← All changes | includes/class-notification.php +20 -66 1.6.25 → 1.6.10 View file →

		@@ -120,41 +120,8 @@
120	120	// content type to text/html
121	121	$headers[] = 'Content-Type: text/html; charset=UTF-8';
122	122	$email_body = apply_filters( 'weforms_email_message', $this->get_formatted_body( $message ), $notification['message'], $headers );
123	123
124		- /**
125		- * Added the display style to the safe styles during wp_kses_post().
126		- * WP kses post removes the display css property that we need when formatting the Checkbox and Multiple Choice Grids.
127		- * This function will only run during the notification process.
128		- *
129		- * @since 1.6.17
130		- */
131		- add_filter( 'safe_style_css', function( $styles ) {
132		- $styles[] = 'display';
133		- return $styles;
134		- } );
135		-
136		- /**
137		- * Added the input tag to the allowed html during wp_kses_post().
138		- * WP kses post removes the input tag that we need when formatting the Checkbox and Multiple Choice Grids.
139		- * The $message variable is formatted during the entry creation process. The values from the form are sanitized to avoid
140		- * any issues with malicious inputs.
141		- *
142		- * This function is only used during the notification process.
143		- *
144		- * @since 1.6.17
145		- */
146		- add_filter( 'wp_kses_allowed_html', function( $html ) {
147		- $html['input'] = array(
148		- 'class' => array(),
149		- 'name' => array(),
150		- 'type' => array(),
151		- 'value' => array(),
152		- 'checked' => array(),
153		- 'disabled' => array(),
154		- );
155		- return $html;
156		- } );
157	124	weforms()->emailer->send( $to, $subject, wp_kses_post( htmlspecialchars_decode( $email_body ) ) , $headers );
158	125	}
159	126
160	127	/**
		@@ -429,9 +396,9 @@
429	396	return get_permalink( $this->args['page_id'] );
430	397	break;
431	398
432	399	case 'url_referer':
433		- return isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_url( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '';
	400	+ return isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '';
434	401	break;
435	402
436	403	case 'url_login':
437	404	return wp_login_url();
		@@ -507,53 +474,40 @@
507	474	* Users need the ability to pass {field:department} and get "Support",
508	475	* and {value:department} to get support@email.com
509	476	*
510	477	* @param string $text The text to parse.
511		- * @param int $entry_id The entry ID. Optional. Default null if tags to be replaced are on the frontend.
	478	+ * @param int $entry_id The entry ID.
512	479	*
513	480	* @return string $text The parsed text.
514	481	*/
515		- public static function replace_field_tags( $text, $entry_id = null ) {
	482	+ public static function replace_field_tags( $text, $entry_id ) {
516	483	// Validate data.
517		- if ( empty( $text ) || !isset( $entry_id ) ) {
	484	+ if ( empty( $text ) || empty( $entry_id ) ) {
518	485	return;
519	486	}
520	487
521	488	// Users looking for {field:something} or {value:something}, determine which one.
522		- $is_field = preg_match_all( '/{field:(\w*)}/', $text, $matches_field );
523		- $is_value = preg_match_all( '/{value:(\w*)}/', $text, $matches_value );
	489	+ $is_field = preg_match( '/{field:(\w*)}/', $text, $matches_field );
	490	+ $is_value = preg_match( '/{value:(\w*)}/', $text, $matches_value );
524	491
525	492	if ( $is_field ) {
526		- $meta_keys = $matches_field[1];
527		- // Create an array of meta values to replace.
528		- $meta_values = array();
529		- foreach ( $meta_keys as $meta_key ) {
530		- $meta_value = weforms_get_entry_meta( $entry_id, $meta_key, true );
531		- // Add values to the array.
532		- array_push( $meta_values, $meta_value );
533		- if ( is_array( $meta_value ) ) {
534		- $meta_value = implode( WeForms::$field_separator, $meta_value );
535		- }
	493	+ $meta_key = $matches_field[1];
	494	+ $meta_value = weforms_get_entry_meta( $entry_id, $meta_key, true );
	495	+ if ( is_array( $meta_value ) ) {
	496	+ $meta_value = implode( WeForms::$field_separator, $meta_value );
536	497	}
537		- // $text may include HTML tags, only replace tag that was matched. Replace all matches.
538		- $text = str_replace( $matches_field[0], $meta_values, $text );
539		- }
540		- if ( $is_value ) {
541		- $meta_keys = $matches_value[1];
542		- // Create an array of modified values to replace.
543		- $modified_values = array();
544		- foreach ( $meta_keys as $meta_key ) {
545		- $form_field_values = WeForms_Form_Entry::get_form( $entry_id )->get_field_values()[ $meta_key ]['options'];
546		- $meta_value = weforms_get_entry_meta( $entry_id, $meta_key, true );
547		- $modified_value = array_search( $meta_value, $form_field_values );
548		- // Add values to the array.
549		- array_push( $modified_values, $modified_value );
550		- if ( is_array( $modified_value ) ) {
551		- $modified_value = implode( WeForms::$field_separator, $modified_value );
552		- }
	498	+ // $text may include HTML tags, only replace tag that was matched.
	499	+ $text = str_replace( $matches_field[0], $meta_value, $text );
	500	+ } elseif ( $is_value ) {
	501	+ $meta_key = $matches_value[1];
	502	+ $form_field_values = WeForms_Form_Entry::get_form( $entry_id )->get_field_values()[ $meta_key ]['options'];
	503	+ $meta_value = weforms_get_entry_meta( $entry_id, $meta_key, true );
	504	+ $modified_value = array_search( $meta_value, $form_field_values );
	505	+ if ( is_array( $modified_value ) ) {
	506	+ $modified_value = implode( WeForms::$field_separator, $modified_value );
553	507	}
554	508	// $text may include HTML tags, only replace tag that was matched.
555		- $text = str_replace( $matches_value[0], $modified_values, $text );
	509	+ $text = str_replace( $matches_value[0], $modified_value, $text );
556	510	}
557	511	return $text;
558	512	}
559	513