Changeset 2624218

Timestamp:

11/03/2021 08:34:33 PM (4 years ago)

Author:

mmuro

Message:

Properly escape and sanitize various outdated code

Location:

visual-form-builder/trunk

Files:

• admin/class-ajax.php (modified) (2 diffs)
• admin/class-entries-detail.php (modified) (5 diffs)
• admin/class-entries-list.php (modified) (2 diffs)
• admin/class-export.php (modified) (1 diff)
• public/class-security.php (modified) (2 diffs)

visual-form-builder/trunk/admin/class-ajax.php

@@ -150 +150 @@
 
         if ( isset( $_POST['action'] ) && $_POST['action'] == 'visual_form_builder_delete_field' ) {
-            $form_id = absint( $_POST['form'] );
+            $form_id  = absint( $_POST['form'] );
             $field_id = absint( $_POST['field'] );
 
@@ -179 +179 @@
 
         if ( isset( $_POST['action'] ) && $_POST['action'] == 'visual_form_builder_form_settings' ) {
-            $form_id    = absint( $_POST['form'] );
-            $status     = isset( $_POST['status'] ) ? $_POST['status'] : 'opened';
-            $accordion  = isset( $_POST['accordion'] ) ? $_POST['accordion'] : 'general-settings';
-            $user_id    = $current_user instanceof WP_User ? $current_user->ID : 1;
+            $form_id     = absint( $_POST['form'] );
+            $status      = isset( $_POST['status'] ) ? sanitize_text_field( $_POST['status'] ) : 'opened';
+            $accordion = isset( $_POST['accordion'] ) ? sanitize_text_field( $_POST['accordion'] ) : 'general-settings';
+            $user_id   = $current_user instanceof WP_User ? $current_user->ID : 1;
 
             $form_settings = get_user_meta( $user_id, 'vfb-form-settings', true );

visual-form-builder/trunk/admin/class-entries-detail.php

@@ -92 +92 @@
                     }
 
-                    echo '<h4>' . ucwords( $k ) . '</h4>';
-                    echo $v;
+                    printf( '<h4>%s</h4>', esc_html( ucwords( $k ) ) );
+                    echo esc_html( $v );
                     $count++;
                 else :
@@ -104 +104 @@
                             echo '</table>';
 
-                        echo '<h3>' . stripslashes( $obj->name ) . '</h3><table class="form-table">';
+                        printf( '<h3>%s</h3><table class="form-table">', esc_html( $obj->name ) );
 
                         $open_fieldset = true;
@@ -122 +122 @@
                             ?>
                             <tr valign="top">
-                                <th scope="row"><label for="field[<?php echo $obj->id; ?>]"><?php echo stripslashes( $obj->name ); ?></label></th>
+                                <th scope="row"><label for="field[<?php echo $obj->id; ?>]"><?php echo esc_html( $obj->name ); ?></label></th>
                                 <td style="background:#eee;border:1px solid #ddd"><a href="<?php esc_attr_e( $obj->value ); ?>" target="_blank"><?php echo esc_html( $obj->value ); ?></a></td>
                             </tr>
@@ -132 +132 @@
                             ?>
                             <tr valign="top">
-                                <th scope="row"><label for="field[<?php echo $obj->id; ?>]"><?php echo stripslashes( $obj->name ); ?></label></th>
+                                <th scope="row"><label for="field[<?php echo $obj->id; ?>]"><?php echo esc_html( $obj->name ); ?></label></th>
                                 <td style="background:#eee;border:1px solid #ddd"><?php echo wpautop( esc_html( $obj->value ) ); ?></td>
                             </tr>
@@ -141 +141 @@
                             ?>
                             <tr valign="top">
-                                <th scope="row"><label for="field[<?php echo $obj->id; ?>]"><?php echo stripslashes( $obj->name ); ?></label></th>
+                                <th scope="row"><label for="field[<?php echo $obj->id; ?>]"><?php echo esc_html( $obj->name ); ?></label></th>
                                 <td style="background:#eee;border:1px solid #ddd"><?php echo esc_html( $obj->value ); ?></td>
                             </tr>

visual-form-builder/trunk/admin/class-entries-list.php

@@ -481 +481 @@
 
         // Get entries search terms
-        $search_terms = ( !empty( $_POST['s'] ) ) ? explode( ' ', $_POST['s'] ) : array();
+        $search_terms = ( !empty( $_POST['s'] ) ) ? explode( ' ', sanitize_text_field( $_POST['s'] ) ) : array();
 
         $searchand = $search = '';
@@ -495 +495 @@
 
         // Set our ORDER BY and ASC/DESC to sort the entries
-        $orderby = ( !empty( $_GET['orderby'] ) ) ? $_GET['orderby'] : 'date';
-        $order = ( !empty( $_GET['order'] ) ) ? $_GET['order'] : 'desc';
+        $orderby = ( !empty( $_GET['orderby'] ) ) ? sanitize_text_field( $_GET['orderby'] ) : 'date';
+        $order   = ( !empty( $_GET['order'] ) ) ? sanitize_text_field( $_GET['order'] ) : 'desc';
 
         // Get the sorted entries

visual-form-builder/trunk/admin/class-export.php

@@ -179 +179 @@
         $data       = stripslashes_deep( $data );
         $content    = isset( $data['content'] ) ? $data['content'] : 'forms';
-        $form_id    = isset( $data['form-id'] ) ? $data['form-id'] : 0;
-        $format     = isset( $data['format'] ) ? $data['format'] : 'csv';
-        $start_date = isset( $data['start-date'] ) ? $data['start-date'] : '';
-        $end_date   = isset( $data['end-date'] ) ? $data['end-date'] : '';
+        $form_id    = isset( $data['form-id'] ) ? absint( $data['form-id'] ) : 0;
+        $format     = isset( $data['format'] ) ? sanitize_text_field( $data['format'] ) : 'csv';
+        $start_date = isset( $data['start-date'] ) ? sanitize_text_field( $data['start-date'] ) : '';
+        $end_date   = isset( $data['end-date'] ) ? sanitize_text_field( $data['end-date'] ) : '';
         $fields     = isset( $data['fields'] ) ? $data['fields'] : '';
 

visual-form-builder/trunk/public/class-security.php

@@ -38 +38 @@
     public function secret_check() {
         $required       = ( isset( $_POST['_vfb-required-secret'] ) && $_POST['_vfb-required-secret'] == '0' ) ? false : true;
-        $secret_field   = ( isset( $_POST['_vfb-secret'] ) ) ? esc_html( $_POST['_vfb-secret'] ) : '';
+        $secret_field = ( isset( $_POST['_vfb-secret'] ) ) ? sanitize_text_field( $_POST['_vfb-secret'] ) : '';
 
         // If the verification is set to required, run validation check
@@ -55 +55 @@
      */
     public function referer_check() {
-        $referrer        = ( isset( $_POST['_wp_http_referer'] ) ) ? esc_html( $_POST['_wp_http_referer'] ) : false;
+        $referrer        = ( isset( $_POST['_wp_http_referer'] ) ) ? sanitize_text_field( $_POST['_wp_http_referer'] ) : false;
         $wp_get_referer  = wp_get_referer();
         $form_id         = absint( $_POST['form_id'] );