WordPress.org
Get WordPress

Plugin Directory

Changeset 3442720


Ignore:
Timestamp:
01/19/2026 05:56:41 PM (2 months ago)
Author:
sjcope
Message:

Check post variables

Location:
consignment-store-for-woocommerce
Files:
32 added
8 edited

Legend:

Unmodified
Added
Removed

  • consignment-store-for-woocommerce/trunk/README.txt

    r3412523 r3442720  
    44Tags: consignment store, consignment for WooCommerce
    55Tested up to: 6.9
    6 Stable tag: 2.7
     6Stable tag: 2.8
    77License: GPLv2
    88License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    7575
    7676== Changelog ==
     77= 2.8 =
     78* Fix form submission error.
     79
    7780= 2.7 =
    7881* Fix scrollintoview and error messaging.
    … …  
    169172
    170173== Upgrade Notice ==
     174= 2.8 =
     175* Fix form submission error. Upgrade as soon as possible.
     176
    171177= 2.7 =
    172178* Fix scrollintoview and error messaging. Upgrade when possible.

  • consignment-store-for-woocommerce/trunk/admin/class-cws-consignment-admin.php

    r3335016 r3442720  
    2121 * @author     Charlene Copeland <charlene@charlenesweb.ca>
    2222 */
     23if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     24
    2325#[AllowDynamicProperties]
     26
    2427class cws_consignment_Admin {
    2528
    … …  
    99102        //add_shortcode( 'cwscs_additemform', array($this, 'additemform_func') );
    100103    }
    101     // Log errors
    102     public function cwscsLogError($system, $file, $fcn, $url, $msg) {
    103         global $wpdb;
    104         $query = $wpdb->insert( $wpdb->prefix.'cwscs_errorlog', array( 'system' => sanitize_text_field($system), 'file' => sanitize_text_field($file), 'fcn' => sanitize_text_field($fcn), 'url' => esc_url_raw($url), 'msg' => sanitize_text_field($msg) ), array('%s', '%s', '%s', '%s', '%s') ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
    105         $result = $wpdb->insert_id;
    106         return $result;
    107     } // END cwscsLogError
     104
    108105    /**
    109106     * create menu structure
    … …  
    330327        $results = '<p class="cwscs_failmsg">'.$tmp.'. </p>';
    331328        $url = get_site_url();
    332         $test = cwscsLogError("admin", "class-cws-consignment-admin-php", "cwscsGetInventory", $url, $tmp);
    333329        $ok = false;
    334330    }
    … …  
    361357        $item = '<p class="cwscs_failmsg">'.$tmp.'.</p>';
    362358        $url = get_site_url();
    363         $test = cwscsLogError("admin", "class-cws-consignment-admin-php", "cwscsGetInventoryByID", $url, $tmp.'ID: '.$id);
    364359    } else {
    365360        $item = $results[0];
    … …  
    380375        $item = '<p class="cwscs_failmsg">'.$tmp.'. Error emailed to Charlene. </p>';
    381376        $url = get_site_url();
    382         $test = cwscsLogError("admin", "class-cws-consignment-admin-php", "cwscsGetInventoryBySKU", $url, $tmp.'SKU: '.$sku);
    383377    } else {
    384378        $item = $results; // only 1
    … …  
    402396        $results = '<p class="cwscs_failmsg">'.$tmp.'. </p>';
    403397        $url = get_site_url();
    404         $test = cwscsLogError("admin", "class-cws-consignment-admin-php", "cwscsGetInventoryBySKU", $url, $tmp.'SKU: '.$sku);
    405398    }
    406399    return $results;
    … …  
    439432   
    440433    if (!is_object($items) && !is_array($items)) {
    441         $tmp = 'Failed to find inventory. Error is '.$wpdb->last_error.'. Search criteria are '.$show.' store tag: '.$search_sku.', keywords: '.$search_kw.'. WHERE is '.$where;
    442         $results = array();
    443         $url = get_site_url();
    444         $test = cwscsLogError("admin", "class-cws-consignment-admin-php", "cwscsGetInventorySold", $url, $tmp);
     434        $tmp = 'Failed to find inventory. Error is '.$wpdb->last_error.'. Search criteria are '.$show.' store tag: '.$search_sku.', keywords: '.$search_kw;
    445435    } elseif (count($items) == 0)
    446436        $results = array();
    … …  
    528518                $to = sanitize_email(wp_unslash($_POST['approved-email']));
    529519                $from = $emails[0];
     520                $from = str_replace("&lt;", "<", $from);
     521                $from = str_replace("&gt;", ">", $from);
    530522
    531523                if (isset($_POST['approved_subject'])) {
    … …  
    546538                    echo '<p class="cwscs_successmsg">An email was sent successfully. </p>';
    547539                else
    548                     echo '<p class="cwscs_failmsg">Could not send email. </p>';
     540                    echo '<p class="cwscs_failmsg">Could not send email</p>';
    549541            }
    550542        }
    … …  
    585577                $post_id = "Unknown ID";
    586578            }
    587             $test = cwscsLogError("admin", "class-cws-consignment-admin-php", "cwscsRejectItem", $url, "Could not delete inventory ".$post_id.'. Error: '.$wpdb->last_error);
    588579            $ok = false;
    589580        }
    … …  
    596587            $to = sanitize_email(wp_unslash($_POST['rejected-email']));
    597588            $from = $emails[0];
     589            $from = str_replace("&lt;", "<", $from);
     590            $from = str_replace("&gt;", ">", $from);
    598591            if (isset($_POST['rejected_subject'])) {
    599592                $subject = wp_unslash( $_POST['rejected_subject'] );
    … …  
    608601                echo '<p class="cwscs_successmsg">An email was sent. </p>';
    609602            else {
    610                 echo '<p class="cwscs_failmsg">Could not send email. </p>';
     603                echo '<p class="cwscs_failmsg">Could not send email</p>';
    611604                $ok = false;
    612605            }
    … …  
    667660            $results = array("status"=>0, "msg"=>$tmp);
    668661            $url = get_site_url();
    669             $test = cwscsLogError("admin", "class-cws-consignment-admin-php", "cwscsGetSettingByKey", $url, $tmp);
    670662        } elseif (count($values) == 0) {
    671663            $results = array("status"=>0, "data"=>"", "msg"=>"");
    … …  
    697689   
    698690    $url = get_site_url();
    699    
     691    if ($cwscs_key = "emails") {
     692        $cwscs_value = str_replace("<", "&lt;", $cwscs_value);
     693        $cwscs_value = str_replace(">", "&gt;", $cwscs_value);
     694    }
    700695    if (!isset($cwscs_key) || $cwscs_key == "") {
    701696        $msg .= 'There was a problem saving the settings because the key was not set. Please refresh and try again.';
    … …  
    705700        // Update or insert?
    706701        $values = cwscsGetSettingByKey($cwscs_key);
    707         if ($values['status'] == 0)
     702        if ($values['status'] == 0) {
    708703            $action = "insert";
    709         else
     704        } else {
    710705            $action = "update";
     706        }
    711707        if ($action == "update") {
    712708            // if value is blank then delete
    … …  
    732728        $file = "class-cws-consignment-admin.php";
    733729        $url = get_site_url();
    734         //cwscsLogError($system, $file, $fcn, $url, $tmp);
    735730        $results = array("status"=>0, "msg"=>$msg);
    736731    }
    … …  
    10111006            'width'  => array(),
    10121007        ),
     1008        'input'        => array(
     1009            'aria-describedby' => array(),   
     1010            'type'    => array(),
     1011            'class'  => array(),
     1012            'name' => array(),
     1013            'id'    => array(),
     1014            'value'  => array(),
     1015            'checked'  => array(),
     1016            'style'  => array(),
     1017        ),
    10131018        'li'         => array(
    10141019            'class' => array(),
    … …  
    10261031        'span'       => array(
    10271032            'class' => array(),
     1033            'id' => array(),
    10281034            'title' => array(),
    10291035            'style' => array(),
    … …  
    10491055            'style' => array(),
    10501056        ),
     1057        'textarea'        => array(
     1058            'class'  => array(),
     1059            'name' => array(),
     1060            'id'    => array(),
     1061        ),
    10511062        'ul'         => array(
    10521063            'class' => array(),

  • consignment-store-for-woocommerce/trunk/admin/partials/cws-consignment-admin-display.php

    r3335016 r3442720  
    1212 * @subpackage cws_consignment/admin/partials
    1313 */
     14if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
    1415///////////////////////////////////////
    1516// SUBMITTED ITEMS display functions
    … …  
    127128                    'textarea_rows'  => 15,
    128129                    'editor_height'  => 300,
    129                     'quicktags'      => true,
    130130                    'tinymce'        => true,
    131131                );
    … …  
    166166                    'textarea_rows'  => 15,
    167167                    'editor_height'  => 300,
    168                     'quicktags'      => true,
    169168                    'tinymce'        => true,
    170169                );
    … …  
    320319    $icons = array("dashicons-admin-tools", "dashicons-category", "dashicons-edit", "dashicons-chart-pie", "dashicons-admin-generic", "dashicons-admin-generic", "dashicons-email-alt");
    321320    $content = cwscsGetSettingsContent();
    322    
    323321    echo '
    324322    <div class="cwscs_tab">';
    … …  
    338336        echo '
    339337        <div id="contenttab_'.esc_html($i).'" class="cwscs_tabcontent cwshidden">
    340             <h3>'.esc_html($tab).'</h3>'.
    341             $content[$i].'
     338            <h3>'.esc_html($tab).'</h3>'.wp_kses($content[$i], cwscs_allowed_html() ).'
    342339        </div>';
    343340       
    … …  
    540537    }
    541538    $ct = '
    542     <p>
    543         <label for="cwscs_from_email">Send emails to customers from this email address:</label>
    544         <br />
    545         <input type="email" name="cwscs_from_email" id="cwscs_from_email" value="'.$cwscs_from_email.'" style="width:350px" aria-describedby="descriptionFromEmail"/><br />
    546         <span id="descriptionFromEmail" class="cwscs_small">Send from email adress (Example: Name &lt;name@domain.com&gt;). Leave blank to use default address.</span>
    547     </p>
    548     <p>
    549         <label for="cwscs_to_email">Send notification emails to:</label><br />
    550         <input type="email" name="cwscs_to_email" id="cwscs_to_email" value="'.$cwscs_to_email.'" style="width:350px" aria-describedby="descriptionToEmail" /><br />
    551         <span id="descriptionToEmail" class="cwscs_small">Send to email adress (Example: Name &lt;name@domain.com&gt;). To notify of an item submitted to the consignment store. If blank, a notification email will not be sent.</span>
    552     </p>
     539    <p><label for="cwscs_from_email">Send emails to customers from this email address:</label></p>
     540    <input type="text" name="cwscs_from_email" id="cwscs_from_email" value="'.$cwscs_from_email.'" style="width:350px" aria-describedby="descriptionFromEmail"/><br />
     541    <span id="descriptionFromEmail" class="cwscs_small">Send from email adress (Example: name &lt;name@domain.com&gt;). Leave blank to use default address.</span>
     542    <p><label for="cwscs_to_email">Send notification emails to:</label></p>
     543    <input type="text" name="cwscs_to_email" id="cwscs_to_email" value="'.$cwscs_to_email.'" style="width:350px" aria-describedby="descriptionToEmail" /><br />
     544    <span id="descriptionToEmail" class="cwscs_small">Send to email adress (Example: name &lt;name@domain.com&gt;). To notify of an item submitted to the consignment store. If blank, a notification email will not be sent.</span>
    553545    <div class="clear"></div>';
    554546    return $ct;

  • consignment-store-for-woocommerce/trunk/cws-consignment.php

    r3412523 r3442720  
    1919 * Requires at least: 6.3
    2020 * Requires PHP:      8.0
    21  * Version:           2.7
     21 * Version:           2.8
    2222 * Author:            Charlene's Web Services
    2323 * Author URI:        https://charlenesweb.ca
    … …  
    3636 * First release 1.0.0 and then using SemVer - https://semver.org X.Y.Z (Major.Minor.Patch)
    3737 */
    38 define( 'CWS_CONSIGNMENT_VERSION', '2.7' );
     38define( 'CWS_CONSIGNMENT_VERSION', '2.8' );
    3939define('CWSCS_SRC_DIR', dirname(__FILE__) );
    4040/**

  • consignment-store-for-woocommerce/trunk/includes/class-cws-consignment-loader.php

    r2600130 r3442720  
    2222 * @author     Charlene Copeland <charlene@charlenesweb.ca>
    2323 */
     24if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     25
    2426class cws_consignment_Loader {
    2527

  • consignment-store-for-woocommerce/trunk/includes/class-cws-consignment.php

    r3412523 r3442720  
    2828 * @author     Charlene Copeland <charlene@charlenesweb.ca>
    2929 */
     30if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     31
    3032#[AllowDynamicProperties]
     33
    3134class cws_consignment {
    3235
    … …  
    7275            $this->version = CWS_CONSIGNMENT_VERSION;
    7376        } else {
    74             $this->version = '2.7';
     77            $this->version = '2.8';
    7578        }
    7679        $this->plugin_name = 'cws-consignment';
    … …  
    191194    }
    192195}
     196if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly

  • consignment-store-for-woocommerce/trunk/public/class-cws-consignment-public.php

    r3336736 r3442720  
    2121 * @author     Charlene Copeland <charlene@charlenesweb.ca>
    2222 */
     23if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
     24
    2325#[AllowDynamicProperties]
     26
    2427class cws_consignment_Public {
    2528
    … …  
    145148       
    146149        // Was additem form submitted?
    147         if (isset($_POST['item_cat'])) {
     150        if (isset($_POST) && is_array($_POST) && isset($_POST['item_cat']) && $_POST['item_cat'] != "") {
    148151            $ok = true;
    149152            // check sku if admin
    … …  
    236239                    if (is_array($email_settings) && count($email_settings) == 2 && $email_settings[1] != "") {
    237240                        $from = $email_settings[0];
     241                        $from = str_replace("&lt;", "<", $from);
     242                        $from = str_replace("&gt;", ">", $from);
    238243                        $to = $email_settings[1];
    239244                        if (isset($_POST['item_retail'])) {
    … …  
    341346        $splits = cwscsGetMySplits();
    342347        $policy = cwscsGetMyPolicy();
    343        
    344         unset($_POST); // prevent double submission
     348
    345349        $ct .= '<br />
    346350        <div class="additemform" id="cwscs_additemdiv">';
    … …  
    661665        $status = 0;
    662666    }
    663     if (isset($post['sku']) && $post['sku'] |= "") {
     667    if (isset($post['sku']) && $post['sku'] != "") {
    664668        $woo = cwscsGetWooBySku($post['sku']);
    665669        if (isset($woo['status']) && $woo['status'] == 1) {
    … …  
    697701        $file = "class-cws-consignment-public.php";
    698702        $url = get_site_url();
    699         cwscsLogErrror($system, $file, $fcn, $url, $tmp);
    700703    } else {
    701704        $result = $wpdb->insert_id;

  • consignment-store-for-woocommerce/trunk/uninstall.php

    r3312681 r3442720  
    2626 */
    2727
    28 // If uninstall not called from WordPress, then exit.
     28// if uninstall.php is not called by WordPress, die
    2929if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
    30     exit;
     30    die;
    3131}
     32
    3233global $wpdb;
    3334$wpdb->query( "DROP TABLE IF EXISTS ".$wpdb->prefix . "cwscs_inventory"); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
Note: See TracChangeset for help on using the changeset viewer.