CVE-2023-38519

@@ -656,6 +656,21 @@ public function get_wp_client_by( $by = 'client_id', $value = null, $obj = OBJEC
 		$with_tags           = isset( $params['with_tags'] ) && $params['with_tags'] ? true : false;
 		$group_ids           = isset( $params['by_tags'] ) ? $params['by_tags'] : '';
 
+		// valid group ids.
+		if ( is_array( $group_ids ) ) {
+			$group_ids = array_filter(
+				$group_ids,
+				function( $e ) {
+					if ( 'nogroups' === $e ) {
+						return true;
+					}
+					return ( is_numeric( $e ) && 0 < $e ) ? true : false;
+				}
+			);
+		} else {
+			$group_ids = '';
+		}
+
 		$select_sites  = '';
 		$select_tags   = '';
 		$where_clients = '';
@@ -867,8 +882,7 @@ public function update_selected_sites_for_client( $client_id, $site_ids ) {
 		$site_ids = array_filter(
 			$site_ids,
 			function( $e ) {
-				$e = intval( $e );
-				return ( 0 < $e ) ? true : false;
+				return ( is_numeric( $e ) && 0 < $e ) ? true : false;
 			}
 		);
 

@@ -1076,7 +1076,7 @@ public function get_sql_search_websites_for_current_user( $params ) {
 		$group_ids = array_filter(
 			$group_ids,
 			function( $e ) {
-				if ( 'nogroups' == $e ) {
+				if ( 'nogroups' === $e ) {
 					return true;
 				}
 				$e = intval( $e );
@@ -1092,7 +1092,7 @@ function( $e ) {
 		$client_ids = array_filter(
 			$client_ids,
 			function( $e ) {
-				if ( 'noclients' == $e ) {
+				if ( 'noclients' === $e ) {
 					return true;
 				}
 				return is_numeric( $e ) && ! empty( $e ) ? true : false; // to valid client ids.

@@ -35,7 +35,7 @@ class MainWP_System {
 	 *
 	 * @var string Current plugin version.
 	 */
-	public static $version = '4.4.3.3';
+	public static $version = '4.4.3.4';
 
 	/**
 	 * Private static variable to hold the single instance of the class.

@@ -8,7 +8,7 @@
  * Author URI: https://mainwp.com
  * Plugin URI: https://mainwp.com/
  * Text Domain: mainwp
- * Version:  4.4.3.3
+ * Version:  4.4.3.4
  *
  * @package MainWP/Dashboard
  *

@@ -7,7 +7,7 @@ Plugin URI: https://mainwp.com
 Requires at least: 5.4
 Tested up to: 6.2.2
 Requires PHP: 7.4
-Stable tag: 4.4.3.3
+Stable tag: 4.4.3.4
 License: GPLv3 or later
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
 
@@ -298,6 +298,9 @@ Yes, we have a quick FAQ with a lot more questions and answers [here](https://ma
 
 == Changelog ==
 
+= 4.4.3.4 - 6-26-2023 =
+* Security: Added `tag` parameter value validation on the Manage Clients page
+
 = 4.4.3.3 - 6-19-2023 =
 * Added: Upcomming extension info data
 * Fixed: An issue with the negative search feature