| @@ -1,8 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * @package FireBox |
| 4 | - * @version 3.1.8 Free | |
| 4 | + * @version 3.1.14 Free | |
| 5 | 5 | * |
| 6 | 6 | * @author FirePlugins <[email protected]> |
| 7 | 7 | * @link https://www.fireplugins.com |
| 8 | 8 | * @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| @@ -97,9 +97,14 @@ | ||
| 97 | 97 | return $field->prepareValueHTML($meta_item->meta_value); |
| 98 | 98 | } |
| 99 | 99 | else |
| 100 | 100 | { |
| 101 | - return nl2br($meta_item->meta_value); | |
| 101 | + /** | |
| 102 | + * The field no longer exists in the form, so there is no field class to | |
| 103 | + * escape the value for us. Escape here instead — stored values predate | |
| 104 | + * any given sanitization rule and must not be trusted at render time. | |
| 105 | + */ | |
| 106 | + return nl2br(esc_html($meta_item->meta_value)); | |
| 102 | 107 | } |
| 103 | 108 | } |
| 104 | 109 | |
| 105 | 110 | return ''; |
| @@ -437,9 +442,9 @@ | ||
| 437 | 442 | */ |
| 438 | 443 | public function get_views() |
| 439 | 444 | { |
| 440 | 445 | $current = isset($_GET['status']) ? sanitize_key($_GET['status']) : ''; //phpcs:ignore WordPress.Security.NonceVerification.Recommended |
| 441 | - $base_url = $this->get_base_url(); | |
| 446 | + $base_url = admin_url('admin.php?page=firebox-submissions'); | |
| 442 | 447 | |
| 443 | 448 | // Base URL |
| 444 | 449 | $remove = ['status', 'paged', '_wpnonce']; |
| 445 | 450 | $url = remove_query_arg($remove, $base_url); |
