| @@ -14,8 +14,24 @@ | ||
| 14 | 14 | * @author PropertyHive |
| 15 | 15 | */ |
| 16 | 16 | class PH_Form_Handler { |
| 17 | 17 | |
| 18 | + /** Normalize only database-backed form markup, before trusted PHP filters. */ | |
| 19 | + public static function sanitize_saved_search_form_fields( $fields ) { | |
| 20 | + foreach ( $fields as $field_id => $field ) { | |
| 21 | + if ( ! is_array( $field ) ) { | |
| 22 | + unset( $fields[$field_id] ); | |
| 23 | + continue; | |
| 24 | + } | |
| 25 | + foreach ( array( 'label', 'before', 'after' ) as $key ) { | |
| 26 | + if ( isset( $field[$key] ) ) { | |
| 27 | + $fields[$field_id][$key] = is_string( $field[$key] ) ? wp_kses_post( $field[$key] ) : ''; | |
| 28 | + } | |
| 29 | + } | |
| 30 | + } | |
| 31 | + return $fields; | |
| 32 | + } | |
| 33 | + | |
| 18 | 34 | public function __construct() { |
| 19 | 35 | |
| 20 | 36 | add_action( 'init', array( $this, 'add_captcha_to_forms' ) ); |
| 21 | 37 | |
| @@ -34,11 +50,11 @@ | ||
| 34 | 50 | $new_fields = ( |
| 35 | 51 | ( |
| 36 | 52 | isset($current_settings['search_forms'][$form_id]['active_fields']) |
| 37 | 53 | && |
| 38 | - !empty($current_settings['search_forms'][$form_id]['active_fields']) | |
| 54 | + is_array($current_settings['search_forms'][$form_id]['active_fields']) && !empty($current_settings['search_forms'][$form_id]['active_fields']) | |
| 39 | 55 | ) ? |
| 40 | - $current_settings['search_forms'][$form_id]['active_fields'] : | |
| 56 | + self::sanitize_saved_search_form_fields( $current_settings['search_forms'][$form_id]['active_fields'] ) : | |
| 41 | 57 | $fields |
| 42 | 58 | ); |
| 43 | 59 | |
| 44 | 60 | // Remove any fields that are in the $fields array but not active in active_fields, excluding hidden fields |
