← All changes | includes/functions.php +39 -90 1.6.27 → 1.6.1 View file →

		@@ -85,26 +85,17 @@
85	85	];
86	86
87	87	$r = wp_parse_args( $args, $defaults );
88	88
89		- $query = $wpdb->prepare(
90		- "
91		- SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
92		- FROM $wpdb->weforms_entries
93		- WHERE form_id = %d AND status = %s
94		- ORDER BY %s %s
95		- LIMIT %d, %d
96		- ",
97		- array(
98		- $form_id,
99		- $r['status'],
100		- $r['orderby'],
101		- $r['order'],
102		- $r['offset'],
103		- $r['number'],
104		- )
105		- );
	89	+ $query = 'SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
	90	+ FROM ' . $wpdb->weforms_entries .
	91	+ ' WHERE form_id = ' . $form_id . ' AND status = \'' . $r['status'] . '\'' .
	92	+ ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'];
106	93
	94	+ if ( !empty( $r['offset'] ) && !empty( $r['number'] ) ) {
	95	+ $query .= ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
	96	+ }
	97	+
107	98	$results = $wpdb->get_results( $query );
108	99
109	100	return $results;
110	101	}
		@@ -119,8 +110,10 @@
119	110	function weforms_count_entries( $args = [] ) {
120	111	global $wpdb;
121	112
122	113	$defaults = [
	114	+ 'number' => -1,
	115	+ 'offset' => 0,
123	116	'orderby' => 'created_at',
124	117	'status' => 'publish',
125	118	'order' => 'DESC',
126	119	];
		@@ -126,22 +119,17 @@
126	119	];
127	120
128	121	$r = wp_parse_args( $args, $defaults );
129	122
130		- $query = $wpdb->prepare(
131		- "
132		- SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
133		- FROM $wpdb->weforms_entries
134		- WHERE status = %s
135		- ORDER BY %s %s
136		- ",
137		- array(
138		- $r['status'],
139		- $r['orderby'],
140		- $r['order'],
141		- )
142		- );
	123	+ $query = 'SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
	124	+ FROM ' . $wpdb->weforms_entries .
	125	+ ' WHERE status = \'' . $r['status'] . '\'' .
	126	+ ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'];
143	127
	128	+ if ( !empty( $r['offset'] ) && !empty( $r['number'] ) ) {
	129	+ $query .= ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
	130	+ }
	131	+
144	132	$results = $wpdb->get_results( $query );
145	133
146	134	return count( $results );
147	135	}
		@@ -165,24 +153,12 @@
165	153	];
166	154
167	155	$r = wp_parse_args( $args, $defaults );
168	156
169		- $query = $wpdb->prepare(
170		- "
171		- SELECT *
172		- FROM wp_weforms_payments
173		- WHERE form_id = %d
174		- ORDER BY %s %s
175		- LIMIT %d, %d
176		- ",
177		- array(
178		- $form_id,
179		- $r['orderby'],
180		- $r['order'],
181		- $r['offset'],
182		- $r['number'],
183		- )
184		- );
	157	+ $query = 'SELECT * FROM ' . $wpdb->prefix . 'weforms_payments' .
	158	+ ' WHERE form_id = ' . $form_id .
	159	+ ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'] .
	160	+ ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
185	161
186	162	$results = $wpdb->get_results( $query );
187	163
188	164	return $results;
		@@ -188,33 +164,8 @@
188	164	return $results;
189	165	}
190	166
191	167	/**
192		- * Get payments by a entry_id
193		- *
194		- * @param int $entry_id
195		- *
196		- * @return object
197		- */
198		-function weforms_get_entry_payment( $entry_id ) {
199		- global $wpdb;
200		-
201		- $query = $wpdb->prepare(
202		- "
203		- SELECT transaction_id
204		- FROM $wpdb->prefix 'weforms_payments'
205		- WHERE entry_id = %d
206		- ",
207		- array(
208		- $entry_id
209		- )
210		- );
211		- $payment = $wpdb->get_row( $query );
212		-
213		- return $payment;
214		-}
215		-
216		-/**
217	168	* Get an entry by id
218	169	*
219	170	* @param int $entry_id
220	171	*
		@@ -255,9 +206,9 @@
255	206	'form_id' => 0,
256	207	'user_id' => get_current_user_id(),
257	208	'user_ip' => ip2long( weforms_get_client_ip() ),
258	209	'user_device' => $browser['name'] . '/' . $browser['platform'],
259		- 'referer' => isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_url( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '',
	210	+ 'referer' => isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '',
260	211	'created_at' => current_time( 'mysql' )
261	212	];
262	213
263	214	$r = wp_parse_args( $args, $defaults );
		@@ -1131,9 +1082,9 @@
1131	1082	'message' => __( 'Thanks for contacting us! We will get in touch with you shortly.', 'weforms' ),
1132	1083	'page_id' => '',
1133	1084	'url' => '',
1134	1085
1135		- 'submit_text' => __( 'Submit', 'weforms' ),
	1086	+ 'submit_text' => __( 'Submit Query', 'weforms' ),
1136	1087	'submit_button_cond' => [
1137	1088	'condition_status' => 'no',
1138	1089	'cond_logic' => 'any',
1139	1090	'conditions' => [
		@@ -1163,9 +1114,8 @@
1163	1114	'respondent_can_see' => [ 'missed_questions', 'correct_answers', 'point_values' ],
1164	1115	'total_points' => 0,
1165	1116	'enable_multistep' => false,
1166	1117	'multistep_progressbar_type' => 'progressive',
1167		- 'humanpresence_enabled' => false,
1168	1118
1169	1119	// payment
1170	1120	'payment_paypal_images' => 'https://www.paypalobjects.com/webstatic/mktg/logo/AM_mc_vs_dc_ae.jpg',
1171	1121
		@@ -1247,33 +1197,32 @@
1247	1197	*
1248	1198	* @return string
1249	1199	**/
1250	1200	function weforms_get_pain_text( $value ) {
1251		- // Security fix: Removed unsafe unserialize() call to prevent PHP Object Injection.
1252		- // WordPress's get_metadata() already handles deserialization safely.
1253		- // Any serialized strings at this point should be treated as untrusted user input.
	1201	+ if ( is_serialized( $value ) ) {
	1202	+ $value = unserialize( $value );
	1203	+ }
1254	1204
1255	1205	if ( is_array( $value ) ) {
1256	1206	$string_value = [];
1257		- foreach ( $value as $key => $single_value ) {
1258		- // Only recursively process arrays, not serialized strings
1259		- if ( is_array( $single_value ) ) {
1260		- $single_value = weforms_get_pain_text( $single_value );
	1207	+
	1208	+ if ( is_array( $value ) ) {
	1209	+ foreach ( $value as $key => $single_value ) {
	1210	+ if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
	1211	+ $single_value = weforms_get_pain_text( $single_value );
	1212	+ }
	1213	+
	1214	+ $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
	1215	+
	1216	+ $string_value[] = $single_value;
1261	1217	}
1262	1218
1263		- $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
1264		-
1265		- $string_value[] = $single_value;
	1219	+ $value = implode( WeForms::$field_separator, $string_value );
1266	1220	}
1267		-
1268		- $value = implode( WeForms::$field_separator, $string_value );
1269	1221	}
1270	1222
1271	1223	$value = trim( strip_tags( $value ) );
1272	1224
1273		- // escape spreadsheet special characters to prevent formula exploits.
1274		- $value = preg_match( '/^[=+@-]/', $value ) ? '\'' . $value : $value;
1275		-
1276	1225	return $value;
1277	1226	}
1278	1227
1279	1228	/**
		@@ -1352,7 +1301,7 @@
1352	1301	function weforms_clean( $var ) {
1353	1302	if ( is_array( $var ) ) {
1354	1303	return array_map( 'weforms_clean', $var );
1355	1304	} else {
1356		- return is_scalar( $var ) ? sanitize_textarea_field( wp_unslash( $var ) ) : $var;
	1305	+ return is_scalar( $var ) ? sanitize_text_field( wp_unslash( $var ) ) : $var;
1357	1306	}
1358	1307	}