| @@ -68,9 +68,9 @@ | ||
| 68 | 68 | } |
| 69 | 69 | } |
| 70 | 70 | |
| 71 | 71 | if (!empty($fieldId)) { |
| 72 | - $this->breadcrumb[acym_escape(acym_translation($field->name))] = acym_completeLink('fields&task=edit&fieldId='.$fieldId); | |
| 72 | + $this->breadcrumb[acym_translation($field->name)] = acym_completeLink('fields&task=edit&fieldId='.$fieldId); | |
| 73 | 73 | } else { |
| 74 | 74 | $this->breadcrumb[acym_translation('ACYM_NEW_CUSTOM_FIELD')] = acym_completeLink('fields&task=edit'); |
| 75 | 75 | } |
| 76 | 76 | |
| @@ -140,8 +140,10 @@ | ||
| 140 | 140 | } |
| 141 | 141 | |
| 142 | 142 | protected function saveField(): void |
| 143 | 143 | { |
| 144 | + wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token'); | |
| 145 | + | |
| 144 | 146 | $fieldClass = new FieldClass(); |
| 145 | 147 | $newField = $this->setFieldToSave(); |
| 146 | 148 | $fieldId = empty($newField->name) ? null : $fieldClass->save($newField); |
| 147 | 149 | if (!empty($fieldId)) { |
| @@ -192,9 +194,16 @@ | ||
| 192 | 194 | $i++; |
| 193 | 195 | } |
| 194 | 196 | } |
| 195 | 197 | |
| 196 | - $field['name'] = strip_tags($field['name'], '<i><b><strong>'); | |
| 198 | + $field['name'] = wp_kses( | |
| 199 | + $field['name'], | |
| 200 | + [ | |
| 201 | + 'i' => [], | |
| 202 | + 'b' => [], | |
| 203 | + 'strong' => [], | |
| 204 | + ] | |
| 205 | + ); | |
| 197 | 206 | $field['namekey'] = empty($field['namekey']) ? $fieldClass->generateNamekey($field['name']) : $field['namekey']; |
| 198 | 207 | $field['option']['format'] = $field['type'] === 'date' && empty($field['option']['format']) ? '%d%m%y' : strtolower($field['option']['format']); |
| 199 | 208 | $field['option']['rows'] = ($field['type'] == 'textarea' && empty($field['option']['rows'])) ? '5' : $field['option']['rows']; |
| 200 | 209 | $field['option']['columns'] = ($field['type'] == 'textarea' && empty($field['option']['columns'])) ? '30' : $field['option']['columns']; |
