Changeset 2624111

Timestamp:

11/03/2021 03:34:57 PM (4 years ago)

Author:

mmuro

Message:

Prepend a space to values to prevent CSV injection attacks

File:

• visual-form-builder/trunk/admin/class-export.php (modified) (1 diff)

visual-form-builder/trunk/admin/class-export.php

@@ -301 +301 @@
             foreach ( $fields_clean as $label ) {
                 $label = wp_specialchars_decode( $label );
-                $rows[ $label ] =  ( isset( $row[ $label ] ) && in_array( $label, $fields_clean ) ) ? esc_html( $row[ $label ] ) : '';
+                // Prepend a space to prevent CSV injection attacks
+                $value = ' ' . wp_specialchars_decode( $row[ $label ] );
+
+                $rows[ $label ] =  ( isset( $row[ $label ] ) && in_array( $label, $fields_clean ) ) ? $value : '';
             }