Changeset 2445228

Timestamp:

12/23/2020 07:41:03 PM (5 years ago)

Author:

jamesros161

Message:

Patch Release

Location:

weforms

Files:

• tags/1.6.4 (copied) (copied from weforms/trunk)
• tags/1.6.4/assets/components (deleted)
• tags/1.6.4/assets/images/icon-sprout-invoices.png (modified) (previous)
• tags/1.6.4/assets/images/integrations/secure-database.png (modified) (previous)
• tags/1.6.4/assets/images/weforms-logo.png (modified) (previous)
• tags/1.6.4/assets/images/wpspin_light.gif (modified) (previous)
• tags/1.6.4/assets/less (deleted)
• tags/1.6.4/assets/spa (deleted)
• tags/1.6.4/assets/wpuf/images/wpspin_light.gif (modified) (previous)
• tags/1.6.4/assets/wpuf/vendor/sweetalert2/README.md (deleted)
• tags/1.6.4/assets/wpuf/vendor/sweetalert2/package.json (deleted)
• tags/1.6.4/includes/functions.php (modified) (1 diff)
• tags/1.6.4/readme.txt (modified) (2 diffs)
• tags/1.6.4/weforms.php (modified) (2 diffs)
• trunk/assets/components (deleted)
• trunk/assets/images/icon-sprout-invoices.png (modified) (previous)
• trunk/assets/images/integrations/secure-database.png (modified) (previous)
• trunk/assets/images/weforms-logo.png (modified) (previous)
• trunk/assets/images/wpspin_light.gif (modified) (previous)
• trunk/assets/less (deleted)
• trunk/assets/spa (deleted)
• trunk/assets/wpuf/images/wpspin_light.gif (modified) (previous)
• trunk/assets/wpuf/vendor/sweetalert2/README.md (deleted)
• trunk/assets/wpuf/vendor/sweetalert2/package.json (deleted)
• trunk/includes/functions.php (modified) (1 diff)
• trunk/readme.txt (modified) (2 diffs)
• trunk/weforms.php (modified) (2 diffs)

weforms/tags/1.6.4/includes/functions.php

@@ -1205 +1205 @@
     if ( is_array( $value ) ) {
         $string_value = [];
-
-        if ( is_array( $value ) ) {
-            foreach ( $value as $key => $single_value ) {
-                if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
-                    $single_value = weforms_get_pain_text( $single_value );
-                }
-
-                $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
-
-                $string_value[] = $single_value;
+        foreach ( $value as $key => $single_value ) {
+            if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
+                $single_value = weforms_get_pain_text( $single_value );
             }
 
-            $value = implode( WeForms::$field_separator, $string_value );
+            $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
+
+            $string_value[] = $single_value;
         }
+
+        $value = implode( WeForms::$field_separator, $string_value );
     }
 
     $value = trim( strip_tags( $value ) );
+
+    // escape spreadsheet special characters to prevent formula exploits.
+    $value = preg_match( '/^[=+@-]/', $value ) ? '\'' . $value : $value;
 
     return $value;

weforms/tags/1.6.4/readme.txt

@@ -1 +1 @@
 === weForms - Easy Drag & Drop Contact Form Builder For WordPress ===
-Contributors: tareq1988, nizamuddinbabu, boldgrid, joemoto
+Contributors: tareq1988, nizamuddinbabu, boldgrid, joemoto, jamesros161
 Tags: forms, contact form, contact form plugin, custom form, form builder, form, form creator, form manager, form creation, contact forms, custom forms, forms builder, forms creator, forms manager, forms creation
 Requires at least: 4.4
 Requires PHP: 5.6.20
-Tested up to: 5.5
-Stable tag: 1.6.3
+Tested up to: 5.6
+Stable tag: 1.6.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -250 +250 @@
 == Changelog ==
 
+= Version 1.6.4 (23 December, 2020) =
+* **Fix:** Added spreadsheet functione escaping to prevent CSV exploits. [#50] (https://github.com/BoldGrid/weforms/pull/50)
+* **Update:** Update Node Packages
+
 = Version 1.6.3 (11 November, 2020) =
 * **Update:** Sprout Invoices Integration

weforms/tags/1.6.4/weforms.php

@@ -6 +6 @@
  * Author: weForms
  * Author URI: https://weformspro.com/
- * Version: 1.6.3
+ * Version: 1.6.4
  * License: GPL2 or later
  * License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -56 +56 @@
      * @var string
      */
-    public $version = '1.6.3';
+    public $version = '1.6.4';
 
     /**

weforms/trunk/includes/functions.php

@@ -1205 +1205 @@
     if ( is_array( $value ) ) {
         $string_value = [];
-
-        if ( is_array( $value ) ) {
-            foreach ( $value as $key => $single_value ) {
-                if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
-                    $single_value = weforms_get_pain_text( $single_value );
-                }
-
-                $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
-
-                $string_value[] = $single_value;
+        foreach ( $value as $key => $single_value ) {
+            if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
+                $single_value = weforms_get_pain_text( $single_value );
             }
 
-            $value = implode( WeForms::$field_separator, $string_value );
+            $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
+
+            $string_value[] = $single_value;
         }
+
+        $value = implode( WeForms::$field_separator, $string_value );
     }
 
     $value = trim( strip_tags( $value ) );
+
+    // escape spreadsheet special characters to prevent formula exploits.
+    $value = preg_match( '/^[=+@-]/', $value ) ? '\'' . $value : $value;
 
     return $value;

weforms/trunk/readme.txt

@@ -1 +1 @@
 === weForms - Easy Drag & Drop Contact Form Builder For WordPress ===
-Contributors: tareq1988, nizamuddinbabu, boldgrid, joemoto
+Contributors: tareq1988, nizamuddinbabu, boldgrid, joemoto, jamesros161
 Tags: forms, contact form, contact form plugin, custom form, form builder, form, form creator, form manager, form creation, contact forms, custom forms, forms builder, forms creator, forms manager, forms creation
 Requires at least: 4.4
 Requires PHP: 5.6.20
-Tested up to: 5.5
-Stable tag: 1.6.3
+Tested up to: 5.6
+Stable tag: 1.6.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -250 +250 @@
 == Changelog ==
 
+= Version 1.6.4 (23 December, 2020) =
+* **Fix:** Added spreadsheet functione escaping to prevent CSV exploits. [#50] (https://github.com/BoldGrid/weforms/pull/50)
+* **Update:** Update Node Packages
+
 = Version 1.6.3 (11 November, 2020) =
 * **Update:** Sprout Invoices Integration

weforms/trunk/weforms.php

@@ -6 +6 @@
  * Author: weForms
  * Author URI: https://weformspro.com/
- * Version: 1.6.3
+ * Version: 1.6.4
  * License: GPL2 or later
  * License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -56 +56 @@
      * @var string
      */
-    public $version = '1.6.3';
+    public $version = '1.6.4';
 
     /**