3.8.2

Author: n7studios

readme.txt

@@ -137,6 +137,9 @@ To auto post to Instagram and/or Pinterest, [Upgrade to WordPress to Buffer Pro]
 
 == Changelog ==
 
+= 3.8.2 (2022-06-21) =
+* Fix: Status: Correctly sanitize and escape status textarea field value to prevent possible XSS
+
 = 3.8.1 (2022-06-09) =
 * Added: Support for WordPress 6.0
 

vendor/includes/admin/settings.php

@@ -291,6 +291,9 @@ public function get_settings( $type ) {
      */
     public function update_settings( $type, $settings ) {
 
+		// Iterate through array of Post Type Settings to strip HTML tags.
+		$settings = $this->strip_tags_deep( $settings );
+
         /**
          * Filters Post Type Settings before they are saved.
          *
@@ -341,6 +344,20 @@ public function update_settings( $type, $settings ) {
 
     }
 
+	/**
+	 * Strip HTML tags from the given array or string.
+	 *
+	 * @since   4.8.9
+	 *
+	 * @param   string|array $value  Setting value.
+	 * @return  string                  Setting value
+	 */
+	private function strip_tags_deep( $value ) {
+
+		return is_array( $value ) ? array_map( array( $this, 'strip_tags_deep' ), $value ) : wp_strip_all_tags( $value );
+
+	}
+
     /**
      * Returns an array of default settings for a new installation.
      *

wp-to-buffer.php

@@ -2,7 +2,7 @@
 /**
 * Plugin Name: WP to Buffer
 * Plugin URI: http://www.wpzinc.com/plugins/wp-to-buffer-pro
-* Version: 3.8.1
+* Version: 3.8.2
 * Author: WP Zinc
 * Author URI: http://www.wpzinc.com
 * Description: Send WordPress Pages, Posts or Custom Post Types to your Buffer (buffer.com) account for scheduled publishing to social networks.
@@ -74,8 +74,8 @@ public function __construct() {
 
         $this->plugin->settingsName     = 'wp-to-buffer-pro'; // Settings key - used in both Free + Pro, and for oAuth
         $this->plugin->account          = 'Buffer';
-        $this->plugin->version          = '3.8.1';
-        $this->plugin->buildDate        = '2022-06-09 18:00:00';
+        $this->plugin->version          = '3.8.2';
+        $this->plugin->buildDate        = '2022-06-21 18:00:00';
         $this->plugin->requires         = '5.0';
         $this->plugin->tested           = '6.0';
         $this->plugin->folder           = plugin_dir_path( __FILE__ );