| @@ -109,16 +109,11 @@ | ||
| 109 | 109 | $grid_css = '<style>.wpufTable {display: table; width: 100%; } .wpufTableRow {display: table-row; } .wpufTableRow:nth-child(even) {background-color: #f5f5f5; } .wpufTableHeading {background-color: #eee; display: table-header-group; font-weight: bold; } .wpufTableCell, .wpufTableHead {border: none; display: table-cell; padding: 3px 10px; } .wpufTableFoot {background-color: #eee; display: table-footer-group; font-weight: bold; } .wpufTableBody {display: table-row-group; }</style>'; |
| 110 | 110 | |
| 111 | 111 | $values = []; |
| 112 | 112 | |
| 113 | - $query = $wpdb->prepare( | |
| 114 | - " | |
| 115 | - SELECT * FROM {$wpdb->weforms_entries} as entry | |
| 116 | - LEFT JOIN {$wpdb->weforms_entrymeta} AS meta ON entry.id = meta.weforms_entry_id | |
| 117 | - WHERE entry.id = %d | |
| 118 | - ", | |
| 119 | - $this->id | |
| 120 | - ); | |
| 113 | + $query = "SELECT * FROM {$wpdb->weforms_entries} as entry | |
| 114 | + LEFT JOIN {$wpdb->weforms_entrymeta} AS meta ON entry.id = meta.weforms_entry_id | |
| 115 | + WHERE entry.id = {$this->id}"; | |
| 121 | 116 | |
| 122 | 117 | $results = $wpdb->get_results( $query ); |
| 123 | 118 | |
| 124 | 119 | if ( $results ) { |
| @@ -169,12 +164,9 @@ | ||
| 169 | 164 | $value = $new_array; |
| 170 | 165 | } |
| 171 | 166 | } elseif ( in_array( $field['type'], [ 'image_upload', 'file_upload' ] ) ) { |
| 172 | 167 | $file_field = ''; |
| 173 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 174 | - $value = is_serialized( $value ) | |
| 175 | - ? @unserialize( $value, [ 'allowed_classes' => false ] ) | |
| 176 | - : $value; | |
| 168 | + $value = maybe_unserialize( $value ); | |
| 177 | 169 | |
| 178 | 170 | if ( is_array( $value ) && $value ) { |
| 179 | 171 | foreach ( $value as $attachment_id ) { |
| 180 | 172 | if ( $field['type'] == 'image_upload' ) { |
| @@ -198,12 +190,9 @@ | ||
| 198 | 190 | 'lat' => trim( $lat ), |
| 199 | 191 | 'long' => trim( $long ), |
| 200 | 192 | ]; |
| 201 | 193 | } elseif ( $field['type'] == 'multiple_product' ) { |
| 202 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 203 | - $field_value = is_serialized( $value ) | |
| 204 | - ? @unserialize( $value, [ 'allowed_classes' => false ] ) | |
| 205 | - : $value; | |
| 194 | + $field_value = unserialize( $value ); | |
| 206 | 195 | |
| 207 | 196 | $serialized_value = []; |
| 208 | 197 | |
| 209 | 198 | if ( is_array( $field_value ) ) { |
| @@ -223,12 +212,9 @@ | ||
| 223 | 212 | |
| 224 | 213 | $value = implode( '<br> <br> ', $serialized_value ); |
| 225 | 214 | } |
| 226 | 215 | } elseif ( $field['type'] == 'checkbox_grid' ) { |
| 227 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 228 | - $entry_value = is_serialized( $value ) | |
| 229 | - ? @unserialize( $value, [ 'allowed_classes' => false ] ) | |
| 230 | - : $value; | |
| 216 | + $entry_value = unserialize( $value ); | |
| 231 | 217 | |
| 232 | 218 | if ( $entry_value ) { |
| 233 | 219 | $return = ''; |
| 234 | 220 | $check = ''; |
| @@ -289,12 +275,9 @@ | ||
| 289 | 275 | |
| 290 | 276 | $value = $return; |
| 291 | 277 | } |
| 292 | 278 | } elseif ( $field['type'] == 'multiple_choice_grid' ) { |
| 293 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 294 | - $entry_value = is_serialized( $value ) | |
| 295 | - ? @unserialize( $value, [ 'allowed_classes' => false ] ) | |
| 296 | - : $value; | |
| 279 | + $entry_value = unserialize( $value ); | |
| 297 | 280 | |
| 298 | 281 | if ( $entry_value ) { |
| 299 | 282 | $return = ''; |
| 300 | 283 | $check = ''; |
| @@ -355,12 +338,9 @@ | ||
| 355 | 338 | |
| 356 | 339 | $value = $return; |
| 357 | 340 | } |
| 358 | 341 | } elseif ( $field['type'] == 'address_field' || is_serialized( $value ) ) { |
| 359 | - // Security fix: Prevent PHP Object Injection by restricting allowed classes | |
| 360 | - $field_value = is_serialized( $value ) | |
| 361 | - ? @unserialize( $value, [ 'allowed_classes' => false ] ) | |
| 362 | - : $value; | |
| 342 | + $field_value = unserialize( $value ); | |
| 363 | 343 | |
| 364 | 344 | $serialized_value = []; |
| 365 | 345 | |
| 366 | 346 | if ( is_array( $field_value ) ) { |
| @@ -466,9 +446,9 @@ | ||
| 466 | 446 | */ |
| 467 | 447 | public static function get_form_id( $entry_id ) { |
| 468 | 448 | global $wpdb; |
| 469 | 449 | |
| 470 | - $results = $wpdb->get_results( $wpdb->prepare( "SELECT form_id FROM {$wpdb->prefix}weforms_entries WHERE id = %d ", $entry_id ) ); | |
| 450 | + $results = $wpdb->get_results( "SELECT form_id FROM {$wpdb->prefix}weforms_entries WHERE id = {$entry_id} " ); | |
| 471 | 451 | |
| 472 | 452 | return ! empty( $results[0]->form_id ) ? $results[0]->form_id : null; |
| 473 | 453 | } |
| 474 | 454 | } |
