Released Spectra 2.15.1

brainstormforce · Aug 6, 2024 · f732bea · f732bea
2 parents e41735d + 3f45095
commit f732bea
Show file tree

Hide file tree

Showing 12 changed files with 40 additions and 20 deletions.
diff --git a/README.md b/README.md
@@ -5,7 +5,7 @@
 **Requires at least:** 5.6  
 **Requires PHP:** 7.4  
 **Tested up to:** 6.6  
-**Stable tag:** 2.15.0  
+**Stable tag:** 2.15.1  
 **License:** GPLv2 or later  
 **License URI:** https://www.gnu.org/licenses/gpl-2.0.html  
 
@@ -215,6 +215,9 @@ Our external packages use [Rating Star Component](https://github.com/n49/react-s
 
 ## Changelog ##
 
+### 2.15.1 - Tuesday, 6th August 2024 ###
+* This update addressed a security bug. Props to Patchstack for privately reporting it to our team. Please make sure you are using the latest version on your website.
+
 ### 2.15.0 - Thursday, 1st August 2024 ###
 * Improvement: Container - Added an order option for grid layout to set the order in which the inner container should be.
 * Improvement: Info Box - Added an overall border option.

diff --git a/blocks-config/faq/class-uagb-faq.php b/blocks-config/faq/class-uagb-faq.php
@@ -1306,13 +1306,14 @@ public function faq_render_icon( $icon, $class ) {
 		 */
 		public function render_faq_child_block( $attributes, $content, $block ) {
 			// Extract attributes.
-			$block_id    = isset( $attributes['block_id'] ) ? $attributes['block_id'] : '';
-			$question    = $attributes['question'];
-			$answer      = $attributes['answer'];
-			$icon        = isset( $attributes['icon'] ) ? $attributes['icon'] : 'plus';
-			$icon_active = isset( $attributes['iconActive'] ) ? $attributes['iconActive'] : 'minus';
-			$layout      = $attributes['layout'];
-			$heading_tag = $attributes['headingTag'];
+			$block_id              = isset( $attributes['block_id'] ) ? $attributes['block_id'] : '';
+			$question              = $attributes['question'];
+			$answer                = $attributes['answer'];
+			$icon                  = isset( $attributes['icon'] ) ? $attributes['icon'] : 'plus';
+			$icon_active           = isset( $attributes['iconActive'] ) ? $attributes['iconActive'] : 'minus';
+			$layout                = $attributes['layout'];
+			$array_of_allowed_HTML = array( 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'span', 'p' );
+			$heading_tag           = UAGB_Helper::title_tag_allowed_html( $attributes['headingTag'], $array_of_allowed_HTML, 'span' );
 
 			// Render icon and active icon.
 			$icon_output        = $this->faq_render_icon( $icon, 'uagb-icon' );

diff --git a/classes/class-uagb-loader.php b/classes/class-uagb-loader.php
@@ -86,7 +86,7 @@ public function define_constants() {
 			define( 'UAGB_BASE', plugin_basename( UAGB_FILE ) );
 			define( 'UAGB_DIR', plugin_dir_path( UAGB_FILE ) );
 			define( 'UAGB_URL', plugins_url( '/', UAGB_FILE ) );
-			define( 'UAGB_VER', '2.15.0' );
+			define( 'UAGB_VER', '2.15.1' );
 			define( 'UAGB_MODULES_DIR', UAGB_DIR . 'modules/' );
 			define( 'UAGB_MODULES_URL', UAGB_URL . 'modules/' );
 			define( 'UAGB_SLUG', 'spectra' );

diff --git a/dist/blocks.asset.php b/dist/blocks.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-url'), 'version' => 'f0638d97af9d555f44a0f550da337f30');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-api-fetch', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-core-data', 'wp-data', 'wp-date', 'wp-dom-ready', 'wp-element', 'wp-hooks', 'wp-html-entities', 'wp-i18n', 'wp-keyboard-shortcuts', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-rich-text', 'wp-url'), 'version' => 'e6db36cfa7e3f3e968af6d1e1a88af58');
diff --git a/dist/blocks.js b/dist/blocks.js
diff --git a/languages/ultimate-addons-for-gutenberg.pot b/languages/ultimate-addons-for-gutenberg.pot
@@ -2,19 +2,20 @@
 # This file is distributed under the same license as the Spectra plugin.
 msgid ""
 msgstr ""
-"Project-Id-Version: Spectra 2.15.0\n"
+"Project-Id-Version: Spectra 2.15.1\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/ultimate-addons-for-gutenberg\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <[email protected]>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"POT-Creation-Date: 2024-07-31T15:35:05+00:00\n"
+"POT-Creation-Date: 2024-08-02T13:54:07+00:00\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"X-Generator: WP-CLI 2.9.0\n"
+"X-Generator: WP-CLI 2.10.0\n"
 "X-Domain: ultimate-addons-for-gutenberg\n"
 
 #. Plugin Name of the plugin
+#: ultimate-addons-for-gutenberg.php
 #: admin-core/inc/admin-menu.php:135
 #: admin-core/inc/admin-menu.php:136
 #: admin-core/inc/admin-menu.php:147
@@ -28,14 +29,17 @@ msgstr ""
 
 #. Plugin URI of the plugin
 #. Author URI of the plugin
+#: ultimate-addons-for-gutenberg.php
 msgid "https://www.brainstormforce.com"
 msgstr ""
 
 #. Description of the plugin
+#: ultimate-addons-for-gutenberg.php
 msgid "The Spectra extends the Gutenberg functionality with several unique and feature-rich blocks that help build websites faster."
 msgstr ""
 
 #. Author of the plugin
+#: ultimate-addons-for-gutenberg.php
 msgid "Brainstorm Force"
 msgstr ""
 

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ultimate-addons-for-gutenberg",
-  "version": "2.15.0",
+  "version": "2.15.1",
   "description": "The Ultimate Addons for Gutenberg extends the Gutenberg functionality with several unique and feature-rich blocks that help build websites faster.",
   "author": "Brainstorm Force",
   "license": "ISC",

diff --git a/readme.txt b/readme.txt
@@ -5,7 +5,7 @@ Tags: gutenberg, blocks, gutenberg blocks, editor, block
 Requires at least: 5.6
 Requires PHP: 7.4
 Tested up to: 6.6
-Stable tag: 2.15.0
+Stable tag: 2.15.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -215,6 +215,9 @@ Our external packages use [Rating Star Component](https://github.com/n49/react-s
 
 == Changelog ==
 
+= 2.15.1 - Tuesday, 6th August 2024 =
+* This update addressed a security bug. Props to Patchstack for privately reporting it to our team. Please make sure you are using the latest version on your website.
+
 = 2.15.0 - Thursday, 1st August 2024 =
 * Improvement: Container - Added an order option for grid layout to set the order in which the inner container should be.
 * Improvement: Info Box - Added an overall border option.

diff --git a/src/blocks/faq-child/render.js b/src/blocks/faq-child/render.js
@@ -16,6 +16,11 @@ const Render = ( props ) => {
 	const { attributes, setAttributes, state, isSelected } = props;
 	const { question, answer, icon, iconActive, layout, headingTag, block_id } = attributes;
 
+
+	// Reset the heading tag to it's default if it somehow has a value other than the valid tag types.
+	const validHeadingTags = [ 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'span', 'p' ];
+	const childHeadingTag = validHeadingTags.includes( headingTag ) ? headingTag : 'span';
+
 	const faqRenderIcon = () => {
 		return (
 			<>
@@ -31,7 +36,7 @@ const Render = ( props ) => {
 				<div className="uagb-faq-questions-button uagb-faq-questions">
 					{ 'accordion' === layout && faqRenderIcon() }
 					<RichText
-						tagName={ 'span' !== headingTag ? headingTag : 'div' }
+						tagName={ 'span' !== childHeadingTag ? childHeadingTag : 'div' }
 						placeholder={ __( 'Question', 'ultimate-addons-for-gutenberg' ) }
 						value={ question }
 						onChange={ ( value ) => setAttributes( { question: value } ) }

diff --git a/src/blocks/faq/edit.js b/src/blocks/faq/edit.js
@@ -114,11 +114,15 @@ const FaqComponent = ( props ) => {
 
 	}, [] );
 
+	// A list of all the valid heading tags.
+	const validHeadingTags = [ 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'span', 'p' ];
+
 	useEffect( () => {
 		const getChildBlocks = select( 'core/block-editor' ).getBlocks( clientId );
 
+		// Set all the FAQ child heading types based on the current heading type if it's valid, else set to span.
 		getChildBlocks.forEach( ( faqChild ) => {
-			faqChild.attributes.headingTag = attributes.headingTag;
+			faqChild.attributes.headingTag = validHeadingTags.includes( attributes.headingTag ) ? attributes.headingTag : 'span';
 		} );
 
 		// Use Effect Case to Update the Defaults for Backward Compatible Attributes that don't have a Default.

diff --git a/ultimate-addons-for-gutenberg.php b/ultimate-addons-for-gutenberg.php
@@ -4,7 +4,7 @@
  * Plugin URI: https://www.brainstormforce.com
  * Author: Brainstorm Force
  * Author URI: https://www.brainstormforce.com
- * Version: 2.15.0
+ * Version: 2.15.1
  * Description: The Spectra extends the Gutenberg functionality with several unique and feature-rich blocks that help build websites faster.
  * Text Domain: ultimate-addons-for-gutenberg
  * Domain Path: /languages