| @@ -120,41 +120,8 @@ | ||
| 120 | 120 | // content type to text/html |
| 121 | 121 | $headers[] = 'Content-Type: text/html; charset=UTF-8'; |
| 122 | 122 | $email_body = apply_filters( 'weforms_email_message', $this->get_formatted_body( $message ), $notification['message'], $headers ); |
| 123 | 123 | |
| 124 | - /** | |
| 125 | - * Added the display style to the safe styles during wp_kses_post(). | |
| 126 | - * WP kses post removes the display css property that we need when formatting the Checkbox and Multiple Choice Grids. | |
| 127 | - * This function will only run during the notification process. | |
| 128 | - * | |
| 129 | - * @since 1.6.17 | |
| 130 | - */ | |
| 131 | - add_filter( 'safe_style_css', function( $styles ) { | |
| 132 | - $styles[] = 'display'; | |
| 133 | - return $styles; | |
| 134 | - } ); | |
| 135 | - | |
| 136 | - /** | |
| 137 | - * Added the input tag to the allowed html during wp_kses_post(). | |
| 138 | - * WP kses post removes the input tag that we need when formatting the Checkbox and Multiple Choice Grids. | |
| 139 | - * The $message variable is formatted during the entry creation process. The values from the form are sanitized to avoid | |
| 140 | - * any issues with malicious inputs. | |
| 141 | - * | |
| 142 | - * This function is only used during the notification process. | |
| 143 | - * | |
| 144 | - * @since 1.6.17 | |
| 145 | - */ | |
| 146 | - add_filter( 'wp_kses_allowed_html', function( $html ) { | |
| 147 | - $html['input'] = array( | |
| 148 | - 'class' => array(), | |
| 149 | - 'name' => array(), | |
| 150 | - 'type' => array(), | |
| 151 | - 'value' => array(), | |
| 152 | - 'checked' => array(), | |
| 153 | - 'disabled' => array(), | |
| 154 | - ); | |
| 155 | - return $html; | |
| 156 | - } ); | |
| 157 | 124 | weforms()->emailer->send( $to, $subject, wp_kses_post( htmlspecialchars_decode( $email_body ) ) , $headers ); |
| 158 | 125 | } |
| 159 | 126 | |
| 160 | 127 | /** |
| @@ -429,9 +396,9 @@ | ||
| 429 | 396 | return get_permalink( $this->args['page_id'] ); |
| 430 | 397 | break; |
| 431 | 398 | |
| 432 | 399 | case 'url_referer': |
| 433 | - return isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_url( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : ''; | |
| 400 | + return isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : ''; | |
| 434 | 401 | break; |
| 435 | 402 | |
| 436 | 403 | case 'url_login': |
| 437 | 404 | return wp_login_url(); |
| @@ -601,9 +568,8 @@ | ||
| 601 | 568 | * |
| 602 | 569 | * @return string |
| 603 | 570 | */ |
| 604 | 571 | public static function replace_file_tags( $text, $entry_id ) { |
| 605 | - $text = $text ?? ''; | |
| 606 | 572 | $pattern = '/{(?:image|file):(\w*)}/'; |
| 607 | 573 | |
| 608 | 574 | preg_match_all( $pattern, $text, $matches ); |
| 609 | 575 | |
| @@ -614,12 +580,19 @@ | ||
| 614 | 580 | |
| 615 | 581 | foreach ( $matches[1] as $index => $meta_key ) { |
| 616 | 582 | $meta_value = weforms_get_entry_meta( $entry_id, $meta_key, true ); |
| 617 | 583 | |
| 618 | - $files = []; | |
| 619 | - $attachments = is_array( $meta_value ) ? $meta_value : array( $meta_value ); | |
| 584 | + $files = []; | |
| 620 | 585 | |
| 621 | - foreach ( $attachments as $attachment_id ) { | |
| 586 | + if ( is_array( $meta_value ) ) { | |
| 587 | + foreach ( $meta_value as $key => $attachment_id ) { | |
| 588 | + $file_url = wp_get_attachment_url( $attachment_id ); | |
| 589 | + | |
| 590 | + if ( $file_url ) { | |
| 591 | + $files[] = $file_url; | |
| 592 | + } | |
| 593 | + } | |
| 594 | + } else { | |
| 622 | 595 | $file_url = wp_get_attachment_url( $attachment_id ); |
| 623 | 596 | |
| 624 | 597 | if ( $file_url ) { |
| 625 | 598 | $files[] = $file_url; |
