WordPress.org
Get WordPress

Plugin Directory

Changeset 3375512


Ignore:
Timestamp:
10/09/2025 07:47:29 AM (4 weeks ago)
Author:
webtoffee
Message:

2.6.6

  • [Fix] Invalid delimiter sanitization caused issues during import/export.
Location:
order-import-export-for-woocommerce
Files:
334 added
13 edited

Legend:

Unmodified
Added
Removed

  • order-import-export-for-woocommerce/trunk/admin/classes/class-csvreader.php

    r3374407 r3375512  
    126126    public function get_data_as_batch($file, $offset, $batch_count, $module_obj, $form_data)
    127127    {
    128                 $use_mb = function_exists('mb_detect_encoding');
    129                 // Set locale
    130                 $enc = ($use_mb) ? mb_detect_encoding( $file, 'UTF-8, ISO-8859-1', true ) : false;
    131         if($enc)
    132         {
     128        $use_mb = function_exists('mb_detect_encoding');
     129        // Set locale
     130        $enc = ($use_mb) ? mb_detect_encoding( $file, 'UTF-8, ISO-8859-1', true ) : false;
     131        if ( $enc ) {
    133132            setlocale( LC_ALL, 'en_US.' . $enc );
    134133        }
    … …  
    176175                {
    177176                    /* removing BOM like non characters */
    178                             $wt_remove_bom = apply_filters('wt_import_csv_parser_keep_bom', true);
    179                             if ($wt_remove_bom) {
    180                                 $head_arr[$head_key]=preg_replace('/[\x00-\x1F\x80-\xFF]/', '', $head_val);
    181                             } else {
    182                                 $head_arr[$head_key]= wt_removeBomUtf8_basic($head_val);
    183                             }   
     177                    $wt_remove_bom = apply_filters('wt_import_csv_parser_keep_bom', true);
     178                    if ($wt_remove_bom) {
     179                        $head_arr[$head_key]=preg_replace('/[\x00-\x1F\x80-\xFF]/', '', $head_val);
     180                    } else {
     181                        $head_arr[$head_key]= wt_removeBomUtf8_basic($head_val);
     182                    }   
    184183                }
    185184            }

  • order-import-export-for-woocommerce/trunk/admin/modules/coupon/export/class-wt-cpnimpexpcsv-basic-exporter.php

    r3374407 r3375512  
    1111
    1212        // phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce verification already done in the wt_process_order_bulk_actions(), process_coupons_bulk_actions() method
    13         $delimiter = !empty($_POST['delimiter']) ? sanitize_text_field(wp_unslash($_POST['delimiter'])) : ',';
     13        $delimiter = !empty($_POST['delimiter']) ? wp_kses_post(wp_unslash($_POST['delimiter'])) : ',';
    1414        $csv_columns = include_once( __DIR__ . '/../data/data-coupon-post-columns.php' );
    1515        $csv_columns = array_combine(array_keys($csv_columns), array_keys($csv_columns));

  • order-import-export-for-woocommerce/trunk/admin/modules/export/assets/js/main.js

    r3248219 r3375512  
    1717        on_rerun:false,
    1818        rerun_id:0,
    19                 export_finished:false,
     19        export_finished:false,
    2020        Set:function()
    2121        {

  • order-import-export-for-woocommerce/trunk/admin/modules/export/export.php

    r3374407 r3375512  
    341341                'field_name'=>'file_name',
    342342                'help_text'=>__('Specify a filename for the exported file. If left blank, the system generates the name automatically.', 'order-import-export-for-woocommerce'),
    343                 'after_form_field_html'=>'<div class="wt_iew_file_ext_info_basic">.csv</div>',
     343                'after_form_field_html'=>'<div class="wt_iew_file_ext_info_basic">.csv</div>', // Always pass safe data.
    344344                'td_class3'=>'wt_iew_file_ext_info_td',
    345345                'validation_rule'=>array('type'=>'file_name'),
    … …  
    365365                'help_text'=>__( 'Separator for differentiating the columns in the CSV file. Assumes ‘,’ by default.', 'order-import-export-for-woocommerce' ),
    366366                'validation_rule'=>array('type'=>'skip'),
    367                 'after_form_field'=>'<input type="text" class="wt_iew_custom_delimiter" name="wt_iew_delimiter" value="'.$delimiter_default.'" maxlength = "1" />',
     367                'after_form_field'=>'<input type="text" class="wt_iew_custom_delimiter" name="wt_iew_delimiter" value="' . esc_attr( $delimiter_default ) . '" maxlength = "1" />', // Always pass safe data.
    368368            )
    369369        );

  • order-import-export-for-woocommerce/trunk/admin/modules/import/classes/class-import-ajax.php

    r3374407 r3375512  
    246246        $sample_data = array();
    247247        include_once WT_O_IEW_PLUGIN_PATH . 'admin/classes/class-csvreader.php';
    248         $delimiter = (isset($_POST['delimiter']) ? sanitize_text_field(wp_unslash($_POST['delimiter'])) : $delimit);
     248        $delimiter = (isset($_POST['delimiter']) ? wp_kses_post(wp_unslash($_POST['delimiter'])) : $delimit);
    249249
    250250        $reader = new Wt_Import_Export_For_Woo_Basic_Csvreader($delimiter);
    … …  
    749749
    750750                    include_once WT_O_IEW_PLUGIN_PATH.'admin/classes/class-csvreader.php';
    751                     $delimiter= isset( $_POST['delimiter'] ) ? sanitize_text_field(wp_unslash($_POST['delimiter'])) : $delimit;
     751                    $delimiter= isset( $_POST['delimiter'] ) ? wp_kses_post(wp_unslash($_POST['delimiter'])) : $delimit;
    752752                    $reader=new Wt_Import_Export_For_Woo_Basic_Csvreader($delimiter);
    753753   

  • order-import-export-for-woocommerce/trunk/admin/modules/import/import.php

    r3374407 r3375512  
    254254            'help_text'=>__('The character used to separate columns in the CSV file. Takes comma (,) by default.', 'order-import-export-for-woocommerce'),
    255255            'validation_rule'=>array('type'=>'skip'),
    256             'after_form_field'=>'<input type="text" class="wt_iew_custom_delimiter" name="wt_iew_delimiter" value="," />',
     256            'after_form_field'=>'<input type="text" class="wt_iew_custom_delimiter" name="wt_iew_delimiter" value="," />', // Always pass safe data.
    257257        );
    258258
    … …  
    979979        if(isset($form_data['method_import_form_data']) && $file_type=='csv')
    980980        {
    981             $csv_delimiter=(isset($form_data['method_import_form_data']['wt_iew_delimiter']) ? $form_data['method_import_form_data']['wt_iew_delimiter'] : $csv_delimiter);
    982             $csv_delimiter=($csv_delimiter=="" ? ',' : $csv_delimiter);
     981            $csv_delimiter = (isset($form_data['method_import_form_data']['wt_iew_delimiter']) ? $form_data['method_import_form_data']['wt_iew_delimiter'] : $csv_delimiter);
     982            $csv_delimiter = ( "" === $csv_delimiter ? ',' : $csv_delimiter );
     983            $csv_delimiter = ( "t" === $csv_delimiter ? "\t" : $csv_delimiter );
    983984        }       
    984985       
    985986       
    986 
    987             include_once WT_O_IEW_PLUGIN_PATH.'admin/classes/class-csvreader.php';
    988             $reader=new Wt_Import_Export_For_Woo_Basic_Csvreader($csv_delimiter);
    989 
    990 
    991         /* important: prepare deafult mapping formdata for quick import */
    992         $input_data=$reader->get_data_as_batch($file_path, $offset, $batch_count, $this, $form_data);
    993        
     987        include_once WT_O_IEW_PLUGIN_PATH.'admin/classes/class-csvreader.php';
     988        $reader=new Wt_Import_Export_For_Woo_Basic_Csvreader($csv_delimiter);
     989
     990        /* important: prepare default mapping formdata for quick import */
     991        $input_data=$reader->get_data_as_batch($file_path, $offset, $batch_count, $this, $form_data); 
     992
    994993        if(empty($input_data['data_arr'])){         
    995994            $out['msg']=__('CSV is empty', 'order-import-export-for-woocommerce');

  • order-import-export-for-woocommerce/trunk/admin/modules/order/export/class-wt-orderimpexpcsv-basic-exporter.php

    r3374407 r3375512  
    5656        $user_columns_name = !empty($_POST['columns_name']) ? array_map('sanitize_text_field', wp_unslash($_POST['columns_name'])) : $csv_columns;
    5757        $export_columns = !empty($_POST['columns']) ? array_map('sanitize_text_field', wp_unslash($_POST['columns'])) : array();   
    58         $delimiter = !empty($_POST['delimiter']) ? sanitize_text_field(wp_unslash($_POST['delimiter'])) : ',';
     58        $delimiter = !empty($_POST['delimiter']) ? wp_kses_post(wp_unslash($_POST['delimiter'])) : ',';
    5959        // phpcs:enable
    6060        $exclude_already_exported =  false;

  • order-import-export-for-woocommerce/trunk/admin/partials/_form_field_generator.php

    r3374407 r3375512  
    392392                        <?php
    393393                    }
    394                     echo wp_kses_post($after_form_field);
     394                    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Known HTML
     395                    echo $after_form_field;
    395396                }else
    396397                {
    397                     echo wp_kses_post($field_html);
     398                    // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Known HTML
     399                    echo $field_html;
    398400                }
    399401                // phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped -- Already escaped in the $conditional_help_html

  • order-import-export-for-woocommerce/trunk/changelog.txt

    r3374407 r3375512  
    11
    22== Changelog ==
     3
     4= 2.6.6 2025-10-09 =
     5* [Fix] Invalid delimiter sanitization caused issues during import/export.
    36
    47= 2.6.5 2025-10-07 =

  • order-import-export-for-woocommerce/trunk/helpers/class-wt-security-helper.php

    r3374407 r3375512  
    123123                    }else
    124124                    {
    125                         $out[$k] = self::sanitize_item($arrv, $type);
     125                        $final_type = ( false !== strpos( $k, 'delimiter') ? 'post_content' : $type );
     126                        $out[$k] = self::sanitize_item( $arrv, $final_type );
    126127                    }
    127128                }

  • order-import-export-for-woocommerce/trunk/includes/class-wt-import-export-for-woo.php

    r3374407 r3375512  
    8484                $this->version = WT_O_IEW_VERSION;
    8585            } else {
    86                 $this->version = '2.6.5';
     86                $this->version = '2.6.6';
    8787            }
    8888            $this->plugin_name = 'wt-import-export-for-woo-basic';

  • order-import-export-for-woocommerce/trunk/order-import-export-for-woocommerce.php

    r3374407 r3375512  
    77Author: WebToffee
    88Author URI: https://www.webtoffee.com/product/woocommerce-order-coupon-subscription-export-import/
    9 Version: 2.6.5
     9Version: 2.6.6
    1010Text Domain: order-import-export-for-woocommerce
    1111Domain Path: /languages
    … …  
    5555 * Rename this for your plugin and update it as you release new versions.
    5656 */
    57 define( 'WT_O_IEW_VERSION', '2.6.5' );
     57define( 'WT_O_IEW_VERSION', '2.6.6' );
    5858
    5959/**

  • order-import-export-for-woocommerce/trunk/readme.txt

    r3374407 r3375512  
    55Tested up to: 6.8
    66Requires PHP: 5.6
    7 Stable tag: 2.6.5
     7Stable tag: 2.6.6
    88License: GPLv3
    99License URI: http://www.gnu.org/licenses/gpl-3.0.html
    … …  
    208208== Changelog ==
    209209
    210 = 2.6.5 2025-10-07 =
    211 * [Compatibility] – Tested OK with WooCommerce 10.2.2
    212 * [Compatibility] – Tested OK with WordPress 6.8.3
    213 * [Update] – Plugin Check Plugin fixes.
     210= 2.6.6 2025-10-09 =
     211* [Fix] Invalid delimiter sanitization caused issues during import/export.
    214212
    215213[See changelog for all versions](https://plugins.svn.wordpress.org/order-import-export-for-woocommerce/trunk/changelog.txt)
    … …  
    217215== Upgrade Notice ==
    218216
    219 = 2.6.5 =
    220 * [Compatibility] – Tested OK with WooCommerce 10.2.2
    221 * [Compatibility] – Tested OK with WordPress 6.8.3
    222 * [Update] – Plugin Check Plugin fixes.
    223 
     217= 2.6.6 =
     218* [Fix] Invalid delimiter sanitization caused issues during import/export.
     219
Note: See TracChangeset for help on using the changeset viewer.