CVE-2023-3244: cld-admin.php in comments-like-dislike/trunk/inc/classes – WordPress Plugin Repository

1<?php23defined(‘ABSPATH’) or die(‘No script kiddies please!!’);45if (!class_exists(‘CLD_Admin’)) {67 class CLD_Admin extends CLD_Library {89 function __construct() {10 parent::__construct();11 add_action('admin_menu’, array($this, ‘cld_admin_menu’));1213 /**14 * Plugin Settings link in plugins screen15 *16 */17 add_filter(‘plugin_action_links_’ . CLD_BASENAME, array($this, ‘add_setting_link’));1819 /**20 * Settings save action21 */22 add_action('wp_ajax_cld_settings_save_action’, array($this, ‘save_settings’));23 add_action('wp_ajax_nopriv_cld_settings_save_action’, array($this, ‘no_permission’));2425 /**26 * Settings restore action27 */28 add_action('wp_ajax_cld_settings_restore_action’, array($this, ‘restore_settings’));29 add_action('wp_ajax_nopriv_cld_settings_restore_action’, array($this, ‘no_permission’));3031 /**32 * Add like dislike columns in comments section33 *34 * @since 1.0.535 */36 add_filter('manage_edit-comments_columns’, array($this, ‘add_like_dislike_column’));3738 /**39 * Display Like Dislike count in each column40 *41 * @since 1.0.542 */43 add_filter('manage_comments_custom_column’, array($this, ‘display_like_dislike_values’), 10, 2);4445 /**46 * Count Info Meta Box47 */48 add_action('add_meta_boxes’, array($this, ‘render_count_info_metabox’));4950 /**51 * Save comments like dislike meta box52 */53 add_action('edit_comment’, array($this, ‘save_cld_metabox’));54 }5556 function cld_admin_menu() {57 add_comments_page(__('Comments Like Dislike’, ‘comments-like-dislike’), __('Comments Like Dislike’, ‘comments-like-dislike’), 'manage_options’, 'comments-like-dislike’, array($this, ‘cld_settings’));58 }5960 function cld_settings() {61 include(CLD_PATH . ‘inc/views/backend/settings.php’);62 }6364 function save_settings() {65 if (isset($_POST[‘_wpnonce’]) && wp_verify_nonce($_POST[‘_wpnonce’], ‘cld-backend-ajax-nonce’)) {66 $_POST = stripslashes_deep($_POST);67 parse_str($_POST[‘settings_data’], $settings_data);68 foreach ($settings_data[‘cld_settings’] as $key => $val) {69 $cld_settings[$key] = array_map('sanitize_text_field’, $val);70 }71 /**72 * Fires before storing the settings array into database73 *74 * @param type array $settings_data - before sanitization75 * @param type array $cld_settings - after sanitization76 *77 * @since 1.0.078 */79 do_action('cld_before_save_settings’, $settings_data, $cld_settings);8081 /**82 * Filters the settings stored in the database83 *84 * @param type array $cld_settings85 *86 * @since 1.0.087 */88 update_option('cld_settings’, apply_filters('cld_settings’, $cld_settings));89 die(__('Settings saved successfully’, CLD_TD));90 } else {91 die(‘No script kiddies please!!’);92 }93 }9495 function no_permission() {96 die(‘No script kiddies please!!’);97 }9899 function restore_settings() {100 $default_settings = $this->get_default_settings();101 update_option('cld_settings’, $default_settings);102 die(__('Settings restored successfully.Redirecting…’, CLD_TD));103 }104105 /**106 * Adds settings link107 *108 * @since 1.0.0109 */110 function add_setting_link($links) {111 $settings_link = array(112 ‘<a href="’ . admin_url(‘edit-comments.php?page=comments-like-dislike’) . ‘">’ . __('Settings’, CLD_TD) . '</a>’,113 );114 return array_merge($links, $settings_link);115 }116117 function add_like_dislike_column($columns) {118 $cld_settings = $this->cld_settings;119 if (empty($cld_settings[‘basic_settings’][‘hide_like_dislike_admin’])) {120 $columns[‘cld_like_column’] = __('Likes’, ‘comments-like-dislike’);121 $columns[‘cld_dislike_column’] = __('Dislikes’, ‘comments-like-dislike’);122 }123 return $columns;124 }125126 function display_like_dislike_values($column, $comment_id) {127 if (‘cld_like_column’ == $column) {128 $like_count = get_comment_meta($comment_id, 'cld_like_count’, true);129 if (empty($like_count)) {130 $like_count = 0;131 }132 echo $like_count;133 }134 if (‘cld_dislike_column’ == $column) {135 $dislike_count = get_comment_meta($comment_id, 'cld_dislike_count’, true);136 if (empty($dislike_count)) {137 $dislike_count = 0;138 }139 echo $dislike_count;140 }141 }142143 function render_count_info_metabox() {144 add_meta_box('cld-count-info’, esc_html__('Comments Like Dislike’, ‘comments-like-dislike’), array($this, ‘render_count_info_html’), 'comment’, ‘normal’);145 }146147 function render_count_info_html($comment) {148 $comment_id = $comment->comment_ID;149 $like_count = get_comment_meta($comment_id, 'cld_like_count’, true);150 $dislike_count = get_comment_meta($comment_id, 'cld_dislike_count’, true);151 include(CLD_PATH . ‘/inc/views/backend/cld-metabox.php’);152 }153154 function save_cld_metabox($comment_id) {155 $nonce_name = isset($_POST[‘cld_metabox_nonce_field’]) ? $_POST[‘cld_metabox_nonce_field’] : '’;156 $nonce_action = 'cld_metabox_nonce’;157158 // Check if nonce is valid.159 if (!wp_verify_nonce($nonce_name, $nonce_action)) {160 return;161 }162163164 if (isset($_POST[‘cld_like_count’], $_POST[‘cld_dislike_count’])) {165 $cld_like_count = sanitize_text_field($_POST[‘cld_like_count’]);166 $cld_dislike_count = sanitize_text_field($_POST[‘cld_dislike_count’]);167 update_comment_meta($comment_id, 'cld_like_count’, $cld_like_count);168 update_comment_meta($comment_id, 'cld_dislike_count’, $cld_dislike_count);169 return $comment_id;170 } else {171 return $comment_id;172 }173 }174175 }176177 new CLD_Admin();178}