← All changes | includes/class-notification.php +34 -1 1.6.15 → 1.6.24 View file →

		@@ -120,8 +120,41 @@
120	120	// content type to text/html
121	121	$headers[] = 'Content-Type: text/html; charset=UTF-8';
122	122	$email_body = apply_filters( 'weforms_email_message', $this->get_formatted_body( $message ), $notification['message'], $headers );
123	123
	124	+ /**
	125	+ * Added the display style to the safe styles during wp_kses_post().
	126	+ * WP kses post removes the display css property that we need when formatting the Checkbox and Multiple Choice Grids.
	127	+ * This function will only run during the notification process.
	128	+ *
	129	+ * @since 1.6.17
	130	+ */
	131	+ add_filter( 'safe_style_css', function( $styles ) {
	132	+ $styles[] = 'display';
	133	+ return $styles;
	134	+ } );
	135	+
	136	+ /**
	137	+ * Added the input tag to the allowed html during wp_kses_post().
	138	+ * WP kses post removes the input tag that we need when formatting the Checkbox and Multiple Choice Grids.
	139	+ * The $message variable is formatted during the entry creation process. The values from the form are sanitized to avoid
	140	+ * any issues with malicious inputs.
	141	+ *
	142	+ * This function is only used during the notification process.
	143	+ *
	144	+ * @since 1.6.17
	145	+ */
	146	+ add_filter( 'wp_kses_allowed_html', function( $html ) {
	147	+ $html['input'] = array(
	148	+ 'class' => array(),
	149	+ 'name' => array(),
	150	+ 'type' => array(),
	151	+ 'value' => array(),
	152	+ 'checked' => array(),
	153	+ 'disabled' => array(),
	154	+ );
	155	+ return $html;
	156	+ } );
124	157	weforms()->emailer->send( $to, $subject, wp_kses_post( htmlspecialchars_decode( $email_body ) ) , $headers );
125	158	}
126	159
127	160	/**
		@@ -396,9 +429,9 @@
396	429	return get_permalink( $this->args['page_id'] );
397	430	break;
398	431
399	432	case 'url_referer':
400		- return isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '';
	433	+ return isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_url( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '';
401	434	break;
402	435
403	436	case 'url_login':
404	437	return wp_login_url();