Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fixed a Possible SQL injection vulnerability reported by [Oskar Adin](h…
…ttps://github.com/osadi) and fixed by [Danny van Kooten](https://twitter.com/DannyvanKooten).

git-svn-id: https://plugins.svn.wordpress.org/i-recommend-this/trunk@996218 b8457f37-d9ea-0310-8a92-e5e31aec5664
  • Loading branch information
hchouhan committed Sep 24, 2014
1 parent ee1bcbb commit 058b3ef
Show file tree
Hide file tree
Showing 2 changed files with 86 additions and 62 deletions.
93 changes: 55 additions & 38 deletions dot-irecommendthis.php
Expand Up @@ -3,7 +3,7 @@
* Plugin Name: I Recommend This
* Plugin URI: http://www.harishchouhan.com/personal-projects/i-recommend-this/
* Description: This plugin allows your visitors to simply recommend or like your posts instead of commment it.
* Version: 3.7.2
* Version: 3.7.3
* Author: Harish Chouhan
* Author URI: http://www.harishchouhan.com
* Author Email: me@harishchouhan.com
Expand Down Expand Up @@ -671,53 +671,70 @@ function dot_recommend($id=null)

function dot_recommended_top_posts( $atts, $content = null )
{
// get our variable from $atts
extract(shortcode_atts(array(
'container' => 'li',
'number' => '10',
'post_type' => 'post',
'year' => '',
'monthnum' => '',
'show_count' => '1',
), $atts));

global $wpdb;
// define attributes and their defaults
// get our variable from $atts
$atts = shortcode_atts( array(
'container' => 'li',
'number' => '10',
'post_type' => 'post',
'year' => '',
'monthnum' => '',
'show_count' => '1',
), $atts );

$request = "SELECT * FROM $wpdb->posts, $wpdb->postmeta";
$request .= " WHERE $wpdb->posts.ID = $wpdb->postmeta.post_id";
global $wpdb;

// empty params array to hold params for prepared statement
$params = array();

if ($year != '') {
$request .= " AND YEAR(post_date) = '$year'";
}
// build query string
$sql = "SELECT * FROM $wpdb->posts, $wpdb->postmeta WHERE $wpdb->posts.ID = $wpdb->postmeta.post_id";

if ($monthnum != '') {
$request .= " AND MONTH(post_date) = '$monthnum'";
}
// add year
if( '' !== $atts['year'] ) {
$sql .= ' AND YEAR(post_date) = %d';
$params[] = $atts['year'];
}

// add monthnum
if( '' !== $atts['monthnum'] ) {
$sql .= ' AND MONTH(post_date) = %d';
$params[] = $atts['monthnum'];
}

$request .= " AND post_status='publish' AND post_type='$post_type' AND meta_key='_recommended'";
$request .= " ORDER BY $wpdb->postmeta.meta_value+0 DESC LIMIT $number";
$posts = $wpdb->get_results($request);
// add post WHERE
$sql .= " AND post_status = 'publish' AND post_type = %s AND meta_key = '_recommended'";
$params[] = $atts['post_type'];

$return = '';
// add order by and limit
$sql .= " ORDER BY {$wpdb->postmeta}.meta_value+0 DESC LIMIT %d";
$params[] = $atts['number'];

// prepare sql statement
$query = $wpdb->prepare( $sql, $params );

foreach ($posts as $item) {
$post_title = stripslashes($item->post_title);
$permalink = get_permalink($item->ID);
$post_count = $item->meta_value;
// execute query
$posts = $wpdb->get_results( $query );

$return .= '<' . $container . '>';
$return .= '<a href="' . $permalink . '" title="' . $post_title.'" rel="nofollow">' . $post_title . '</a> ';
$return = '';

if ( $show_count == '1') {
$return .= '<span class="votes">' . $post_count . '</span> ';
}
foreach ($posts as $item) {
$post_title = stripslashes( $item->post_title );
$permalink = get_permalink( $item->ID );
$post_count = $item->meta_value;

//$return .= get_the_post_thumbnail($item->ID, 'showcase-thumbnail');
$return .= '</' . $container . '>';
$return .= '<' . esc_html( $atts['container'] ) . '>';
$return .= '<a href="' . esc_url( $permalink ) . '" title="' . esc_attr( $post_title ) .'" rel="nofollow">' . esc_html( $post_title ) . '</a> ';

}
return $return;
if ( $atts['show_count'] == '1') {
$return .= '<span class="votes">' . esc_html( $post_count ) . '</span> ';
}

$return .= '</' . esc_html( $atts['container'] ) . '>';

}
return $return;

} //dot_recommended_top_posts

Expand Down Expand Up @@ -866,7 +883,7 @@ function dot_column_content($column_name, $post_ID) {
}

function dot_column_register_sortable( $columns ) {
$columns['likes'] = 'likes';
$columns['likes'] = 'likes';
return $columns;
}

Expand All @@ -883,6 +900,6 @@ function dot_column_orderby( $vars ) {
add_filter('request', 'dot_column_orderby');
add_filter('manage_edit-post_sortable_columns', 'dot_column_register_sortable');
add_filter('manage_posts_columns', 'dot_columns_head');
add_action('manage_posts_custom_column', 'dot_column_content', 10, 2);
add_action('manage_posts_custom_column', 'dot_column_content', 10, 2);

?>
55 changes: 31 additions & 24 deletions readme.txt
Expand Up @@ -2,39 +2,45 @@
Contributors: hchouhan, themeist, dreamsmedia, Benoit "LeBen" Burgener
Donate link: http://themeist.co
Tags: recommend, like, love, post, rate, rating, post rating, heart, dribbble like, tumblr like
Requires at least: 3.7
Tested up to: 3.9.1
Stable tag: 3.7.2
Last Updated: 2014-June-21
Requires at least: 4.0
Tested up to: 4.0
Stable tag: 3.7.3
Last Updated: 2014-September-24
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

This plugin allows your visitors to simply like/recommend your posts instead of comment on it.


== Description ==

This plugin allows your visitors to simply like/recommend your posts instead of comment on it.

= Features of I Recommend This =

= This plugin includes =
* A counter to display the number of "like" and to vote.
* A widget and a function to display the X most liked posts.
* A preference pane with some options.
* Saves Cookie as well as users IP address to disable voting on the same post again
* Displays Number of likes on Post Edit page along with sorting option Thanks to [HSG](http://profiles.wordpress.org/HSG/)
- A counter to display the number of "like" and to vote.
- A widget and a function to display the X most liked posts.
- Saves Cookie as well as users IP address to disable voting on the same post again.
- Displays Number of likes on Post Edit page along with sorting option. [HSG](http://profiles.wordpress.org/HSG/)
- A preference pane with some options.

** Advanced Options **

= Advanced Options =
* Hide count if count is zero
* Set a default messages when count is zero, one or more
* Choose between a "Thumbs Up" or a "Heart" icon to allow recommending on a post
* Disable CSS to allow you to add your own styling rules
* Choose between a "Thumbs Up" or a "Heart" icon to allow post recommending.
* Disable plugin CSS to allow you to add your own styling rules
* Disable saving of IP address in the table.

= Shortcodes =
* You can add the voting link to any page using shortcodes
* Now using shortcode display a specific number of most recommended posts of all time or from a specific time period with support to chose the post type.
** Shortcodes **

- Add the voting link to any page using shortcodes
- Display specific number of most recommended posts of all time or from a specific time period with support for custom post types.

= Examples of how the plugin has been used =

- [Flat UI Design Gallery](http://flattrendz.com)
- [Harish's blog](http://www.harishchouhan.com/blog/)
- [OnePageMania.com](http://onepagemania.com/)

= Translations =

Expand All @@ -49,14 +55,12 @@ If you have created your own language pack (or have an update of an existing one

This plugin is based exactly on Benoit "LeBen" Burgener's "I Like This" Plugin and has been modified after getting requests for the changes I had made on my website.

Please report any bugs you find via http://www.dreamsonline.net/wordpress-plugins/i-recommend-this/ or via WordPress forums.

= Examples of how the plugin has been used =

* [Flat UI Design Gallery](http://flattrendz.com) - Example usage in website Design Gallery
* [Harish's blog](http://www.harishchouhan.com/blog/) -
* [OnePageMania.com](http://onepagemania.com/) -
Please report any bugs you find via [Support Forum](https://wordpress.org/support/plugin/i-recommend-this) or via comment on http://www.dreamsonline.net/wordpress-plugins/i-recommend-this/

> ** For Developers **
>
> If you're a developer and want to contribute, head over to [I Recommend This plugin on GitHub](https://github.com/hchouhan/I-Recommend-This)
>

= My Links =

Expand Down Expand Up @@ -95,6 +99,9 @@ You can also visit the [support center](http://www.dreamsonline.net/wordpress-pl

== Changelog ==

= 3.7.3
* Fixed a Possible SQL injection vulnerability reported by [Oskar Adin](https://github.com/osadi) and fixed by [Danny van Kooten](https://twitter.com/DannyvanKooten).

= 3.7.2
* Updated 'dot_irecommendthis.js' file to make plugin work even when the like button is on a hidden element. Thanks to [forthewinn](http://wordpress.org/support/profile/forthewinn). [Support Ticket](http://wordpress.org/support/topic/recommendation-to-fix-usage-in-hiddenexpanding-elements)

Expand Down

0 comments on commit 058b3ef

Please sign in to comment.