| @@ -1,20 +1,24 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /* |
| 3 | 3 | Plugin Name: iframe |
| 4 | 4 | Plugin URI: http://wordpress.org/plugins/iframe/ |
| 5 | -Description: [iframe src="http://www.youtube.com/embed/4qsGTXLnmKs" width="100%" height="500"] shortcode | |
| 6 | -Version: 4.3 | |
| 5 | +Description: [iframe src="http://www.youtube.com/embed/mOOClonYKmc" width="100%" height="500"] shortcode | |
| 6 | +Version: 4.6 | |
| 7 | 7 | Author: webvitaly |
| 8 | 8 | Author URI: http://web-profile.net/wordpress/plugins/ |
| 9 | 9 | License: GPLv3 |
| 10 | 10 | */ |
| 11 | 11 | |
| 12 | -define('IFRAME_PLUGIN_VERSION', '4.3'); | |
| 12 | +if ( ! defined( 'ABSPATH' ) ) { // Avoid direct calls to this file and prevent full path disclosure | |
| 13 | + exit; | |
| 14 | +} | |
| 13 | 15 | |
| 16 | +define('IFRAME_PLUGIN_VERSION', '4.6'); | |
| 17 | + | |
| 14 | 18 | function iframe_plugin_add_shortcode_cb( $atts ) { |
| 15 | 19 | $defaults = array( |
| 16 | - 'src' => 'http://www.youtube.com/embed/4qsGTXLnmKs', | |
| 20 | + 'src' => 'http://www.youtube.com/embed/mOOClonYKmc', | |
| 17 | 21 | 'width' => '100%', |
| 18 | 22 | 'height' => '500', |
| 19 | 23 | 'scrolling' => 'yes', |
| 20 | 24 | 'class' => 'iframe-class', |
| @@ -29,9 +33,13 @@ | ||
| 29 | 33 | |
| 30 | 34 | $html = "\n".'<!-- iframe plugin v.'.IFRAME_PLUGIN_VERSION.' wordpress.org/plugins/iframe/ -->'."\n"; |
| 31 | 35 | $html .= '<iframe'; |
| 32 | 36 | foreach( $atts as $attr => $value ) { |
| 37 | + if ( strtolower($attr) == 'src' ) { // sanitize url | |
| 38 | + $value = esc_url( $value ); | |
| 39 | + } | |
| 33 | 40 | if ( strtolower($attr) != 'same_height_as' AND strtolower($attr) != 'onload' |
| 41 | + AND strtolower($attr) != 'onmouseover' AND strtolower($attr) != 'onfocus' | |
| 34 | 42 | AND strtolower($attr) != 'onpageshow' AND strtolower($attr) != 'onclick') { // remove some attributes |
| 35 | 43 | if ( $value != '' ) { // adding all attributes |
| 36 | 44 | $html .= ' ' . esc_attr( $attr ) . '="' . esc_attr( $value ) . '"'; |
| 37 | 45 | } else { // adding empty attributes |
| @@ -61,12 +69,11 @@ | ||
| 61 | 69 | |
| 62 | 70 | function iframe_plugin_row_meta_cb( $links, $file ) { |
| 63 | 71 | if ( $file == plugin_basename( __FILE__ ) ) { |
| 64 | 72 | $row_meta = array( |
| 65 | - 'support' => '<a href="http://web-profile.net/wordpress/plugins/iframe/" target="_blank"><span class="dashicons dashicons-editor-help"></span> ' . __( 'Iframe', 'iframe' ) . '</a>', | |
| 66 | - 'donate' => '<a href="http://web-profile.net/donate/" target="_blank"><span class="dashicons dashicons-heart"></span> ' . __( 'Donate', 'iframe' ) . '</a>', | |
| 67 | - 'iframe_pro' => '<a href="http://codecanyon.net/item/advanced-iframe-pro/5344999?ref=webvitalii" target="_blank"><span class="dashicons dashicons-star-filled"></span> ' . __( 'Advanced iFrame Pro', 'iframe' ) . '</a>', | |
| 68 | - 'pro' => '<a href="http://codecanyon.net/item/silver-bullet-pro/15171769?ref=webvitalii" target="_blank" title="Speedup and protect WordPress in a smart way"><span class="dashicons dashicons-star-filled"></span> ' . __( 'Silver Bullet Pro', 'iframe' ) . '</a>' | |
| 73 | + 'support' => '<a href="http://web-profile.net/wordpress/plugins/iframe/" target="_blank">' . __( 'Iframe', 'iframe' ) . '</a>', | |
| 74 | + 'donate' => '<a href="http://web-profile.net/donate/" target="_blank">' . __( 'Donate', 'iframe' ) . '</a>', | |
| 75 | + 'pro' => '<a href="https://1.envato.market/Ym5aq" target="_blank">' . __( 'Advanced iFrame Pro', 'iframe' ) . '</a>' | |
| 69 | 76 | ); |
| 70 | 77 | $links = array_merge( $links, $row_meta ); |
| 71 | 78 | } |
| 72 | 79 | return (array) $links; |
