version 1.0.8

Author: yanniks

README.md

@@ -1,6 +1,6 @@
 # Shariff for WordPress
 
-This is the Shariff sharing plugin by Heise Zeitschriften Verlag / c't modified for WordPress.
+This is the Shariff for WordPress plugin based on c't Shariff.
 
 From the original Shariff GitHub project:
 

release.sh

@@ -1,4 +1,4 @@
-version=1.0.7
+version=1.0.8
 if [ "$1" = "zip" ]; then
 	rm -rf shariff-wp
 	mkdir -p shariff-wp

src/readme.txt

@@ -1,17 +1,19 @@
 === Shariff for Wordpress ===
 Contributors: yanniks
-Tags: sharing, social, networks, network, privacy, facebook, twitter, google, whatsapp, linkedin, heise
+Tags: sharing, social, networks, network, privacy, facebook, twitter, google, whatsapp, linkedin, heise, pinterest
 Requires at least: 3.0
 Tested up to: 4.0.1
-Stable tag: 1.0.7
+Stable tag: 1.0.8
 License: MIT
 License URI: http://opensource.org/licenses/MIT
 
 Shariff enables website users to share their favorite content without compromising their privacy.
 
 == Description ==
 
-This is the Shariff sharing plugin by Heise Zeitschriften Verlag / c't updated for WordPress.
+This is the Shariff for WordPress plugin based on c't Shariff.
+
+For more information, check out the original [GitHub project](https://github.com/heiseonline/shariff) and the [c’t information page](http://ct.de/shariff).
 
 > Shariff enables website users to share their favorite content without compromising their privacy.
 
@@ -42,8 +44,13 @@ Select which color you want, set the button location, select the orientation fit
 
 **Method B:** Include `hideshariff` in the article. The word will be removed automatically and Shariff will not be shown. If you want to write hidesharrif in an article without removing Shariff, just write `/hideshariff`.
 
+= Shariff doesn't show any numbers =
+Your user probably doesn't have the right to write to the default temp folder `/tmp`. Then create a new folder and use it as temp folder in the Shariff settings, make sure that the rights are set correct.
 == Changelog ==
 
+= 1.0.8 =
+* security fix
+
 = 1.0.7 =
 * upstream changes
 * possibility to manually change temp dir

src/shariff-wp.php

@@ -93,11 +93,11 @@ function shariffsharing($content) {
 				}
 			}
 		} else {
-			$image = get_option('shariff_image','');
+			$image = filter_var(get_option('shariff_image',''), FILTER_SANITIZE_STRING);
 		}
 	}
 	if (!((strpos($content,'hideshariff') !== false) && (strpos($content,'/hideshariff') == false)) && !(get_post_meta($post->ID, 'shariff_enabled', true))) {
-		$content2 .= '<div class="shariff" data-backend-url="'.plugins_url( 'backend/index.php', __FILE__ ).'" data-temp="'.get_option('shariff_temp',"/tmp").'" data-ttl="'.get_option('shariff_ttl',"60").'" data-service="'.$serv.'" data-services=\''.$services.'\' data-image="'.$image.'" data-url="'.get_permalink().'" data-lang="'.__('en', 'shariff').'" data-theme="'.get_option('shariff_color',"colored").'" data-orientation="'.get_option('shariff_orientation',"horizontal").'"></div>';
+		$content2 .= '<div class="shariff" data-backend-url="'.plugins_url( 'backend/index.php', __FILE__ ).'" data-temp="'.filter_var(get_option('shariff_temp',"/tmp"),FILTER_SANITIZE_STRING).'" data-ttl="'.filter_var(get_option('shariff_ttl',"60"),FILTER_SANITIZE_STRING).'" data-service="'.$serv.'" data-services=\''.$services.'\' data-image="'.$image.'" data-url="'.get_permalink().'" data-lang="'.__('en', 'shariff').'" data-theme="'.get_option('shariff_color',"colored").'" data-orientation="'.get_option('shariff_orientation',"horizontal").'"></div>';
 	}
 	if (get_option('shariff_beforeafter','before') != 'after') {
 		$content2 .= $content;
@@ -178,7 +178,7 @@ function setting_pinterest_callback() {
  	checkbox_setting('shariff_pinterest','Pinterest',false);
 }
 function setting_imageurl() {
-	echo '<input type="text" name="shariff_image" value="'.get_option('shariff_image','').'"> '.__('Used for services such as Pinterest','shariff');
+	echo '<input type="text" name="shariff_image" value="'.filter_var(get_option('shariff_image',''), FILTER_SANITIZE_STRING).'"> '.__('Used for services such as Pinterest','shariff');
 }
 function setting_whatsapp_callback() {
  	checkbox_setting('shariff_whatsapp','WhatsApp',false);
@@ -200,10 +200,10 @@ function setting_orientation_callback() {
 		</select>';
 }
 function setting_ttl_callback() {
-	echo '<input type="number" name="shariff_ttl" value="'.get_option("shariff_ttl","60").'">';
+	echo '<input type="number" name="shariff_ttl" value="'.filter_var(get_option("shariff_ttl","60"),FILTER_SANITIZE_STRING).'">';
 }
 function setting_temp_callback() {
-	echo '<input type="text" name="shariff_temp" value="'.get_option("shariff_temp","/tmp").'">';
+	echo '<input type="text" name="shariff_temp" value="'.filter_var(get_option("shariff_temp","/tmp"),FILTER_SANITIZE_STRING).'">';
 }
 function setting_color_callback() {
 	echo '<select name="shariff_color">