CVE-2015-10117 (PHP, published 2023-06-06T02:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 5966a5e6343e3d5610bdfa126a5cfbae95e629b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230664.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/gravity-forms-dps-pxpay
Files changed:
gravityforms-dps-pxpay.php
includes/class.GFDpsPxPayAdmin.php
includes/class.GFDpsPxPayFeedAdmin.php
includes/class.GFDpsPxPayPayment.php
includes/class.GFDpsPxPayPlugin.php
includes/class.GFDpsPxPayResult.php
readme.md
readme.txt
views/metabox-save.php
views/requires-extensions.php
Commit message: gravity-forms-dps-pxpay 1.4.3: XSS, error handling, new hooks

git-svn-id: https://plugins.svn.wordpress.org/gravity-forms-dps-pxpay/trunk@1150713 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Version: 1.4.2
copyright (c) 2013-2014 WebAware Pty Ltd (email : support@webaware.com.au)
define('GFDPSPXPAY_PLUGIN_VERSION', '1.4.2');
			$settings_link = sprintf('<a href="%s">Settings</a>', admin_url('admin.php?page=gf_settings&subview=DPS+PxPay'));
			$links[] = '<a href="http://wordpress.org/support/plugin/gravity-forms-dps-pxpay">' . __('Get help') . '</a>';
			$links[] = '<a href="http://wordpress.org/plugins/gravity-forms-dps-pxpay/">' . __('Rating') . '</a>';
		$feedsURL = 'edit.php?post_type=' . GFDPSPXPAY_TYPE_FEED;
		echo "<a href=\"$feedsURL\">Click to return to list</a>.\n";
				$actions['entries'] = sprintf('<a href="%s" title="%s">%s</a>',
					add_query_arg(array('page' => 'gf_entries', 'id' => $feed->FormID), admin_url('admin.php')), 'View Entries', 'Entries');
			$this->isValid = ('1' === ((string) $xml['valid']));
			$this->paymentURL = (string) $xml->URI;
			throw new GFDpsPxPayException('Error parsing DPS PxPay generate response: ' . $e->getMessage());
		// if response is "invalid", throw error with message given in URI field
			throw new GFDpsPxPayException('Error from DPS PxPay generate response: ' . $this->paymentURL);
		if ($this->paymentURL) {
			// NB: GF handles redirect via JavaScript if headers already sent, or AJAX
			$confirmation = array('redirect' => $this->paymentURL);
			self::log_debug('Payment Express request valid, redirecting...');

			$this->paymentURL = false;
		}

		elseif ($this->errorMessage) {
			$this->errorMessage = false;
							wp_redirect($feed->UrlFail);
					wp_redirect(add_query_arg(array(self::PXPAY_RETURN => base64_encode($query)), $lead['source_url']));
			throw new GFDpsPxPayException('Error parsing DPS PxPay result request: ' . $e->getMessage());
* [Download](http://wordpress.org/plugins/gravity-forms-dps-pxpay/)
* [Documentation](http://wordpress.org/plugins/gravity-forms-dps-pxpay/faq/)
* [Support](http://wordpress.org/support/plugin/gravity-forms-dps-pxpay)
Tested up to: 4.2
Stable tag: 1.4.2
* creation of this plugin was generously sponsored by [IstanbulMMV](http://profiles.wordpress.org/IstanbulMMV/profile/)
	<a class="submitdelete deletion" href="<?php echo get_delete_post_link($post->ID); ?>"><?php echo $delete_text; ?></a><?php
	<?php foreach ($missing as $ext): if (!extension_loaded($ext)): ?>
		<li><?php echo $ext; ?></li>
	<?php endif; endforeach; ?>

Fixed code:
Version: 1.4.3
copyright (c) 2013-2015 WebAware Pty Ltd (email : support@webaware.com.au)
define('GFDPSPXPAY_PLUGIN_VERSION', '1.4.3');
			$settings_link = sprintf('<a href="%s">Settings</a>', esc_url(admin_url('admin.php?page=gf_settings&subview=DPS+PxPay')));
			$links[] = '<a href="https://wordpress.org/support/plugin/gravity-forms-dps-pxpay">' . __('Get help') . '</a>';
			$links[] = '<a href="https://wordpress.org/plugins/gravity-forms-dps-pxpay/">' . __('Rating') . '</a>';
		$output = array();

		$feedsURL = admin_url('edit.php?post_type=' . GFDPSPXPAY_TYPE_FEED);
		printf('<a href="%s">Click to return to list</a>', esc_url($feedsURL));
				$url = add_query_arg(array('page' => 'gf_entries', 'id' => $feed->FormID), admin_url('admin.php'));
				$actions['entries'] = sprintf('<a href="%s" title="%s">%s</a>', esc_url($url), 'View Entries', 'Entries');
	protected $errorMessage;

			if ('1' === ((string) $xml['valid'])) {
				$this->isValid = true;
				$this->paymentURL = (string) $xml->URI;

				if (empty($this->paymentURL)) {
					$this->isValid = false;

					$this->errorMessage = (string) $xml->ResponseText;
					if (empty($this->errorMessage)) {
						$this->errorMessage = 'no hosted page URI given';
					}
				}
			}
			else {
				$this->isValid = false;
				$this->errorMessage = (string) $xml->ResponseText;
				if (empty($this->errorMessage)) {
					// API 1.0 passed error message in URI
					$this->errorMessage = (string) $xml->URI;

					if (empty($this->errorMessage)) {
						$this->errorMessage = 'invalid request';
					}
				}
			}
			throw new GFDpsPxPayException('Error parsing DPS PxPay request: ' . $e->getMessage());
		// if response is "invalid", throw error with message
			throw new GFDpsPxPayException('Error from DPS PxPay request: ' . $this->errorMessage);
				self::log_debug($this->errorMessage);
			self::log_debug($this->errorMessage);
		if ($this->errorMessage) {
		}
		elseif ($this->paymentURL) {
			// NB: GF handles redirect via JavaScript if headers already sent, or AJAX
			$confirmation = array('redirect' => $this->paymentURL);
			self::log_debug('Payment Express request valid, redirecting to: ' . $this->paymentURL);
		// reset transient members
		$this->errorMessage = false;
		$this->paymentURL = false;

					do_action('gfdpspxpay_process_return_parsed', $lead, $form, $feed);

							wp_redirect(esc_url_raw($feed->UrlFail));
					$redirect_url = esc_url_raw(add_query_arg(array(self::PXPAY_RETURN => base64_encode($query)), $lead['source_url']));
					wp_redirect($redirect_url);
				do_action('gfdpspxpay_process_confirmation_parsed', $lead, $form);

			throw new GFDpsPxPayException('Error parsing DPS PxPay result: ' . $e->getMessage());
* [Download](https://wordpress.org/plugins/gravity-forms-dps-pxpay/)
* [Documentation](https://wordpress.org/plugins/gravity-forms-dps-pxpay/faq/)
* [Support](https://wordpress.org/support/plugin/gravity-forms-dps-pxpay)
Tested up to: 4.2.1
Stable tag: 1.4.3
* creation of this plugin was generously sponsored by [IstanbulMMV](https://profiles.wordpress.org/IstanbulMMV/profile/)
= 1.4.3, 2015-05-01 =

* fixed: error reporting when initial request fails, e.g. with API key error
* fixed: error handling logic with redirect as confirmation
* added: some more precautionary XSS prevention steps
* added: action `gfdpspxpay_process_return_parsed` with `$lead`, `$form`, `$feed`
* added: action `gfdpspxpay_process_confirmation_parsed` with `$entry`, `$form`

	<a class="submitdelete deletion" href="<?php echo esc_url(get_delete_post_link($post->ID)); ?>"><?php echo $delete_text; ?></a><?php
	<?php foreach ($missing as $ext): ?>
		<li><?php echo esc_html($ext); ?></li>
	<?php endforeach; ?>