← All changes | includes/functions.php +40 -92 1.6.28 → 1.6.1 View file →

		@@ -85,26 +85,17 @@
85	85	];
86	86
87	87	$r = wp_parse_args( $args, $defaults );
88	88
89		- $query = $wpdb->prepare(
90		- "
91		- SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
92		- FROM $wpdb->weforms_entries
93		- WHERE form_id = %d AND status = %s
94		- ORDER BY %s %s
95		- LIMIT %d, %d
96		- ",
97		- array(
98		- $form_id,
99		- $r['status'],
100		- $r['orderby'],
101		- $r['order'],
102		- $r['offset'],
103		- $r['number'],
104		- )
105		- );
	89	+ $query = 'SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
	90	+ FROM ' . $wpdb->weforms_entries .
	91	+ ' WHERE form_id = ' . $form_id . ' AND status = \'' . $r['status'] . '\'' .
	92	+ ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'];
106	93
	94	+ if ( !empty( $r['offset'] ) && !empty( $r['number'] ) ) {
	95	+ $query .= ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
	96	+ }
	97	+
107	98	$results = $wpdb->get_results( $query );
108	99
109	100	return $results;
110	101	}
		@@ -119,8 +110,10 @@
119	110	function weforms_count_entries( $args = [] ) {
120	111	global $wpdb;
121	112
122	113	$defaults = [
	114	+ 'number' => -1,
	115	+ 'offset' => 0,
123	116	'orderby' => 'created_at',
124	117	'status' => 'publish',
125	118	'order' => 'DESC',
126	119	];
		@@ -126,22 +119,17 @@
126	119	];
127	120
128	121	$r = wp_parse_args( $args, $defaults );
129	122
130		- $query = $wpdb->prepare(
131		- "
132		- SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
133		- FROM $wpdb->weforms_entries
134		- WHERE status = %s
135		- ORDER BY %s %s
136		- ",
137		- array(
138		- $r['status'],
139		- $r['orderby'],
140		- $r['order'],
141		- )
142		- );
	123	+ $query = 'SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
	124	+ FROM ' . $wpdb->weforms_entries .
	125	+ ' WHERE status = \'' . $r['status'] . '\'' .
	126	+ ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'];
143	127
	128	+ if ( !empty( $r['offset'] ) && !empty( $r['number'] ) ) {
	129	+ $query .= ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
	130	+ }
	131	+
144	132	$results = $wpdb->get_results( $query );
145	133
146	134	return count( $results );
147	135	}
		@@ -165,24 +153,12 @@
165	153	];
166	154
167	155	$r = wp_parse_args( $args, $defaults );
168	156
169		- $query = $wpdb->prepare(
170		- "
171		- SELECT *
172		- FROM wp_weforms_payments
173		- WHERE form_id = %d
174		- ORDER BY %s %s
175		- LIMIT %d, %d
176		- ",
177		- array(
178		- $form_id,
179		- $r['orderby'],
180		- $r['order'],
181		- $r['offset'],
182		- $r['number'],
183		- )
184		- );
	157	+ $query = 'SELECT * FROM ' . $wpdb->prefix . 'weforms_payments' .
	158	+ ' WHERE form_id = ' . $form_id .
	159	+ ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'] .
	160	+ ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
185	161
186	162	$results = $wpdb->get_results( $query );
187	163
188	164	return $results;
		@@ -188,33 +164,8 @@
188	164	return $results;
189	165	}
190	166
191	167	/**
192		- * Get payments by a entry_id
193		- *
194		- * @param int $entry_id
195		- *
196		- * @return object
197		- */
198		-function weforms_get_entry_payment( $entry_id ) {
199		- global $wpdb;
200		-
201		- $query = $wpdb->prepare(
202		- "
203		- SELECT transaction_id
204		- FROM $wpdb->prefix 'weforms_payments'
205		- WHERE entry_id = %d
206		- ",
207		- array(
208		- $entry_id
209		- )
210		- );
211		- $payment = $wpdb->get_row( $query );
212		-
213		- return $payment;
214		-}
215		-
216		-/**
217	168	* Get an entry by id
218	169	*
219	170	* @param int $entry_id
220	171	*
		@@ -255,9 +206,9 @@
255	206	'form_id' => 0,
256	207	'user_id' => get_current_user_id(),
257	208	'user_ip' => ip2long( weforms_get_client_ip() ),
258	209	'user_device' => $browser['name'] . '/' . $browser['platform'],
259		- 'referer' => isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_url( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '',
	210	+ 'referer' => isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '',
260	211	'created_at' => current_time( 'mysql' )
261	212	];
262	213
263	214	$r = wp_parse_args( $args, $defaults );
		@@ -620,9 +571,9 @@
620	571	continue;
621	572	}
622	573
623	574	$data[ $field['name'] ] = [
624		- 'label' => $field['label'] ?? '',
	575	+ 'label' => $field['label'],
625	576	'type' => $field['template'],
626	577	];
627	578	}
628	579
		@@ -714,9 +665,8 @@
714	665	$u_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';
715	666	$bname = 'Unknown';
716	667	$platform = 'Unknown';
717	668	$version = '';
718		- $ub = '';
719	669
720	670	// first get the platform
721	671	if ( preg_match( '/linux/i', $u_agent ) ) {
722	672	$platform = 'Linux';
		@@ -1132,9 +1082,9 @@
1132	1082	'message' => __( 'Thanks for contacting us! We will get in touch with you shortly.', 'weforms' ),
1133	1083	'page_id' => '',
1134	1084	'url' => '',
1135	1085
1136		- 'submit_text' => __( 'Submit', 'weforms' ),
	1086	+ 'submit_text' => __( 'Submit Query', 'weforms' ),
1137	1087	'submit_button_cond' => [
1138	1088	'condition_status' => 'no',
1139	1089	'cond_logic' => 'any',
1140	1090	'conditions' => [
		@@ -1164,9 +1114,8 @@
1164	1114	'respondent_can_see' => [ 'missed_questions', 'correct_answers', 'point_values' ],
1165	1115	'total_points' => 0,
1166	1116	'enable_multistep' => false,
1167	1117	'multistep_progressbar_type' => 'progressive',
1168		- 'humanpresence_enabled' => false,
1169	1118
1170	1119	// payment
1171	1120	'payment_paypal_images' => 'https://www.paypalobjects.com/webstatic/mktg/logo/AM_mc_vs_dc_ae.jpg',
1172	1121
		@@ -1248,33 +1197,32 @@
1248	1197	*
1249	1198	* @return string
1250	1199	**/
1251	1200	function weforms_get_pain_text( $value ) {
1252		- // Security fix: Removed unsafe unserialize() call to prevent PHP Object Injection.
1253		- // WordPress's get_metadata() already handles deserialization safely.
1254		- // Any serialized strings at this point should be treated as untrusted user input.
	1201	+ if ( is_serialized( $value ) ) {
	1202	+ $value = unserialize( $value );
	1203	+ }
1255	1204
1256	1205	if ( is_array( $value ) ) {
1257	1206	$string_value = [];
1258		- foreach ( $value as $key => $single_value ) {
1259		- // Only recursively process arrays, not serialized strings
1260		- if ( is_array( $single_value ) ) {
1261		- $single_value = weforms_get_pain_text( $single_value );
	1207	+
	1208	+ if ( is_array( $value ) ) {
	1209	+ foreach ( $value as $key => $single_value ) {
	1210	+ if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
	1211	+ $single_value = weforms_get_pain_text( $single_value );
	1212	+ }
	1213	+
	1214	+ $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
	1215	+
	1216	+ $string_value[] = $single_value;
1262	1217	}
1263	1218
1264		- $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
1265		-
1266		- $string_value[] = $single_value;
	1219	+ $value = implode( WeForms::$field_separator, $string_value );
1267	1220	}
1268		-
1269		- $value = implode( WeForms::$field_separator, $string_value );
1270	1221	}
1271	1222
1272	1223	$value = trim( strip_tags( $value ) );
1273	1224
1274		- // escape spreadsheet special characters to prevent formula exploits.
1275		- $value = preg_match( '/^[=+@-]/', $value ) ? '\'' . $value : $value;
1276		-
1277	1225	return $value;
1278	1226	}
1279	1227
1280	1228	/**
		@@ -1353,7 +1301,7 @@
1353	1301	function weforms_clean( $var ) {
1354	1302	if ( is_array( $var ) ) {
1355	1303	return array_map( 'weforms_clean', $var );
1356	1304	} else {
1357		- return is_scalar( $var ) ? sanitize_textarea_field( wp_unslash( $var ) ) : $var;
	1305	+ return is_scalar( $var ) ? sanitize_text_field( wp_unslash( $var ) ) : $var;
1358	1306	}
1359	1307	}