← All changes | includes/functions.php +81 -30 1.6.7 → 1.6.28 View file →

		@@ -85,17 +85,26 @@
85	85	];
86	86
87	87	$r = wp_parse_args( $args, $defaults );
88	88
89		- $query = 'SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
90		- FROM ' . $wpdb->weforms_entries .
91		- ' WHERE form_id = ' . $form_id . ' AND status = \'' . $r['status'] . '\'' .
92		- ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'];
	89	+ $query = $wpdb->prepare(
	90	+ "
	91	+ SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
	92	+ FROM $wpdb->weforms_entries
	93	+ WHERE form_id = %d AND status = %s
	94	+ ORDER BY %s %s
	95	+ LIMIT %d, %d
	96	+ ",
	97	+ array(
	98	+ $form_id,
	99	+ $r['status'],
	100	+ $r['orderby'],
	101	+ $r['order'],
	102	+ $r['offset'],
	103	+ $r['number'],
	104	+ )
	105	+ );
93	106
94		- if ( !empty( $r['offset'] ) && !empty( $r['number'] ) ) {
95		- $query .= ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
96		- }
97		-
98	107	$results = $wpdb->get_results( $query );
99	108
100	109	return $results;
101	110	}
		@@ -110,10 +119,8 @@
110	119	function weforms_count_entries( $args = [] ) {
111	120	global $wpdb;
112	121
113	122	$defaults = [
114		- 'number' => -1,
115		- 'offset' => 0,
116	123	'orderby' => 'created_at',
117	124	'status' => 'publish',
118	125	'order' => 'DESC',
119	126	];
		@@ -119,17 +126,22 @@
119	126	];
120	127
121	128	$r = wp_parse_args( $args, $defaults );
122	129
123		- $query = 'SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
124		- FROM ' . $wpdb->weforms_entries .
125		- ' WHERE status = \'' . $r['status'] . '\'' .
126		- ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'];
	130	+ $query = $wpdb->prepare(
	131	+ "
	132	+ SELECT id, form_id, user_id, INET_NTOA( user_ip ) as ip_address, created_at
	133	+ FROM $wpdb->weforms_entries
	134	+ WHERE status = %s
	135	+ ORDER BY %s %s
	136	+ ",
	137	+ array(
	138	+ $r['status'],
	139	+ $r['orderby'],
	140	+ $r['order'],
	141	+ )
	142	+ );
127	143
128		- if ( !empty( $r['offset'] ) && !empty( $r['number'] ) ) {
129		- $query .= ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
130		- }
131		-
132	144	$results = $wpdb->get_results( $query );
133	145
134	146	return count( $results );
135	147	}
		@@ -153,12 +165,24 @@
153	165	];
154	166
155	167	$r = wp_parse_args( $args, $defaults );
156	168
157		- $query = 'SELECT * FROM ' . $wpdb->prefix . 'weforms_payments' .
158		- ' WHERE form_id = ' . $form_id .
159		- ' ORDER BY ' . $r['orderby'] . ' ' . $r['order'] .
160		- ' LIMIT ' . $r['offset'] . ', ' . $r['number'];
	169	+ $query = $wpdb->prepare(
	170	+ "
	171	+ SELECT *
	172	+ FROM wp_weforms_payments
	173	+ WHERE form_id = %d
	174	+ ORDER BY %s %s
	175	+ LIMIT %d, %d
	176	+ ",
	177	+ array(
	178	+ $form_id,
	179	+ $r['orderby'],
	180	+ $r['order'],
	181	+ $r['offset'],
	182	+ $r['number'],
	183	+ )
	184	+ );
161	185
162	186	$results = $wpdb->get_results( $query );
163	187
164	188	return $results;
		@@ -164,8 +188,33 @@
164	188	return $results;
165	189	}
166	190
167	191	/**
	192	+ * Get payments by a entry_id
	193	+ *
	194	+ * @param int $entry_id
	195	+ *
	196	+ * @return object
	197	+ */
	198	+function weforms_get_entry_payment( $entry_id ) {
	199	+ global $wpdb;
	200	+
	201	+ $query = $wpdb->prepare(
	202	+ "
	203	+ SELECT transaction_id
	204	+ FROM $wpdb->prefix 'weforms_payments'
	205	+ WHERE entry_id = %d
	206	+ ",
	207	+ array(
	208	+ $entry_id
	209	+ )
	210	+ );
	211	+ $payment = $wpdb->get_row( $query );
	212	+
	213	+ return $payment;
	214	+}
	215	+
	216	+/**
168	217	* Get an entry by id
169	218	*
170	219	* @param int $entry_id
171	220	*
		@@ -206,9 +255,9 @@
206	255	'form_id' => 0,
207	256	'user_id' => get_current_user_id(),
208	257	'user_ip' => ip2long( weforms_get_client_ip() ),
209	258	'user_device' => $browser['name'] . '/' . $browser['platform'],
210		- 'referer' => isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '',
	259	+ 'referer' => isset( $_SERVER['HTTP_REFERER'] ) ? sanitize_url( wp_unslash( $_SERVER['HTTP_REFERER'] ) ) : '',
211	260	'created_at' => current_time( 'mysql' )
212	261	];
213	262
214	263	$r = wp_parse_args( $args, $defaults );
		@@ -571,9 +620,9 @@
571	620	continue;
572	621	}
573	622
574	623	$data[ $field['name'] ] = [
575		- 'label' => $field['label'],
	624	+ 'label' => $field['label'] ?? '',
576	625	'type' => $field['template'],
577	626	];
578	627	}
579	628
		@@ -665,8 +714,9 @@
665	714	$u_agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) ) : '';
666	715	$bname = 'Unknown';
667	716	$platform = 'Unknown';
668	717	$version = '';
	718	+ $ub = '';
669	719
670	720	// first get the platform
671	721	if ( preg_match( '/linux/i', $u_agent ) ) {
672	722	$platform = 'Linux';
		@@ -1082,9 +1132,9 @@
1082	1132	'message' => __( 'Thanks for contacting us! We will get in touch with you shortly.', 'weforms' ),
1083	1133	'page_id' => '',
1084	1134	'url' => '',
1085	1135
1086		- 'submit_text' => __( 'Submit Query', 'weforms' ),
	1136	+ 'submit_text' => __( 'Submit', 'weforms' ),
1087	1137	'submit_button_cond' => [
1088	1138	'condition_status' => 'no',
1089	1139	'cond_logic' => 'any',
1090	1140	'conditions' => [
		@@ -1198,16 +1248,17 @@
1198	1248	*
1199	1249	* @return string
1200	1250	**/
1201	1251	function weforms_get_pain_text( $value ) {
1202		- if ( is_serialized( $value ) ) {
1203		- $value = unserialize( $value );
1204		- }
	1252	+ // Security fix: Removed unsafe unserialize() call to prevent PHP Object Injection.
	1253	+ // WordPress's get_metadata() already handles deserialization safely.
	1254	+ // Any serialized strings at this point should be treated as untrusted user input.
1205	1255
1206	1256	if ( is_array( $value ) ) {
1207	1257	$string_value = [];
1208	1258	foreach ( $value as $key => $single_value ) {
1209		- if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
	1259	+ // Only recursively process arrays, not serialized strings
	1260	+ if ( is_array( $single_value ) ) {
1210	1261	$single_value = weforms_get_pain_text( $single_value );
1211	1262	}
1212	1263
1213	1264	$single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
		@@ -1302,7 +1353,7 @@
1302	1353	function weforms_clean( $var ) {
1303	1354	if ( is_array( $var ) ) {
1304	1355	return array_map( 'weforms_clean', $var );
1305	1356	} else {
1306		- return is_scalar( $var ) ? sanitize_text_field( wp_unslash( $var ) ) : $var;
	1357	+ return is_scalar( $var ) ? sanitize_textarea_field( wp_unslash( $var ) ) : $var;
1307	1358	}
1308	1359	}