Skip to content

Commit 2c0b08a

Browse files
author
Benjamin Pick
committed
Merge branch 'beta'
2 parents 712ce78 + 1861282 commit 2c0b08a

File tree

28 files changed

+1248
-1139
lines changed

28 files changed

+1248
-1139
lines changed

‎README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,10 @@ See [Documentation](https://github.com/yellowtree/geoip-detect/wiki) for more in
121121
1. Lookup page (under Tools > Geolocation Lookup)
122122
2. Options page (under Preferences > Geolocation IP Detection)
123123

124+
= 5.6.0 =
125+
126+
This update removes the deprecated shortcode [geoip_detect ...] (read the changelog for more details)
127+
124128
= 5.5.0 =
125129

126130
When using the default datasource "hostip.info", the region code (i.e. CA) is now correctly moved to the property `mostSpecificSubdivision` (previously, it was part of the property `city`)
@@ -131,6 +135,11 @@ If you are using AJAX mode, please read the changelog.
131135

132136
## Changelog ##
133137

138+
= 5.6.0 =
139+
* FIX [!]: Remove deprecated shortcode [geoip_detect] (Security - CVE-2025-57993). If you are still using it, use [geoip_detect2 ...] instead, you might have to change the property name.
140+
* FIX: Compatibility with Wordpress 6.7 (Textdomain loading)
141+
* Library updates
142+
134143
= 5.5.0 =
135144
* FIX [!]: In the datasource "hostip.info", the region code (i.e. CA) is now correctly moved to the property `mostSpecificSubdivision` (previously, it was part of the property `city`)
136145
* Library updates

‎SECURITY.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
Only the most recent version of the plugin is supported.
6+
7+
## Reporting a Vulnerability
8+
9+
Please send vulnerabilty reports to wp-geoip-detect ät posteo.de or use the Github "Report a vulnerability" and I will respond within a week.

‎admin-ui.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ function geoip_detect_option_page() {
195195
break;
196196

197197
case 'choose':
198-
$sourceId = sanitize_text_field($_POST['options']['source']);
198+
$sourceId = sanitize_text_field(isset($_POST['options']['source']) ? $_POST['options']['source'] : '' );
199199
$registry->setCurrentSource($sourceId);
200200
break;
201201

@@ -219,7 +219,7 @@ function geoip_detect_option_page() {
219219
if (in_array($opt_name, $numeric_options))
220220
$opt_value = isset($_POST['options'][$opt_name]) ? (int) $_POST['options'][$opt_name] : 0;
221221
else {
222-
$opt_value = geoip_detect_sanitize_option($opt_name, @$_POST['options'][$opt_name], $m);
222+
$opt_value = geoip_detect_sanitize_option($opt_name, isset($_POST['options'][$opt_name]) ? $_POST['options'][$opt_name] : '', $m);
223223
}
224224
if ($m) {
225225
$messages[] = $m;

‎ajax.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ function geoip_detect_ajax_get_info_from_current_ip() {
4949

5050
// Referer check
5151

52-
$referer = _geoip_detect_get_domain_name($_SERVER['HTTP_REFERER']);
52+
$referer = _geoip_detect_get_domain_name(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '');
5353
if (!$referer) {
5454
_geoip_detect_ajax_error('This AJAX call does not work when called directly. Do an AJAX call via JS instead.');
5555
}
@@ -75,7 +75,7 @@ function geoip_detect_ajax_get_info_from_current_ip() {
7575

7676

7777
function _geoip_detect_get_domain_name($url) {
78-
$result = parse_url($url);
78+
$result = wp_parse_url($url);
7979
return $result['host'];
8080
}
8181

‎check_compatibility.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,11 +96,11 @@ function checkCompatible() {
9696
$line2 = __('These incompatible files have been found to be loaded from another plugin: ', 'geoip-detect') . $data;
9797
$line3 = __('Please test if looking up an IP adress works without an PHP Error. If it works, you can dismiss this notice. It will appear again when their libraries are changed.', 'geoip-detect');
9898

99-
$body = <<<BODY
99+
$body = "
100100
<p><i>$line1</i></p>
101101
<p>$line2</p>
102102
<p>$line3</p>
103-
BODY;
103+
";
104104
$this->adminNotices[] = [
105105
'id' => 'maxmind_vendor_old_' . md5($data),
106106
'title' => __('Geolocation IP Detection: Warning: Old Maxmind Libraries detected.', 'geoip-detect'),

‎data-sources/auto.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ public function saveParameters($post) {
143143

144144
protected function download_url($url, $modified = 0) {
145145
// Similar to wordpress download_url, but with custom UA
146-
$url_filename = basename( parse_url( $url, PHP_URL_PATH ) );
146+
$url_filename = basename( wp_parse_url( $url, PHP_URL_PATH ) );
147147

148148
$tmpfname = wp_tempnam( $url_filename );
149149
if ( ! $tmpfname )
@@ -161,7 +161,7 @@ protected function download_url($url, $modified = 0) {
161161
return new \WP_Error( 'http_304', __('It has not changed since the last update.', 'geoip-detect') );
162162
}
163163
if (is_wp_error( $response ) || 200 != $http_response_code) {
164-
unlink($tmpfname);
164+
wp_delete_file($tmpfname);
165165
$body = wp_remote_retrieve_body($response);
166166
return new \WP_Error( 'http_404', $http_response_code . ': ' . trim( wp_remote_retrieve_response_message( $response ) ) . ' ' . $body );
167167
}
@@ -220,7 +220,7 @@ public function maxmindUpdate($forceUpdate = false)
220220
}
221221

222222
update_option('geoip-detect-auto_downloaded_file', '');
223-
unlink($tmpFile);
223+
wp_delete_file($tmpFile);
224224

225225
return true;
226226
}
@@ -252,7 +252,7 @@ protected function unpackArchive($downloadedFilename, $outFile) {
252252
$phar->extractTo($outDir, null, true);
253253
} catch(\Throwable $e) {
254254
// Fallback method of unpacking?
255-
unlink($downloadedFilename); // Do not try to unpack this file again, instead re-download
255+
wp_delete_file($downloadedFilename); // Do not try to unpack this file again, instead re-download
256256
return __('The downloaded file seems to be corrupt. Try again ...', 'geoip-detect');
257257
}
258258

@@ -309,7 +309,7 @@ public function set_cron_schedule()
309309
public function schedule_next_cron_run() {
310310
// Try to update every 1-2 weeks
311311
$next = time() + WEEK_IN_SECONDS;
312-
$next += mt_rand(1, WEEK_IN_SECONDS);
312+
$next += \wp_rand(1, WEEK_IN_SECONDS);
313313

314314
wp_schedule_single_event($next, 'geoipdetectupdate');
315315
}
@@ -329,7 +329,7 @@ public function uninstall() {
329329
// Delete the automatically downloaded file, if it exists
330330
$filename = $this->maxmindGetFilename();
331331
if ($filename) {
332-
unlink($filename);
332+
wp_delete_file($filename);
333333
}
334334
}
335335
}

‎deprecated.php‎

Lines changed: 1 addition & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -20,32 +20,4 @@ function geoip_detect_get_abs_db_filename()
2020
if (is_object($reader) && method_exists($source, 'maxmindGetFilename'))
2121
return $source->maxmindGetFilename();
2222
return '';
23-
}
24-
25-
26-
27-
/**
28-
* @deprecated shortcode
29-
*/
30-
function geoip_detect_shortcode($attr)
31-
{
32-
$userInfo = geoip_detect_get_info_from_current_ip();
33-
34-
$defaultValue = isset($attr['default']) ? $attr['default'] : '';
35-
36-
if (!is_object($userInfo))
37-
return $defaultValue . '<!-- Geolocation IP Detection: No info found for this IP. -->';
38-
39-
$propertyName = $attr['property'];
40-
41-
42-
if (property_exists($userInfo, $propertyName)) {
43-
if ($userInfo->$propertyName)
44-
return $userInfo->$propertyName;
45-
else
46-
return $defaultValue;
47-
}
48-
49-
return $defaultValue . '<!-- Geolocation IP Detection: Invalid property name. -->';
50-
}
51-
add_shortcode('geoip_detect', 'geoip_detect_shortcode');
23+
}

‎geoip-detect.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,17 @@
55
Description: Provides geographic information detected by an IP adress.
66
Author: Yellow Tree (Benjamin Pick)
77
Author URI: http://www.yellowtree.de
8-
Version: 5.5.0
8+
Version: 5.6.0
99
License: GPLv3 or later
1010
License URI: http://www.gnu.org/licenses/gpl-3.0.html
1111
Text Domain: geoip-detect
12-
Domain Path: /languages
1312
GitHub Plugin URI: https://github.com/yellowtree/geoip-detect
1413
GitHub Branch: master
1514
Requires WP: 5.4
1615
Requires PHP: 7.2.5
1716
*/
1817

19-
define('GEOIP_DETECT_VERSION', '5.5.0');
18+
define('GEOIP_DETECT_VERSION', '5.6.0');
2019

2120
/*
2221
Copyright 2013-2023 Yellow Tree, Siegen, Germany

‎init.php‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,6 @@ function geoip_detect_check_ipv6_support() {
3636
return @inet_pton('::1') !== false;
3737
}
3838

39-
// Load Locales
40-
function geoip_detect_load_textdomain() {
41-
load_plugin_textdomain( 'geoip-detect', false, GEOIP_PLUGIN_DIR . '/languages' );
42-
}
43-
add_action( 'plugins_loaded', 'geoip_detect_load_textdomain' );
44-
4539

4640
function geoip_detect_enqueue_admin_notices() {
4741
// Nobody would see these notices them anyway.
@@ -89,15 +83,15 @@ function geoip_detect_admin_notice_template($id, $title, $body, $addButtonDismis
8983
?>
9084
<div class="error notice is-dismissible">
9185
<p style="float: right">
92-
<a href="tools.php?page=<?php echo GEOIP_PLUGIN_BASENAME ?>&geoip_detect_dismiss_notice=<?php echo $id ?>"><?php _e('Dismiss notice', 'geoip-detect'); ?></a>
86+
<a href="tools.php?page=<?php echo GEOIP_PLUGIN_BASENAME ?>&geoip_detect_dismiss_notice=<?php echo esc_attr($id) ?>"><?php _e('Dismiss notice', 'geoip-detect'); ?></a>
9387
</p>
9488

9589
<h3><?php echo $title; ?></h3>
9690

9791
<?php echo $body; ?>
9892
<?php if ($addButtonDismiss) : ?>
9993
<p>
100-
<a class="button button-secondary" href="?geoip_detect_dismiss_notice=<?= $id ?>">Hide this notice</a>
94+
<a class="button button-secondary" href="?geoip_detect_dismiss_notice=<?php echo esc_attr($id) ?>">Hide this notice</a>
10195
</p>
10296
<?php endif; ?>
10397
</div>

‎lib/ccpa.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -288,7 +288,7 @@ public function schedule($forceReschedule = false) {
288288

289289
protected function schedule_next_cron_run() {
290290
$next = time() + DAY_IN_SECONDS;
291-
$next += mt_rand(1, HOUR_IN_SECONDS);
291+
$next += wp_rand(1, HOUR_IN_SECONDS);
292292
wp_schedule_single_event($next, 'geoipdetectccpaupdate');
293293
}
294294
}

0 commit comments

Comments
 (0)