| @@ -123,9 +123,9 @@ | ||
| 123 | 123 | $tfoot = "\t<tfoot>\n{$tfoot}\t</tfoot>\n"; |
| 124 | 124 | } |
| 125 | 125 | $tbody = "\t<tbody>\n" . implode( '', $tbody ) . "\t</tbody>\n"; |
| 126 | 126 | |
| 127 | - $output = "<table>\n" . $thead . $tbody . $tfoot . "</table>\n"; | |
| 127 | + $output = "<table>\n" . $thead . $tfoot . $tbody . "</table>\n"; | |
| 128 | 128 | break; |
| 129 | 129 | case 'json': |
| 130 | 130 | $output = wp_json_encode( $table, TABLEPRESS_JSON_OPTIONS ); |
| 131 | 131 | if ( false === $output ) { |
| @@ -156,29 +156,23 @@ | ||
| 156 | 156 | |
| 157 | 157 | // Escape potentially dangerous functions that could be used for CSV injection attacks in external spreadsheet software. |
| 158 | 158 | $active_content_triggers = array( '=', '+', '-', '@' ); |
| 159 | 159 | if ( in_array( $cell_content[0], $active_content_triggers, true ) ) { |
| 160 | - // phpcs:disable Generic.Strings.UnnecessaryStringConcat.Found -- Avoid concatenation of function names to prevent false positives in code scanners. | |
| 161 | 160 | $functions_to_escape = array( |
| 162 | 161 | 'cmd|', |
| 163 | - 'FOR' . 'FILES|', | |
| 164 | - 'rund' . 'll32', | |
| 165 | - 'DD' . 'E(', | |
| 166 | - 'IMPORT' . 'XML(', | |
| 167 | - 'IMPORT' . 'FEED(', | |
| 168 | - 'IMPORT' . 'HTML(', | |
| 169 | - 'IMPORT' . 'RANGE(', | |
| 170 | - 'IMPORT' . 'DATA(', | |
| 162 | + 'rundll32', | |
| 163 | + 'DDE(', | |
| 164 | + 'IMPORTXML(', | |
| 165 | + 'IMPORTFEED(', | |
| 166 | + 'IMPORTHTML(', | |
| 167 | + 'IMPORTRANGE(', | |
| 168 | + 'IMPORTDATA(', | |
| 171 | 169 | 'IMAGE(', |
| 172 | 170 | 'HYPERLINK(', |
| 173 | 171 | 'WEBSERVICE(', |
| 174 | 172 | ); |
| 175 | - // phpcs:enable | |
| 176 | - | |
| 177 | - $fn_stripos = function_exists( 'mb_stripos' ) ? 'mb_stripos' : 'stripos'; | |
| 178 | - | |
| 179 | 173 | foreach ( $functions_to_escape as $function ) { |
| 180 | - if ( false !== $fn_stripos( $cell_content, $function ) ) { | |
| 174 | + if ( false !== stripos( $cell_content, $function ) ) { | |
| 181 | 175 | $cell_content = "'" . $cell_content; // Prepend a ' to indicate that the cell format is a text string. |
| 182 | 176 | break; |
| 183 | 177 | } |
| 184 | 178 | } |
