Steve-Dee-Designs
/
woocommerce
mirror of https://github.com/woocommerce/woocommerce.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[3.2.4] Sanitization #1575

This commit is contained in:
Coen Jacobs 2012-10-18 12:33:47 +02:00
parent aef75800c9
commit 9769b8851f
12 changed files with 119 additions and 114 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
classes/class-wc-cart.php
View File

@ -387,13 +387,15 @@ class WC_Cart {
if ( is_array( $coupon->customer_email ) && sizeof( $coupon->customer_email ) > 0 ) {
$coupon->customer_email = array_map( 'sanitize_email', $coupon->customer_email );
if ( is_user_logged_in() ) {
$current_user = wp_get_current_user();
$check_emails[] = $current_user->user_email;
}
$check_emails[] = $posted['billing_email'];
$check_emails = array_map( 'strtolower', $check_emails );
$check_emails = array_map( 'sanitize_email', array_map( 'strtolower', $check_emails ) );
if ( 0 == sizeof( array_intersect( $check_emails, $coupon->customer_email ) ) ) {
$woocommerce->add_error( sprintf( __( 'Sorry, it seems the coupon "%s" is not yours - it has now been removed from your order.', 'woocommerce' ), $code ) );

12
classes/class-wc-countries.php
View File

@ -446,10 +446,10 @@ class WC_Countries {
* @return string
*/
function get_base_country() {
$default = get_option('woocommerce_default_country');
if (($pos = strpos($default, ':')) === false)
$default = esc_attr( get_option('woocommerce_default_country') );
if ( ( $pos = strpos( $default, ':' ) ) === false )
return $default;
return substr($default, 0, $pos);
return substr( $default, 0, $pos );
}
@ -460,10 +460,10 @@ class WC_Countries {
* @return string
*/
function get_base_state() {
$default = get_option('woocommerce_default_country');
if (($pos = strrpos($default, ':')) === false)
$default = esc_attr( get_option( 'woocommerce_default_country' ) );
if ( ( $pos = strrpos( $default, ':' ) ) === false )
return '';
return substr($default, $pos + 1);
return substr( $default, $pos + 1 );
}

30
classes/class-wc-coupon.php
View File

@ -80,21 +80,21 @@ class WC_Coupon {
$coupon_data = apply_filters('woocommerce_get_shop_coupon_data', false, $code);
if ($coupon_data) :
$this->id = $coupon_data['id'];
$this->type = $coupon_data['type'];
$this->amount = $coupon_data['amount'];
$this->individual_use = $coupon_data['individual_use'];
$this->product_ids = $coupon_data['product_ids'];
$this->exclude_product_ids = $coupon_data['exclude_product_ids'];
$this->usage_limit = $coupon_data['usage_limit'];
$this->usage_count = $coupon_data['usage_count'];
$this->expiry_date = $coupon_data['expiry_date'];
$this->apply_before_tax = $coupon_data['apply_before_tax'];
$this->free_shipping = $coupon_data['free_shipping'];
$this->product_categories = $coupon_data['product_categories'];
$this->exclude_product_categories = $coupon_data['exclude_product_categories'];
$this->minimum_amount = $coupon_data['minimum_amount'];
$this->customer_email = $coupon_data['customer_email'];
$this->id = absint( $coupon_data['id'] );
$this->type = esc_html( $coupon_data['type'] );
$this->amount = esc_html( $coupon_data['amount'] );
$this->individual_use = esc_html( $coupon_data['individual_use'] );
$this->product_ids = ( is_array( $coupon_data['product_ids'] ) ) ? $coupon_data['product_ids'] : array();
$this->exclude_product_ids = ( is_array( $coupon_data['exclude_product_ids'] ) ) ? $coupon_data['exclude_product_ids'] : array();
$this->usage_limit = absint( $coupon_data['usage_limit'] );
$this->usage_count = absint( $coupon_data['usage_count'] );
$this->expiry_date = esc_html( $coupon_data['expiry_date'] );
$this->apply_before_tax = esc_html( $coupon_data['apply_before_tax'] );
$this->free_shipping = esc_html( $coupon_data['free_shipping'] );
$this->product_categories = ( is_array( $coupon_data['product_categories'] ) ) ? $coupon_data['product_categories'] : array();
$this->exclude_product_categories = ( is_array( $coupon_data['exclude_product_categories'] ) ) ? $coupon_data['exclude_product_categories'] : array();
$this->minimum_amount = esc_html( $coupon_data['minimum_amount'] );
$this->customer_email = esc_html( $coupon_data['customer_email'] );
return true;
else:
$coupon_id = $wpdb->get_var( $wpdb->prepare( "SELECT ID FROM $wpdb->posts WHERE BINARY post_title = %s AND post_type= %s", $this->code, 'shop_coupon' ) );

4
classes/class-wc-customer.php
View File

@ -35,11 +35,11 @@ class WC_Customer {
}
$this->_data = array(
'country' => $country,
'country' => esc_html( $country ),
'state' => '',
'postcode' => '',
'city' => '',
'shipping_country' => $country,
'shipping_country' => esc_html( $country ),
'shipping_state' => '',
'shipping_postcode' => '',
'shipping_city' => '',

2
classes/class-wc-logger.php
View File

@ -34,7 +34,7 @@ class WC_Logger {
*/
function __destruct() {
foreach ( $this->handles as $handle )
fclose( $handle );
fclose( escapeshellarg( $handle ) );
}

4
classes/class-wc-order.php
View File

@ -1127,9 +1127,11 @@ class WC_Order {
*/
function add_order_note( $note, $is_customer_note = 0 ) {
$is_customer_note = intval( $is_customer_note );
$comment_post_ID = $this->id;
$comment_author = __( 'WooCommerce', 'woocommerce' );
$comment_author_email = strtolower( __( 'WooCommerce', 'woocommerce' ) ) . '@' . str_replace('www.', '', $_SERVER['HTTP_HOST']);
$comment_author_email = sanitize_email( strtolower( __( 'WooCommerce', 'woocommerce' ) ) . '@' . str_replace( 'www.', '', $_SERVER['HTTP_HOST'] ) );
$comment_author_url = '';
$comment_content = $note;
$comment_agent = 'WooCommerce';

25
classes/class-wc-product-variation.php
View File

@ -60,14 +60,14 @@ class WC_Product_Variation extends WC_Product {
* Loads all product data from custom fields
*
* @access public
* @param mixed $variation_id ID of the variation to load
* @param int $variation_id ID of the variation to load
* @param int $parent_id (default: '') ID of the parent product
* @param array $parent_custom_fields (default: '') Array of the parent products meta data
* @return void
*/
function __construct( $variation_id, $parent_id = '', $parent_custom_fields = '' ) {
$this->variation_id = $variation_id;
$this->variation_id = intval( $variation_id );
$product_custom_fields = get_post_custom( $this->variation_id );
@ -77,13 +77,14 @@ class WC_Product_Variation extends WC_Product {
if ( ! strstr( $name, 'attribute_' ) ) continue;
$this->variation_data[$name] = $value[0];
$this->variation_data[ $name ] = $value[0];
}
/* Get main product data from parent */
$this->id = ($parent_id>0) ? $parent_id : wp_get_post_parent_id( $this->variation_id );
if (!$parent_custom_fields) $parent_custom_fields = get_post_custom( $this->id );
$this->id = ( $parent_id > 0 ) ? intval( $parent_id ) : wp_get_post_parent_id( $this->variation_id );
if ( ! $parent_custom_fields ) $parent_custom_fields = get_post_custom( $this->id );
// Define the data we're going to load from the parent: Key => Default value
$load_data = array(
@ -108,7 +109,7 @@ class WC_Product_Variation extends WC_Product {
// Load the data from the custom fields
foreach ( $load_data as $key => $default )
$this->$key = ( isset( $parent_custom_fields['_' . $key][0] ) && $parent_custom_fields['_' . $key][0] !== '' ) ? $parent_custom_fields['_' . $key][0] : $default;
$this->$key = ( isset( $parent_custom_fields['_' . $key ][0] ) && $parent_custom_fields['_' . $key ][0] !== '' ) ? $parent_custom_fields['_' . $key ][0] : $default;
$this->product_type = 'variable';
@ -379,10 +380,16 @@ class WC_Product_Variation extends WC_Product {
* @return string
*/
function get_shipping_class() {
if (!$this->variation_shipping_class) :
if ( ! $this->variation_shipping_class ) {
$classes = get_the_terms( $this->variation_id, 'product_shipping_class' );
if ($classes && !is_wp_error($classes)) $this->variation_shipping_class = current($classes)->slug; else $this->variation_shipping_class = parent::get_shipping_class();
endif;
if ( $classes && ! is_wp_error( $classes ) ) {
$this->variation_shipping_class = esc_attr( current( $classes )->slug );
} else {
$this->variation_shipping_class = parent::get_shipping_class();
}
}
return $this->variation_shipping_class;
}

108
classes/class-wc-product.php
View File

@ -205,31 +205,26 @@ class WC_Product {
*/
function get_total_stock() {
if (is_null($this->total_stock)) :
if ( is_null( $this->total_stock ) ) {
$transient_name = 'wc_product_total_stock_' . $this->id;
if ( false === ( $this->total_stock = get_transient( $transient_name ) ) ) :
if ( false === ( $this->total_stock = get_transient( $transient_name ) ) ) {
$this->total_stock = $this->stock;
if (sizeof($this->get_children())>0) foreach ($this->get_children() as $child_id) :
if ( sizeof( $this->get_children() ) > 0 ) {
foreach ($this->get_children() as $child_id) {
$stock = get_post_meta( $child_id, '_stock', true );
$stock = get_post_meta($child_id, '_stock', true);
if ( $stock!='' ) :
$this->total_stock += $stock;
endif;
endforeach;
if ( $stock != '' ) {
$this->total_stock += intval( $stock );
}
}
}
set_transient( $transient_name, $this->total_stock );
endif;
endif;
}
}
return (int) $this->total_stock;
}
@ -917,11 +912,11 @@ class WC_Product {
* @return string
*/
function get_price_html( $price = '' ) {
if ($this->is_type('grouped')) :
if ( $this->is_type( 'grouped' ) ) {
$child_prices = array();
foreach ($this->get_children() as $child_id) $child_prices[] = get_post_meta( $child_id, '_price', true );
foreach ( $this->get_children() as $child_id ) $child_prices[] = get_post_meta( $child_id, '_price', true );
$child_prices = array_unique( $child_prices );
@ -931,13 +926,13 @@ class WC_Product {
$min_price = '';
}
if (sizeof($child_prices)>1) $price .= $this->get_price_html_from_text();
if ( sizeof( $child_prices ) > 1 ) $price .= $this->get_price_html_from_text();
$price .= woocommerce_price( $min_price );
$price = apply_filters('woocommerce_grouped_price_html', $price, $this);
$price = apply_filters( 'woocommerce_grouped_price_html', $price, $this );
elseif ($this->is_type('variable')) :
} elseif ( $this->is_type( 'variable' ) ) {
// Ensure variation prices are synced with variations
if ( $this->min_variation_price === '' || $this->min_variation_regular_price === '' ) {
@ -946,17 +941,17 @@ class WC_Product {
}
// Get the price
if ($this->price > 0) :
if ($this->is_on_sale() && isset($this->min_variation_price) && $this->min_variation_regular_price !== $this->get_price()) :
if ($this->price > 0) {
if ( $this->is_on_sale() && isset( $this->min_variation_price ) && $this->min_variation_regular_price !== $this->get_price() ) {
if ( !$this->min_variation_price || $this->min_variation_price !== $this->max_variation_price )
if ( ! $this->min_variation_price || $this->min_variation_price !== $this->max_variation_price )
$price .= $this->get_price_html_from_text();
$price .= $this->get_price_html_from_to( $this->min_variation_regular_price, $this->get_price() );
$price = apply_filters('woocommerce_variable_sale_price_html', $price, $this);
$price = apply_filters( 'woocommerce_variable_sale_price_html', $price, $this );
else :
} else {
if ( ! $this->min_variation_price || $this->min_variation_price !== $this->max_variation_price )
$price .= $this->get_price_html_from_text();
@ -965,74 +960,73 @@ class WC_Product {
$price = apply_filters('woocommerce_variable_price_html', $price, $this);
endif;
elseif ($this->price === '' ) :
}
} elseif ($this->price === '' ) {
$price = apply_filters('woocommerce_variable_empty_price_html', '', $this);
elseif ($this->price == 0 ) :
} elseif ($this->price == 0 ) {
if ($this->is_on_sale() && isset($this->min_variation_regular_price) && $this->min_variation_regular_price !== $this->get_price()) :
if ( $this->is_on_sale() && isset( $this->min_variation_regular_price ) && $this->min_variation_regular_price !== $this->get_price() ) {
if ( !$this->min_variation_price || $this->min_variation_price !== $this->max_variation_price )
if ( ! $this->min_variation_price || $this->min_variation_price !== $this->max_variation_price )
$price .= $this->get_price_html_from_text();
$price .= $this->get_price_html_from_to( $this->min_variation_regular_price, __( 'Free!', 'woocommerce' ) );
$price = apply_filters('woocommerce_variable_free_sale_price_html', $price, $this);
$price = apply_filters( 'woocommerce_variable_free_sale_price_html', $price, $this );
else :
} else {
if ( ! $this->min_variation_price || $this->min_variation_price !== $this->max_variation_price )
$price .= $this->get_price_html_from_text();
$price .= __( 'Free!', 'woocommerce' );
$price = apply_filters('woocommerce_variable_free_price_html', $price, $this);
$price = apply_filters( 'woocommerce_variable_free_price_html', $price, $this );
endif;
}
endif;
else :
if ($this->price > 0) :
if ($this->is_on_sale() && isset($this->regular_price)) :
}
} else {
if ( $this->price > 0 ) {
if ( $this->is_on_sale() && isset( $this->regular_price ) ) {
$price .= $this->get_price_html_from_to( $this->regular_price, $this->get_price() );
$price = apply_filters('woocommerce_sale_price_html', $price, $this);
$price = apply_filters( 'woocommerce_sale_price_html', $price, $this );
else :
} else {
$price .= woocommerce_price( $this->get_price() );
$price = apply_filters('woocommerce_price_html', $price, $this);
$price = apply_filters( 'woocommerce_price_html', $price, $this );
endif;
elseif ($this->price === '' ) :
}
} elseif ($this->price === '' ) {
$price = apply_filters('woocommerce_empty_price_html', '', $this);
$price = apply_filters( 'woocommerce_empty_price_html', '', $this );
elseif ($this->price == 0 ) :
} elseif ($this->price == 0 ) {
if ($this->is_on_sale() && isset($this->regular_price)) :
if ( $this->is_on_sale() && isset( $this->regular_price ) ) {
$price .= $this->get_price_html_from_to( $this->regular_price, __( 'Free!', 'woocommerce' ) );
$price = apply_filters('woocommerce_free_sale_price_html', $price, $this);
$price = apply_filters( 'woocommerce_free_sale_price_html', $price, $this );
else :
} else {
$price = __( 'Free!', 'woocommerce' );
$price = apply_filters('woocommerce_free_price_html', $price, $this);
$price = apply_filters( 'woocommerce_free_price_html', $price, $this );
endif;
}
endif;
endif;
}
}
return apply_filters('woocommerce_get_price_html', $price, $this);
return apply_filters( 'woocommerce_get_price_html', $price, $this );
}
@ -1514,7 +1508,7 @@ class WC_Product {
$variation_attributes = $variation->get_variation_attributes();
$availability = $variation->get_availability();
$availability_html = empty( $availability['availability'] ) ? '' : apply_filters( 'woocommerce_stock_html', '<p class="stock ' . $availability['class'] . '">'. $availability['availability'].'</p>', $availability['availability'] );
$availability_html = empty( $availability['availability'] ) ? '' : apply_filters( 'woocommerce_stock_html', '<p class="stock ' . esc_attr( $availability['class'] ) . '">'. wp_kses_post( $availability['availability'] ).'</p>', wp_kses_post( $availability['availability'] ) );
if ( has_post_thumbnail( $variation->get_variation_id() ) ) {
$attachment_id = get_post_thumbnail_id( $variation->get_variation_id() );

6
classes/emails/class-wc-email.php
View File

@ -261,7 +261,7 @@ class WC_Email extends WC_Settings_API {
* @return string
*/
function get_from_name() {
return get_option( 'woocommerce_email_from_name' );
return esc_html( get_option( 'woocommerce_email_from_name' ) );
}
/**
@ -271,7 +271,7 @@ class WC_Email extends WC_Settings_API {
* @return string
*/
function get_from_address() {
return get_option( 'woocommerce_email_from_address' );
return sanitize_email( get_option( 'woocommerce_email_from_address' ) );
}
/**
@ -290,7 +290,7 @@ class WC_Email extends WC_Settings_API {
add_filter( 'wp_mail_from_name', array( &$this, 'get_from_name' ) );
add_filter( 'wp_mail_content_type', array( &$this, 'get_content_type' ) );
wp_mail( $to, $subject, $message, $headers, $attachments );
wp_mail( $to, $subject, wp_kses_post( $message ), $headers, $attachments );
remove_filter( 'wp_mail_from', array( &$this, 'get_from_address' ) );
remove_filter( 'wp_mail_from_name', array( &$this, 'get_from_name' ) );

10
widgets/widget-login.php
View File

@ -103,7 +103,7 @@ class WooCommerce_Widget_Login extends WP_Widget {
endforeach;
// Get redirect URL
$redirect_to = apply_filters( 'woocommerce_login_widget_redirect', get_permalink(woocommerce_get_page_id('myaccount')) );
$redirect_to = esc_url( apply_filters( 'woocommerce_login_widget_redirect', get_permalink( woocommerce_get_page_id( 'myaccount' ) ) ) );
?>
<form method="post">
@ -174,9 +174,9 @@ class WooCommerce_Widget_Login extends WP_Widget {
echo '<ul class="pagenav">';
foreach ($links as $name => $link) :
echo '<li><a href="'.$link.'">'.$name.'</a></li>';
endforeach;
foreach ( $links as $name => $link ) {
echo '<li><a href="' . esc_attr( $link ) . '">' . wp_kses_post( $name ) . '</a></li>';
}
echo '</ul>';
@ -239,7 +239,7 @@ function woocommerce_sidebar_login_process() {
global $login_errors;
// Get redirect URL
$redirect_to = apply_filters( 'woocommerce_login_widget_redirect', get_permalink(woocommerce_get_page_id('myaccount')) );
$redirect_to = esc_url( apply_filters( 'woocommerce_login_widget_redirect', get_permalink( woocommerce_get_page_id( 'myaccount' ) ) ) );
// Check for Secure Cookie
$secure_cookie = '';

18
widgets/widget-recent_reviews.php
View File

@ -73,24 +73,24 @@ class WooCommerce_Widget_Recent_Reviews extends WP_Widget {
$comments = get_comments( array( 'number' => $number, 'status' => 'approve', 'post_status' => 'publish', 'post_type' => 'product' ) );
if ( $comments ) :
if ( $comments ) {
echo $before_widget;
if ( $title ) echo $before_title . $title . $after_title;
echo '<ul class="product_list_widget">';
foreach ( (array) $comments as $comment) :
foreach ( (array) $comments as $comment) {
$_product = new WC_Product( $comment->comment_post_ID );
$star_size = apply_filters('woocommerce_star_rating_size_recent_reviews', 16);
$star_size = intval( apply_filters( 'woocommerce_star_rating_size_recent_reviews', 16 ) );
$rating = intval( get_comment_meta( $comment->comment_ID, 'rating', true ) );
$rating_html = '<div class="star-rating" title="'.$rating.'">
<span style="width:'.($rating*$star_size).'px">'.$rating.' '.__( 'out of 5', 'woocommerce' ).'</span>
$rating_html = '<div class="star-rating" title="' . $rating . '">
<span style="width:' . ( $rating * $star_size ) . 'px">' . $rating . ' ' . __( 'out of 5', 'woocommerce' ) . '</span>
</div>';
echo '<li><a href="' . esc_url( get_comment_link($comment->comment_ID) ) . '">';
echo '<li><a href="' . esc_url( get_comment_link( $comment->comment_ID ) ) . '">';
echo $_product->get_image();
@ -98,13 +98,13 @@ class WooCommerce_Widget_Recent_Reviews extends WP_Widget {
echo $rating_html;
printf(_x('by %1$s', 'by comment author', 'woocommerce'), get_comment_author()) . '</li>';
printf( _x( 'by %1$s', 'by comment author', 'woocommerce' ), get_comment_author() ) . '</li>';
endforeach;
}
echo '</ul>';
echo $after_widget;
endif;
}
$content = ob_get_clean();

10
woocommerce.php
View File

@ -551,14 +551,14 @@ class Woocommerce {
if ( ! is_ssl() ) {
if ( is_checkout() ) {
wp_redirect( str_replace('http:', 'https:', get_permalink(woocommerce_get_page_id('checkout'))), 301 );
wp_safe_redirect( str_replace('http:', 'https:', get_permalink(woocommerce_get_page_id('checkout'))), 301 );
exit;
} elseif ( is_account_page() ) {
if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
wp_redirect( preg_replace( '|^http://|', 'https://', $_SERVER['REQUEST_URI'] ) );
wp_safe_redirect( preg_replace( '|^http://|', 'https://', $_SERVER['REQUEST_URI'] ) );
exit;
} else {
wp_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
wp_safe_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
exit;
}
exit;
@ -567,10 +567,10 @@ class Woocommerce {
// Break out of SSL if we leave the checkout/my accounts (anywhere but thanks)
if ( get_option('woocommerce_unforce_ssl_checkout') == 'yes' && $_SERVER['REQUEST_URI'] && ! is_checkout() && ! is_page( woocommerce_get_page_id('thanks') ) && ! is_ajax() && ! is_account_page() ) {
if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
wp_redirect( preg_replace( '|^https://|', 'http://', $_SERVER['REQUEST_URI'] ) );
wp_safe_redirect( preg_replace( '|^https://|', 'http://', $_SERVER['REQUEST_URI'] ) );
exit;
} else {
wp_redirect( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
wp_safe_redirect( 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
exit;
}
}