BuddyDev

Search

Magnific Popup version

  • Participant
    Level: Master
    Posts: 476
    Venutius on July 14, 2025 at 7:27 am #55636

    Hi Brajesh,

    What version of Magnific are you using?

    https://www.wordfence.com/threat-intel/vulnerabilities/detail/multiple-plugins-various-versions-authenticated-contributor-stored-dom-based-cross-site-scripting-via-magnific-popups-javascript-library

  • Keymaster
    (BuddyDev Team)
    Posts: 25076
    Brajesh Singh on July 14, 2025 at 8:34 am #55637

    Hi George,
    Thank you for pointing.
    I don’t think we will be affected by this but I am going to check it one more time(we have proper input/output serialization and js/html is not allowed for normal roles).

    Regards
    Brajesh

  • Keymaster
    (BuddyDev Team)
    Posts: 25076
    Brajesh Singh on July 14, 2025 at 9:42 am #55638

    Hi George,
    In our case, all the contents are sanitized before saving(BuddyPress handles commenting/post sanitization of activity entries) and we do not do much with the input. For the output, we have partially sanitized as the assumption is all inputs were sanitized while recording.

    This will only be problematic if something was imported via a script without using MediaPress functions. For now, I don’t see any reason for us to worry about it. I will update the lightbox in next release too.

    Regards
    Brajesh

  • Participant
    Level: Master
    Posts: 476
    Venutius on July 23, 2025 at 8:05 am #55660

    I had a full day programming yesterday and made great steps forward in terms of bug fixes and better overall integration and automation. I completed my standalone function to print those extra mmp photo fields, which means the next step is to hook into the uploader shortcode and other photo edit locations those fields.

    The first thing I need to do is change the file picker aspect of the uploader shortcode so that only a single file is pickable.

  • Keymaster
    (BuddyDev Team)
    Posts: 25076
    Brajesh Singh on July 28, 2025 at 8:49 pm #55663

    Hi George,
    I am happy you are having some great productive time.

    You can control that via javascript(or probably by filtering in php on the config generation for the uploaded).I am sorry but we have been mixing 1.5.x and 2.x, which version of the plugin you are using now? I can look into it and share the appropriate api.

    Regards
    Brajesh

You must be logged in to reply to this topic.

This topic is: not resolved