← All changes
|
app/Services/FormBuilder/EditorShortcodeParser.php
+7
-3
6.2.13
→
6.2.14
View file →
| @@ -218,9 +218,9 @@ | ||
| 218 | 218 | |
| 219 | 219 | if (false !== strpos($prop, 'meta.')) { |
| 220 | 220 | $metaKey = substr($prop, strlen('meta.')); |
| 221 | 221 | $metaKey = sanitize_text_field($metaKey); |
| 222 | - if (empty($metaKey)) { | |
| 222 | + if (empty($metaKey) || ShortCodeParser::isDeniedUserProperty($metaKey)) { | |
| 223 | 223 | return ''; |
| 224 | 224 | } |
| 225 | 225 | $userId = $user->ID; |
| 226 | 226 | $data = get_user_meta($userId, $metaKey, true); |
| @@ -230,8 +230,12 @@ | ||
| 230 | 230 | } |
| 231 | 231 | return esc_html(implode(',', $data)); |
| 232 | 232 | } |
| 233 | 233 | |
| 234 | + if (ShortCodeParser::isDeniedUserProperty($prop)) { | |
| 235 | + return ''; | |
| 236 | + } | |
| 237 | + | |
| 234 | 238 | return esc_html($user->{$prop}); |
| 235 | 239 | } |
| 236 | 240 | |
| 237 | 241 | return ''; |
| @@ -255,9 +259,9 @@ | ||
| 255 | 259 | |
| 256 | 260 | if (false !== strpos($key, 'author.')) { |
| 257 | 261 | $authorProperty = substr($key, strlen('author.')); |
| 258 | 262 | $authorId = $post->post_author; |
| 259 | - if ($authorId) { | |
| 263 | + if ($authorId && !ShortCodeParser::isDeniedUserProperty($authorProperty)) { | |
| 260 | 264 | $data = get_the_author_meta($authorProperty, $authorId); |
| 261 | 265 | if (!is_array($data)) { |
| 262 | 266 | return esc_html($data); |
| 263 | 267 | } |
| @@ -286,9 +290,9 @@ | ||
| 286 | 290 | if ('permalink' == $prop) { |
| 287 | 291 | return site_url(esc_attr(urldecode(wpFluentForm('request')->server('REQUEST_URI')))); |
| 288 | 292 | } |
| 289 | 293 | |
| 290 | - if (property_exists($post, $prop)) { | |
| 294 | + if ('post_password' !== $prop && property_exists($post, $prop)) { | |
| 291 | 295 | return esc_html($post->{$prop}); |
| 292 | 296 | } |
| 293 | 297 | return ''; |
| 294 | 298 | } |