Skip to content

Commit 6ab4943

Browse files
authored
Merge pull request #1 from peterhebert/security/2025-08-path-traversal
Fixes to address path traversal vulnerability
2 parents e83fbd3 + 51387c2 commit 6ab4943

17 files changed

+1107
-552
lines changed

.distignore

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# A set of files you probably don't want in your WordPress.org distribution
2+
.*~
3+
.babelrc
4+
.circleci/config.yml
5+
.deployignore
6+
.distignore
7+
.DS_Store
8+
.editorconfig
9+
.eslintignore
10+
.eslintrc
11+
.git
12+
.github
13+
.gitignore
14+
.gitlab-ci.yml
15+
.phpcs.xml
16+
.phpcs.xml.dist
17+
.travis.yml
18+
*.sql
19+
*.tar.gz
20+
*.zip
21+
behat.yml
22+
bin
23+
bitbucket-pipelines.yml
24+
composer.json
25+
composer.lock
26+
dependencies.yml
27+
Gruntfile.js
28+
multisite.xml
29+
multisite.xml.dist
30+
node_modules
31+
package-lock.json
32+
package.json
33+
phpcs.xml
34+
phpcs.xml.dist
35+
phpunit.xml
36+
phpunit.xml.dist
37+
README.md
38+
tests
39+
Thumbs.db
40+
vendor
41+
webpack.config.js
42+
wp-cli.local.yml
43+
yarn.lock

.editorconfig

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# This file is for unifying the coding style for different editors and IDEs
2+
# editorconfig.org
3+
4+
# WordPress Coding Standards
5+
# https://make.wordpress.org/core/handbook/coding-standards/
6+
7+
root = true
8+
9+
[*]
10+
charset = utf-8
11+
end_of_line = lf
12+
insert_final_newline = true
13+
trim_trailing_whitespace = true
14+
indent_style = tab
15+
indent_size = 4
16+
17+
[{.jshintrc,*.json,*.yml}]
18+
indent_style = space
19+
indent_size = 2
20+
21+
[{*.txt,wp-config-sample.php}]
22+
end_of_line = crlf

.gitignore

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,11 @@
1-
/vendor/
1+
.DS_Store
2+
phpcs.xml
3+
phpunit.xml
4+
Thumbs.db
5+
wp-cli.local.yml
6+
node_modules/
7+
vendor/
8+
*.sql
9+
*.tar.gz
10+
*.zip
11+
composer.lock

README.md

Lines changed: 60 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,51 @@
11
# Custom Query Shortcode
2-
**Contributors:** peterhebert, shazdeh
2+
3+
**Contributors:** peterhebert, shazdeh
34
Plugin Name: Custom Query Shortcode
4-
**Tags:** query, shortcode, post
5-
**Requires at least:** 3.3
6-
**Tested up to:** 5.7
7-
**Stable tag:** 0.4.0
8-
**License:** GPLv2
9-
**License URI:** http://www.gnu.org/licenses/gpl-2.0.html
5+
**Tags:** query, shortcode, post \
6+
**Requires at least:** 3.3 \
7+
**Tested up to:** 6.8.2 \
8+
**Stable tag:** 0.5.0 \
9+
**License:** GPLv2 \
10+
**License URI:** http://www.gnu.org/licenses/gpl-2.0.html
1011

1112
A powerful shortcode that enables you to query anything you want and display it however you like, on both pages and posts, and in widgets.
1213

13-
1414
## Description
1515

16-
This plugin gives you a `[query]` shortcode which enables you to query and output any posts filtered by specific attributes.
17-
16+
This plugin gives you <code>[query]</code> shortcode which enables you to query and output any posts filtered by specific attributes.
1817

1918
### Usage
2019

21-
You can use all parameters supported by the [WP_Query](http://codex.wordpress.org/Class_Reference/WP_Query) class to filter the posts; you can query for specific post types, categories, tags, authors, etc.
22-
20+
You can use most parameters supported by <a href="http://codex.wordpress.org/Class_Reference/WP_Query">WP_Query class</a> to filter the posts; you can query for specific post types, categories, tags, authors, etc.
2321

2422
### Other supported parameters
2523

26-
Aside from [WP_Query parameters](https://codex.wordpress.org/Class_Reference/WP_Query#Parameters), the shortcode also supports the following additional parameters:
24+
Aside from WP_Query parameters, the shortcode also supports the following additional parameters:
2725

2826
* *featured*: to query for sticky posts which by default are excluded from the query.
2927
* *thumbnail_size*: to specify the size of the {THUMBNAIL} images. You can use <a href="http://codex.wordpress.org/Function_Reference/add_image_size#Reserved_Image_Size_Names">built-in image sizes</a> or custom ones you've defined.
3028
* *content_limit*: to limit the number of words of the {CONTENT} var; by default it's "0" which means it outputs the whole content.
3129
* *posts_separator*: text to display between individual posts.
3230
* *lens*: custom output template - see description below.
33-
* *twig_template*: output template using [Twig](https://twig.sensiolabs.org/) templating engine - requires the [Timber](https://github.com/timber/timber) library.
34-
31+
* *twig_template*: output template using Twig templating engine - requires the Timber library.
3532

3633
### Formatting the output
37-
You can define how you want to format the output inline within an opening `[query]` and closing `[/query]` tag.
3834

35+
You can define how you want to format the output inline within an opening <code>[query]</code> and closing <code>[/query]</code> tag.
3936
Available keywords are: TITLE, CONTENT, AUTHOR, AUTHOR_URL, DATE, THUMBNAIL, CONTENT, COMMENT_COUNT.
4037

4138
The following example will display the latest 5 posts from the category with the ID of 3, showing a post title and comment count, with a link to the post:
39+
<code>[query posts_per_page="5" cat="3"] <h3><a href="{URL}">{TITLE} ({COMMENT_COUNT})</a></h3> [/query]</code>
4240

43-
```
44-
[query posts_per_page="5" cat="3"]
45-
<h3><a href="{URL}">{TITLE} ({COMMENT_COUNT})</a></h3>
46-
[/query]
47-
```
48-
49-
##### Grid display
50-
41+
<h5>Grid display</h5>
5142
With the "cols" parameter you can display the output in a grid.
52-
53-
```
54-
[query posts_per_page="3" cols="3"]
55-
{THUMBNAIL}
56-
<h3>{TITLE}</h3>
57-
{CONTENT}
58-
[/query]
59-
```
60-
This example will display the latest 3 posts in the defined template, in 3 columns.
61-
43+
<code>[query posts_per_page="3" cols="3"] {THUMBNAIL} <h3>{TITLE}</h3> {CONTENT} [/query]</code>
44+
will display the latest 3 posts in the defined template, in 3 columns.
6245
The plugin will automatically divide the grid into rows based upon the 'posts_per_page' option, divided by the 'cols' option.
6346

6447
### Lenses (output templates)
48+
6549
With the "lens" parameter you can customize the display of the query results using a template. Some basic lenses/templates are provided:
6650

6751
* **ul**: unordered list of linked post titles.
@@ -70,111 +54,114 @@ With the "lens" parameter you can customize the display of the query results usi
7054
* **article-excerpt-date**: same as 'article-excerpt', but also displays the posted date.
7155
* **cards**: displays the post thumb above the header with linked post title, followed by the excerpt.
7256

73-
#### Bootstrap support
57+
<h5>Bootstrap lenses</h5>
58+
Some pre-defined lenses/templates are provided which use JavaScript Components from the <a href="http://getbootstrap.com/">Bootstrap</a> CSS framework. The generated markup is compliant with the 5.x version of Bootstrap.
7459

75-
Some pre-defined lenses/templates are provided which use JavaScript Components from the [Bootstrap](http://getbootstrap.com/) CSS framework.
60+
This feature relies on Bootstrap library to be already loaded on the page, the plugin does *not* include it.
7661

77-
This feature relies on the Bootstrap library to be already loaded on the page, the plugin does *not* include it.
78-
79-
If you're using a Bootstrap-based theme, this *should* work; otherwise you can use the [Bootstrap plugin](http://wordpress.org/extend/plugins/bootstrap/) for WordPress.
80-
81-
##### Bootstrap [Tabs](http://getbootstrap.com/javascript/#tabs)
62+
If you're using a Bootstrap-based theme, this *should* work; otherwise you can use the <a href="http://wordpress.org/extend/plugins/bootstrap/">Bootstrap plugin</a>).
8263

64+
<h6><a href="http://getbootstrap.com/javascript/#tabs">Tabs</a></h6>
8365
This will show the latest 3 posts in a tabbed widget.
66+
<code>[query posts_per_page="3" lens="tabs"]</code>
8467

85-
```
86-
[query posts_per_page="3" lens="tabs"]
87-
```
88-
89-
90-
##### Bootstrap [Accordion](http://getbootstrap.com/javascript/#collapse-example-accordion)
91-
68+
<h6><a href="http://getbootstrap.com/javascript/#tabs">Accordion</a></h6>
9269
This will create an accordion widget of all our posts from the "faq" post type.
70+
<code>[query posts_per_page="0" post_type="faq" lens="accordion"]</code>
9371

94-
```
95-
[query posts_per_page="0" post_type="faq" lens="accordion"]
96-
```
97-
98-
###### Bootstrap [Carousel](http://getbootstrap.com/javascript/#carousel)
99-
72+
<h6><a href="http://getbootstrap.com/javascript/#carousel">Carousel</a></h6>
10073
This creates a carousel of latest five featured posts:
74+
<code>[query posts_per_page="5" featured="true" lens="carousel"]</code>
10175

102-
```
103-
[query posts_per_page="5" featured="true" lens="carousel"]
104-
```
105-
106-
#### Custom Lenses/templates
107-
76+
<h5>Custom Lenses/templates</h5>
10877
You can create your own custom templates and put them into one of these pre-defined folder names within your theme:
10978

11079
* 'query-shortcode-templates'
11180
* 'partials/query-shortcode-lenses/'
11281
* 'html/lenses/'
11382

11483
Or simply specify your own subfolder in the 'lens' parameter:
115-
116-
```
117-
[query lens="folder/template-name"]
118-
```
84+
<code>[query lens="folder/template-name"]</code>
11985

12086
### Twig Template Support
121-
Starting with version 0.4, you can use [Twig](https://twig.sensiolabs.org/) templates for your output. Support for Twig is provided by the [Timber](https://github.com/timber/timber) library.
12287

123-
This requires that Timber be [installed as a plugin](https://en-ca.wordpress.org/plugins/timber-library/) or [included in your theme](http://timber.github.io/timber/#getting-started).
88+
Starting with version 0.4, you can use Twig templates for your output. Support for Twig is provided by the <a href="https://github.com/timber/timber">Timber</a> library.
89+
90+
This requires that Timber 2.x be installed as a <a href="https://timber.github.io/docs/v2/installation/installation/">Composer dependency</a>.
91+
92+
To use a Twig template for your query output, simply use the &#39;twig_template&#39; parameter instead of the &#39;lens&#39; parameter, and provide the path to your template. By default, Timber looks within the <code>views</code> folder in your active theme. You can <a href="https://timber.github.io/docs/v2/guides/template-locations/#changing-the-default-folder-for-twig-files">change the default template location</a> in Timber.
12493

125-
To use a Twig template for your query output, simply use the 'twig_template' parameter instead of the 'lens' parameter, and provide the path to your template:
94+
Examples:
12695

127-
```
96+
<pre><code>
97+
[query twig_template="template-name.twig"]
12898
[query twig_template="folder/template-name.twig"]
129-
```
99+
</code></pre>
130100

131101
## Installation
132102

133103
1. Upload the whole plugin directory to the `/wp-content/plugins/` directory
134104
2. Activate the plugin through the 'Plugins' menu in WordPress
135-
3. Now use the `[query]` shortcode anywhere you want.
105+
3. Now use <code>[query]</code> shortcode anywhere you want.
136106
4. Enjoy!
137107

138108

109+
139110
## Frequently Asked Questions
140111

141112
no questions have been asked yet.
142113

143-
144114
## Screenshots
145115

146116
### 1. Example of shortcode syntax
147-
![Example of shortcode syntax](https://ps.w.org/custom-query-shortcode/assets/screenshot-1.png)
117+
118+
[missing image]
119+
148120

149121
## Changelog
150122

123+
### 0.5.0
124+
125+
* Security release - fixes to address path traversal vulnerability as noted in CVE-2025-8562.
126+
* Added localization template .pot
127+
151128
### 0.4.0
152-
* Added Twig templating support via the Timber Library
129+
130+
* Added Twig templating support via the Timber Library - note we do not include Timber with this plugin.
153131

154132
### 0.3
133+
155134
* Added a new directory to search for lenses within the current theme - 'query-shortcode-templates'
156135
* Revamped readme.txt documentation
157136

158137
### 0.2.5
138+
159139
* Changed lens 'ul', removing post date. I also added lens 'ul-title-date', which is the equivalent of the previous 'ul' lens.
160140

161141
### 0.2.4
142+
162143
* Added lens 'ul', presenting an unordered list of query results with post date displayed.
163144

164145
### 0.2.3
146+
165147
* Added lens 'article-excerpt-date', which is the same as 'article-excerpt', except with the post date displayed.
166148

167149
### 0.2.2
150+
168151
* Added a filter to allow shortcodes within widget areas, which makes this plugin a lot more useful.
169152

170153
### 0.2.1.1
154+
171155
* Added a second directory to search for lenses within the current theme - 'partials/custom-query-lenses'.
172156

173157
### 0.2.1
158+
174159
* Added posts_separator parameter.
175160

176161
### 0.2
162+
177163
* Added Lens functionality. Now you can build tabs, accordions, and carousels (and build custom ones) out of queried posts. Relies on Twitter Bootstrap framework.
178164

179165
## Upgrade Notice
166+
180167
Upgrades are handled just like any other WordPress plugin.

composer.json

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"name": "peterhebert/custom-query-shortcode",
3+
"description": "A WordPress plugin that provides a shortcode to perform queries of your content.",
4+
"type": "wordpress-plugin",
5+
"license": "GPL-2.0",
6+
"authors": [
7+
{
8+
"name": "Peter Hebert",
9+
"email": "[email protected]"
10+
}
11+
],
12+
"minimum-stability": "stable",
13+
"require-dev": {
14+
"wp-cli/i18n-command": "^2",
15+
"wpreadme2markdown/wp2md": "^4.1"
16+
},
17+
"scripts": {
18+
"makepot": "wp i18n make-pot .",
19+
"readme": "wp2md -i readme.txt -o README.md"
20+
}
21+
}

0 commit comments

Comments
 (0)