WordPress.org
Get WordPress

Plugin Directory

Changeset 3467709


Ignore:
Timestamp:
02/23/2026 12:45:16 PM (7 days ago)
Author:
webtoffee
Message:

[Fix] - Fixed coding standards and security issues flagged by WordPress Plugin Check.

Location:
alt-text-generator
Files:
15 added
4 edited

Legend:

Unmodified
Added
Removed

  • alt-text-generator/trunk/includes/class-uninstall-feedback.php

    r3390619 r3467709  
    11<?php
    2 if (!class_exists('WY_AltTextGenerator_Uninstall_Feedback')) :
     2if ( ! defined( 'ABSPATH' ) ) exit;
     3if (!class_exists('Atgai_Uninstall_Feedback')) :
    34
    45    /**
    … …  
    78     * @package AltTextGenerator
    89     */
    9     class WY_AltTextGenerator_Uninstall_Feedback {
     10    class Atgai_Uninstall_Feedback {
    1011
    1112        /**
    … …  
    179180                        $('#alt-text-generator-modal').on('click', 'a.review-and-deactivate', function (e) {
    180181                            e.preventDefault();
    181                             window.open("https://wordpress.org/support/plugin/alt-text-generator/reviews/?filter=5#new-post", "_blank", "noopener,noreferrer");
     182                            window.open("https://wordpress.org/support/plugin/alt-text-generator/#new-topic-0", "_blank", "noopener,noreferrer");
    182183                            window.location.href = deactivateLink;
    183184                        });
    … …  
    257258
    258259            // Check nonce
    259             if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'atgai_uninstall_feedback_nonce')) {
     260            if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'atgai_uninstall_feedback_nonce')) {
    260261                wp_send_json_error(array('message' => 'Nonce verification failed'));
    261262                wp_die();
    … …  
    269270
    270271            $allowed_reasons = array('used-it', 'could-not-understand', 'found-better-plugin', 'not-have-that-feature', 'is-not-working', 'other', 'none');
    271             $reason_id = sanitize_text_field($_POST['reason_id']);
     272            $reason_id = sanitize_text_field(wp_unslash($_POST['reason_id']));
    272273           
    273274            if (!in_array($reason_id, $allowed_reasons, true)) {
    … …  
    279280            $reason_info = '';
    280281            if (isset($_POST['reason_info'])) {
    281                 $reason_info = sanitize_textarea_field($_POST['reason_info']);
     282                $reason_info = sanitize_textarea_field(wp_unslash($_POST['reason_info']));
    282283                // Limit length to prevent abuse
    283284                if (strlen($reason_info) > 1000) {
    … …  
    289290            $server_software = '';
    290291            if (isset($_SERVER['SERVER_SOFTWARE'])) {
    291                 $server_software = sanitize_text_field($_SERVER['SERVER_SOFTWARE']);
     292                $server_software = sanitize_text_field(wp_unslash($_SERVER['SERVER_SOFTWARE']));
    292293            }
    293294
    … …  
    308309                'languages' => sanitize_text_field(implode(",", get_available_languages())),
    309310                'theme' => sanitize_text_field(wp_get_theme()->get('Name')),
    310                 'plugin_version' => sanitize_text_field(PLUGIN_VERSION),
     311                'plugin_version' => sanitize_text_field(ATGAI_PLUGIN_VERSION),
    311312                'multisite' => is_multisite() ? 'Yes' : 'No'
    312313            );
    … …  
    331332
    332333    // Initialize the uninstall feedback class
    333     new WY_AltTextGenerator_Uninstall_Feedback();
     334    new Atgai_Uninstall_Feedback();
    334335
    335336endif;

  • alt-text-generator/trunk/index.php

    r3429595 r3467709  
    22
    33/**
    4  * Plugin Name: AltTextGenerator AI
     4 * Plugin Name: Alt Text Generator AI - Auto Generate & Bulk Update Alt Texts For Images
    55 * Description: This plugin automatically identifies the images that don't have alt texts in your image library and will auto generate them using our AI Computer Vision model and bulk update them for you with a single click.
    6  * Version: 1.8.5
     6 * Version: 1.8.6
    77 * Author: WebToffee
    88 * Author URI: https://www.webtoffee.com
     9 * License: GPLv2 or later
     10 * License URI: http://www.gnu.org/licenses/gpl-2.0.html
    911 */
    1012
    1113if (!defined('ABSPATH')) exit;
    1214
    13 define('PLUGIN_VERSION', '1.8.5');
    14 define('API_URL', 'https://api.alttextgenerator.ai/api');
     15define('ATGAI_PLUGIN_VERSION', '1.8.6');
     16define('ATGAI_API_URL', 'https://api.alttextgenerator.ai/api');
    1517//define('API_URL', 'http://localhost:4000/api');
    1618
    … …  
    3436        wp_enqueue_script(
    3537            'atgai-plugin-main',
    36             plugin_dir_url(__FILE__) . 'build/index.js?v=' . PLUGIN_VERSION,
     38            plugin_dir_url(__FILE__) . 'build/index.js?v=' . ATGAI_PLUGIN_VERSION,
    3739            $asset['dependencies'],
    38             PLUGIN_VERSION,
     40            ATGAI_PLUGIN_VERSION,
    3941            true
    4042        );
    … …  
    4547            plugin_dir_url(__FILE__) . 'build/index.css',
    4648            array(),
    47             PLUGIN_VERSION,
     49            ATGAI_PLUGIN_VERSION,
    4850            'all'
    4951        );
    … …  
    5658            plugin_dir_url(__FILE__) . 'build/media-button.js',
    5759            array(),
    58             PLUGIN_VERSION,
     60            ATGAI_PLUGIN_VERSION,
    5961            true
    6062        );
    … …  
    165167}
    166168
     169// Add settings link on plugin page
     170function atgai_plugin_action_links($links) {
     171    $settings_link = '<a href="' . get_admin_url(null, 'admin.php?page=atgai-admin') . '">' . esc_html__('Settings', 'alt-text-generator') . '</a>';
     172    $support_link = '<a href="https://wordpress.org/support/plugin/alt-text-generator/#new-topic-0" target="_blank">' . esc_html__('Support', 'alt-text-generator') . '</a>';
     173   
     174    array_unshift($links, $support_link);
     175    array_unshift($links, $settings_link);
     176   
     177    return $links;
     178}
     179add_filter('plugin_action_links_' . plugin_basename(__FILE__), 'atgai_plugin_action_links');
     180
    167181// AJAX action to fetch images
    168182add_action('wp_ajax_atgai_fetch_images', 'atgai_fetch_images');
    … …  
    178192
    179193    // Check nonce
    180     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'fetch_images_nonce')) {
     194    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'fetch_images_nonce')) {
    181195        wp_send_json_error(array('message' => 'Nonce verification failed'));
    182196        wp_die();
    … …  
    184198
    185199    // Sanitize the input, default to 'all' if no filter set
    186     $filter = isset($_POST['filter']) ? sanitize_text_field($_POST['filter']) : 'all';
     200    $filter = isset($_POST['filter']) ? sanitize_text_field(wp_unslash($_POST['filter'])) : 'all';
    187201
    188202    // Validate the filter against allowed values
    … …  
    221235        'post_status' => 'inherit',
    222236        'posts_per_page' => -1,
    223         'meta_query' => array(
     237        'meta_query' => array( // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query
    224238            array(
    225239                'key' => '_wp_attachment_metadata',
    … …  
    279293
    280294    // Check nonce
    281     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'fetch_images_nonce')) {
     295    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'fetch_images_nonce')) {
    282296        wp_send_json_error(array('message' => 'Nonce verification failed'));
    283297        wp_die();
    … …  
    350364
    351365    // Check nonce
    352     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'set_api_key_nonce')) {
     366    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'set_api_key_nonce')) {
    353367        wp_send_json_error(array('message' => 'Nonce verification failed'));
    354368        wp_die();
    … …  
    356370
    357371    // Validate API key input
    358     if (!isset($_POST['api_key']) || empty(trim($_POST['api_key']))) {
     372    if (!isset($_POST['api_key']) || empty(trim(sanitize_text_field(wp_unslash($_POST['api_key']))))) {
    359373        wp_send_json_error(array('message' => 'API key is required'));
    360374        wp_die();
    361375    }
    362376
    363     $api_key = sanitize_text_field($_POST['api_key']);
     377    $api_key = sanitize_text_field(wp_unslash($_POST['api_key']));
    364378
    365379    //verify api key
    366     $response = wp_remote_get(API_URL . '/user', array(
     380    $response = wp_remote_get(ATGAI_API_URL . '/user', array(
    367381        'headers' => array('API-Key' => $api_key),
    368382        'timeout' => 30,
    … …  
    383397    // get site domain
    384398    $site_url = get_site_url();
    385     $domain = parse_url($site_url, PHP_URL_HOST);
     399    $domain = wp_parse_url($site_url, PHP_URL_HOST);
    386400   
    387401    // Sanitize domain
    … …  
    393407
    394408    // set domain id
    395     $domain_response = wp_remote_post(API_URL . '/website', array(
     409    $domain_response = wp_remote_post(ATGAI_API_URL . '/website', array(
    396410        'headers' => array(
    397411            'API-Key' => $api_key,
    … …  
    434448
    435449    // Check nonce
    436     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'set_api_key_nonce')) {
     450    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'set_api_key_nonce')) {
    437451        wp_send_json_error(array('message' => 'Nonce verification failed'));
    438452        wp_die();
    … …  
    456470
    457471    // Check nonce
    458     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'set_api_key_nonce')) {
     472    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'set_api_key_nonce')) {
    459473        wp_send_json_error(array('message' => 'Nonce verification failed'));
    460474        wp_die();
    … …  
    477491
    478492    // Check nonce
    479     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'set_api_key_nonce')) {
     493    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'set_api_key_nonce')) {
    480494        wp_send_json_error(array('message' => 'Nonce verification failed'));
    481495        wp_die();
    … …  
    515529
    516530    // Check nonce
    517     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'set_api_key_nonce')) {
     531    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'set_api_key_nonce')) {
    518532        wp_send_json_error(array('message' => 'Nonce verification failed'));
    519533        wp_die();
    … …  
    523537        // Check if each parameter exists and update only if it does
    524538        if (isset($_POST['language'])) {
    525             $language = sanitize_text_field($_POST['language']);
     539            $language = sanitize_text_field(wp_unslash($_POST['language']));
    526540            // Validate language against allowed values
    527541            $allowed_languages = array('English', 'Spanish', 'French', 'German', 'Italian', 'Portuguese', 'Dutch', 'Russian', 'Chinese', 'Japanese', 'Korean');
    … …  
    533547        if (isset($_POST['auto_generate'])) {
    534548            // Validate boolean value
    535             $auto_generate = sanitize_text_field($_POST['auto_generate']);
     549            $auto_generate = sanitize_text_field(wp_unslash($_POST['auto_generate']));
    536550            if ($auto_generate === 'true' || $auto_generate === 'false') {
    537551                update_option('atgai_auto_generate', $auto_generate);
    … …  
    541555        if (isset($_POST['enable_chatgpt_enhancement'])) {
    542556            // Validate boolean value
    543             $enable_enhancement = sanitize_text_field($_POST['enable_chatgpt_enhancement']);
     557            $enable_enhancement = sanitize_text_field(wp_unslash($_POST['enable_chatgpt_enhancement']));
    544558            if ($enable_enhancement === 'true' || $enable_enhancement === 'false') {
    545559                update_option('atgai_enable_chatgpt_enhancement', $enable_enhancement);
    … …  
    548562       
    549563        if (isset($_POST['chatgpt_enhancement_prompt'])) {
    550             $prompt = sanitize_textarea_field($_POST['chatgpt_enhancement_prompt']);
     564            $prompt = sanitize_textarea_field(wp_unslash($_POST['chatgpt_enhancement_prompt']));
    551565            // Limit prompt length to prevent abuse
    552566            if (strlen($prompt) <= 1000) {
    … …  
    577591
    578592    // Check nonce
    579     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'update_image_alt_text_nonce')) {
     593    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'update_image_alt_text_nonce')) {
    580594        wp_send_json_error(array('message' => 'Nonce verification failed'), 403);
    581595        wp_die();
    … …  
    588602    }
    589603
    590     $image_id = intval($_POST['image_id']);
     604    $image_id = intval(wp_unslash($_POST['image_id']));
    591605   
    592606    // Verify attachment exists and is an image
    … …  
    604618
    605619    // Sanitize alt text
    606     $new_alt_text = isset($_POST['alt_text']) ? sanitize_text_field($_POST['alt_text']) : '';
     620    $new_alt_text = isset($_POST['alt_text']) ? sanitize_text_field(wp_unslash($_POST['alt_text'])) : '';
    607621   
    608622    // Limit alt text length to prevent abuse
    … …  
    638652        if (!$domain_id) { 
    639653            $site_url = get_site_url();
    640             $domain = parse_url($site_url, PHP_URL_HOST);
    641             $domain_response = wp_remote_post(API_URL . '/website', array(
     654            $domain = wp_parse_url($site_url, PHP_URL_HOST);
     655            $domain_response = wp_remote_post(ATGAI_API_URL . '/website', array(
    642656                'headers' => array(
    643657                    'API-Key' => $api_key,
    … …  
    697711    // Get site domain
    698712    $site_url = get_site_url();
    699     $domain = parse_url($site_url, PHP_URL_HOST);
     713    $domain = wp_parse_url($site_url, PHP_URL_HOST);
    700714   
    701715    // Get image details
    … …  
    724738   
    725739    // Send request to generate alt text
    726     $response = wp_remote_post(API_URL . '/image', array(
     740    $response = wp_remote_post(ATGAI_API_URL . '/image', array(
    727741        'headers' => array(
    728742            'API-Key' => $api_key,
    … …  
    734748   
    735749    if (is_wp_error($response)) {
    736         error_log('Alt Text Generator AI: Alt text generation failed - ' . $response->get_error_message());
     750        // error_log('Alt Text Generator AI: Alt text generation failed - ' . $response->get_error_message());
    737751        return;
    738752    }
    … …  
    756770       
    757771        // Mark as updated in the API (non-blocking)
    758         wp_remote_post(API_URL . '/image', array(
     772        wp_remote_post(ATGAI_API_URL . '/image', array(
    759773            'method' => 'PATCH',
    760774            'headers' => array(
    … …  
    769783        ));
    770784    } else {
    771         error_log('Alt Text Generator AI: Invalid response from API');
     785        // error_log('Alt Text Generator AI: Invalid response from API');
    772786    }
    773787}
    … …  
    784798
    785799    // Check nonce
    786     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'set_api_key_nonce')) {
     800    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'set_api_key_nonce')) {
    787801        wp_send_json_error(array('message' => 'Nonce verification failed'));
    788802        wp_die();
    … …  
    790804
    791805    $site_url = get_site_url();
    792     $domain = parse_url($site_url, PHP_URL_HOST);
     806    $domain = wp_parse_url($site_url, PHP_URL_HOST);
    793807   
    794808    // Sanitize domain
    … …  
    812826
    813827    // Check nonce
    814     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'set_api_key_nonce')) {
     828    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'set_api_key_nonce')) {
    815829        wp_send_json_error(array('message' => 'Nonce verification failed'));
    816830        wp_die();
    … …  
    823837    }
    824838   
    825     $response = wp_remote_get(API_URL . '/user', array(
     839    $response = wp_remote_get(ATGAI_API_URL . '/user', array(
    826840        'headers' => array('API-Key' => $api_key),
    827841        'timeout' => 30,
    … …  
    871885
    872886    // Check nonce
    873     if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'generate_alt_text_nonce')) {
     887    if (!isset($_POST['nonce']) || !wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'])), 'generate_alt_text_nonce')) {
    874888        wp_send_json_error(array('message' => 'Nonce verification failed'), 403);
    875889        wp_die();
    … …  
    883897
    884898    // Get image ID
    885     $image_id = intval($_POST['image_id']);
     899    $image_id = intval(wp_unslash($_POST['image_id']));
    886900   
    887901    // Verify attachment exists and is an image
    … …  
    930944
    931945    // Send request to generate alt text
    932     $response = wp_remote_post(API_URL . '/image', array(
     946    $response = wp_remote_post(ATGAI_API_URL . '/image', array(
    933947        'headers' => array(
    934948            'API-Key' => $api_key,
    … …  
    981995    $api_response_id = isset($response_data['imageInfo']['_id']) ? sanitize_text_field($response_data['imageInfo']['_id']) : '';
    982996    if (!empty($api_response_id)) {
    983         wp_remote_post(API_URL . '/image', array(
     997        wp_remote_post(ATGAI_API_URL . '/image', array(
    984998            'method' => 'PATCH',
    985999            'headers' => array(

  • alt-text-generator/trunk/readme.txt

    r3429595 r3467709  
    55Tested up to: 6.9
    66Requires PHP: 5.6
    7 Stable tag: 1.8.5
     7Stable tag: 1.8.6
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    6767== Changelog ==
    6868
     69= 1.8.6 =
     70[Fix] - Fixed coding standards and security issues flagged by WordPress Plugin Check.
     71
    6972= 1.8.5 =
    7073Compatibility: Tested OK with WordPress version 6.9
    … …  
    102105== Upgrade Notice ==
    103106
    104 = 1.8.5 =
    105 Compatibility: Tested OK with WordPress version 6.9
     107= 1.8.6 =
     108[Fix] - Fixed coding standards and security issues flagged by WordPress Plugin Check.

  • alt-text-generator/trunk/uninstall.php

    r3253129 r3467709  
    77
    88// Delete all plugin options
    9 $options_to_delete = array(
     9$atgai_options_to_delete = array(
    1010    'atgai_api_key',
    1111    'atgai_language',
    … …  
    1616);
    1717
    18 foreach ($options_to_delete as $option) {
    19     delete_option($option);
     18foreach ($atgai_options_to_delete as $atgai_option) {
     19    delete_option($atgai_option);
    2020}
    2121
Note: See TracChangeset for help on using the changeset viewer.