| @@ -12,9 +12,9 @@ | ||
| 12 | 12 | |
| 13 | 13 | /** |
| 14 | 14 | * Helper class for the conditional rules. |
| 15 | 15 | * |
| 16 | - * @since 1.4.0 | |
| 16 | + * @since 1.14 (J) - 1.4.0 (WP) | |
| 17 | 17 | */ |
| 18 | 18 | class VikBookingHelperConditionalRules |
| 19 | 19 | { |
| 20 | 20 | /** |
| @@ -283,11 +283,10 @@ | ||
| 283 | 283 | $special_tags = array(); |
| 284 | 284 | |
| 285 | 285 | $q = "SELECT `ct`.* FROM `#__vikbooking_condtexts` AS `ct` ORDER BY `ct`.`{$orby_col}` {$orby_dir};"; |
| 286 | 286 | $this->dbo->setQuery($q); |
| 287 | - $this->dbo->execute(); | |
| 288 | - if ($this->dbo->getNumRows()) { | |
| 289 | - $records = $this->dbo->loadAssocList(); | |
| 287 | + $records = $this->dbo->loadAssocList(); | |
| 288 | + if ($records) { | |
| 290 | 289 | $this->vbo_tn->translateContents($records, '#__vikbooking_condtexts'); |
| 291 | 290 | foreach ($records as $record) { |
| 292 | 291 | // decode rules |
| 293 | 292 | $record['rules'] = !empty($record['rules']) ? json_decode($record['rules']) : array(); |
| @@ -308,15 +307,12 @@ | ||
| 308 | 307 | * @return array the record of the conditional text found or an empty array. |
| 309 | 308 | */ |
| 310 | 309 | public function getBySpecialTag($token) |
| 311 | 310 | { |
| 312 | - $cond_text = array(); | |
| 313 | - | |
| 314 | 311 | $q = "SELECT * FROM `#__vikbooking_condtexts` WHERE `token`=" . $this->dbo->quote($token) . ";"; |
| 315 | 312 | $this->dbo->setQuery($q); |
| 316 | - $this->dbo->execute(); | |
| 317 | - if ($this->dbo->getNumRows()) { | |
| 318 | - $cond_text = $this->dbo->loadAssoc(); | |
| 313 | + $cond_text = (array) $this->dbo->loadAssoc(); | |
| 314 | + if ($cond_text) { | |
| 319 | 315 | $this->vbo_tn->translateContents($cond_text, '#__vikbooking_condtexts'); |
| 320 | 316 | } |
| 321 | 317 | |
| 322 | 318 | return $cond_text; |
| @@ -468,9 +464,9 @@ | ||
| 468 | 464 | * unknown to VBO, and so we can detect from the content whether plain text messages are |
| 469 | 465 | * necessary, maybe for sending an SMS message. We allow the use of special strings to |
| 470 | 466 | * detect if no HTML should ever be included in the message, like [sms] or [plain text]. |
| 471 | 467 | * |
| 472 | - * @since 1.4.3 | |
| 468 | + * @since 1.14.2 (J) - 1.4.3 (WP) | |
| 473 | 469 | */ |
| 474 | 470 | $requires_plain_text = false; |
| 475 | 471 | if (preg_match_all("/(\[sms\]|\[plain_? ?text\])+/i", $cond_texts[$token]['msg'], $plt_matches)) { |
| 476 | 472 | $requires_plain_text = true; |
| @@ -489,14 +485,15 @@ | ||
| 489 | 485 | |
| 490 | 486 | /** |
| 491 | 487 | * Make sure any src/href attribute does not contain relative URLs. |
| 492 | 488 | * |
| 493 | - * @since 1.5.0 | |
| 489 | + * @since 1.15 (J) - 1.5.0 (WP) | |
| 490 | + * @since 1.18.8 (J) - 1.8.8 (WP) ignore attributes containing a special tag. | |
| 494 | 491 | */ |
| 495 | 492 | $cond_texts[$token]['msg'] = preg_replace_callback("/\s*(src|href)=([\"'])(.*?)[\"']/i", function($match) { |
| 496 | 493 | // check if the URL starts with the base domain |
| 497 | - if (stripos($match[3], JUri::root()) !== 0 && !preg_match("/^(https?:\/\/|www\.)/i", $match[3])) { | |
| 498 | - // prepend base domain to URL | |
| 494 | + if (stripos($match[3], JUri::root()) !== 0 && !preg_match("/^(https?:\/\/|www\.|{)/i", $match[3])) { | |
| 495 | + // safely prepend base domain to URL | |
| 499 | 496 | $match[0] = ' ' . $match[1] . '=' . $match[2] . JUri::root() . $match[3] . $match[2]; |
| 500 | 497 | } |
| 501 | 498 | return $match[0]; |
| 502 | 499 | }, $cond_texts[$token]['msg']); |
| @@ -771,8 +768,11 @@ | ||
| 771 | 768 | // |
| 772 | 769 | |
| 773 | 770 | // immediately restore the PHP tags that could have been converted to HTML entities |
| 774 | 771 | $php_code = str_replace(array('<?php', '?>'), array('<?php', '?>'), $php_code); |
| 772 | + | |
| 773 | + // take care of "unsafe" HTML detected for PHP opening and closing tags that may now be HTML comments | |
| 774 | + $php_code = str_replace(array('<!--?php', '?-->'), array('<?php', '?>'), $php_code); | |
| 775 | 775 | |
| 776 | 776 | // remove doctype |
| 777 | 777 | $php_code = preg_replace("/(^<!DOCTYPE.*\R)/i", '', $php_code); |
| 778 | 778 | |
