Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prevent sprintf errors by escaping % in form title #1486

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Prevent sprintf errors by escaping % in form title #1486

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
75237f5
Prevent sprintf errors by escaping % in form title
krokodok May 15, 2024
4648e99
Escape all user input values
krokodok Jun 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 17 additions & 17 deletions connectors/class-connector-gravityforms.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,7 +221,7 @@ public function register() {
* @param bool $is_new Is this a new form?.
*/
public function callback_gform_after_save_form( $form, $is_new ) {
$title = $form['title'];
$title = str_replace( '%', '%%', $form['title'] );
$id = $form['id'];

$this->log(
Expand Down Expand Up @@ -258,9 +258,9 @@ public function callback_gform_pre_confirmation_save( $confirmation, $form, $is_
sprintf(
/* translators: %1$s: a confirmation name, %2$s: a status, %3$s: a form title (e.g. "Email", "created", "Contact Form") */
__( '"%1$s" confirmation %2$s for "%3$s"', 'stream' ),
$confirmation['name'],
str_replace( '%', '%%', $confirmation['name'] ),
$is_new ? esc_html__( 'created', 'stream' ) : esc_html__( 'updated', 'stream' ),
$form['title']
str_replace( '%', '%%', $form['title'] )
),
array(
'is_new' => $is_new,
Expand Down Expand Up @@ -291,9 +291,9 @@ public function callback_gform_pre_notification_save( $notification, $form, $is_
sprintf(
/* translators: %1$s: a notification name, %2$s: a status, %3$s: a form title (e.g. "Email", "created", "Contact Form") */
__( '"%1$s" notification %2$s for "%3$s"', 'stream' ),
$notification['name'],
str_replace( '%', '%%', $notification['name'] ),
$is_new ? esc_html__( 'created', 'stream' ) : esc_html__( 'updated', 'stream' ),
$form['title']
str_replace( '%', '%%', $form['title'] )
),
array(
'is_update' => $is_new,
Expand All @@ -318,8 +318,8 @@ public function callback_gform_pre_notification_deleted( $notification, $form )
sprintf(
/* translators: %1$s: a notification name, %2$s: a form title (e.g. "Email", "Contact Form") */
__( '"%1$s" notification deleted from "%2$s"', 'stream' ),
$notification['name'],
$form['title']
str_replace( '%', '%%', $notification['name'] ),
str_replace( '%', '%%', $form['title'] )
),
array(
'form_id' => $form['id'],
Expand All @@ -342,8 +342,8 @@ public function callback_gform_pre_confirmation_deleted( $confirmation, $form )
sprintf(
/* translators: %1$s: a confirmation name, %2$s: a form title (e.g. "Email", "Contact Form") */
__( '"%1$s" confirmation deleted from "%2$s"', 'stream' ),
$confirmation['name'],
$form['title']
str_replace( '%', '%%', $confirmation['name'] ),
str_replace( '%', '%%', $form['title'] )
),
array(
'form_id' => $form['id'],
Expand All @@ -367,9 +367,9 @@ public function callback_gform_confirmation_status( $confirmation, $form, $is_ac
sprintf(
/* translators: %1$s: a confirmation name, %2$s: a status, %3$s: a form title (e.g. "Email", "activated", "Contact Form") */
__( '"%1$s" confirmation %2$s from "%3$s"', 'stream' ),
$confirmation['name'],
str_replace( '%', '%%', $confirmation['name'] ),
$is_active ? esc_html__( 'activated', 'stream' ) : esc_html__( 'deactivated', 'stream' ),
$form['title']
str_replace( '%', '%%', $form['title'] )
),
array(
'form_id' => $form['id'],
Expand All @@ -394,9 +394,9 @@ public function callback_gform_notification_status( $notification, $form, $is_ac
sprintf(
/* translators: %1$s: a notification name, %2$s: a status, %3$s: a form title (e.g. "Email", "activated", "Contact Form") */
__( '"%1$s" notification %2$s from "%3$s"', 'stream' ),
$notification['name'],
str_replace( '%', '%%', $notification['name'] ),
$is_active ? esc_html__( 'activated', 'stream' ) : esc_html__( 'deactivated', 'stream' ),
$form['title']
str_replace( '%', '%%', $form['title'] )
),
array(
'form_id' => $form['id'],
Expand Down Expand Up @@ -756,7 +756,7 @@ public function callback_gform_update_status( $lead_id, $status, $prev = '' ) {
__( 'Lead #%1$d %2$s on "%3$s" form', 'stream' ),
$lead_id,
$actions[ $status ],
$form['title']
str_replace( '%', '%%', $form['title'] )
),
array(
'lead_id' => $lead_id,
Expand Down Expand Up @@ -791,7 +791,7 @@ public function callback_gform_update_is_read( $lead_id, $status ) {
$lead_id,
$status,
$form['id'],
$form['title']
str_replace( '%', '%%', $form['title'] )
),
array(
'lead_id' => $lead_id,
Expand Down Expand Up @@ -826,7 +826,7 @@ public function callback_gform_update_is_starred( $lead_id, $status ) {
$lead_id,
$status,
$form['id'],
$form['title']
str_replace( '%', '%%', $form['title'] )
),
array(
'lead_id' => $lead_id,
Expand Down Expand Up @@ -945,7 +945,7 @@ public function log_form_action( $form_id, $action ) {
/* translators: %1$d: an ID, %2$s: a form title, %3$s: a status (e.g. "42", "Contact Form", "Activated") */
__( 'Form #%1$d ("%2$s") %3$s', 'stream' ),
$form_id,
$form['title'],
str_replace( '%', '%%', $form['title'] ),
strtolower( $actions[ $action ] )
),
array(
Expand Down