WordPress.org
Get WordPress

Plugin Directory

Changeset 3171503


Ignore:
Timestamp:
10/18/2024 01:45:57 PM (14 months ago)
Author:
10web
Message:
  • Fixed: Security issue fix.
Location:
form-maker/trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • form-maker/trunk/admin/controllers/Widget.php

    r2069192 r3171503  
    4040    $contact_form_forms = explode(',', get_option('contact_form_forms'));
    4141
    42     $instance['title'] = isset($instance['title']) ? $instance['title'] : '';
    43     $instance['form_id'] = isset($instance['form_id']) ? $instance['form_id'] : 0;
     42    $instance['title'] = isset($instance['title']) ? esc_html($instance['title']) : '';
     43    $instance['form_id'] = isset($instance['form_id']) ? intval($instance['form_id']) : 0;
    4444
    4545    if ( !WDFMInstance(self::PLUGIN)->is_free || !in_array($instance['form_id'], $contact_form_forms) ) {

  • form-maker/trunk/admin/views/Widget.php

    r2069192 r3171503  
    4545    <p>
    4646      <label for="<?php echo $id_title; ?>">Title:</label>
    47       <input class="widefat" id="<?php echo $id_title; ?>" name="<?php echo $name_title; ?>" type="text" value="<?php echo $instance['title']; ?>" />
     47      <input class="widefat" id="<?php echo $id_title; ?>" name="<?php echo esc_attr($name_title); ?>" type="text" value="<?php echo esc_attr($instance['title']); ?>" />
    4848      <label for="<?php echo $id_form_id; ?>">Select a form:</label>
    49       <select class="widefat" name="<?php echo $name_form_id; ?>" id="<?php echo $id_form_id; ?>">
     49      <select class="widefat" name="<?php echo esc_attr($name_form_id); ?>" id="<?php echo $id_form_id; ?>">
    5050        <option style="text-align:center" value="0">- Select a Form -</option>
    5151        <?php

  • form-maker/trunk/form-maker.php

    r3160727 r3171503  
    44 * Plugin URI: https://10web.io/plugins/wordpress-form-maker/?utm_source=form_maker&utm_medium=free_plugin
    55 * Description: This plugin is a modern and advanced tool for easy and fast creating of a WordPress Form. The backend interface is intuitive and user friendly which allows users far from scripting and programming to create WordPress Forms.
    6  * Version: 1.15.29
     6 * Version: 1.15.30
    77 * Author: 10Web Form Builder Team
    88 * Author URI: https://10web.io/plugins/?utm_source=form_maker&utm_medium=free_plugin
    … …  
    2727  public $front_urls = array();
    2828  public $main_file = '';
    29   public $plugin_version = '1.15.29';
    30   public $db_version = '2.15.29';
     29  public $plugin_version = '1.15.30';
     30  public $db_version = '2.15.30';
    3131  public $menu_postfix = '_fm';
    3232  public $plugin_postfix = '';

  • form-maker/trunk/frontend/models/form_maker.php

    r3056119 r3171503  
    30073007    $current_page_url = WDW_FM_Library(self::PLUGIN)->get_current_page_url();
    30083008    $formtitle = $row->title;
    3009     $submit_text = do_shortcode($row->submit_text);
     3009    $submit_text = do_shortcode(wp_kses_post($row->submit_text));
    30103010
    30113011    $label_type = array();
    … …  
    42144214      $content_type = "text/html";
    42154215      $list_user = wordwrap( $list, 100, "\n" );
    4216         $new_script = wpautop( do_shortcode(  $row->script_mail_user ));
     4216        $new_script = wpautop( do_shortcode( wp_kses_post($row->script_mail_user) ));
    42174217    }
    42184218    else {
    42194219      $content_type = "text/plain";
    42204220      $list_user = wordwrap( $list_text_mode, 1000, "\n" );
    4221         $new_script = do_shortcode(  $row->script_mail_user );
     4221        $new_script = do_shortcode( wp_kses_post($row->script_mail_user) );
    42224222    }
    42234223
    … …  
    44134413        $content_type = "text/html";
    44144414        $list = wordwrap( $list, 100, "\n", TRUE );
    4415           $new_script = wpautop( do_shortcode(  $row->script_mail ));
     4415          $new_script = wpautop( do_shortcode( wp_kses_post($row->script_mail) ));
    44164416      }
    44174417      else {
    … …  
    44194419        $list = $list_text_mode;
    44204420        $list = wordwrap( $list, 1000, "\n", TRUE );
    4421           $new_script = do_shortcode(  $row->script_mail );
     4421          $new_script = do_shortcode( wp_kses_post($row->script_mail) );
    44224422      }
    44234423

  • form-maker/trunk/frontend/views/form_maker.php

    r3160727 r3171503  
    202202          </div>
    203203          <div class="fm-header-description">
    204             ' . do_shortcode($row->header_description) . '
     204            ' . do_shortcode(wp_kses_post($row->header_description)) . '
    205205          </div>
    206206        </div>';
    … …  
    290290              $temp = $temp[1];
    291291            }
    292             $rep = '<div type="type_editor" class="wdform-field">' . html_entity_decode(do_shortcode($param['w_editor'])) . '</div>';
     292            $rep = '<div type="type_editor" class="wdform-field">' . html_entity_decode(do_shortcode(wp_kses_post($param['w_editor']))) . '</div>';
    293293            break;
    294294          }
    … …  
    18131813                </div>
    18141814                <div class="fm-header-description">
    1815                   ' . do_shortcode($row->header_description) . '
     1815                  ' . do_shortcode(wp_kses_post($row->header_description)) . '
    18161816                </div>
    18171817              </div>';

  • form-maker/trunk/readme.txt

    r3160743 r3171503  
    44Requires at least: 4.6
    55Tested up to: 6.5
    6 Stable tag: 1.15.29
     6Stable tag: 1.15.30
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    6767**File Upload\***
    6868Your users can upload files to your forms.
    69 
    7069
    7170_\* Premium version only_
    … …  
    559558
    560559== Changelog ==
     560= 1.15.30 =
     561* Fixed: Security issue fix.
     562
    561563= 1.15.29 =
    562564* Fixed: Textarea input issue.
Note: See TracChangeset for help on using the changeset viewer.