← All changes | boot/globals.php +59 -40 6.2.9 → 6.2.14 View file →

		@@ -100,9 +100,9 @@
100	100	$input = sanitize_text_field($input);
101	101	}
102	102	} elseif (is_array($input)) {
103	103	$sanitizedInput = [];
104		-
	104	+
105	105	foreach ($input as $key => &$value) {
106	106	$key = fluentFormSanitizer($key);
107	107	// Local var: mutating $attribute here would collapse every sibling
108	108	// after the first onto a bare key, resolving nested inputs to the wrong element.
		@@ -110,9 +110,9 @@
110	110
111	111	$value = fluentFormSanitizer($value, $childAttribute, $fields);
112	112	$sanitizedInput[$key] = $value;
113	113	}
114		-
	114	+
115	115	$input = $sanitizedInput;
116	116	}
117	117
118	118	return $input;
		@@ -211,13 +211,13 @@
211	211
212	212	function fluentFormIsHandlingSubmission()
213	213	{
214	214	$status = fluentFormWasSubmitted() || isWpAsyncRequest('fluentform_async_request');
215		-
	215	+
216	216	$status = apply_filters_deprecated(
217	217	'fluentform_is_handling_submission',
218	218	[
219		- $status
	219	+ $status,
220	220	],
221	221	FLUENTFORM_FRAMEWORK_UPGRADE,
222	222	'fluentform/is_handling_submission',
223	223	'Use fluentform/is_handling_submission instead of fluentform_is_handling_submission'
		@@ -322,24 +322,8 @@
322	322	{
323	323	return \FluentForm\App\Helpers\Helper::sanitizeAdvancedOptions($options);
324	324	}
325	325
326		-function fluentform_iframe_srcdoc_sanitize($value)
327		-{
328		- $tags = wp_kses_allowed_html('post');
329		- $tags['style'] = [
330		- 'types' => [],
331		- ];
332		- // Check if decoding is necessary
333		- if (strpos($value, '&') !== false) {
334		- // Decode HTML entities
335		- $value = html_entity_decode($value, ENT_QUOTES | ENT_HTML5, 'UTF-8');
336		- $value = stripslashes($value);
337		- }
338		- return wp_kses($value, $tags);
339		-}
340		-
341		-
342	326	function fluentform_sanitize_html($html)
343	327	{
344	328	if (!$html) {
345	329	return $html;
		@@ -359,11 +343,8 @@
359	343	$tags['iframe'] = [
360	344	'width' => [],
361	345	'height' => [],
362	346	'src' => [],
363		- 'srcdoc' => [
364		- 'value_callback' => 'fluentform_iframe_srcdoc_sanitize'
365		- ],
366	347	'title' => [],
367	348	'frameborder' => [],
368	349	'allow' => [],
369	350	'class' => [],
		@@ -370,9 +351,9 @@
370	351	'id' => [],
371	352	'allowfullscreen' => [],
372	353	'style' => [],
373	354	];
374		-
	355	+
375	356	//svg
376	357	if (empty($tags['svg'])) {
377	358	$svg_args = [
378	359	'svg' => [
		@@ -387,9 +368,9 @@
387	368	'fill' => true,
388	369	'stroke' => true,
389	370	'stroke-width' => true,
390	371	'stroke-linecap' => true,
391		- 'stroke-linejoin' => true
	372	+ 'stroke-linejoin' => true,
392	373	],
393	374	'g' => ['fill' => true],
394	375	'title' => ['title' => true],
395	376	'path' => [
		@@ -397,18 +378,18 @@
397	378	'fill' => true,
398	379	'transform' => true,
399	380	],
400	381	'polyline' => [
401		- 'points' => true
402		- ]
	382	+ 'points' => true,
	383	+ ],
403	384	];
404	385	$tags = array_merge($tags, $svg_args);
405	386	}
406		-
	387	+
407	388	$tags = apply_filters_deprecated(
408	389	'fluentform_allowed_html_tags',
409	390	[
410		- $tags
	391	+ $tags,
411	392	],
412	393	FLUENTFORM_FRAMEWORK_UPGRADE,
413	394	'fluentform/allowed_html_tags',
414	395	'Use fluentform/allowed_html_tags instead of fluentform_allowed_html_tags'
		@@ -440,18 +421,8 @@
440	421
441	422	return preg_replace('/<\/?script[^>]*>/is', '', $content);
442	423	}
443	424
444		-function fluentform_sanitize_json_object($value)
445		-{
446		- return \FluentForm\App\Services\FormBuilder\DateConfigNormalizer::sanitize($value);
447		-}
448		-
449		-function fluentform_date_config_to_js($json)
450		-{
451		- return \FluentForm\App\Services\FormBuilder\DateConfigNormalizer::toJs($json);
452		-}
453		-
454	425	/**
455	426	* Sanitize inputs recursively.
456	427	*
457	428	* @param array $input
		@@ -490,9 +461,9 @@
490	461	// Convert to string if not already
491	462	if (!is_string($css)) {
492	463	$css = (string) $css;
493	464	}
494		-
	465	+
495	466	return preg_match('#</?\w+#', $css) ? '' : $css;
496	467	}
497	468
498	469	function fluentformCanUnfilteredHTML()
		@@ -525,5 +496,53 @@
525	496	];
526	497	}
527	498
528	499	return $formattedPages;
	500	+}
	501	+
	502	+function fluentform_maybe_disable_contaminated_pro()
	503	+{
	504	+ $unsafeProFile = WP_PLUGIN_DIR . '/fluentformpro/libs/class-license-sync.php';
	505	+
	506	+ if (! is_file($unsafeProFile)) {
	507	+ return;
	508	+ }
	509	+
	510	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	511	+
	512	+ deactivate_plugins(
	513	+ 'fluentformpro/fluentformpro.php',
	514	+ true
	515	+ );
	516	+
	517	+ $message = sprintf(
	518	+ __('<strong>Fluent Forms Pro has been deactivated for security reasons.</strong> Delete the existing plugin and install a fresh copy from your %1$sWPManageNinja dashboard%2$s. Your Fluent Forms data will remain intact. We recommend %3$sopening a support ticket%4$s so we can help clean up your site. Read the %5$sincident report%6$s for details.', 'fluentform'),
	519	+ '<a href="' . esc_url(add_query_arg('ff_deactivation_error', '1', 'https://wpmanageninja.com/account/downloads')) . '" target="_blank" rel="noopener noreferrer">',
	520	+ '</a>',
	521	+ '<a href="' . esc_url(add_query_arg('ff_deactivation_error', '1', 'https://wpmanageninja.com/account/support-tickets/submit-ticket/')) . '" target="_blank" rel="noopener noreferrer">',
	522	+ '</a>',
	523	+ '<a href="' . esc_url(add_query_arg('ff_deactivation_error', '1', 'https://wpmanageninja.com/security-incident-on-31-july-2026/')) . '" target="_blank" rel="noopener noreferrer">',
	524	+ '</a>'
	525	+ );
	526	+
	527	+ add_action('admin_init', function () use ($message) {
	528	+ $renderNotice = function () use ($message) {
	529	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Admin notice with HTML links
	530	+ printf('<div class="fluentform-admin-notice notice notice-error"><div style="padding: 15px 10px;">%1$s</div></div>', $message);
	531	+ };
	532	+ add_action('fluentform/global_menu', $renderNotice);
	533	+ add_action('fluentform/after_form_menu', $renderNotice);
	534	+ });
	535	+
	536	+ add_action('admin_notices', function () use ($message) {
	537	+ if (! current_user_can('activate_plugins')) {
	538	+ return;
	539	+ }
	540	+ ?>
	541	+ <div class="notice notice-error">
	542	+ <p>
	543	+ <?php echo $message; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Admin notice with HTML links ?>
	544	+ </p>
	545	+ </div>
	546	+ <?php
	547	+ });
529	548	}