ProSolution WP Client

2.0.17

• UPDATE:
  • Fix “WordPress.Security.ValidatedSanitizedInput.MissingUnslash” (unslash then sanitize remaining $_GET/$_POST/$_SERVER reads)
  • Fix “WordPress.Security.ValidatedSanitizedInput.InputNotSanitized” (sanitize keyed $_GET/$_POST/$_SERVER/$_SESSION reads; structure-preserving session restore)
  • Fix WordPress.DB.DirectDatabaseQuery.DirectQuery (centralized DB accessor with object-cache invalidation on sync/site removal)
  • [prosolfrontend type="result"] on additional-site URLs (?siteid=): leftover job_search_result session is no longer reused across tenants, so the list shows that site’s jobs instead of master (site_id 0)
  • Result list sort now uses the current site’s dessortby / dessortbyorder (cold GET no longer always publishdate DESC; leftover search session no longer keeps the wrong direction, e.g. name DESC while Staging is set to name ASC)
  • Direct job deep-links ?type=details&jobid=<id> (optional siteid) open the job details page again without requiring _wpnonce or searchlist (WOEX-5051). Full nonce-bearing links still work. Apply, fromjoblist, searchlist restore, crawler uuid, and admin/sync nonces are unchanged. Unpublished jobs still require a valid woexPreview UUID (PS-039).

2.0.16

• UPDATE:
  • Fix “WordPress.DB.PreparedSQL.InterpolatedNotPrepared”

2.0.15

• SECURITY:
  • Fix stored / second-order ORDER BY SQL injection on the public job-search path: allowlist *dessortbyorder to ASC/DESC only at save time and when building the frontend job list query; reject time-based payloads such as (SELECT SLEEP(3)) and fall back to a safe default
  • Fix stored XSS via design-template desmaincolor: validate main color at save time and sanitize with proSol_escCssColor() before rendering into public job search, details, and apply <style> blocks so CSS-context breakout payloads cannot execute; legitimate hex/RGB/named colors still apply
    Special thanks to Nir Yehoshua of Cipher Security Labs and CHOIGYEONGMIN (Wordfence), who discovered and responsibly disclosed these vulnerabilities.

2.0.14

• FIXED Bug:
  • [prosolfrontend type="result"] with ProSolution design + recruitment: cold load unfolds the job list again via shortcode-driven render (no nonce-less fromjoblist redirect)
  • Fix PHP 8 critical error on that path when DB job JSON columns (customer, etc.) were pre-decoded and the search form called json_decode() on arrays
  • Shortcode no longer starts a PHP session during REST/admin editor renders (avoids breaking the block editor via PHPSESSID on JSON)

2.0.13

• FIXED Bug:
  • Job details page no longer fatals on PHP 8 when a job image exists on disk but is not a valid image (or getimagesize cannot read it). Custom display size is skipped instead of dividing by zero.

2.0.12

• SECURITY:
  • Fix Plugin Check WordPress.Security.EscapeOutput.OutputNotEscaped
  • Fix Plugin Check WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQueryWithPlaceholder
  • Fix Plugin Check WordPress.Security.NonceVerification.Recommended