← All changes | classes/class-evaluate-phpspreadsheet.php +10 -7 2.2 → 3.0 View file →

		@@ -26,9 +26,9 @@
26	26	*
27	27	* @since 2.0.0
28	28	*/
29	29	public function __construct() {
30		- // Load PHPSpreadsheet via the Composer autoloading mechanism.
	30	+ // Load PHPSpreadsheet via its autoloading mechanism.
31	31	TablePress::load_file( 'autoload.php', 'libraries' );
32	32	}
33	33
34	34	/**
		@@ -51,13 +51,13 @@
51	51	}
52	52
53	53	$table_has_formulas = true;
54	54
55		- // Convert legacy "formulas in text" notation to standard Excel notation (`=Text {A3+B3} Text` => `="Text "&A3+B3&" Text"`).
56		- $count = 0;
57		- $cell_content = (string) preg_replace( '#{(.+?)}#', '"&$1&"', $cell_content, -1, $count );
58		- if ( $count > 0 ) {
59		- $cell_content = '="' . substr( $cell_content, 1 ) . '"';
	55	+ // Convert legacy "formulas in text" notation (`=Text {A3+B3} Text`) to standard Excel notation (`="Text "&A3+B3&" Text"`).
	56	+ if ( 1 === preg_match( '#{(.+?)}#', $cell_content ) ) {
	57	+ $cell_content = str_replace( '"', '""', $cell_content ); // Preserve existing quotation marks in text around formulas.
	58	+ $cell_content = '="' . substr( $cell_content, 1 ) . '"'; // Wrap the whole cell content in quotation marks, as there will be text around formulas.
	59	+ $cell_content = (string) preg_replace( '#{(.+?)}#', '"&$1&"', $cell_content, -1, $count ); // Convert all wrapped formulas to standard Excel notation.
60	60	}
61	61	}
62	62	}
63	63	unset( $row, $cell_content ); // Unset use-by-reference parameters of foreach loops.
		@@ -72,9 +72,9 @@
72	72	$worksheet = $spreadsheet->setActiveSheetIndex( 0 );
73	73	$worksheet->fromArray( /* $source */ $table_data, /* $nullValue */ '' );
74	74
75	75	// Don't allow cyclic references.
76		- TablePress\PhpOffice\PhpSpreadsheet\Calculation\Calculation::getInstance( $spreadsheet )->cyclicFormulaCount = 0;
	76	+ \TablePress\PhpOffice\PhpSpreadsheet\Calculation\Calculation::getInstance( $spreadsheet )->cyclicFormulaCount = 0;
77	77
78	78	/*
79	79	* Register variables as Named Formulas.
80	80	* The variables `ROW`, `COLUMN`, `CELL`, `PI`, and `E` should be considered deprecated and only their formulas should be used.
		@@ -110,8 +110,11 @@
110	110	$url = esc_url( $url );
111	111	$cell_content = "<a href=\"{$url}\">{$cell_content}</a>";
112	112	}
113	113	}
	114	+
	115	+ // Sanitize the output of the evaluated formula.
	116	+ $cell_content = wp_kses_post( $cell_content ); // Equals wp_filter_post_kses(), but without the unnecessary slashes handling.
114	117	} catch ( \TablePress\PhpOffice\PhpSpreadsheet\Calculation\Exception $exception ) {
115	118	$message = str_replace( 'Worksheet!', '', $exception->getMessage() );
116	119	$cell_content = "!ERROR! {$message}";
117	120	}