The only thing I could see on your site that I knew was coded by you guys, was the Twist of Ten theme, so I went to check out the code to see if there was anything odd in there, but it all seems fine bar a minor issue with the form validation of your admin page. But it's pretty minor and is a problem present in many other themes and plugins too so is highly unlikely to be causing the problem you experienced.
When validating forms like you have done in the functions.php, it's generally best to only pass the specific input fields you intended to enter through the validation function, whereas what you have done is to actually pass all of them without filtering except one.
So the following:
PHP Code:
// Sanitize and validate input. Accepts an array, return a sanitized array.
function tot_validate_options($input) {
// strip html from textboxes
$input['front_page_message'] = wp_filter_nohtml_kses($input['front_page_message']);
return $input;
}
Should look something like this (note how $input goes into the function, but $output is what is returned)
PHP Code:
// Sanitize and validate input. Accepts an array, return a sanitized array.
function tot_validate_options($input) {
// strip html from textboxes
$output['front_page_message'] = wp_filter_nohtml_kses($input['front_page_message']);
return $output;
}
You could also revalidate the options on serving them onto the admin page too, just in case something nasty was injected. Some people do this, some don't. And the skill level of those who don't is often quite high (ie: Otto). Personally I err on the side of caution and prefer to over-sanitize the heck out of things like this just in case I screw up somewhere else and can at least mitigate the damage done if something does get hacked. To revalidate them you would just change the following line in your functions.php file:
PHP Code:
<?php $options = get_option('tot_options'); ?>
to this:
PHP Code:
<?php $options = tot_validate_options( get_option('tot_options') ); ?>
As an aside (unrelated to security issues), you also use get_bloginfo( 'stylesheet_directory' ) whereas the recommended function is get_stylesheet_directory_uri() or get_stylesheet_directory() I think. You also have if ( ! function_exists( 'twistoften_setup' ) ): wrapped around one of your functions, which I find confusing since I wouldn't have thought that function would be present in anything but that theme.
LinkBack URL
About LinkBacks
Site Hacked
Reply With Quote
Originally Posted by dgwyer 
