| @@ -1,8 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * @package FireBox |
| 4 | - * @version 3.1.10 Free | |
| 4 | + * @version 3.1.14 Free | |
| 5 | 5 | * |
| 6 | 6 | * @author FirePlugins <[email protected]> |
| 7 | 7 | * @link https://www.fireplugins.com |
| 8 | 8 | * @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| @@ -164,9 +164,9 @@ | ||
| 164 | 164 | wp_die(); |
| 165 | 165 | } |
| 166 | 166 | |
| 167 | 167 | $form_data = isset($_POST['form_data']) ? sanitize_text_field(wp_unslash($_POST['form_data'])) : ''; |
| 168 | - $form_data = $form_data ? json_decode(html_entity_decode(stripslashes($form_data)), true) : ''; | |
| 168 | + $form_data = $form_data ? json_decode(stripslashes($form_data), true) : ''; | |
| 169 | 169 | |
| 170 | 170 | if (!$form_data) |
| 171 | 171 | { |
| 172 | 172 | echo wp_json_encode([ |
| @@ -205,8 +205,18 @@ | ||
| 205 | 205 | ]); |
| 206 | 206 | wp_die(); |
| 207 | 207 | } |
| 208 | 208 | |
| 209 | + // Forms live inside campaigns; only a published campaign may accept submissions from the frontend. | |
| 210 | + if (empty($form['state']) || $form['state'] !== '1') | |
| 211 | + { | |
| 212 | + echo wp_json_encode([ | |
| 213 | + 'error' => true, | |
| 214 | + 'message' => 'This form does not exist.' | |
| 215 | + ]); | |
| 216 | + wp_die(); | |
| 217 | + } | |
| 218 | + | |
| 209 | 219 | $form_block = $form['block']; |
| 210 | 220 | $form_fields = $form['fields']; |
| 211 | 221 | |
| 212 | 222 | // Get the Campaign ID |
| @@ -222,9 +232,9 @@ | ||
| 222 | 232 | catch (\Exception $e) |
| 223 | 233 | { |
| 224 | 234 | echo wp_json_encode([ |
| 225 | 235 | 'error' => true, |
| 226 | - 'message' => $e->getMessage() | |
| 236 | + 'message' => wp_kses_post($e->getMessage()) | |
| 227 | 237 | ]); |
| 228 | 238 | wp_die(); |
| 229 | 239 | } |
| 230 | 240 | |
| @@ -234,9 +244,9 @@ | ||
| 234 | 244 | catch (\Exception $e) |
| 235 | 245 | { |
| 236 | 246 | echo wp_json_encode([ |
| 237 | 247 | 'error' => true, |
| 238 | - 'message' => $e->getMessage() | |
| 248 | + 'message' => wp_kses_post($e->getMessage()) | |
| 239 | 249 | ]); |
| 240 | 250 | wp_die(); |
| 241 | 251 | } |
| 242 | 252 | |
| @@ -337,9 +347,9 @@ | ||
| 337 | 347 | if (!$actions->run()) |
| 338 | 348 | { |
| 339 | 349 | echo wp_json_encode([ |
| 340 | 350 | 'error' => true, |
| 341 | - 'message' => $actions->getErrorMessage() | |
| 351 | + 'message' => wp_kses_post($actions->getErrorMessage()) | |
| 342 | 352 | ]); |
| 343 | 353 | wp_die(); |
| 344 | 354 | } |
| 345 | 355 | } |
