← All changes | includes/class-form-entry.php +10 -63 1.6.27 → 1.6.1 View file →

		@@ -109,16 +109,11 @@
109	109	$grid_css = '<style>.wpufTable {display: table; width: 100%; } .wpufTableRow {display: table-row; } .wpufTableRow:nth-child(even) {background-color: #f5f5f5; } .wpufTableHeading {background-color: #eee; display: table-header-group; font-weight: bold; } .wpufTableCell, .wpufTableHead {border: none; display: table-cell; padding: 3px 10px; } .wpufTableFoot {background-color: #eee; display: table-footer-group; font-weight: bold; } .wpufTableBody {display: table-row-group; }</style>';
110	110
111	111	$values = [];
112	112
113		- $query = $wpdb->prepare(
114		- "
115		- SELECT * FROM {$wpdb->weforms_entries} as entry
116		- LEFT JOIN {$wpdb->weforms_entrymeta} AS meta ON entry.id = meta.weforms_entry_id
117		- WHERE entry.id = %d
118		- ",
119		- $this->id
120		- );
	113	+ $query = "SELECT * FROM {$wpdb->weforms_entries} as entry
	114	+ LEFT JOIN {$wpdb->weforms_entrymeta} AS meta ON entry.id = meta.weforms_entry_id
	115	+ WHERE entry.id = {$this->id}";
121	116
122	117	$results = $wpdb->get_results( $query );
123	118
124	119	if ( $results ) {
		@@ -169,12 +164,9 @@
169	164	$value = $new_array;
170	165	}
171	166	} elseif ( in_array( $field['type'], [ 'image_upload', 'file_upload' ] ) ) {
172	167	$file_field = '';
173		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
174		- $value = is_serialized( $value )
175		- ? @unserialize( $value, [ 'allowed_classes' => false ] )
176		- : $value;
	168	+ $value = maybe_unserialize( $value );
177	169
178	170	if ( is_array( $value ) && $value ) {
179	171	foreach ( $value as $attachment_id ) {
180	172	if ( $field['type'] == 'image_upload' ) {
		@@ -198,12 +190,9 @@
198	190	'lat' => trim( $lat ),
199	191	'long' => trim( $long ),
200	192	];
201	193	} elseif ( $field['type'] == 'multiple_product' ) {
202		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
203		- $field_value = is_serialized( $value )
204		- ? @unserialize( $value, [ 'allowed_classes' => false ] )
205		- : $value;
	194	+ $field_value = unserialize( $value );
206	195
207	196	$serialized_value = [];
208	197
209	198	if ( is_array( $field_value ) ) {
		@@ -223,12 +212,9 @@
223	212
224	213	$value = implode( '<br> <br> ', $serialized_value );
225	214	}
226	215	} elseif ( $field['type'] == 'checkbox_grid' ) {
227		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
228		- $entry_value = is_serialized( $value )
229		- ? @unserialize( $value, [ 'allowed_classes' => false ] )
230		- : $value;
	216	+ $entry_value = unserialize( $value );
231	217
232	218	if ( $entry_value ) {
233	219	$return = '';
234	220	$check = '';
		@@ -289,12 +275,9 @@
289	275
290	276	$value = $return;
291	277	}
292	278	} elseif ( $field['type'] == 'multiple_choice_grid' ) {
293		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
294		- $entry_value = is_serialized( $value )
295		- ? @unserialize( $value, [ 'allowed_classes' => false ] )
296		- : $value;
	279	+ $entry_value = unserialize( $value );
297	280
298	281	if ( $entry_value ) {
299	282	$return = '';
300	283	$check = '';
		@@ -355,12 +338,9 @@
355	338
356	339	$value = $return;
357	340	}
358	341	} elseif ( $field['type'] == 'address_field' || is_serialized( $value ) ) {
359		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
360		- $field_value = is_serialized( $value )
361		- ? @unserialize( $value, [ 'allowed_classes' => false ] )
362		- : $value;
	342	+ $field_value = unserialize( $value );
363	343
364	344	$serialized_value = [];
365	345
366	346	if ( is_array( $field_value ) ) {
		@@ -372,18 +352,15 @@
372	352
373	353	$value = implode( '<br> ', $serialized_value );
374	354	}
375	355	} elseif ( $field['type'] == 'signature_field' ) {
376		- $url = $value;
	356	+ $url = content_url() . $value;
	357	+ $value = $url;
377	358
378	359	if ( isset( $_REQUEST['action'] ) != 'weforms_pdf_download' ) {
379		- $url = content_url() . '/' . $value;
380	360	$value = sprintf( '<img src="%s">', $url );
381	361	$value .= sprintf( '<a style="margin-left: -200px" href="%s">Download</a>', $url );
382	362	}
383		- else{
384		- $value = sprintf( '<img src="%s">', $url );
385		- }
386	363	}
387	364
388	365	$this->fields[ $result->meta_key ]['value'] = apply_filters( 'weforms_entry_meta_field', $value, $field );
389	366	}
		@@ -439,36 +416,6 @@
439	416	return;
440	417	}
441	418
442	419	return $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}weforms_payments WHERE entry_id = {$this->id} " );
443		- }
444		-
445		- /**
446		- * Get Form from entry id.
447		- *
448		- * @param int $entry_id The entry id.
449		- * @global object $wpdb The Wordpress database object.
450		- *
451		- * @return object The form object.
452		- */
453		- public static function get_form( $entry_id ) {
454		- $form_id = self::get_form_id( $entry_id );
455		-
456		- return ! empty( $form_id ) ? weforms()->form->get( $form_id ) : null;
457		- }
458		-
459		- /**
460		- * Get form id from entry id.
461		- *
462		- * @param int $entry_id The entry id.
463		- * @global object $wpdb The Wordpress database object.
464		- *
465		- * @return int The form id.
466		- */
467		- public static function get_form_id( $entry_id ) {
468		- global $wpdb;
469		-
470		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT form_id FROM {$wpdb->prefix}weforms_entries WHERE id = %d ", $entry_id ) );
471		-
472		- return ! empty( $results[0]->form_id ) ? $results[0]->form_id : null;
473	420	}
474	421	}