Tagged: 

Viewing 9 posts - 1 through 9 (of 9 total)
  • Author
    Posts
  • February 15, 2019 at 3:32 pm #1067477
    adrianvanwyk

    Hi,

    I need to get in touch as soon as possible about a confirmed security is avia_wpml_language_switch as part of the Enfold theme.
    I understand this is included in this theme and it is currently in use on our site. I would rather not mention the details publicly, is there an address I can e-mail this problem?
    As I understand it, the problem is not present when using WPML without Enfold, but I’m not sure about this. I would like to discuss this with you directly.

    Regards

    February 15, 2019 at 3:34 pm #1067479
    adrianvanwyk

    Additional information: this problem is present in at least 4.4.1 through 4.5.4

    February 15, 2019 at 3:58 pm #1067488
    adrianvanwyk
    This reply has been marked as private.
    February 18, 2019 at 1:33 pm #1068347
    adrianvanwyk

    It is really important that we do get a response to this problem. Please contact us as soon as possible.

    February 18, 2019 at 10:47 pm #1068620
    Basilis

    Hi,

    We have forward the issue to our developers for review.

    Best regards,
    Basilis

    February 19, 2019 at 11:29 am #1068877
    Günter

    Hi,

    Thanks for reporting this.

    Please update line 278 and 279:

    
$output .= "<li class='language_" . $lang['language_code'] . " $currentlang'><a href='" . esc_url( $lang['url'] ) . "'>";
$output .= "	<span class='language_flag'><img title='" . $lang['native_name'] . "' src='". esc_url( $lang['country_flag_url'] ) . "' alt='" . $lang['native_name'] . "' /></span>";

    I added a pull request to our dev repo for the next update.

    Best regards,
    Günter

    February 19, 2019 at 12:06 pm #1068889
    adrianvanwyk

    Thanks for your response. I haven’t tested it yet but that fix does seem correct.

    I am worried about the state of the code in the rest of that file. Is a security review something that is on your agenda?

    February 20, 2019 at 3:14 pm #1069493
    Edwin

    I just responding to this topic because I created a personal account, rather than use an account I share with somebody else; I am the original starter of this topic.

    February 20, 2019 at 4:28 pm #1069523
    Günter

    Hey!

    I checked this file and fixed some more. Here is the updated file (Enfold 4.5.4):

    https://github.com/KriesiMedia/enfold-library/blob/master/temp_fixes/Enfold_4_5_4/WPML%20escape%20urls/config.php

    I added a pull request to our dev repo.

    Cheers!
    Günter

  • Author
    Posts
Viewing 9 posts - 1 through 9 (of 9 total)
  • You must be logged in to reply to this topic.