| @@ -1203,25 +1203,25 @@ | ||
| 1203 | 1203 | } |
| 1204 | 1204 | |
| 1205 | 1205 | if ( is_array( $value ) ) { |
| 1206 | 1206 | $string_value = []; |
| 1207 | + foreach ( $value as $key => $single_value ) { | |
| 1208 | + if ( is_array( $single_value ) || is_serialized( $single_value ) ) { | |
| 1209 | + $single_value = weforms_get_pain_text( $single_value ); | |
| 1210 | + } | |
| 1207 | 1211 | |
| 1208 | - if ( is_array( $value ) ) { | |
| 1209 | - foreach ( $value as $key => $single_value ) { | |
| 1210 | - if ( is_array( $single_value ) || is_serialized( $single_value ) ) { | |
| 1211 | - $single_value = weforms_get_pain_text( $single_value ); | |
| 1212 | - } | |
| 1212 | + $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value ); | |
| 1213 | 1213 | |
| 1214 | - $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value ); | |
| 1214 | + $string_value[] = $single_value; | |
| 1215 | + } | |
| 1215 | 1216 | |
| 1216 | - $string_value[] = $single_value; | |
| 1217 | - } | |
| 1218 | - | |
| 1219 | - $value = implode( WeForms::$field_separator, $string_value ); | |
| 1220 | - } | |
| 1217 | + $value = implode( WeForms::$field_separator, $string_value ); | |
| 1221 | 1218 | } |
| 1222 | 1219 | |
| 1223 | 1220 | $value = trim( strip_tags( $value ) ); |
| 1221 | + | |
| 1222 | + // escape spreadsheet special characters to prevent formula exploits. | |
| 1223 | + $value = preg_match( '/^[=+@-]/', $value ) ? '\'' . $value : $value; | |
| 1224 | 1224 | |
| 1225 | 1225 | return $value; |
| 1226 | 1226 | } |
| 1227 | 1227 | |
