diff --git a/changelog.txt b/changelog.txt index 803777782dddfaaed36a5d04a9fed23c2e85f6e6..5a82bf16c704465f3157e0b1e3256a4bf714da90 100644 --- a/changelog.txt +++ b/changelog.txt @@ -1,5 +1,9 @@ # Changelog +## [2.4.9] - 2021-09-28 +### Fixed +- Prevent form fields from being deleted by escaping functions + ## [2.4.8] - 2021-09-27 ### Fixed - Add escaping functions to all templates diff --git a/templates/button.php b/templates/button.php index fd95750148a4356e87383c2aaaef789f4cc9a6fe..214417d3968ccc53ed7713ec66e35f2d5ee3b2d3 100644 --- a/templates/button.php +++ b/templates/button.php @@ -33,3 +33,4 @@ readonly="readonly"<?php endif; ?> ><?php echo \esc_html( $field->get_label() ); ?></button> + diff --git a/templates/form-field.php b/templates/form-field.php index 0fd07d5ef880bdee34de0d879e5c05299c846860..375e8233076eaf2b2a43a2f1fd460e529fab9ac2 100644 --- a/templates/form-field.php +++ b/templates/form-field.php @@ -11,22 +11,12 @@ <tr valign="top"> <?php if ( $field->has_label() ) : ?> - <?php echo wp_kses_post( $renderer->render( 'form-label', [ 'field' => $field ] ) ); ?> + <?php echo $renderer->render( 'form-label', [ 'field' => $field ] ); // phpcs:ignore ?> <?php endif; ?> <td class="forminp"> <?php - echo wp_kses_post( - $renderer->render( - $template_name, - [ - 'field' => $field, - 'renderer' => $renderer, - 'name_prefix' => $name_prefix, - 'value' => $value, - ] - ) - ); + echo $renderer->render( $template_name, [ 'field' => $field, 'renderer' => $renderer, 'name_prefix' => $name_prefix, 'value' => $value ]); // phpcs:ignore ?> <?php if ( $field->has_description() ) : ?> diff --git a/templates/form-label.php b/templates/form-label.php index 8eeaf286cfcf1622a9e3a73d2b93841e9c495944..9d960fe6adef8f6006108e456d25814dd99c0c0d 100644 --- a/templates/form-label.php +++ b/templates/form-label.php @@ -9,7 +9,7 @@ <th class="titledesc" scope="row"> <label for="<?php echo \esc_attr( $field->get_id() ); ?>"><?php echo \esc_html( $field->get_label() ); ?> <?php if ( $field->has_description_tip() ) : ?> - <?php echo esc_html( wc_help_tip( $field->get_description_tip() ) ); ?> + <?php echo wp_kses_post( wc_help_tip( $field->get_description_tip() ) ); ?> <?php endif ?> </label> </th> diff --git a/templates/input-checkbox.php b/templates/input-checkbox.php index 8474091fbb6d8db0e476178312bb6f471f409e00..d843e9d7daf2ec275d1c7fc86c6555d6e59427cd 100644 --- a/templates/input-checkbox.php +++ b/templates/input-checkbox.php @@ -10,14 +10,4 @@ ?> <?php -echo wp_kses_post( - $renderer->render( - 'input', - [ - 'field' => $field, - 'renderer' => $renderer, - 'name_prefix' => $name_prefix, - 'value' => $value, - ] - ) -); +echo $renderer->render( 'input', [ 'field' => $field, 'renderer' => $renderer, 'name_prefix' => $name_prefix, 'value' => $value ] ); // phpcs:ignore; diff --git a/templates/input-date-picker.php b/templates/input-date-picker.php index 3caa4c6b576606555c250c489df9f4b9bdd44a76..4257825e9fa9b3fd897dbb030388ebfe402f6cff 100644 --- a/templates/input-date-picker.php +++ b/templates/input-date-picker.php @@ -7,14 +7,5 @@ * @var string $template_name Real field template. */ -echo wp_kses_post( - $renderer->render( - 'input', - [ - 'field' => $field, - 'renderer' => $renderer, - 'name_prefix' => $name_prefix, - 'value' => $value, - ] - ) -); +echo $renderer->render( 'input',[ 'field' => $field, 'renderer' => $renderer, 'name_prefix' => $name_prefix, 'value' => $value ]); // phpcs:ignore + diff --git a/templates/input-hidden.php b/templates/input-hidden.php index 638855251f89759e07211a11a1d4d797fc026a58..41957f038dab13700dc7f2b9c330b87085a2e5c1 100644 --- a/templates/input-hidden.php +++ b/templates/input-hidden.php @@ -9,14 +9,4 @@ ?> <?php -echo wp_kses_post( - $renderer->render( - 'input', - [ - 'field' => $field, - 'renderer' => $renderer, - 'name_prefix' => $name_prefix, - 'value' => $value, - ] - ) -); +echo $renderer->render( 'input', [ 'field' => $field, 'renderer' => $renderer, 'name_prefix' => $name_prefix, 'value' => $value ] ); // phpcs:ignore diff --git a/templates/input-image.php b/templates/input-image.php index 5111c4c2c5af3cc159eb7e44597f4b46a5a5bf22..ce099e45930db93421a05db736286b4ddf9f7b47 100644 --- a/templates/input-image.php +++ b/templates/input-image.php @@ -13,17 +13,25 @@ $media_container_id = 'media_' . sanitize_key( $field->get_id() ); id="<?php echo \esc_attr( $field->get_id() ); ?>"/> <div class="custom-img-container"> <?php if ( $value ) : ?> - <img src="<?php echo \esc_url( $value ) ?>" alt="" width="100"/> + <img src="<?php echo \esc_url( $value ); ?>" alt="" width="100"/> <?php endif; ?> - </div> - <p class="hide-if-no-js"> - <a class="upload-custom-img <?php if ( $value ): ?>hidden<?php endif ?>" href="<?php echo \esc_url( $value ) ?>"> - <?php \esc_html_e( 'Set image', 'wp-forms' ) ?> - </a> - <a class="delete-custom-img <?php if ( ! $value ): ?>hidden<?php endif ?>" href="#"> - <?php \esc_html_e( 'Remove image', 'wp-forms' ) ?> - </a> - </p> + </div> + <p class="hide-if-no-js"> + <a class="upload-custom-img + <?php + if ( $value ) : + ?> + hidden<?php endif ?>" href="<?php echo \esc_url( $value ); ?>"> + <?php \esc_html_e( 'Set image', 'wp-forms' ); ?> + </a> + <a class="delete-custom-img + <?php + if ( ! $value ) : + ?> + hidden<?php endif ?>" href="#"> + <?php \esc_html_e( 'Remove image', 'wp-forms' ); ?> + </a> + </p> </div> <script> jQuery( function ( $ ) { diff --git a/templates/input-number.php b/templates/input-number.php index 3caa4c6b576606555c250c489df9f4b9bdd44a76..55971092502a5540d1fcd0e916c81bf24de84642 100644 --- a/templates/input-number.php +++ b/templates/input-number.php @@ -7,14 +7,4 @@ * @var string $template_name Real field template. */ -echo wp_kses_post( - $renderer->render( - 'input', - [ - 'field' => $field, - 'renderer' => $renderer, - 'name_prefix' => $name_prefix, - 'value' => $value, - ] - ) -); +echo $renderer->render( 'input', ['field' => $field, 'renderer' => $renderer, 'name_prefix' => $name_prefix,'value' => $value ] ); // phpcs:ignore diff --git a/templates/input-radio.php b/templates/input-radio.php index 638855251f89759e07211a11a1d4d797fc026a58..5ba991ff411f355b1b6869d6dbff0c991e232c2f 100644 --- a/templates/input-radio.php +++ b/templates/input-radio.php @@ -9,14 +9,4 @@ ?> <?php -echo wp_kses_post( - $renderer->render( - 'input', - [ - 'field' => $field, - 'renderer' => $renderer, - 'name_prefix' => $name_prefix, - 'value' => $value, - ] - ) -); +echo $renderer->render( 'input', [ 'field' => $field, 'renderer' => $renderer, 'name_prefix' => $name_prefix, 'value' => $value ] ); // phpcs:ignore diff --git a/templates/input-text.php b/templates/input-text.php index 3caa4c6b576606555c250c489df9f4b9bdd44a76..a45c64c9f643cdb6359f52877b1e39f08f21dd7c 100644 --- a/templates/input-text.php +++ b/templates/input-text.php @@ -7,14 +7,4 @@ * @var string $template_name Real field template. */ -echo wp_kses_post( - $renderer->render( - 'input', - [ - 'field' => $field, - 'renderer' => $renderer, - 'name_prefix' => $name_prefix, - 'value' => $value, - ] - ) -); +echo $renderer->render( 'input', [ 'field' => $field, 'renderer' => $renderer, 'name_prefix' => $name_prefix, 'value' => $value ] ); // phpcs:ignore