PluginProbe
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) / 1.8.13
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) v1.8.13
1.8.13.1 1.8.13 1.8.12.3 1.8.12.2 1.8.12.1 1.8.12 1.8.11.3 1.8.11.2 1.8.11.1 1.8.11 1.6.6 1.6.60 1.6.7 1.6.8 1.6.9 1.7.0 1.7.0.1 1.7.0.11 1.7.0.12 1.7.0.14 1.7.0.2 1.7.0.3 1.7.0.5 1.7.0.6 1.7.0.7 All 212 releases
← All changes | includes/forms/class-charitable-registration-form.php +31 -8 1.7.0.3 → 1.8.13 View file →
@@ -3,9 +3,9 @@
3 3 * Class that manages the display and processing of the registration form.
4 4 *
5 5 * @package Charitable/Classes/Charitable_Registration_Form
6 6 * @author David Bisset
7 - * @copyright Copyright (c) 2022, WP Charitable LLC
7 + * @copyright Copyright (c) 2023, WP Charitable LLC
8 8 * @license http://opensource.org/licenses/gpl-2.0.php GNU Public License
9 9 * @since 1.0.0
10 10 * @version 1.6.51
11 11 */
@@ -98,12 +98,14 @@
98 98 /**
99 99 * Profile fields to be displayed.
100 100 *
101 101 * @since 1.0.0
102 + * @version 1.8.9.1
102 103 *
103 104 * @return array
104 105 */
105 106 public function get_fields() {
107 + // phpcs:disable WordPress.Security.NonceVerification.Missing
106 108 $fields = array(
107 109 'user_email' => array(
108 110 'label' => __( 'Email', 'charitable' ),
109 111 'type' => 'email',
@@ -108,9 +110,9 @@
108 110 'label' => __( 'Email', 'charitable' ),
109 111 'type' => 'email',
110 112 'required' => true,
111 113 'priority' => 4,
112 - 'value' => isset( $_POST['user_email'] ) ? $_POST['user_email'] : '',
114 + 'value' => isset( $_POST['user_email'] ) ? sanitize_text_field( wp_unslash( $_POST['user_email'] ) ) : '',
113 115 ),
114 116 'user_login' => array(
115 117 'label' => __( 'Username', 'charitable' ),
116 118 'type' => 'text',
@@ -115,9 +117,9 @@
115 117 'label' => __( 'Username', 'charitable' ),
116 118 'type' => 'text',
117 119 'priority' => 6,
118 120 'required' => true,
119 - 'value' => isset( $_POST['user_login'] ) ? $_POST['user_login'] : '',
121 + 'value' => isset( $_POST['user_login'] ) ? sanitize_text_field( wp_unslash( $_POST['user_login'] ) ) : '',
120 122 ),
121 123 'user_pass' => array(
122 124 'label' => __( 'Password', 'charitable' ),
123 125 'type' => 'password',
@@ -122,11 +124,12 @@
122 124 'label' => __( 'Password', 'charitable' ),
123 125 'type' => 'password',
124 126 'priority' => 8,
125 127 'required' => true,
126 - 'value' => isset( $_POST['user_pass'] ) ? $_POST['user_pass'] : '',
128 + 'value' => isset( $_POST['user_pass'] ) ? sanitize_text_field( wp_unslash( $_POST['user_pass'] ) ) : '',
127 129 ),
128 130 );
131 + // phpcs:enable WordPress.Security.NonceVerification.Missing
129 132
130 133 $fields = $this->maybe_add_terms_conditions_fields( $fields );
131 134
132 135 /**
@@ -146,8 +149,9 @@
146 149 /**
147 150 * Maybe add terms and conditions fields to the form.
148 151 *
149 152 * @since 1.6.2
153 + * @version 1.8.9.1
150 154 *
151 155 * @param array $fields The registered form fields.
152 156 * @return array
153 157 */
@@ -160,14 +164,17 @@
160 164 );
161 165 }
162 166
163 167 if ( charitable_is_contact_consent_activated() ) {
168 + // phpcs:disable WordPress.Security.NonceVerification.Missing
169 + $checked = isset( $_POST['contact_consent'] ) && ! empty( sanitize_text_field( wp_unslash( $_POST['contact_consent'] ) ) );
170 + // phpcs:enable WordPress.Security.NonceVerification.Missing
164 171 $fields['contact_consent'] = array(
165 172 'type' => 'checkbox',
166 173 'label' => charitable_get_option( 'contact_consent_label', __( 'Yes, I am happy for you to contact me via email or phone.', 'charitable' ) ),
167 174 'priority' => 22,
168 175 'required' => false,
169 - 'checked' => array_key_exists( 'contact_consent', $_POST ) && $_POST['contact_consent'],
176 + 'checked' => $checked,
170 177 );
171 178 }
172 179
173 180 if ( charitable_is_terms_and_conditions_activated() ) {
@@ -210,8 +217,9 @@
210 217 /**
211 218 * Update registration after form submission.
212 219 *
213 220 * @since 1.0.0
221 + * @version 1.8.1.15
214 222 *
215 223 * @return void
216 224 */
217 225 public static function save_registration() {
@@ -242,8 +250,13 @@
242 250
243 251 return false;
244 252 }
245 253
254 + // Remove any ID fields that may have been submitted.
255 + if ( array_key_exists( 'ID', $submitted ) ) {
256 + unset( $submitted['ID'] );
257 + }
258 +
246 259 $user = new Charitable_User();
247 260 $user_id = $user->update_profile( $submitted, array_keys( $fields ) );
248 261
249 262 /**
@@ -277,8 +290,9 @@
277 290 /**
278 291 * Return the link to the login page, or false if we are not going to display it.
279 292 *
280 293 * @since 1.4.2
294 + * @version 1.8.9.1
281 295 *
282 296 * @return false|string
283 297 */
284 298 public function get_login_link() {
@@ -291,11 +305,14 @@
291 305 if ( charitable_get_permalink( 'registration_page' ) === $login_link ) {
292 306 return false;
293 307 }
294 308
309 + // phpcs:disable WordPress.Security.NonceVerification.Recommended
295 310 if ( isset( $_GET['redirect_to'] ) ) {
296 - $login_link = add_query_arg( 'redirect_to', $_GET['redirect_to'], $login_link );
311 + $redirect_to = sanitize_text_field( wp_unslash( $_GET['redirect_to'] ) );
312 + $login_link = add_query_arg( 'redirect_to', $redirect_to, $login_link );
297 313 }
314 + // phpcs:enable WordPress.Security.NonceVerification.Recommended
298 315
299 316 return sprintf(
300 317 '<a href="%1$s">%2$s</a>',
301 318 esc_url( $login_link ),
@@ -306,8 +323,9 @@
306 323 /**
307 324 * Get the redirect URL.
308 325 *
309 326 * @since 1.5.0
327 + * @version 1.8.9.1
310 328 *
311 329 * @return string|false
312 330 */
313 331 protected function get_redirect_url() {
@@ -312,13 +330,18 @@
312 330 */
313 331 protected function get_redirect_url() {
314 332 $redirect = false;
315 333
316 - if ( isset( $_GET['redirect_to'] ) && strlen( $_GET['redirect_to'] ) ) {
317 - $redirect = $_GET['redirect_to'];
334 + // phpcs:disable WordPress.Security.NonceVerification.Recommended
335 + if ( isset( $_GET['redirect_to'] ) ) {
336 + $redirect_to = sanitize_text_field( wp_unslash( $_GET['redirect_to'] ) );
337 + if ( strlen( $redirect_to ) ) {
338 + $redirect = $redirect_to;
339 + }
318 340 } elseif ( isset( $this->shortcode_args['redirect'] ) && strlen( $this->shortcode_args['redirect'] ) ) {
319 341 $redirect = $this->shortcode_args['redirect'];
320 342 }
343 + // phpcs:enable WordPress.Security.NonceVerification.Recommended
321 344
322 345 return $redirect;
323 346 }
324 347 }