Tailored Tools

3.0.3

• Security: fix a stored XSS in the form shortcodes. The class attribute (eg, [ContactForm class=”highlight”]) was written into the form tag unescaped, so any user who can add a shortcode could break out of the attribute. Class names are now sanitised and the form tag is escaped on output. Reported via Patchstack.
• Security: the Embed JS tool now requires the unfiltered_html capability rather than manage_options. The code it stores is printed to the page unescaped, and on multisite a site Administrator has manage_options without being trusted with raw HTML. Embed code is also recorded against the user who saved it and is only printed while that user still holds the capability, and the meta value is now protected so it cannot be set through the Custom Fields box or XML-RPC.
• Security: the form settings page was available to anyone with edit_posts, meaning contributors and authors could change the notification email address and the messages printed on the front end. Viewing logged enquiries is unchanged; saving and viewing settings now requires manage_options, and settings values are escaped when printed in the admin.
• Security: form error and success messages are filtered with wp_kses_post() before being printed on the front end, and the submitted value echoed back by the email-format check is now escaped as well.

NOTE: embed code saved before this release is no longer printed on multisite, or on any site that defines DISALLOW_UNFILTERED_HTML, until a user who holds unfiltered_html (a Super Admin on multisite) opens the page and saves it again. The Embed JS box shows a warning when this applies.

3.0.2

• Security: fix a stored XSS in the [tabs] shortcode. Tab content written by users without the unfiltered_html capability is now filtered through wp_kses_post() after HTML reconstruction. Reported via Patchstack.
• Security: fix a stored XSS in the [googlemap] shortcode. The class, width, height and zoom attributes were written into the map markup unescaped; they are now escaped and coerced on output.
• Security: fix content disclosure in the [pagecontent] shortcode. It would include any post ID regardless of status, exposing draft, pending, private, scheduled, trashed and password-protected content to visitors. Published posts are included as before; anything else now requires the viewer to have permission to read it.
• [pagecontent] no longer loops if a page includes itself, and uses get_post() instead of the deprecated get_page().
• [pagecontent] now actually implements the documented include_title=”yes” option, which was being parsed but never used. The title is added as an H2 with the class ‘pagecontent_title’. The readme previously described this option backwards.

3.0.1

• Add security disclosure policy (Patchstack Vulnerability Disclosure Program) link to FAQ

3.0.0

• Fix PHP8 errors & warnings
• Big version bump, official plugin hasn’t been updated in years, want to jump over any manual fixes for 2.x
• Add column styles (.one-half, .one-third, etc) to plugin stylesheet
• Fix some issues with Maps embed, remove the static image that requires API. The iframe seems to work.
• Embed JS tool (per-page for adding JS tracking code) now restricted to admin role only
• Fix email header injection vulnerability in contact form (Reply-To/Return-Path headers)
• Escape output in admin form-log list tables instead of relying on escaping at save time
• Fix form validation so the “last name” field is actually required on name-type fields

1.9.1

• Fix a namespace conflict

1.9.0

• Moved to git version control
• Update js.php files with finding wp-load for non-standard directories
• Some general fixups
• add a filter tailored_tools_disable_contact_form (return true to disable the default contact form, such as if you’re using Gravity Forms instead)