← All changes | functions.php +24 -46 8.6.6 → 8.2.2 View file →

		@@ -14,9 +14,9 @@
14	14	$wp_chatbot_custom_agent_path = QCLD_wpCHATBOT_IMG_URL . get_option('wp_chatbot_agent_image');
15	15	} else {
16	16	$wp_chatbot_custom_agent_path = QCLD_wpCHATBOT_IMG_URL . 'custom-agent.png';
17	17	}
18		- $hidden_field = '<a class="wp-chatbot qc_wpbot_chat_link" id="wp-chatbot-search-btn" data-search-type="product" data-search-term="" style="max-height: 50px; margin-left: 10px;padding: 0 !important;position: absolute;top: -9px;right: -60px;"><img src="'. esc_url($wp_chatbot_custom_agent_path) .'" alt=""></a>';
	18	+ $hidden_field = '<a class="wp-chatbot qc_wpbot_chat_link" id="wp-chatbot-search-btn" data-search-type="product" data-search-term="" style="max-height: 50px; margin-left: 10px;padding: 0 !important;position: absolute;top: -9px;right: -60px;"><img src="'. esc_attr($wp_chatbot_custom_agent_path) .'" alt=""></a>';
19	19	$block_content = str_replace( '</form>', $hidden_field . '</form>', $form );
20	20	return $block_content;
21	21	}
22	22	if(get_option('wpbot_enable_on_search') == 1 && (get_option('disable_floating_button') != '1') && get_option('disable_wp_chatbot') != 1 ){
		@@ -33,9 +33,9 @@
33	33	$wp_chatbot_custom_agent_path = QCLD_wpCHATBOT_IMG_URL . get_option('wp_chatbot_agent_image');
34	34	} else {
35	35	$wp_chatbot_custom_agent_path = QCLD_wpCHATBOT_IMG_URL . 'custom-agent.png';
36	36	}
37		- $hidden_field = '<button type="button" class="wp-chatbot qc_wpbot_chat_link" id="wp-chatbot-search-btn" data-search-type="product" data-search-term="" style="max-height: 50px; margin-left: 10px;padding: 0 !important"><img src="'. esc_url($wp_chatbot_custom_agent_path) .'" alt=""></button>';
	37	+ $hidden_field = '<button type="button" class="wp-chatbot qc_wpbot_chat_link" id="wp-chatbot-search-btn" data-search-type="product" data-search-term="" style="max-height: 50px; margin-left: 10px;padding: 0 !important"><img src="'. esc_attr($wp_chatbot_custom_agent_path) .'" alt=""></button>';
38	38	// Inject the hidden field before the closing </form> tag
39	39	$block_content = str_replace( '</div></form>', $hidden_field . '</div></form>', $block_content );
40	40	return $block_content;
41	41	}
		@@ -65,9 +65,9 @@
65	65	?>
66	66	<style>
67	67	<?php if(get_option('wp_chatbot_custom_css')!="") {
68	68
69		- echo wp_strip_all_tags( get_option('wp_chatbot_custom_css') );// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
	69	+ echo wp_strip_all_tags( get_option('wp_chatbot_custom_css') );
70	70	}
71	71	?>
72	72	</style>
73	73
		@@ -155,9 +155,9 @@
155	155	}
156	156	?>
157	157	<div class="wp-chatbot-notification-agent-profile">
158	158	<div class="wp-chatbot-notification-widget-avatar" ><img
159		- src="<?php echo esc_url($wp_chatbot_custom_agent_path); ?>" alt=""></div>
	159	+ src="<?php echo esc_attr($wp_chatbot_custom_agent_path); ?>" alt=""></div>
160	160	<div class="wp-chatbot-notification-welcome"><?php echo wp_kses_post(wpb_randmom_message_handle(maybe_unserialize(get_option('qlcd_wp_chatbot_welcome')))) . ' <strong>' . esc_html(get_option('qlcd_wp_chatbot_host')) . '</strong>'; ?></div>
161	161	</div>
162	162	<?php
163	163	//update_option('qlcd_wp_chatbot_notifications','Welcome to WpBot');
		@@ -338,15 +338,8 @@
338	338	*/
339	339	add_action('wp_ajax_qcld_wb_chatbot_keyword', 'qcld_wb_chatbot_keyword');
340	340	add_action('wp_ajax_nopriv_qcld_wb_chatbot_keyword', 'qcld_wb_chatbot_keyword');
341	341	function qcld_wb_chatbot_keyword(){
342		- // Verify nonce for security
343		- $nonce = isset($_POST['security']) ? sanitize_text_field(wp_unslash($_POST['security'])) : (isset($_POST['nonce']) ? sanitize_text_field(wp_unslash($_POST['nonce'])) : '');
344		- if ( ! wp_verify_nonce( $nonce, 'wp_chatbot' ) && ! wp_verify_nonce( $nonce, 'qcsecretbotnonceval123qc' ) ) {
345		- wp_send_json_error( array( 'status' => 'fail', 'message' => 'Security check failed.' ) );
346		- wp_die();
347		- }
348		-
349	342	$keyword = sanitize_text_field(wp_unslash($_POST['keyword']));
350	343	$product_per_page = get_option('qlcd_wp_chatbot_ppp') != '' ? get_option('qlcd_wp_chatbot_ppp') : 10;
351	344	if (get_option('qlcd_wp_chatbot_search_option') == 'standard') {
352	345	$product_orderby = sanitize_text_field(get_option('qlcd_wp_chatbot_product_orderby') != '' ? get_option('qlcd_wp_chatbot_product_orderby') : 'title');
		@@ -393,9 +386,9 @@
393	386	endwhile;
394	387	wp_reset_postdata();
395	388	$html .= '</ul>';
396	389	if ($total_product_num > $product_per_page && $product_per_page > 0 ) {
397		- $html .= '<p style="text-align: center"><button type="button" id="wp-chatbot-loadmore" data-offset="' . $product_per_page . '" data-search-type="product" data-search-term="' . esc_attr($keyword) . '" >' . wp_kses_post(wpb_randmom_message_handle(unserialize(get_option('qlcd_wp_chatbot_load_more')))) . ' <span id="wp-chatbot-loadmore-loader"></span></button> </p>';
	390	+ $html .= '<p style="text-align: center"><button type="button" id="wp-chatbot-loadmore" data-offset="' . $product_per_page . '" data-search-type="product" data-search-term="' . $keyword . '" >' . wp_kses_post(wpb_randmom_message_handle(unserialize(get_option('qlcd_wp_chatbot_load_more')))) . ' <span id="wp-chatbot-loadmore-loader"></span></button> </p>';
398	391	}
399	392	}
400	393	$html .= '</div>';
401	394	} else if (get_option('qlcd_wp_chatbot_search_option') == 'advanced') {
		@@ -423,9 +416,9 @@
423	416	}
424	417	}
425	418	$html .= '</ul>';
426	419	if ($total_product_num > $product_per_page && $product_per_page > 0) {
427		- $html .= '<p style="text-align: center"><button type="button" id="wp-chatbot-loadmore" data-offset="' . $product_per_page . '" data-search-type="product" data-search-term="' . esc_attr($more_product_ids) . '" >' . wp_kses_post(wpb_randmom_message_handle(unserialize(get_option('qlcd_wp_chatbot_load_more')))) . ' <span id="wp-chatbot-loadmore-loader"></span></button> </p>';
	420	+ $html .= '<p style="text-align: center"><button type="button" id="wp-chatbot-loadmore" data-offset="' . $product_per_page . '" data-search-type="product" data-search-term="' . $more_product_ids . '" >' . wp_kses_post(wpb_randmom_message_handle(unserialize(get_option('qlcd_wp_chatbot_load_more')))) . ' <span id="wp-chatbot-loadmore-loader"></span></button> </p>';
428	421	}
429	422	}
430	423	$html .= '</div>';
431	424	}
		@@ -992,12 +985,9 @@
992	985	//Support part
993	986	add_action('wp_ajax_qcld_wb_chatbot_support_email', 'qcld_wb_chatbot_support_email');
994	987	add_action('wp_ajax_nopriv_qcld_wb_chatbot_support_email', 'qcld_wb_chatbot_support_email');
995	988	function qcld_wb_chatbot_support_email(){
996		- $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
997		- if ( ! wp_verify_nonce( $nonce, 'qcsecretbotnonceval123qc' ) ) {
998		- wp_send_json_error( array( 'error' => esc_html__( 'Error: Invalid nonce verification.', 'chatbot' ) ) );
999		- }
	989	+ check_ajax_referer('qcsecretbotnonceval123qc', 'nonce');
1000	990	$name = trim(sanitize_text_field(wp_unslash($_POST['name'])));
1001	991	$email = sanitize_email(wp_unslash($_POST['email']));
1002	992	$message = sanitize_text_field(wp_unslash($_POST['message']));
1003	993	$subject = sanitize_text_field(get_option('qlcd_wp_chatbot_email_sub') != '' ? get_option('qlcd_wp_chatbot_email_sub') : 'Support Email from wpWBot by Client');
		@@ -1014,8 +1004,9 @@
1014	1004	$fromEmail = get_option('qlcd_wp_chatbot_from_email');
1015	1005	}else{
1016	1006	$fromEmail = "wordpress@" . $domain;
1017	1007	}
	1008	+
1018	1009	//Starting messaging and status.
1019	1010	$response['status'] = 'fail';
1020	1011	$response['message'] = str_replace('\\', '',wp_kses_post(get_option('qlcd_wp_chatbot_email_fail')));
1021	1012	if (filter_var($email, FILTER_VALIDATE_EMAIL) === false) {
		@@ -1273,9 +1264,9 @@
1273	1264	$html .= get_the_post_thumbnail(get_the_ID(), 'shop_catalog') . '
1274	1265	<div class="wp-chatbot-product-summary">
1275	1266	<div class="wp-chatbot-product-table">
1276	1267	<div class="wp-chatbot-product-table-cell">
1277		- <h3 class="wp-chatbot-product-title">' . esc_html($product->post->post_title) . '</h3>
	1268	+ <h3 class="wp-chatbot-product-title">' . $product->post->post_title . '</h3>
1278	1269	<div class="price">' . $product->get_price_html() . '</div>';
1279	1270	$html .= ' </div>
1280	1271	</div>
1281	1272	</div></a>
		@@ -1344,9 +1335,9 @@
1344	1335	$html .= get_the_post_thumbnail(get_the_ID(), 'shop_catalog') . '
1345	1336	<div class="wp-chatbot-product-summary">
1346	1337	<div class="wp-chatbot-product-table">
1347	1338	<div class="wp-chatbot-product-table-cell">
1348		- <h3 class="wp-chatbot-product-title">' . esc_html($product->post->post_title) . '</h3>
	1339	+ <h3 class="wp-chatbot-product-title">' . $product->post->post_title . '</h3>
1349	1340	<div class="price">' . $product->get_price_html() . '</div>';
1350	1341	$html .= ' </div>
1351	1342	</div>
1352	1343	</div></a>
		@@ -1520,9 +1511,8 @@
1520	1511	//Updating the cart items.
1521	1512	add_action('wp_ajax_qcld_wb_chatbot_update_cart_item_number', 'qcld_wb_chatbot_update_cart_item_number');
1522	1513	add_action('wp_ajax_nopriv_qcld_wb_chatbot_update_cart_item_number', 'qcld_wb_chatbot_update_cart_item_number');
1523	1514	function qcld_wb_chatbot_update_cart_item_number(){
1524		- check_ajax_referer( 'wp_chatbot', 'nonce' );
1525	1515	//getting cart items n
1526	1516	$cart_item_key = sanitize_text_field(wp_unslash($_POST['cart_item_key']));
1527	1517	$qnty = sanitize_text_field(wp_unslash($_POST['qnty']));
1528	1518	global $wpcommerce;
		@@ -1532,9 +1522,8 @@
1532	1522	//Show item after removing from cart page.
1533	1523	add_action('wp_ajax_qcld_wb_chatbot_cart_item_remove', 'qcld_wb_chatbot_cart_item_remove');
1534	1524	add_action('wp_ajax_nopriv_qcld_wb_chatbot_cart_item_remove', 'qcld_wb_chatbot_cart_item_remove');
1535	1525	function qcld_wb_chatbot_cart_item_remove(){
1536		- check_ajax_referer( 'wp_chatbot', 'nonce' );
1537	1526	//getting cart items n
1538	1527	$cart_item_key = sanitize_text_field(wp_unslash($_POST['cart_item']));
1539	1528	global $wpcommerce;
1540	1529	$result = $wpcommerce->cart->remove_cart_item($cart_item_key);
		@@ -1592,9 +1581,9 @@
1592	1581
1593	1582	if(class_exists('Qcformbuilder_Forms_Admin')){
1594	1583
1595	1584
1596		- $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM ". $wpdb->prefix."wfb_forms WHERE type= %s",'primary')); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	1585	+ $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM ". $wpdb->prefix."wfb_forms WHERE type= %s",'primary')); //DB Call OK, No Caching OK
1597	1586
1598	1587	if(!empty($results)){
1599	1588
1600	1589	foreach($results as $result){
		@@ -1747,12 +1736,9 @@
1747	1736	}
1748	1737	}
1749	1738
1750	1739	function qcld_choose_random($array){
1751		- if (is_array($array) && !empty($array)) {
1752		- return $array[array_rand($array)];
1753		- }
1754		- return $array;
	1740	+ return $array[array_rand($array)];
1755	1741	}
1756	1742
1757	1743	//User session count
1758	1744	add_action('wp_ajax_qcld_wb_chatbot_session_count', 'qcld_wb_chatbot_session_count');
		@@ -1765,22 +1751,22 @@
1765	1751	$tableuser = $wpdb->prefix.'wpbot_sessions';
1766	1752	$response = array();
1767	1753
1768	1754
1769		- $session_exists = $wpdb->get_row($wpdb->prepare("select * from {$tableuser} where 1 and id = %d",1)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
	1755	+ $session_exists = $wpdb->get_row($wpdb->prepare("select * from $tableuser where 1 and id = %d",1)); //DB Call OK, No Caching OK
1770	1756
1771	1757	if(empty($session_exists)){
1772		- $wpdb->insert( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
	1758	+ $wpdb->insert(
1773	1759	$tableuser,
1774	1760	array(
1775	1761	'session' => 1,
1776	1762	)
1777		- );
	1763	+ ); //DB Call OK, No Caching OK
1778	1764	}else{
1779	1765
1780	1766	$session_id = $session_exists->id;
1781	1767
1782		- $wpdb->update( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	1768	+ $wpdb->update(
1783	1769	$tableuser,
1784	1770	array(
1785	1771	'session'=>($session_exists->session+1),
1786	1772	),
		@@ -1788,9 +1774,9 @@
1788	1774	array(
1789	1775	'%d',
1790	1776	),
1791	1777	array('%d')
1792		- );
	1778	+ ); //DB Call OK, No Caching OK
1793	1779
1794	1780	}
1795	1781
1796	1782	wp_send_json($response);
		@@ -1798,9 +1784,9 @@
1798	1784
1799	1785	/* WPBot Chat History Addon check */
1800	1786	function qcld_wpbot_is_active_chat_history(){
1801	1787
1802		- if(function_exists('qcwp_chat_session_menu_fnc') || function_exists('qcwp_chat_session_menu_fnc_free') || function_exists( 'qcpdcs_chat_session_menu_fnc' ) ){
	1788	+ if(function_exists('qcwp_chat_session_menu_fnc') || function_exists( 'qcpdcs_chat_session_menu_fnc' ) ){
1803	1789	return 1;
1804	1790	}else{
1805	1791	return 0;
1806	1792	}
		@@ -1815,11 +1801,9 @@
1815	1801	return $data;
1816	1802	}
1817	1803	add_action('wp_ajax_qcld_small_talk_import', 'qcld_small_talk_import');
1818	1804	function qcld_small_talk_import(){
1819		- if ( ! current_user_can( 'manage_options' ) ) {
1820		- wp_die();
1821		- }
	1805	+
1822	1806	global $wpdb;
1823	1807
1824	1808	$table = $wpdb->prefix.'wpbot_response';
1825	1809
		@@ -1826,10 +1810,9 @@
1826	1810	$csvFile = file(QCLD_wpCHATBOT_PLUGIN_DIR_PATH . 'small_talk.csv');
1827	1811
1828	1812	foreach ($csvFile as $line) {
1829	1813	$line = str_getcsv($line, ',', '"');
1830		- $wpdb->insert( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
1831		- $table, array(
	1814	+ $wpdb->insert($table, array(
1832	1815	'query' => $line[0],
1833	1816	'keyword' => $line[1],
1834	1817	'response' => $line[2],
1835	1818	'category'=> $line[3],
		@@ -1834,17 +1817,16 @@
1834	1817	'response' => $line[2],
1835	1818	'category'=> $line[3],
1836	1819	'intent'=> '',
1837	1820	//'lang'=> 'en_US',
1838		- ));
	1821	+ )); //DB Call OK, No Caching OK
1839	1822	}
1840	1823
1841	1824	$table2 = $wpdb->prefix.'wpbot_response_category';
1842	1825
1843		- $wpdb->insert( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery
1844		- $table2, array(
	1826	+ $wpdb->insert($table2, array(
1845	1827	'name' => 'smalltalk',
1846		- ));
	1828	+ )); //DB Call OK, No Caching OK
1847	1829
1848	1830	update_option( 'qcld_small_talk_imported', 'yes' );
1849	1831
1850	1832	}
		@@ -1872,12 +1854,8 @@
1872	1854	function qcld_change_language_from_center() {
1873	1855	if ( ! current_user_can( 'manage_options' ) ) {
1874	1856	wp_send_json_error( array( 'message' => 'Unauthorized.' ) );
1875	1857	}
1876		- $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
1877		- if ( ! wp_verify_nonce( $nonce, 'wp_chatbot' ) ) {
1878		- wp_send_json_error( array( 'message' => 'Invalid nonce.' ) );
1879		- }
1880	1858	$plugin_path = plugin_dir_path( __FILE__ );
1881	1859	include $plugin_path . 'includes/admin/settings-fields.php';
1882	1860	$json_file_path = $plugin_path . 'includes/language-center.json';
1883	1861
		@@ -1891,5 +1869,5 @@
1891	1869	wp_send_json_error( array( 'message' => 'Language not specified.' ) );
1892	1870
1893	1871	}
1894	1872	}
1895		-}
	1873	+}