From 73e41eb291aecddc042fbd30823682b8e4502c7c Mon Sep 17 00:00:00 2001 From: rvdforst Date: Mon, 26 Feb 2024 16:06:12 +0100 Subject: [PATCH 01/19] Update composer.json --- composer.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/composer.json b/composer.json index e39f19e..568fa36 100644 --- a/composer.json +++ b/composer.json @@ -2,8 +2,8 @@ "name": "rrze/rrze-rsvp", "version": "2.11.3", "require": { - "cmb2/cmb2": "^2.10.0", - "tecnickcom/tcpdf": "6.4.4" + "cmb2/cmb2": "^2.10.1", + "tecnickcom/tcpdf": "^6.6.5" }, "autoload": { "psr-4": { From 52ae92bfe9d17d42009a78b6d3b38348bafecddb Mon Sep 17 00:00:00 2001 From: rvdforst Date: Mon, 26 Feb 2024 16:06:19 +0100 Subject: [PATCH 02/19] Update Actions.php --- includes/Actions.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/includes/Actions.php b/includes/Actions.php index 634688f..38375b0 100644 --- a/includes/Actions.php +++ b/includes/Actions.php @@ -10,6 +10,10 @@ class Actions protected $template; + protected $settings; + + protected $options; + public function __construct() { $this->email = new Email; From 711695eb5160e4f5fb2e83aa32f1812cc7e411b7 Mon Sep 17 00:00:00 2001 From: rvdforst Date: Mon, 26 Feb 2024 16:06:21 +0100 Subject: [PATCH 03/19] Update LDAP.php --- includes/Auth/LDAP.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/includes/Auth/LDAP.php b/includes/Auth/LDAP.php index c7b7439..4210b1a 100644 --- a/includes/Auth/LDAP.php +++ b/includes/Auth/LDAP.php @@ -86,10 +86,10 @@ public function getCustomerData(): array public function login() { - $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING); - $username = ($username ? $username : filter_input(INPUT_GET, 'username', FILTER_SANITIZE_STRING)); - $password = filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING); - $password = ($password ? $password : filter_input(INPUT_GET, 'password', FILTER_SANITIZE_STRING)); + $username = htmlspecialchars($_POST['username'] ?? ''); + $username = $username ? $username : htmlspecialchars($_GET['username'] ?? ''); + $password = htmlspecialchars($_POST['password'] ?? ''); + $password = $password ? $password : htmlspecialchars($_GET['password'] ?? ''); if ($username && $password) { $this->connection = @ldap_connect($this->server, $this->port); From e4d4b083041b28da0aa7037f03a8040b150f053c Mon Sep 17 00:00:00 2001 From: rvdforst Date: Mon, 26 Feb 2024 16:06:34 +0100 Subject: [PATCH 04/19] Update Bookings.php --- includes/CPT/Bookings.php | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/includes/CPT/Bookings.php b/includes/CPT/Bookings.php index f5acc38..661bdc6 100644 --- a/includes/CPT/Bookings.php +++ b/includes/CPT/Bookings.php @@ -11,7 +11,6 @@ use RRZE\RSVP\Capabilities; use RRZE\RSVP\Functions; use function RRZE\RSVP\Config\isAllowedSearchForGuest; -// use RRZE\RSVP\Carbon; class Bookings { @@ -317,8 +316,8 @@ public function addFilters($post_type) $sAllDates = __('Show all dates', 'rrze-rsvp'); $sAllTimeslots = __('Show all time slots', 'rrze-rsvp'); $sAllRoomes = __('Show all rooms', 'rrze-rsvp'); - $sSelectedDate = (string) filter_input(INPUT_GET, $this->sDate, FILTER_SANITIZE_STRING); - $sSelectedTimeslot = (string) filter_input(INPUT_GET, $this->sTimeslot, FILTER_SANITIZE_STRING); + $sSelectedDate = htmlspecialchars($_GET[$this->sDate] ?? ''); + $sSelectedTimeslot = htmlspecialchars($_GET[$this->sTimeslot] ?? ''); $sSelectedRoom = (string) filter_input(INPUT_GET, $this->sRoom, FILTER_VALIDATE_INT); // 1. get all booking IDs @@ -381,8 +380,8 @@ private function getBookingIDsBySeatRoomTitle($sSearch) private function setFilterParams() { $this->filterRoomIDs = filter_input(INPUT_GET, $this->sRoom, FILTER_VALIDATE_INT); - $this->filterDate = filter_input(INPUT_GET, $this->sDate, FILTER_SANITIZE_STRING); - $filterTime = filter_input(INPUT_GET, $this->sTimeslot, FILTER_SANITIZE_STRING); + $this->filterDate = htmlspecialchars($_GET[$this->sDate] ?? ''); + $filterTime = htmlspecialchars($_GET[$this->sTimeslot] ?? ''); if ($filterTime) { $parts = explode(" - ", $filterTime); $this->filterStart = $parts[0]; From 04b8acd38ab570244dd8644ec64f5e46e0454ab0 Mon Sep 17 00:00:00 2001 From: rvdforst Date: Mon, 26 Feb 2024 16:06:37 +0100 Subject: [PATCH 05/19] Update Seats.php --- includes/CPT/Seats.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/CPT/Seats.php b/includes/CPT/Seats.php index c9a82d4..321c3ef 100644 --- a/includes/CPT/Seats.php +++ b/includes/CPT/Seats.php @@ -146,7 +146,7 @@ public function applyFilters($postType) } $allRooms = __('Show all rooms', 'rrze-rsvp'); - $selectedRoom = (string) filter_input(INPUT_GET, 'rrze-rsvp-seat-room', FILTER_SANITIZE_STRING); + $selectedRoom = htmlspecialchars($_GET['rrze-rsvp-seat-room'] ?? ''); $seatIds = get_posts([ 'post_type' => 'seat', From 22a187c20a89c4abff421d1f1dec4df52040d05b Mon Sep 17 00:00:00 2001 From: rvdforst Date: Mon, 26 Feb 2024 16:06:41 +0100 Subject: [PATCH 06/19] Update Email.php --- includes/Email.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/includes/Email.php b/includes/Email.php index 6c736fc..d48db57 100644 --- a/includes/Email.php +++ b/includes/Email.php @@ -26,6 +26,8 @@ class Email */ protected $isLocaleEnglish; + protected $settings; + /** * __construct */ From ea0b21a0d30ee33143a2e90addf8b0567b098c84 Mon Sep 17 00:00:00 2001 From: rvdforst Date: Mon, 26 Feb 2024 16:06:43 +0100 Subject: [PATCH 07/19] Update Metaboxes.php --- includes/Metaboxes.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/includes/Metaboxes.php b/includes/Metaboxes.php index 5d746a1..a533f28 100644 --- a/includes/Metaboxes.php +++ b/includes/Metaboxes.php @@ -9,6 +9,8 @@ class Metaboxes { + protected $settings; + public function __construct() { $this->settings = new Settings(plugin()->getFile()); From 5bf4119c1fbf7c5e127208a3ba75b9f37d5f4997 Mon Sep 17 00:00:00 2001 From: rvdforst Date: Mon, 26 Feb 2024 16:06:46 +0100 Subject: [PATCH 08/19] Update Schedule.php --- includes/Schedule.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/includes/Schedule.php b/includes/Schedule.php index feda264..c03785f 100644 --- a/includes/Schedule.php +++ b/includes/Schedule.php @@ -18,6 +18,10 @@ class Schedule */ protected $email; + protected $settings; + + protected $options; + /** * __construct */ From 1fc1802c48e060959296ecb28bf70427ae029359 Mon Sep 17 00:00:00 2001 From: rvdforst Date: Mon, 26 Feb 2024 16:06:57 +0100 Subject: [PATCH 09/19] Update Settings.php --- includes/Settings.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/includes/Settings.php b/includes/Settings.php index bbc927a..0a70aee 100644 --- a/includes/Settings.php +++ b/includes/Settings.php @@ -74,6 +74,8 @@ class Settings */ protected $settingsPrefix; + protected $optionsPage; + /** * Variablen Werte zuweisen. * @param string $pluginFile [description] @@ -720,7 +722,7 @@ public function callbackSelect($args) */ public function callbackMultiSelect($args) { - $value = $this->getOption($args['section'], $args['id'], $args['default']); + $value = (array) $this->getOption($args['section'], $args['id'], $args['default']); $size = isset($args['size']) && !is_null($args['size']) ? $args['size'] : 'regular'; $html = sprintf( '