CVE-2012-10011 (published 2023-04-09T22:15Z)

A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the function hd_add_media/hd_update_media of the file functions.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 34d66b9f3231a0e2dc0e536a6fe615d736e863f7. It is recommended to upgrade the affected component. VDB-225350 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/wp-plugins/contus-hd-flv-player
commit_details: repo_url: https://github.com/wp-plugins/contus-hd-flv-player
author: hdflvplayer
author_date: 2012-07-24 08:31:46+00:00
msg: vulnerabilities issues fixed in trunk folder

git-svn-id: https://plugins.svn.wordpress.org/contus-hd-flv-player/trunk@576511 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/contus-hd-flv-player
repo_name: wp-plugins/contus-hd-flv-player
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: configXML.php
change_type: ModificationType.MODIFY
diff: @@ -1,15 +1,16 @@
 <?php
-/*
- *
- * Purpose : Player Configuration Settings
- * Path:/wp-content/plugins/contus-hd-flv-player/configXML.php
- * Edited by : kranthi kumar
- * Version: 1.7
- * Email : kranthikumar@contus.in
- * Date:9/12/11
- *
- */
-
+/**
+ * @name          : Player Configuration Settings
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Player Configuration Settings
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
 
 header("content-type:text/xml;charset=utf-8");
 require_once( dirname(__FILE__) . '/hdflv-config.php');

programming_language: PHP
filename: functions.php
change_type: ModificationType.MODIFY
diff: @@ -1,11 +1,19 @@
 <?php
-ob_start();
-/* Purpose : Common functions needed throughout the plugin
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Path:/wp-content/plugins/contus-hd-flv-player/function.php
- * Date:9/12/11
- */
+/**
+ * @name          : Common functions needed throughout the plugin
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Common functions needed throughout the plugin
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
+ob_start(); 
+
 require_once( dirname(__FILE__) . '/hdflv-config.php');
 
 $name = filter_input(INPUT_GET,'name');
@@ -201,7 +209,8 @@ function hd_add_media($wptfile_abspath, $wp_urlpath) {
 // Get input informations from POST
     $sorder = $_POST['sorder'];
 
-    $act_name = trim($_POST['name']);
+    $act_name = strip_tags(trim($_POST['name']));
+    $act_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $act_name);
 
     if ($_POST['youtube-value'] != '') {
 
@@ -289,7 +298,7 @@ function hd_update_thumb($wptfile_abspath,$showPath,$updateID) {
     global $wpdb;
     $uploadPath = $wpdb->get_col("SELECT upload_path FROM " . $wpdb->prefix . "hdflv_settings");
     $uPath = $uploadPath[0];
-    //echo "<pre>"; print_r($_POST); echo "</pre>";
+    $uploadStatus = '';
     
     if($uPath != ''){
         $wp_urlpath = $wptfile_abspath.$uPath.'/';
@@ -303,18 +312,24 @@ function hd_update_thumb($wptfile_abspath,$showPath,$updateID) {
                     $random_digit = rand(0000,9999);
                     $new_file_name=$random_digit.'_'.$cname;
                     if(move_uploaded_file($tname ,$wp_urlpath . $new_file_name)){
+                    $uploadStatus = true;
                     $updated_thumb=$new_file_name;
                     }
+                }else{
+                $uploadStatus = false;
+                render_error(__('Invalid File Format Uploaded', 'hdflv'));
                 }
 if($uPath != ''){
         $wp_showPath = $showPath.$uPath.'/';
     }else{
         $wp_showPath = $showPath.'/';
     }
+    if($uploadStatus == '1'){
    $updated_thumb_value = $wp_showPath.$updated_thumb;
    $wpdb->query(" UPDATE " . $wpdb->prefix . "hdflv SET image= '$updated_thumb_value' WHERE vid = '$updateID'");
    render_message(__('Image Update Successfully', 'hdflv'));
     return;
+    }
 }
 //Function for updating preview image
 function hd_update_preview($wptfile_abspath,$showPath,$updateID) {
@@ -322,7 +337,7 @@ function hd_update_preview($wptfile_abspath,$showPath,$updateID) {
      global $wpdb;
     $uploadPath = $wpdb->get_col("SELECT upload_path FROM " . $wpdb->prefix . "hdflv_settings");
     $uPath = $uploadPath[0];
-    //echo "<pre>"; print_r($_POST); echo "</pre>";
+    $uploadStatus = '';
     
     if($uPath != ''){
         $wp_urlpath = $wptfile_abspath.$uPath.'/';
@@ -337,18 +352,24 @@ function hd_update_preview($wptfile_abspath,$showPath,$updateID) {
                     $random_digit = rand(0000,9999);
                     $new_file_name=$random_digit.'_'.$cname;
                     if(move_uploaded_file($tname ,$wp_urlpath . $new_file_name)){
+                    $uploadStatus = true;
                     $updated_preview = $new_file_name;
                     }
+                }else{
+                $uploadStatus = false;
+                render_error(__('Invalid File Format Uploaded', 'hdflv'));
                 }
 if($uPath != ''){
         $wp_showPath = $showPath.$uPath.'/';
     }else{
         $wp_showPath = $showPath.'/';
     }
+   if($uploadStatus == '1'){
    $updated_preview_value = $wp_showPath.$updated_preview;
    $wpdb->query(" UPDATE " . $wpdb->prefix . "hdflv SET opimage= '$updated_preview_value' WHERE vid = '$updateID'");
    render_message(__('Image Update Successfully', 'hdflv'));
     return;
+   }
 }
 //Function used for retrieving YOUTUBE url
 function youtubeurl() {
@@ -376,7 +397,8 @@ function hd_update_media($media_id) {
     global $wpdb;
     $pieces = explode(",", $_POST['hid']);
     $sorder = $_POST['sorder'];
-    $act_name = addslashes(trim($_POST['act_name']));
+    $act_name = strip_tags(trim($_POST['act_name']));    
+    $act_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $act_name);    
     $act_filepath = addslashes(trim($_POST['act_filepath']));
     $act_image = addslashes(trim($_POST['act_image']));
     $act_hdpath = addslashes(trim($_POST['act_hdpath']));
@@ -509,8 +531,9 @@ function hd_add_playlist() {
     global $wpdb;
    
     // Get input informations from POST
-    $p_name = addslashes(trim($_POST['p_name']));
-    $p_description = addslashes(trim($_POST['p_description']));
+    $p_name = strip_tags(trim($_POST['p_name']));
+    $p_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $p_name);
+    $p_description = strip_tags(trim($_POST['p_description']));
     $p_playlistorder = $_POST['sortorder'];
     if (empty($p_playlistorder))
         $p_playlistorder = "ASC";
@@ -541,9 +564,9 @@ function hd_update_playlist() {
 
     // Get input informations from POST
     $p_id = (int) ($_POST['p_id']);
-    $p_name = addslashes(trim($_POST['p_name']));
-    		 
-    $p_description = addslashes(trim($_POST['p_description']));
+    $p_name = strip_tags(trim($_POST['p_name']));
+    $p_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $p_name);		 
+    $p_description = strip_tags(trim($_POST['p_description']));
     $p_playlistorder = $_POST['sortorder'];
 
 //echo $siteUrl = $_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'].'?page='.$_GET['page'].'&mode='.$_GET['mode'];

programming_language: PHP
filename: hdflv-config.php
change_type: ModificationType.MODIFY
diff: @@ -1,13 +1,17 @@
 <?php
-/*
- * version : 1.6
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Purpose : configuration of plugin
- * Path:/wp-content/plugins/contus-hd-flv-player/hdflv-config.php
- * Date:9/12/11
- *
- */
+/**
+ * @name          : configuration of plugin
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : configuration of plugin
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 /**
  * Bootstrap file for getting the ABSPATH constant to wp-load.php
  * This is requried when a plugin requires access not via the admin screen.

programming_language: PHP
filename: jquery.ui.all.css
change_type: ModificationType.MODIFY
diff: @@ -9,10 +9,3 @@
  */
 @import "jquery.ui.base.css";
 @import "jquery.ui.theme.css";
- .column { width: 500px; float: left; padding-bottom: 20px; }
-        .portlet { margin: 0 1em 1em 0; }
-        .portlet-header { margin: 0.3em; padding-bottom: 4px; padding-left: 10px;padding-top: 4px;font-size:12px; }
-        .portlet-header .ui-icon { float: right; }
-        .portlet-content { padding: 0.4em; font-size:12px;}
-        .ui-sortable-placeholder { border: 1px dotted black; visibility: visible !important; height: 50px !important; }
-        .ui-sortable-placeholder * { visibility: hidden; }
\ No newline at end of file

programming_language: CSS
filename: jquery.ui.theme.css
change_type: ModificationType.MODIFY
diff: @@ -16,7 +16,7 @@
 .ui-widget { font-family: Verdana,Arial,sans-serif/*{ffDefault}*/; font-size: 1.1em/*{fsDefault}*/; }
 .ui-widget .ui-widget { font-size: 1em; }
 .ui-widget input, .ui-widget select, .ui-widget textarea, .ui-widget button { font-family: Verdana,Arial,sans-serif/*{ffDefault}*/; font-size: 1em; }
-.ui-widget-content { border: 1px solid #aaaaaa/*{borderColorContent}*/; background: #ffffff/*{bgColorContent}*/ /*{bgImgUrlContent}*/ 50%/*{bgContentXPos}*/ 50%/*{bgContentYPos}*/ repeat-x/*{bgContentRepeat}*/; color: #222222/*{fcContent}*/; }
+.ui-widget-content { border: 1px solid #aaaaaa/*{borderColorContent}*/; background: #ffffff/*{bgColorContent}*/ url(images/ui-bg_flat_75_ffffff_40x100.png)/*{bgImgUrlContent}*/ 50%/*{bgContentXPos}*/ 50%/*{bgContentYPos}*/ repeat-x/*{bgContentRepeat}*/; color: #222222/*{fcContent}*/; }
 .ui-widget-content a { color: #222222/*{fcContent}*/; }
 .ui-widget-header { border: 1px solid #aaaaaa/*{borderColorHeader}*/; background: #cccccc/*{bgColorHeader}*/ url(images/ui-bg_highlight-soft_75_cccccc_1x100.png)/*{bgImgUrlHeader}*/ 50%/*{bgHeaderXPos}*/ 50%/*{bgHeaderYPos}*/ repeat-x/*{bgHeaderRepeat}*/; color: #222222/*{fcHeader}*/; font-weight: bold; }
 .ui-widget-header a { color: #222222/*{fcHeader}*/; }

programming_language: CSS
filename: config.xml
change_type: ModificationType.ADD
diff: @@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<config 
+license="Key provided for commercial version"
+stagecolor="0x000000" 
+autoplay="true" 
+buffer="3"
+Volume="false" 
+fullscreenscale="0" 
+normalscale="0" 
+logopath="hdflvplayer/images/platoon.png"
+logoalpha="50" 
+logoalign="TR" 
+Download="false"
+logo_target="http://www.hdflvplayer.net/"
+skin="hdflvplayer/skin/skin_black/skin_black.swf"
+skin_autohide="false"
+language = "English"
+playlistXML="hdflvplayer/xml/playlist.xml"
+playlist_open="false" 
+showPlaylist ="true"
+HD_default="false" 
+vast="false"
+vast_partnerid=""
+streamer=""
+embed_visible="true"
+UseYouTubeApi="flash"
+debug="true">
+<timer>true</timer>
+<zoom>true</zoom>
+<email>true</email>
+<fullscreen>true</fullscreen>
+</config>
\ No newline at end of file

programming_language: Lua
filename: playlist.xml
change_type: ModificationType.ADD
diff: @@ -0,0 +1,23 @@
+﻿<?xml version="1.0" encoding="utf-8"?>
+<playlist autoplay="false" random="false">
+
+  <mainvideo url="http://www.hdflvplayer.net/videos/300.mp4" 
+             hdpath="http://www.hdflvplayer.net/videos/300.mp4"
+             id="100"
+             thu_image=""                                                                                
+             Preview="" 
+             preroll="true" 
+             midroll="true" 
+             postroll="true" 
+             allow_download="true"
+             streamer=""
+             isLive="false" > 
+             <title><![CDATA[Welcome]]></title> 
+             <!--Optional--> 
+             <tagline targeturl="https://mydomain.com"><![CDATA[<span class='heading'>Tagline - </span> <b>Your short description  goes here for Videos.</b> ]]></tagline>        
+  </mainvideo>
+
+
+
+
+</playlist>

programming_language: HTML
filename: youtubeurl.php
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,5 @@
 <?php
+
 /*
  * version : 1.6
  * Edited by : John THomas

programming_language: PHP
filename: hdflvplugin.php
change_type: ModificationType.MODIFY
diff: @@ -1,15 +1,14 @@
 <?php
 /*
  * Plugin Name: Contus HDFLVPlayer Plugin
- * Version: 1.7
+ * Version: 1.8
  * Author: Apptha
  * Plugin URI: http://www.apptha.com/category/extension/Wordpress/HD-FLV-Player-Plugin/
  * Author URI: http://www.apptha.com/
  * Description: Contus HD FLV Player simplifies the process of adding high definition videos to the Wordpress blog. The plugin efficiently plays your Videos with high quality video and audio output.  
  * Path :wp-content\plugins\contus-hd-flv-player\hdflvplugin.php
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * date:09/12/11
+ * Creation Date : Dec 09, 2011
+ * Modified Date : Jul 23, 2012
  * Purpose : Main plugin file to configure
  */
 session_start();

programming_language: PHP
filename: install.php
change_type: ModificationType.MODIFY
diff: @@ -1,10 +1,17 @@
 <?php
-/* 
- * Purpose : Used for installing player plugin (Creating tables)
- * Edited By : kranthi kumar
- * Version: 1.7
- * Email : kranthikumar@contus.in
-*/
+/**
+ * @name          : Used for installing player plugin (Creating tables)
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Used for installing player plugin (Creating tables)
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 /****************************************************************/
 /* Install routine for hdflvplayer
 /****************************************************************/

programming_language: PHP
filename: hdflvscript.js
change_type: ModificationType.MODIFY
diff: @@ -1,215 +1,273 @@
+/**
+ * @name          : Script for Hd Flv Player
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : For Validation and Sortable Process
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 var xmlhttp;
 var myarray = [];
 var myarray1;
-function showUser(str,order)
-{
-xmlhttp=GetXmlHttpObject();
-if (xmlhttp==null)
-  {
-  alert ("Browser does not support HTTP Request");
-  return;
-  }
-var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
-url=url+"?"+order;
-url=url+"&playid="+str;
-url=url+"&sid="+Math.random();
-xmlhttp.onreadystatechange=stateChanged;
-xmlhttp.open("GET",url,true);
-xmlhttp.send(null);
+function showUser(str, order) {
+	xmlhttp = GetXmlHttpObject();
+	if (xmlhttp == null) {
+		alert("Browser does not support HTTP Request");
+		return;
+	}
+	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
+	url = url + "?" + order;
+	url = url + "&playid=" + str;
+	url = url + "&sid=" + Math.random();
+	xmlhttp.onreadystatechange = stateChanged;
+	xmlhttp.open("GET", url, true);
+	xmlhttp.send(null);
 }
 
-function stateChanged()
-{
-if (xmlhttp.readyState==4)
-{
-     myarray = xmlhttp.responseText;
-       myarray1 = myarray.split(",");
-        var length1 = myarray1.length-1;
-        var i=0;
-        for(i=0;i<=length1;i++ )
-        {
-            document.getElementById('txtHint['+myarray1[i]+']').innerHTML=i;
-        }
-    
-}
+function stateChanged() {
+	if (xmlhttp.readyState == 4) {
+		myarray = xmlhttp.responseText;
+		myarray1 = myarray.split(",");
+		var length1 = myarray1.length - 1;
+		var i = 0;
+		for (i = 0; i <= length1; i++) {
+			document.getElementById('txtHint[' + myarray1[i] + ']').innerHTML = i;
+		}
+
+	}
 }
 
-function GetXmlHttpObject()
-{
-if (window.XMLHttpRequest)
-  {
-  // code for IE7+, Firefox, Chrome, Opera, Safari
-  return new XMLHttpRequest();
-  }
-if (window.ActiveXObject)
-  {
-  // code for IE6, IE5
-  return new ActiveXObject("Microsoft.XMLHTTP");
-  }
-return null;
+function GetXmlHttpObject() {
+	if (window.XMLHttpRequest) {
+		// code for IE7+, Firefox, Chrome, Opera, Safari
+		return new XMLHttpRequest();
+	}
+	if (window.ActiveXObject) {
+		// code for IE6, IE5
+		return new ActiveXObject("Microsoft.XMLHTTP");
+	}
+	return null;
 }
 
+// this function is useful to show or display the  HDFLVPlayer Options div when u click on - or + buttons
+function hideContentDives(divIdIs, id) {
 
- // this function is useful to show or display the  HDFLVPlayer Options div when u click on - or + buttons
-function hideContentDives(divIdIs , id)
-{
-   
-    var status = document.getElementById(divIdIs).style.display;
-  //  alert(status);
-    if(status == 'none')
-    {
-    	document.getElementById(divIdIs).style.display = 'block';
-    	divStyleDisplaySet(divIdIs ,0);
-    	document.getElementById(id).className = 'ui-icon ui-icon-minusthick';
-    }
-    else{
-    	document.getElementById(divIdIs).style.display = 'none';
-    	divStyleDisplaySet(divIdIs ,1 );
-    	document.getElementById(id).className  = 'ui-icon ui-icon-plusthick';
-        }
+	var status = document.getElementById(divIdIs).style.display;
+	//  alert(status);
+	if (status == 'none') {
+		document.getElementById(divIdIs).style.display = 'block';
+		divStyleDisplaySet(divIdIs, 0);
+		document.getElementById(id).className = 'ui-icon ui-icon-minusthick';
+	} else {
+		document.getElementById(divIdIs).style.display = 'none';
+		divStyleDisplaySet(divIdIs, 1);
+		document.getElementById(id).className = 'ui-icon ui-icon-plusthick';
+	}
 }
 
-function divStyleDisplaySet(IdValue , setValue)
-{
-var xmlhttp;
-var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
-if (IdValue.length==0)
-  { 
-  
-  return;
-  }
-if (window.XMLHttpRequest)
-  {// code for IE7+, Firefox, Chrome, Opera, Safari
-  xmlhttp=new XMLHttpRequest();
-  }
-else
-  {// code for IE6, IE5
-  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
-  }
-xmlhttp.onreadystatechange=function()
-  {
-  if (xmlhttp.readyState==4 && xmlhttp.status==200)
-    {
-	//  alert(xmlhttp.responseText);
-    //document.getElementById("txtHint").innerHTML=xmlhttp.responseText;
-    }
-  }
-
-xmlhttp.open("GET", url+'?updatedisplay=1&IdValue='+IdValue+'&setValue='+setValue  ,true);
-xmlhttp.send();
+function divStyleDisplaySet(IdValue, setValue) {
+	var xmlhttp;
+	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
+	if (IdValue.length == 0) {
+
+		return;
+	}
+	if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari
+		xmlhttp = new XMLHttpRequest();
+	} else {// code for IE6, IE5
+		xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
+	}
+	xmlhttp.onreadystatechange = function() {
+		if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
+			//  alert(xmlhttp.responseText);
+			//document.getElementById("txtHint").innerHTML=xmlhttp.responseText;
+		}
+	}
+
+	xmlhttp.open("GET", url + '?updatedisplay=1&IdValue=' + IdValue
+			+ '&setValue=' + setValue, true);
+	xmlhttp.send();
 }
 
-function  setVideoStatusOff(videoId , status ,flag )  //click on status image then it exe
+function setVideoStatusOff(videoId, status, flag) //click on status image then it exe
 {
 	//if flag is set 1 then it is playlist status else video status
 
 	var xmlhttp;
-	var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
+	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
 	//var statusImgPath = document.getElementById('imagepath').value;
-	if (window.XMLHttpRequest)
-	  {// code for IE7+, Firefox, Chrome, Opera, Safari
-	  xmlhttp=new XMLHttpRequest();
-	  }
-	else
-	  {// code for IE6, IE5
-	  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
-	  }
-	xmlhttp.onreadystatechange=function()
-	  {
-	  if (xmlhttp.readyState==4 && xmlhttp.status==200)
-	    {
-		 imgName  = (xmlhttp.responseText);
-				
-		  //alert(imgName);
-		 // alert(  document.getElementById('status'+videoId).innerHTML);
-		 
-	    document.getElementById('status'+videoId).innerHTML= imgName;
-	    }
-	  }
-	if(flag){
-	//	alert( url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status);
-		xmlhttp.open("GET", url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status  ,true);//for playlist status
-	}
-	else{
-		xmlhttp.open("GET", url+'?changeVideoStatus=1&videoId='+videoId+'&status='+status  ,true); //for video status
-	}	
-	
-	
+	if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari
+		xmlhttp = new XMLHttpRequest();
+	} else {// code for IE6, IE5
+		xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
+	}
+	xmlhttp.onreadystatechange = function() {
+		if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
+			imgName = (xmlhttp.responseText);
+
+			//alert(imgName);
+			// alert(  document.getElementById('status'+videoId).innerHTML);
+
+			document.getElementById('status' + videoId).innerHTML = imgName;
+		}
+	}
+	if (flag) {
+		//	alert( url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status);
+		xmlhttp.open("GET", url + '?changeplaylistStatus=1&videoId=' + videoId
+				+ '&status=' + status, true);//for playlist status
+	} else {
+		xmlhttp.open("GET", url + '?changeVideoStatus=1&videoId=' + videoId
+				+ '&status=' + status, true); //for video status
+	}
+
 	xmlhttp.send();
 } //status fun end hear
 
-
 /*   manage.php  script                                  */
 
-function savePlaylist(playlistName , mediaId){
-    var name = playlistName.value;
-    var pluginUrl =  document.getElementById('pluginUrl').value;
-    
-    $.ajax({
-        type: "GET",
-        url: pluginUrl+"/functions.php",
-        data: "name="+name+"&media="+mediaId,
-        success: function(msg){
-            var response = msg.split('##');
-          //  alert(msg);
-           document.getElementById('playlistchecklist').innerHTML = msg;
-        }
-    });
+function savePlaylist(playlistName, mediaId) {
+	var name = playlistName.value;
+	var pluginUrl = document.getElementById('pluginUrl').value;
+
+	$.ajax({
+		type : "GET",
+		url : pluginUrl + "/functions.php",
+		data : "name=" + name + "&media=" + mediaId,
+		success : function(msg) {
+			var response = msg.split('##');
+			//  alert(msg);
+			document.getElementById('playlistchecklist').innerHTML = msg;
+		}
+	});
 }
 
-function validateInput(){
+/**
+ * function to validate during adding video files
+ * 
+ */
+
+function validateInput() {
+	document.getElementById('message').style.display = '';
 	var YouTubeUrl = document.getElementById('filepath1').value;
-    var CustomUrl = document.getElementById('filepath2').value;
-   	var HdUrl = document.getElementById('filepath3').value;
-   	var ThumbUrl = document.getElementById('filepath4').value;
-   	var ThumbPreviewUrl = document.getElementById('filepath5').value;
-   	var tomatch = /http:\/\/[A-Za-z0-9\.-]{3,}\.[A-Za-z]{3}/
-   		if (!tomatch.test(CustomUrl)&&(CustomUrl!=''))
-  	     {
-  			 document.getElementById('message').innerHTML = 'Please enter valid URL';
-  	         return false;
-  	     }
-   		else if (!tomatch.test(HdUrl)&&(HdUrl!=''))
-	     {
-			 document.getElementById('message').innerHTML = 'Please enter valid Hd Url';
-	         return false;
-	     }
-   		
-   		else if (!tomatch.test(ThumbUrl)&&(ThumbUrl!=''))
-    	 {
-		 	document.getElementById('message').innerHTML = 'Please enter valid Thumb Image Url';
-         	return false;
-    	  }
-   		else if (!tomatch.test(ThumbPreviewUrl)&&(ThumbPreviewUrl!=''))
-    	 {
-		      document.getElementById('message').innerHTML = 'Please enter Preview Image  Url';
-              return false;
-    	 }
-		else if (!tomatch.test(YouTubeUrl)&&(YouTubeUrl!=''))
-           {
-		 			document.getElementById('message').innerHTML = 'Please enter valid You Tube Url';
-       			return false;
-           }
-    if(document.getElementById('btn2').checked == true && document.getElementById('filepath1').value == ''){
-        document.getElementById('message').innerHTML = 'Enter Youtube URL';
-        return false;
-    }
-    if(document.getElementById('btn1').checked == true && document.getElementById('f1-upload-form').style.display != 'none'){
-        document.getElementById('message').innerHTML = 'Upload Video';
-        return false;
-    }
-    if(document.getElementById('btn3').checked == true && document.getElementById('filepath2').value == ''){
-        document.getElementById('message').innerHTML = 'Enter Video URl';
-        return false;
-    }   
-    var titlename = document.getElementById('name').value;
-    titlename = titlename.trim();
-   if(titlename == ''){
-	   document.getElementById('Errormsgname').innerHTML = 'Please enter the title for video ';
-	   document.getElementById('name').focus();
-	   return false;      
-      }
+	var CustomUrl = document.getElementById('filepath2').value;
+	var HdUrl = document.getElementById('filepath3').value;
+	var ThumbUrl = document.getElementById('filepath4').value;
+	var ThumbPreviewUrl = document.getElementById('filepath5').value;
+	var tomatch = /http:\/\/[A-Za-z0-9\.-]{3,}\.[A-Za-z]{3}/;
+	if (!tomatch.test(CustomUrl) && (CustomUrl != '')) {
+		document.getElementById('message').innerHTML = 'Please enter valid URL';
+		return false;
+	} else if (!tomatch.test(HdUrl) && (HdUrl != '')) {
+		document.getElementById('message').innerHTML = 'Please enter valid Hd Url';
+		return false;
+	}
 
+	else if (!tomatch.test(ThumbUrl) && (ThumbUrl != '')) {
+		document.getElementById('message').innerHTML = 'Please enter valid Thumb Image Url';
+		return false;
+	} else if (!tomatch.test(ThumbPreviewUrl) && (ThumbPreviewUrl != '')) {
+		document.getElementById('message').innerHTML = 'Please enter Preview Image  Url';
+		return false;
+	} else if (!tomatch.test(YouTubeUrl) && (YouTubeUrl != '')) {
+		document.getElementById('message').innerHTML = 'Please enter valid You Tube Url';
+		return false;
+	}
+	if (document.getElementById('btn2').checked == true
+			&& document.getElementById('filepath1').value == '') {
+		document.getElementById('message').innerHTML = 'Enter Youtube URL';
+		return false;
+	}
+	if (document.getElementById('btn1').checked == true
+			&& document.getElementById('f1-upload-form').style.display != 'none') {
+		document.getElementById('message').innerHTML = 'Upload Video';
+		return false;
+	}
+	if (document.getElementById('btn3').checked == true
+			&& document.getElementById('filepath2').value == '') {
+		document.getElementById('message').innerHTML = 'Enter Video URl';
+		return false;
+	}
+	var titlename = document.getElementById('name').value;
+	titlename = titlename.trim();
+	if (titlename == '') {
+		document.getElementById('Errormsgname').innerHTML = 'Please enter the title for video ';
+		document.getElementById('name').focus();
+		return false;
+	}
 }
 
+/**
+ * function to validate during editing video files
+ * 
+ */
 
+function edtValidate() {
+	
+	var edtVideoTitle = document.getElementById('act_name').value;
+	var videoUrl = document.getElementById('act_filepath').value;
+	var hdUrl = document.getElementById('act_hdpath').value;
+	var thumbimgUrl = document.getElementById('act_image').value;
+	var previewimgUrl = document.getElementById('act_opimg').value;
+	var linkUrl = document.getElementById('act_link').value;
+	
+	var regexp = /^(((ht|f){1}((tp|tps):[/][/]){1}))[-a-zA-Z0-9@:%_\+.~#!?&//=]+$/;
+	
+	if (edtVideoTitle.trim() == '') {
+		document.getElementById('alert_title').innerHTML = 'Please Enter Video Title';
+		return false;
+	}else if (videoUrl.trim() == '') {
+		document.getElementById('alert_VUrl').innerHTML = 'Please Enter Video URL';
+		return false;
+	}else if(videoUrl != '' && regexp.test(videoUrl)== false){
+		document.getElementById('alert_VUrl').innerHTML = 'Please Enter Valid Video URL';
+		return false;
+	}else if(hdUrl != '' && regexp.test(hdUrl)== false){ 	 
+		document.getElementById('alert_HDURL').innerHTML = 'Please Enter Valid HD Url';
+		return false;
+	}else if (thumbimgUrl == '') {
+		document.getElementById('errmsg_thumbimg').style.display = '';
+		document.getElementById('errmsg_thumbimg').innerHTML = 'Please Enter Thumb Image/Url';
+		return false;
+	}else if (previewimgUrl == '') {
+		document.getElementById('errmsg_previewimg').style.display = '';
+		document.getElementById('errmsg_previewimg').innerHTML = 'Please Enter Preview Image/Url';
+		return false;
+	}else if(linkUrl != '' && regexp.test(linkUrl)== false) {
+		document.getElementById('alert_linkURL').innerHTML = 'Please Enter Valid Link Url';
+		return false;
+	}
+}
+
+/**
+ * function to validate during edit upload video files
+ * 
+ */
+
+function validateFileExt() {
+	var previewImg = document.getElementById('edit_preview').value;
+	var thumbImg = document.getElementById('edit_thumb').value;
+
+	if(thumbImg != ''){
+		var filext = thumbImg.substring(thumbImg.lastIndexOf(".")+1);					
+	}
+	
+	if(previewImg != ''){
+		var filext = previewImg.substring(previewImg.lastIndexOf(".")+1);
+	}
+	
+	filext = filext.toLowerCase();	
+	
+	if (filext == 'jpg' || filext == 'png' || filext == 'jpeg' || filext == 'gif'){
+		return true;
+	}else{
+		alert("Invalid File Format Selected");
+		document.getElementById('edit_preview').value = "";
+		document.getElementById('edit_thumb').value = "";
+		return false;
+	}
+}

programming_language: JavaScript
filename: manage.php
change_type: ModificationType.MODIFY
diff: @@ -1,12 +1,17 @@
 <?php
-/* 
- * Purpose : Common functions needed throughout the plugin
- * Path:/wp-content/plugins/contus-hd-flv-player/manage.php
- * Version: 1.7
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Date:9/12/11
- */
+/**
+ * @name          : Common functions needed throughout the plugin
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Common functions needed throughout the plugin
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 $contus = dirname(plugin_basename(__FILE__));
 $siteUrl = get_option('siteurl');
 define('SITEURL',$siteUrl);
@@ -103,13 +108,13 @@ cursor: default;
         setStatus(form_handler,statuscode);
         uploadqueue.shift();
         processQueue();
-
     }
 
     function submitUploadForm(form_handle)
     {
+        var token = '<?php echo md5(DB_NAME);?>';
         document.forms[form_handle].target = "uploadvideo_target";
-        document.forms[form_handle].action = "../wp-content/plugins/contus-hd-flv-player/uploadVideo.php?processing=1";
+        document.forms[form_handle].action = "../wp-content/plugins/contus-hd-flv-player/uploadVideo.php?processing=1&token="+token;
         document.forms[form_handle].submit();
     }
     function setStatus(form_handle,status)
@@ -765,24 +770,28 @@ class HDFLVManage {
                         <tr valign="top">
                             <th scope="row"><?php _e('Thumbnail URL', 'hdflv') ?></th>
                             <td><input type="text" size="80"  name="act_image" value="<?php echo $act_image ?>" id="act_image"/>
-                                <br /><?php _e('Enter the URL to show a thumbnail of the video file or upload a image', 'hdflv') ?><?php if($act_image != ''): ?><br /><span id="alert_IMGURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?>
-                                <br />
+                                <br/><?php _e('Enter the URL to show a thumbnail of the video file or upload a image', 'hdflv') ?><?php if($act_image != ''): ?><br /><span id="alert_IMGURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?>
+                                <br/>
                                 <form name="edit_thumb_form" method="post" enctype="multipart/form-data">
-                                <input type="file" name="edit_thumb">
-                                <input type="submit" name="thumb-update" value="upload" class="button-secondary">
+                                <input type="file" name="edit_thumb" id="edit_thumb">
+                                <input type="submit" name="thumb-update" value="Upload" class="button-secondary" onclick ="return validateFileExt();">
                                 </form>
-                                </td>
+                                <br />
+                                <span id="errmsg_thumbimg" style="color:red;font-size:12px;font-weight:bold;display: none;"></span>
+                             </td>
                         </tr>
                         <tr valign="top">
                             <th scope="row"><?php _e('Preview Image URL', 'hdflv') ?></th>
                             <td><input type="text" size="80"  name="act_opimg" value="<?php echo $act_opimg ?>" id="act_opimg"/>
                                 <br /><?php _e('Enter the URL to show a preview of the video file or upload a image', 'hdflv') ?><?php if($act_opimg != ''): ?><br /> <span id="alert_prIMGURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?>
                                 <br />
-                                <form name="edit_preview_form" method="post" enctype="multipart/form-data">
-                                <input type="file" name="edit_preview">
-                                <input type="submit" name="preview-update" value="upload" class="button-secondary">
+                                <form name="edit_preview_form" method="post" enctype="multipart/form-data" onSubmit ="return validateFileExt();">
+                                <input type="file" name="edit_preview" id="edit_preview">
+                                <input type="submit" name="preview-update" value="Upload" class="button-secondary">
                                 </form>
-                                </td>
+                                <br />
+                                <span id="errmsg_previewimg" style="color:red;font-size:12px;font-weight:bold;display: none;"></span>
+                             </td>
                         </tr>
                         <tr valign="top">
                             <th scope="row"><?php _e('Link URL', 'hdflv') ?></th>
@@ -793,44 +802,7 @@ class HDFLVManage {
                 </div>
                 <script type="text/javascript">
                 
-                function edtValidate(){
-                	var edtVideoTitle = document.getElementById('act_name').value;
-                	var videoUrl = document.getElementById('act_filepath').value;
-                	var hdUrl = document.getElementById('act_hdpath').value;
-                	var thumbimgUrl = document.getElementById('act_image').value;
-                	var previewimgUrl = document.getElementById('act_opimg').value;
-                	var linkUrl = document.getElementById('act_link').value;
-                    if(edtVideoTitle.trim() == '' ){
-                		document.getElementById('alert_title').innerHTML = 'Please Enter Video Title';
-                  	   return false;      
-                        }
-                	
-                   		if (videoUrl.trim() == '' )
-                  	     {
-                  			 document.getElementById('alert_VUrl').innerHTML = 'Please Enter Video URL';
-                  	         return false;
-                  	     }
-                   		else if (hdUrl.trim() == '' )
-                	     {
-                			// document.getElementById('alert_HDURL').innerHTML = 'Please Enter HD Url';
-                	        // return false;
-                	     }
-                   		
-                   		else if (thumbimgUrl.trim() == '' )
-                    	{
-                		 document.getElementById('alert_IMGURL').innerHTML = 'Please Enter Thumb Image Url';
-                         return false;
-                    	}
-                   		else if (previewimgUrl.trim() == '' )
-                    {
-                		 document.getElementById('alert_prIMGURL').innerHTML = 'Please Enter Preview Image  Url';
-                        return false;
-                    }	else if (linkUrl.trim() == '' )
-                    {
-               		 document.getElementById('alert_linkURL').innerHTML = 'Please Enter valid Link Url';
-                       return false;
-                   }
-                 }
+               
                          
                  </script>
                 <p>
@@ -863,18 +835,20 @@ class HDFLVManage {
 
                                             function t1(t2)
                                             {
-                                                if(t2.value == "y" )
-                                                {
-                                                    document.getElementById('upload2').style.display = "block"
+                                                if(t2.value == "y" ){
+                                                	document.getElementById('message').style.display = "none";
+                                                    document.getElementById('upload2').style.display = "block";
                                                     document.getElementById('youtube').style.display = "none";
                                                     document.getElementById('customurl').style.display = "none";
                                                 }
                                                 if(t2.value == "c" ){
+                                                	document.getElementById('message').style.display = "none";
                                                     document.getElementById('youtube').style.display = "block";
                                                     document.getElementById('upload2').style.display = "none";
                                                     document.getElementById('customurl').style.display = "none";
                                                 }
                                                 if(t2.value == "url" ){
+                                                	document.getElementById('message').style.display = "none";
                                                     document.getElementById('customurl').style.display = "block";
                                                     document.getElementById('youtube').style.display = "none";
                                                     document.getElementById('upload2').style.display = "none";
@@ -1219,7 +1193,7 @@ if($isTable){ //yes already in DB so add fields only
                                             echo "<th style='padding-left: 2%;' scope=\"row\">$table->pid</th>\n";
                                             echo "<td><a onclick=\"submitplay($table->pid)\" href=\"#\" >" . stripslashes($table->playlist_name) . "</td>\n";
                                             echo "<td><a href=?page=hdflvplaylist&pid=$table->pid class=\"edit\">" . __('Edit') . "</a> |
-                                                      <a href=?page=hdflvplaylist&pname=$table->playlist_name&did=$table->pid class=\"delete\" onclick=\"javascript:check=confirm( '" . __("Delete this file ?", 'hdflv') . "');if(check==false) return false;\">" . __('Delete') . "</a></td>\n";
+                                                      <a href='?page=hdflvplaylist&pname=$table->playlist_name&did=$table->pid' class=\"delete\" onclick=\"javascript:check=confirm( '" . __("Delete this file ?", 'hdflv') . "');if(check==false) return false;\">" . __('Delete') . "</a></td>\n";
                                             echo "<td></td>";
 				                            if($table->is_pactive){
 				                            	

programming_language: PHP
filename: myextractXML.php
change_type: ModificationType.MODIFY
diff: @@ -1,13 +1,17 @@
 <?php
-/*
- * version : 1.7
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Purpose : Create playlist for player
- * Path:/wp-content/plugins/contus-hd-flv-player/myextractXML.php
- * Date:09/12/11
- *
- */
+/**
+ * @name          : Common functions needed throughout the plugin
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Common functions needed throughout the plugin
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 /* Used to import plugin configuration */
 require_once( dirname(__FILE__) . '/hdflv-config.php');
 
@@ -65,7 +69,6 @@ if ($playlist_id != '' && $video_id != '') {//Condition if both playlist id  &&
 ($autoPlay[0] == 1)? $ap = 'true' : $ap = 'false';
 
 // Create XML output of playlist
-//ob_start();ob_end_flush();ob_end_clean();
 
 header("content-type:text/xml;charset = utf-8"); //mime type
 echo '<?xml version = "1.0" encoding = "utf-8"?>';

programming_language: PHP
filename: process-sortable.php
change_type: ModificationType.MODIFY
diff: @@ -1,13 +1,17 @@
 <?php
-/*
- * version : 1.6
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Purpose : functions used to sort the playlist
- * Path:/wp-content/plugins/contus-hd-flv-player/process-sortable.php
- * Date:09/12/11
- *
- */
+/**
+ * @name          : Common functions needed throughout the plugin
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Common functions needed throughout the plugin
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 
 /* Used to import plugin configuration */
 require_once( dirname(__FILE__) . '/hdflv-config.php');

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@ Contributors: Contus Support
 Tags: Video Player plugin, video, flash player, flv player, flash Video Player, flv player wordpress, hd flv player, youtube plugin, youtube Video Player, high definition Video Player, flash, play flv wordpress, player, Video Plugin, wp flv player, wp flv plugin, flv player 2009, Wp flash Video Player, wp flv, wordpress flv plugin, wp hd flv player, flv player plugin, wordpress flv player
 Requires at least: 2.8
 Tested up to: 2.8.6
-Stable tag: 1.7
+Stable tag: 1.8
 
 Get the most exciting FLV player in the internet, designed and modified to suit your Wordpress websites.  Installing this Video Plugin is real easy and if you have any difficulty in installation, contact our Video Player support team and quickly resolve your issue.  You can either download this Video Plugin directly from our website or through Wordpress plugins page itself.  This Flash Video Player has many advanced features that you cannot find elsewhere, such as that you can play youtube videos directly through this player, and it can also aptly be called as a youtube player.
 

programming_language: Markdown
filename: uploadVideo.php
change_type: ModificationType.MODIFY
diff: @@ -1,16 +1,26 @@
 <?php
-/* 
- * Purpose : functions used to upload video
- * Path:/wp-content/plugins/contus-hd-flv-player/upload1.php
- * Version: 1.7
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Date:9/12/11
- *
- */
+/**
+ * @name          : functions used to upload video
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : functions used to upload video
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
 
 /*		This file is use to validate uploadvideos  in Add a new video file first tab upload file option	*/
+require_once('../../../wp-load.php');
 
+$dbtoken = md5(DB_NAME);
+$token = trim($_REQUEST["token"]);
+
+if($dbtoken != $token ){
+    die("You are not authorized to access this file");
+}
 require_once( dirname(__FILE__) . '/hdflv-config.php');
 			
 $errormsg = array();

programming_language: PHP