← All changes | back/Controllers/Fields/Edition.php +13 -4 10.10.2 → 11.1.0 View file →

		@@ -68,9 +68,9 @@
68	68	}
69	69	}
70	70
71	71	if (!empty($fieldId)) {
72		- $this->breadcrumb[acym_escape(acym_translation($field->name))] = acym_completeLink('fields&task=edit&fieldId='.$fieldId);
	72	+ $this->breadcrumb[acym_translation($field->name)] = acym_completeLink('fields&task=edit&fieldId='.$fieldId);
73	73	} else {
74	74	$this->breadcrumb[acym_translation('ACYM_NEW_CUSTOM_FIELD')] = acym_completeLink('fields&task=edit');
75	75	}
76	76
		@@ -110,9 +110,9 @@
110	110
111	111	public function ajaxGetTables(): void
112	112	{
113	113	$database = acym_getVar('string', 'database');
114		- $allTables = acym_loadResultArray('SHOW TABLES FROM `'.$database.'`');
	114	+ $allTables = acym_loadResultArray('SHOW TABLES FROM `'.acym_secureDBColumn($database).'`');
115	115
116	116	acym_sendAjaxResponse('', ['tables' => $allTables]);
117	117	}
118	118
		@@ -120,9 +120,9 @@
120	120	{
121	121	$table = acym_getVar('string', 'table');
122	122	$database = acym_getVar('string', 'database');
123	123
124		- $columns = acym_loadResultArray('SHOW COLUMNS FROM `'.$table.'` FROM `'.$database.'`');
	124	+ $columns = acym_loadResultArray('SHOW COLUMNS FROM `'.acym_secureDBColumn($table).'` FROM `'.acym_secureDBColumn($database).'`');
125	125	array_unshift($columns, 'ACYM_CHOOSE_COLUMN');
126	126
127	127	acym_sendAjaxResponse('', ['columns' => $columns]);
128	128	}
		@@ -140,8 +140,10 @@
140	140	}
141	141
142	142	protected function saveField(): void
143	143	{
	144	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	145	+
144	146	$fieldClass = new FieldClass();
145	147	$newField = $this->setFieldToSave();
146	148	$fieldId = empty($newField->name) ? null : $fieldClass->save($newField);
147	149	if (!empty($fieldId)) {
		@@ -192,9 +194,16 @@
192	194	$i++;
193	195	}
194	196	}
195	197
196		- $field['name'] = strip_tags($field['name'], '<i><b><strong>');
	198	+ $field['name'] = wp_kses(
	199	+ $field['name'],
	200	+ [
	201	+ 'i' => [],
	202	+ 'b' => [],
	203	+ 'strong' => [],
	204	+ ]
	205	+ );
197	206	$field['namekey'] = empty($field['namekey']) ? $fieldClass->generateNamekey($field['name']) : $field['namekey'];
198	207	$field['option']['format'] = $field['type'] === 'date' && empty($field['option']['format']) ? '%d%m%y' : strtolower($field['option']['format']);
199	208	$field['option']['rows'] = ($field['type'] == 'textarea' && empty($field['option']['rows'])) ? '5' : $field['option']['rows'];
200	209	$field['option']['columns'] = ($field['type'] == 'textarea' && empty($field['option']['columns'])) ? '30' : $field['option']['columns'];