← All changes | app/Helpers/Helper.php +30 -0 6.2.13 → 6.2.14 View file →

		@@ -121,8 +121,32 @@
121	121	{
122	122	return is_scalar($value) ? sanitize_title($value) : '';
123	123	}
124	124
	125	+ /**
	126	+ * A key is unsafe when it opens a handler, or when it carries a character that
	127	+ * ENDS an attribute name in the HTML tokeniser -- whitespace, quote, slash,
	128	+ * equals or angle bracket. `esc_attr()` leaves those intact, so `x onclick`
	129	+ * renders as two attributes and the second one is live.
	130	+ *
	131	+ * Deny those characters rather than allow-list a charset: an allow-list also
	132	+ * rejects the legal-but-unusual keys real sites carry (leading underscore,
	133	+ * non-Latin names, framework prefixes) and silently drops working markup.
	134	+ *
	135	+ * @param string|int $key
	136	+ * @return bool
	137	+ */
	138	+ public static function isSafeAttributeKey($key)
	139	+ {
	140	+ $key = (string) $key;
	141	+
	142	+ if ('' === $key || preg_match('/^on[a-z]/i', $key)) {
	143	+ return false;
	144	+ }
	145	+
	146	+ return !preg_match('/[\s"\'\/=<>`]|[\x00-\x1F\x7F]/', $key);
	147	+ }
	148	+
125	149	/*
126	150	* Keys the whitelist above drops but the editor and Pro Inventory need back.
127	151	* They are sanitized rather than passed through, since preserving unknown
128	152	* keys verbatim would defeat the whitelist for exactly the users this path
		@@ -327,8 +351,14 @@
327	351
328	352	$statuses['trashed'] = __('Trashed', 'fluentform');
329	353
330	354	return $statuses;
	355	+ }
	356	+
	357	+ // Statuses a caller may write by hand; add-ons withhold the ones they own as workflow steps.
	358	+ public static function getMutableEntryStatuses($form_id = false, $submission_id = null)
	359	+ {
	360	+ return apply_filters('fluentform/entry_statuses_for_mutation', static::getEntryStatuses($form_id), $form_id, $submission_id);
331	361	}
332	362
333	363	public static function getReportableInputs()
334	364	{