← All changes | includes/payments/class-give-payment.php +30 -28 4.16.3 → 4.17.0 View file →

		@@ -636,17 +636,18 @@
636	636
637	637	$this->setup_payment( $payment_id );
638	638	}
639	639
640		- /**
641		- * Create the base of a payment.
642		- *
643		- * @since 1.5
644		- * @access private
645		- *
646		- * @return int|bool False on failure, the payment ID on success.
647		- */
648		- private function insert_payment() {
	640	+ /**
	641	+ * Create the base of a payment.
	642	+ *
	643	+ * @since 4.16.7.2 Sanitize first, last, and title name values before storing donor meta.
	644	+ * @since 1.5
	645	+ * @access private
	646	+ *
	647	+ * @return int|bool False on failure, the payment ID on success.
	648	+ */
	649	+ private function insert_payment() {
649	650
650	651	// Construct the payment title.
651	652	$payment_title = '';
652	653	if ( ! empty( $this->first_name ) && ! empty( $this->last_name ) ) {
		@@ -757,11 +758,11 @@
757	758	*/
758	759	$donor = apply_filters( 'give_update_donor_information', $donor, $payment_id, $payment_data, $args );
759	760
760	761	// Update Donor Meta once donor is created.
761		- $donor->update_meta( '_give_donor_first_name', $this->first_name );
762		- $donor->update_meta( '_give_donor_last_name', $this->last_name );
763		- $donor->update_meta( '_give_donor_title_prefix', $this->title_prefix );
	762	+ $donor->update_meta( '_give_donor_first_name', sanitize_text_field( $this->first_name ) );
	763	+ $donor->update_meta( '_give_donor_last_name', sanitize_text_field( $this->last_name ) );
	764	+ $donor->update_meta( '_give_donor_title_prefix', sanitize_text_field( $this->title_prefix ) );
764	765
765	766	$this->customer_id = $donor->id;
766	767	$this->pending['customer_id'] = $this->customer_id;
767	768	$donor->attach_payment( $this->ID, false );
		@@ -802,18 +803,19 @@
802	803	return $this->ID;
803	804
804	805	}
805	806
806		- /**
807		- * Save
808		- *
809		- * Once items have been set, an update is needed to save them to the database.
810		- *
811		- * @access public
812		- *
813		- * @return bool True of the save occurred, false if it failed or wasn't needed
814		- */
815		- public function save() {
	807	+ /**
	808	+ * Save
	809	+ *
	810	+ * Once items have been set, an update is needed to save them to the database.
	811	+ *
	812	+ * @since 4.16.7.2 Sanitize first and last name values when saving billing meta.
	813	+ * @access public
	814	+ *
	815	+ * @return bool True of the save occurred, false if it failed or wasn't needed
	816	+ */
	817	+ public function save() {
816	818	$saved = false;
817	819
818	820	// Must have an ID.
819	821	if ( empty( $this->ID ) ) {
		@@ -921,15 +923,15 @@
921	923	case 'price_id':
922	924	$this->update_meta( '_give_payment_price_id', $this->price_id );
923	925	break;
924	926
925		- case 'first_name':
926		- $this->update_meta( '_give_donor_billing_first_name', $this->first_name );
927		- break;
	927	+ case 'first_name':
	928	+ $this->update_meta( '_give_donor_billing_first_name', sanitize_text_field( $this->first_name ) );
	929	+ break;
928	930
929		- case 'last_name':
930		- $this->update_meta( '_give_donor_billing_last_name', $this->last_name );
931		- break;
	931	+ case 'last_name':
	932	+ $this->update_meta( '_give_donor_billing_last_name', sanitize_text_field( $this->last_name ) );
	933	+ break;
932	934
933	935	case 'currency':
934	936	$this->update_meta( '_give_payment_currency', $this->currency );
935	937	break;