Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-4840: mappress.php in mappress-google-maps-for-wordpress/tags/2.88.5 – WordPress Plugin Repository

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ‘mappress’ shortcode in versions up to, and including, 2.88.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE
#xss#web#ios#google#js#git#java#wordpress#php#auth#ssl

1<?php2/*3Plugin Name: MapPress Google Maps and Leaflet Maps4Plugin URI: https://www.mappresspro.com5Author URI: https://www.mappresspro.com6Pro Update URI: https://www.mappresspro.com7Description: MapPress makes it easy to add Google Maps and Leaflet Maps to WordPress8Version: 2.88.59Author: Chris Richardson10Text Domain: mappress-google-maps-for-wordpress11Thanks to all the translators and to Scott DeJonge for his wonderful icons12*/1314/*15 This program is distributed in the hope that it will be useful,16 but WITHOUT ANY WARRANTY; without even the implied warranty of17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the license.txt file for details.18*/1920require_once dirname( __FILE__ ) . '/mappress_api.php’;21require_once dirname( __FILE__ ) . '/mappress_compliance.php’;22require_once dirname( __FILE__ ) . '/mappress_db.php’;23require_once dirname( __FILE__ ) . '/mappress_obj.php’;24require_once dirname( __FILE__ ) . '/mappress_poi.php’;25require_once dirname( __FILE__ ) . '/mappress_map.php’;26require_once dirname( __FILE__ ) . '/mappress_settings.php’;27include_once dirname( __FILE__ ) . '/mappress_template.php’;28include_once dirname( __FILE__ ) . '/mappress_wpml.php’;2930if (is_dir(dirname( __FILE__ ) . ‘/pro’)) {31 include_once dirname( __FILE__ ) . '/pro/mappress_filter.php’;32 include_once dirname( __FILE__ ) . '/pro/mappress_frontend.php’;33 include_once dirname( __FILE__ ) . '/pro/mappress_geocoder.php’;34 include_once dirname( __FILE__ ) . '/pro/mappress_icons.php’;35 include_once dirname( __FILE__ ) . '/pro/mappress_import.php’;36 include_once dirname( __FILE__ ) . '/pro/mappress_meta.php’;37 include_once dirname( __FILE__ ) . '/pro/mappress_query.php’;38 include_once dirname( __FILE__ ) . '/pro/mappress_updater.php’;39 include_once dirname( __FILE__ ) . '/pro/mappress_widget.php’;40 include_once dirname( __FILE__ ) . '/pro/mappress_widget_map.php’;41}4243class Mappress {44 const VERSION = '2.88.5’;4546 static47 $api,48 $baseurl,49 $basename,50 $basedir,51 $block_category = 'text’,52 $debug,53 $loaded,54 $options,55 $notices,56 $pages,57 $pro,58 $updater,59 $version60 ;6162 function __construct() {63 global $wp_version;64 self::$basedir = dirname(__FILE__);65 self::$basename = plugin_basename(__FILE__);66 self::$baseurl = plugins_url('’, __FILE__);67 self::$options = Mappress_Options::get();68 self::$pro = is_dir(dirname( __FILE__ ) . ‘/pro’);69 self::$version = (self::$pro) ? self::VERSION . “PRO” : self::VERSION;70 self::$version = (defined(‘MAPPRESS_DEV’) && MAPPRESS_DEV) ? self::$version . '-' . rand(0,99999) : self::$version;71 self::$api = new Mappress_Api();7273 self::debugging();7475 if (self::$pro)76 self::$updater = new Mappress_Updater(self::$basename, 'mappress’, self::VERSION, self::$options->license, self::$options->betas);7778 add_action('admin_menu’, array(__CLASS__, ‘admin_menu’));79 add_action('init’, array(__CLASS__, ‘init’), 0); // Priority 0 required for widgets_init hook80 add_action('plugins_loaded’, array(__CLASS__, ‘plugins_loaded’));8182 add_shortcode('mappress’, array(__CLASS__, ‘shortcode_map’));83 add_action('admin_notices’, array(__CLASS__, ‘admin_notices’));8485 // Filter to automatically add maps to post/page content86 add_filter('the_content’, array(__CLASS__, ‘the_content’), 2);8788 // Namespace89 add_action('wp_head’, array(__CLASS__, ‘wp_head’), 0);90 add_action('admin_head’, array(__CLASS__, ‘wp_head’), 0);9192 // Scripts and stylesheets93 add_action('wp_enqueue_scripts’, array(__CLASS__, ‘wp_enqueue_scripts’));94 add_action('admin_enqueue_scripts’, array(__CLASS__, ‘admin_enqueue_scripts’));9596 // Plugin action links97 add_filter(“plugin_action_links_” . self::$basename, array(__CLASS__, ‘plugin_action_links’), 10, 2);9899 if (self::$pro)100 add_shortcode('mashup’, array(__CLASS__, ‘shortcode_mashup’));101102 // Adjust google script tag103 if (self::$options->engine == ‘google’)104 add_filter('script_loader_tag’, array(__CLASS__, ‘script_loader_tag’), PHP_INT_MAX, 3);105106 // Slow heartbeat107 if (self::$debug)108 add_filter( 'heartbeat_settings’, array(__CLASS__, ‘heartbeat_settings’));109110 // Dismissible notices111 add_action('wp_ajax_mapp_dismiss’, array(__CLASS__, ‘ajax_dismiss’ ));112113 // Add block category114 if ( version_compare( $wp_version, '5.8-RC4’, ‘>=’ ) )115 add_filter( 'block_categories_all’, array(__CLASS__, ‘block_categories’), 10, 2);116 else117 add_filter( 'block_categories’, array(__CLASS__, ‘block_categories’), 10, 2 );118119 add_filter('mime_types’, array(__CLASS__, ‘mime_types’));120 add_action(‘deactivate_’ . self::$basename, array(__CLASS__, ‘deactivate’));121122 // Welcome123 add_action(‘activate_’ . self::$basename, array(__CLASS__, ‘activate’), 10, 2);124 add_action('admin_init’, array(__CLASS__, ‘admin_init’), 10, 2);125126 // Iframes127 if (isset($_GET[‘mappress’]) && $_GET[‘mappress’] = ‘embed’)128 add_action('template_redirect’, array(__CLASS__, ‘template_redirect’));129130 // Temporary fix for https://core.trac.wordpress.org/ticket/56969131 if (version_compare( $wp_version, '6.1.1’, ‘<’ ) )132 add_filter( 'wp_img_tag_add_decoding_attr’, array(__CLASS__, ‘wp_img_tag_add_decoding_attr’), 10, 3);133 }134135 static function wp_img_tag_add_decoding_attr( $value, $filtered_image, $context) {136 return false;137 }138139 static function activate($network_wide = false) {140 $current_version = get_option(‘mappress_version’);141 if (!$current_version)142 set_transient('_mappress_activation_redirect’, 'wizard’, 30);143 else144 set_transient('_mappress_activation_redirect’, true, 30);145 }146147 static function admin_init() {148 $redirect = get_transient(‘_mappress_activation_redirect’);149 if ($redirect) {150 delete_transient(‘_mappress_activation_redirect’);151 if (is_network_admin() || isset( $_GET[‘activate-multi’])) {152 return;153 } else {154 $args = array(‘page’ => 'mappress_support’, ‘wizard’ => ($redirect == ‘wizard’) ? 1 : 0);155 wp_safe_redirect(add_query_arg($args, admin_url(‘admin.php’)));156 }157 }158 }159160 // Scripts & styles for admin161 // CSS is always loaded from the plugin directory162 static function admin_enqueue_scripts($hook) {163 // Some plugins call this without setting $hook164 if (empty($hook))165 return;166167 $pages = (self::$pages) ? self::$pages : array();168 $admin_pages = array(169 'appearance_page_gutenberg-widgets’,170 'appearance_page_gutenberg-edit-site’,171 'customize.php’,172 'plugins.php’,173 'post.php’,174 'post-new.php’,175 'site-editor.php’,176 'widgets.php’177 );178179 if ($hook) {180 self::styles_enqueue(‘backend’);181 if (isset($pages[‘main’]) && $hook == $pages[‘main’]) {182 self::scripts_enqueue(‘settings’);183 } else if (in_array($hook, $pages) || in_array($hook, $admin_pages)) {184 self::scripts_enqueue(‘backend’);185 }186 }187 }188189 static function admin_menu() {190 $upgrade = Mappress_Db::upgrade_check();191 $parent = ($upgrade) ? null : 'mappress’;192193 self::$pages[‘main’] = add_menu_page('MapPress’, 'MapPress’, 'manage_options’, 'mappress’, array('Mappress_Settings’, ‘options_page’), ‘dashicons-location’);194 self::$pages[‘settings’] = add_submenu_page($parent, __('Settings’, ‘mappress-google-maps-for-wordpress’), __('Settings’, ‘mappress-google-maps-for-wordpress’), 'manage_options’, 'mappress’, array('Mappress_Settings’, ‘options_page’));195 self::$pages[‘maps’] = add_submenu_page($parent, __('Maps’, ‘mappress-google-maps-for-wordpress’), __('Maps’, ‘mappress-google-maps-for-wordpress’), 'edit_posts’, 'mappress_maps’, array(__CLASS__, ‘map_library’));196 if (self::$pro)197 self::$pages[‘import’] = add_submenu_page($parent, __('Import’, ‘mappress-google-maps-for-wordpress’), __('Import’, ‘mappress-google-maps-for-wordpress’), 'manage_options’, 'mappress_import’, array('Mappress_Import’, ‘import_page’));198 self::$pages[‘support’] = add_submenu_page($parent, __('Support’, ‘mappress-google-maps-for-wordpress’), __('Support’, ‘mappress-google-maps-for-wordpress’), 'manage_options’, 'mappress_support’, array('Mappress_Settings’, ‘support_page’));199 200 if ($upgrade)201 self::$pages[‘upgrade’] = add_submenu_page('mappress’, __('Upgrade’, ‘mappress-google-maps-for-wordpress’), __('Upgrade’, ‘mappress-google-maps-for-wordpress’), 'manage_options’, 'mappress_db’, array('Mappress_Db’, ‘upgrade_page’));202 }203204 static function admin_notices() {205 global $wpdb;206 $current_screen = get_current_screen();207208 $error = "<div class=’notice notice-error’><p>%s</p></div>";209 $maps_table = $wpdb->prefix . "mapp_maps";210 $exists = $wpdb->get_var(“show tables like '$maps_table’”);211212 // Non-dismissible notices213 if (!$exists) {214 printf($error, __("MapPress database tables are missing. Please deactivate the plugin and activate it again to fix this.", ‘mappress-google-maps-for-wordpress’));215 return;216 }217218 if (self::$options->engine != ‘leaflet’ && !self::get_api_keys()->browser)219 printf($error, sprintf("%s. %s <a href=’%s’>%s</a>.", __("A Google Maps API key is required", ‘mappress-google-maps-for-wordpress’), __(“Please update your", ‘mappress-google-maps-for-wordpress’), admin_url(‘admin.php?page=mappress’), __('MapPress Settings’, ‘mappress-google-maps-for-wordpress’)));220221 // Notice to upgrade DB222 if (Mappress_Db::upgrade_check() && (!$current_screen || $current_screen->id != self::$pages[‘upgrade’])) {223 $url = admin_url(‘admin.php?page=mappress_db’);224 $link = sprintf('<a href="%s">%s</a>’, $url, __(“Upgrade Now", ‘mappress-google-maps-for-wordpress’));225 printf($error, sprintf(‘<strong>’ . __(‘Your MapPress data must be upgraded! Please %s.’ . ‘</strong>’, ‘mappress-google-maps-for-wordpress’), $link));226 }227228 // Dismissibles229 if (is_super_admin()) {230 $content = "<div class=’notice notice-%s is-dismissible’ data-mapp-dismiss=’%s’><p>%s</p></div>";231 $dismissed = array_filter( explode( ',’, (string) get_user_meta( get_current_user_id(), 'mappress_dismissed’, true ) ) );232 $notices = (self::$notices) ? array_diff_key(self::$notices, array_flip($dismissed)) : array();233234 foreach($notices as $key => $notice)235 printf($content, $notice[0], $key, $notice[1]);236237 if ($notices) {238 echo Mappress::script(“jQuery('[data-mapp-dismiss]').on('click’, '.notice-dismiss, .mapp-dismiss’, function(e) {239 var key = jQuery(this).closest(‘.notice’).attr(‘data-mapp-dismiss’);240 jQuery(this).closest('[data-mapp-dismiss]').remove();241 jQuery.post(ajaxurl, { action : 'mapp_dismiss’, key : key });242 });”);243 }244 }245 }246247 /**248 * Dismiss/undismiss admin notices249 *250 * @param mixed $key - notice to dismiss/undismiss251 * @param mixed $dismiss - true to dismiss, false to undismiss252 * @return mixed253 */254 static function admin_notices_dismiss($key, $dismiss) {255 if (!$key)256 return;257258 $dismissed = array_filter( explode( ',’, (string) get_user_meta( get_current_user_id(), 'mappress_dismissed’, true ) ) );259 if ($dismiss)260 $dismissed[] = $key;261 else262 unset($dismissed[$key]);263 update_user_meta( get_current_user_id(), 'mappress_dismissed’, implode( ',’, $dismissed ));264 }265266 static function ajax_dismiss() {267 // Still sent via jQuery268 $key = (isset($_POST[‘key’])) ? $_POST[‘key’] : null;269 if (!$key || sanitize_key( $key) != $key)270 wp_die( 0 );271 self::admin_notices_dismiss($key, true);272 self::ajax_response(‘OK’);273 }274275 static function ajax_response($status, $data=null) {276 $output = trim(ob_get_clean()); // Ignore whitespace, any other output is an error277 header( “Content-Type: application/json” );278279 // WP bug: when zlib active, warning messages are generated, which corrupt JSON output280 // Ticket has been open for 9 years. Workaround is to disable flush when providing json response - may cause other conflicts!281 // https://core.trac.wordpress.org/ticket/22430, https://core.trac.wordpress.org/ticket/18525282 if (ini_get(‘zlib.output_compression’))283 remove_action( 'shutdown’, 'wp_ob_end_flush_all’, 1 );284285 $response = json_encode(array(‘status’ => $status, ‘output’ => $output, ‘data’ => $data));286 die ($response);287 }288289 // 5.8 version of block_categories hook290 // Older GT versions send ($categories, $post) instead of ($categories, $context)291 static function block_categories($categories, $context) {292 self::$block_category = 'mappress’;293 return array_merge(294 $categories,295 array(296 array(297 ‘slug’ => 'mappress’,298 ‘title’ => 'MapPress’299 ),300 )301 );302 }303304 static function deactivate() {305 $reason = (isset($_REQUEST[‘mapp_reason’])) ? $_REQUEST[‘mapp_reason’] : null;306 $reason_text = (isset($_REQUEST[‘mapp_reason_text’])) ? $_REQUEST[‘mapp_reason_text’] : null;307308 if (!$reason || $reason == ‘private’ || $reason == ‘temporary’)309 return;310311 // Don’t bother if there’s no reason text312 if (empty($reason_text))313 return;314315 // Call API (static functions can’t use api_call())316 $args = array(317 ‘api_action’ => 'feedback’,318 ‘network_url’ => (is_multisite()) ? trim(network_home_url()) : trim(home_url()),319 ‘plugin’ => 'mappress’,320 ‘reason’ => $reason,321 ‘reason_text’ => $reason_text,322 ‘url’ => trim(home_url()),323 );324 $response = wp_remote_post(‘https://mappresspro.com’, array(‘timeout’ => 15, ‘sslverify’ => false, ‘body’ => (array) $args));325 }326327 static function debugging() {328 global $wpdb;329330 if (isset($_GET[‘mp_info’])) {331 echo “<b>Plugin</b> " . self::$version;332 $maps_table = $wpdb->prefix . ‘mapp_maps’;333 $results = $wpdb->get_results(“SELECT otype, oid, mapid FROM $maps_table”);334 echo "<br/>otype/oid => mapid<br/>";335 foreach($results as $i => $result) {336 if ($i > 50)337 break;338 echo "<br/>$result->otype / $result->oid => $result->mapid";339 }340 $options = Mappress_Options::get();341 unset($options->mapbox, $options->license, $options->apiKey, $options->apiKeyServer);342 echo str_replace(array(“\r", “\n”), array('<br/>’, ‘<br/>’), print_r($options, true));343 die();344 }345346 if (isset($_REQUEST[‘mp_debug’]))347 self::$debug = max(1, (int) $_REQUEST[‘mp_debug’]);348 else if (defined(‘MAPPRESS_DEBUG’) && MAPPRESS_DEBUG)349 self::$debug = true;350351 if (self::$debug) {352 error_reporting(E_ALL);353 ini_set(‘error_reporting’, E_ALL);354 ini_set(‘display_errors’,’On’);355 $wpdb->show_errors();356 }357 }358359 static function get_api_keys() {360 $results = (object) array(361 ‘browser’ => self::$options->apiKey, 362 ‘server’ => self::$options->apiKeyServer, 363 ‘liq’ => self::$options->liq,364 ‘mapbox’ => self::$options->mapbox365 );366 if (empty($results->browser) && defined(‘MAPPRESS_APIKEY’))367 $results->browser = MAPPRESS_APIKEY;368 if (empty($results->server) && defined(‘MAPPRESS_APIKEY_SERVER’))369 $results->server = MAPPRESS_APIKEY_SERVER;370 if (empty($results->mapbox) && defined(‘MAPPRESS_APIKEY_MAPBOX’))371 $results->mapbox = MAPPRESS_APIKEY_MAPBOX;372 return $results;373 } 374375 static function get_iframe($map) {376 $styles = new WP_Styles();377 $scripts = new WP_Scripts();378 self::scripts_register($scripts);379 self::scripts_enqueue(‘frontend’, $scripts);380 self::styles_register($styles);381 self::styles_enqueue(‘frontend’, $styles);382383 $content = $map->display(null, true);384385 ob_start();386 ?>387 <!doctype html>388 <html class=’mapp-iframe-html’ <?php language_attributes(); ?>>389 <head>390 <title>MapPress</title>391 <?php Mappress::wp_head(); ?>392 <?php $styles->do_items(array(‘mappress’, ‘mappress-custom’)); ?>393 </head>394 <body class=’mapp-iframe-body’>395 <?php echo $content; ?>396 <?php $scripts->do_items(‘mappress’); ?>397 <?php Mappress_Template::print_footer_templates(); ?>398 <script type=’javascript’>mappload();</script>399 </body>400 </html>401 <?php402 $html = ob_get_clean();403 return $html;404 }405406 /**407 * Get language using settings/WPML/qTrans408 *409 */410 static function get_language() {411 // WPML412 if (defined(‘ICL_LANGUAGE_CODE’))413 $lang = ICL_LANGUAGE_CODE;414415 // qTranslate416 else if (function_exists(‘qtrans_getLanguage’))417 $lang = qtrans_getLanguage();418419 else420 $lang = self::$options->language;421422 return ($lang) ? $lang : null;423 }424425 /**426 * Get a mashup - used by shortcode and widget427 *428 * @param mixed $atts429 */430 static function get_mashup($atts) {431 global $wp_query;432 433 $mashup = new Mappress_Map($atts);434 $mashup->otype = (isset($atts[‘otype’]) && $atts[‘otype’] == ‘user’) ? ‘user’ : ‘post’;435 $mashup->query = Mappress_Query::parse_query($atts);436437 // If parameter test="true", output the query result (or global query) without using a map438 if (isset($_GET[‘mp_test’]) || (isset($atts[‘test’]) && $atts[‘test’])) {439 $wpq = ($mashup->query) ? new WP_Query($mashup->query) : $wp_query;440 return “<pre>” . print_r($wpq, true) . "</pre>";441 }442443 // If ‘hideEmpty’ is set, try to suppress the map if there are no POIs444 if ($mashup->hideEmpty) {445 if (Mappress_Query::is_empty($mashup->query))446 return “";447 }448 return $mashup->display();449 }450451 static function heartbeat_settings( $settings ) {452 $settings[‘minimalInterval’] = 600;453 return $settings;454 }455456 /**457 * There are several WP bugs that prevent correct activation in multisitie:458 * http://core.trac.wordpress.org/ticket/14170459 * http://core.trac.wordpress.org/ticket/14718)460 *461 */462 static function init() {463 Mappress_Compliance::register();464 Mappress_Db::register();465 Mappress_Map::register();466 Mappress_Settings::register();467 Mappress_Template::register();468 Mappress_WPML::register();469470 if (self::$pro) {471 Mappress_Filter::register();472 Mappress_Frontend::register();473 Mappress_Icons::register();474 Mappress_Import::register();475 Mappress_Meta::register();476 Mappress_Query::register();477 Mappress_Widget::register();478 Mappress_Widget_Map::register();479 }480481 self::styles_register();482 self::scripts_register();483484 // Register Gutenberg block types and load GT scripts485 if (function_exists(‘register_block_type’)) {486 register_block_type('mappress/map’, array(487 ‘render_callback’ => array(__CLASS__, ‘shortcode_map’),488 ‘editor_script’ => array(‘mappress_admin’),489 ‘style’ => 'mappress’,490 ‘editor_style’ => 'mappress-admin’491 ));492 if (self::$pro) {493 register_block_type('mappress/mashup’, array(494 ‘render_callback’ => array(__CLASS__, ‘shortcode_mashup’),495 ‘editor_script’ => array(‘mappress_admin’),496 ‘style’ => 'mappress’,497 ‘editor_style’ => 'mappress-admin’498 ));499 }500 }501502 // Check if upgrade is needed503 $current_version = get_option(‘mappress_version’);504505 if (empty($current_version)) {506 $args = array(507 ‘api_action’ => 'feedback’,508 ‘network_url’ => (is_multisite()) ? trim(network_home_url()) : trim(home_url()),509 ‘plugin’ => 'mappress’,510 ‘reason’ => 'new’,511 ‘reason_text’ => '’,512 ‘url’ => trim(home_url()),513 );514 $response = wp_remote_post('https://mappresspro.com’, array(‘timeout’ => 15, ‘sslverify’ => false, ‘body’ => (array) $args));515 }516517 // Algolia geocoder discontinued since 2.69.3518 if (empty(self::$options->geocoder || self::$options->geocoder == ‘algolia’)) {519 self::$options->geocoder = ‘nominatim’;520 self::$options->save();521 }522523 // Check for license expired524 if (self::$pro && self::$options->license) {525 $last_check = get_option(‘mappress_license_check’);526 if (!$last_check || time() > $last_check + (60 * 60 * 24 * 7)) {527 $status = Mappress::$updater->get_status();528 if ($status == ‘inactive’) {529 $renew_link = sprintf("<a target=’_blank’ href=’https://mappresspro.com/account’>%s</a>", __('Renew your license’, ‘mappress-google-maps-for-wordpress’));530 self::admin_notices_dismiss('expiredlicense’, false);531 self::$notices[‘expiredlicense’] = sprintf(__('Your MapPress license has expired. %s to get the latest updates and prevent errors.’, ‘mappress-google-maps-for-wordpress’), $renew_link);532 }533 update_option('mappress_license_check’, time());534 return;535 }536 }537538 // Missing license539 if (self::$pro && empty(self::$options->license) && (!is_multisite() || (is_super_admin() && is_main_site())))540 self::$notices[‘nolicense’] = array('warning’, __('Please enter your MapPress license key to enable plugin updates’, ‘mappress-google-maps-for-wordpress’));541542 if (self::VERSION >= ‘2.55’ && version_compare(get_bloginfo(‘version’),’5.3’, ‘<’) )543 self::$notices[‘255_min_version’] = array('error’, __('MapPress Gutenberg blocks require WordPress 5.3 or the latest Gutenberg Plugin. Please update if using the block editor.’, ‘mappress-google-maps-for-wordpress’));544545 if ($current_version && $current_version < ‘2.55’ && self::VERSION >= ‘2.55’)546 self::$notices[‘255_whats_new’] = array('info’, sprintf(__('MapPress has many new features! %s.’, ‘mappress-google-maps-for-wordpress’), '<a target="_blank” href="https://mappresspro.com/whats-new">’ . __(“Learn more", ‘mappress-google-maps-for-wordpress’) . ‘</a>’));547548 if ($current_version && $current_version < ‘2.60’ && self::VERSION >= ‘2.60’)549 self::$notices[‘260_whats_new’] = array('warning’, sprintf(__('MapPress templates have changed! Please update custom templates to the new format. %s.’, ‘mappress-google-maps-for-wordpress’), '<a target="_blank” href="https://mappresspro.com/whats-new">’ . __(“Learn more", ‘mappress-google-maps-for-wordpress’) . ‘</a>’));550551 // Upgrades552 if ($current_version) {553 if (version_compare($current_version, '2.63’, ‘<’)) {554 // New list templates555 self::$notices[‘263_whats_new’] = array('warning’, sprintf(__('MapPress templates and filters have changed. Please update custom templates and filters. %s.’, ‘mappress-google-maps-for-wordpress’), '<a target="_blank” href="https://mappresspro.com/whats-new">’ . __(“Learn more", ‘mappress-google-maps-for-wordpress’) . ‘</a>’));556557 // Convert filters to array558 if (self::$options->filter) {559 self::$options->filters = array(array(‘key’ => self::$options->filter));560 self::$options->save();561 }562563 // Convert styles to indexed arrays564 if (self::$options->styles && is_array(self::$options->styles)) {565 self::$options->stylesGoogle = array();566 self::$options->stylesMapbox = array();567 foreach(self::$options->styles as $name => $json)568 self::$options->stylesGoogle[] = array(‘id’ => $name, ‘name’ => $name, ‘url’ => null, ‘json’ => $json, ‘imageUrl’ => self::$baseurl . ‘/images/roadmap.png’);569 foreach(self::$options->mapboxStyles as $name => $url) {570 $parts = explode('?’, strtolower($url));571 $short_url = str_ireplace(array('.html’, 'https://api.mapbox.com/styles/v1/’, ‘mapbox://styles/’), '’, $parts[0]);572 $parts = explode('/’, $short_url);573 if (count($parts) == 2)574 self::$options->stylesMapbox[] = array(‘url’ => $url, ‘provider’ => 'mapbox’, ‘user’ => $parts[0], ‘id’ => $name, ‘mapboxid’ => $parts[1], ‘name’ => $name);575 }576 self::$options->save();577 }578 }579580 // 2.73 Add a type to all filters581 if (version_compare($current_version, '2.73’, ‘<’)) {582 foreach(self::$options->filters as &$filter) {583 if (empty($filter[‘type’]))584 $filter[‘type’] = 'tax’;585 }586 self::$options->save();587 }588589 // 2.76 New templates590 if (version_compare($current_version, '2.76’, ‘<’))591 self::$notices[‘276_whats_new’] = array('warning’, sprintf(__('MapPress templates have changed! Please update custom templates to the new format. %s.’, ‘mappress-google-maps-for-wordpress’), '<a target="_blank” href="https://mappresspro.com/whats-new">’ . __(“Learn more", ‘mappress-google-maps-for-wordpress’) . ‘</a>’));592593 // 2.80 - DB upgrade, filters and meta594 if (version_compare($current_version, '2.80’, ‘<’)) {595 // Convert filters and meta to include users596 self::$options->filters = array(‘post’ => self::$options->filters, ‘user’ => array());597 self::$options->metaKeys = array(‘post’ => self::$options->metaKeys, ‘user’ => array());598 self::$options->save();599600 // trigger DB ugprade by setting db_version lower than current version601 update_option('mappress_db_version’, ‘2.79’);602 Mappress_Db::upgrade();603 }604605 // 2.84 - copy mashupbody setting => mashupthumbs (poi | post)606 if (version_compare($current_version, '2.84’, ‘<’))607 self::$options->mashupThumbs = self::$options->mashupBody;608609 // 2.85 - rename filters type checkbox=>checkboxes and radio=>radios610 if (version_compare($current_version, '2.85’, ‘<’)) {611 foreach(['post’, ‘user’] as $type) {612 $filters = self::$options->filters[$type] ?? [];613 foreach($filters as &$filter) {614 if ($filter[‘format’] == ‘radio’)615 $filter[‘format’] = 'radios’;616 else if ($filter[‘format’] == ‘checkbox’)617 $filter[‘format’] = 'checkboxes’;618 }619 self::$options->filters[$type] = $filters;620 }621 self::$options->save();622 }623 }624625 update_option('mappress_version’, self::VERSION);626 }627628 // Prevent shortcodes on admin screens629 static function is_admin() {630 $ajax = defined(‘DOING_AJAX’) && DOING_AJAX;631 $rest = defined(‘REST_REQUEST’) && REST_REQUEST;632 return (is_admin() && !$ajax) || $rest;633 }634635 static function is_dev() {636 if (defined(‘MAPPRESS_DEV’) && MAPPRESS_DEV)637 return MAPPRESS_DEV;638 else if (isset($_REQUEST[‘mp_dev’]))639 return ($_REQUEST[‘mp_dev’]) ? $_REQUEST[‘mp_dev’] : 'dev’;640 else641 return false;642 }643644 static function is_footer() {645 if (defined(‘DOING_AJAX’) && DOING_AJAX)646 return false;647 if (defined(‘REST_REQUEST’) && REST_REQUEST)648 return true;649 if (is_admin())650 return true;651 return self::$options->footer;652 }653654 static function is_localhost() {655 return !filter_var($_SERVER[‘SERVER_ADDR’], FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);656 }657658 static function is_plugin_active($plugin) {659 $plugins = array(‘complianz’ => 'complianz-gdpr/complianz-gpdr.php’, ‘amp’ => ‘amp/amp.php’);660 if (array_key_exists($plugin, $plugins))661 $plugin = $plugins[$plugin];662663 // Can’t use WP’s is_plugin_active on frontend w/o including WP files664 if (in_array($plugin, (array) get_option('active_plugins’, array()), true))665 return true;666 if (is_multisite() && in_array($plugin, (array) get_option('active_sitewide_plugins’, array()), true))667 return true;668 return false;669 }670671 static function is_ssl() {672 return (is_ssl() || !filter_var($_SERVER[‘REMOTE_ADDR’], FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE));673 }674675 static function l10n() {676 global $post, $is_IE;677678 $l10n = array(‘delete_prompt’ => __('Are you sure you want to delete?’, ‘mappress-google-maps-for-wordpress’));679680 // Globals681 $l10n[‘options’] = array(682 ‘admin’ => current_user_can(‘administrator’),683 ‘adminurl’ => admin_url(),684 ‘ajaxurl’ => admin_url(‘admin-ajax.php’),685 ‘apikey’ => self::get_api_keys()->browser,686 ‘baseurl’ => self::$baseurl,687 ‘blockCategory’ => self::$block_category,688 ‘debug’ => self::$debug,689 ‘editurl’ => admin_url(‘post.php’),690 ‘filterParams’ => (class_exists(‘Mappress_Filter’)) ? Mappress_Filter::get_url_params() : array(),691 ‘iconsUrl’ => (self::$pro) ? Mappress_Icons::$icons_url : null, 692 ‘isIE’ => $is_IE,693 ‘language’ => self::get_language(),694 ‘liq’ => self::get_api_keys()->liq,695 ‘mapbox’ => self::get_api_keys()->mapbox,696 ‘nonce’ => wp_create_nonce(‘mappress’),697 ‘oid’ => ($post) ? $post->ID : null, // Note: GT => numeric, classic => string698 ‘otype’ => ($post) ? ‘post’ : null, // Not for users yet699 ‘pro’ => self::$pro,700 ‘ssl’ => self::is_ssl(), // SSL is needed for ‘your location’ in directions701 ‘standardIcons’ => (self::$pro) ? Mappress_Icons::$standard_icons : null,702 ‘standardIconsUrl’ => (self::$pro) ? Mappress_Icons::$standard_icons_url : null,703 ‘userStyles’ => (self::$options->engine == ‘leaflet’) ? self::$options->stylesMapbox : self::$options->stylesGoogle,704 ‘userIcons’ => (self::$pro) ? Mappress_Icons::get_user_icons() : null,705 ‘version’ => self::$version706 );707708 // Tile providers709 $l10n[‘options’][‘tileProviders’] = array(710 ‘mapbox’ => array(711 ‘accessToken’ => self::get_api_keys()->mapbox,712 ‘attribution’ => ['<a href="https://www.mapbox.com/about/maps” target="_blank">© Mapbox</a>’, '<a href="https://www.openstreetmap.org/about/” target="_blank">© OpenStreetMap</a>’ ],713 ‘url’ => 'https://api.mapbox.com/styles/v1/{user}/{mapboxid}/tiles/256/{z}/{x}/{y}{r}?access_token={accessToken}&fresh=true’,714 ‘zoomOffset’ => 0715 ),716 ‘osm’ => array(717 ‘attribution’ => ['<a href="https://openstreetmap.org” target="_blank">© OpenStreetMap</a>’],718 ‘url’ => 'https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png’719 )720 );721 722 // Default styles723 if (Mappress::$options->engine == ‘leaflet’) {724 if (Mappress::get_api_keys()->mapbox) {725 $styles = array(726 array(‘id’ => 'streets’, ‘type’ => 'standard’, ‘provider’ => 'mapbox’, ‘user’ => 'mapbox’, ‘mapboxid’ => 'streets-v11’, ‘name’ => __('Streets’, ‘mappress-google-maps-for-wordpress’)),727 array(‘id’ => 'outdoors’, ‘type’ => 'standard’, ‘provider’ => 'mapbox’, ‘user’ => 'mapbox’, ‘mapboxid’ => 'outdoors-v11’, ‘name’ => __('Outdoors’, ‘mappress-google-maps-for-wordpress’)),728 array(‘id’ => 'light’, ‘type’ => 'standard’, ‘provider’ => 'mapbox’, ‘user’ => 'mapbox’, ‘mapboxid’ => 'light-v10’, ‘name’ => __('Light’, ‘mappress-google-maps-for-wordpress’)),729 array(‘id’ => 'dark’, ‘type’ => 'standard’, ‘provider’ => 'mapbox’, ‘user’ => 'mapbox’, ‘mapboxid’ => 'dark-v10’, ‘name’ => __('Dark’, ‘mappress-google-maps-for-wordpress’)),730 array(‘id’ => 'satellite’, ‘type’ => 'standard’, ‘provider’ => 'mapbox’, ‘user’ => 'mapbox’, ‘mapboxid’ => 'satellite-v9’, ‘name’ => __('Satellite’, ‘mappress-google-maps-for-wordpress’)),731 array(‘id’ => 'satellite-streets’, ‘type’ => 'standard’, ‘provider’ => 'mapbox’, ‘user’ => 'mapbox’, ‘mapboxid’ => 'satellite-streets-v11’, ‘name’ => __('Satellite Streets’, ‘mappress-google-maps-for-wordpress’))732 );733 } else {734 $styles = array(735 array(‘id’ => 'osm’, ‘type’ => 'standard’, ‘provider’ => 'osm’, ‘name’ => __('Streets’, ‘mappress-google-maps-for-wordpress’))736 );737 }738 } else {739 // Google styles740 $styles = array(741 array( ‘id’ => 'roadmap’, ‘type’ => 'standard’, ‘name’ => __('Roadmap’, ‘mappress-google-maps-for-wordpress’), ‘imageUrl’ => Mappress::$baseurl . ‘/images/roadmap.png’),742 array( ‘id’ => 'terrain’, ‘type’ => 'standard’, ‘name’ => __('Terrain’, ‘mappress-google-maps-for-wordpress’), ‘imageUrl’ => Mappress::$baseurl . ‘/images/terrain.png’),743 array( ‘id’ => 'satellite’, ‘type’ => 'standard’, ‘name’ => __('Satellite’, ‘mappress-google-maps-for-wordpress’), ‘imageUrl’ => Mappress::$baseurl . ‘/images/satellite.png’),744 array( ‘id’ => 'hybrid’, ‘type’ => 'standard’, ‘name’ => __('Hybrid’, ‘mappress-google-maps-for-wordpress’), ‘imageUrl’ => Mappress::$baseurl . ‘/images/hybrid.png’),745 );746 }747 $l10n[‘options’][‘standardStyles’] = $styles;748749 // Global settings750 $options = array('alignment’, 'betaPoiFields’, 'clustering’, 'clusteringOptions’, 'country’, 'defaultIcon’, 'directions’, 'directionsList’,751 'directionsPopup’, 'directionsServer’, 'engine’, 'filters’, 'filtersPos’, 'geocoder’, 'geolocate’,752 'highlight’, 'highlightIcon’, 'iconScale’, 'initialOpenInfo’, 'layout’, 'lines’, 'lineOpts’,753 'mashupClick’, 'mini’, 'poiFields’, 'poiList’, 'poiListOpen’, 'poiListPageSize’, 'poiListViewport’, 'poiZoom’, 'radius’, 'scrollWheel’, 'search’,754 'searchBox’, 'searchParam’, 'searchPlaceholder’, 'size’, 'sizes’, 'sort’, 'style’, 'thumbHeight’, 'thumbWidth’, 'thumbs’, 'thumbsList’, 'thumbsPopup’, 755 'tooltips’, 'units’, 'userLocation’, ‘webComponent’);756757 foreach($options as $option) {758 if (isset(self::$options->$option)) {759 $l10n[‘options’][$option] = self::$options->$option;760 }761 }762763 return apply_filters('mappress_options’, $l10n);764 }765766 static function map_library() {767 self::scripts_enqueue(‘backend’);768 echo '<div id="mapp-library” class="mapp-library"></div>’;769 wp_editor('’, ‘mapp-library-tinymce’);770 }771772 /**773 * Add KML/KMZ as valid mime types774 *775 * @param mixed $mimes776 */777 static function mime_types($mimes) {778 // Additional entries must match WP, which use finfo_file(), e.g. KML => text/xml779 $mimes[‘kml’] = 'text/xml’; // Real type: 'application/vnd.google-earth.kml+xml’;780 $mimes[‘kmz’] = 'application/zip’; // Real type: 'application/vnd.google-earth.kmz’;781 return $mimes;782 }783784 static function plugin_action_links($links, $file) {785 $settings_link = “<a href=’” . admin_url(“admin.php?page=mappress”) . “’>” . __(‘Settings’, ‘mappress-google-maps-for-wordpress’) . "</a>";786 $whatsnew_link = "<a href=’https://mappresspro.com/whats-new/’ target=’_blank’>” . __("What’s new", ‘mappress-google-maps-for-wordpress’) . "</a>";787 array_unshift( $links, $whatsnew_link );788 array_unshift( $links, $settings_link);789 return $links;790 }791792 static function plugins_loaded() {793 load_plugin_textdomain('mappress-google-maps-for-wordpress’, false, dirname(self::$basename) . ‘/languages’);794 }795796 static function script($script) {797 return "\r\n<script type=’text/javascript’>\r\n$script\r\n</script>";798 }799800 static function script_loader_tag($tag, $handle, $src) {801 // Deregister802 if (self::$options->engine == ‘google’ && self::$options->deregister && self::$loaded && ($handle != ‘mappress-google’ && (stripos($src, ‘maps.googleapis.com’) !== false || stripos($src, ‘maps.google.com’))))803 return ‘’;804 // Re-register805 else if ($handle == ‘mappress-google’ && empty($tag))806 return sprintf("<script src=’%s’ id=’mappress-google-js-fixed’></script>\n", self::scripts_google_tag());807 else808 return $tag;809 }810811 static function scripts_enqueue($type = 'frontend’, $scripts = null) {812 if (self::$loaded)813 return;814 else815 self::$loaded = true;816817 // Don’t output frontend scripts if using iframes818 if (!$scripts && $type == ‘frontend’ && self::$options->iframes)819 return;820821 if ($scripts) {822 // Some plugins add ‘defer’ using script_loader_tag, which interferes with script loading, so remove it823 $nodefer = function ($tag, $handle) { return str_ireplace('defer="defer"’, '’, $tag); };824 add_filter('script_loader_tag’, $nodefer, 999);825 $scripts->enqueue(‘mappress’);826 $scripts->localize('mappress’, 'mappl10n’, self::l10n());827 remove_filter('script_loader_tag’, $nodefer, 999);828 } else {829 wp_enqueue_script(‘mappress’);830 wp_localize_script('mappress’, 'mappl10n’, self::l10n());831832 if ($type == ‘backend’ || $type == ‘settings’)833 wp_enqueue_script(‘mappress_admin’);834835 if ($type == ‘settings’) {836 if (function_exists(‘wp_enqueue_code_editor’))837 wp_enqueue_code_editor(array( ‘type’ => ‘php’ ));838 }839 }840841 // Templates (iframes always queue in footer)842 $footer = ($scripts) ? true : self::is_footer();843 $templates = array('map-item’, 'map-popup’, 'mashup-popup’, 'mashup-item’, 'user-mashup-item’, ‘user-mashup-popup’);844 foreach($templates as $template_name)845 Mappress_Template::enqueue_template($template_name, $footer);846 }847848 static function scripts_register($scripts = null) {849 $dev = self::is_dev();850 $footer = ($scripts) ? false : self::is_footer();851852 // Directories853 $lib = ($dev) ? “https://localhost/$dev/wp-content/plugins/mappress-google-maps-for-wordpress/lib” : self::$baseurl . '/lib’;854 $js = ($dev) ? “https://localhost/$dev/wp-content/plugins/mappress-google-maps-for-wordpress/build” : self::$baseurl . '/build’;855856 // Dependencies857 $deps = array('react’, 'react-dom’, ‘wp-i18n’);858 if (self::$options->engine == ‘leaflet’)859 $deps = array_merge(array('mappress-leaflet’, ‘mappress-leaflet-omnivore’), $deps);860 if (self::$options->engine != ‘leaflet’ || self::$options->geocoder == ‘google’)861 $deps[] = 'mappress-google’;862 if (self::$options->clustering)863 $deps[] = (self::$options->engine == ‘leaflet’) ? ‘mappress-leaflet-markercluster’ : 'mappress-markerclusterer’;864 $admin_deps = array('mappress’, 'wp-blocks’, 'wp-components’, 'wp-compose’, 'wp-core-data’, 'wp-element’, 'wp-media-utils’, 'wp-i18n’, 'wp-notices’, ‘wp-url’);865866 // Clustering ( https://github.com/googlemaps/js-markerclusterer | https://github.com/Leaflet/Leaflet.markercluster )867 $register = array(868 array("mappress-leaflet", $lib . '/leaflet/leaflet.js’, null, null, $footer),869 array("mappress-leaflet-omnivore", $lib . '/leaflet/leaflet-omnivore.min.js’, null, null, $footer),870 array("mappress-google", self::scripts_google_tag(), null, null, $footer),871 array('mappress-markerclusterer’, self::unpkg('markerclusterer’, ‘index.min.js’), null, null, $footer),872 array('mappress-leaflet-markercluster’, $lib . '/leaflet/leaflet.markercluster.js’, null, null, $footer),873 array('mappress’, $js . "/index_mappress.js", $deps, self::$version, $footer),874 array('mappress_admin’, $js . "/index_mappress_admin.js", $admin_deps, self::$version, $footer)875 );876877 foreach($register as $script) {878 if ($scripts)879 $scripts->add($script[0], $script[1], $script[2], $script[3], $script[4]);880 else881 wp_register_script($script[0], $script[1], $script[2], $script[3], $script[4]);882 }883884 // I18N885 if (function_exists(‘wp_set_script_translations’)) {886 if ($scripts) {887 $scripts->set_translations('mappress’, 'mappress-google-maps-for-wordpress’, self::$basedir . ‘/languages’);888 $scripts->set_translations('mappress_admin’, 'mappress-google-maps-for-wordpress’, self::$basedir . ‘/languages’);889 } else {890 wp_set_script_translations('mappress’, 'mappress-google-maps-for-wordpress’, self::$basedir . ‘/languages’);891 wp_set_script_translations('mappress_admin’, 'mappress-google-maps-for-wordpress’, self::$basedir . ‘/languages’);892 }893 }894 }895896 static function scripts_google_tag() {897 $dev = self::is_dev();898 $language = self::get_language();899 $language = ($language) ? “&language=$language” : '’;900 $apiversion = ($dev) ? ‘&v=beta’ : '&v=3’;901 $apikey = “&key=” . self::get_api_keys()->browser;902 $libs = '&libraries=places,drawing’;903 return "https://maps.googleapis.com/maps/api/js?callback=Function.prototype{$apiversion}{$language}{$libs}{$apikey}";904 }905906 /**907 * Scrub attributes908 * The WordPress shortcode API passes shortcode attributes in lowercase and with boolean values as strings (e.g. “true”)909 * Converts atts to lowercase, replaces boolean strings with booleans, and creates arrays from comma-separated attributes910 *911 * Returns empty array if $atts is empty or not an array912 */913 static function scrub_atts($atts=null) {914 if (!$atts || !is_array($atts))915 return array();916 917 // Sanitize, single quotes could be used for xss JS918 foreach($atts as $key => $value)919 $atts[$key] = esc_attr($value);920921 $atts = self::string_to_boolean($atts);922923 // Shortcode attributes are lowercase so convert everything to lowercase924 $atts = array_change_key_case($atts);925926 // Map options - includes both leaflet and Google927 foreach(array('disableDefaultUI’, 'disableDoubleClickZoom’, 'draggable’, 'dragging’, 'fullscreenControl’, 'geolocate’, 'keyboard’,928 'keyboardShortcuts’, 'mapTypeControl’, 'maxZoom’, 'minZoom’, 'panControl’, 'rotateControl’, 'scaleControl’,929 'scrollwheel’, 'scrollWheelZoom’, 'streetViewControl’, ‘zoomControl’) as $opt) {930 $lcopt = strtolower($opt);931 if (isset($atts[$lcopt])) {932 $atts[‘mapopts’][$opt] = $atts[$lcopt];933 unset($atts[$lcopt]);934 }935 }936937 // For center = 'post’, use location of first poi in first map938 if (isset($atts[‘center’]) && $atts[‘center’] == ‘post’) {939 global $post;940 $maps = Mappress_Map::get_list(‘post’, $post->ID, ‘ids’);941 $map = ($maps) ? Mappress_Map::get($maps[0]) : null;942 $atts[‘center’] = ($map && $map->pois) ? $map->pois[0]->point[‘lat’] . ‘,’ . $map->pois[0]->point[‘lng’] : null;943 }944945 // Conver GT ‘align’ to ‘alignment’946 if (isset($atts[‘align’]))947 $atts[‘alignment’] = $atts[‘align’];948949 // Change legacy center=’user’ to geolocation=’true’950 if (isset($atts[‘center’]) && strtolower($atts[‘center’]) == ‘user’) {951 $atts[‘center’] = null;952 $atts[‘geolocate’] = true;953 }954 955 return $atts;956 }957958 /**959 * Map shortcode960 *961 */962 static function shortcode_map($atts=’’) {963 global $post;964965 if (self::is_admin() || is_feed())966 return;967968 $atts = self::scrub_atts($atts);969970 // Determine what to show971 $mapid = (isset($atts[‘mapid’])) ? $atts[‘mapid’] : null;972973 // On archive pages, $post isn’t set974 if (!$mapid && !$post)975 return;976977 if ($mapid) {978 // Show map by mapid979 $map = Mappress_Map::get($mapid);980 } else {981 // Get the first map attached to the post982 $maps = Mappress_Map::get_list(‘post’, $post->ID);983 $map = (isset ($maps[0]) ? $maps[0] : false);984 }985986 if (!$map)987 return;988989 return $map->display($atts);990 }991992 /**993 * Mashup shortcode994 *995 */996 static function shortcode_mashup($atts=’’) {997 if (self::is_admin() || is_feed())998 return;9991000 $atts = self::scrub_atts($atts);1001 return self::get_mashup($atts);1002 }10031004 static function string_to_boolean($data) {1005 if ($data === ‘false’)1006 return false;10071008 if ($data === ‘true’)1009 return true;10101011 if (is_array($data)) {1012 foreach($data as &$datum)1013 $datum = self::string_to_boolean($datum);1014 }1015 return $data;1016 }10171018 static function styles_enqueue($type, $styles = null) {1019 global $wp_styles;1020 $styles = ($styles) ? $styles : $wp_styles;10211022 $styles->enqueue(‘mappress-leaflet’);1023 $styles->enqueue(‘mappress-leaflet-markercluster-default’);1024 $styles->enqueue(‘mappress-leaflet-markercluster’);1025 $styles->enqueue(‘mappress’);10261027 if ($type == ‘frontend’)1028 $styles->enqueue(‘mappress-custom’);1029 else if ($type == ‘backend’ || $type == ‘settings’)1030 $styles->enqueue(‘mappress-admin’);1031 }10321033 static function styles_register($styles = null) {1034 $styles = ($styles) ? $styles : wp_styles();10351036 $deps = array();10371038 // Leaflet CSS1039 if (self::$options->engine == ‘leaflet’) {1040 $styles->add('mappress-leaflet’, self::$baseurl . '/lib/leaflet/leaflet.css’, null, ‘1.7.1’);1041 $deps[] = 'mappress-leaflet’;1042 if (self::$options->clustering) {1043 $styles->add('mappress-leaflet-markercluster-default’, self::$baseurl . "/lib/leaflet/MarkerCluster.Default.css", null, ‘1.4.1’);1044 $deps[] = 'mappress-leaflet-markercluster-default’;1045 $styles->add(‘mappress-leaflet-markercluster’, self::$baseurl . “/lib/leaflet/MarkerCluster.css", null, ‘1.4.1’);1046 $deps[] = 'mappress-leaflet-markercluster’;1047 }1048 }10491050 // Frontend1051 $styles->add('mappress’, self::$baseurl . '/css/mappress.css’, $deps, self::$version);10521053 // Admin CSS1054 $styles->add('mappress-admin’, self::$baseurl . '/css/mappress_admin.css’, array('mappress’, ‘wp-edit-blocks’), self::$version);10551056 // Mappress CSS from theme directory1057 if ( @file_exists( get_stylesheet_directory() . ‘/mappress.css’ ) )1058 $file = get_stylesheet_directory_uri() . '/mappress.css’;1059 elseif ( @file_exists( get_template_directory() . ‘/mappress.css’ ) )1060 $file = get_template_directory_uri() . '/mappress.css’;1061 if (isset($file)) {1062 $styles->add('mappress-custom’, $file, array(‘mappress’), self::$version);1063 }1064 }10651066 static function template_redirect() {1067 header(“HTTP/1.1 200 OK”);10681069 // Convert strings to booleans1070 $args = array_map(function($arg) { if ($arg == ‘true’) return true; if ($arg == ‘false’) return false; return $arg; }, $_GET);10711072 if (isset($args[‘mapid’])) {1073 $map = Mappress_Map::get($args[‘mapid’]);1074 if (!$map)1075 die(“<html><body><!-- Bad mapid --></body></html>”);1076 } elseif (isset($args[‘transient’])) {1077 $mapdata = get_transient($args[‘transient’]);1078 if (!$mapdata)1079 die(“<html><body><!-- Bad map transient --></body></html>”);1080 $map = new Mappress_Map($mapdata);1081 } else {1082 $map = new Mappress_Map();1083 }10841085 $map->update($args);1086 $map->layout = 'left’;10871088 // Hydrate POIs for mashups1089 if ($map->query) {1090 $result = Mappress_Query::query(array(‘query’ => $map->query));1091 $map->pois = $result->pois;1092 }10931094 echo self::get_iframe($map);1095 die();1096 }10971098 /**1099 * Automatic map display.1100 * If set, the [mappress] shortcode will be prepended/appended to the post body, once for each map1101 * The shortcode is used so it can be filtered - for example WordPress will remove it in excerpts by default.1102 *1103 * @param mixed $content1104 */1105 static function the_content($content="”) {1106 global $post;1107 global $wp_current_filter;11081109 $autodisplay = self::$options->autodisplay;11101111 // No auto display1112 if (!$autodisplay || $autodisplay == ‘none’)1113 return $content;11141115 // Check if in the loop, to prevent conflicts with JetPack - see http://wordpress.org/support/topic/easy-adsense-lite-and-jetpack1116 if (!in_the_loop())1117 return $content;11181119 // Don’t add the shortcode for feeds or admin screens1120 if (is_feed() || self::is_admin())1121 return $content;11221123 // No shortcode if post is password protected1124 if (post_password_required())1125 return $content;11261127 // If this is an excerpt don’t attempt to add the map to it1128 if (in_array(‘get_the_excerpt’, $wp_current_filter))1129 return $content;11301131 // Don’t auto display if the post already contains a MapPress shortcode1132 if (stristr($content, '[mappress’) !== false || stristr($content, '[mashup’) !== false)1133 return $content;11341135 // Don’t auto display if the post already contains GT block1136 if (stristr($content, ‘wp:mappress/map’) !== false)1137 return $content;11381139 // Get maps associated with post1140 $mapids = Mappress_Map::get_list('post’, $post->ID, ‘ids’);1141 if (empty($mapids))1142 return $content;11431144 // Add the shortcode once for each map1145 $shortcodes = “";1146 foreach($mapids as $mapid)1147 $shortcodes .= ‘<p>[mappress mapid="’ . $mapid . '”]</p>’;11481149 if ($autodisplay == ‘top’)1150 return $shortcodes . $content;1151 else1152 return $content . $shortcodes;1153 }11541155 static function to_atts($vars) {1156 $vars = is_object($vars) ? $vars : (object) $vars;1157 $results = array();1158 foreach($vars as $name => $value) {1159 if ($value === null || $value === ‘’)1160 continue;11611162 $lcname = strtolower($name); // Only lowercase is allowed11631164 if (is_object($value) || is_array($value))1165 $results[] = sprintf("%s=’%s’", $lcname, json_encode($value, JSON_HEX_APOS));1166 else1167 $results[] = “$lcname=’” . str_replace('"’, '"’, $value) . "’";1168 }1169 return join(' ', $results);1170 }11711172 static function unpkg($package, $filename) {1173 $urls = array(1174 ‘markerclusterer’ => 'https://unpkg.com/@googlemaps/markerclusterer@%s/dist’,1175 );1176 $versions = array(1177 ‘markerclusterer’ => '2.0.11’,1178 );11791180 $url = $urls[$package];1181 $version = $versions[$package];1182 return apply_filters('mappress_unpkg’, sprintf($url, $version) . "/$filename", $package, $filename);1183 }11841185 /**1186 * Scripts & styles for frontend1187 * CSS is loaded from: child theme, theme, or plugin directory1188 */1189 static function wp_enqueue_scripts() {1190 self::styles_enqueue(‘frontend’);11911192 // Load scripts in header if needed1193 if (!self::is_footer())1194 self::scripts_enqueue();1195 }11961197 static function wp_head() {1198 echo "\r\n<!-- MapPress Easy Google Maps " . __('Version’, ‘mappress-google-maps-for-wordpress’) . ‘:’ . self::$version . " (https://www.mappresspro.com) -->\r\n";1199 }1200}12011202$mappress = new Mappress();1203?>

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907