Escape spreadsheet special characters to prevent formula exploits #50

jamesros161 · 2020-12-23T16:03:31Z

No description provided.

cssjoe

All of the code can be reverted and the line prepending the ' can be after

weforms/includes/functions.php

Line 1223 in 9a8f9db

$value = trim( strip_tags( $value ) );

. Also, that weforms_get_pain_text method has a duplicate is_array condition that can be eliminated.

includes/admin/class-admin.php

Updated contributors ( +jamesros161 ), stable tag ( 1.6.4 ), and changelog: = Version 1.6.4 (23 December, 2020) = * **Fix:** Added spreadsheet function escaping to prevent CSV exploits. [#50] (#50) * **Update:** Update Node Packages

Escape spreadsheet special characters to prevent formula exploits

c49b9a0

jamesros161 requested a review from cssjoe December 23, 2020 16:03

cssjoe requested changes Dec 23, 2020

View reviewed changes

includes/admin/class-admin.php Outdated Show resolved Hide resolved

jamesros161 added 5 commits December 23, 2020 12:04

moved spreadsheet sanitizing to functions.php

77dc1ba

changed tab to spaces to match rest of file.

ce7a235

change tabs to spaces to match rest of file

1de3fbd

changed tabs to spaces to match rest of file.

7a6b3f4

correct regex

a480bd2

jamesros161 requested a review from cssjoe December 23, 2020 17:11

cssjoe approved these changes Dec 23, 2020

View reviewed changes

jamesros161 merged commit 01eb24c into master Dec 23, 2020

cssjoe deleted the escape-formulas branch December 23, 2020 17:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Escape spreadsheet special characters to prevent formula exploits #50

Escape spreadsheet special characters to prevent formula exploits #50

jamesros161 commented Dec 23, 2020

cssjoe left a comment

Escape spreadsheet special characters to prevent formula exploits #50

Escape spreadsheet special characters to prevent formula exploits #50

Conversation

jamesros161 commented Dec 23, 2020

cssjoe left a comment

Choose a reason for hiding this comment