release: fixes

- Improved security by escaping shortcode attribute before render
- Compatibility with PHP 8.2

Author: vytisbulkevicius

classes/Visualizer/Module.php

@@ -270,7 +270,7 @@ private function _getCSV( $rows, $filename, $enclose ) {
 
 		$bom = chr( 0xEF ) . chr( 0xBB ) . chr( 0xBF );
 		// phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
-		$fp = @tmpfile();
+		$fp = function_exists( 'tmpfile' ) ? @tmpfile() : null;
 		if ( null === $fp ) {
 			$fp = fopen( wp_tempnam(), 'w+' );
 		}

classes/Visualizer/Module/Admin.php

@@ -883,7 +883,7 @@ private function getQuery() {
 		$this->getDisplayFilters( $query_args );
 
 		// Added by Ash/Upwork
-		$filterByMeta = filter_input( INPUT_GET, 's', FILTER_SANITIZE_STRING );
+		$filterByMeta = ! empty( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 		if ( $filterByMeta ) {
 			$query                    = array(
 				'key'     => Visualizer_Plugin::CF_SETTINGS,

classes/Visualizer/Module/Frontend.php

@@ -305,6 +305,11 @@ public function renderChart( $atts ) {
 			$atts
 		);
 
+		$atts['id']        = (int) $atts['id'];
+		$atts['class']     = esc_attr( $atts['class'] );
+		$atts['lazy']      = esc_attr( $atts['lazy'] );
+		$atts['use_image'] = esc_attr( $atts['use_image'] );
+
 		global $sitepress;
 		if ( Visualizer_Module::is_pro() && ( function_exists( 'icl_get_languages' ) && $sitepress instanceof \SitePress ) ) {
 			global $sitepress;

classes/Visualizer/Render/Library.php

@@ -216,10 +216,7 @@ private function getDisplayForm() {
 	 */
 	private function _renderLibrary() {
 		// Added by Ash/Upwork
-		$filterBy = null;
-		if ( isset( $_GET['s'] ) && strlen( $_GET['s'] ) > 0 ) {
-			$filterBy = filter_input( INPUT_GET, 's', FILTER_SANITIZE_STRING );
-		}
+		$filterBy = ! empty( $_GET['s'] ) ? sanitize_text_field( wp_unslash( $_GET['s'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 		// Added by Ash/Upwork
 		echo $this->custom_css;
 		echo '<div id="visualizer-types" class="visualizer-clearfix">';

classes/Visualizer/Source/Csv.php

@@ -47,8 +47,8 @@ class Visualizer_Source_Csv extends Visualizer_Source {
 	 * @access public
 	 * @param string $filename The path to the file.
 	 */
-	public function __construct( $filename = null ) {
-		$this->_filename = trim( $filename );
+	public function __construct( $filename = '' ) {
+		$this->_filename = trim( (string) $filename );
 	}
 
 	/**