WordPress.org
Get WordPress

Plugin Directory

Changeset 3444528


Ignore:
Timestamp:
01/22/2026 04:16:53 AM (2 months ago)
Author:
codemenschen
Message:

Version 4.6.3 - Released: January 22, 2026

Location:
gift-voucher
Files:
975 added
9 edited

Legend:

Unmodified
Added
Removed

  • gift-voucher/trunk/classes/voucher.php

    r3262503 r3444528  
    190190            }
    191191
    192             $where_clause = " WHERE `order_type` = %s";
    193             $params       = [($itemorder) ? 'items' : 'vouchers'];
    194 
    195             if ($search && $voucher_code) {
    196                 $where_clause .= " AND (`couponcode` = %s OR `shipping_email` = %s)";
    197                 array_push($params, $voucher_code, $search_email);
    198             }
    199 
    200             if ($page === 'redeem-voucher') {
    201                 $where_clause .= " AND (`couponcode` = %s OR `shipping_email` = %s)";
    202                 array_push($params, $voucher_code, $search_email);
    203             }
    204 
    205             $result = $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}giftvouchers_list {$where_clause}", ...$params));
    206 
     192            $order_type = ($itemorder) ? 'items' : 'vouchers';
     193
     194            // Build query based on conditions
     195            if ($search && $voucher_code && $page === 'redeem-voucher') {
     196                // Both search and redeem-voucher page
     197                $result = $wpdb->get_var(
     198                    $wpdb->prepare(
     199                        "SELECT COUNT(*) FROM {$wpdb->prefix}giftvouchers_list WHERE `order_type` = %s AND (`couponcode` = %s OR `shipping_email` = %s) AND (`couponcode` = %s OR `shipping_email` = %s)",
     200                        $order_type,
     201                        $voucher_code,
     202                        $search_email,
     203                        $voucher_code,
     204                        $search_email
     205                    )
     206                );
     207            } elseif ($search && $voucher_code) {
     208                // Search only
     209                $result = $wpdb->get_var(
     210                    $wpdb->prepare(
     211                        "SELECT COUNT(*) FROM {$wpdb->prefix}giftvouchers_list WHERE `order_type` = %s AND (`couponcode` = %s OR `shipping_email` = %s)",
     212                        $order_type,
     213                        $voucher_code,
     214                        $search_email
     215                    )
     216                );
     217            } elseif ($page === 'redeem-voucher') {
     218                // Redeem-voucher page only
     219                $result = $wpdb->get_var(
     220                    $wpdb->prepare(
     221                        "SELECT COUNT(*) FROM {$wpdb->prefix}giftvouchers_list WHERE `order_type` = %s AND (`couponcode` = %s OR `shipping_email` = %s)",
     222                        $order_type,
     223                        $voucher_code,
     224                        $search_email
     225                    )
     226                );
     227            } else {
     228                // Base query only
     229                $result = $wpdb->get_var(
     230                    $wpdb->prepare(
     231                        "SELECT COUNT(*) FROM {$wpdb->prefix}giftvouchers_list WHERE `order_type` = %s",
     232                        $order_type
     233                    )
     234                );
     235            }
    207236
    208237            return $result;

  • gift-voucher/trunk/gift-voucher.php

    r3412727 r3444528  
    77 * Author: Codemenschen GmbH
    88 * Author URI: https://www.codemenschen.at/
    9  * Version: 4.6.2
     9 * Version: 4.6.3
    1010 * Text Domain: gift-voucher
    1111 * Domain Path: /languages
    … …  
    3939}
    4040
    41 define('WPGIFT_VERSION', '4.6.2');
     41define('WPGIFT_VERSION', '4.6.3');
    4242define('WPGIFT__MINIMUM_WP_VERSION', '4.0');
    4343define('WPGIFT__PLUGIN_DIR', untrailingslashit(plugin_dir_path(__FILE__)));

  • gift-voucher/trunk/readme.txt

    r3412727 r3444528  
    44Requires at least: 4.0
    55Tested up to: 6.9
    6 Stable tag: 4.6.2
     6Stable tag: 4.6.3
    77Requires PHP: 5.6
    88License: GPLv2 or later
    … …  
    226226== Changelog ==
    227227
     228= Version 4.6.3 - Released: January 22, 2026 =
     229* Fix: Secure database query in `classes/voucher.php::record_count()` by building the full SQL and using `$wpdb->prepare()` with bound parameters to avoid unescaped DB parameters.
     230* Fix: Add direct file access protection to `templates/wpgv_item_pdf.php`, `templates/wpgv_voucher_pdf.php`, and `templates/pdfstyles/receipt.php`, `templates/pdfstyles/style1.php`, `templates/pdfstyles/style2.php`, `templates/pdfstyles/style3.php` by checking `if ( ! defined( 'ABSPATH' ) ) exit;` to prevent direct access.
     231
    228232= Version 4.6.2 - Released: December 06, 2025 =
    229233* Improvement: Unicode and special character support improved for all user input fields and currency symbols in PDF exports and admin UI.

  • gift-voucher/trunk/templates/pdfstyles/receipt.php

    r3412727 r3444528  
    11<?php
    2 
     2if ( ! defined( 'ABSPATH' ) ) {
     3    exit;
     4}
    35$receipt = new WPGV_PDF('P', 'pt', array(595, 900));
    46$receipt->SetAutoPageBreak(0);

  • gift-voucher/trunk/templates/pdfstyles/style1.php

    r3412727 r3444528  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) {
     3    exit;
     4}
    25
    36// PDF Style 1

  • gift-voucher/trunk/templates/pdfstyles/style2.php

    r3412727 r3444528  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) {
     3    exit;
     4}
    25
    36// PDF Style 2

  • gift-voucher/trunk/templates/pdfstyles/style3.php

    r3401530 r3444528  
    11<?php
     2if ( ! defined( 'ABSPATH' ) ) {
     3    exit;
     4}
    25
    36// PDF Style 3

  • gift-voucher/trunk/templates/wpgv_item_pdf.php

    r3299113 r3444528  
    11<?php
     2if (!defined('ABSPATH')) exit; // Prevent direct access
    23/*
    34 * Template Name: PDF Viewer Page Template

  • gift-voucher/trunk/templates/wpgv_voucher_pdf.php

    r3299113 r3444528  
    11<?php
     2if (!defined('ABSPATH')) exit; // Prevent direct access
    23/*
    34 * Template Name: PDF Viewer Page Template
Note: See TracChangeset for help on using the changeset viewer.