← All changes | includes/class-form-entry.php +24 -92 1.6.28 → 1.6.1 View file →

		@@ -107,34 +107,13 @@
107	107
108	108	$grid_css_added = false;
109	109	$grid_css = '<style>.wpufTable {display: table; width: 100%; } .wpufTableRow {display: table-row; } .wpufTableRow:nth-child(even) {background-color: #f5f5f5; } .wpufTableHeading {background-color: #eee; display: table-header-group; font-weight: bold; } .wpufTableCell, .wpufTableHead {border: none; display: table-cell; padding: 3px 10px; } .wpufTableFoot {background-color: #eee; display: table-footer-group; font-weight: bold; } .wpufTableBody {display: table-row-group; }</style>';
110	110
111		- // Custom allowlist for grid field HTML: wp_kses_post() strips <style> and <input>,
112		- // but all dynamic values are already escaped (esc_html/esc_attr) at construction time.
113		- $grid_kses_allowed = array(
114		- 'style' => array(),
115		- 'div' => array( 'class' => true ),
116		- 'label' => array( 'class' => true ),
117		- 'input' => array(
118		- 'name' => true,
119		- 'class' => true,
120		- 'type' => true,
121		- 'value' => true,
122		- 'checked' => true,
123		- 'disabled' => true,
124		- ),
125		- );
126		-
127	111	$values = [];
128	112
129		- $query = $wpdb->prepare(
130		- "
131		- SELECT * FROM {$wpdb->weforms_entries} as entry
132		- LEFT JOIN {$wpdb->weforms_entrymeta} AS meta ON entry.id = meta.weforms_entry_id
133		- WHERE entry.id = %d
134		- ",
135		- $this->id
136		- );
	113	+ $query = "SELECT * FROM {$wpdb->weforms_entries} as entry
	114	+ LEFT JOIN {$wpdb->weforms_entrymeta} AS meta ON entry.id = meta.weforms_entry_id
	115	+ WHERE entry.id = {$this->id}";
137	116
138	117	$results = $wpdb->get_results( $query );
139	118
140	119	if ( $results ) {
		@@ -157,9 +136,9 @@
157	136
158	137	$this->raw_fields[ $result->meta_key ]['value'] = $value;
159	138
160	139	if ( $field['type'] == 'textarea_field' ) {
161		- $value = wp_kses_post( weforms_format_text( $value ) );
	140	+ $value = weforms_format_text( $value );
162	141	} elseif ( $field['type'] == 'name_field' ) {
163	142	$value = implode( ' ', explode( WeForms::$field_separator, $value ) );
164	143	} elseif ( in_array( $field['type'], [ 'dropdown_field', 'radio_field' ] ) ) {
165	144	if ( isset( $field['options'] ) && $field['options'] ) {
		@@ -185,12 +164,9 @@
185	164	$value = $new_array;
186	165	}
187	166	} elseif ( in_array( $field['type'], [ 'image_upload', 'file_upload' ] ) ) {
188	167	$file_field = '';
189		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
190		- $value = is_serialized( $value )
191		- ? @unserialize( $value, [ 'allowed_classes' => false ] )
192		- : $value;
	168	+ $value = maybe_unserialize( $value );
193	169
194	170	if ( is_array( $value ) && $value ) {
195	171	foreach ( $value as $attachment_id ) {
196	172	if ( $field['type'] == 'image_upload' ) {
		@@ -195,18 +171,18 @@
195	171	foreach ( $value as $attachment_id ) {
196	172	if ( $field['type'] == 'image_upload' ) {
197	173	$thumb = wp_get_attachment_image( $attachment_id, 'thumbnail' );
198	174	} else {
199		- $thumb = esc_html( get_post_field( 'post_title', $attachment_id ) );
	175	+ $thumb = get_post_field( 'post_title', $attachment_id );
200	176	}
201	177
202		- $full_size = esc_url( wp_get_attachment_url( $attachment_id ) );
	178	+ $full_size = wp_get_attachment_url( $attachment_id );
203	179
204		- $file_field .= sprintf( '<a href="%s" target="_blank" rel="noopener noreferrer">%s</a> ', $full_size, $thumb );
	180	+ $file_field .= sprintf( '<a href="%s" target="_blank">%s</a> ', $full_size, $thumb );
205	181	}
206	182	}
207	183
208		- $value = wp_kses_post( $file_field );
	184	+ $value = $file_field;
209	185	} elseif ( $field['type'] == 'google_map' ) {
210	186	list( $address, $lat, $long ) = explode( '||', $value );
211	187
212	188	$value = [
		@@ -214,12 +190,9 @@
214	190	'lat' => trim( $lat ),
215	191	'long' => trim( $long ),
216	192	];
217	193	} elseif ( $field['type'] == 'multiple_product' ) {
218		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
219		- $field_value = is_serialized( $value )
220		- ? @unserialize( $value, [ 'allowed_classes' => false ] )
221		- : $value;
	194	+ $field_value = unserialize( $value );
222	195
223	196	$serialized_value = [];
224	197
225	198	if ( is_array( $field_value ) ) {
		@@ -236,15 +209,12 @@
236	209	$serialized_value[] = implode( '<br> ', $v );
237	210	}
238	211	}
239	212
240		- $value = wp_kses_post( implode( '<br> <br> ', $serialized_value ) );
	213	+ $value = implode( '<br> <br> ', $serialized_value );
241	214	}
242	215	} elseif ( $field['type'] == 'checkbox_grid' ) {
243		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
244		- $entry_value = is_serialized( $value )
245		- ? @unserialize( $value, [ 'allowed_classes' => false ] )
246		- : $value;
	216	+ $entry_value = unserialize( $value );
247	217
248	218	if ( $entry_value ) {
249	219	$return = '';
250	220	$check = '';
		@@ -266,9 +236,9 @@
266	236	<div class="wpufTableRow">
267	237	<div class="wpufTableHead">&nbsp;</div>';
268	238
269	239	foreach ( $field['grid_columns'] as $column ) {
270		- $return .= '<div class="wpufTableHead">' . esc_html( $column ) . '</div>';
	240	+ $return .= '<div class="wpufTableHead">' . $column . '</div>';
271	241	}
272	242
273	243	$return .= '</div>
274	244	</div>
		@@ -275,9 +245,9 @@
275	245	<div class="wpufTableBody">';
276	246
277	247	foreach ( $field['grid_rows'] as $row_key => $row_value ) {
278	248	$return .= '<div class="wpufTableRow">
279		- <div class="wpufTableHead">' . esc_html( $row_value ) . '</div>';
	249	+ <div class="wpufTableHead">' . $row_value . '</div>';
280	250
281	251	foreach ( $field['grid_columns'] as $column_key => $column_value ) {
282	252	if ( isset( $new_val[ $row_key ] ) ) {
283	253	$check = ( in_array( $column_value, $new_val[ $row_key ] ) ) ? 'checked ' : '';
		@@ -302,15 +272,12 @@
302	272	$return .= '</div>
303	273	</div>';
304	274	}
305	275
306		- $value = wp_kses( $return, $grid_kses_allowed );
	276	+ $value = $return;
307	277	}
308	278	} elseif ( $field['type'] == 'multiple_choice_grid' ) {
309		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
310		- $entry_value = is_serialized( $value )
311		- ? @unserialize( $value, [ 'allowed_classes' => false ] )
312		- : $value;
	279	+ $entry_value = unserialize( $value );
313	280
314	281	if ( $entry_value ) {
315	282	$return = '';
316	283	$check = '';
		@@ -332,9 +299,9 @@
332	299	<div class="wpufTableRow">
333	300	<div class="wpufTableHead">&nbsp;</div>';
334	301
335	302	foreach ( $field['grid_columns'] as $column ) {
336		- $return .= '<div class="wpufTableHead">' . esc_html( $column ) . '</div>';
	303	+ $return .= '<div class="wpufTableHead">' . $column . '</div>';
337	304	}
338	305
339	306	$return .= '</div>
340	307	</div>
		@@ -341,9 +308,9 @@
341	308	<div class="wpufTableBody">';
342	309
343	310	foreach ( $field['grid_rows'] as $row_key => $row_value ) {
344	311	$return .= '<div class="wpufTableRow">
345		- <div class="wpufTableHead">' . esc_html( $row_value ) . '</div>';
	312	+ <div class="wpufTableHead">' . $row_value . '</div>';
346	313
347	314	foreach ( $field['grid_columns'] as $column_key => $column_value ) {
348	315	if ( isset( $new_val[ $row_key ] ) ) {
349	316	$check = ( $new_val[ $row_key ] == $column_value ) ? 'checked ' : '';
		@@ -368,15 +335,12 @@
368	335	$return .= '</div>
369	336	</div>';
370	337	}
371	338
372		- $value = wp_kses( $return, $grid_kses_allowed );
	339	+ $value = $return;
373	340	}
374	341	} elseif ( $field['type'] == 'address_field' || is_serialized( $value ) ) {
375		- // Security fix: Prevent PHP Object Injection by restricting allowed classes
376		- $field_value = is_serialized( $value )
377		- ? @unserialize( $value, [ 'allowed_classes' => false ] )
378		- : $value;
	342	+ $field_value = unserialize( $value );
379	343
380	344	$serialized_value = [];
381	345
382	346	if ( is_array( $field_value ) ) {
		@@ -388,17 +352,15 @@
388	352
389	353	$value = implode( '<br> ', $serialized_value );
390	354	}
391	355	} elseif ( $field['type'] == 'signature_field' ) {
392		- if ( ! isset( $_REQUEST['action'] ) || $_REQUEST['action'] !== 'weforms_pdf_download' ) {
393		- $url = esc_url( content_url() . '/' . $value );
	356	+ $url = content_url() . $value;
	357	+ $value = $url;
	358	+
	359	+ if ( isset( $_REQUEST['action'] ) != 'weforms_pdf_download' ) {
394	360	$value = sprintf( '<img src="%s">', $url );
395	361	$value .= sprintf( '<a style="margin-left: -200px" href="%s">Download</a>', $url );
396		- } else {
397		- $url = esc_url( $value );
398		- $value = sprintf( '<img src="%s">', $url );
399	362	}
400		- $value = wp_kses_post( $value );
401	363	}
402	364
403	365	$this->fields[ $result->meta_key ]['value'] = apply_filters( 'weforms_entry_meta_field', $value, $field );
404	366	}
		@@ -454,36 +416,6 @@
454	416	return;
455	417	}
456	418
457	419	return $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}weforms_payments WHERE entry_id = {$this->id} " );
458		- }
459		-
460		- /**
461		- * Get Form from entry id.
462		- *
463		- * @param int $entry_id The entry id.
464		- * @global object $wpdb The Wordpress database object.
465		- *
466		- * @return object The form object.
467		- */
468		- public static function get_form( $entry_id ) {
469		- $form_id = self::get_form_id( $entry_id );
470		-
471		- return ! empty( $form_id ) ? weforms()->form->get( $form_id ) : null;
472		- }
473		-
474		- /**
475		- * Get form id from entry id.
476		- *
477		- * @param int $entry_id The entry id.
478		- * @global object $wpdb The Wordpress database object.
479		- *
480		- * @return int The form id.
481		- */
482		- public static function get_form_id( $entry_id ) {
483		- global $wpdb;
484		-
485		- $results = $wpdb->get_results( $wpdb->prepare( "SELECT form_id FROM {$wpdb->prefix}weforms_entries WHERE id = %d ", $entry_id ) );
486		-
487		- return ! empty( $results[0]->form_id ) ? $results[0]->form_id : null;
488	420	}
489	421	}