| @@ -1,8 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * @package FireBox |
| 4 | - * @version 3.1.8 Free | |
| 4 | + * @version 3.1.14 Free | |
| 5 | 5 | * |
| 6 | 6 | * @author FirePlugins <[email protected]> |
| 7 | 7 | * @link https://www.fireplugins.com |
| 8 | 8 | * @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| @@ -113,12 +113,21 @@ | ||
| 113 | 113 | |
| 114 | 114 | /** |
| 115 | 115 | * The script for the "Run Javascript" action. It executes the custom Javascript code specified by the administrator. |
| 116 | 116 | * |
| 117 | + * The code is campaign-authored and emitted verbatim, so it runs only when the | |
| 118 | + * campaign's author holds unfiltered_html — the same gate as the Custom | |
| 119 | + * JavaScript setting. | |
| 120 | + * | |
| 117 | 121 | * @return string |
| 118 | 122 | */ |
| 119 | 123 | private function _Custom() |
| 120 | 124 | { |
| 125 | + if (!\FireBox\Core\Helpers\CustomCode::isAllowedForCampaign($this->box_id)) | |
| 126 | + { | |
| 127 | + return; | |
| 128 | + } | |
| 129 | + | |
| 121 | 130 | return $this->item['customcode']; |
| 122 | 131 | } |
| 123 | 132 | |
| 124 | 133 | /** |