Changeset 2558890

Timestamp:

07/05/2021 03:22:59 PM (5 years ago)

Author:

madeit

Message:

V1.12.1

Location:

forms-by-made-it/trunk

Files:

• admin/FormListTable.php (modified) (1 diff)
• admin/WP_MADEIT_FORM_admin.php (modified) (1 diff)
• madeit-form.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)

forms-by-made-it/trunk/admin/FormListTable.php

@@ -131 +131 @@
         ];
 
-        return sprintf('<a href="?page=%s&action=%s&id=%s">%s</a> %s', $_REQUEST['page'], 'edit', $item->id, $item->title, $this->row_actions($actions));
+        return sprintf('<a href="?page=%s&action=%s&id=%s">%s</a> %s', $_REQUEST['page'], 'edit', $item->id, esc_textarea($item->title), $this->row_actions($actions));
     }
 

forms-by-made-it/trunk/admin/WP_MADEIT_FORM_admin.php

@@ -113 +113 @@
             <?php
         }
-        if (isset($_GET['action']) && $_GET['action'] == 'delete') {
-            $this->db->queryWrite('DELETE FROM '.$this->db->prefix().'madeit_forms SET `id` = %s', $_GET['id']); ?>
+        if ((isset($_GET['action']) && $_GET['action'] == 'delete') || (isset($_POST['madeit-forms-delete']) && isset($_GET['action']) && $_GET['action'] == 'edit')) {
+            $this->db->queryWrite('DELETE FROM '.$this->db->prefix().'madeit_forms WHERE `id` = %s', $_GET['id']); ?>
             <div class="updated"><p><strong><?php echo __('The form is deleted.', 'forms-by-made-it'); ?></strong></p></div>
             <?php
+            $_GET['action'] = 'delete';
         }
         if (isset($_GET['action']) && $_GET['action'] == 'edit') {

forms-by-made-it/trunk/madeit-form.php

@@ -6 +6 @@
  * Author: Made I.T.
  * Author URI: https://www.madeit.be
- * Version: 1.12.0
+ * Version: 1.12.1
  * Text Domain: forms-by-made-it
  * Domain Path: /languages

forms-by-made-it/trunk/readme.txt

@@ -6 +6 @@
 Tested up to: 5.7
 Requires PHP: 7.2
-Stable tag: 1.12.0
+Stable tag: 1.12.1
 License: GNU GPL v3.0
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
@@ -48 +48 @@
 
 == Changelog ==
+= 1.12.1 =
+* Fix XSS bug in Title field
+* Fix delete form bug
+
 = 1.12.0 =
 * Email-service.be integration