ -320,7 +320,7 @@ function get_clean_url() {
return $this->clean_url;
}
//remove any language identifier and find the "clean" url, used for posting and calculating urls if needed
- $this->clean_url = transposh_utils::cleanup_url(filter_input(INPUT_SERVER, 'REQUEST_URI'), $this->home_url, true);
+ $this->clean_url = transposh_utils::cleanup_url(transposh_utils::get_clean_server_var('REQUEST_URI'), $this->home_url, true);
// we need this if we are using url translations
if ($this->options->enable_url_translate) {
$this->clean_url = transposh_utils::get_original_url($this->clean_url, '', $this->target_language, array($this->database, 'fetch_original'));
@@ -381,7 +381,7 @@ function process_page($buffer) { //php7?
$start_time = microtime(TRUE);
// Refrain from touching the administrative interface and important pages
- if ($this->is_special_page(filter_input(INPUT_SERVER, 'REQUEST_URI')) && !$this->attempt_json) {
+ if ($this->is_special_page(transposh_utils::get_clean_server_var('REQUEST_URI')) && !$this->attempt_json) {
tp_logger("Skipping translation for admin pages", 3);
} elseif ($bad_content) {
tp_logger("Seems like content we should not handle");
@@ -409,7 +409,7 @@ function process_page($buffer) { //php7?
}
}
- tp_logger("Translating " . filter_input(INPUT_SERVER, 'REQUEST_URI') . " to: {$this->target_language} for: " . filter_input(INPUT_SERVER, 'REMOTE_ADDR'), 1);
+ tp_logger("Translating " . transposh_utils::get_clean_server_var('REQUEST_URI') . " to: {$this->target_language} for: " . transposh_utils::get_clean_server_var('REMOTE_ADDR'), 1);
//translate the entire page
$parse = new tp_parser();
@@ -427,7 +427,7 @@ function process_page($buffer) { //php7?
$parse->allow_ad = $this->options->widget_remove_logo;
//** FULLSTOP
// TODO - check this!
- if (stripos(filter_input(INPUT_SERVER, 'REQUEST_URI'), '/feed/') !== FALSE) {
+ if (stripos(transposh_utils::get_clean_server_var('REQUEST_URI'), '/feed/') !== FALSE) {
tp_logger("in rss feed!", 2);
$parse->is_auto_translate = false;
$parse->is_edit_mode = false;
@@ -452,7 +452,7 @@ function process_page($buffer) { //php7?
* Once processing is completed the buffer will go into the translation process.
*/
function on_init() {
- tp_logger('init ' . filter_input(INPUT_SERVER, 'REQUEST_URI'), 4);
+ tp_logger('init ' . transposh_utils::get_clean_server_var('REQUEST_URI'), 4);
// the wp_rewrite is not available earlier so we can only set the enable_permalinks here
if (is_object($GLOBALS['wp_rewrite'])) {
@@ -464,47 +464,47 @@ function on_init() {
// this is an ajax special case, currently crafted and tested on buddy press, lets hope this won't make hell break loose.
// it basically sets language based on referred when accessing wp-load.php (which is the way bp does ajax)
- tp_logger(substr(filter_input(INPUT_SERVER, 'SCRIPT_FILENAME'), -11), 5);
- if (substr(filter_input(INPUT_SERVER, 'SCRIPT_FILENAME'), -11) == 'wp-load.php') {
- $this->target_language = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url);
+ tp_logger(substr(transposh_utils::get_clean_server_var('SCRIPT_FILENAME'), -11), 5);
+ if (substr(transposh_utils::get_clean_server_var('SCRIPT_FILENAME'), -11) == 'wp-load.php') {
+ $this->target_language = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url);
$this->attempt_json = true;
}
//buddypress old activity
if (isset($_POST['action']) && $_POST['action'] == 'activity_get_older_updates') {
- $this->target_language = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url);
+ $this->target_language = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url);
$this->attempt_json = true;
}
//alm news
if (isset($_GET['action']) && $_GET['action'] == 'alm_query_posts') {
- $this->target_language = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url);
+ $this->target_language = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url);
}
//woocommerce_update_order_review
if (isset($_POST['action']) && $_POST['action'] == 'woocommerce_update_order_review') {
- $this->target_language = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url);
+ $this->target_language = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url);
$this->attempt_json = true;
}
if (isset($_GET['wc-ajax']) && $_GET['wc-ajax'] == 'update_order_review') {
- $this->target_language = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url);
+ $this->target_language = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url);
$this->attempt_json = true;
}
//woocommerce_get_refreshed_fragments
if (isset($_POST['action']) && $_POST['action'] == 'woocommerce_get_refreshed_fragments') {
- $this->target_language = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url);
+ $this->target_language = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url);
$this->attempt_json = true;
}
if (isset($_POST['action']) && $_POST['action'] == 'woocommerce_add_to_cart') {
- $this->target_language = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url);
+ $this->target_language = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url);
$this->attempt_json = true;
}
- tp_logger(filter_input(INPUT_SERVER, 'REQUEST_URI'), 5);
- if (strpos(filter_input(INPUT_SERVER, 'REQUEST_URI'), '/wpv-ajax-pagination/') === true) {
+ tp_logger(transposh_utils::get_clean_server_var('REQUEST_URI'), 5);
+ if (strpos(transposh_utils::get_clean_server_var('REQUEST_URI'), '/wpv-ajax-pagination/') === true) {
tp_logger('wpv pagination', 5);
- $this->target_language = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url);
+ $this->target_language = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url);
}
// load translation files for transposh
@@ -627,24 +627,24 @@ function on_parse_request($wp) {
// and this is not a special page or one that is refered by our site
// bots can skip this altogether
if (($this->options->enable_detect_redirect || $this->options->widget_allow_set_deflang || $this->options->enable_geoip_redirect) &&
- !($this->is_special_page(filter_input(INPUT_SERVER, 'REQUEST_URI')) || (filter_input(INPUT_SERVER, 'HTTP_REFERER') != null && strpos(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url) !== false)) &&
+ !($this->is_special_page(transposh_utils::get_clean_server_var('REQUEST_URI')) || (transposh_utils::get_clean_server_var('HTTP_REFERER') != null && strpos(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url) !== false)) &&
!(transposh_utils::is_bot())) {
// we are starting a session if needed
if (!session_id()) {
session_start();
}
// no redirections if we already redirected in this session or we suspect cyclic redirections
- if (!isset($_SESSION['TR_REDIRECTED']) && !(filter_input(INPUT_SERVER, 'HTTP_REFERER') == filter_input(INPUT_SERVER, 'REQUEST_URI'))) {
+ if (!isset($_SESSION['TR_REDIRECTED']) && !(transposh_utils::get_clean_server_var('HTTP_REFERER') == transposh_utils::get_clean_server_var('REQUEST_URI'))) {
tp_logger('session redirection never happened (yet)', 2);
// we redirect once per session
$_SESSION['TR_REDIRECTED'] = true;
// redirect according to stored lng cookie, and than according to detection
if (isset($_COOKIE['TR_LNG']) && $this->options->widget_allow_set_deflang) {
if ($_COOKIE['TR_LNG'] != $this->target_language) {
- $url = transposh_utils::rewrite_url_lang_param(filter_input(INPUT_SERVER, "REQUEST_URI"), $this->home_url, $this->enable_permalinks_rewrite, $_COOKIE['TR_LNG'], $this->edit_mode);
+ $url = transposh_utils::rewrite_url_lang_param(transposh_utils::get_clean_server_var("REQUEST_URI"), $this->home_url, $this->enable_permalinks_rewrite, $_COOKIE['TR_LNG'], $this->edit_mode);
if ($this->options->is_default_language($_COOKIE['TR_LNG']))
//TODO - fix wrt translation
- $url = transposh_utils::cleanup_url(filter_input(INPUT_SERVER, "REQUEST_URI"), $this->home_url);
+ $url = transposh_utils::cleanup_url(transposh_utils::get_clean_server_var("REQUEST_URI"), $this->home_url);
tp_logger("redirected to $url because of cookie", 2);
$this->tp_redirect($url);
exit;
@@ -659,10 +659,10 @@ function on_parse_request($wp) {
$bestlang = transposh_utils::language_from_country(explode(',', $this->options->viewable_languages), $country, $this->options->default_language);
}
if ($bestlang && $bestlang != $this->target_language) {
- $url = transposh_utils::rewrite_url_lang_param(filter_input(INPUT_SERVER, 'REQUEST_URI'), $this->home_url, $this->enable_permalinks_rewrite, $bestlang, $this->edit_mode);
+ $url = transposh_utils::rewrite_url_lang_param(transposh_utils::get_clean_server_var('REQUEST_URI'), $this->home_url, $this->enable_permalinks_rewrite, $bestlang, $this->edit_mode);
if ($this->options->is_default_language($bestlang))
//TODO - fix wrt translation
- $url = transposh_utils::cleanup_url(filter_input(INPUT_SERVER, 'REQUEST_URI'), $this->home_url);
+ $url = transposh_utils::cleanup_url(transposh_utils::get_clean_server_var('REQUEST_URI'), $this->home_url);
tp_logger("redirected to $url because of bestlang", 2);
$this->tp_redirect($url);
exit;
@@ -679,8 +679,8 @@ function on_parse_request($wp) {
add_action('pre_get_posts', array(&$this, 'pre_post_search'));
add_action('posts_where_request', array(&$this, 'posts_where_request'));
}
- if (transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url) && !transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'REQUEST_URI'), $this->home_url)) {
- $this->tp_redirect(transposh_utils::rewrite_url_lang_param(filter_input(INPUT_SERVER, "REQUEST_URI"), $this->home_url, $this->enable_permalinks_rewrite, transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url), false)); //."&stop=y");
+ if (transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url) && !transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('REQUEST_URI'), $this->home_url)) {
+ $this->tp_redirect(transposh_utils::rewrite_url_lang_param(transposh_utils::get_clean_server_var("REQUEST_URI"), $this->home_url, $this->enable_permalinks_rewrite, transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url), false)); //."&stop=y");
exit;
}
}
@@ -688,7 +688,7 @@ function on_parse_request($wp) {
$this->edit_mode = true;
// redirect bots away from edit pages to avoid double indexing
if (transposh_utils::is_bot()) {
- $this->tp_redirect(transposh_utils::rewrite_url_lang_param(filter_input(INPUT_SERVER, "REQUEST_URI"), $this->home_url, $this->enable_permalinks_rewrite, transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, "REQUEST_URI"), $this->home_url), false), 301);
+ $this->tp_redirect(transposh_utils::rewrite_url_lang_param(transposh_utils::get_clean_server_var("REQUEST_URI"), $this->home_url, $this->enable_permalinks_rewrite, transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var("REQUEST_URI"), $this->home_url), false), 301);
exit;
}
} else {
@@ -938,7 +938,7 @@ function add_rel_alternate() {
echo 'home_url);
if ($lang && !$this->got_request) {
tp_logger('Trying to find original url');
@@ -1334,7 +1334,7 @@ function request_filter($query) {
* @return string
*/
function transposh_gettext_filter($translation, $orig, $domain) {
- if ($this->is_special_page(filter_input(INPUT_SERVER, 'REQUEST_URI')) || ($this->options->is_default_language($this->tgl) && !$this->options->enable_default_translate)) {
+ if ($this->is_special_page(transposh_utils::get_clean_server_var('REQUEST_URI')) || ($this->options->is_default_language($this->tgl) && !$this->options->enable_default_translate)) {
return $translation;
}
tp_logger("($translation, $orig, $domain)", 5);
@@ -1356,7 +1356,7 @@ function transposh_gettext_filter($translation, $orig, $domain) {
* @return string
*/
function transposh_ngettext_filter($translation, $single, $plural, $domain) {
- if ($this->is_special_page(filter_input(INPUT_SERVER, 'REQUEST_URI')) || ($this->options->is_default_language($this->tgl) && !$this->options->enable_default_translate))
+ if ($this->is_special_page(transposh_utils::get_clean_server_var('REQUEST_URI')) || ($this->options->is_default_language($this->tgl) && !$this->options->enable_default_translate))
return $translation;
tp_logger("($translation, $single, $plural, $domain)", 4);
if (in_array($domain, transposh_consts::$ignored_po_domains))
@@ -1374,7 +1374,7 @@ function transposh_ngettext_filter($translation, $single, $plural, $domain) {
* @return string
*/
function transposh_locale_filter($locale) {
- $lang = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'REQUEST_URI'), $this->home_url);
+ $lang = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('REQUEST_URI'), $this->home_url);
if (!$this->options->is_active_language($lang)) {
$lang = '';
}
@@ -1473,8 +1473,8 @@ function on_ajax_nopriv_proxy() {
// Check requester IP to be allowed
$ips = json_decode($this->options->superproxy_ips);
- if (!in_array(filter_input(INPUT_SERVER, 'REMOTE_ADDR'), $ips)) {
- $errstr = "Error: 503: Unauthorized " . filter_input(INPUT_SERVER, 'REMOTE_ADDR');
+ if (!in_array(transposh_utils::get_clean_server_var('REMOTE_ADDR'), $ips)) {
+ $errstr = "Error: 503: Unauthorized " . transposh_utils::get_clean_server_var('REMOTE_ADDR');
tp_logger($errstr);
die($errstr);
}
@@ -1507,7 +1507,7 @@ function on_ajax_nopriv_proxy() {
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
// Handle POST method
- if (filter_input(INPUT_SERVER, 'REQUEST_METHOD') === 'POST') {
+ if (transposh_utils::get_clean_server_var('REQUEST_METHOD') === 'POST') {
//tp_logger($_POST);
curl_setopt($ch, CURLOPT_POST, true);
foreach ($_POST as $key => $value) {
@@ -1682,7 +1682,7 @@ function get_yandex_translation($tl, $sl, $q) {
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
//must set agent for google to respond with utf-8
- $UA = filter_input(INPUT_SERVER, "HTTP_USER_AGENT", FILTER_DEFAULT);
+ $UA = transposh_utils::get_clean_server_var("HTTP_USER_AGENT", FILTER_DEFAULT);
// tp_logger($UA,1);
curl_setopt($ch, CURLOPT_USERAGENT, $UA);
$output = curl_exec($ch);
@@ -1888,7 +1888,7 @@ function get_google_translation($tl, $sl, $q) {
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
//must set agent for google to respond with utf-8
- $UA = filter_input(INPUT_SERVER, "HTTP_USER_AGENT", FILTER_DEFAULT);
+ $UA = transposh_utils::get_clean_server_var("HTTP_USER_AGENT");
tp_logger($UA, 1);
curl_setopt($ch, CURLOPT_USERAGENT, $UA);
curl_setopt($ch, CURLOPT_POST, true);
@@ -1900,7 +1900,7 @@ function get_google_translation($tl, $sl, $q) {
//if the attempt is 2 or more, we skip ipv6 and use an alternative user agent
if ($attempt > 1) {
curl_setopt($ch, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
- curl_setopt($ch, CURLOPT_USERAGENT, filter_input(INPUT_SERVER, 'HTTP_USER_AGENT'));
+ curl_setopt($ch, CURLOPT_USERAGENT, transposh_utils::get_clean_server_var('HTTP_USER_AGENT'));
}
$output = curl_exec($ch);
$info = curl_getinfo($ch);
@@ -2085,17 +2085,17 @@ function on_ajax_nopriv_tp_trans_alts() {
// set the cookie with ajax, no redirect needed
function on_ajax_nopriv_tp_cookie() {
- setcookie('TR_LNG', transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url), time() + 90 * 24 * 60 * 60, COOKIEPATH, COOKIE_DOMAIN);
- tp_logger('Cookie ' . transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url));
+ setcookie('TR_LNG', transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url), time() + 90 * 24 * 60 * 60, COOKIEPATH, COOKIE_DOMAIN);
+ tp_logger('Cookie ' . transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url));
die();
}
// Set our cookie and return (if no js works - or we are in the default language)
function on_ajax_nopriv_tp_cookie_bck() {
global $my_transposh_plugin;
- setcookie('TR_LNG', transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url), time() + 90 * 24 * 60 * 60, COOKIEPATH, COOKIE_DOMAIN);
- if (filter_input(INPUT_SERVER, 'HTTP_REFERER')) {
- $this->tp_redirect(filter_input(INPUT_SERVER, 'HTTP_REFERER'));
+ setcookie('TR_LNG', transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url), time() + 90 * 24 * 60 * 60, COOKIEPATH, COOKIE_DOMAIN);
+ if (transposh_utils::get_clean_server_var('HTTP_REFERER')) {
+ $this->tp_redirect(transposh_utils::get_clean_server_var('HTTP_REFERER'));
} else {
$this->tp_redirect($my_transposh_plugin->home_url);
}
diff --git a/wp/transposh_3rdparty.php b/wp/transposh_3rdparty.php
index 15735a8..b53220f 100644
--- a/wp/transposh_3rdparty.php
+++ b/wp/transposh_3rdparty.php
@@ -74,7 +74,7 @@ function add_analyticator_tracking() {
function super_cache_invalidate() {
//Now, we are actually using the referrer and not the request, with some precautions
// check server['']
- $GLOBALS['wp_cache_request_uri'] = substr(filter_input(INPUT_SERVER, 'HTTP_REFERER'), stripos(filter_input(INPUT_SERVER, 'HTTP_REFERER'), filter_input(INPUT_SERVER, 'HTTP_HOST')) + strlen(filter_input(INPUT_SERVER, '') . filter_input(INPUT_SERVER, 'HTTP_HOST')));
+ $GLOBALS['wp_cache_request_uri'] = substr(transposh_utils::get_clean_server_var('HTTP_REFERER'), stripos(transposh_utils::get_clean_server_var('HTTP_REFERER'), transposh_utils::get_clean_server_var('HTTP_HOST')) + strlen(transposh_utils::get_clean_server_var('HTTP_HOST')));
$GLOBALS['wp_cache_request_uri'] = preg_replace('/[ <>\'\"\r\n\t\(\)]/', '', str_replace('/index.php', '/', str_replace('..', '', preg_replace("/(\?.*)?$/", '', $GLOBALS['wp_cache_request_uri']))));
// get some supercache variables
extract(wp_super_cache_init());
@@ -111,8 +111,8 @@ function super_cache_invalidate() {
}
function w3tc_invalidate() {
- tp_logger("W3TC invalidate:" . filter_input(INPUT_SERVER, 'HTTP_REFERER'));
- $id = url_to_postid(filter_input(INPUT_SERVER, 'HTTP_REFERER'));
+ tp_logger("W3TC invalidate:" . transposh_utils::get_clean_server_var('HTTP_REFERER'));
+ $id = url_to_postid(transposh_utils::get_clean_server_var('HTTP_REFERER'));
if (is_numeric($id)) {
tp_logger("W3TC invalidate post id: $id");
w3tc_pgcache_flush_post($id);
@@ -141,7 +141,7 @@ function bp_uri_filter($uri) {
* @param type $url
*/
function bbp_get_search_results_url($url) {
- $lang = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->home_url);
+ $lang = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->home_url);
$href = transposh_utils::rewrite_url_lang_param($url, $this->transposh->home_url, $this->transposh->enable_permalinks_rewrite, $lang, false);
return $href;
}
@@ -154,8 +154,8 @@ function bp_activity_after_save($params) {
// we don't need to modify our own activity stream
if ($params->type == 'new_translation')
return;
- if (transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->transposh->home_url))
- bp_activity_update_meta($params->id, 'tp_language', transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->transposh->home_url));
+ if (transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->transposh->home_url))
+ bp_activity_update_meta($params->id, 'tp_language', transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->transposh->home_url));
}
/**
@@ -335,7 +335,7 @@ function add_yoast_transposh_urls($yoast_url) {
}
function woo_uri_filter($url) {
- $lang = transposh_utils::get_language_from_url(filter_input(INPUT_SERVER, 'HTTP_REFERER'), $this->transposh->home_url);
+ $lang = transposh_utils::get_language_from_url(transposh_utils::get_clean_server_var('HTTP_REFERER'), $this->transposh->home_url);
tp_logger('altering woo url to:' . transposh_utils::rewrite_url_lang_param($url, $this->transposh->home_url, $this->transposh->enable_permalinks_rewrite, $lang, $this->transposh->edit_mode));
return transposh_utils::rewrite_url_lang_param($url, $this->transposh->home_url, $this->transposh->enable_permalinks_rewrite, $lang, $this->transposh->edit_mode);
}
diff --git a/wp/transposh_admin.php b/wp/transposh_admin.php
index 630c646..2ef69f4 100644
--- a/wp/transposh_admin.php
+++ b/wp/transposh_admin.php
@@ -770,7 +770,7 @@ function tp_advanced() {
4 => __('Information', TRANSPOSH_TEXT_DOMAIN),
5 => __('Debug', TRANSPOSH_TEXT_DOMAIN),
));
- $this->textinput($this->transposh->options->debug_remoteip_o, '', sprintf(__('Remote debug IP (Your current IP is %s)', TRANSPOSH_TEXT_DOMAIN), filter_input(INPUT_SERVER, 'REMOTE_ADDR')));
+ $this->textinput($this->transposh->options->debug_remoteip_o, '', sprintf(__('Remote debug IP (Your current IP is %s)', TRANSPOSH_TEXT_DOMAIN), transposh_utils::get_clean_server_var('REMOTE_ADDR')));
$this->sectionstop();
}
diff --git a/wp/transposh_db.php b/wp/transposh_db.php
index fab5990..727c4aa 100644
--- a/wp/transposh_db.php
+++ b/wp/transposh_db.php
@@ -373,7 +373,7 @@ function update_translation($by = "") {
}
if (!$by && !($all_editable &&
($this->transposh->is_translator() || ($source > 0 && $this->transposh->options->enable_autotranslate)))) {
- tp_logger("Unauthorized translation attempt " . filter_input(INPUT_SERVER,'REMOTE_ADDR'), 1);
+ tp_logger("Unauthorized translation attempt " . transposh_utils::get_clean_server_var('REMOTE_ADDR'), 1);
header("HTTP/1.0 401 Unauthorized translation");
exit;
}
@@ -387,7 +387,7 @@ function update_translation($by = "") {
$loguser = get_current_user_id();
}
if (!$loguser) {
- $loguser = filter_input(INPUT_SERVER,'REMOTE_ADDR');
+ $loguser = transposh_utils::get_clean_server_var('REMOTE_ADDR');
}
// reset values (for good code style)
@@ -530,7 +530,7 @@ function get_translation_history($token, $lang) {
// Check permissions, first the lanugage must be on the edit list. Then either the user
// is a translator or automatic translation if it is enabled.
if (!($this->transposh->options->is_active_language($lang) && $this->transposh->is_translator())) {
- tp_logger("Unauthorized history request " . filter_input(INPUT_SERVER,'REMOTE_ADDR'), 1);
+ tp_logger("Unauthorized history request " . transposh_utils::get_clean_server_var('REMOTE_ADDR'), 1);
header('HTTP/1.0 401 Unauthorized history');
exit;
}
@@ -557,7 +557,7 @@ function get_translation_history($token, $lang) {
$rows = $GLOBALS['wpdb']->get_results($query);
for ($i = 0; $i < count($rows); $i++) {
- if (($rows[$i]->translated_by == filter_input(INPUT_SERVER,'REMOTE_ADDR') && $rows[$i]->source == '0') || (is_user_logged_in() && current_user_can(TRANSLATOR)) || current_user_can('manage_options')) {
+ if (($rows[$i]->translated_by == transposh_utils::get_clean_server_var('REMOTE_ADDR') && $rows[$i]->source == '0') || (is_user_logged_in() && current_user_can(TRANSLATOR)) || current_user_can('manage_options')) {
$rows[$i]->can_delete = true;
}
}
@@ -607,7 +607,7 @@ function del_translation_history($token, $langp, $timestampp) {
tp_logger($query, 3);
// We only delete if we found something to delete and it is allowed to delete it (user either did that - by ip, has the translator role or is an admin)
- if (($inmaintable || $inlogtable) && (($rows[0]->translated_by == filter_input(INPUT_SERVER,'REMOTE_ADDR') && $rows[0]->source == '0') || (is_user_logged_in() && current_user_can(TRANSLATOR)) || current_user_can('manage_options'))) {
+ if (($inmaintable || $inlogtable) && (($rows[0]->translated_by == transposh_utils::get_clean_server_var('REMOTE_ADDR') && $rows[0]->source == '0') || (is_user_logged_in() && current_user_can(TRANSLATOR)) || current_user_can('manage_options'))) {
// delete faulty record, if in log
if ($inlogtable) {
$query = "DELETE " .
@@ -667,7 +667,7 @@ function get_translation_alt($token) {
// Check permissions
if (!($this->transposh->is_translator())) {
- tp_logger("Unauthorized alt request " . filter_input(INPUT_SERVER,'REMOTE_ADDR'), 1);
+ tp_logger("Unauthorized alt request " . transposh_utils::get_clean_server_var('REMOTE_ADDR'), 1);
header('HTTP/1.0 401 Unauthorized alt request');
exit;
}
@@ -1002,7 +1002,7 @@ function deduplicate_auto() {
$update = "DELETE FROM " . $this->translation_table . " WHERE $delvalues";
tp_logger($update, 3);
$GLOBALS['wpdb']->query($update);
- $this->cache_delete($row->original, $row->lang);
+ $this->cache_delete($row->original, $row->lang);
}
}
}
diff --git a/wp/transposh_editor.php b/wp/transposh_editor.php
index 145ab55..bd9c089 100644
--- a/wp/transposh_editor.php
+++ b/wp/transposh_editor.php
@@ -172,8 +172,12 @@ function prepare_items() {
$orderby = (!empty(filter_input(INPUT_GET, 'orderby', FILTER_SANITIZE_SPECIAL_CHARS)) ) ? filter_input(INPUT_GET, 'orderby', FILTER_SANITIZE_SPECIAL_CHARS) : 'timestamp';
$order = (!empty(filter_input(INPUT_GET, 'order', FILTER_SANITIZE_SPECIAL_CHARS)) ) ? filter_input(INPUT_GET, 'order', FILTER_SANITIZE_SPECIAL_CHARS) : 'desc';
// FIX CVE-2022-25811
- if (!in_array($orderby,['timestamp','lang','original','translated','translated_by'] )) {$orderby = "timestamp";}
- if (!in_array($order,['asc','desc'] )) {$order = "desc";}
+ if (!in_array($orderby, ['timestamp', 'lang', 'original', 'translated', 'translated_by'])) {
+ $orderby = "timestamp";
+ }
+ if (!in_array($order, ['asc', 'desc'])) {
+ $order = "desc";
+ }
//$per_page = 5;
$user = get_current_user_id();
@@ -204,7 +208,7 @@ function render_table() {
echo '