CVE-2015-10125 (published 2023-10-05T23:15Z)

A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/wp-plugins/wp-ultimate-csv-importer
commit_details: repo_url: https://github.com/wp-plugins/wp-ultimate-csv-importer
author: smackcoders
author_date: 2015-05-05 13:28:09+00:00
msg: Version 3.7.3 for Vulnarablility fix

git-svn-id: https://plugins.svn.wordpress.org/wp-ultimate-csv-importer/trunk@1153788 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/wp-ultimate-csv-importer
repo_name: wp-plugins/wp-ultimate-csv-importer
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: Readme.txt
change_type: ModificationType.MODIFY
diff: @@ -1,20 +1,20 @@
-=== Import a CSV with Ultimate CSV Importer ===
+=== Import CSV made simple with Ultimate CSV Importer ===
 Contributors: smackcoders
 Donate link: http://www.smackcoders.com/donate.html
 Tags: wp all import, batch, csv, excel, import, spreadsheet, autoblog, Autoblogger, csvimporter, data, dataimport, importer, wpcsvimporter, wpimporter, acf, auto blog, csv import, csv to post, data import, Easy CSV Importer, eci, import plugin, admin, user, users, Advanced CSV Import, Advanced CSV Importer, affiliate, amazon, author, automatic, blog, bulk, bulk edit, bulk editor, categories, comments, content, csv file, csv format, csv importer, custom post, e-commerce, free, images, language, manage, media, meta, multisite, News, page, photos, pictures, plugin, Post, seo, shop, shortcode, tags, Taxonomy, text, title, video, eshop, woocommerce, wordpress, xml, youtube, export
 Requires at least: 4.1
 Tested up to: 4.2.1
-Stable tag: 3.7.2
-Version: 3.7.2
+Stable tag: 3.7.3
+Version: 3.7.3
 Author: smackcoders
 Author URI: http://profiles.wordpress.org/smackcoders/
 
 License: GPLv2 or later
 
-Import a CSV with Ultimate CSV Importer as posts, pages, eshop products, custom posts with custom fields in few simple clicks 
+Import CSV made simple with Ultimate CSV Importer to import/export posts, pages, eshop products, custom posts with custom fields in few simple clicks 
 
 == Description ==
-Import a CSV as wordpress posts made very simple and easy even for novice users as in few clicks and 3 simple steps with Ultimate CSV Importer plugin. Wordpress Ultimate CSV Importer V3.7.2 is updated with major issue fix and 4.2.1 compatibility.  Users can get product manual and sample csv files etc., from - http://www.wpultimatecsvimporter.com/
+Import CSV data to wordpress is made very easy even for novice users as in few clicks and 3 simple steps with Ultimate CSV Importer plugin. Wordpress Ultimate CSV Importer V3.7.3 is updated with major issue fix and 4.2.1 compatibility.  Users can get product manual and sample csv files etc., from - http://www.wpultimatecsvimporter.com/
 
 ** New Features of Wordpress Ultimate CSV Importer Pro V4.0 **
 
@@ -31,7 +31,7 @@ Import a CSV as wordpress posts made very simple and easy even for novice users
 * Mapping template feature with edit option.
 * Auto mapping and specific column update in Update feature.
 
-** Now stable version 3.7.2 available to download with hot linked featured image fix. Visit [www.wpultimatecsvimporter.com](http://www.wpultimatecsvimporter.com) for more news and future plans.
+** Now stable version 3.7.3 available to download with security issue fix. Visit [www.wpultimatecsvimporter.com](http://www.wpultimatecsvimporter.com) for more news and future plans.
 
 WP Ultimate CSV Importer Plugin proven much effective advanced CSV File Importer With Ultimate User Friendly Features. It is much easy now even for newbies to import csv file exported from any tool, app or software. Import as any wordpress post type and associated fields by simple mapping feature. Now import any CSV file as thousands of post, page and custom post types. This is admin side free plugin helps you in bulk edit, create and import posts type for your blog or site. 
 
@@ -197,6 +197,9 @@ This will solve your issue or get support from hosting if you dint have sufficie
 
 == Changelog ==
 
+= 3.7.3 =
+*Fixed: Vulnarablility security issue fix. 
+
 = 3.7.2 =
 * Added: wordpress 4.2 and 4.2.1 compatibility.
 * Fixed: Blank page conflict issue 
@@ -442,6 +445,9 @@ This will solve your issue or get support from hosting if you dint have sufficie
 
 == Upgrade Notice ==
 
+= 3.7.3 =
+* Upgrade now for Vulnarability fix.
+
 = 3.7.2 =
 * Important Upgrade for wordpress 4.2 and above
 

programming_language: Markdown
filename: WPImporter_includes_helper.php
change_type: ModificationType.MODIFY
diff: @@ -1132,6 +1132,10 @@ class WPImporter_includes_helper {
 			</span>';
 		return $smackhelpnotes;
 	}
+	function create_nonce_key(){
+		return wp_create_nonce('smack_nonce');
+	}
+        
 }
 
 class CallWPImporterObj extends WPImporter_includes_helper

programming_language: PHP
filename: ultimate-importer-free.js
change_type: ModificationType.MODIFY
diff: @@ -7,10 +7,6 @@ jQuery( document ).ready(function() {
                   document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>';
                 }
        
-//pieStats();
-//lineStats();
-
-
  }
  if (checkmodule == 'custompost') {
 		    var step = jQuery('#stepstatus').val();
@@ -22,7 +18,9 @@ jQuery( document ).ready(function() {
 	    }
  if (checkmodule != 'filemanager' && checkmodule != 'settings' && checkmodule !='support' && checkmodule !='export') {
 	 var checkfile = jQuery('#checkfile').val();
+	 var dir_path = jQuery('#dirpathval').val();
 	 var uploadedFile = jQuery('#uploadedFile').val();
+	 var noncekey = jQuery('#nonceKey').val();
 	 var select_delimeter = jQuery('#select_delim').val();
 	 var select_delim = jQuery('#select_delim').val();
 	 var get_log = jQuery('#log').val();
@@ -39,8 +37,8 @@ jQuery( document ).ready(function() {
 		 select_delim = select_delimeter;
 	 }
 	 if(uploadedFile != '' && select_delim != '') { 
-		 var doaction = 'record_no=1&file_name=' + uploadedFile + '&selected_delimeter=' + select_delim + '&checkmodule=' + checkmodule;
 		 var tmpLoc = jQuery('#tmpLoc').val();
+		 var doaction = 'record_no=1&file_name=' + uploadedFile + '&selected_delimeter=' + select_delim + '&checkmodule=' + checkmodule+'&temloc=' + tmpLoc+'&dir_path=' + dir_path + '&wpnonce=' + noncekey;
 		 if(tmpLoc != '' && tmpLoc != null) {
 			jQuery.ajax({
 				url: tmpLoc + 'templates/readfile.php',
@@ -70,6 +68,8 @@ document.getElementById('sec-two').style.display='';
 
 function gotoelement(id) {
     var gotoElement = document.getElementById('current_record').value;
+    var dir_path = jQuery('#dirpathval').val();
+    var noncekey = document.getElementById('nonceKey').value;
     var no_of_records = document.getElementById('totRecords').value;
     var uploadedFile = document.getElementById('uploadedFile').value;
     var delim = document.getElementById('select_delimeter').value;
@@ -103,7 +103,7 @@ function gotoelement(id) {
             return false;
         }
     }
-    var doaction = 'record_no=' + gotoElement + '&file_name=' + uploadedFile + '&delim='+ delim + '&checkmodule=' + checkmodule;
+    var doaction = 'record_no=' + gotoElement + '&file_name=' + uploadedFile + '&delim='+ delim + '&checkmodule=' + checkmodule+ '&dir_path=' + dir_path + '&wpnonce=' + noncekey;
     var tmpLoc = document.getElementById('tmpLoc').value;
     jQuery.ajax({
         url: tmpLoc + 'templates/readfile.php',
@@ -531,7 +531,8 @@ function enableinlineimageoption() {
 
 function importRecordsbySettings(siteurl)
 {
-        var importlimit = document.getElementById('importlimit').value; 
+        var importlimit = document.getElementById('importlimit').value;
+	var noncekey = document.getElementById('wpnoncekey').value; 
         var get_requested_count = importlimit; 
         var tot_no_of_records = document.getElementById('checktotal').value;
         var importas = document.getElementById('selectedImporter').value;
@@ -587,7 +588,7 @@ function importRecordsbySettings(siteurl)
 	if(importas == 'post' || importas == 'page' || importas == 'custompost' || importas == 'eshop')
 	advancemedia = document.getElementById('advance_media_handling').checked;
 	var postdata = new Array();
-	postdata = {'dupContent':dupContent,'dupTitle':dupTitle,'importlimit':importlimit,'limit':currentlimit,'totRecords':tot_no_of_records,'selectedImporter':importas,'uploadedFile':uploadedFile,'tmpcount':tmpCnt,'importinlineimage':importinlineimage,'inlineimagehandling':imagehandling,'inline_image_location':inline_image_location,'advance_media':advancemedia,}
+	postdata = {'dupContent':dupContent,'dupTitle':dupTitle,'importlimit':importlimit,'limit':currentlimit,'totRecords':tot_no_of_records,'selectedImporter':importas,'uploadedFile':uploadedFile,'tmpcount':tmpCnt,'importinlineimage':importinlineimage,'inlineimagehandling':imagehandling,'inline_image_location':inline_image_location,'advance_media':advancemedia,'wpnonce':noncekey}
 
         var tmpLoc = document.getElementById('tmpLoc').value;
 	jQuery.ajax({
@@ -980,6 +981,9 @@ function addexportfilter(id) {
 			document.getElementById('authors').style.display = '';
 			document.getElementById('postauthor').style.display = '';
 		}
+		else if(id == 'getdatawithdelimeter'){
+			document.getElementById('delimeter').style.display = '';			
+		}
 	} else if (document.getElementById(id).checked == false) {
                 if(id == 'getdataforspecificperiod') {
 			document.getElementById('specificperiodexport').style.display = 'none';
@@ -998,6 +1002,9 @@ function addexportfilter(id) {
                         document.getElementById('authors').style.display = 'none';
                         document.getElementById('postauthor').style.display = 'none';
                 }
+		else if(id == 'getdatawithdelimeter'){
+                        document.getElementById('delimeter').style.display = 'none';
+                }
 	}
 }
 

programming_language: JavaScript
filename: ultimate-importer-pro.js
change_type: ModificationType.DELETE
diff: @@ -1,770 +0,0 @@
-jQuery( document ).ready(function() {
-      jQuery('.dropdown-toggle').dropdown('toggle');
-   var checkmodule = document.getElementById('checkmodule').value;
-        if(checkmodule != 'dashboard' && checkmodule != 'filemanager') {
-                var get_log = document.getElementById('log').innerHTML;
-                   if (!jQuery.trim(jQuery('#log').html()).length) {      
-                  document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>';
-                }
-       
-pieStats();
-lineStats();
-
-
- }
-if(checkmodule=='custompost')
-{
-	var step = document.getElementById('stepstatus').value;
-        if(step == 'mapping_settings') {
-        var cust_post_list_count = document.getElementById('cust_post_list_count').value;
-        if(cust_post_list_count=='0')
-        document.getElementById('cust_post_empty').style.display='';
-	}
-}	
-var checkfile = document.getElementById('checkfile').value;
-var uploadedFile = document.getElementById('uploadedFile').value;
-var select_delimeter=document.getElementById('select_delim').value;
-var select_delim=document.getElementById('select_delim').value;
-var get_log = document.getElementById('log').innerHTML; 
-if (!jQuery.trim(jQuery('#log').html()).length) {	
-document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>';
-}
-	if(checkfile != ''){
-		uploadedFile = checkfile;
-	}
-	if(select_delimeter!='')
-	{
-	select_delim=select_delimeter;
-	}
-        var doaction = 'record_no=1&file_name='+uploadedFile+'&selected_delimeter='+select_delim;
-        var tmpLoc = document.getElementById('tmpLoc').value;
-                jQuery.ajax({
-                        url: tmpLoc+'templates/readfile.php',
-                        type: 'post',
-                        data: doaction,
-                        dataType: 'json',
-                        success: function(response){ 
-                                var totalLength = response.length;
-				var setHeight = (parseInt(totalLength)*30)+250;
-				//document.getElementById('sec-two').style.height = setHeight+'px';
-                        }
-                });
-});
-function goto_mapping(id){
-if(id == 'importfile'){
-var currentURL = document.URL; 
-var go_to_url = currentURL.replace("uploadfile","mapping_settings");
-window.location.assign(go_to_url);
-document.getElementById('sec-one').style.display='none';
-document.getElementById('sec-two').style.display='';
-}
-}
-
-function gotoelement(id) {
-    var gotoElement = document.getElementById('current_record').value;
-    var no_of_records = document.getElementById('totRecords').value;
-    var uploadedFile = document.getElementById('uploadedFile').value;
-    var delim = document.getElementById('select_delimeter').value;
-    if (id == 'prev_record') {
-        gotoElement = parseInt(gotoElement) - 1;
-    }
-    if (id == 'next_record') {
-        gotoElement = parseInt(gotoElement) + 1;
-    }
-    if (gotoElement <= 0) {
-        gotoElement = 0;
-    }
-    if (gotoElement >= no_of_records) {
-        gotoElement = parseInt(no_of_records) - 1;
-    }
-    if (id == 'apply_element') {
-        gotoElement = parseInt(document.getElementById('goto_element').value);
-        if (isNaN(gotoElement)) {
-            showMapMessages('error', ' Please provide valid record number.');
-        }
-        if (gotoElement <= 0) {
-            gotoElement = 0;
-            showMapMessages('error', ' Please provide valid record number.');
-        } else {
-            gotoElement = gotoElement - 1;
-        }
-        if (gotoElement >= no_of_records) {
-            gotoElement = parseInt(no_of_records) - 1;
-            showMapMessages('error', 'CSV file have only ' + no_of_records + ' records.');
-            return false;
-        }
-    }
-    var doaction = 'record_no=' + gotoElement + '&file_name=' + uploadedFile + '&delim='+ delim;
-    var tmpLoc = document.getElementById('tmpLoc').value;
-    jQuery.ajax({
-        url: tmpLoc + 'templates/readfile.php',
-        type: 'post',
-        data: doaction,
-        dataType: 'json',
-        success: function (response) {
-            var totalLength = response.length;
-            for (var i = 0; i < totalLength; i++) {
-                if ((response[i].length) > 32) {
-                    document.getElementById('elementVal_' + i).innerHTML = response[i].substring(0, 28) + '...';
-                } else {
-                    document.getElementById('elementVal_' + i).innerHTML = response[i];
-                }
-            }
-        var displayRecCount = gotoElement + 1;
-            document.getElementById('preview_of_row').innerHTML = "Showing preview of row #" + displayRecCount;
-            document.getElementById('current_record').value = gotoElement;
-        }
-    });
-}
-
-function showtemplatediv_wpuci(checked, div)
-{
-	if(checked)
-		jQuery('#'+div).show();
-	else
-		jQuery('#'+div).hide();
-}
-
-function showtemplatediv_edit(checked, value)
-{
-	if(value == 'saveas')
-		jQuery('#showtemplate_edit_div').show();
-	else
-		jQuery('#showtemplate_edit_div').hide();
-}
-
-
-function selectpoststatus()
-{
-	var ps = document.getElementById("importallwithps");
-	var selectedpsindex = ps.options[ps.selectedIndex].value;
-	if(selectedpsindex == 3){
-		document.getElementById('globalpassword_label').style.display = "block";
-		document.getElementById('globalpassword_text').style.display = "block";
-	}
-	else{
-                document.getElementById('globalpassword_label').style.display = "none";
-                document.getElementById('globalpassword_text').style.display = "none";
-	}
-	var totdropdown= document.getElementById('h2').value;
-	var total = parseInt(totdropdown);
-	if(selectedpsindex=='0')
-	{
-
-		for(var i=0;i < total;i++)
-		{
-
-			dropdown = document.getElementById("mapping"+i);
-			var option=document.createElement('option');
-			option.text="post_status";
-			dropdown.add(option);
-
-		}
-
-	}
-	else {
-		for(var i=0;i < total;i++)
-		{
-
-			dropdown = document.getElementById("mapping"+i);
-
-			var totarr = dropdown.options.length;
-
-			for(var j=0;j<totarr;j++)
-			{
-
-				if(dropdown.options[j].value=='post_status')
-				{
-
-					dropdown.options.remove(j);
-					totarr--;
-				}
-			}
-
-		}
-	}
-}
-
-
-
-// Function for add customfield
-
-function addcustomfield(myval, selected_id) { 
-    var a = document.getElementById('h1').value;
-    var importer = document.getElementById('selectedImporter').value;
-    var aa = document.getElementById('h2').value;
-    var selected_dropdown = document.getElementById('mapping' + selected_id);
-    var selected_value = selected_dropdown.value; 
-    var prevoptionindex = document.getElementById('prevoptionindex').value;
-    var prevoptionvalue = document.getElementById('prevoptionvalue').value;
-    var mappedID = 'mapping' + selected_id;
-    var add_prev_option = false;
-    if(mappedID == prevoptionindex){
-	    add_prev_option = true;	
-    }
-    for (var i = 0; i < aa; i++) {
-	    var b = document.getElementById('mapping' + i).value; 
-	    var id = 'mapping' + i;
-	    if(add_prev_option){
-		    if(i != selected_id){	
-			    jQuery('#'+id).append( new Option(prevoptionvalue,prevoptionvalue) );
-		    }
-	    }
-	    if(i != selected_id){
-		    var x=document.getElementById('mapping' + i);
-		    jQuery('#'+id+' option[value="'+selected_value+'"]').remove();
-	    }
-	    if (b == 'add_custom' + i) {
-		    document.getElementById('textbox' + i).style.display = "";
-		    document.getElementById('customspan' + i).style.display = "";
-	    }
-	    else {
-		    document.getElementById('textbox' + i).style.display = "none";
-		    document.getElementById('customspan' + i).style.display = "none";
-	    }
-    }
-    document.getElementById('prevoptionindex').value = 'mapping' + selected_id;
-    var customField = selected_value.indexOf("add_custom");
-    if(selected_value != '-- Select --' && customField != 0){
-	    document.getElementById('prevoptionvalue').value = selected_value;
-    }
-}
-
-
-function clearMapping()
-{
-	var total_mfields = document.getElementById('h2').value; 
-	var mfields_arr = document.getElementById('mapping_fields_array').value;
-	var n=mfields_arr.split(",");
-	var options = '<option id="select">-- Select --</option>';
-	for(var i=0;i<n.length;i++){
-		options +="<option value='"+n[i]+"'>"+n[i]+"</option>";
-	}
-	for(var j=0;j<total_mfields;j++){
-		document.getElementById('mapping'+j).innerHTML = options;
-		document.getElementById('mapping'+j).innerHTML += "<option value='add_custom"+j+"'>Add Custom Field</option>";
-		document.getElementById('textbox'+j).style.display = 'none';
-		document.getElementById('customspan'+j).style.display = 'none';
-	}	
-}
-
-function clearmapping()
-{
-        var total_mfields = document.getElementById('h2').value;
-        var mfields_arr = document.getElementById('mapping_fields_array').value;
-        var n=mfields_arr.split(",");
-        var options = "<option id='select'>-- Select --</option>";
-        for(var i=0;i<n.length;i++){
-                options +="<option value='"+n[i]+"'>"+n[i]+"</option>";
-        }
-        for(var j=0;j<total_mfields;j++){
-                document.getElementById('mapping'+j).innerHTML = options;
-                //document.getElementById('mapping'+j).innerHTML += "<option value='add_custom"+j+"'>Add Custom Field</option>";
-                document.getElementById('textbox'+j).style.display = 'none';
-                document.getElementById('customspan'+j).style.display = 'none';
-        }
-}
-
-function shownotification(msg, alerts)
-{
-        var newclass;
-        var divid = "notification_wp_csv";
-
-        if(alerts == 'success')
-                newclass = "alert alert-success";
-        else if(alerts == 'danger')
-                newclass = "alert alert-danger";
-        else if(alerts == 'warning')
-                newclass = "alert alert-warning";
-        else
-                newclass = "alert alert-info";
-
-        jQuery('#'+divid).removeClass()
-        jQuery('#'+divid).html(msg);
-        jQuery('#'+divid).addClass(newclass);
-        // Scroll
-        jQuery('html,body').animate({
-                scrollTop: jQuery("#"+divid).offset().top},
-        'slow'); 
-}
-
-function import_csv() 
-{
-	// code added by goku to check whether templatename
-	var mapping_checked = jQuery('#mapping_templatename_checked').is(':checked');
-	var mapping_tempname = jQuery('#mapping_templatename').val();
-	var mapping_checked_radio = jQuery('input[name=tempaction]:radio:checked').val();
-	if(mapping_checked || mapping_checked_radio == 'saveas')	
-	{
-		if(mapping_checked_radio == 'saveas')
-			mapping_tempname = jQuery('#mapping_templatename_edit').val();
-
-		if(jQuery.trim(mapping_tempname) == '')	
-		{
-			alert('Template name is empty');
-			return false;
-		}
-		else
-		{
-			// check templatename already exists
-			jQuery.ajax({
-		                type: 'POST',
-                		url: ajaxurl,
-				async: false,
-		                data: {
-                		    'action'       : 'checktemplatename',
-		                    'templatename' : mapping_tempname,
-		                },
-                		success:function(data) 
-				{
-					if(data != 0)
-					{
-						jQuery('#mapping_templatename').val('');
-					}
-        	        	},
-		                error: function(errorThrown){
-        	        	        console.log(errorThrown);
-        		        }
-		        });		
-		}
-	}
-	var mapping_tempname = jQuery('#mapping_templatename').val();
-	if(mapping_checked_radio == 'saveas')
-        	//mapping_tempname = jQuery('#mapping_templatename_edit').val();
-
-	if(mapping_tempname == '' && (mapping_checked || mapping_templatename_edit == 'saveas'))
-	{
-		alert('Template Name already exists');return false;
-	}
-	// code ends here on checking templatename
-
-    var importer = document.getElementById('selectedImporter').value;
-    var header_count = document.getElementById('h2').value;
-    var array = new Array();
-    var val1, val2, val3, val4, val5, val6, val7, error_msg, chk_status_in_csv, post_status_msg;
-    val1 = val2 = val3 = val4 = val5 = val6 = val7 = post_status_msg = post_type = 'Off';
-    for (var i = 0; i < header_count; i++) {
-        var e = document.getElementById("mapping" + i);
-        var value = e.options[e.selectedIndex].value;
-        array[i] = value;
-    }
-//alert(array.length);
-    if (importer == 'post' || importer == 'page' || importer == 'custompost') { 
-	if(importer == 'custompost') {
-        	var getSelectedIndex = document.getElementById('custompostlist');
-	        var SelectedIndex = getSelectedIndex.value;
-			//var t=getSelectedIndex.options[getSelectedIndex.selectedIndex];
-			if( SelectedIndex != 'select')
-			post_type='On';
-			//alert(t+'---'+SelectedIndex);
-	}
-
-        chk_status_in_csv = document.getElementById('importallwithps').value;
-        if (chk_status_in_csv != 0)
-            post_status_msg = 'On';
-
-        for (var j = 0; j < array.length; j++) {
-            if (array[j] == 'post_title') {
-                val1 = 'On';
-            }
-            if (array[j] == 'post_content') {
-                val2 = 'On';
-            }
-            if (post_status_msg == 'Off') {
-                if (array[j] == 'post_status')
-                    post_status_msg = 'On';
-            }
-        }
-        if (importer != 'custompost' && val1 == 'On' && val2 == 'On' && post_status_msg == 'On') {
-		return true;
-        }
-	else if (importer == 'custompost' && val1 == 'On' && val2 == 'On' && post_status_msg == 'On' && post_type=='On') {
-                return true;
-        }
-        else {
-            error_msg = '';
-            if (val1 == 'Off')
-                error_msg += " post_title,";
-            if (val2 == 'Off')
-                error_msg += " post_content,";
-	    if(importer == 'custompost') {
-	            if (SelectedIndex == 'select')
-        	        error_msg += " post_type,";
-	    }
-            if (post_status_msg == 'Off')
-                error_msg += " post_status";
-            showMapMessages('error', 'Error: ' + error_msg + ' - Mandatory fields. Please map the fields to proceed.');
-            return false;
-        }
-    }
-
-// validation starts
-else if(importer == 'comments'){
-        //var getSelectedIndex1 = document.getElementById('selectPosts');
-        //var SelectedIndex1 = getSelectedIndex1.options[getSelectedIndex1.selectedIndex].text;
-                for(var j=0;j<array.length;j++){
-                        if(array[j] == 'comment_author'){
-                                val1 = 'On';
-                        }
-                        if(array[j] == 'comment_author_email'){
-                                val2 = 'On';
-                        }
-                        if(array[j] == 'comment_content'){
-                                val3 = 'On';
-                        }
-			if(array[j] == 'comment_post_ID'){
-                                val4 = 'On';
-                        }
-
-
-                }
-                if(val1 == 'On' && val2 == 'On' && val3 == 'On' && val4 == 'On') {
-                 return true;
-                }
-                else{
-                 showMapMessages('error',' "Post Id", "Comment Author", "Comment Author Email" and "Comment Content" should be mapped.');
-                 return false;
-                }
-
-	
-		showMapMessages('error',header_count);return false;
-	}
-	else if(importer == 'users'){
-		//var getSelectedIndex = document.getElementById('userrole');
-		//var SelectedIndex = getSelectedIndex.options[getSelectedIndex.selectedIndex].text;
-		for(var j=0;j<array.length;j++){
-			if(array[j] == 'user_login'){
-				val1 = 'On';	
-			}
-			if(array[j] == 'user_email'){
-				val2 = 'On';
-			}
-			if(array[j] == 'role'){
-				val3 = 'On';
-			}
-		}
-		if(val1 == 'On' && val2 == 'On' && val3 == 'On') {
-	   	 return true;
-		}
-		else{
-		 showMapMessages('error','"role", "user_login" and "user_email" should be mapped.');
-		 return false;
-		}
-	}
-// validation ends
-}
-
-
-function showMapMessages(alerttype, msg) {
-    jQuery("#showMsg").addClass("maperror");
-    document.getElementById('showMsg').innerHTML = msg;
-    document.getElementById('showMsg').className += ' ' + alerttype;
-    document.getElementById('showMsg').style.display = '';
-    jQuery("#showMsg").fadeOut(10000);
-}
-
-function importRecordsbySettings(siteurl)
-{
-        var importlimit = document.getElementById('importlimit').value; 
-        var get_requested_count = importlimit; 
-        var tot_no_of_records = document.getElementById('checktotal').value;
-        var importas = document.getElementById('selectedImporter').value;
-        var uploadedFile = document.getElementById('checkfile').value;
-       // var no_of_columns = document.getElementById('h2').value;
-        var step = document.getElementById('stepstatus').value;
-        var mappingArr = document.getElementById('mappingArr').value;
-	var dupContent = document.getElementById('duplicatecontent').checked;
-	var dupTitle = document.getElementById('duplicatetitle').checked;
-	var currentlimit = document.getElementById('currentlimit').value;
-	var tmpCnt = document.getElementById('tmpcount').value;
-	var no_of_tot_records = document.getElementById('tot_records').value;
-        var get_log = document.getElementById('log').innerHTML;
-         document.getElementById('reportLog').style.display = '';
-         document.getElementById('terminatenow').style.display = '';
-        if(get_requested_count != '') {
-                //return true;
-        } else {
-                 document.getElementById('showMsg').style.display = "";
-                 document.getElementById('showMsg').innerHTML = '<p id="warning-msg" class="alert alert-warning">Fill all mandatory fields.</p>';			jQuery("#showMsg").fadeOut(10000);
-                 return false;
-        }
-	if(parseInt(get_requested_count) <= parseInt(no_of_tot_records)) {
-                document.getElementById('server_request_warning').style.display = 'none';
-        } else {
-                document.getElementById('server_request_warning').style.display = '';
-                return false;
-        }
-	if(get_log == '<p style="margin:15px;color:red;">NO LOGS YET NOW.</p>'){
-		document.getElementById('log').innerHTML = '<p style="margin:15px;color:red;">Your Import Is In Progress...</p>';
-		document.getElementById('startbutton').disabled = true;
-	}
-	document.getElementById('ajaxloader').style.display="";
-        var tempCount = parseInt(tmpCnt);
-        var totalCount = parseInt(tot_no_of_records);
-        if(tempCount>totalCount){
-		document.getElementById('ajaxloader').style.display="none";
-		document.getElementById('startbutton').style.display="none";
-		document.getElementById('importagain').style.display="";
-                document.getElementById('terminatenow').style.display = "none";
-		return false;
-	}
-
-	var postdata = new Array();
-	postdata = {'dupContent':dupContent,'dupTitle':dupTitle,'importlimit':importlimit,'limit':currentlimit,'totRecords':tot_no_of_records,'selectedImporter':importas,'uploadedFile':uploadedFile,'tmpcount':tmpCnt,}
-
-        var tmpLoc = document.getElementById('tmpLoc').value;
-	jQuery.ajax({
-		type: 'POST',
-		url: ajaxurl,
-		data: {
-		    'action'   : 'importByRequest',
-		    'postdata' : postdata,
-		    'siteurl'  : siteurl,
-		},
-		success:function(data) {
-                        if(parseInt(tmpCnt) == parseInt(tot_no_of_records)){
-                                document.getElementById('terminatenow').style.display = "none";
-                        } 
-        	        if(parseInt(tmpCnt) < parseInt(tot_no_of_records)){
-				var terminate_action = document.getElementById('terminateaction').value;
-				if(terminate_action == 'continue'){
-					currentlimit = parseInt(currentlimit)+parseInt(importlimit);
-					document.getElementById('currentlimit').value = currentlimit;
-					console.log('impLmt: '+importlimit+'totRecds: '+tot_no_of_records);
-					document.getElementById('tmpcount').value = parseInt(tmpCnt)+parseInt(importlimit);
-					setTimeout(function(){importRecordsbySettings()},0);
-				} else {
-					document.getElementById('log').innerHTML += "Import process has been terminated.</br>";
-					return false;
-				}
-	                }else{
-				document.getElementById('ajaxloader').style.display="none";
-		                document.getElementById('startbutton').style.display="none";
-		                document.getElementById('importagain').style.display="";
-        	                return false;
-	                }
-			document.getElementById('log').innerHTML += data+'<br/>';
-				
-		},
-		error: function(errorThrown){
-			console.log(errorThrown);
-		}
-	});
-}
-
-// Terminate import process
-function terminateProcess(){
-	document.getElementById('terminateaction').value = 'terminate';
-}
-
-
-// Enable/Disable WP-e-Commerce Custom Fields
-function enablewpcustomfield(val){
-	if(val == 'wpcustomfields'){
-		document.getElementById('wpcustomfieldstr').style.display = '';
-	}
-	else{
-		document.getElementById('wpcustomfields').checked = false;
-		document.getElementById('wpcustomfieldstr').style.display = 'none';
-	}
-}
-
-function saveSettings(){ //alert('dd');
-//document.getElementById('ShowMsg').style.display = '';
-jQuery(document).ready( function() {
-        jQuery('#ShowMsg').delay(2000).fadeOut();
-      });
-}
-
-function Reload(){
-window.location.reload();
-}
-
-function  check_if_avail(val){
-	var proModule = new Array();
-	proModule[0] = 'categories';
-	proModule[1] = 'customtaxonomy';
-	proModule[2] = 'eshop';
-	proModule[3] = 'marketpress';
-	proModule[4] = 'woocommerce';
-	proModule[5] = 'wpcommerce';
-	proModule[6] = 'cctm';
-	proModule[7] = 'types';
-	proModule[8] = 'acf';
-	proModule[9] = 'Customerreviews';
-	proModule[10] = 'WP-Members';
-	proModule[11] = 'yoastseo';
-	proModule[12] = 'caticonenable';
-	proModule[13] = 'custompostuitype';
-	proModule[14] = 'wpcustomfields';
-	proModule[15] = 'recommerce';
-	proModule[16] = 'automapping';
-	proModule[17] = 'utfsupport';
-        
-	
-	var warning_name = new Array();
-	warning_name['categories'] = 'Categories/Tags';
-	warning_name['customtaxonomy'] = 'Custom Taxonomy';
-	warning_name['eshop'] = 'Eshop';
-	warning_name['marketpress'] = 'Market Press Lite';
-	warning_name['woocommerce'] = 'WooCommerce';
-	warning_name['wpcommerce'] = 'WP e-Commerce';
-	warning_name['cctm'] = 'CCTM';
-	warning_name['types'] = 'Types';
-	warning_name['acf'] = 'ACF';
-	warning_name['Customerreviews'] = 'Customer Reviews';
-	warning_name['WP-Members'] = 'WP-Members';
-	warning_name['aioseo'] = 'All-in-SEO';
-	warning_name['yoastseo'] = 'Yoast SEO';
-	warning_name['caticonenable'] = 'Category Icons';
-	warning_name['custompostuitype'] = 'Custom Post Type UI';
-	warning_name['automapping'] = 'Auto Mapping';
-	warning_name['utfsupport'] = 'UTF Support';
-
-	var result = inArray(val, proModule);
-	if(result == true){
-
-		if(val == 'eshop' || val == 'wpcustomfields' || val == 'wpcommerce' || val == 'woocommerce' || val == 'marketpress'){
-			if(val == 'wpcommerce' || val == 'wpcustomfields') {
-				document.getElementById('wpcustomfieldstr').style.display = '';
-			} else {
-				document.getElementById('wpcustomfieldstr').style.display = '';
-			}
-			//			document.getElementById('wpcustomfieldstr').style.display = 'none';
-			document.getElementById('nonerecommerce').checked = true;
-		}
-		if(val == 'cctm' || val == 'acf'){
-			document.getElementById('nonercustompost').checked = true;
-		}
-		if(val == 'aioseo' || val == 'yoastseo'){
-			document.getElementById('nonerseooption').checked = true;
-		}
-		if(val == 'caticonenable'){
-			document.getElementById('caticondisable').checked = true;
-		}
-		document.getElementById(val).checked = false;
-		document.getElementById('ShowMsg').style.display = "";
-		document.getElementById('warning-msg').innerHTML = warning_name[val]+' feature is available only for PRO!.';
-		jQuery('#ShowMsg').delay(7000).fadeOut();
-	}
-}
-
-function inArray(needle, haystack) {
-    var length = haystack.length;
-    for(var i = 0; i < length; i++) {
-        if(typeof haystack[i] == 'object') {
-            if(arrayCompare(haystack[i], needle)) {
-		 return true;
-	    }
-        } else {
-            if(haystack[i] == needle) {
-		 return true;
-	    }
-        }
-    }
-    return false;
-}
-
-function import_again(){
-	var get_current_url = document.getElementById('current_url').value;
-	window.location.assign(get_current_url);
-}
-function sendemail2smackers(){
-//	var useremail = document.getElementById('usermailid').value;
-	var message_content = document.getElementById('message').value;
-	var firstname = document.getElementById('firstname').value;
-	var lastname = document.getElementById('lastname').value;
-	if(message_content != '' && firstname != '' && lastname != '')
-		return true;
-	else
-		document.getElementById('showMsg').style.display = '';
-		document.getElementById('showMsg').innerHTML = '<p id="warning-msg" class="alert alert-warning">Fill all mandatory fields.</p>';
-		jQuery("#showMsg").fadeOut(10000);
-		return false;
-}
-
-
-function check_allnumeric(inputtxt)  
-{  
-	var numbers = /^[0-9]+$/;  
-	if(inputtxt.match(numbers))  
-	{  
-		return true;
-	}  
-	else  
-	{  
-		if(inputtxt == '')
-			alert('Fill all mandatory fields.');
-		else
-			alert('Please enter numeric characters only');  
-		return false;  
-	}  
-}
-
-function gotoback() {
-	var currentURL = document.getElementById('current_url').value;
-	var set_assigned_step = currentURL.replace("uploadfile","mapping_settings");
-//	window.location.assign(set_assigned_step);
-}
-function export_module(){
-        var get_selected_module = document.getElementsByName('export');
-//      alert(get_selected_module);
-        for (var i = 0, length = get_selected_module.length; i < length; i++) {
-                if (get_selected_module[i].checked) {
-                        // do whatever you want with the checked radio
-                        //alert(get_selected_module[i].value);
-                        // only one radio can be logically checked, don't check the rest
-                        //break;
-                        return true;
-                }
-        }
-        showMapMessages('error', 'Please choose one module to export the records!');
-        return false;
-}
-function export_check(value) {
-	if( value == 'woocommerce' || value == 'wpcommerce' || value == 'marketpress' || value == 'users' || value == 'category' || value == 'tags' || value == 'customtaxonomy') { 
-		document.getElementById(value).checked = false;
-		document.getElementById('ShowMsg').style.display = "";
-		value = value.toUpperCase();
-		document.getElementById('warning-msg').innerHTML = value+' Feature is available only for PRO!.';
-		jQuery('#ShowMsg').delay(7000).fadeOut();
-	}
-}
-function choose_import_method(id) {
-        if(id == 'uploadfilefromcomputer') {
-                document.getElementById('boxmethod1').style.border = "1px solid #ccc";
-                document.getElementById('method1').style.display = '';
-                document.getElementById('method1').style.height = '40px';
-}
-}
-function choose_import_mode(id) {
-        if(id == 'importNow') {
-               document.getElementById('importrightaway').style.display='';
-               document.getElementById('reportLog').style.display='';
-               document.getElementById('schedule').style.display='none';
-         }
-        if(id == 'scheduleNow') {
-               document.getElementById('schedule').style.display='';
-               document.getElementById('importrightaway').style.display='none';
-               document.getElementById('reportLog').style.display='none';
-         }
-}
-function selectModules(id) {
-  var param = id ;
- if(param == 'checkallModules') {
-    document.getElementById('post').checked = true;
-    document.getElementById('page').checked = true;
-    document.getElementById('users').checked = true;
-    document.getElementById('comments').checked = true;
-    document.getElementById('custompost').checked = true;
- }
- else if(param == 'uncheckallModules') {
-
-    document.getElementById('post').checked = false;
-    document.getElementById('page').checked = false;
-    document.getElementById('users').checked = false;
-    document.getElementById('comments').checked = false;
-    document.getElementById('custompost').checked = false;
-  }
-}
-

programming_language: unknown
filename: UploadHandler.php
change_type: ModificationType.MODIFY
diff: @@ -9,10 +9,8 @@
  * Licensed under the MIT license:
  * http://www.opensource.org/licenses/MIT
  */
-
-require_once("../../../../../wp-load.php");
-require_once("../../includes/WPImporter_includes_helper.php");
-
+$parse_uri = explode( 'wp-content', $_SERVER['SCRIPT_FILENAME'] );
+require_once($parse_uri[0]."wp-load.php");
 $impCheckobj = CallWPImporterObj::checkSecurity();
 if($impCheckobj != 'true')
 die($impCheckobj);

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -34,11 +34,11 @@
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
+$impCE = new WPImporter_includes_helper();
+$nonce_Key = $impCE->create_nonce_key();
 ?>
 <div style="width:100%;">
 <div id="accordion">
-<?php $impCE = new WPImporter_includes_helper(); 
-?>
 <table class="table-importer">
 <tr>
 <td>
@@ -65,6 +65,7 @@
 <div class="container">
   <?php echo $impCE->smack_csv_import_method(); ?>
 <input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
 <?php $uploadDir = wp_upload_dir(); ?>
 <input type="hidden" id="uploaddir" value="<?php if(isset($uploadDir['basedir'])) { echo $uploadDir['basedir']; }  ?>">
 <input type="hidden" id="uploadFileName" name="uploadfilename" value="">
@@ -231,6 +232,7 @@ $allcustomposts.=$value.',';
    <input type='hidden' id='current_record' name='current_record' value='0' />
    <input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; }  ?>' />
    <input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
+   <input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
    <input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename; }  ?>" />
    <!-- real uploaded filename -->
    <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) { echo $uploaded_csv_name; }  ?>" />
@@ -408,6 +410,7 @@ $mFieldsArr = substr($mFieldsArr, 0, -1);
                         <input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing                        <br>
                         <input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing                        <br>-->
 			<label id='importalign'><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+			<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 			<label id='importalign'><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 
 			 <label id='importalign'>No. of posts/rows per server request</label> <span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?><br>

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -36,6 +36,7 @@
  ********************************************************************************/
 
 $impCE = new WPImporter_includes_helper();
+$nonce_Key = $impCE->create_nonce_key();
 ?>
 	<div style="width:100%;">
 	<div id="accordion">
@@ -62,6 +63,7 @@ $impCE = new WPImporter_includes_helper();
 	<div class="container">
           <?php echo $impCE->smack_csv_import_method(); ?>
 	<input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
 	<?php $uploadDir = wp_upload_dir(); ?>
 	<input type="hidden" id="uploaddir" value="<?php if(isset($uploadDir)) { echo $uploadDir['basedir']; }  ?>">
 	<input type="hidden" id="uploadFileName" name="uploadfilename" value="">
@@ -333,6 +335,7 @@ $impCE = new WPImporter_includes_helper();
 			<input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; }  ?>' />
 			<input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
 			<input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename; }  ?>" />
+			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
                         <!-- real uploaded filename -->
                         <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) { echo $uploaded_csv_name; }  ?>" />
 			<input type='hidden' id='select_delimeter' name='select_delimeter' value="<?php if(isset($delimeter)) { echo  $delimeter; }  ?>" />
@@ -537,6 +540,7 @@ $impCE = new WPImporter_includes_helper();
 		<input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing <br>
 		<input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing <br>-->
 		<label id="importalign"><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+		<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 		<label id="importalign"><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 		 <label id="importalign">No. of posts/rows per server request</label> <span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?><br>
 			<span class='msg' id='server_request_warning' style="display:none;color:red;margin-left:-10px;">You can set upto <?php echo $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['totRecords']; ?> per request.</span>

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -36,6 +36,7 @@
  ********************************************************************************/
 require_once(WP_CONST_ULTIMATE_CSV_IMP_DIRECTORY.'/includes/WPImporter_includes_helper.php');
 $impCE = new WPImporter_includes_helper();
+$nonce_Key = $impCE->create_nonce_key();
 $eshopObj = new EshopActions();
 $eshopObj->isplugin();
 ?>
@@ -99,6 +100,7 @@ if ($_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['isplugin_avail'] != 'not_avail'
         <?php echo $impCE->smack_csv_import_method(); ?>
 
 	<input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
 	<?php $uploadDir = wp_upload_dir(); ?>
 	<input type="hidden" id="uploaddir" value="<?php if(isset($uploadDir)) { echo $uploadDir['basedir']; }  ?>">
 	<input type="hidden" id="uploadFileName" name="uploadfilename" value="">
@@ -316,6 +318,7 @@ if ($_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['isplugin_avail'] != 'not_avail'
 			<input type='hidden' id='current_record' name='current_record' value='0' />
 			<input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; }  ?>' />
 			<input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
+			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
 			<input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename;  }  ?>" />
                         <!-- real uploaded filename -->
                         <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) {   echo $uploaded_csv_name;  }  ?>" />
@@ -521,6 +524,7 @@ if ($_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['isplugin_avail'] != 'not_avail'
 		<input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing <br>
 		<input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing <br>-->
 		<label id='importalign'><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+		<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 		<label id='importalign'><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 		 <label id='importalign'>No. of posts/rows per server request</label> <span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?><br>
 		<span class='msg' id='server_request_warning' style="display:none;color:red;margin-left:-10px;">You can set upto <?php echo $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['totRecords']; ?> per request.</span>

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -36,6 +36,8 @@
  ********************************************************************************/
 
 $impCE = new WPImporter_includes_helper();
+$nonce_Key = $impCE->create_nonce_key();
+
 ?>
 	<div style="width:100%;">
 	<div id="accordion">
@@ -62,6 +64,7 @@ $impCE = new WPImporter_includes_helper();
 	<div class="container">
            <?php echo $impCE->smack_csv_import_method(); ?>
 	<input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
 	<?php $uploadDir = wp_upload_dir(); ?>
 	<input type="hidden" id="uploaddir" value="<?php  if(isset($uploadDir['basedir'])) {  echo $uploadDir['basedir']; }  ?>">
 	<input type="hidden" id="uploadFileName" name="uploadfilename" value="">
@@ -273,6 +276,7 @@ $impCE = new WPImporter_includes_helper();
 			<input type='hidden' id='current_record' name='current_record' value='0' />
 			<input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; } ?>' />
 			<input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
+			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
 			<input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename; }  ?>" />
                         <!-- real uploaded filename -->
                         <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) { echo $uploaded_csv_name;  }  ?>" />
@@ -474,6 +478,7 @@ $impCE = new WPImporter_includes_helper();
 		<input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing <br>
 		<input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing <br>-->
 		<label id="importalign"><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 		<label id="importalign"><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 		 <label id="importalign">No. of posts/rows per server request</label> <span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?> <br>
 			<span class='msg' id='server_request_warning' style="display:none;color:red;margin-left:-10px;">You can set upto <?php echo $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['totRecords']; ?> per request.</span>

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -35,7 +35,7 @@
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
 $impCE = new WPImporter_includes_helper();
-
+$nonce_Key = $impCE->create_nonce_key();
 ?>
 	<div style="width:100%;">
 	<div id="accordion">
@@ -63,6 +63,7 @@ $impCE = new WPImporter_includes_helper();
         <?php echo $impCE->smack_csv_import_method(); ?>
 
 	<input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+	<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' /> 
 	<?php $uploadDir = wp_upload_dir(); ?>
 	<input type="hidden" id="uploaddir" value="<?php if(isset($uploadDir)) { echo $uploadDir['basedir']; }  ?>">
 	<input type="hidden" id="uploadFileName" name="uploadfilename" value="">
@@ -279,6 +280,7 @@ $impCE = new WPImporter_includes_helper();
 			<input type='hidden' id='current_record' name='current_record' value='0' />
 			<input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; }  ?>' />
 			<input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
+			<input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
 			<input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename;  }  ?>" />
                         <!-- real uploaded filename -->
                         <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) {   echo $uploaded_csv_name;  }  ?>" />
@@ -483,6 +485,7 @@ $impCE = new WPImporter_includes_helper();
 		<input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing <br>
 		<input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing <br>-->
 		<label id="importalign"><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+		<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 		<label id="importalign"><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 		 <label id="importalign">No. of posts/rows per server request</label><span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?><br>
 			<span class='msg' id='server_request_warning' style="display:none;color:red;margin-left:-10px;">You can set upto <?php echo $_SESSION['SMACK_MAPPING_SETTINGS_VALUES']['totRecords']; ?> per request.</span>	

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,10 @@
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
+$impCE = new WPImporter_includes_helper();
+$nonce_Key = $impCE->create_nonce_key();
+if(! wp_verify_nonce($nonce_Key, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
 ?>
 <div style ='text-align:center;margin:0;color:red;font-size:smaller;'> Your Required Settings Configuration Please Select Security and Performance tab </div></br>
 <div id="ShowMsg" style="display:none;"><p id="warning-msg" class="alert alert-warning"><?php echo $skinnyData['plugStatus'];?></p></div>
@@ -382,14 +386,14 @@ global $wpdb; ?>
                                 <tr><td>
 					<label class=$utfsupport><input type='checkbox' name='rutfsupport' id='utfsupport' value='utfsupport' checked disabled onclick="check_if_avail(this.id);" ><span id="align">Enable UTF Support</span></label>
 				</td></tr>
-                                <tr class="databorder"><td>
+                                <!--<tr class="databorder"><td>
 					<label id="align">Export Delimiter
 					<select name="export_delimiter">
-						<option>;</option>
-						<option>,</option>
+						<option value = ";">;</option>
+						<option value = ",">,</option>
 					</select>
 					</label>
-				</td></tr>
+				</td></tr>-->
                                 <tr class="databorder"><td>
                                         <h3 id="innertitle">Debug Mode</h3>
                                         <label>You can enable/disable the debug mode.</label> </td><td>
@@ -518,7 +522,8 @@ global $wpdb; ?>
                         <h3 id="innertitle" colspan="2" >Required Loaders and Extentions:</h3>
                         <table class="table table-striped">
                         <?php $loaders_extensions = get_loaded_extensions();
-                              $mod_security = apache_get_modules();
+				if(function_exists('apache_get_modules'))
+                                   $mod_security = apache_get_modules();
                        ?>
                         <tr><td>IonCube Loader </td><td><?php if(in_array('ionCube Loader', $loaders_extensions)) {
                                         echo '<label style="color:green;">Yes</label>';
@@ -535,7 +540,7 @@ global $wpdb; ?>
                                 } else {
                                         echo '<label style="color:red;">No</label>';
                                 } ?></td><td></td></tr>
-                         <tr><td>Mod Security </td><td><?php if(in_array('mod_security.c', $mod_security)) {
+                         <tr><td>Mod Security </td><td><?php if(isset($mod_security) && in_array('mod_security.c', $mod_security)) {
                                         echo '<label style="color:green;">Yes</label>';
                                 } else {
                                         echo '<label style="color:red;">No</label>';

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -42,6 +42,7 @@ require_once(WP_CONST_ULTIMATE_CSV_IMP_DIRECTORY.'/includes/WPImporter_includes_
 <div id="accordion">
 <?php 
 $impCE = new WPImporter_includes_helper(); 
+$nonce_Key = $impCE->create_nonce_key();
 ?>
 <table class="table-importer">
 <tr>
@@ -66,6 +67,7 @@ $impCE = new WPImporter_includes_helper();
 <div class="container">
    <?php echo $impCE->smack_csv_import_method(); ?>
 <input type ='hidden' id="pluginurl"value="<?php echo WP_CONTENT_URL;?>">
+<input type='hidden' id='dirpathval' name='dirpathval' value='<?php echo ABSPATH; ?>' />
 <?php $uploadDir = wp_upload_dir(); ?>
 <input type="hidden" id="uploaddir" value="<?php if(isset($uploadDir['basedir'])) { echo $uploadDir['basedir']; }  ?>">
 <input type="hidden" id="uploadFileName" name="uploadfilename" value="">
@@ -229,6 +231,7 @@ $allcustomposts.=$value.',';
    <input type='hidden' id='current_record' name='current_record' value='0' />
    <input type='hidden' id='totRecords' name='totRecords' value='<?php if(isset($records)) { echo $records; }  ?>' />
    <input type='hidden' id='tmpLoc' name='tmpLoc' value='<?php echo WP_CONST_ULTIMATE_CSV_IMP_DIR; ?>' />
+   <input type='hidden' id='nonceKey' name='wpnonce' value='<?php echo $nonce_Key; ?>' />
    <input type='hidden' id='uploadedFile' name='uploadedFile' value="<?php if(isset($filename)) { echo  $filename; }  ?>" />
    <!-- real uploaded filename -->
    <input type='hidden' id='uploaded_csv_name' name='uploaded_csv_name' value="<?php if(isset($uploaded_csv_name)) { echo $uploaded_csv_name; }  ?>" />
@@ -405,6 +408,7 @@ $mFieldsArr = substr($mFieldsArr, 0, -1);
                         <input name="filterhtml" id="filterhtml" type="checkbox" value="1"> Filter out HTML-Tags while comparing                        <br>
                         <input name="filterhtmlentities" id="filterhtmlentities" type="checkbox" value="1"> Decode HTML-Entities before comparing                        <br>-->
 			<label id='importalign'><input name='duplicatecontent' id='duplicatecontent' type="checkbox" value=""> Detect duplicate post content</label> <br>
+			<input type='hidden' name='wpnoncekey' id='wpnoncekey' value='<?php echo $nonce_Key; ?>' />
 			<label id='importalign'><input name='duplicatetitle' id='duplicatetitle' type="checkbox" value="" > Detect duplicate post title</label> <br>
 
 			 <label id='importalign'>No. of posts/rows per server request</label> <span class="mandatory" style="margin-left:-13px;margin-right:10px">*</span> <input name="importlimit" id="importlimit" type="text" value="1" placeholder="10" onblur="check_allnumeric(this.value);"></label> <?php echo $impCE->helpnotes(); ?><br>	

programming_language: PHP
filename: import.php
change_type: ModificationType.MODIFY
diff: @@ -34,7 +34,10 @@
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
-//require_once(WP_CONST_ULTIMATE_CSV_IMP_DIR.'includes/WPImporter_includes_helper.php');
+$noncevar = isset($_POST['postdata']['wpnonce']) ? $_POST['postdata']['wpnonce'] : '';
+if(!wp_verify_nonce($noncevar, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
+
 $impCheckobj = CallWPImporterObj::checkSecurity();
 if($impCheckobj != 'true')
 die($impCheckobj);
@@ -46,7 +49,7 @@ $importedAs = Null;
 $inserted_post_count = 0;
 $noofrecords = '';
 if ($curr_action != 'post' && $curr_action != 'page' && $curr_action != 'custompost') {
-	require_once(plugin_dir_path(__FILE__) . '../modules/' . $curr_action . '/actions/actions.php');
+	require_once(WP_CSVIMP_PLUGIN_BASE . '/modules/' . $curr_action . '/actions/actions.php');
 }
 if ($curr_action == 'post' || $curr_action == 'page' || $curr_action == 'custompost') {
 	$importObj = new WPImporter_includes_helper();

programming_language: PHP
filename: layout.php
change_type: ModificationType.MODIFY
diff: @@ -34,6 +34,10 @@
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
+$impObj = new WPImporter_includes_helper();
+$nonceKey = $impObj->create_nonce_key();
+if(! wp_verify_nonce($nonceKey, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
 ?>
 
 <style> #ui-datepicker-div { display:none } </style>

programming_language: PHP
filename: menu.php
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,10 @@
  * You can contact Smackcoders at email address info@smackcoders.com.
  *******************************************************************************************/
 //require_once(WP_CONST_ULTIMATE_CSV_IMP_DIR.'includes/WPImporter_includes_helper.php');
+$impObj = new WPImporter_includes_helper();
+$nonceKey = $impObj->create_nonce_key();
+if(! wp_verify_nonce($nonceKey, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
 $impCheckobj = CallWPImporterObj::checkSecurity();
 if($impCheckobj != 'true')
 die($impCheckobj);

programming_language: PHP
filename: readfile.php
change_type: ModificationType.MODIFY
diff: @@ -34,13 +34,14 @@
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
-
-require_once('../includes/WPImporter_includes_helper.php');
+$parse_uri = explode( 'wp-content', $_SERVER['SCRIPT_FILENAME'] );
++require_once($parse_uri[0]."wp-load.php");
 $impCheckobj = CallWPImporterObj::checkSecurity();
 if($impCheckobj != 'true')
 die($impCheckobj);
-
-require_once('../../../../wp-load.php');
+$noncevar = isset($_REQUEST['wpnonce']) ? $_REQUEST['wpnonce'] : '';
+if(! wp_verify_nonce($noncevar, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
 
 $requested_module = "";
 if(isset($requested_module))

programming_language: PHP
filename: versioncheck.php
change_type: ModificationType.MODIFY
diff: @@ -34,7 +34,10 @@
  * Notices must display the words
  * "Copyright Smackcoders. 2014. All rights reserved".
  ********************************************************************************/
-//require_once(WP_CONST_ULTIMATE_CSV_IMP_DIR.'includes/WPImporter_includes_helper.php');
+$impObj = new WPImporter_includes_helper();
+$nonceKey = $impObj->create_nonce_key();
+if(! wp_verify_nonce($nonceKey, 'smack_nonce'))
+die('You are not allowed to do this operation.Please contact your admin.');
 $impCheckobj = CallWPImporterObj::checkSecurity();
 if($impCheckobj != 'true')
 die($impCheckobj);

programming_language: PHP