| @@ -32,9 +32,9 @@ | ||
| 32 | 32 | <span style="background: #2271b1; color: #fff; width: 24px; height: 24px; border-radius: 50%; display: inline-flex; align-items: center; justify-content: center; font-size: 14px;">1</span> |
| 33 | 33 | Login with your onWebChat Email & Password |
| 34 | 34 | </h3> |
| 35 | 35 | <p style="color: #646970; margin-bottom: 15px;"> |
| 36 | - Recommended — enables automatic WooCommerce sync connection. | |
| 36 | + Recommended: it also connects the product sync for your AI chatbot (Products & Orders tab). | |
| 37 | 37 | </p> |
| 38 | 38 | |
| 39 | 39 | <table class="form-table" style="margin: 0;"> |
| 40 | 40 | <tr> |
| @@ -167,11 +167,14 @@ | ||
| 167 | 167 | if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'on_web_chat_nonce')) { |
| 168 | 168 | wp_die('Sorry, your nonce did not verify.'); |
| 169 | 169 | } |
| 170 | 170 | |
| 171 | - $userName = isset($_POST["onWebChatUser"]) ? sanitize_text_field($_POST["onWebChatUser"]) : ''; | |
| 172 | - $userPass = isset($_POST["onWebChatPass"]) ? sanitize_text_field($_POST["onWebChatPass"]) : ''; | |
| 173 | - $chatId = isset($_POST["chatId"]) ? sanitize_text_field($_POST["chatId"]) : ''; | |
| 171 | + // Same rule as the WooCommerce tab: the password is only forwarded to onWebChat, so it | |
| 172 | + // must be un-slashed and NOT sanitized, otherwise sanitize_text_field() silently strips | |
| 173 | + // characters (spaces, %xx sequences, "<") and the correct password is refused. | |
| 174 | + $userName = isset($_POST["onWebChatUser"]) ? sanitize_text_field(wp_unslash($_POST["onWebChatUser"])) : ''; | |
| 175 | + $userPass = isset($_POST["onWebChatPass"]) ? (string) wp_unslash($_POST["onWebChatPass"]) : ''; | |
| 176 | + $chatId = isset($_POST["chatId"]) ? sanitize_text_field(wp_unslash($_POST["chatId"])) : ''; | |
| 174 | 177 | |
| 175 | 178 | if (isChatIdValid($chatId)) { |
| 176 | 179 | // Direct Chat ID provided |
| 177 | 180 | $my_options = get_option('onwebchat_plugin_option'); |
