← All changes | includes/class-ph-form-handler.php +18 -2 2.2.6 → 2.3.0 View file →

		@@ -14,8 +14,24 @@
14	14	* @author PropertyHive
15	15	*/
16	16	class PH_Form_Handler {
17	17
	18	+ /** Normalize only database-backed form markup, before trusted PHP filters. */
	19	+ public static function sanitize_saved_search_form_fields( $fields ) {
	20	+ foreach ( $fields as $field_id => $field ) {
	21	+ if ( ! is_array( $field ) ) {
	22	+ unset( $fields[$field_id] );
	23	+ continue;
	24	+ }
	25	+ foreach ( array( 'label', 'before', 'after' ) as $key ) {
	26	+ if ( isset( $field[$key] ) ) {
	27	+ $fields[$field_id][$key] = is_string( $field[$key] ) ? wp_kses_post( $field[$key] ) : '';
	28	+ }
	29	+ }
	30	+ }
	31	+ return $fields;
	32	+ }
	33	+
18	34	public function __construct() {
19	35
20	36	add_action( 'init', array( $this, 'add_captcha_to_forms' ) );
21	37
		@@ -34,11 +50,11 @@
34	50	$new_fields = (
35	51	(
36	52	isset($current_settings['search_forms'][$form_id]['active_fields'])
37	53	&&
38		- !empty($current_settings['search_forms'][$form_id]['active_fields'])
	54	+ is_array($current_settings['search_forms'][$form_id]['active_fields']) && !empty($current_settings['search_forms'][$form_id]['active_fields'])
39	55	) ?
40		- $current_settings['search_forms'][$form_id]['active_fields'] :
	56	+ self::sanitize_saved_search_form_fields( $current_settings['search_forms'][$form_id]['active_fields'] ) :
41	57	$fields
42	58	);
43	59
44	60	// Remove any fields that are in the $fields array but not active in active_fields, excluding hidden fields