Skip to content

Commit f300736

Browse files
cryptoapicryptoapi
committed
Version 1.5.6
Security issue fixed. Mandatory Update!
1 parent 2f24aa2 commit f300736

File tree

4 files changed

+88
-30
lines changed

4 files changed

+88
-30
lines changed

‎gourl.php

Lines changed: 77 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ final class gourlclass
1010
private $hash_url = ""; // security; save your gourl public/private keys sha1 hash in file (db and file)
1111
private $errors = array(); // global setting errors
1212
private $payments = array(); // global activated payments (bitcoin, litecoin, etc)
13+
private $adminform = "gourl_adminform";
14+
private $admin_form_key = ""; // unique form key
1315

1416
private $options2 = array(); // pay-per-view settings
1517
private $options3 = array(); // pay-per-membership settings
@@ -78,11 +80,14 @@ public function __construct()
7880
// security data hash; you can change path / file location
7981
$this->hash_url = GOURL_PHP."/gourl.hash";
8082

83+
// admin form
84+
$this->adminform = "gourl_adminform_" . md5(sha1(AUTH_KEY.NONCE_KEY.AUTH_KEY));
85+
$this->admin_form_key = 'gourl_adminformkey_' . sha1(md5(AUTH_KEY.NONCE_KEY));
8186

8287
$this->coin_names = self::coin_names();
8388
$this->coin_chain = self::coin_chain();
84-
$this->coin_www = self::coin_www();
85-
$this->languages = self::languages();
89+
$this->coin_www = self::coin_www();
90+
$this->languages = self::languages();
8691

8792
// compatible test
8893
$ver = get_option(GOURL.'version');
@@ -892,12 +897,14 @@ private function get_settings()
892897
$txt = (is_readable($this->hash_url)) ? file_get_contents($this->hash_url) : "";
893898
$arr = json_decode($txt, true);
894899

900+
/*
895901
if (isset($arr["nonce"]) && $arr["nonce"] != sha1(md5(NONCE_KEY)))
896902
{
897903
$this->save_cryptokeys_hash(); // admin changed NONCE_KEY
898904
$txt = (is_readable($this->hash_url)) ? file_get_contents($this->hash_url) : "";
899905
$arr = json_decode($txt, true);
900906
}
907+
*/
901908

902909
foreach($this->coin_names as $k => $v)
903910
{
@@ -925,7 +932,8 @@ private function get_settings()
925932
* 20.
926933
*/
927934
private function post_settings()
928-
{
935+
{
936+
929937
foreach ($this->options as $key => $value)
930938
{
931939
$this->options[$key] = (isset($_POST[GOURL.$key])) ? stripslashes($_POST[GOURL.$key]) : "";
@@ -1046,7 +1054,8 @@ private function check_settings()
10461054
*/
10471055
private function save_settings()
10481056
{
1049-
$arr = array();
1057+
$arr = array();
1058+
$editable = (!file_exists($this->hash_url) || is_writable($this->hash_url)) ? true : false;
10501059

10511060
if (!(is_admin() && is_user_logged_in() && current_user_can('administrator')))
10521061
{
@@ -1058,21 +1067,23 @@ private function save_settings()
10581067
foreach ($this->options as $key => $value)
10591068
{
10601069
$boxkey = (strpos($key, "public_key") || strpos($key, "private_key")) ? true : false;
1061-
if (!(file_exists($this->hash_url) && !is_writable($this->hash_url) && $boxkey))
1070+
if ($editable || !$boxkey)
10621071
{
1063-
$oldval = get_option(GOURL.$key);
1072+
$oldval = get_option(GOURL.$key);
10641073
if ($boxkey && $oldval != $value) $arr[$key] = array("old_key" => ($oldval ? substr($oldval, 0, -20)."....." : "-empty-"), "new_key" => ($value ? substr($value, 0, -20)."....." : "-empty-"));
10651074
update_option(GOURL.$key, $value);
10661075
}
10671076
}
10681077

10691078
if ($arr)
1070-
{
1071-
wp_mail(get_bloginfo('admin_email'), 'Notification - GoUrl Bitcoin Payment Gateway Plugin - Cryptobox Keys Changed',
1072-
date("r")."\n\nGoUrl Bitcoin Payment Gateway for Wordpress plugin\n\nFollowing crypto payment box/es keys was changed on your website -\n\n".print_r($arr, true));
1079+
{
1080+
wp_mail(get_bloginfo('admin_email'), 'Notification - GoUrl Bitcoin Payment Gateway Plugin - Cryptobox Keys Changed',
1081+
date("r")."\n\nGoUrl Bitcoin Payment Gateway for Wordpress plugin\n\nFollowing crypto payment box/es keys was changed on your website -\n\n".print_r($arr, true));
1082+
1083+
$this->save_cryptokeys_hash();
10731084
}
10741085

1075-
$this->save_cryptokeys_hash();
1086+
10761087
}
10771088

10781089
return true;
@@ -1107,14 +1118,35 @@ private function save_cryptokeys_hash()
11071118
}
11081119

11091120

1121+
/*
1122+
* Notice for non-admin users
1123+
*/
1124+
private function is_nonadmin_user ()
1125+
{
1126+
if (!(is_admin() && is_user_logged_in() && current_user_can('administrator')))
1127+
{
1128+
$tmp = "<div class='wrap ".GOURL."admin'>";
1129+
$tmp .= $this->page_title(__('Admin Area', GOURL));
1130+
$tmp .= "<br><br><br><br><h2><center>".__('Only Admin users can access to this page !', GOURL)."</center></h2><br><br><br>";
1131+
$tmp .= "</div>";
1132+
1133+
echo $tmp;
1134+
1135+
return true;
1136+
}
1137+
else return false;
1138+
}
11101139

11111140

11121141

11131142
/*
11141143
* 24.
11151144
*/
11161145
public function page_settings()
1117-
{
1146+
{
1147+
1148+
if ($this->is_nonadmin_user()) return true;
1149+
11181150
$readonly = (file_exists($this->hash_url) && !is_writable($this->hash_url)) ? 'readonly' : '';
11191151

11201152
if ($readonly)
@@ -1173,7 +1205,8 @@ public function page_settings()
11731205
$tmp .= "<h3 class='hndle'>".__('General Settings', GOURL)."</h3>";
11741206
$tmp .= "<div class='inside'>";
11751207

1176-
$tmp .= '<input type="hidden" name="ak_action" value="'.GOURL.'save_settings" />';
1208+
$tmp .= '<input type="hidden" name="'.$this->adminform.'" value="'.GOURL.'save_settings" />';
1209+
$tmp .= wp_nonce_field( $this->admin_form_key );
11771210

11781211
$tmp .= '<p>'.sprintf(__( "If you use multiple websites online, please create separate <a target='_blank' href='%s'>GoUrl Payment Box</a> records (with unique payment box public/private keys) for each of your websites. Do not use the same GoUrl Payment Box with the same public/private keys on your different websites.", GOURL ), "https://gourl.io/editrecord/coin_boxes/0") . '</p>';
11791212
$tmp .= '<p>'.sprintf(__( "If you want to use plugin in a language other than English, see the page <a href='%s'>Languages and Translations</a>. &#160; This enables you to easily customize the texts of all the labels visible to your users.", GOURL ), "https://gourl.io/languages.html", "https://gourl.io/languages.html") . '</p>';
@@ -1684,6 +1717,7 @@ private function save_download()
16841717
*/
16851718
public function page_newfile()
16861719
{
1720+
if ($this->is_nonadmin_user()) return true;
16871721

16881722
$preview = ($this->id && isset($_GET["preview"]) && $_GET["preview"] == "true") ? true : false;
16891723

@@ -1727,7 +1761,8 @@ public function page_newfile()
17271761
$tmp .= "<h3 class='hndle'>".__(($this->id?'Edit file':'Upload New File, Music, Picture, Video'), GOURL)."</h3>";
17281762
$tmp .= "<div class='inside'>";
17291763

1730-
$tmp .= '<input type="hidden" name="ak_action" value="'.GOURL.'save_download" />';
1764+
$tmp .= '<input type="hidden" name="'.$this->adminform.'" value="'.GOURL.'save_download" />';
1765+
$tmp .= wp_nonce_field( $this->admin_form_key );
17311766

17321767
$tmp .= '<div class="alignright">';
17331768
$tmp .= '<img id="gourlsubmitloading" src="'.plugins_url('/images/loading.gif', __FILE__).'" border="0">';
@@ -1951,6 +1986,7 @@ public function page_files()
19511986
{
19521987
global $wpdb;
19531988

1989+
if ($this->is_nonadmin_user()) return true;
19541990

19551991
if (isset($_GET["intro"]))
19561992
{
@@ -2459,6 +2495,8 @@ private function save_view()
24592495
*/
24602496
public function page_view()
24612497
{
2498+
if ($this->is_nonadmin_user()) return true;
2499+
24622500
$example = 0;
24632501
$preview = (isset($_GET["preview"]) && $_GET["preview"] == "true") ? true : false;
24642502

@@ -2557,7 +2595,8 @@ public function page_view()
25572595
$tmp .= "<h3 class='hndle'>".__('Paid Access to Premium Webages for Unregistered Visitors', GOURL)."</h3>";
25582596
$tmp .= "<div class='inside'>";
25592597

2560-
$tmp .= '<input type="hidden" name="ak_action" value="'.GOURL.'save_view" />';
2598+
$tmp .= '<input type="hidden" name="'.$this->adminform.'" value="'.GOURL.'save_view" />';
2599+
$tmp .= wp_nonce_field( $this->admin_form_key );
25612600

25622601
$tmp .= '<div class="alignright">';
25632602
$tmp .= '<input type="submit" class="'.GOURL.'button button-primary" name="submit" value="'.__('Save Settings', GOURL).'">';
@@ -3281,6 +3320,8 @@ public function page_membership()
32813320
{
32823321
global $current_user;
32833322

3323+
if ($this->is_nonadmin_user()) return true;
3324+
32843325
$example = 0;
32853326
$preview = (isset($_GET["preview"]) && $_GET["preview"] == "true") ? true : false;
32863327

@@ -3396,7 +3437,8 @@ public function page_membership()
33963437
$tmp .= "<h3 class='hndle'>".__('Paid Access to Premium Pages for Registered Users', GOURL)."</h3>";
33973438
$tmp .= "<div class='inside'>";
33983439

3399-
$tmp .= '<input type="hidden" name="ak_action" value="'.GOURL.'save_membership" />';
3440+
$tmp .= '<input type="hidden" name="'.$this->adminform.'" value="'.GOURL.'save_membership" />';
3441+
$tmp .= wp_nonce_field( $this->admin_form_key );
34003442

34013443
$tmp .= '<div class="alignright">';
34023444
$tmp .= '<input type="submit" class="'.GOURL.'button button-primary" name="submit" value="'.__('Save Settings', GOURL).'">';
@@ -4017,6 +4059,8 @@ public function page_membership_users()
40174059
{
40184060
global $wpdb;
40194061

4062+
if ($this->is_nonadmin_user()) return true;
4063+
40204064
$dt = gmdate('Y-m-d H:i:s');
40214065

40224066
$search = "";
@@ -4104,6 +4148,8 @@ public function page_membership_user()
41044148
{
41054149
global $wpdb;
41064150

4151+
if ($this->is_nonadmin_user()) return true;
4152+
41074153
if ($this->record_errors) $message = "<div class='error'>".__('Please fix errors below:', GOURL)."<ul><li>- ".implode("</li><li>- ", $this->record_errors)."</li></ul></div>";
41084154
else $message = "";
41094155

@@ -4127,7 +4173,8 @@ public function page_membership_user()
41274173
$tmp .= "<h3 class='hndle'>".__('Manually create Premium Membership', GOURL)."</h3>";
41284174
$tmp .= "<div class='inside'>";
41294175

4130-
$tmp .= '<input type="hidden" name="ak_action" value="'.GOURL.'save_membership_newuser" />';
4176+
$tmp .= '<input type="hidden" name="'.$this->adminform.'" value="'.GOURL.'save_membership_newuser" />';
4177+
$tmp .= wp_nonce_field( $this->admin_form_key );
41314178

41324179
$tmp .= '<div class="alignright">';
41334180
$tmp .= '<img id="gourlsubmitloading" src="'.plugins_url('/images/loading.gif', __FILE__).'" border="0">';
@@ -4421,6 +4468,8 @@ public function save_product()
44214468
public function page_newproduct()
44224469
{
44234470

4471+
if ($this->is_nonadmin_user()) return true;
4472+
44244473
$preview = ($this->id && isset($_GET["preview"]) && $_GET["preview"] == "true") ? true : false;
44254474
$preview_final = ($this->id && isset($_GET["previewfinal"]) && $_GET["previewfinal"] == "true") ? true : false;
44264475
$preview_email = ($this->id && isset($_GET["previewemail"]) && $_GET["previewemail"] == "true") ? true : false;
@@ -4502,7 +4551,8 @@ public function page_newproduct()
45024551
$tmp .= "<h3 class='hndle'>".__($this->id?__('Edit Product', GOURL):__('Create New Product', GOURL))."</h3>";
45034552
$tmp .= "<div class='inside'>";
45044553

4505-
$tmp .= '<input type="hidden" name="ak_action" value="'.GOURL.'save_product" />';
4554+
$tmp .= '<input type="hidden" name="'.$this->adminform.'" value="'.GOURL.'save_product" />';
4555+
$tmp .= wp_nonce_field( $this->admin_form_key );
45064556

45074557
$tmp .= '<div class="alignright">';
45084558
$tmp .= '<img id="gourlsubmitloading" src="'.plugins_url('/images/loading.gif', __FILE__).'" border="0">';
@@ -4700,6 +4750,8 @@ public function page_products()
47004750
{
47014751
global $wpdb;
47024752

4753+
if ($this->is_nonadmin_user()) return true;
4754+
47034755
if (isset($_GET["intro"]))
47044756
{
47054757
$intro = intval($_GET["intro"]);
@@ -5073,7 +5125,9 @@ public function shortcode_product($arr, $preview_final = false)
50735125
public function page_payments()
50745126
{
50755127
global $wpdb;
5076-
5128+
5129+
if ($this->is_nonadmin_user()) return true;
5130+
50775131
$search = $sql_where = "";
50785132

50795133
if (isset($_GET["s"]) && trim($_GET["s"]))
@@ -5394,9 +5448,11 @@ public function admin_init()
53945448

53955449
// Actions POST
53965450

5397-
if (isset($_POST['ak_action']) && strpos($this->page, GOURL) === 0)
5451+
if (isset($_POST[$this->adminform]) && strpos($this->page, GOURL) === 0)
53985452
{
5399-
switch($_POST['ak_action'])
5453+
check_admin_referer( $this->admin_form_key );
5454+
5455+
switch($_POST[$this->adminform])
54005456
{
54015457
case GOURL.'save_settings':
54025458

@@ -5515,7 +5571,7 @@ public function admin_init()
55155571

55165572
// Actions GET
55175573

5518-
if (!isset($_POST['ak_action']) && strpos($this->page, GOURL) === 0 && is_admin() && is_user_logged_in() && current_user_can('administrator'))
5574+
if (!isset($_POST[$this->adminform]) && strpos($this->page, GOURL) === 0 && is_admin() && is_user_logged_in() && current_user_can('administrator'))
55195575
{
55205576

55215577
switch($this->page)

‎gourl_wordpress.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Plugin Name: GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership
44
Plugin URI: https://gourl.io/bitcoin-wordpress-plugin.html
55
Description: Official <a href="https://gourl.io">GoUrl.io</a> Bitcoin Payment Gateway for Wordpress. White Label Solution. Provides bitcoin/altcoin payment gateways for - WooCommerce, Paid Memberships Pro, bbPress, Give Donations, Pay-Per-View, Pay-Per-Download, etc. Accept Bitcoin, BitcoinCash, BitcoinSV, Litecoin, Dash, Dogecoin, etc payments online. No Chargebacks, Global, Secure. All in automatic mode.
6-
Version: 1.5.5
6+
Version: 1.5.6
77
Author: GoUrl.io
88
Author URI: https://gourl.io
99
WC requires at least: 2.1.0
@@ -33,7 +33,7 @@
3333

3434
DEFINE('GOURL', "gourl");
3535
DEFINE('GOURL_PREVIEW', "gourladmin");
36-
DEFINE('GOURL_VERSION', "1.5.5");
36+
DEFINE('GOURL_VERSION', "1.5.6");
3737
DEFINE('GOURL_ADMIN', admin_url("admin.php?page="));
3838
DEFINE('GOURL_DIR', $dir_arr["basedir"]."/".GOURL.'/');
3939
DEFINE('GOURL_DIR2', $dir_arr["baseurl"]."/".GOURL.'/');

‎readme.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership
33
-----------------------------------------------------------
44

5-
Version 1.5.5
5+
Version 1.5.6
66

77

88
**GoUrl Official Bitcoin/Altcoin Payment Gateway for Wordpress 3.5 or higher version**
@@ -17,7 +17,7 @@ Accept Bitcoin, BitcoinCash, BitcoinSV, Litecoin, Dash, Dogecoin, Speedcoin, Red
1717
* Instruction - [https://tishonator.com/blog/how-to-add-bitcoin-payment-to-your-woocommerce-store](https://tishonator.com/blog/how-to-add-bitcoin-payment-to-your-woocommerce-store)
1818
* Requires at least: 3.5
1919
* Tested up to: 5.5
20-
* Stable Tag: 1.5.5
20+
* Stable Tag: 1.5.6
2121
* License: GNU Version 2 or Any Later Version
2222

2323

‎readme.txt

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Author URI: https://gourl.io
66
Tags: bitcoin, accept bitcoin, bitcoin payments, bitcoin woocommerce, bitcoin wordpress plugin, bitcoin wordpress, bitcoin payments, bitcoincash, bitcoin cash, bitcoin sv, bitcoins, affiliate program, cryptocurrency, affiliates, altcoins, bitpay, paid memberships pro, pmpro, paid membership, btc, marketpress, coinbase, e-commerce, content protection, access-control, credit cards, currency, payment, dash, digital downloads, dogecoin, donation, downloads, e-downloads, e-store, easy digital downloads, ecommerce, feathercoin, universalcurrency, file download, gateway, gourl, litecoin, membership, paid content, payment gateway, paypal, potcoin, protection, reddcoin, registration, restrict access, restrict content, speedcoin, subscription, usd, vertcoin, virtual currency, jigoshop, woocommerce, authorize, shop, wp e-commerce, appthemes, classipress, vantage, jobroller, clipper, taskerr, hirebee, ideas, quality control, akismet, bbpress, buddypress, discussion, forums, forum, bitcoin donations, bitcoin donation, charity, churches, crowdfunding, donate, donation, donations, fundraiser, fundraising, gifts, giving, non-profit, nonprofit, paypal, stripe, give, wordpress donations, bitcoin, payments, payment gateway, digital downloads, download, downloads, e-commerce, e-downloads, e-store, ecommerce, eshop, selling, wp ecommerce, edd, easy digital downloads, litecoin, dogecoin, dash, speedcoin, vertcoin, reddcoin, feathercoin, potcoin, monetaryunit, peercoin, white label
77
Requires at least: 3.5
88
Tested up to: 5.5
9-
Stable Tag: 1.5.5
9+
Stable Tag: 1.5.6
1010
License: GNU Version 2 or Any Later Version
1111
License URI: http://www.gnu.org/licenses/gpl-2.0.html
1212

@@ -181,12 +181,14 @@ Yes, we offer [Free Technical Support](https://gourl.io/view/contact/Contact_Us.
181181
== Changelog ==
182182

183183

184+
= 1.5.6 =
185+
Security issue fixed. Mandatory Update!
186+
184187
= 1.5.5 =
185-
Several new enhancements. Mandatory Update!
188+
Several new enhancements
186189

187190
= 1.5.4 =
188-
* Security issue fixed
189-
* Several new enhancements
191+
Several new enhancements
190192

191193
= 1.5.3 =
192194
Update currencyconverterapi.com api
@@ -355,4 +357,4 @@ Add Pay-Per-Product, Pay-Per-Membership
355357

356358
= 1.0.0 =
357359
This is the first version of GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership Plugin
358-
360+

0 commit comments

Comments
 (0)