To whom it might concern…

A very good analyze here.

Another issue I accidentally found, due to some net issues: You need to declare the jquery dependency on all your scripts containing jQuery (which are not depending on scripts that are already depending on jQuery). This is a set of errors that do not typically occur on a local machine, since the loading time is very small, but if you test it on a live website on slow connection, you’ll see what I mean.

Here’s the list of scripts that need the dependency:

adverts-multiselect     => wpadverts.php:137
adverts-frontend        => wpadverts.php:192,194
adverts-frontend-add.js => wpadverts.php:195
adverts-admin           => wpadverts.php:195:238
adverts-admin-updates   => wpadverts.php:241

You’re welcome.

1. adverts_request(), the purpose of this function is not to escape user submitted data it is intended to easily retrieve user submitted data without generating any notices or warnings.

The data is escaped before displaying it on page or in the form or before saving it in DB. In other words as far as the SQL Injection and XSS goes the plugin is pretty well secured, of course there is no 100% guarantee , but while testing myself i was not able to find any issue here.

2. i’ll check jQuery dependencies thanks.

1. Always escape user data first thing after you get it. Than decide what you do with it.
2. You are using this function in way too many places to keep track of, at least when it’s so much as stake.
3. I found at least one place where you are querying the database with the contents of user input without escaping it: shortcodes.php line 47.

My advice in regard to your own piece of mind and maybe that of your users, escape that input. When security related, do not hope and will. Do.

4. Keep looking on the bright side of life. I’m with you on that one, really.

___________

And, since we’re here, do you have any idea why after installing your plugin WP no longer returns the auto-generated excerpts, on advert_category (tax pages), even after I add_post_type_support('advert', 'exceprt'). It only returns the manual excerpts, if set. Link to the full context in Iurie’s post, above.

It really bugs me, as I wasn’t able to find the reason.

Yet.

Cheers!

1,2. this is not true, if user submits ad description in HTML should i first escape and then unescape it?

In the plugin i have functions that are responsible for handling user submitted data and this functions make sure that submitted data is not dangerous.
3. this is not true again, try doing search for “Test ‘) OR 1” this will not break the plugin as WP_Query is escaping params before querying DB. With your customized adverts_request() function i would have data escaped twice and some unexpected results in search at best.

The only case when my adverts_request() function is unsafe is when i am querying DB directly using $wpdb->query() function, but i do not have any code that does this.

Either way in the next version i will add adverts_request filter in the plugin and you will be able to apply your sanitize functions to this query.

No offence, but unless you can find actual loophole in the code i do not really feel like discussing this further.

—

On advert-category pages i am using kind of a hack to display the list because by default WordPress will use archive.php or taxonomy.php which will completely ignore WPAdverts styling for adverts list and use it’s own layout to list ads.

You can disable this hack by adding following code to your theme functions.php

add_action("init", "twentytwelve_for_wpadverts_init", 20);
function twentytwelve_for_wpadverts_init() {
    remove_filter('template_include', 'adverts_template_include');
}

Next in your theme directory create file taxonomy-advert_category.php copy to it content from either taxonomy.php or archive.php, usually it will have something like

<?php if ( have_posts() ) : ?>
...
<?php endif; ?>

remove all this code and replace it with

<?php
    global $wp_query;
    remove_filter("the_content", "adverts_the_content");
    echo shortcode_adverts_list(array(
        "category" => $wp_query->get_queried_object_id()
    ));
?>

This should make the plugin work like on a page with [adverts_list] shortcode. Here is https://dl.dropboxusercontent.com/u/30001999/snippets/twentytwelve-for-wpadverts.zip a working example of TwentyTwelve child theme that has this implemented properly.