| 1 |
<?php |
| 2 |
|
| 3 |
if ( function_exists( 'add_action' ) == false ) |
| 4 |
die( "Cheatin' eh?" ); |
| 5 |
|
| 6 |
function pd_video_shortcodes_help($video_form) { |
| 7 |
return ' |
| 8 |
<table class="describe"><tbody> |
| 9 |
<tr> |
| 10 |
<th valign="top" scope="row" class="label"> |
| 11 |
<span class="alignleft"><label for="insertonly[href]">' . __('URL', 'polldaddy') . '</label></span> |
| 12 |
<span class="alignright"><abbr title="required" class="required">*</abbr></span> |
| 13 |
</th> |
| 14 |
<td class="field"><input type="text" id="insertonly[href]" name="insertonly[href]" value="" /></td> |
| 15 |
</tr> |
| 16 |
<tr> |
| 17 |
<td colspan="2"> |
| 18 |
<p>' . __('Paste your YouTube or Google Video URL above, or use the examples below.', 'polldaddy') . '</p> |
| 19 |
<ul class="short-code-list"> |
| 20 |
<li>' . sprintf( |
| 21 |
/* translators: %1$s is the URL to YouTube instructions, %2$s is the example shortcode */ |
| 22 |
__('<a href="%1$s" target="_blank">YouTube instructions</a> %2$s', 'polldaddy'), |
| 23 |
'http://support.wordpress.com/videos/youtube/', |
| 24 |
'<code>[youtube=http://www.youtube.com/watch?v=cXXm696UbKY]</code>' |
| 25 |
) . '</li> |
| 26 |
<li>' . sprintf( |
| 27 |
/* translators: %1$s is the URL to Google Video instructions, %2$s is the example shortcode */ |
| 28 |
__('<a href="%1$s" target="_blank">Google instructions</a> %2$s', 'polldaddy'), |
| 29 |
'http://support.wordpress.com/videos/google-video/', |
| 30 |
'<code>[googlevideo=http://video.google.com/googleplayer.swf?docId=-8459301055248673864]</code>' |
| 31 |
) . '</li> |
| 32 |
<li>' . sprintf( |
| 33 |
/* translators: %1$s is the URL to DailyMotion instructions, %2$s is the example shortcode */ |
| 34 |
__('<a href="%1$s" target="_blank">DailyMotion instructions</a> %2$s', 'polldaddy'), |
| 35 |
'http://support.wordpress.com/videos/dailymotion/', |
| 36 |
'<code>[dailymotion id=5zYRy1JLhuGlP3BGw]</code>' |
| 37 |
) . '</li> |
| 38 |
</ul> |
| 39 |
</td> |
| 40 |
</tr> |
| 41 |
<tr> |
| 42 |
<td></td> |
| 43 |
<td> |
| 44 |
<input type="submit" class="button" name="insertonlybutton" value="' . esc_attr( __('Insert into Poll', 'polldaddy') ) . '" /> |
| 45 |
</td> |
| 46 |
</tr> |
| 47 |
</tbody></table> |
| 48 |
'; |
| 49 |
} |
| 50 |
|
| 51 |
function pd_audio_shortcodes_help($audio_form) { |
| 52 |
return ' |
| 53 |
<table class="describe"><tbody> |
| 54 |
<tr> |
| 55 |
<th valign="top" scope="row" class="label"> |
| 56 |
<span class="alignleft"><label for="insertonly[href]">' . __('Audio File URL', 'polldaddy') . '</label></span> |
| 57 |
<span class="alignright"><abbr title="required" class="required">*</abbr></span> |
| 58 |
</th> |
| 59 |
<td class="field"><input id="insertonly[href]" name="insertonly[href]" value="" type="text" aria-required="true"></td> |
| 60 |
</tr> |
| 61 |
<tr> |
| 62 |
<td></td> |
| 63 |
<td> |
| 64 |
<input type="submit" class="button" name="insertonlybutton" value="' . esc_attr( __('Insert into Poll', 'polldaddy') ) . '" /> |
| 65 |
</td> |
| 66 |
</tr> |
| 67 |
</tbody></table> |
| 68 |
'; |
| 69 |
} |
| 70 |
|
| 71 |
function pd_image_shortcodes_help($image_form) { |
| 72 |
return ' |
| 73 |
<h4 class="media-sub-title">' . __('Insert an image from another web site', 'polldaddy') . '</h4> |
| 74 |
<table class="describe"><tbody> |
| 75 |
<tr> |
| 76 |
<th valign="top" scope="row" class="label" style="width:130px;"> |
| 77 |
<span class="alignleft"><label for="src">' . __('Image URL', 'polldaddy') . '</label></span> |
| 78 |
<span class="alignright"><abbr id="status_img" title="required" class="required">*</abbr></span> |
| 79 |
</th> |
| 80 |
<td class="field"><input id="src" name="src" value="" type="text" aria-required="true" onblur="addExtImage.getImageData()" /></td> |
| 81 |
</tr> |
| 82 |
|
| 83 |
<tr> |
| 84 |
<th valign="top" scope="row" class="label"> |
| 85 |
<span class="alignleft"><label for="title">' . __('Image Title', 'polldaddy') . '</label></span> |
| 86 |
<span class="alignright"><abbr title="required" class="required">*</abbr></span> |
| 87 |
</th> |
| 88 |
<td class="field"><input id="alt" name="alt" value="" type="hidden" /><input id="url" name="url" value="" type="hidden" /><input id="caption" name="caption" value="" type="hidden" /><input id="title" name="title" value="" type="text" aria-required="true" /></td> |
| 89 |
</tr> |
| 90 |
<tr> |
| 91 |
<td></td> |
| 92 |
<td> |
| 93 |
<input type="button" value="' . esc_attr( __('Insert into Poll', 'polldaddy') ) . '" onclick="addExtImage.insert()" style="color: rgb(187, 187, 187);" id="go_button" class="button"> |
| 94 |
</td> |
| 95 |
</tr> |
| 96 |
</tbody></table> |
| 97 |
'; |
| 98 |
} |
| 99 |
|
| 100 |
function polldaddy_popups_init() { |
| 101 |
// Only process polls_media requests |
| 102 |
if ( ! isset( $_REQUEST['polls_media'] ) ) { |
| 103 |
return; |
| 104 |
} |
| 105 |
|
| 106 |
// Security checks for CSRF vulnerability (CVE-2024-43338) |
| 107 |
// Verify admin context |
| 108 |
if ( ! is_admin() ) { |
| 109 |
return; |
| 110 |
} |
| 111 |
|
| 112 |
// Verify user capability |
| 113 |
if ( ! current_user_can( 'edit_posts' ) ) { |
| 114 |
return; |
| 115 |
} |
| 116 |
|
| 117 |
// Verify nonce for CSRF protection |
| 118 |
$nonce_action = get_polls_media_nonce(); |
| 119 |
|
| 120 |
if ( ! isset( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( $_REQUEST['_wpnonce'], $nonce_action ) ) { |
| 121 |
return; |
| 122 |
} |
| 123 |
|
| 124 |
// All security checks passed, add the filters |
| 125 |
add_filter( 'type_url_form_video', 'pd_video_shortcodes_help' ); |
| 126 |
add_filter( 'type_url_form_audio', 'pd_audio_shortcodes_help' ); |
| 127 |
add_filter( 'type_url_form_image', 'pd_image_shortcodes_help' ); |
| 128 |
} |
| 129 |
|
| 130 |
add_action( 'admin_init', 'polldaddy_popups_init' ); |
| 131 |
?> |
| 132 |
|
