Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-3371: Helper.php in embedpress/tags/3.7.3/EmbedPress/Includes/Classes – WordPress Plugin Repository

The User Registration plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the ‘lock_content_form_handler’ and ‘display_password_form’ function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to decrypt and view the password protected content.

CVE
#web#ios#google#js#wordpress#php#pdf#auth#webkit#ssl

1<?php23namespace EmbedPress\Includes\Classes;4use EmbedPress\Shortcode;56if ( !defined(‘ABSPATH’) ) {7 exit;8} // Exit if accessed directly910class Helper {1112 /**13 * Parse a query string into an associative array.14 *15 * If multiple values are found for the same key, the value of that key16 * value pair will become an array. This function does not parse nested17 * PHP style arrays into an associative array (e.g., foo[a]=1&foo[b]=2 will18 * be parsed into ['foo[a]' => '1’, 'foo[b]' => ‘2’]).19 *20 * @param string $str Query string to parse21 * @param int|bool $urlEncoding How the query string is encoded22 *23 * @return array24 */25 26 public function __construct () {27 add_action('wp_ajax_lock_content_form_handler’, [$this, ‘lock_content_form_handler’]);28 add_action('wp_ajax_nopriv_lock_content_form_handler’, [$this, ‘lock_content_form_handler’]);29 add_action( 'wp_head’, [$this, ‘ep_add_meta_tags’] );30 }3132 public function ep_add_meta_tags() {33 echo 'abstract’;34 }3536 public static function parse_query($str, $urlEncoding = true)37 {38 $result = [];3940 if ($str === ‘’) {41 return $result;42 }4344 if ($urlEncoding === true) {45 $decoder = function ($value) {46 return rawurldecode(str_replace('+’, ' ', $value));47 };48 } elseif ($urlEncoding === PHP_QUERY_RFC3986) {49 $decoder = 'rawurldecode’;50 } elseif ($urlEncoding === PHP_QUERY_RFC1738) {51 $decoder = 'urldecode’;52 } else {53 $decoder = function ($str) { return $str; };54 }5556 foreach (explode('&’, $str) as $kvp) {57 $parts = explode('=’, $kvp, 2);58 $key = $decoder($parts[0]);59 $value = isset($parts[1]) ? $decoder($parts[1]) : null;60 if (!isset($result[$key])) {61 $result[$key] = $value;62 } else {63 if (!is_array($result[$key])) {64 $result[$key] = [$result[$key]];65 }66 $result[$key][] = $value;67 }68 }6970 return $result;71 }72 public static function get_pdf_renderer() {73 $renderer = EMBEDPRESS_URL_ASSETS . ‘pdf/web/viewer.html’;74 // @TODO; apply settings query args here75 return $renderer;76 }7778 public static function get_extension_from_file_url($url) {79 $urlSplit = explode(“.", $url);80 $ext = end($urlSplit);81 return $ext;82 }83 84 public static function is_file_url($url) {85 $pattern = '/\.([0-9a-z]+)(?=[?#])|(\.)(?:[\w]+)$/i’;86 return preg_match($pattern, $url) === 1;87 }8889 public static function is_opensea($url) {90 return strpos($url, “opensea.io”) !== false;91 }92 public static function is_youtube_channel($url) {93 return (bool) (preg_match('~(?:https?:\/\/)?(?:www\.)?(?:youtube.com\/)(?:channel\/|c\/|user\/|@)(\w+)~i’, (string) $url));94 }9596 public static function is_youtube($url) {97 return (bool) (preg_match('~(?:https?://)?(?:www\.)?(?:youtube\.com|youtu\.be)/watch\?v=([^&]+)~i’, (string) $url));98 }99100 // Saved sources data temporary in wp_options table101 public static function get_source_data($blockid, $source_url, $source_option_name, $source_temp_option_name) {102 103 104 if(self::is_youtube_channel($source_url)){105 $source_name = 'YoutubeChannel’; 106 }107 else if(self::is_youtube($source_url)){108 $source_name = 'Youtube’; 109 }110 else if (!empty(self::is_file_url($source_url))) {111 $source_name = ‘document_’ . self::get_extension_from_file_url($source_url);112 }113 else if(self::is_opensea($source_url)){114 $source_name = 'OpenSea’;115 }116 else{117 Shortcode::get_embera_instance();118 $collectios = Shortcode::get_collection();119 $provider = $collectios->findProviders($source_url);120 if(!empty($provider[$source_url])){121 $source_name = $provider[$source_url]->getProviderName();122 }123 else{124 $source_name = 'Unknown Source’;125 }126 }127 128 if(!empty($blockid) && $blockid != ‘undefined’){129 $sources = json_decode(get_option($source_temp_option_name), true);130131 if(!$sources) {132 $sources = array();133 }134 $exists = false;135 136 foreach($sources as $i => $source) {137 if ($source[‘id’] === $blockid) {138 $sources[$i][‘source’][‘name’] = $source_name;139 $sources[$i][‘source’][‘url’] = $source_url;140 $exists = true;141 break;142 }143 }144145 if(!$exists) {146 $sources[] = array(‘id’ => $blockid, ‘source’ => array(‘name’ => $source_name, ‘url’ => $source_url, ‘count’ => 1));147 }148 149 update_option($source_temp_option_name, json_encode($sources));150 }151 }152153 // Saved source data when post updated154 public static function get_save_source_data_on_post_update( $source_option_name, $source_temp_option_name ) {155156 if ( defined( ‘DOING_AUTOSAVE’ ) && DOING_AUTOSAVE ) {157 return;158 } 159 $temp_data = json_decode(get_option($source_temp_option_name), true);160 $source_data = json_decode(get_option($source_option_name), true);161 if(!$temp_data) {162 $temp_data = array();163 }164 if(!$source_data) {165 $source_data = array();166 }167168 $sources = array_merge($temp_data, $source_data);169170 $unique_sources = array();171 foreach ($sources as $source) {172 $unique_sources[$source[‘id’]] = $source;173 }174 175 $unique_sources = array_values($unique_sources);176177 delete_option($source_temp_option_name);178179 update_option($source_option_name, json_encode($unique_sources));180 }181 182 //Delete source data from option table when widget is removed183 public static function get_delete_source_data($blockid, $source_option_name, $source_temp_option_name) {184 if (!empty($blockid) && $blockid != ‘undefined’) {185 $sources = json_decode(get_option($source_option_name), true); 186 $temp_sources = json_decode(get_option($source_temp_option_name), true); 187 if ($sources) {188 foreach ($sources as $i => $source) {189 if ($source[‘id’] === $blockid) {190 unset($sources[$i]);191 break;192 }193 }194 update_option($source_option_name, json_encode(array_values($sources)));195 }196 if ($temp_sources) {197 foreach ($temp_sources as $i => $source) {198 if ($source[‘id’] === $blockid) {199 unset($temp_sources[$i]);200 break;201 }202 }203 update_option($source_temp_option_name, json_encode(array_values($temp_sources)));204 }205 }206 wp_die();207 }208 209 //Delete source temporary data when reload without update or publish210 public static function get_delete_source_temp_data_on_reload($source_temp_option_name) {211 $source_temp_data = json_decode(get_option($source_temp_option_name), true);212 if ($source_temp_data ) {213 delete_option( $source_temp_option_name );214 }215 }216217 public static function get_file_title($url){218 return get_the_title(attachment_url_to_postid( $url ));219 }220221222 public function lock_content_form_handler()223 {224 225 $client_id = isset($_POST[‘client_id’]) ? $_POST[‘client_id’] : '’;226 $password = isset($_POST[‘password’]) ? $_POST[‘password’] : '’; 227 $epbase64 = isset($_POST[‘epbase’]) ? $_POST[‘epbase’] : '’;228 $hash_key = isset($_POST[‘hash_key’]) ? $_POST[‘hash_key’] : '’;229230 // Set the decryption key and initialization vector (IV)231 $key = “g72@QKgEcANy8%D7xq8%@n%#";232 $iv = “^ZCC$93vsbyYjz01";233234 // Decode the base64 encoded cipher235 $cipher = base64_decode($epbase64);236 // Decrypt the cipher using AES-128-CBC encryption237238 $wp_pass_key = hash('sha256’, wp_salt(32) . md5($password));239240 if ($wp_pass_key === $hash_key) {241 setcookie(“password_correct_", $password, time() + 3600);242243 $embed = openssl_decrypt($cipher, 'AES-128-CBC’, $key, OPENSSL_RAW_DATA, $iv) . ‘<script>244 var now = new Date();245 var time = now.getTime();246 var expireTime = time + 1000 * 60 * 60 * 24 * 30;247 now.setTime(expireTime);248 document.cookie = "password_correct_’ . $client_id . ‘=’ . $hash_key . '; expires=” + now.toUTCString() + “; path=/";249 </script>’;250 } else {251 $embed = 0;252 }253254 // Process the form data and return a response255 $response = array(256 ‘success’ => true,257 ‘password’ => $password,258 ‘embedHtml’ => $embed259 );260261 echo json_encode($response);262263 wp_die();264 }265266 public static function display_password_form($client_id=’’, $embedHtml=’’, $pass_hash_key=’’, $attributes = [])267 {268 $lock_heading = !empty($attributes[‘lockHeading’]) ? $attributes[‘lockHeading’] : '’;269 $lock_subheading = !empty($attributes[‘lockSubHeading’]) ? $attributes[‘lockSubHeading’] : '’;270 $lock_error_message = !empty($attributes[‘lockErrorMessage’]) ? $attributes[‘lockErrorMessage’] : '’;271 $footer_message = !empty($attributes[‘footerMessage’]) ? $attributes[‘footerMessage’] : '’;272 $password_placeholder = !empty($attributes[‘passwordPlaceholder’]) ? $attributes[‘passwordPlaceholder’] : '’;273 $button_text = !empty($attributes[‘submitButtonText’]) ? $attributes[‘submitButtonText’] : '’;274 $unlocking_text = !empty($attributes[‘submitUnlockingText’]) ? $attributes[‘submitUnlockingText’] : '’;275 $enable_footer_message = !empty($attributes[‘enableFooterMessage’]) ? $attributes[‘enableFooterMessage’] : '’;276277 // Set the encryption key and initialization vector (IV)278 $key = “g72@QKgEcANy8%D7xq8%@n%#";279 $iv = “^ZCC$93vsbyYjz01";280281 $salt = wp_salt(32);282 $wp_hash_key = hash('sha256’, $salt . $pass_hash_key);283284285 // Encrypt the plaintext using AES-128-CBC encryption286 $cipher = openssl_encrypt($embedHtml, 'AES-128-CBC’, $key, OPENSSL_RAW_DATA, $iv);287288 // Base64 encode the encrypted cipher289 $encrypted_data = base64_encode($cipher);290291 $lock_icon = '<svg xmlns="http://www.w3.org/2000/svg” viewBox="0 0 64 64"><g fill="#6354a5” class="color134563 svgShape"><path d="M46.3 28.7h-3v-6.4C43.3 16.1 38.2 11 32 11c-6.2 0-11.3 5.1-11.3 11.3v6.4h-3v-6.4C17.7 14.4 24.1 8 32 8s14.3 6.4 14.3 14.3v6.4” fill="#6354a5” class="color000000 svgShape"></path><path d="M44.8 55.9H19.2c-2.6 0-4.8-2.2-4.8-4.8V31.9c0-2.6 2.2-4.8 4.8-4.8h25.6c2.6 0 4.8 2.2 4.8 4.8v19.2c0 2.7-2.2 4.8-4.8 4.8zM19.2 30.3c-.9 0-1.6.7-1.6 1.6v19.2c0 .9.7 1.6 1.6 1.6h25.6c.9 0 1.6-.7 1.6-1.6V31.9c0-.9-.7-1.6-1.6-1.6H19.2z” fill="#6354a5” class="color000000 svgShape"></path><path d="M35.2 36.7c0 1.8-1.4 3.2-3.2 3.2s-3.2-1.4-3.2-3.2 1.4-3.2 3.2-3.2 3.2 1.5 3.2 3.2" fill="#6354a5" class="color000000 svgShape"></path><path d="M32.8 36.7h-1.6l-1.6 9.6h4.8l-1.6-9.6" fill="#6354a5" class="color000000 svgShape"></path></g></svg>’;292293 echo ‘294 <div class="password-form-container">295 <h2>’.esc_html( $lock_heading ).’</h2>296 <p>’.esc_html( $lock_subheading ).’ </p>297 <form class="password-form" method="post" class="password-form" data-unlocking-text="’.esc_attr( $unlocking_text ).’">298 299 <div class="password-field">300 <span class="lock-icon">’ . $lock_icon . ‘</span>301 <input type="password" name="pass_’ . esc_attr($client_id) . ‘" placeholder="’ . esc_attr($password_placeholder) . ‘" required>302 </div>303 <input type="hidden" name="ep_client_id" value="’ . esc_attr($client_id) . ‘">304 <input type="hidden" name="ep_base_’ . esc_attr($client_id) . ‘" value="’ . esc_attr($encrypted_data) . ‘">305 <input type="hidden" name="hash_key_’ . esc_attr($client_id) . ‘" value="’ . esc_attr($wp_hash_key ) . '">306 <input type="submit" name="password_submit" value="’.esc_attr( $button_text ).’">307 <div class="error-message hidden">’.esc_html( $lock_error_message ).’</div>308 </form>309 ' . ( ! empty( $enable_footer_message ) ? ‘<p class="need-access-message">’ . esc_html( $footer_message ) . ‘</p>’ : ‘’ ) . '310 </div>311 ';312 }313314 // Check if the user has already entered the correct password315 public static function is_password_correct($client_id)316 {317 if (isset($_COOKIE[‘password_correct_’ . $client_id])) {318 return $_COOKIE[‘password_correct_’ . $client_id];319 } else {320 return false;321 }322 }323324 public static function customLogo($embedHTML, $atts){325 $x = !empty($atts[‘logoX’]) ? $atts[‘logoX’] : 0;326 $y = !empty($atts[‘logoY’]) ? $atts[‘logoY’] : 0;327 $uniqid = !empty($atts[‘url’])? '.ose-uid-' . md5($atts[‘url’]): '’;328 329 $brandUrl = !empty($atts[‘customlogoUrl’]) ? $atts[‘customlogoUrl’] : '’;330 $opacity = !empty($atts[‘logoOpacity’]) ? $atts[‘logoOpacity’] : '’;331 332 $cssClass = !empty( $atts[‘url’] ) ? '.ose-uid-' . md5( $atts[‘url’] ) : '.ose-youtube’;333334335336 ob_start(); ?>337 <style type="text/css">338 <?php echo esc_html($cssClass); ?>339 {340 position: relative;341 }342 343 <?php echo esc_html($cssClass); ?> .watermark {344 border: 0;345 position: absolute;346 bottom: <?php echo esc_html($y); ?>%;347 right: <?php echo esc_html($x); ?>%;348 max-width: 150px;349 max-height: 75px;350 opacity: 0.25;351 z-index: 5;352 -o-transition: opacity 0.5s ease-in-out;353 -moz-transition: opacity 0.5s ease-in-out;354 -webkit-transition: opacity 0.5s ease-in-out;355 transition: opacity 0.5s ease-in-out;356 opacity: <?php echo esc_html($opacity); ?>;357 }358359 <?php echo esc_html($cssClass); ?>360 .watermark:hover {361 opacity: 1;362 }363 </style>364 <?php 365366367 $style = ob_get_clean();368369 if ( ! class_exists( ‘\simple_html_dom’ ) ) {370 include_once EMBEDPRESS_PATH_CORE . 'simple_html_dom.php’;371 }372373 $cta = '’;374 $img = '’;375376 if(!empty($atts[‘customlogo’])){377 $img = '<img src="’.esc_url($atts[‘customlogo’]).’"/>’;378379 $imgDom = str_get_html( $img );380 $imgDom = $imgDom->find( 'img’, 0 );381 $imgDom->setAttribute( 'class’, ‘watermark ep-custom-logo’ );382 $imgDom->removeAttribute( ‘style’ );383 $imgDom->setAttribute( 'width’, ‘auto’ );384 $imgDom->setAttribute( 'height’, ‘auto’ );385 ob_start();386 echo $imgDom;387388 $cta .= ob_get_clean();389390 $imgDom->clear();391 unset( $img, $imgDom ); 392393 if ( !empty($brandUrl) ) {394 $cta = '<a href="’.esc_url($brandUrl).’" target="_blank">’.$cta.’</a>’;395 }396 $dom = str_get_html( $embedHTML ); 397398 $wrapDiv = $dom->find( $uniqid, 0 ); 399400 if ( ! empty( $wrapDiv ) && is_object( $wrapDiv ) ) {401 $wrapDiv->innertext .= $cta;402 }403404 ob_start();405 echo $wrapDiv;406 407 $markup = ob_get_clean();408 409 $dom->clear();410 unset( $dom, $wrapDiv );411412 $embedHTML = $style . $markup;413414 }415416 return $embedHTML;417418 }419420421 public static function embed_content_share($content_id=’’, $attributes = []){422423 $share_position = !empty($attributes[‘sharePosition’]) ? $attributes[‘sharePosition’] : 'right’;424 $custom_thumnail = !empty($attributes[‘customThumbnail’]) ? urlencode($attributes[‘customThumbnail’]) : '’;425 $custom_title = !empty($attributes[‘customTitle’]) ? urlencode($attributes[‘customTitle’]) : '’;426 $custom_description = !empty($attributes[‘customDescription’]) ? urlencode($attributes[‘customDescription’]) : '’;427 428 $page_url = urlencode(get_permalink().’?hash=’.$content_id);429 430 $social_icons = '<div class="ep-social-share-wraper"><div class="ep-social-share share-position-'.esc_attr( $share_position ).’">’;431 $social_icons .= ‘<a href="https://www.facebook.com/sharer/sharer.php?u=’ . $page_url . '" class="ep-social-icon facebook" target="_blank">432 <svg width="64px" height="64px" fill="#000000" viewBox="0 -6 512 512" xmlns="http://www.w3.org/2000/svg">433 <path d="M0 0h512v500H0z" fill="#475a96"/>434 <path d="m375.72 112.55h-237.43c-8.137 0-14.73 6.594-14.73 14.73v237.43c0 8.135 6.594 14.73 14.73 14.73h127.83v-103.36h-34.781v-40.28h34.781v-29.705c0-34.473 21.055-53.244 51.807-53.244 14.73 0 27.391 1.097 31.08 1.587v36.026l-21.328 0.01c-16.725 0-19.963 7.947-19.963 19.609v25.717h39.887l-5.193 40.28h-34.693v103.36h68.012c8.135 0 14.73-6.596 14.73-14.73v-237.43c-1e-3 -8.137-6.596-14.73-14.731-14.73z" fill="#fff"/>435 </svg>436 </a>’;437 $social_icons .= ‘<a href="https://twitter.com/intent/tweet?url=’ . $page_url . ‘&text=’ . $custom_title . '" class="ep-social-icon twitter" target="_blank">438 <svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" viewBox="0 0 248 204">439 <path fill="#ffffff"440 d="M221.95 51.29c.15 2.17.15 4.34.15 6.53 0 66.73-50.8 143.69-143.69 143.69v-.04c-27.44.04-54.31-7.82-77.41-22.64 3.99.48 8 .72 12.02.73 22.74.02 44.83-7.61 62.72-21.66-21.61-.41-40.56-14.5-47.18-35.07 7.57 1.46 15.37 1.16 22.8-.87-23.56-4.76-40.51-25.46-40.51-49.5v-.64c7.02 3.91 14.88 6.08 22.92 6.32C11.58 63.31 4.74 33.79 18.14 10.71c25.64 31.55 63.47 50.73 104.08 52.76-4.07-17.54 1.49-35.92 14.61-48.25 20.34-19.12 52.33-18.14 71.45 2.19 11.31-2.23 22.15-6.38 32.07-12.26-3.77 11.69-11.66 21.62-22.2 27.93 10.01-1.18 19.79-3.86 29-7.95-6.78 10.16-15.32 19.01-25.2 26.16z" />441 </svg>442 </a>’;443 $social_icons .= ‘<a href="http://pinterest.com/pin/create/button/?url=’ . $page_url . ‘&media=’ .$custom_thumnail . ‘&description=’ . $custom_description . '" class="ep-social-icon pinterest" target="_blank">444 445 <svg xmlns="http://www.w3.org/2000/svg" height="800" width="1200" viewBox="-36.42015 -60.8 315.6413 364.8"><path d="M121.5 0C54.4 0 0 54.4 0 121.5 0 173 32 217 77.2 234.7c-1.1-9.6-2-24.4.4-34.9 2.2-9.5 14.2-60.4 14.2-60.4s-3.6-7.3-3.6-18c0-16.9 9.8-29.5 22-29.5 10.4 0 15.4 7.8 15.4 17.1 0 10.4-6.6 26-10.1 40.5-2.9 12.1 6.1 22 18 22 21.6 0 38.2-22.8 38.2-55.6 0-29.1-20.9-49.4-50.8-49.4-34.6 0-54.9 25.9-54.9 52.7 0 10.4 4 21.6 9 27.7 1 1.2 1.1 2.3.8 3.5-.9 3.8-3 12.1-3.4 13.8-.5 2.2-1.8 2.7-4.1 1.6-15.2-7.1-24.7-29.2-24.7-47.1 0-38.3 27.8-73.5 80.3-73.5 42.1 0 74.9 30 74.9 70.2 0 41.9-26.4 75.6-63 75.6-12.3 0-23.9-6.4-27.8-14 0 0-6.1 23.2-7.6 28.9-2.7 10.6-10.1 23.8-15.1 31.9 11.4 3.5 23.4 5.4 36 5.4 67.1 0 121.5-54.4 121.5-121.5C243 54.4 188.6 0 121.5 0z" fill="#fff"/></svg>446 447 </a>’;448 449 $social_icons .= '<a href="https://www.linkedin.com/sharing/share-offsite/?url=’.$page_url.’&title=’.$custom_title.’&summary=’.$custom_description.’&source=LinkedIn" class="ep-social-icon linkedin" target="_blank">450 451 <svg fill="#ffffff" height="800px" width="800px" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" 452 viewBox="0 0 310 310" xml:space="preserve">453 <g id="XMLID_801_">454 <path id="XMLID_802_" d="M72.16,99.73H9.927c-2.762,0-5,2.239-5,5v199.928c0,2.762,2.238,5,5,5H72.16c2.762,0,5-2.238,5-5V104.73455 C77.16,101.969,74.922,99.73,72.16,99.73z"/>456 <path id="XMLID_803_" d="M41.066,0.341C18.422,0.341,0,18.743,0,41.362C0,63.991,18.422,82.4,41.066,82.4457 c22.626,0,41.033-18.41,41.033-41.038C82.1,18.743,63.692,0.341,41.066,0.341z"/>458 <path id="XMLID_804_" d="M230.454,94.761c-24.995,0-43.472,10.745-54.679,22.954V104.73c0-2.761-2.238-5-5-5h-59.599459 c-2.762,0-5,2.239-5,5v199.928c0,2.762,2.238,5,5,5h62.097c2.762,0,5-2.238,5-5v-98.918c0-33.333,9.054-46.319,32.29-46.319460 c25.306,0,27.317,20.818,27.317,48.034v97.204c0,2.762,2.238,5,5,5H305c2.762,0,5-2.238,5-5V194.995461 C310,145.43,300.549,94.761,230.454,94.761z"/>462 </g>463 </svg>464 </a>’;465 $social_icons .= '</div></div>’;466 467 return $social_icons ;468 }469470471 472 public static function ep_get_elementor_widget_settings($page_settings = '’, $id = '’, $widgetType = ‘’){473474 $data = json_decode($page_settings, true);475476 // Search for the element with the given ID477 $element = null;478 foreach ($data as $section) {479 foreach ($section[‘elements’] as $column) {480 foreach ($column[‘elements’] as $el) {481 if ($el[‘id’] == $id && $el[‘elType’] == ‘widget’ && $el[‘widgetType’] == $widgetType) {482 $element = $el;483 break 3;484 }485 }486 }487 }488489 // Output the element code490 if ($element) {491 return $element;;492 } 493494 } 495496 public static function ep_get_popup_icon() {497 $svg = '<div class="ep-doc-popup-icon" ><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" xml:space="preserve"><path fill="#fff" d="M5 3c-1.1 0-2 .9-2 2v14c0 1.1.9 2 2 2h14c1.1 0 2-.9 2-2v-6l-2-2v8H5V5h8l-2-2H5zm9 0 2.7 2.7-7.5 7.5 1.7 1.7 7.5-7.5L21 10V3h-7z"/><path style="fill:none" d="M0 0h24v24H0z"/></svg></div>’;498499 return $svg;500 }501 public static function ep_get_download_icon() {502 $svg = '<div class="ep-doc-download-icon" ><svg width="25" height="25" viewBox="0 0 0.6 0.6" xmlns="http://www.w3.org/2000/svg"><path fill="#fff" fill-rule="evenodd" d="M.525.4A.025.025 0 0 1 .55.422v.053A.075.075 0 0 1 .479.55H.125A.075.075 0 0 1 .05.479V.425A.025.025 0 0 1 .1.422v.053A.025.025 0 0 0 .122.5h.353A.025.025 0 0 0 .5.478V.425A.025.025 0 0 1 .525.4ZM.3.05a.025.025 0 0 1 .025.025v.24L.357.283A.025.025 0 0 1 .39.281l.002.002a.025.025 0 0 1 .002.033L.392.318.317.393.316.394.314.395.311.397.308.398.305.399.301.4H.295L.292.399.289.398.287.397.285.395A.025.025 0 0 1 .283.393L.208.318A.025.025 0 0 1 .241.281l.002.002.032.032v-.24A.025.025 0 0 1 .3.05Z"/></svg></div>’;503504 return $svg;505 }506507 public static function ep_get_print_icon() {508 $svg = '<div class="ep-doc-print-icon" ><svg xmlns="http://www.w3.org/2000/svg" width="25" height="25" viewBox="0 0 24 24">509 <path d="M19 8H5c-1.66 0-3 1.34-3 3v6h4v4h12v-4h4v-6c0-1.66-1.34-3-3-3zm-3 11H8v-5h8v5zm3-7c-.55 0-1-.45-1-1s.45-1 1-1 1 .45 1 1-.45 1-1 1zm-1-9H6v4h12V3z" fill="#fff"/>510 </svg></div>’;511512 return $svg;513 }514515 public static function ep_get_fullscreen_icon() {516 $svg = '<div class="ep-doc-fullscreen-icon"><svg width="25" height="25" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">517 <path d="m3 15 .117.007a1 1 0 0 1 .876.876L4 16v4h4l.117.007a1 1 0 0 1 0 1.986L8 22H3l-.117-.007a1 1 0 0 1-.876-.876L2 21v-5l.007-.117a1 1 0 0 1 .876-.876L3 15Zm18 0a1 1 0 0 1 .993.883L22 16v5a1 1 0 0 1-.883.993L21 22h-5a1 1 0 0 1-.117-1.993L16 20h4v-4a1 1 0 0 1 .883-.993L21 15ZM8 2a1 1 0 0 1 .117 1.993L8 4H4v4a1 1 0 0 1-.883.993L3 9a1 1 0 0 1-.993-.883L2 8V3a1 1 0 0 1 .883-.993L3 2h5Zm13 0 .117.007a1 1 0 0 1 .876.876L22 3v5l-.007.117a1 1 0 0 1-.876.876L21 9l-.117-.007a1 1 0 0 1-.876-.876L20 8V4h-4l-.117-.007a1 1 0 0 1 0-1.986L16 2h5Z" fill="#fff"/>518 </svg></div>’;519 520 return $svg;521 }522 public static function ep_get_minimize_icon() {523 $svg = '<div class="ep-doc-minimize-icon" style="display:none"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" style="enable-background:new 0 0 385.331 385.331" xml:space="preserve" width="20" height="20"><path fill="#fff" d="M13.751 8.131h5.62c0.355 0 0.619 -0.28 0.619 -0.634 0 -0.355 -0.265 -0.615 -0.619 -0.614h-4.995V1.878c0 -0.355 -0.27 -0.624 -0.624 -0.624s-0.624 0.27 -0.624 0.624v5.62c0 0.002 0.001 0.003 0.001 0.004 0 0.002 -0.001 0.003 -0.001 0.005 0 0.348 0.276 0.625 0.624 0.624zM6.244 1.259c-0.354 0 -0.614 0.265 -0.614 0.619v4.995H0.624c-0.355 0 -0.624 0.27 -0.624 0.624 0 0.355 0.27 0.624 0.624 0.624h5.62c0.002 0 0.003 -0.001 0.004 -0.001 0.002 0 0.003 0.001 0.005 0.001 0.348 0 0.624 -0.276 0.624 -0.624V1.878c0 -0.354 -0.28 -0.619 -0.634 -0.619zm0.005 10.61H0.629c-0.355 0.001 -0.619 0.28 -0.619 0.634 0 0.355 0.265 0.615 0.619 0.614h4.995v5.005c0 0.355 0.27 0.624 0.624 0.624 0.355 0 0.624 -0.27 0.624 -0.624V12.502c0 -0.002 -0.001 -0.003 -0.001 -0.004 0 -0.002 0.001 -0.003 0.001 -0.005 0 -0.348 -0.276 -0.624 -0.624 -0.624zm13.127 0H13.756c-0.002 0 -0.003 0.001 -0.004 0.001 -0.002 0 -0.003 -0.001 -0.005 -0.001 -0.348 0 -0.624 0.276 -0.624 0.624v5.62c0 0.355 0.28 0.619 0.634 0.619 0.354 0.001 0.614 -0.265 0.614 -0.619v-4.995H19.376c0.355 0 0.624 -0.27 0.624 -0.624s-0.27 -0.624 -0.624 -0.625z"/><g/><g/><g/><g/><g/><g/></svg></div>’;524 525 return $svg;526 }527 public static function ep_get_draw_icon() {528 $svg = '<div class="ep-doc-draw-icon"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="m15 7.5 2.5 2.5m-10 10L19.25 8.25c0.69 -0.69 0.69 -1.81 0 -2.5v0c-0.69 -0.69 -1.81 -0.69 -2.5 0L5 17.5V20h2.5Zm0 0h8.379C17.05 20 18 19.05 18 17.879v0c0 -0.563 -0.224 -1.103 -0.621 -1.5L17 16M4.5 5c2 -2 5.5 -1 5.5 1 0 2.5 -6 2.5 -6 5 0 0.876 0.533 1.526 1.226 2" stroke="#fff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg></div>’;529 530 return $svg;531 }532533 public static function get_google_presentation_url($embedded_url){534 $parsed_url = parse_url($embedded_url);535 $base_url = $parsed_url[‘scheme’] . ‘://’ . $parsed_url[‘host’] . $parsed_url[‘path’];536 $base_url = strtok($base_url, ‘?’);537 $base_url = rtrim($base_url, ‘/’);538 return $base_url;539540 }541 542}543544?>

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907