| @@ -18,8 +18,9 @@ | ||
| 18 | 18 | $field = new \stdClass(); |
| 19 | 19 | $field->id = 0; |
| 20 | 20 | $field->name = ''; |
| 21 | 21 | $field->active = 1; |
| 22 | + $field->core = 0; | |
| 22 | 23 | $field->type = 'text'; |
| 23 | 24 | $field->value = ''; |
| 24 | 25 | $field->option = ''; |
| 25 | 26 | $field->default_value = ''; |
| @@ -67,9 +68,9 @@ | ||
| 67 | 68 | } |
| 68 | 69 | } |
| 69 | 70 | |
| 70 | 71 | if (!empty($fieldId)) { |
| 71 | - $this->breadcrumb[acym_escape(acym_translation($field->name))] = acym_completeLink('fields&task=edit&fieldId='.$fieldId); | |
| 72 | + $this->breadcrumb[acym_translation($field->name)] = acym_completeLink('fields&task=edit&fieldId='.$fieldId); | |
| 72 | 73 | } else { |
| 73 | 74 | $this->breadcrumb[acym_translation('ACYM_NEW_CUSTOM_FIELD')] = acym_completeLink('fields&task=edit'); |
| 74 | 75 | } |
| 75 | 76 | |
| @@ -109,9 +110,9 @@ | ||
| 109 | 110 | |
| 110 | 111 | public function ajaxGetTables(): void |
| 111 | 112 | { |
| 112 | 113 | $database = acym_getVar('string', 'database'); |
| 113 | - $allTables = acym_loadResultArray('SHOW TABLES FROM `'.$database.'`'); | |
| 114 | + $allTables = acym_loadResultArray('SHOW TABLES FROM `'.acym_secureDBColumn($database).'`'); | |
| 114 | 115 | |
| 115 | 116 | acym_sendAjaxResponse('', ['tables' => $allTables]); |
| 116 | 117 | } |
| 117 | 118 | |
| @@ -119,9 +120,9 @@ | ||
| 119 | 120 | { |
| 120 | 121 | $table = acym_getVar('string', 'table'); |
| 121 | 122 | $database = acym_getVar('string', 'database'); |
| 122 | 123 | |
| 123 | - $columns = acym_loadResultArray('SHOW COLUMNS FROM `'.$table.'` FROM `'.$database.'`'); | |
| 124 | + $columns = acym_loadResultArray('SHOW COLUMNS FROM `'.acym_secureDBColumn($table).'` FROM `'.acym_secureDBColumn($database).'`'); | |
| 124 | 125 | array_unshift($columns, 'ACYM_CHOOSE_COLUMN'); |
| 125 | 126 | |
| 126 | 127 | acym_sendAjaxResponse('', ['columns' => $columns]); |
| 127 | 128 | } |
| @@ -139,8 +140,10 @@ | ||
| 139 | 140 | } |
| 140 | 141 | |
| 141 | 142 | protected function saveField(): void |
| 142 | 143 | { |
| 144 | + wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token'); | |
| 145 | + | |
| 143 | 146 | $fieldClass = new FieldClass(); |
| 144 | 147 | $newField = $this->setFieldToSave(); |
| 145 | 148 | $fieldId = empty($newField->name) ? null : $fieldClass->save($newField); |
| 146 | 149 | if (!empty($fieldId)) { |
| @@ -191,9 +194,16 @@ | ||
| 191 | 194 | $i++; |
| 192 | 195 | } |
| 193 | 196 | } |
| 194 | 197 | |
| 195 | - $field['name'] = strip_tags($field['name'], '<i><b><strong>'); | |
| 198 | + $field['name'] = wp_kses( | |
| 199 | + $field['name'], | |
| 200 | + [ | |
| 201 | + 'i' => [], | |
| 202 | + 'b' => [], | |
| 203 | + 'strong' => [], | |
| 204 | + ] | |
| 205 | + ); | |
| 196 | 206 | $field['namekey'] = empty($field['namekey']) ? $fieldClass->generateNamekey($field['name']) : $field['namekey']; |
| 197 | 207 | $field['option']['format'] = $field['type'] === 'date' && empty($field['option']['format']) ? '%d%m%y' : strtolower($field['option']['format']); |
| 198 | 208 | $field['option']['rows'] = ($field['type'] == 'textarea' && empty($field['option']['rows'])) ? '5' : $field['option']['rows']; |
| 199 | 209 | $field['option']['columns'] = ($field['type'] == 'textarea' && empty($field['option']['columns'])) ? '30' : $field['option']['columns']; |
