Recommended Fixes from Plugin Checker

Benjamin Pick · Benjamin Pick · commit 159087c7c068 · 2025-10-22T22:16:15.000+02:00
diff --git a/admin-ui.php b/admin-ui.php
@@ -195,7 +195,7 @@ function geoip_detect_option_page() {
 				break;
 
 			case 'choose':
-				$sourceId = sanitize_text_field($_POST['options']['source']);
+				$sourceId = sanitize_text_field(isset($_POST['options']['source']) ? $_POST['options']['source'] : '' );
 				$registry->setCurrentSource($sourceId);
 				break;
 
@@ -219,7 +219,7 @@ function geoip_detect_option_page() {
 					if (in_array($opt_name, $numeric_options))
 						$opt_value = isset($_POST['options'][$opt_name]) ? (int) $_POST['options'][$opt_name] : 0;
 					else {
-						$opt_value = geoip_detect_sanitize_option($opt_name, @$_POST['options'][$opt_name], $m);
+						$opt_value = geoip_detect_sanitize_option($opt_name, isset($_POST['options'][$opt_name]) ? $_POST['options'][$opt_name] : '', $m);
 					}
 					if ($m) {
 						$messages[] = $m;
diff --git a/ajax.php b/ajax.php
@@ -49,7 +49,7 @@ function geoip_detect_ajax_get_info_from_current_ip() {
 	
 	// Referer check
 	
-    $referer = _geoip_detect_get_domain_name($_SERVER['HTTP_REFERER']);
+    $referer = _geoip_detect_get_domain_name(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '');
     if (!$referer) {
         _geoip_detect_ajax_error('This AJAX call does not work when called directly. Do an AJAX call via JS instead.');
 	}
@@ -75,7 +75,7 @@ function geoip_detect_ajax_get_info_from_current_ip() {
 
 
 function _geoip_detect_get_domain_name($url) {
-	$result = parse_url($url);
+	$result = wp_parse_url($url);
 	return $result['host'];
 }
 
diff --git a/check_compatibility.php b/check_compatibility.php
@@ -96,11 +96,11 @@ function checkCompatible() {
             $line2 = __('These incompatible files have been found to be loaded from another plugin: ', 'geoip-detect') . $data;
             $line3 = __('Please test if looking up an IP adress works without an PHP Error. If it works, you can dismiss this notice. It will appear again when their libraries are changed.', 'geoip-detect');
 
-            $body = <<<BODY
+            $body = "
 <p><i>$line1</i></p>
 <p>$line2</p>
 <p>$line3</p>
-BODY;
+";
             $this->adminNotices[] = [
                 'id' => 'maxmind_vendor_old_' . md5($data),
                 'title' => __('Geolocation IP Detection: Warning: Old Maxmind Libraries detected.', 'geoip-detect'),
diff --git a/data-sources/auto.php b/data-sources/auto.php
@@ -143,7 +143,7 @@ public function saveParameters($post) {
 
 	protected function download_url($url, $modified = 0) {
 		// Similar to wordpress download_url, but with custom UA
-		$url_filename = basename( parse_url( $url, PHP_URL_PATH ) );
+		$url_filename = basename( wp_parse_url( $url, PHP_URL_PATH ) );
 
 		$tmpfname = wp_tempnam( $url_filename );
 		if ( ! $tmpfname )
@@ -161,7 +161,7 @@ protected function download_url($url, $modified = 0) {
 			return new \WP_Error( 'http_304', __('It has not changed since the last update.', 'geoip-detect') );
 		}
 		if (is_wp_error( $response ) || 200 !=  $http_response_code) {
-			unlink($tmpfname);
+			wp_delete_file($tmpfname);
 			$body = wp_remote_retrieve_body($response);
 			return new \WP_Error( 'http_404', $http_response_code . ': ' . trim( wp_remote_retrieve_response_message( $response ) ) . ' ' . $body );
 		}
@@ -220,7 +220,7 @@ public function maxmindUpdate($forceUpdate = false)
 		}
 
 		update_option('geoip-detect-auto_downloaded_file', '');
-		unlink($tmpFile);
+		wp_delete_file($tmpFile);
 
 		return true;
 	}
@@ -252,7 +252,7 @@ protected function unpackArchive($downloadedFilename, $outFile) {
 			$phar->extractTo($outDir, null, true);
 		} catch(\Throwable $e) {
 			// Fallback method of unpacking?
-			unlink($downloadedFilename); // Do not try to unpack this file again, instead re-download
+			wp_delete_file($downloadedFilename); // Do not try to unpack this file again, instead re-download
 			return __('The downloaded file seems to be corrupt. Try again ...', 'geoip-detect');
 		}
 
@@ -309,7 +309,7 @@ public function set_cron_schedule()
 	public function schedule_next_cron_run() {
 		// Try to update every 1-2 weeks
 		$next = time() + WEEK_IN_SECONDS;
-		$next += mt_rand(1, WEEK_IN_SECONDS);
+		$next += \wp_rand(1, WEEK_IN_SECONDS);
 
 		wp_schedule_single_event($next, 'geoipdetectupdate');
 	}
@@ -329,7 +329,7 @@ public function uninstall() {
 		// Delete the automatically downloaded file, if it exists
 		$filename = $this->maxmindGetFilename();
 		if ($filename) {
-			unlink($filename);
+			wp_delete_file($filename);
 		}
 	}
 }
diff --git a/geoip-detect.php b/geoip-detect.php
@@ -9,7 +9,6 @@
 License:         GPLv3 or later
 License URI:     http://www.gnu.org/licenses/gpl-3.0.html
 Text Domain:     geoip-detect
-Domain Path:     /languages
 GitHub Plugin URI: https://github.com/yellowtree/geoip-detect
 GitHub Branch:   master
 Requires WP:     5.4
diff --git a/init.php b/init.php
@@ -36,12 +36,6 @@ function geoip_detect_check_ipv6_support() {
 	return @inet_pton('::1') !== false;
 }
 
-// Load Locales
-function geoip_detect_load_textdomain() {
-  load_plugin_textdomain( 'geoip-detect', false, GEOIP_PLUGIN_DIR . '/languages' );
-}
-add_action( 'init', 'geoip_detect_load_textdomain' );
-
 
 function geoip_detect_enqueue_admin_notices() {
 	// Nobody would see these notices them anyway.
@@ -89,15 +83,15 @@ function geoip_detect_admin_notice_template($id, $title, $body, $addButtonDismis
 ?>
 <div class="error notice is-dismissible">
 	<p style="float: right">
-		<a href="tools.php?page=<?php echo GEOIP_PLUGIN_BASENAME ?>&geoip_detect_dismiss_notice=<?php echo $id ?>"><?php _e('Dismiss notice', 'geoip-detect'); ?></a>
+		<a href="tools.php?page=<?php echo GEOIP_PLUGIN_BASENAME ?>&geoip_detect_dismiss_notice=<?php echo esc_attr($id) ?>"><?php _e('Dismiss notice', 'geoip-detect'); ?></a>
 	</p>
 
 	<h3><?php echo $title; ?></h3>
 
 	<?php echo $body; ?>
 	<?php if ($addButtonDismiss) : ?>
 	<p>
-		<a class="button button-secondary" href="?geoip_detect_dismiss_notice=<?= $id ?>">Hide this notice</a>
+		<a class="button button-secondary" href="?geoip_detect_dismiss_notice=<?php echo esc_attr($id) ?>">Hide this notice</a>
 	</p>
 	<?php endif; ?>
 </div>
diff --git a/lib/ccpa.php b/lib/ccpa.php
@@ -288,7 +288,7 @@ public function schedule($forceReschedule = false) {
 
     protected function schedule_next_cron_run() {
         $next = time() + DAY_IN_SECONDS;
-        $next += mt_rand(1, HOUR_IN_SECONDS);
+        $next += wp_rand(1, HOUR_IN_SECONDS);
         wp_schedule_single_event($next, 'geoipdetectccpaupdate');
     }
 }
diff --git a/lib/dynamic-reverse-proxies/abstract.php b/lib/dynamic-reverse-proxies/abstract.php
@@ -168,7 +168,7 @@ public function unschedule() {
 
     protected function schedule_next_cron_run() {
         $next = time() + DAY_IN_SECONDS;
-        $next += mt_rand(1, HOUR_IN_SECONDS);
+        $next += wp_rand(1, HOUR_IN_SECONDS);
         wp_schedule_single_event($next, 'geoipdetectdynamicproxiesupdate');
     }
 }
diff --git a/readme.txt b/readme.txt
@@ -2,8 +2,8 @@
 Contributors: benjaminpick
 Tags: geolocation, locator, geoip, maxmind, ipstack
 Requires at least: 5.0
-Tested up to: 6.7
-Requires PHP: 7.2
+Tested up to: 6.8
+Requires PHP: 7.2.5
 Stable tag: 5.5.0
 License: GPLv3 or later
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
diff --git a/views/client-ip.php b/views/client-ip.php
@@ -36,9 +36,9 @@
 		</span>
 	</p>
 	<p>
-		REMOTE_ADDR: <b><?php echo $_SERVER['REMOTE_ADDR']; ?></b><br>
+		REMOTE_ADDR: <b><?php echo esc_html($_SERVER['REMOTE_ADDR']); ?></b><br>
 		<span class="detail-box">In server configurations without reverse proxy, this will equal to the "detected client IP". Otherwise, this is the IP of the reverse proxy.</span>
-		HTTP_X_FORWARDED_FOR: <b><?php echo isset($_SERVER["HTTP_X_FORWARDED_FOR"]) ? $_SERVER["HTTP_X_FORWARDED_FOR"] : __('(unset)', 'geoip-detect'); ?></b><br>
+		HTTP_X_FORWARDED_FOR: <b><?php echo isset($_SERVER["HTTP_X_FORWARDED_FOR"]) ? esc_html($_SERVER["HTTP_X_FORWARDED_FOR"]) : __('(unset)', 'geoip-detect'); ?></b><br>
 		<span class="detail-box">Reverse proxies usually add this header to indicate the original IP. If several IPs are given here (seperated by a comma), the correct user IP usually is the leftmost one.</span>
 		<?php if (isset($_SERVER["HTTP_X_FORWARDED_FOR"]) && !get_option('geoip-detect-has_reverse_proxy')): ?>
 		<i>(Probably you should enable the reverse proxy option.)</i>
@@ -56,10 +56,10 @@
 
 		<li>Add known proxies of a cloud provider enabled: <b><?php echo get_option('geoip-detect-dynamic_reverse_proxies') ? 'Yes, ' . ucfirst(get_option('geoip-detect-dynamic_reverse_proxy_type', '')) : 'No'; ?></b>
 			<span class="detail-box">If your site is hosted by CloudFlare or AWS, this should probably be enabled. It will automatically retrieve the many IP adresses that a reverse proxy of this provider can have, and update the list daily.</span>
-			<span class="detail-box">Here is the current list of IP adresses: <b><?= implode(', ', \YellowTree\GeoipDetect\DynamicReverseProxies\addDynamicIps()) ?: '(Empty)' ?></b></span>
+			<span class="detail-box">Here is the current list of IP adresses: <b><?php echo implode(', ', \YellowTree\GeoipDetect\DynamicReverseProxies\addDynamicIps()) ?: '(Empty)' ?></b></span>
 			<span class="detail-box">
-				Last updated: <b><?= geoip_detect_format_localtime($last_update); ?></b><br>
-				Next update:  <b><?= geoip_detect_format_localtime(wp_next_scheduled('geoipdetectdynamicproxiesupdate')); ?></b>
+				Last updated: <b><?php echo geoip_detect_format_localtime($last_update); ?></b><br>
+				Next update:  <b><?php echo geoip_detect_format_localtime(wp_next_scheduled('geoipdetectdynamicproxiesupdate')); ?></b>
 				<?php if(get_option('geoip-detect-dynamic_reverse_proxies')) : ?>
 				<form method="POST">
 					<?php wp_nonce_field( 'geoip_detect_reload-proxies' ); ?>
diff --git a/views/lookup.php b/views/lookup.php
diff --git a/views/options.php b/views/options.php

Original file line number	Diff line number	Diff line change
`@@ -49,7 +49,7 @@ function geoip_detect_ajax_get_info_from_current_ip() {`
`49`	`49`
`50`	`50`	`// Referer check`
`51`	`51`
`52`		`- $referer = _geoip_detect_get_domain_name($_SERVER['HTTP_REFERER']);`
	`52`	`+ $referer = _geoip_detect_get_domain_name(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '');`
`53`	`53`	`if (!$referer) {`
`54`	`54`	`_geoip_detect_ajax_error('This AJAX call does not work when called directly. Do an AJAX call via JS instead.');`
`55`	`55`	`}`
`@@ -75,7 +75,7 @@ function geoip_detect_ajax_get_info_from_current_ip() {`
`75`	`75`
`76`	`76`
`77`	`77`	`function _geoip_detect_get_domain_name($url) {`
`78`		`- $result = parse_url($url);`
	`78`	`+ $result = wp_parse_url($url);`
`79`	`79`	`return $result['host'];`
`80`	`80`	`}`
`81`	`81`
Original file line number	Diff line number	Diff line change
`@@ -143,7 +143,7 @@ public function saveParameters($post) {`
`143`	`143`
`144`	`144`	`protected function download_url($url, $modified = 0) {`
`145`	`145`	`// Similar to wordpress download_url, but with custom UA`
`146`		`- $url_filename = basename( parse_url( $url, PHP_URL_PATH ) );`
	`146`	`+ $url_filename = basename( wp_parse_url( $url, PHP_URL_PATH ) );`
`147`	`147`
`148`	`148`	`$tmpfname = wp_tempnam( $url_filename );`
`149`	`149`	`if ( ! $tmpfname )`
`@@ -161,7 +161,7 @@ protected function download_url($url, $modified = 0) {`
`161`	`161`	`return new \WP_Error( 'http_304', __('It has not changed since the last update.', 'geoip-detect') );`
`162`	`162`	`}`
`163`	`163`	`if (is_wp_error( $response ) \|\| 200 != $http_response_code) {`
`164`		`- unlink($tmpfname);`
	`164`	`+ wp_delete_file($tmpfname);`
`165`	`165`	`$body = wp_remote_retrieve_body($response);`
`166`	`166`	`return new \WP_Error( 'http_404', $http_response_code . ': ' . trim( wp_remote_retrieve_response_message( $response ) ) . ' ' . $body );`
`167`	`167`	`}`
`@@ -220,7 +220,7 @@ public function maxmindUpdate($forceUpdate = false)`
`220`	`220`	`}`
`221`	`221`
`222`	`222`	`update_option('geoip-detect-auto_downloaded_file', '');`
`223`		`- unlink($tmpFile);`
	`223`	`+ wp_delete_file($tmpFile);`
`224`	`224`
`225`	`225`	`return true;`
`226`	`226`	`}`
`@@ -252,7 +252,7 @@ protected function unpackArchive($downloadedFilename, $outFile) {`
`252`	`252`	`$phar->extractTo($outDir, null, true);`
`253`	`253`	`} catch(\Throwable $e) {`
`254`	`254`	`// Fallback method of unpacking?`
`255`		`- unlink($downloadedFilename); // Do not try to unpack this file again, instead re-download`
	`255`	`+ wp_delete_file($downloadedFilename); // Do not try to unpack this file again, instead re-download`
`256`	`256`	`return __('The downloaded file seems to be corrupt. Try again ...', 'geoip-detect');`
`257`	`257`	`}`
`258`	`258`
`@@ -309,7 +309,7 @@ public function set_cron_schedule()`
`309`	`309`	`public function schedule_next_cron_run() {`
`310`	`310`	`// Try to update every 1-2 weeks`
`311`	`311`	`$next = time() + WEEK_IN_SECONDS;`
`312`		`- $next += mt_rand(1, WEEK_IN_SECONDS);`
	`312`	`+ $next += \wp_rand(1, WEEK_IN_SECONDS);`
`313`	`313`
`314`	`314`	`wp_schedule_single_event($next, 'geoipdetectupdate');`
`315`	`315`	`}`
`@@ -329,7 +329,7 @@ public function uninstall() {`
`329`	`329`	`// Delete the automatically downloaded file, if it exists`
`330`	`330`	`$filename = $this->maxmindGetFilename();`
`331`	`331`	`if ($filename) {`
`332`		`- unlink($filename);`
	`332`	`+ wp_delete_file($filename);`
`333`	`333`	`}`
`334`	`334`	`}`
`335`	`335`	`}`
Original file line number	Diff line number	Diff line change
`@@ -288,7 +288,7 @@ public function schedule($forceReschedule = false) {`
`288`	`288`
`289`	`289`	`protected function schedule_next_cron_run() {`
`290`	`290`	`$next = time() + DAY_IN_SECONDS;`
`291`		`- $next += mt_rand(1, HOUR_IN_SECONDS);`
	`291`	`+ $next += wp_rand(1, HOUR_IN_SECONDS);`
`292`	`292`	`wp_schedule_single_event($next, 'geoipdetectccpaupdate');`
`293`	`293`	`}`
`294`	`294`	`}`
Original file line number	Diff line number	Diff line change
`@@ -168,7 +168,7 @@ public function unschedule() {`
`168`	`168`
`169`	`169`	`protected function schedule_next_cron_run() {`
`170`	`170`	`$next = time() + DAY_IN_SECONDS;`
`171`		`- $next += mt_rand(1, HOUR_IN_SECONDS);`
	`171`	`+ $next += wp_rand(1, HOUR_IN_SECONDS);`
`172`	`172`	`wp_schedule_single_event($next, 'geoipdetectdynamicproxiesupdate');`
`173`	`173`	`}`
`174`	`174`	`}`