From 5d46d749909385ba59de4eef7d33279ba1b00563 Mon Sep 17 00:00:00 2001 From: miyanialkesh7 Date: Tue, 25 Aug 2026 13:44:45 +0530 Subject: [PATCH] Add index.php stubs to block directory-listing exposure None of the plugin's directories had the standard WordPress index.php stub, so if the server ever serves directory listings (Options +Indexes, or a misconfigured host), the plugin's source tree structure and filenames are exposed. No functional or SQL/XSS vulnerabilities were found elsewhere in the codebase in this review: no superglobal access, no dangerous functions (eval, exec, unserialize, etc.), no raw $wpdb queries, and all dynamic output is already escaped. --- Functions/index.php | 6 ++++++ index.php | 6 ++++++ src/blocks/banner/index.php | 6 ++++++ src/blocks/index.php | 6 ++++++ src/blocks/slider/index.php | 6 ++++++ src/blocks/toggle/index.php | 6 ++++++ src/index.php | 6 ++++++ 7 files changed, 42 insertions(+) create mode 100644 Functions/index.php create mode 100644 index.php create mode 100644 src/blocks/banner/index.php create mode 100644 src/blocks/index.php create mode 100644 src/blocks/slider/index.php create mode 100644 src/blocks/toggle/index.php create mode 100644 src/index.php diff --git a/Functions/index.php b/Functions/index.php new file mode 100644 index 0000000..a1ae427 --- /dev/null +++ b/Functions/index.php @@ -0,0 +1,6 @@ +