166ec607c0
Escape columns
2015-06-01 13:08:33 +01:00
f194330aeb
Escape properly echoed values
...
The variables $base_slug/$structures may contain unsafe values due to
the use of urldecode. For example if the post slug is '%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E'
2015-06-01 12:59:03 +01:00
f38bc86c5d
Escape properly the metadata to be copied.
...
Fixes a SQL injection because the meta key can contain arbitrary values.
2015-06-01 12:58:56 +01:00
3c1b14d00d
Escape properly the provided array of post codes
...
The callers only run wc_clean/esc_attr on the provided values which are
not functions meant to protect against SQL injections.
2015-06-01 12:58:51 +01:00
7d8db595f2
Fixes an (admin) SQLi when setting stock levels for product variations
2015-06-01 12:58:38 +01:00
7896b49684
fclose requires a resource, not a string.
2015-06-01 12:58:06 +01:00
2740db17c0
Merge conflict - esc customer data
2015-06-01 12:57:48 +01:00
f46060a0dd
Remove call to `wp_specialchars_decode()` in `wc_get_price_thousand_separator()` and `wc_get_price_decimal_separator()`.
...
Closes #6
2015-06-01 12:54:23 +01:00
f3e3b5c209
add `$args` arguments to `WC_Product_Factory->get_product_class()` to allow `$product_type` to be overwritten by `$args['product_type']`
2015-06-01 12:54:18 +01:00
7b9a22208e
readds the `$the_product` global variable
2015-06-01 12:54:14 +01:00
c8dd2b6268
fixes usage of void return value from `wc_cart_totals_taxes_total_html()`
2015-06-01 12:54:07 +01:00
f066a7bb21
pass correct number of arguments to `wc_lostpassword_url()`, `wc_nav_menu_items()`, `wc_nav_menu_item_classes()`, and `wc_change_term_counts()`
2015-06-01 12:53:51 +01:00
32e37b57d0
fixes too many arguments in function or method call: WC_Shortcode_My_Account::add_payment_method($wp->query_vars['add-payment-method'])
2015-06-01 12:52:10 +01:00
1aa020ca57
fixes undefined constant ('error_code' > '$error' typo)
2015-06-01 12:52:01 +01:00
5e22e13975
set default currency position format string (in case of missing or invalid `woocommerce_currency_pos` option value)
2015-06-01 12:51:56 +01:00
3d049ff379
[2.3] Clear expired transients on update
2015-06-01 11:39:03 +01:00
1ce272b385
[2.3] Tweak transient clear SQL
2015-06-01 11:38:43 +01:00
b9708c4df9
Show refunded total shipping and taxes
...
Closes #8222
2015-06-01 11:06:11 +01:00
6760589381
Tweak code used to get country's statebox
...
Closes #8255
2015-06-01 10:50:16 +01:00
bd7624e5b7
Check template code isset
2015-05-29 17:40:53 +01:00
1e3fcd0e6d
[2.3] Avoid initialising classes when saving
2015-05-29 17:38:25 +01:00
b2a612dba2
[2.3] Revert some changes from a65616c
2015-05-29 12:27:38 -03:00
803f4a9e85
[2.3] Delete correct transient when linking variations
...
Closes #8241
2015-05-29 15:34:27 +01:00
3222d1473e
Merge pull request #8242 from n-dawson/master
...
Add a filter to override needs_shipping_address order method.
2015-05-29 15:28:49 +01:00
a7a290e12a
Merge pull request #8250 from kilbot/patch-1
...
Add capability_type to product_variation
2015-05-29 15:27:41 +01:00
0a3defd798
Move tax enabled check
2015-05-29 14:55:57 +01:00
b2711f3d64
[API] Fixed products tags in write-mode
2015-05-29 10:05:15 -03:00
88003436a6
[API] Add properly sanitization for categories and tags in products endpoint, closes #8251
2015-05-29 10:04:02 -03:00
e6ae10ee9a
Test
2015-05-29 10:01:43 -03:00
b16d443709
fix missing comma
2015-05-29 19:35:31 +08:00
b158d517e9
Add capability_type to product_variation
...
By default the product_variation has `capability_type = 'post'` which means that users need `edit_post` capability to edit. This change will make variation capabilities consistent with products, ie: `edit_product`
2015-05-29 17:42:33 +08:00
b91d3358ef
Merge pull request #8247 from roykho/dynamic-variation-description
...
use esc_textarea function
2015-05-29 00:13:15 +01:00
b9eefa58fa
use esc_textarea function
2015-05-28 16:08:22 -07:00
8b92bfa433
Merge pull request #8246 from roykho/dynamic-variation-description
...
Improved dynamic variation description and sanitized properly
2015-05-28 18:58:12 -03:00
54b0a0ca54
changed dynamic variation description to allow limited HTML and some sanitized tweaks
2015-05-28 14:31:45 -07:00
e51eae80c6
Merge pull request #8167 from roykho/dynamic-variation-description
...
Dynamic variation description
2015-05-28 15:53:03 +01:00
e535e005b7
Add a filter to override needs_shipping_address order method.
...
If an order doesn't have any shipping methods it's not possible to set needs_shipping_address to true. When 'woocommerce_cart_needs_shipping_address' is set to true the address needs to be shown on the front end and in confirmation emails.
2015-05-28 15:48:37 +01:00
4e5091adda
Merge remote-tracking branch 'origin/master'
2015-05-28 14:42:45 +01:00
5cac639cff
Merge branch 'improve-refund-reporting' Closes #8028
...
Conflicts:
includes/admin/reports/class-wc-report-sales-by-date.php
includes/updates/woocommerce-update-2.4.php
2015-05-28 14:41:20 +01:00
903cb817f0
Fixed WC_Install::get_schema for woocommerce_api_keys table
2015-05-28 10:36:25 -03:00
eff9b5ec18
Fixed test for wc_format_list_of_items
2015-05-28 10:28:49 -03:00
9826273f8f
Merge pull request #7910 from SiR-DanieL/unit-tests
...
More unit tests
2015-05-28 10:27:10 -03:00
5ef335b169
Merge pull request #8215 from JeroenSormani/order-tests
...
Order tests
2015-05-28 12:44:17 +01:00
e122a8258c
Minification
2015-05-28 12:29:33 +01:00
a21d0073de
[2.3] Wrap payment js in jquery
...
Closes #8191
2015-05-28 12:29:33 +01:00
b77755af5c
Merge pull request #8236 from n-dawson/master
...
[2.3] Resolve blank shipping information bug. Fixes #8235
2015-05-28 12:21:38 +01:00
4a9971193f
Only track product views when widget is active
...
Closes #8212
2015-05-28 11:49:10 +01:00
8c1e452514
proceed to checkout button template. closes #7507
2015-05-28 11:48:37 +01:00
ba2e638e54
nocache download_file requests
...
Closes #8162
2015-05-28 11:44:47 +01:00
f9e43b874c
Resolve blank shipping information bug. Fixes #8235
...
Setting the 'woocommerce_cart_needs_shipping' filter to true means the shipping fields can be shown for virtual products. Whether to check shipping details should be based on whether they're shown and not whether the cart needs shipping.
2015-05-28 00:54:05 +01:00
Claudio Sanches
Alexander Concha
Ben Bidner
Mike Jolley
Paul Kilmurray
roykho
Nathan Dawson
James Koster