davidlrattigan

Okay, I tried it on another PC (in Chrome), and it worked. I will keep you updated – thanks!

Yes, I’ve disabled all my Chrome extensions. Going to try on another computer now.

Thanks for the prompt response and for the upcoming fix. Hopefully your response will be useful for other plugin users with the same concern.

Cheers!

Hi,

The reason I suspected it was vulnerable is because of this code:

private function settings_page_url() {
  $base =  $this->networkactive ? network_admin_url( 'settings.php' ) : admin_url( 'options-general.php' );
  return add_query_arg( 'page', 'disable_comments_settings', $base );
 }

and

`function filter_query() {
if( is_comment_feed() ) {
if( isset( $_GET[‘feed’] ) ) {
wp_redirect( remove_query_arg( ‘feed’ ), 301 );
exit;
}
`

According to the link in my first post, I should see esc_url() or esc_url_raw() before remove_query_arg and add_query_arg if they are secure.

Many thanks.

Hi, Alin,

Here is the error I get when I activate your plugin (IPs sanitized):

2013/12/21 19:09:07 [error] 24527#0: *23254 FastCGI sent in stderr: “PHP message: XML_ERR_NAME_REQUIRED at line 1, column 2
PHP message: Space required at line 6, column 39
PHP message: Mismatched tag at line 79, column 13″ while reading response header from upstream, client: 000.000.000.000, server: prescotonline.co.uk, request: “GET /wp-admin/plugins.php HTTP/1.1”, upstream: “fastcgi://unix:/var/run/prescotonline.co.uk.sock:”, host: “prescotonline.co.uk”, referrer: “https://prescotonline.co.uk/wp-admin/”
2013/12/21 19:09:28 [error] 24527#0: *23254 FastCGI sent in stderr: “PHP message: PHP Fatal error: Cannot redeclare class Google_DataServiceResource in /srv/www/prescotonline.co.uk/htdocs/wp-content/plugins/google-analytics-dashboard-for-wp/src/contrib/Google_AnalyticsService.php on line 27” while reading upstream, client: 000.000.000.000, server: prescotonline.co.uk, request: “GET /wp-admin/index.php HTTP/1.1”, upstream: “fastcgi://unix:/var/run/prescotonline.co.uk.sock:”, host: “prescotonline.co.uk”, referrer: “https://prescotonline.co.uk/wp-admin/plugins.php?activate=true&plugin_status=all&paged=1&s=”