| @@ -1,9 +1,9 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace FluentForm\App\Services\FormBuilder\Components; |
| 4 | 4 | |
| 5 | -defined('ABSPATH') or die; | |
| 5 | +defined('ABSPATH') || die; | |
| 6 | 6 | |
| 7 | 7 | use FluentForm\App\Helpers\Helper; |
| 8 | 8 | use FluentForm\Framework\Helpers\ArrayHelper; |
| 9 | 9 | |
| @@ -23,9 +23,9 @@ | ||
| 23 | 23 | $data = apply_filters_deprecated( |
| 24 | 24 | 'fluentform_rendering_field_data_' . $elementName, |
| 25 | 25 | [ |
| 26 | 26 | $data, |
| 27 | - $form | |
| 27 | + $form, | |
| 28 | 28 | ], |
| 29 | 29 | FLUENTFORM_FRAMEWORK_UPGRADE, |
| 30 | 30 | 'fluentform/rendering_field_data_' . $elementName, |
| 31 | 31 | 'Use fluentform/rendering_field_data_' . $elementName . ' instead of fluentform_rendering_field_data_' . $elementName |
| @@ -53,13 +53,16 @@ | ||
| 53 | 53 | $ariaRequired = 'true'; |
| 54 | 54 | } |
| 55 | 55 | $id = $data['attributes']['id']; |
| 56 | 56 | |
| 57 | - $ariaLabel = esc_html__(' Use arrow keys to navigate dates. Press enter to select a date.', 'fluentform') ; | |
| 58 | - $label = ArrayHelper::get($data,'settings.label'); | |
| 59 | - $elMarkup = "<input aria-label='".$label.$ariaLabel."' aria-haspopup='dialog' data-type-datepicker data-format='" . esc_attr($dateFormat) . "' " . $atts . " aria-invalid='false' aria-required={$ariaRequired}>"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $atts is escaped before being passed in. | |
| 57 | + $ariaLabel = esc_html__(' Use arrow keys to navigate dates. Press enter to select a date.', 'fluentform'); | |
| 58 | + $label = ArrayHelper::get($data, 'settings.label'); | |
| 59 | + // SECURITY (FINDING-12): esc_attr the settings.label before interpolating it into the | |
| 60 | + // single-quoted aria-label; the save-time wp_kses does not encode quotes, so an unescaped | |
| 61 | + // label allows an attribute breakout (stored XSS). | |
| 62 | + $elMarkup = "<input aria-label='" . esc_attr($label) . $ariaLabel . "' aria-haspopup='dialog' data-type-datepicker data-format='" . esc_attr($dateFormat) . "' " . $atts . " aria-invalid='false' aria-required={$ariaRequired}>"; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $atts is escaped before being passed in. | |
| 60 | 63 | $config = $this->getDateFormatConfigJSON($data['settings'], $form); |
| 61 | - $customConfig = $this->getCustomConfig($data['settings']); | |
| 64 | + $customConfig = $this->getCustomConfig($data['settings'], $form); | |
| 62 | 65 | $this->loadToFooter($config, $customConfig, $form, $id); |
| 63 | 66 | $html = $this->buildElementMarkup($elMarkup, $data, $form); |
| 64 | 67 | |
| 65 | 68 | $html = apply_filters_deprecated( |
| @@ -66,9 +69,9 @@ | ||
| 66 | 69 | 'fluentform_rendering_field_html_' . $elementName, |
| 67 | 70 | [ |
| 68 | 71 | $html, |
| 69 | 72 | $data, |
| 70 | - $form | |
| 73 | + $form, | |
| 71 | 74 | ], |
| 72 | 75 | FLUENTFORM_FRAMEWORK_UPGRADE, |
| 73 | 76 | 'fluentform/rendering_field_html_' . $elementName, |
| 74 | 77 | 'Use fluentform/rendering_field_html_' . $elementName . ' instead of fluentform_rendering_field_html_' . $elementName |
| @@ -125,9 +128,9 @@ | ||
| 125 | 128 | } |
| 126 | 129 | |
| 127 | 130 | $config = apply_filters('fluentform/frontend_date_format', [ |
| 128 | 131 | 'dateFormat' => $dateFormat, |
| 129 | - 'ariaDateFormat' =>"F j, Y", | |
| 132 | + 'ariaDateFormat' =>'F j, Y', | |
| 130 | 133 | 'enableTime' => $hasTime, |
| 131 | 134 | 'noCalendar' => ! $this->hasDate($dateFormat), |
| 132 | 135 | 'disableMobile' => true, |
| 133 | 136 | 'time_24hr' => $time24, |
| @@ -135,17 +138,23 @@ | ||
| 135 | 138 | |
| 136 | 139 | return json_encode($config, JSON_FORCE_OBJECT); |
| 137 | 140 | } |
| 138 | 141 | |
| 139 | - public function getCustomConfig($settings) | |
| 142 | + public function getCustomConfig($settings, $form = null) | |
| 140 | 143 | { |
| 141 | - $customConfigObject = trim(ArrayHelper::get($settings, 'date_config')); | |
| 144 | + $customConfigObject = trim((string) ArrayHelper::get($settings, 'date_config')); | |
| 142 | 145 | |
| 143 | - if (! $customConfigObject || '{' != substr($customConfigObject, 0, 1) || '}' != substr($customConfigObject, -1)) { | |
| 146 | + if ( | |
| 147 | + !$customConfigObject || | |
| 148 | + '{' !== substr($customConfigObject, 0, 1) || | |
| 149 | + '}' !== substr($customConfigObject, -1) | |
| 150 | + ) { | |
| 144 | 151 | $customConfigObject = '{}'; |
| 152 | + } else { | |
| 153 | + $customConfigObject = str_ireplace('</script', '<\\/script', $customConfigObject); | |
| 145 | 154 | } |
| 146 | 155 | |
| 147 | - return $customConfigObject; | |
| 156 | + return apply_filters('fluentform/date_time_custom_config', $customConfigObject, $settings, $form); | |
| 148 | 157 | } |
| 149 | 158 | |
| 150 | 159 | private function loadToFooter($config, $customConfigObject, $form, $id) |
| 151 | 160 | { |
