WordPress.org
Get WordPress

Plugin Directory

Changeset 3309680


Ignore:
Timestamp:
06/11/2025 09:44:11 AM (6 months ago)
Author:
10web
Message:
  • Fixed: Security issue.
  • Fixed: Deprecated issue.
Location:
form-maker/trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • form-maker/trunk/admin/views/Options_fm.php

    r2316673 r3309680  
    8282            <span class="wd-group">
    8383              <label class="wd-label" for="public_key"><?php _e('Site key', WDFMInstance(self::PLUGIN)->prefix); ?></label>
    84               <input id="public_key" name="public_key" value="<?php echo $public_key; ?>" type="text" />
     84              <input id="public_key" name="public_key" value="<?php echo esc_attr($public_key); ?>" type="text" />
    8585            </span>
    8686            <span class="wd-group">
    8787              <label class="wd-label" for="private_key"><?php _e('Secret key', WDFMInstance(self::PLUGIN)->prefix); ?></label>
    88               <input id="private_key" name="private_key" value="<?php echo $private_key; ?>" type="text" />
     88              <input id="private_key" name="private_key" value="<?php echo esc_attr($private_key); ?>" type="text" />
    8989              <p class="description">
    9090                <?php echo sprintf(__('%s for your site from ReCaptcha website and copy the provided here.', WDFMInstance(self::PLUGIN)->prefix), '<a href="https://www.google.com/recaptcha/intro/index.html" target="_blank">' . __('Get ReCaptcha Site and Secret Keys', WDFMInstance(self::PLUGIN)->prefix) . '</a>'); ?>
    … …  
    9393            <span class="wd-group">
    9494              <label class="wd-label" for="recaptcha_score"><?php _e('Minimum ReCaptcha v3 Score to allow submission', WDFMInstance(self::PLUGIN)->prefix); ?></label>
    95               <input id="recaptcha_score" name="recaptcha_score" value="<?php echo $recaptcha_score == '' ? 0.5 : $recaptcha_score; ?>" type="number" max="1" min="0" step="0.1" />
     95              <input id="recaptcha_score" name="recaptcha_score" value="<?php echo esc_attr($recaptcha_score === '' ? 0.5 : $recaptcha_score); ?>" type="number" max="1" min="0" step="0.1" />
    9696              <p class="description">
    9797                <?php echo sprintf(__('ReCaptcha v3 returns a score based on the user interactions with your forms. Scores range from 0.0 to 1.0, with 0.0 indicating abusive traffic and 1.0 indicating good traffic. %sVisit%s ReCaptcha admin to review verification statistics.', WDFMInstance(self::PLUGIN)->prefix), '<a href="https://www.google.com/recaptcha/admin/" target="_blank">', '</a>'); ?>
    … …  
    110110            <span class="wd-group">
    111111              <label class="wd-label" for="map_key"><?php _e('Map API Key', WDFMInstance(self::PLUGIN)->prefix); ?></label>
    112               <input id="map_key" name="map_key" value="<?php echo $map_key; ?>" type="text" />
     112              <input id="map_key" name="map_key" value="<?php echo esc_attr($map_key); ?>" type="text" />
    113113              <p class="description">
    114114                <?php echo _e('Get', WDFMInstance(self::PLUGIN)->prefix); ?>
    … …  
    128128            <span class="wd-group">
    129129              <label class="wd-label" for="csv_delimiter"><?php _e('CSV Delimiter', WDFMInstance(self::PLUGIN)->prefix); ?></label>
    130               <input id="csv_delimiter" name="csv_delimiter" value="<?php echo $csv_delimiter; ?>" type="text" />
     130              <input id="csv_delimiter" name="csv_delimiter" value="<?php echo esc_attr($csv_delimiter); ?>" type="text" />
    131131              <p class="description"><?php _e('This option sets the symbol, which will be used to separate the values in CSV file of form submissions.', WDFMInstance(self::PLUGIN)->prefix); ?></p>
    132132            </span>

  • form-maker/trunk/admin/views/Submissions_fm.php

    r3156791 r3309680  
    753753                                            <td id="<?php echo $sorted_labels_id[$h]; ?>_fc" class="<?php echo $sorted_labels_id[$h]; ?>_fc sub-align" <?php echo $styleStr; ?> data-colname="<?php echo !empty($label_name_ids[$sorted_labels_id[$h]]) ? $label_name_ids[$sorted_labels_id[$h]] : ''; ?>" <?php echo ($savedb == 2 &&  $sorted_label_types[$h] == "type_paypal_payment_status") ? $check_payment_status : ""; ?> style="width:<?php echo $status_column_width; ?>; max-width:<?php echo $status_column_width; ?>;">
    754754                                                <?php if ( $sorted_label_types[$h] == 'type_signature' ) { ?>
    755                                                     <img src="<?php echo $textdata['text']; ?>" style="width:50px; border: 1px solid #ddd;"/>
     755                                                    <img src="<?php echo esc_url($element_value); ?>" style="width:50px; border: 1px solid #ddd;"/>
    756756                                                <?php
    757757                                                }

  • form-maker/trunk/css/style_submissions.css

    r2510880 r3309680  
    3939.submissions tbody tr {
    4040  border-bottom: solid 1px #ddd !important;
     41  display:table-row!important
    4142}
    4243.submissions td {

  • form-maker/trunk/form-maker.php

    r3229199 r3309680  
    44 * Plugin URI: https://10web.io/plugins/wordpress-form-maker/?utm_source=form_maker&utm_medium=free_plugin
    55 * Description: This plugin is a modern and advanced tool for easy and fast creating of a WordPress Form. The backend interface is intuitive and user friendly which allows users far from scripting and programming to create WordPress Forms.
    6  * Version: 1.15.33
     6 * Version: 1.15.34
    77 * Author: 10Web Form Builder Team
    88 * Author URI: https://10web.io/plugins/?utm_source=form_maker&utm_medium=free_plugin
    … …  
    2727  public $front_urls = array();
    2828  public $main_file = '';
    29   public $plugin_version = '1.15.33';
    30   public $db_version = '2.15.33';
     29  public $plugin_version = '1.15.34';
     30  public $db_version = '2.15.34';
    3131  public $menu_postfix = '_fm';
    3232  public $plugin_postfix = '';
    … …  
    520520    add_action('load-' . $submissions_page, array($this, 'submissions_per_page'));
    521521
    522     add_submenu_page(null, __('Blocked IPs', $this->prefix), __('Blocked IPs', $this->prefix), 'manage_options', 'blocked_ips' . $this->menu_postfix, array($this, 'form_maker'));
     522    add_submenu_page('', __('Blocked IPs', $this->prefix), __('Blocked IPs', $this->prefix), 'manage_options', 'blocked_ips' . $this->menu_postfix, array($this, 'form_maker'));
    523523    add_submenu_page($parent_slug, __('Themes', $this->prefix), __('Themes', $this->prefix), 'manage_options', 'themes' . $this->menu_postfix, array($this, 'form_maker'));
    524524    add_submenu_page($parent_slug, __('Options', $this->prefix), __('Options', $this->prefix), 'manage_options', 'options' . $this->menu_postfix, array($this, 'form_maker'));
    525     add_submenu_page(null, __('Uninstall', $this->prefix), __('Uninstall', $this->prefix), 'manage_options', 'uninstall' . $this->menu_postfix, array($this, 'form_maker'));
     525    add_submenu_page('', __('Uninstall', $this->prefix), __('Uninstall', $this->prefix), 'manage_options', 'uninstall' . $this->menu_postfix, array($this, 'form_maker'));
    526526
    527527    if ( current_user_can('manage_options') && $this->is_free ) {

  • form-maker/trunk/form_maker_insert.php

    r2711405 r3309680  
    393393      'checkout_mode' => '0',
    394394      'paypal_email' => '',
    395       'payment_currency' => 'UDS',
     395      'payment_currency' => 'USD',
    396396      'tax' => '0',
    397397      'savedb' => '1',
    … …  
    471471      'checkout_mode' => 'testmode',
    472472      'paypal_email' => '',
    473       'payment_currency' => 'UDS',
     473      'payment_currency' => 'USD',
    474474      'tax' => '0',
    475475      'savedb' => '1',
    … …  
    549549      'checkout_mode' => 'testmode',
    550550      'paypal_email' => '',
    551       'payment_currency' => 'UDS',
     551      'payment_currency' => 'USD',
    552552      'tax' => '0',
    553553      'savedb' => '1',

  • form-maker/trunk/frontend/models/form_maker.php

    r3171503 r3309680  
    24322432                    fclose($indexfile);
    24332433                    $htaccessfile = fopen($upload_dir[ 'basedir' ] . '/' . $destination . "/signatures/.htaccess", "w");
    2434                     fwrite($htaccessfile, "deny from all");
     2434                    fwrite($htaccessfile, '<FilesMatch "\.(?!jpe?g$|png$|gif$|webp$).*$">' . PHP_EOL . 'Deny from all' . PHP_EOL . '</FilesMatch>');
    24352435                    fclose($htaccessfile);
    24362436                }
    … …  
    24472447                        $indexfile = fopen($dirTmp."/index.html", "w");
    24482448                        fclose($indexfile);
    2449                         $htaccessfile = fopen($dirTmp . "/.htaccess", "w");
    2450                         fwrite($htaccessfile, "deny from all");
    2451                         fclose($htaccessfile);
     2449                        if( $dir === 'signature' ) {
     2450                            $htaccessfile = fopen($dirTmp . "/.htaccess", "w");
     2451                            fwrite($htaccessfile, '<FilesMatch "\.(?!jpe?g$|png$|gif$|webp$).*$">' . PHP_EOL . 'Deny from all' . PHP_EOL . '</FilesMatch>');
     2452                            fclose($htaccessfile);
     2453                        }
    24522454                    }
    24532455                  }
    … …  
    26912693          $this->set_submission_total( $total_field_subm_data );
    26922694
    2693           $total = $total + ($total * $tax) / 100;
     2695          $total = floatval($total) + (floatval($total) * floatval($tax)) / 100;
    26942696          if ( isset( $paypal[ 'shipping' ] ) ) {
    26952697            $total = $total + $paypal[ 'shipping' ];

  • form-maker/trunk/readme.txt

    r3305506 r3309680  
    44Requires at least: 4.6
    55Tested up to: 6.8
    6 Stable tag: 1.15.33
     6Stable tag: 1.15.34
    77License: GPLv2 or later
    88License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    558558
    559559== Changelog ==
     560= 1.15.34 =
     561* Fixed: Security issue.
     562* Fixed: Deprecated issue.
     563
    560564= 1.15.33 =
    561565* Fixed: Security issue fix.
Note: See TracChangeset for help on using the changeset viewer.