WordPress.org
Get WordPress

Plugin Directory

Changeset 3056446


Ignore:
Timestamp:
03/22/2024 12:55:20 AM (2 years ago)
Author:
bgermann
Message:

import version 15.0.6

Location:
cforms2/trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • cforms2/trunk/cforms-global-settings.php

    r2875024 r3056446  
    4242            if ($raw_cforms_settings === null) {
    4343                echo '<div id="message" class="updated fade"><p>' . __('Error:', 'cforms2') . ' ';
    44                 // As WordPress has a compatibility layer, json_last_error_msg (PHP >= 5.5) can be used.
    4544                echo json_last_error_msg() . '</p></div>';
    4645            } elseif (is_array($raw_cforms_settings)) {

  • cforms2/trunk/cforms.php

    r2875024 r3056446  
    2121 * Description: cformsII is a customizable, flexible and powerful form plugin including simple spam protection, multi-step forms, role manager support and custom themes.
    2222 * Author: Oliver Seidel, Bastian Germann
    23  * Version: 15.0.5
     23 * Version: 15.0.6
    2424 * Text Domain: cforms2
    2525 */
    2626namespace Cforms2;
    2727
    28 define('CFORMS2_VERSION', '15.0.5');
     28define('CFORMS2_VERSION', '15.0.6');
    2929
    3030// Debug message handling.

  • cforms2/trunk/lib_render.php

    r2353696 r3056446  
    412412            $formcontent .= '<li' . $liID . ' class="' . $liERR . '">' . $insertErr;
    413413            if (!in_array($field_type, array_keys($captchas)))
    414                 $formcontent .= '<label' . $labelID . ' for="' . $input_id . '"' . ($field_type == 'captcha' ? ' class="seccap"' : '') . '><span>' . stripslashes(($field_name)) . '</span></label>';
     414                $formcontent .= '<label' . $labelID . ' for="' . $input_id . '"' . ($field_type == 'captcha' ? ' class="seccap"' : '') . '><span>' . sanitize_text_field(stripslashes($field_name)) . '</span></label>';
    415415        }
    416416
    … …  
    442442
    443443                case "textonly":
    444                     $field .= '<li' . $liID . ' class="textonly' . (empty($defaultvalue) ? '' : ' ' . $defaultvalue) . '"' . (empty($reg_exp) ? '' : ' style="' . $reg_exp . '" ') . '>' . stripslashes(($field_name)) . '</li>';
     444                    $field .= '<li' . $liID . ' class="textonly' . (empty($defaultvalue) ? '' : ' ' . $defaultvalue) . '"' . (empty($reg_exp) ? '' : ' style="' . $reg_exp . '" ') . '>' . sanitize_text_field(stripslashes($field_name)) . '</li>';
    445445                    break;
    446446
    … …  
    460460
    461461                        $field .= '<fieldset class="cf-fs' . $fscount++ . '" style="' . $fieldsethide[1] . '">'
    462                                 . '<legend>' . stripslashes($fieldsethide[0]) . '</legend>'
     462                                . '<legend>' . sanitize_text_field(stripslashes($fieldsethide[0])) . '</legend>'
    463463                                . '<ol class="cf-ol">';
    464464                        $fieldsetopen = true;
    … …  
    554554                    if (!empty($options[1])) {
    555555                        $before = '<li' . $liID . ' class="' . $liERR . '">' . $insertErr;
    556                         $after = '<label' . $labelID . ' for="' . $input_id . '" class="cf-after' . $err . '"><span>' . $opt[0] . '</span></label></li>';
     556                        $after = '<label' . $labelID . ' for="' . $input_id . '" class="cf-after' . $err . '"><span>' . sanitize_text_field($opt[0]) . '</span></label></li>';
    557557                        $ba = 'a';
    558558                    } else {
    559                         $before = '<li' . $liID . ' class="' . $liERR . '">' . $insertErr . '<label' . $labelID . ' for="' . $input_name . '" class="cf-before' . $err . '"><span>' . $opt[0] . '</span></label>';
     559                        $before = '<li' . $liID . ' class="' . $liERR . '">' . sanitize_text_field($insertErr) . '<label' . $labelID . ' for="' . sanitize_text_field($input_name) . '" class="cf-before' . $err . '"><span>' . $opt[0] . '</span></label>';
    560560                        $after = '</li>';
    561561                        $ba = 'b';
    … …  
    573573                    $liID_b = empty($liID) ? '' : substr($liID, 0, -1) . 'items"';
    574574                    array_shift($options);
    575                     $field .= '<li' . $liID . ' class="cf-box-title">' . (($field_name)) . '</li>' .
     575                    $field .= '<li' . $liID . ' class="cf-box-title">' . sanitize_text_field($field_name) . '</li>' .
    576576                            '<li' . $liID_b . ' class="cf-box-group">';
    577577                    $id = 1;
    … …  
    694694
    695695                    array_shift($options);
    696                     $field .= '<li' . $liID . ' class="' . $liERR . ' cf-box-title">' . $insertErr . (($field_name)) . '</li>' .
     696                    $field .= '<li' . $liID . ' class="' . $liERR . ' cf-box-title">' . $insertErr . sanitize_text_field($field_name) . '</li>' .
    697697                            '<li' . $liID_b . ' class="cf-box-group">';
    698698

  • cforms2/trunk/readme.txt

    r2950677 r3056446  
    44Tags: contact form, contact, form, post, sidebar, multi step, api exposed, fork
    55Requires at least: 5.2
    6 Tested up to: 6.3
     6Tested up to: 6.4
    77Stable tag: trunk
    88License: GPLv3 or later
    … …  
    1717If you want to use plugin versions older than 14.6.3, you should rename the directory containing the plugin from "cforms2" to "cforms". But bear in mind that old versions should not be used in public systems, because they contain [known serious vulnerabilities](https://wpvulndb.com/plugins/cforms) that are exploited in the wild.
    1818
    19 The [current security baseline version](https://wpvulndb.com/plugins/cforms2) is 15.0.5.
     19The [current security baseline version](https://wpvulndb.com/plugins/cforms2) is 15.0.6.
    2020
    2121
    … …  
    109109== Upgrade Notice ==
    110110
    111 = 15.0.5 =
     111= 15.0.6 =
    112112The tracking database feature and its view are removed with cformsII 15.0+. Your data still exists in the database. Please have a look at CFDB plugin as a replacement.
    113113
    114114
    115115== Changelog ==
     116
     117= 15.0.6 =
     118
     119* bugfix:   prevent XSS by output sanitization: CVE-2023-52203 and CVE-2024-22149
    116120
    117121= 15.0.5 =
Note: See TracChangeset for help on using the changeset viewer.