| @@ -120,9 +120,13 @@ | ||
| 120 | 120 | foreach ($values as $value) { |
| 121 | 121 | if (!$value) { |
| 122 | 122 | continue; |
| 123 | 123 | } |
| 124 | - $html .= '<li><a href="' . $value . '" target="_blank">' . basename($value) . '</a></li>'; | |
| 124 | + // SECURITY (FINDING-23): escape the submitted upload value. It reaches this HTML sink | |
| 125 | + // via an unauthenticated submission and is only sanitize_text_field'd (keeps " and :), | |
| 126 | + // so a javascript: URL or an " onmouseover=" attribute breakout would otherwise render | |
| 127 | + // in the admin entry view, notification email and PDF. esc_url enforces a safe scheme. | |
| 128 | + $html .= '<li><a href="' . esc_url($value) . '" target="_blank">' . esc_html(basename($value)) . '</a></li>'; | |
| 125 | 129 | } |
| 126 | 130 | |
| 127 | 131 | $html .= '</ul>'; |
| 128 | 132 | return $html; |
| @@ -151,9 +155,10 @@ | ||
| 151 | 155 | $value = $values[0]; |
| 152 | 156 | if (!$value) { |
| 153 | 157 | return ''; |
| 154 | 158 | } |
| 155 | - return '<a href="' . $value . '" target="_blank"><img style="max-width:180px" src="' . $value . '" /></a>'; | |
| 159 | + // SECURITY (FINDING-23): escape the submitted upload value (see formatFileValues). | |
| 160 | + return '<a href="' . esc_url($value) . '" target="_blank"><img style="max-width:180px" src="' . esc_url($value) . '" /></a>'; | |
| 156 | 161 | } |
| 157 | 162 | |
| 158 | 163 | $html = '<ul class="ff_entry_list ff_entry_images">'; |
| 159 | 164 | foreach ($values as $value) { |
| @@ -159,9 +164,10 @@ | ||
| 159 | 164 | foreach ($values as $value) { |
| 160 | 165 | if (!$value) { |
| 161 | 166 | continue; |
| 162 | 167 | } |
| 163 | - $html .= '<li style="margin: 20px 20px 20px 0px; display: inline-block; margin-right: 20px;"><a href="' . $value . '" target="_blank"><img style="max-width:180px" src="' . $value . '" /></a></li>'; | |
| 168 | + // SECURITY (FINDING-23): escape the submitted upload value (see formatFileValues). | |
| 169 | + $html .= '<li style="margin: 20px 20px 20px 0px; display: inline-block; margin-right: 20px;"><a href="' . esc_url($value) . '" target="_blank"><img style="max-width:180px" src="' . esc_url($value) . '" /></a></li>'; | |
| 164 | 170 | } |
| 165 | 171 | |
| 166 | 172 | $html .= '</ul>'; |
| 167 | 173 | return $html; |
| @@ -327,9 +333,9 @@ | ||
| 327 | 333 | defined('FLUENTFORM_RENDERING_ENTRIES') && |
| 328 | 334 | $values && is_array($values) && |
| 329 | 335 | $options = ArrayHelper::get($field, 'raw.settings.advanced_options', []) |
| 330 | 336 | ) { |
| 331 | - $options = array_column($options, 'label', 'value'); | |
| 337 | + $options = \FluentForm\App\Helpers\Helper::advancedOptionsValueLabelMap($options); | |
| 332 | 338 | foreach ($values as &$value) { |
| 333 | 339 | if ($label = ArrayHelper::get($options, $value)) { |
| 334 | 340 | $value = $label; |
| 335 | 341 | } |
| @@ -346,12 +352,11 @@ | ||
| 346 | 352 | return ''; |
| 347 | 353 | } |
| 348 | 354 | |
| 349 | 355 | if (!isset($field['options'])) { |
| 350 | - $field['options'] = []; | |
| 351 | - foreach (ArrayHelper::get($field, 'raw.settings.advanced_options', []) as $option) { | |
| 352 | - $field['options'][$option['value']] = $option['label']; | |
| 353 | - } | |
| 356 | + $field['options'] = \FluentForm\App\Helpers\Helper::advancedOptionsValueLabelMap( | |
| 357 | + ArrayHelper::get($field, 'raw.settings.advanced_options', []) | |
| 358 | + ); | |
| 354 | 359 | } |
| 355 | 360 | |
| 356 | 361 | $html = '<ul style="white-space: normal;">'; |
| 357 | 362 | foreach ($values as $value) { |
