Merge pull request #803 from brainstormforce/release-candidate

Build: v1.6.29

README.md

@@ -5,7 +5,7 @@
 **Requires at least:** 4.4  
 **Requires PHP:** 5.4  
 **Tested up to:** 6.5  
-**Stable tag:** 1.6.28  
+**Stable tag:** 1.6.29  
 **License:** GPLv2 or later  
 **License URI:** http://www.gnu.org/licenses/gpl-2.0.html  
 
@@ -140,6 +140,10 @@ This same applies when you are creating your Header/Footer using this plugin.
 
 ## Changelog ##
 
+### 1.6.29 ###
+- Fix: Navigation Menu – The submenu container opens without hovering over the parent menu item.
+- Fix: This update addressed a security bug. Props to Wordfence.
+
 ### 1.6.28 ###
 - Fix: Error messages appearing for Display rules.
 

composer.json

@@ -2,7 +2,8 @@
   "name": "nikschavan/header-footer-elementor",
   "description": "Create Header and Footer using Elementor page builder.",
   "require": {
-    "brainstormforce/astra-notices": "^1.1"
+    "brainstormforce/astra-notices": "^1.1",
+    "enshrined/svg-sanitize": "^0.18.0"
   },
   "extra": {
       "installer-paths": {

header-footer-elementor.php

@@ -7,14 +7,14 @@
  * Author URI:  https://www.brainstormforce.com/
  * Text Domain: header-footer-elementor
  * Domain Path: /languages
- * Version: 1.6.28
+ * Version: 1.6.29
  * Elementor tested up to: 3.21
  * Elementor Pro tested up to: 3.21
  *
  * @package         header-footer-elementor
  */
 
-define( 'HFE_VER', '1.6.28' );
+define( 'HFE_VER', '1.6.29' );
 define( 'HFE_FILE', __FILE__ );
 define( 'HFE_DIR', plugin_dir_path( __FILE__ ) );
 define( 'HFE_URL', plugins_url( '/', __FILE__ ) );
@@ -26,6 +26,11 @@
  */
 require_once HFE_DIR . '/inc/class-header-footer-elementor.php';
 
+/**
+ * Include Composer autoloader.
+ */
+require_once HFE_DIR . 'vendor/autoload.php';
+
 /**
  * Load the Plugin Class.
  */

inc/class-hfe-settings-page.php

@@ -165,7 +165,7 @@ public function hfe_compatibility_option_callback() {
 		<p class="description">
 			<?php
 			echo sprintf(
-				esc_html__( 'Sometimes above methods might not work well with your theme, in this case, contact your theme author and request them to add support for the <a href="https://github.com/Nikschavan/header-footer-elementor/wiki/Adding-Header-Footer-Elementor-support-for-your-theme">plugin.</>', 'header-footer-elementor' ),
+				wp_kses( 'Sometimes above methods might not work well with your theme, in this case, contact your theme author and request them to add support for the <a href="https://github.com/Nikschavan/header-footer-elementor/wiki/Adding-Header-Footer-Elementor-support-for-your-theme">plugin.</a>', 'header-footer-elementor' ),
 				'<br>'
 			);
 			?>

inc/widgets-css/frontend.css

@@ -120,6 +120,13 @@ div.hfe-nav-menu,
     clear: both;
 }
 
+.hfe-nav-menu__layout-horizontal .hfe-nav-menu .sub-menu {
+	display: none;
+}
+
+.hfe-nav-menu__layout-horizontal .hfe-nav-menu li.menu-item:hover > .sub-menu {
+    display: block;
+} 
 
 /* Alignemnt CSS */
 .hfe-nav-menu__align-right .hfe-nav-menu {

inc/widgets-manager/class-widgets-loader.php

@@ -58,6 +58,9 @@ private function __construct() {
 		// Add svg support.
 		add_filter( 'upload_mimes', [ $this, 'hfe_svg_mime_types' ] ); // PHPCS:Ignore WordPressVIPMinimum.Hooks.RestrictedHooks.upload_mimes
 
+		// Add filter to sanitize uploaded SVG files.
+		add_filter( 'wp_handle_upload_prefilter', [ $this, 'sanitize_uploaded_svg' ] );
+
 		// Refresh the cart fragments.
 		if ( class_exists( 'woocommerce' ) ) {
 
@@ -159,6 +162,41 @@ public function hfe_svg_mime_types( $mimes ) {
 		return $mimes;
 	}
 
+	/**
+	 * Sanitize uploaded SVG files before they are saved.
+	 *
+	 * @param array $file Array of uploaded file information.
+	 * @return array Modified array of uploaded file information.
+	 */
+	public function sanitize_uploaded_svg( $file ) {
+		if ( 'image/svg+xml' === $file['type'] ) {
+			$clean_svg = $this->sanitize_svg( $file['tmp_name'] );
+
+			if ( false !== $clean_svg ) {
+				file_put_contents( $file['tmp_name'], $clean_svg );
+			}           
+		}
+
+		return $file;
+	}
+	/**
+	 * Sanitize SVG content using enshrined\svgSanitize\Sanitizer.
+	 *
+	 * @param string $file_path Path to the SVG file.
+	 * @return string|bool Sanitized SVG content or false on failure.
+	 */
+	public function sanitize_svg( $file_path ) {
+		$sanitizer = new \enshrined\svgSanitize\Sanitizer();
+		$dirty_svg = file_get_contents( $file_path );
+		$clean_svg = $sanitizer->sanitize( $dirty_svg );
+
+		if ( false !== $clean_svg ) {
+			return $clean_svg;
+		} else {
+			return false;
+		}       
+	}
+
 	/**
 	 * Register Category
 	 *

languages/header-footer-elementor.pot

@@ -2,10 +2,10 @@
 # This file is distributed under the same license as the Elementor Header & Footer Builder package.
 msgid ""
 msgstr ""
-"Project-Id-Version: Elementor Header & Footer Builder 1.6.28\n"
+"Project-Id-Version: Elementor Header & Footer Builder 1.6.29\n"
 "Report-Msgid-Bugs-To: "
 "https://wordpress.org/support/plugin/header-footer-elementor\n"
-"POT-Creation-Date: 2024-04-16 10:00:51+00:00\n"
+"POT-Creation-Date: 2024-05-14 05:36:53+00:00\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=utf-8\n"
 "Content-Transfer-Encoding: 8bit\n"
@@ -389,14 +389,6 @@ msgstr ""
 msgid "Method 2"
 msgstr ""
 
-#: inc/class-hfe-settings-page.php:168
-msgid ""
-"Sometimes above methods might not work well with your theme, in this case, "
-"contact your theme author and request them to add support for the <a "
-"href=\"https://github.com/Nikschavan/header-footer-elementor/wiki/Adding-"
-"Header-Footer-Elementor-support-for-your-theme\">plugin.</>"
-msgstr ""
-
 #: inc/class-hfe-settings-page.php:187 inc/class-hfe-settings-page.php:188
 #: inc/class-hfe-settings-page.php:833
 msgid "Settings"
@@ -740,7 +732,7 @@ msgstr ""
 msgid "The same display setting is already exist in %s post/s."
 msgstr ""
 
-#: inc/widgets-manager/class-widgets-loader.php:234
+#: inc/widgets-manager/class-widgets-loader.php:272
 #: inc/widgets-manager/widgets/class-cart.php:51
 #: inc/widgets-manager/widgets/class-cart.php:651
 msgid "Cart"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "header-footer-elementor",
-  "version": "1.6.28",
+  "version": "1.6.29",
   "main": "Gruntfile.js",
   "author": "Nikhil Chavan",
   "devDependencies": {

readme.txt

@@ -5,7 +5,7 @@ Donate link: https://www.paypal.me/BrainstormForce
 Requires at least: 4.4
 Requires PHP: 5.4
 Tested up to: 6.5
-Stable tag: 1.6.28
+Stable tag: 1.6.29
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -140,6 +140,10 @@ This same applies when you are creating your Header/Footer using this plugin.
 
 == Changelog ==
 
+= 1.6.29 =
+- Fix: Navigation Menu – The submenu container opens without hovering over the parent menu item.
+- Fix: This update addressed a security bug. Props to Wordfence.
+
 = 1.6.28 =
 - Fix: Error messages appearing for Display rules.