diff --git a/CHANGELOG.md b/CHANGELOG.md index 5e0907d..259aa4d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,14 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/). ## Released +## [2.7.8](https://github.com/kabisa/wuunder-webshopplugin-woocommerce/tag/2.7.8) - 2019-10-30 + +### Added +- Support sanitize functions + +### Fixed +- Removed curl functions and use WP functions for getting filesize of images + ## [2.7.7](https://github.com/kabisa/wuunder-webshopplugin-woocommerce/tag/2.7.7) - 2019-10-11 ### Added diff --git a/includes/checkout.php b/includes/checkout.php index 0249446..472eefc 100644 --- a/includes/checkout.php +++ b/includes/checkout.php @@ -189,12 +189,12 @@ function wcwp_update_parcelshop_id($order_id) add_action('woocommerce_checkout_process', 'wcwp_check_parcelshop_selection'); function wcwp_check_parcelshop_selection() { - if ('wuunder_parcelshop' === $_POST['shipping_method'][0]) { + if ('wuunder_parcelshop' === sanitize_text_field($_POST['shipping_method'][0])) { if (!$_POST['parcelshop_id']) { wc_add_notice(__('Kies eerst een parcelshop'), 'error'); } - if ($_POST['shipping_country'] != $_POST['parcelshop_country']) { + if (!isset($_POST['shipping_country']) || $_POST['shipping_country'] != $_POST['parcelshop_country']) { wc_add_notice(__('Het land van de verzendgegevens moet overeenkomen met het land van de parcelshop '), 'error'); } } diff --git a/includes/parcelshop.php b/includes/parcelshop.php index 69cd6c6..15b11d7 100644 --- a/includes/parcelshop.php +++ b/includes/parcelshop.php @@ -7,7 +7,7 @@ function wcwp_parcelShopLocator() $apiKey = ( 'productie' == $status ? get_option( 'wc_wuunder_api' ) : get_option( 'wc_wuunder_test_api' ) ); if( ! empty( $_POST['address'] ) ) { - $shipping_address = $_POST['address']; + $shipping_address = sanitize_text_field($_POST['address']); } else { $shipping_address = ''; $shipping_address .= ( ! empty(WC()->customer->get_shipping_address() ) ? WC()->customer->get_shipping_address() . ' ' : '' ); @@ -43,7 +43,7 @@ function wcwp_getAddress() { $shipping_address = null; if(!empty($_POST['address'])) { - $shipping_address = $_POST['address']; + $shipping_address = sanitize_text_field($_POST['address']); } else { $shipping_address .= (!empty(WC()->customer->get_shipping_address()) ? WC()->customer->get_shipping_address() . " " : ""); @@ -58,7 +58,6 @@ function wcwp_getAddress() { function wcwp_getParcelshopAddress() { $shipping_address = null; - if(empty($_POST['parcelshop_id'])) { echo null; } else { @@ -70,7 +69,7 @@ function wcwp_getParcelshopAddress() { $parcelshopRequest = $connector->getParcelshopById(); $parcelshopConfig = new \Wuunder\Api\Config\ParcelshopConfig(); - $parcelshopConfig->setId($_POST['parcelshop_id']); + $parcelshopConfig->setId(sanitize_text_field($_POST['parcelshop_id'])); if ($parcelshopConfig->validate()) { $parcelshopRequest->setConfig($parcelshopConfig); diff --git a/includes/wcwuunder-create.php b/includes/wcwuunder-create.php index 5ae601b..098c34a 100644 --- a/includes/wcwuunder-create.php +++ b/includes/wcwuunder-create.php @@ -12,7 +12,7 @@ public function __construct() { $this->version_obj = array( 'product' => 'Woocommerce extension', 'version' => array( - 'build' => '2.7.7 ', + 'build' => '2.7.8 ', 'plugin' => '2.0' ), 'platform' => array( 'name' => 'Woocommerce', @@ -33,8 +33,8 @@ public function wcwp_sample_admin_notice__error() { if ( 'error' == isset( $_GET['notice'] ) && $_GET['notice'] ) { $class = 'notice notice-error'; - $message = __( 'Het aanmaken van het label voor #' . $_GET['id'] . ' is mislukt', 'woocommerce-wuunder' ); - $errors = $_GET['error_melding']; + $message = __( 'Het aanmaken van het label voor #' . sanitize_text_field($_GET['id']) . ' is mislukt', 'woocommerce-wuunder' ); + $errors = sanitize_text_field($_GET['error_melding']); $message .= '