| @@ -1,8 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * @package FireBox |
| 4 | - * @version 3.1.9 Free | |
| 4 | + * @version 3.1.14 Free | |
| 5 | 5 | * |
| 6 | 6 | * @author FirePlugins <[email protected]> |
| 7 | 7 | * @link https://www.fireplugins.com |
| 8 | 8 | * @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| @@ -100,9 +100,14 @@ | ||
| 100 | 100 | $assign_cookietype = isset($meta[0]['assign_cookietype']) ? $meta[0]['assign_cookietype'] : ''; |
| 101 | 101 | |
| 102 | 102 | if ($assign_cookietype === 'never') |
| 103 | 103 | { |
| 104 | - setcookie('firebox_' . $post_id, '', time() - 3600, '/'); | |
| 104 | + $cookie = \FireBox\Core\Helpers\BoxHelper::cookiePrefix() . $post_id; | |
| 105 | + | |
| 106 | + foreach (\FireBox\Core\Helpers\BoxHelper::cookiePathsToClear() as $path) | |
| 107 | + { | |
| 108 | + setcookie($cookie, '', time() - 3600, $path, \FireBox\Core\Helpers\BoxHelper::cookieDomain()); | |
| 109 | + } | |
| 105 | 110 | } |
| 106 | 111 | } |
| 107 | 112 | |
| 108 | 113 | /** |
| @@ -127,9 +132,10 @@ | ||
| 127 | 132 | .editor-header:has(>.editor-header__center) { |
| 128 | 133 | grid-template: auto / auto minmax(min-content, 1fr) 2fr minmax(min-content, 1fr) 60px; |
| 129 | 134 | } |
| 130 | 135 | } |
| 131 | - .editor-header__back-button .edit-post-fullscreen-mode-close { | |
| 136 | + .editor-header__back-button .edit-post-fullscreen-mode-close, | |
| 137 | + .editor-header__back-button a.components-button.has-icon { | |
| 132 | 138 | background: transparent !important; |
| 133 | 139 | background-image: url("<?php echo esc_url(FBOX_MEDIA_ADMIN_URL); ?>images/logo_full.svg") !important; |
| 134 | 140 | background-size: 105px !important; |
| 135 | 141 | margin-right: 0 !important; |
| @@ -182,32 +188,56 @@ | ||
| 182 | 188 | { |
| 183 | 189 | return; |
| 184 | 190 | } |
| 185 | 191 | |
| 186 | - $filename = get_temp_dir() . 'submissions_' . $export['name'] . '_' . date('Y-m-d_H-i-s') . '.csv'; | |
| 187 | - self::toCSV($export['rows'], $filename); | |
| 192 | + /** | |
| 193 | + * The export holds every submission for the form, so it must not sit at a | |
| 194 | + * guessable path in the shared temp directory while it is being served. | |
| 195 | + * wp_tempnam() creates a unique file with restrictive permissions. | |
| 196 | + */ | |
| 197 | + $name = sanitize_file_name($export['name']); | |
| 198 | + $download_name = 'submissions_' . $name . '_' . gmdate('Y-m-d_H-i-s') . '.csv'; | |
| 188 | 199 | |
| 189 | - // Prompt to download the file | |
| 190 | - error_reporting(0); | |
| 200 | + $filename = wp_tempnam('firebox-export-' . $name); | |
| 191 | 201 | |
| 192 | - // Send the appropriate headers to force the download in the browser | |
| 193 | - header('Content-Description: File Transfer'); | |
| 194 | - header('Content-Type: application/octet-stream'); | |
| 195 | - header('Content-Disposition: attachment; filename="' . basename($filename) . '"'); | |
| 196 | - header('Expires: 0'); | |
| 197 | - header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); | |
| 198 | - header('Cache-Control: public', false); | |
| 199 | - header('Pragma: public'); | |
| 200 | - header('Content-Length: ' . @filesize($filename)); | |
| 202 | + if (!$filename) | |
| 203 | + { | |
| 204 | + return; | |
| 205 | + } | |
| 201 | 206 | |
| 202 | - // Clear the output buffer and disable output buffering | |
| 203 | - ob_clean(); | |
| 204 | - flush(); | |
| 207 | + try | |
| 208 | + { | |
| 209 | + self::toCSV($export['rows'], $filename); | |
| 205 | 210 | |
| 206 | - readfile($filename); | |
| 211 | + // Send the appropriate headers to force the download in the browser | |
| 212 | + header('Content-Description: File Transfer'); | |
| 213 | + header('Content-Type: text/csv; charset=UTF-8'); | |
| 214 | + header('Content-Disposition: attachment; filename="' . $download_name . '"'); | |
| 215 | + header('X-Content-Type-Options: nosniff'); | |
| 216 | + header('Expires: 0'); | |
| 217 | + header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); | |
| 218 | + header('Pragma: public'); | |
| 219 | + header('Content-Length: ' . filesize($filename)); | |
| 207 | 220 | |
| 208 | - unlink($filename); | |
| 221 | + // Clear any buffered output so it doesn't corrupt the download | |
| 222 | + while (ob_get_level()) | |
| 223 | + { | |
| 224 | + ob_end_clean(); | |
| 225 | + } | |
| 209 | 226 | |
| 227 | + flush(); | |
| 228 | + | |
| 229 | + readfile($filename); | |
| 230 | + } | |
| 231 | + finally | |
| 232 | + { | |
| 233 | + // Runs even if writing or streaming failed, so the PII never lingers on disk. | |
| 234 | + if (file_exists($filename)) | |
| 235 | + { | |
| 236 | + unlink($filename); | |
| 237 | + } | |
| 238 | + } | |
| 239 | + | |
| 210 | 240 | exit; |
| 211 | 241 | } |
| 212 | 242 | |
| 213 | 243 | /** |
| @@ -842,8 +872,12 @@ | ||
| 842 | 872 | 'CONVERSION' => firebox()->_('FB_CONVERSION'), |
| 843 | 873 | 'CONVERSIONS' => firebox()->_('FB_CONVERSIONS'), |
| 844 | 874 | 'CONVERSION_RATE' => firebox()->_('FB_CONVERSION_RATE'), |
| 845 | 875 | 'NO_DATA_AVAILABLE' => firebox()->_('FB_NO_DATA_AVAILABLE'), |
| 876 | + 'COULDNT_LOAD_DATA' => firebox()->_('FB_COULDNT_LOAD_DATA'), | |
| 877 | + 'TRY_AGAIN' => firebox()->_('FB_TRY_AGAIN'), | |
| 878 | + 'DISMISS' => firebox()->_('FB_DISMISS'), | |
| 879 | + 'ERROR_OCCURRED_PLEASE_TRY_AGAIN' => fpframework()->_('FPF_ERROR_OCCURRED_PLEASE_TRY_AGAIN'), | |
| 846 | 880 | 'COUNTRIES' => fpframework()->_('FPF_COUNTRIES'), |
| 847 | 881 | 'FLAG' => fpframework()->_('FPF_FLAG'), |
| 848 | 882 | 'DEVICES' => fpframework()->_('FPF_DEVICES'), |
| 849 | 883 | 'EVENTS' => fpframework()->_('FPF_EVENTS'), |
