| @@ -579,8 +579,16 @@ | ||
| 579 | 579 | |
| 580 | 580 | $file_contents = isset( $_FILES['file']['tmp_name'] ) ? $wp_filesystem->get_contents( wp_unslash( $_FILES['file']['tmp_name'] ) ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized |
| 581 | 581 | $import_options = json_decode( $file_contents, true ); |
| 582 | 582 | |
| 583 | + if ( ! is_array( $import_options ) ) { | |
| 584 | + wp_send_json_error( array( 'message' => __( 'Invalid import file format!', 'responsive-menu' ) ) ); | |
| 585 | + } | |
| 586 | + | |
| 587 | + // Sanitize all imported options — treat imported JSON as untrusted input. | |
| 588 | + // Use the same sanitization as the normal save path (rm_sanitize_rec_array with HTML allowed). | |
| 589 | + $import_options = rm_sanitize_rec_array( $import_options, true ); | |
| 590 | + | |
| 583 | 591 | $option_manager = Option_Manager::get_instance(); |
| 584 | 592 | $exist_option = $option_manager->get_options( $menu_id ); |
| 585 | 593 | |
| 586 | 594 | // Some required options replced in imported settings with existing menu settings. |
