051964adc5
Remove undefined variable
2015-06-03 21:18:01 +05:45
0e01ff90f3
Tweaks - Conding standard and JSHint fix
2015-06-03 21:17:40 +05:45
a2f05dd368
Show notices before cat loops
2015-06-03 14:22:23 +01:00
29e6082ab6
typo
2015-06-03 12:50:11 +02:00
17eac9eaed
added filter wc_tax_enabled
2015-06-03 12:49:10 +02:00
b331bf2cc9
Merge pull request #8270 from shivapoudel/check-array
...
Best practise to check array in expression
2015-06-02 14:35:43 -03:00
db107fac45
Check array in expression for json_search_* events
2015-06-02 22:58:52 +05:45
27adbb2a0b
Best practise to check array in expression :)
2015-06-02 22:55:02 +05:45
d5c5d5e394
Fixed unit tests for wc_get_price_thousand_separator() and wc_get_price_decimal_separator()
2015-06-01 11:03:19 -03:00
60dd4474db
abstract email class should not exist ! legacy
2015-06-01 10:48:13 -03:00
2febc8f20a
Add capability checks to ajax requests
...
Closes #15
2015-06-01 13:38:00 +01:00
1505424469
Define allowed_file_types
...
#13
2015-06-01 13:37:43 +01:00
527311d553
Validate file types when saving products. Closes #13
...
Handles 3 possible types of file;
1. Relative path on server
2. Absolute URL
3. Shortcodes
URLs without extensions are not validated.
2015-06-01 13:37:39 +01:00
95a4133bb7
Removed WooCommerce::fix_server_vars, closes #14
2015-06-01 13:37:33 +01:00
5b435024ea
Use htmlspecialchars to ensure characters get encoded for select2
...
We cannot update to select2 4.0 until a major release. Closes #4
2015-06-01 13:37:26 +01:00
c5bb4ad473
Fix tooltip implode
2015-06-01 13:37:21 +01:00
cb2079deaa
wc_send_frame_options_header
...
Prevent Clickjacking - prevent checkout and account pages from being
used in iFrames. Added via filter so this can be disabled.
Closes #8
2015-06-01 13:37:12 +01:00
3b45c0d46f
Set nonce_user_logged_out to WC session ID, if set
...
Closes #9
2015-06-01 13:36:07 +01:00
ed99be9aed
Sanitize tooltips with htmlspecialchars and remove esc_attr usage
...
Part of #4
2015-06-01 13:36:03 +01:00
51c8bbf87c
wrong nonce verification
2015-06-01 13:33:51 +01:00
ec5a693ad7
Use prepare for updating attributes
...
Closes #7
2015-06-01 13:29:02 +01:00
9eb3b6ddf9
Changed all requests with wp_remote_* to wp_safe_remote_*
2015-06-01 13:28:55 +01:00
c1db266e80
Explicitly cast as integer the rating comment meta.
...
On multisite this can contain arbitrary values.
2015-06-01 13:27:16 +01:00
27f1c15900
email templates can only be moved / deleted / edited if the user has `edit_themes` capabilities
2015-06-01 13:26:02 +01:00
48094b9bf2
Added nonces and check capability when hide admin notices
2015-06-01 13:19:26 +01:00
65608d3fd0
Added nonces and check capability to copy or delete email templates, closes #5
2015-06-01 13:12:25 +01:00
5b00dee203
Implemented wp_safe_remote_* functions for webhooks requests #10
2015-06-01 13:09:21 +01:00
166ec607c0
Escape columns
2015-06-01 13:08:33 +01:00
f194330aeb
Escape properly echoed values
...
The variables $base_slug/$structures may contain unsafe values due to
the use of urldecode. For example if the post slug is '%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E'
2015-06-01 12:59:03 +01:00
f38bc86c5d
Escape properly the metadata to be copied.
...
Fixes a SQL injection because the meta key can contain arbitrary values.
2015-06-01 12:58:56 +01:00
3c1b14d00d
Escape properly the provided array of post codes
...
The callers only run wc_clean/esc_attr on the provided values which are
not functions meant to protect against SQL injections.
2015-06-01 12:58:51 +01:00
7d8db595f2
Fixes an (admin) SQLi when setting stock levels for product variations
2015-06-01 12:58:38 +01:00
7896b49684
fclose requires a resource, not a string.
2015-06-01 12:58:06 +01:00
2740db17c0
Merge conflict - esc customer data
2015-06-01 12:57:48 +01:00
f46060a0dd
Remove call to `wp_specialchars_decode()` in `wc_get_price_thousand_separator()` and `wc_get_price_decimal_separator()`.
...
Closes #6
2015-06-01 12:54:23 +01:00
f3e3b5c209
add `$args` arguments to `WC_Product_Factory->get_product_class()` to allow `$product_type` to be overwritten by `$args['product_type']`
2015-06-01 12:54:18 +01:00
7b9a22208e
readds the `$the_product` global variable
2015-06-01 12:54:14 +01:00
c8dd2b6268
fixes usage of void return value from `wc_cart_totals_taxes_total_html()`
2015-06-01 12:54:07 +01:00
f066a7bb21
pass correct number of arguments to `wc_lostpassword_url()`, `wc_nav_menu_items()`, `wc_nav_menu_item_classes()`, and `wc_change_term_counts()`
2015-06-01 12:53:51 +01:00
32e37b57d0
fixes too many arguments in function or method call: WC_Shortcode_My_Account::add_payment_method($wp->query_vars['add-payment-method'])
2015-06-01 12:52:10 +01:00
1aa020ca57
fixes undefined constant ('error_code' > '$error' typo)
2015-06-01 12:52:01 +01:00
5e22e13975
set default currency position format string (in case of missing or invalid `woocommerce_currency_pos` option value)
2015-06-01 12:51:56 +01:00
3d049ff379
[2.3] Clear expired transients on update
2015-06-01 11:39:03 +01:00
1ce272b385
[2.3] Tweak transient clear SQL
2015-06-01 11:38:43 +01:00
b9708c4df9
Show refunded total shipping and taxes
...
Closes #8222
2015-06-01 11:06:11 +01:00
6760589381
Tweak code used to get country's statebox
...
Closes #8255
2015-06-01 10:50:16 +01:00
bd7624e5b7
Check template code isset
2015-05-29 17:40:53 +01:00
1e3fcd0e6d
[2.3] Avoid initialising classes when saving
2015-05-29 17:38:25 +01:00
b2a612dba2
[2.3] Revert some changes from a65616c
2015-05-29 12:27:38 -03:00
803f4a9e85
[2.3] Delete correct transient when linking variations
...
Closes #8241
2015-05-29 15:34:27 +01:00
Shiva Poudel
Mike Jolley
Nicola Mustone
Claudio Sanches
Alexander Concha
Ben Bidner