WordPress.org
Get WordPress

Plugin Directory

Changeset 3463945


Ignore:
Timestamp:
02/18/2026 05:33:34 AM (5 weeks ago)
Author:
latepoint
Message:

Update to version 5.2.8 from GitHub

Location:
latepoint
Files:
2 deleted
20 edited
1 copied

Legend:

Unmodified
Added
Removed

  • latepoint/tags/5.2.8/.distignore

    r3452593 r3463945  
    5151*.log
    5252*.zip
     53CHANGELOG.md
     54CLAUDE.md

  • latepoint/tags/5.2.8/latepoint.php

    r3452593 r3463945  
    33 * Plugin Name: LatePoint
    44 * Description: Appointment Scheduling Software for WordPress
    5  * Version: 5.2.7
     5 * Version: 5.2.8
    66 * Author: LatePoint
    77 * Author URI: https://latepoint.com
    … …  
    3030         *
    3131         */
    32         public $version = '5.2.7';
     32        public $version = '5.2.8';
    3333        public $db_version = '2.3.0';
    3434

  • latepoint/tags/5.2.8/lib/controllers/booking_form_settings_controller.php

    r3291162 r3463945  
    2424
    2525        public function reload_preview() {
     26            // Verify nonce.
     27            $this->check_nonce( 'reload_preview' );
     28
    2629            OsStepsHelper::set_cart_object();
    2730            OsStepsHelper::set_booking_object();

  • latepoint/tags/5.2.8/lib/controllers/customers_controller.php

    r3452593 r3463945  
    151151            $customer = new OsCustomerModel();
    152152            // Security fix: Prevent mass assignment of wordpress_user_id by non-admin users.
    153             $customer->set_data( $this->params['customer'], LATEPOINT_PARAMS_SCOPE_PUBLIC );
     153            // Use admin scope if user is authenticated as admin, otherwise restrict to public fields.
     154            $customer->set_data( $this->params['customer'], OsAuthHelper::is_admin_logged_in() ? LATEPOINT_PARAMS_SCOPE_ADMIN : LATEPOINT_PARAMS_SCOPE_PUBLIC );
    154155            if ( $customer->save() ) {
    155156                // translators: %s is the html of a customer edit link
    … …  
    181182                    $old_customer_data = $customer->get_data_vars();
    182183                    // Security fix: Prevent mass assignment of wordpress_user_id by non-admin users.
    183                     $customer->set_data( $this->params['customer'], LATEPOINT_PARAMS_SCOPE_PUBLIC );
     184                    // Use admin scope if user is authenticated as admin, otherwise restrict to public fields.
     185                    $customer->set_data( $this->params['customer'], OsAuthHelper::is_admin_logged_in() ? LATEPOINT_PARAMS_SCOPE_ADMIN : LATEPOINT_PARAMS_SCOPE_PUBLIC );
    184186                    if ( $customer->save() ) {
    185187                        // translators: %s is the html of a customer edit link

  • latepoint/tags/5.2.8/lib/controllers/orders_controller.php

    r3452593 r3463945  
    132132            }
    133133            // Security fix: Prevent mass assignment of wordpress_user_id by non-admin users.
    134             // Use 'public' role to restrict which fields can be set via user input.
    135             $customer->set_data( $customer_params, LATEPOINT_PARAMS_SCOPE_PUBLIC );
     134            // Use admin scope if user is authenticated as admin, otherwise restrict to public fields.
     135            $customer->set_data( $customer_params, OsAuthHelper::is_admin_logged_in() ? LATEPOINT_PARAMS_SCOPE_ADMIN : LATEPOINT_PARAMS_SCOPE_PUBLIC );
    136136            if ( $customer->save() ) {
    137137                if ( $is_new_customer ) {

  • latepoint/tags/5.2.8/lib/helpers/customer_import_helper.php

    r3366851 r3463945  
    182182                }
    183183            }
    184             $customer->set_data($save_data);
     184            $customer->set_data($save_data, 'public');
    185185
    186186            if ($customer->save()) {

  • latepoint/tags/5.2.8/lib/helpers/settings_helper.php

    r3452593 r3463945  
    209209
    210210            // Security check: Ensure no dangerous SQL keywords in CREATE statement.
    211             $dangerous_keywords = array( 'EXEC', 'EXECUTE', 'CALL', 'LOAD_FILE', 'INTO OUTFILE', 'INTO DUMPFILE' );
     211            $dangerous_keywords = array( 'SELECT', 'UNION', 'EXEC', 'EXECUTE', 'CALL', 'LOAD_FILE', 'INTO OUTFILE', 'INTO DUMPFILE' );
    212212            foreach ( $dangerous_keywords as $keyword ) {
    213213                if ( stripos( $create_statement, $keyword ) !== false ) {
    … …  
    232232                foreach ( $table_data['data'] as $row ) {
    233233                    if ( is_array( $row ) ) {
     234                        // Security fix: Prevent mass assignment of wordpress_user_id during import.
     235                        if ( $table === $wpdb->prefix . 'latepoint_customers' ) {
     236                            unset( $row['wordpress_user_id'] );
     237                        }
     238
    234239                        $insert_result = $wpdb->insert( $table, $row );
    235240                        if ( $insert_result === false ) {

  • latepoint/tags/5.2.8/lib/views/booking_form_settings/_booking_form_preview.php

    r3291162 r3463945  
    2121                </div>
    2222                <div class="bf-side-heading editable-setting" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][side_panel_heading]" contenteditable="true"><?php echo wp_strip_all_tags(OsStepsHelper::get_step_setting_value($selected_step_code, 'side_panel_heading')); ?></div>
    23                 <div class="bf-side-desc os-editable-basic editable-setting" data-setting-key="[<?php echo $selected_step_code;?>][side_panel_description]"><?php echo strip_tags(OsStepsHelper::get_step_setting_value($selected_step_code, 'side_panel_description'), ['a', 'i', 'u', 'b', 'br']); ?></div>
     23                <div
     24                    class="bf-side-desc os-editable-basic editable-setting"
     25                    data-setting-key="[<?php echo esc_attr( $selected_step_code ); ?>][side_panel_description]"
     26                >
     27                    <?php echo strip_tags( OsStepsHelper::get_step_setting_value( $selected_step_code, 'side_panel_description' ), [ 'a', 'i', 'u', 'b', 'br' ] ); ?>
     28                </div>
    2429            </div>
    2530            <div class="side-panel-extra os-editable editable-setting" data-setting-key="[shared][steps_support_text]">
    26                 <?php echo OsSettingsHelper::get_steps_support_text(); ?>
     31                <?php echo wp_kses_post( OsSettingsHelper::get_steps_support_text() ); ?>
    2732            </div>
    2833        </div>
    … …  
    3035            <div class="bf-main-heading editable-setting" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][main_panel_heading]" contenteditable="true"><?php echo wp_strip_all_tags(OsStepsHelper::get_step_setting_value($selected_step_code, 'main_panel_heading')); ?></div>
    3136            <div class="bf-main-panel-content-wrapper">
    32                 <div class="bf-main-panel-content-before os-editable editable-setting" data-placeholder="+" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][main_panel_content_before]"><?php echo OsStepsHelper::get_step_setting_value($selected_step_code, 'main_panel_content_before'); ?></div>
     37                <div
     38                    class="bf-main-panel-content-before os-editable editable-setting"
     39                    data-placeholder="+"
     40                    data-setting-key="[<?php echo esc_attr( $selected_step_code ); ?>][main_panel_content_before]"
     41                >
     42                    <?php echo wp_kses_post( OsStepsHelper::get_step_setting_value( $selected_step_code, 'main_panel_content_before' ) ); ?>
     43                </div>
    3344                <div class="bf-main-panel-content">
    3445                    <?php echo OsStepsHelper::get_step_content_preview($selected_step_code); ?>
    3546                </div>
    36                 <div class="bf-main-panel-content-after os-editable editable-setting" data-placeholder="+" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][main_panel_content_after]"><?php echo OsStepsHelper::get_step_setting_value($selected_step_code, 'main_panel_content_after'); ?></div>
     47                <div
     48                    class="bf-main-panel-content-after os-editable editable-setting"
     49                    data-placeholder="+"
     50                    data-setting-key="[<?php echo esc_attr( $selected_step_code ); ?>][main_panel_content_after]"
     51                >
     52                    <?php echo wp_kses_post( OsStepsHelper::get_step_setting_value( $selected_step_code, 'main_panel_content_after' ) ); ?>
     53                </div>
    3754            </div>
    3855            <div class="bf-main-panel-buttons">

  • latepoint/tags/5.2.8/lib/views/booking_form_settings/show.php

    r3230896 r3463945  
    1515    <form class="booking-form-preview-settings"
    1616          data-route-name="<?php echo esc_attr(OsRouterHelper::build_route_name( 'booking_form_settings', 'reload_preview' )); ?>">
     17        <?php wp_nonce_field( 'reload_preview', '_wpnonce', false ); ?>
    1718        <div class="bf-heading">
    1819            <div class="latepoint-icon latepoint-icon-browser"></div>

  • latepoint/tags/5.2.8/readme.txt

    r3452592 r3463945  
    11=== LatePoint - Calendar Booking Plugin for Appointments and Events ===
    22Contributors: latepoint
    3 Donate link: https://latepoint.com
    43Tags: appointments, booking, scheduling, events, calendar
    54Requires at least: 6.5
    65Tested up to: 6.9
    7 Stable tag: 5.2.7
     6Stable tag: 5.2.8
    87Requires PHP: 7.4
    98License: GPLv3
    … …  
    205204== Changelog ==
    206205
     206= 5.2.8 - February 18, 2026 =
     207- Security: Addressed security bugs. Props to WordFence for reporting it.
     208- Fix: Fixed admin notes field not saving properly for admin users when creating or updating customers/orders.
     209
    207210= 5.2.7 - February 3, 2026 =
    208211- Security: Addressed security bugs. Props to WordFence for reporting it.
    … …  
    217220- Fix: Fixes for customer login shortcode issues + OTP via SMS
    218221
    219 = 5.2.3 - September 28, 2025 =
    220 - New: Compact side menu
    221 - Fix: Fixes for customer authentication
    222 
    223222Full changelog can be found on our website: [Full Changelog](https://latepoint.com/changelog/)

  • latepoint/trunk/.distignore

    r3452593 r3463945  
    5151*.log
    5252*.zip
     53CHANGELOG.md
     54CLAUDE.md

  • latepoint/trunk/latepoint.php

    r3452593 r3463945  
    33 * Plugin Name: LatePoint
    44 * Description: Appointment Scheduling Software for WordPress
    5  * Version: 5.2.7
     5 * Version: 5.2.8
    66 * Author: LatePoint
    77 * Author URI: https://latepoint.com
    … …  
    3030         *
    3131         */
    32         public $version = '5.2.7';
     32        public $version = '5.2.8';
    3333        public $db_version = '2.3.0';
    3434

  • latepoint/trunk/lib/controllers/booking_form_settings_controller.php

    r3291162 r3463945  
    2424
    2525        public function reload_preview() {
     26            // Verify nonce.
     27            $this->check_nonce( 'reload_preview' );
     28
    2629            OsStepsHelper::set_cart_object();
    2730            OsStepsHelper::set_booking_object();

  • latepoint/trunk/lib/controllers/customers_controller.php

    r3452593 r3463945  
    151151            $customer = new OsCustomerModel();
    152152            // Security fix: Prevent mass assignment of wordpress_user_id by non-admin users.
    153             $customer->set_data( $this->params['customer'], LATEPOINT_PARAMS_SCOPE_PUBLIC );
     153            // Use admin scope if user is authenticated as admin, otherwise restrict to public fields.
     154            $customer->set_data( $this->params['customer'], OsAuthHelper::is_admin_logged_in() ? LATEPOINT_PARAMS_SCOPE_ADMIN : LATEPOINT_PARAMS_SCOPE_PUBLIC );
    154155            if ( $customer->save() ) {
    155156                // translators: %s is the html of a customer edit link
    … …  
    181182                    $old_customer_data = $customer->get_data_vars();
    182183                    // Security fix: Prevent mass assignment of wordpress_user_id by non-admin users.
    183                     $customer->set_data( $this->params['customer'], LATEPOINT_PARAMS_SCOPE_PUBLIC );
     184                    // Use admin scope if user is authenticated as admin, otherwise restrict to public fields.
     185                    $customer->set_data( $this->params['customer'], OsAuthHelper::is_admin_logged_in() ? LATEPOINT_PARAMS_SCOPE_ADMIN : LATEPOINT_PARAMS_SCOPE_PUBLIC );
    184186                    if ( $customer->save() ) {
    185187                        // translators: %s is the html of a customer edit link

  • latepoint/trunk/lib/controllers/orders_controller.php

    r3452593 r3463945  
    132132            }
    133133            // Security fix: Prevent mass assignment of wordpress_user_id by non-admin users.
    134             // Use 'public' role to restrict which fields can be set via user input.
    135             $customer->set_data( $customer_params, LATEPOINT_PARAMS_SCOPE_PUBLIC );
     134            // Use admin scope if user is authenticated as admin, otherwise restrict to public fields.
     135            $customer->set_data( $customer_params, OsAuthHelper::is_admin_logged_in() ? LATEPOINT_PARAMS_SCOPE_ADMIN : LATEPOINT_PARAMS_SCOPE_PUBLIC );
    136136            if ( $customer->save() ) {
    137137                if ( $is_new_customer ) {

  • latepoint/trunk/lib/helpers/customer_import_helper.php

    r3366851 r3463945  
    182182                }
    183183            }
    184             $customer->set_data($save_data);
     184            $customer->set_data($save_data, 'public');
    185185
    186186            if ($customer->save()) {

  • latepoint/trunk/lib/helpers/settings_helper.php

    r3452593 r3463945  
    209209
    210210            // Security check: Ensure no dangerous SQL keywords in CREATE statement.
    211             $dangerous_keywords = array( 'EXEC', 'EXECUTE', 'CALL', 'LOAD_FILE', 'INTO OUTFILE', 'INTO DUMPFILE' );
     211            $dangerous_keywords = array( 'SELECT', 'UNION', 'EXEC', 'EXECUTE', 'CALL', 'LOAD_FILE', 'INTO OUTFILE', 'INTO DUMPFILE' );
    212212            foreach ( $dangerous_keywords as $keyword ) {
    213213                if ( stripos( $create_statement, $keyword ) !== false ) {
    … …  
    232232                foreach ( $table_data['data'] as $row ) {
    233233                    if ( is_array( $row ) ) {
     234                        // Security fix: Prevent mass assignment of wordpress_user_id during import.
     235                        if ( $table === $wpdb->prefix . 'latepoint_customers' ) {
     236                            unset( $row['wordpress_user_id'] );
     237                        }
     238
    234239                        $insert_result = $wpdb->insert( $table, $row );
    235240                        if ( $insert_result === false ) {

  • latepoint/trunk/lib/views/booking_form_settings/_booking_form_preview.php

    r3291162 r3463945  
    2121                </div>
    2222                <div class="bf-side-heading editable-setting" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][side_panel_heading]" contenteditable="true"><?php echo wp_strip_all_tags(OsStepsHelper::get_step_setting_value($selected_step_code, 'side_panel_heading')); ?></div>
    23                 <div class="bf-side-desc os-editable-basic editable-setting" data-setting-key="[<?php echo $selected_step_code;?>][side_panel_description]"><?php echo strip_tags(OsStepsHelper::get_step_setting_value($selected_step_code, 'side_panel_description'), ['a', 'i', 'u', 'b', 'br']); ?></div>
     23                <div
     24                    class="bf-side-desc os-editable-basic editable-setting"
     25                    data-setting-key="[<?php echo esc_attr( $selected_step_code ); ?>][side_panel_description]"
     26                >
     27                    <?php echo strip_tags( OsStepsHelper::get_step_setting_value( $selected_step_code, 'side_panel_description' ), [ 'a', 'i', 'u', 'b', 'br' ] ); ?>
     28                </div>
    2429            </div>
    2530            <div class="side-panel-extra os-editable editable-setting" data-setting-key="[shared][steps_support_text]">
    26                 <?php echo OsSettingsHelper::get_steps_support_text(); ?>
     31                <?php echo wp_kses_post( OsSettingsHelper::get_steps_support_text() ); ?>
    2732            </div>
    2833        </div>
    … …  
    3035            <div class="bf-main-heading editable-setting" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][main_panel_heading]" contenteditable="true"><?php echo wp_strip_all_tags(OsStepsHelper::get_step_setting_value($selected_step_code, 'main_panel_heading')); ?></div>
    3136            <div class="bf-main-panel-content-wrapper">
    32                 <div class="bf-main-panel-content-before os-editable editable-setting" data-placeholder="+" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][main_panel_content_before]"><?php echo OsStepsHelper::get_step_setting_value($selected_step_code, 'main_panel_content_before'); ?></div>
     37                <div
     38                    class="bf-main-panel-content-before os-editable editable-setting"
     39                    data-placeholder="+"
     40                    data-setting-key="[<?php echo esc_attr( $selected_step_code ); ?>][main_panel_content_before]"
     41                >
     42                    <?php echo wp_kses_post( OsStepsHelper::get_step_setting_value( $selected_step_code, 'main_panel_content_before' ) ); ?>
     43                </div>
    3344                <div class="bf-main-panel-content">
    3445                    <?php echo OsStepsHelper::get_step_content_preview($selected_step_code); ?>
    3546                </div>
    36                 <div class="bf-main-panel-content-after os-editable editable-setting" data-placeholder="+" data-setting-key="[<?php echo esc_attr($selected_step_code);?>][main_panel_content_after]"><?php echo OsStepsHelper::get_step_setting_value($selected_step_code, 'main_panel_content_after'); ?></div>
     47                <div
     48                    class="bf-main-panel-content-after os-editable editable-setting"
     49                    data-placeholder="+"
     50                    data-setting-key="[<?php echo esc_attr( $selected_step_code ); ?>][main_panel_content_after]"
     51                >
     52                    <?php echo wp_kses_post( OsStepsHelper::get_step_setting_value( $selected_step_code, 'main_panel_content_after' ) ); ?>
     53                </div>
    3754            </div>
    3855            <div class="bf-main-panel-buttons">

  • latepoint/trunk/lib/views/booking_form_settings/show.php

    r3230896 r3463945  
    1515    <form class="booking-form-preview-settings"
    1616          data-route-name="<?php echo esc_attr(OsRouterHelper::build_route_name( 'booking_form_settings', 'reload_preview' )); ?>">
     17        <?php wp_nonce_field( 'reload_preview', '_wpnonce', false ); ?>
    1718        <div class="bf-heading">
    1819            <div class="latepoint-icon latepoint-icon-browser"></div>

  • latepoint/trunk/readme.txt

    r3452592 r3463945  
    11=== LatePoint - Calendar Booking Plugin for Appointments and Events ===
    22Contributors: latepoint
    3 Donate link: https://latepoint.com
    43Tags: appointments, booking, scheduling, events, calendar
    54Requires at least: 6.5
    65Tested up to: 6.9
    7 Stable tag: 5.2.7
     6Stable tag: 5.2.8
    87Requires PHP: 7.4
    98License: GPLv3
    … …  
    205204== Changelog ==
    206205
     206= 5.2.8 - February 18, 2026 =
     207- Security: Addressed security bugs. Props to WordFence for reporting it.
     208- Fix: Fixed admin notes field not saving properly for admin users when creating or updating customers/orders.
     209
    207210= 5.2.7 - February 3, 2026 =
    208211- Security: Addressed security bugs. Props to WordFence for reporting it.
    … …  
    217220- Fix: Fixes for customer login shortcode issues + OTP via SMS
    218221
    219 = 5.2.3 - September 28, 2025 =
    220 - New: Compact side menu
    221 - Fix: Fixes for customer authentication
    222 
    223222Full changelog can be found on our website: [Full Changelog](https://latepoint.com/changelog/)
Note: See TracChangeset for help on using the changeset viewer.