Skip to content

Commit 83a30ba

Browse files
sc0ttkclarksc0ttkclark
committed
Pods 3.2.7.1
1 parent 620065d commit 83a30ba

15 files changed

+90
-34
lines changed

‎changelog.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ Found a bug? Have a great feature idea? Get on GitHub and tell us about it and w
22

33
Our GitHub has the full list of all prior releases of Pods: https://github.com/pods-framework/pods/releases
44

5+
= 3.2.7.1 - October 9th, 2024 =
6+
7+
* Security: Lock down heading field to only specific allowed HTML tags and preventing it from being used to insert malicious scripts. Props to the CleanTalk / Dmitrii Ignatyev for responsibly reporting this. (@sc0ttkclark)
8+
59
= 3.2.7 - August 28th, 2024 =
610

711
* Feature: New Pods Related Item List block that works like a Pods Item List block but uses the Pods Single Item block context where you specify a relationship field name to reference. (@sc0ttkclark)

‎classes/PodsAdmin.php

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2026,7 +2026,7 @@ public function get_callouts() {
20262026

20272027
if ( ! $callouts ) {
20282028
$callouts = [
2029-
'friends_2023_docs' => 1,
2029+
'friends_2024_docs' => 1,
20302030
'access_rights' => (
20312031
PodsInit::$version_last
20322032
&& version_compare( PodsInit::$version_last, '3.1.0-a-1', '<' )
@@ -2038,7 +2038,7 @@ public function get_callouts() {
20382038

20392039
// Handle callouts logic.
20402040
$callouts['access_rights'] = ! isset( $callouts['access_rights'] ) || $callouts['access_rights'] ? 1 : 0;
2041-
$callouts['friends_2023_docs'] = ! isset( $callouts['friends_2023_docs'] ) || $callouts['friends_2023_docs'] || $force_callouts ? 1 : 0;
2041+
$callouts['friends_2024_docs'] = ! isset( $callouts['friends_2024_docs'] ) || $callouts['friends_2024_docs'] || $force_callouts ? 1 : 0;
20422042

20432043
/**
20442044
* Allow hooking into whether or not the specific callouts should show.
@@ -2108,7 +2108,7 @@ public function handle_callouts_updates() {
21082108

21092109
if ( $is_demo ) {
21102110
// Disable Friends of Pods callout on demos.
2111-
$callout_dismiss = 'friends_2023_docs';
2111+
$callout_dismiss = 'friends_2024_docs';
21122112
}
21132113

21142114
if ( $callout_dismiss ) {
@@ -2188,10 +2188,10 @@ public function admin_manage_callouts() {
21882188
$did_callout = true;
21892189

21902190
pods_view( PODS_DIR . 'ui/admin/callouts/access_rights.php', compact( array_keys( get_defined_vars() ) ) );
2191-
} elseif ( ! empty( $callouts['friends_2023_docs'] ) ) {
2191+
} elseif ( ! empty( $callouts['friends_2024_docs'] ) ) {
21922192
$did_callout = true;
21932193

2194-
pods_view( PODS_DIR . 'ui/admin/callouts/friends_2023_docs.php', compact( array_keys( get_defined_vars() ) ) );
2194+
pods_view( PODS_DIR . 'ui/admin/callouts/friends_2024_docs.php', compact( array_keys( get_defined_vars() ) ) );
21952195
}
21962196
}
21972197

‎classes/fields/heading.php

Lines changed: 57 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -41,15 +41,25 @@ public function setup() {
4141
public function options() {
4242
return [
4343
static::$type . '_tag' => [
44-
'label' => __( 'Heading HTML Tag', 'pods' ),
45-
'type' => 'text',
46-
'default' => '',
44+
'label' => __( 'Heading HTML Tag', 'pods' ),
45+
'type' => 'pick',
46+
'data' => [
47+
'h1' => 'h1',
48+
'h2' => 'h2',
49+
'h3' => 'h3',
50+
'h4' => 'h4',
51+
'h5' => 'h5',
52+
'h6' => 'h6',
53+
'p' => 'p',
54+
'div' => 'div',
55+
],
56+
'default' => 'h2',
4757
'description' => __( 'Leave this empty to use the default heading tag for the form context the heading appears in.', 'pods' ),
4858
'help' => __( 'This is the heading HTML tag to use for the heading text. Example "h2" will output your heading as <code>&lt;h2&gt;Heading Text&lt;/h2&gt;</code>', 'pods' ),
4959
],
50-
'output_options' => [
51-
'label' => __( 'Output Options', 'pods' ),
52-
'type' => 'boolean_group',
60+
'output_options' => [
61+
'label' => __( 'Output Options', 'pods' ),
62+
'type' => 'boolean_group',
5363
'boolean_group' => [
5464
static::$type . '_allow_html' => [
5565
'label' => __( 'Allow HTML', 'pods' ),
@@ -101,11 +111,13 @@ public function schema( $options = null ) {
101111
public function input( $name, $value = null, $options = null, $pod = null, $id = null ) {
102112
$options = ( is_array( $options ) || is_object( $options ) ) ? $options : (array) $options;
103113

114+
$options[ static::$type . '_tag' ] = static::get_heading_tag( $options );
115+
104116
// Format content.
105-
$options[ static::$type . '_content' ] = $this->display( $options[ static::$type . '_content' ], $name, $options, $pod, $id );
117+
$options[ 'label' ] = $this->display( $options[ 'label' ], $name, $options, $pod, $id );
106118

107119
if ( isset( $options['_field_object'] ) && $options['_field_object'] instanceof Field ) {
108-
$options['_field_object']->set_arg( static::$type . '_content', $options[ static::$type . '_content' ] );
120+
$options['_field_object']->set_arg( 'label', $options[ 'label' ] );
109121
}
110122

111123
$type = pods_v( 'type', $options, static::$type );
@@ -120,9 +132,9 @@ public function input( $name, $value = null, $options = null, $pod = null, $id =
120132
* {@inheritdoc}
121133
*/
122134
public function display( $value = null, $name = null, $options = null, $pod = null, $id = null ) {
123-
// Support passing html_content into the options for custom HTML option layouts.
124-
if ( empty( $value ) && ! empty( $options[ static::$type . '_content' ] ) ) {
125-
$value = $options[ static::$type . '_content' ];
135+
// Support passing label into the options for custom HTML option layouts.
136+
if ( empty( $value ) && ! empty( $options[ 'label' ] ) ) {
137+
$value = $options[ 'label' ];
126138
}
127139

128140
$value = $this->strip_html( $value, $options );
@@ -150,4 +162,38 @@ public function ui( $id, $value, $name = null, $options = null, $fields = null,
150162

151163
return wp_trim_words( $value );
152164
}
165+
166+
/**
167+
* Get the heading tag from the field options and ensure it's allowed.
168+
*
169+
* @since 3.2.7.1
170+
*
171+
* @param array|Field $options The field data.
172+
* @param null|string $default The default heading tag to use.
173+
*
174+
* @return string The heading tag.
175+
*/
176+
public static function get_heading_tag( $options, ?string $default = null ): string {
177+
// Only allow specific HTML tags.
178+
$allowed_html_tags = [
179+
'h1' => 'h1',
180+
'h2' => 'h2',
181+
'h3' => 'h3',
182+
'h4' => 'h4',
183+
'h5' => 'h5',
184+
'h6' => 'h6',
185+
'p' => 'p',
186+
'div' => 'div',
187+
];
188+
189+
$heading_tag = 'h2';
190+
191+
if ( ! empty( $options[ static::$type . '_tag' ] ) && isset( $allowed_html_tags[ $options[ static::$type . '_tag' ] ] ) ) {
192+
$heading_tag = $options[ static::$type . '_tag' ];
193+
} elseif ( ! empty( $default ) && isset( $allowed_html_tags[ $default ] ) ) {
194+
$heading_tag = $default;
195+
}
196+
197+
return $heading_tag;
198+
}
153199
}

‎init.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* Plugin Name: Pods - Custom Content Types and Fields
1111
* Plugin URI: https://pods.io/
1212
* Description: Pods is a framework for creating, managing, and deploying customized content types and fields
13-
* Version: 3.2.7.1-a-1
13+
* Version: 3.2.7.1
1414
* Author: Pods Framework Team
1515
* Author URI: https://pods.io/about/
1616
* Text Domain: pods
@@ -43,7 +43,7 @@
4343
add_action( 'init', 'pods_deactivate_pods_ui' );
4444
} else {
4545
// Current version.
46-
define( 'PODS_VERSION', '3.2.7.1-a-1' );
46+
define( 'PODS_VERSION', '3.2.7.1' );
4747

4848
// Current database version, this is the last version the database changed.
4949
define( 'PODS_DB_VERSION', '2.3.5' );

‎package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "pods",
3-
"version": "3.2.7.1-a-1",
3+
"version": "3.2.7.1",
44
"description": "Pods is a development framework for creating, extending, managing, and deploying customized content types in WordPress.",
55
"author": "Pods Foundation, Inc",
66
"homepage": "https://pods.io/",

‎readme.txt

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Tags: pods, custom post types, custom taxonomies, content types, custom fields
55
Requires at least: 6.0
66
Tested up to: 6.6
77
Requires PHP: 7.2
8-
Stable tag: 3.2.7.1-a-1
8+
Stable tag: 3.2.7.1
99
License: GPLv2 or later
1010
License URI: http://www.gnu.org/licenses/gpl-2.0.html
1111

@@ -96,7 +96,7 @@ You can enable some of our included components to extend your WordPress site eve
9696

9797
= Plugins that integrate with Pods =
9898

99-
* [Advanced Views Lite](https://pods.io/advanced-views-lite/) - Lets you build templates (views) and queries (cards) so that you can manage your content rendering with less code.
99+
* [Advanced Views Lite](https://wplake.org/advanced-views-lite/?ref=5) - Lets you build templates (views) and queries (cards) so that you can manage your content rendering with less code. (Disclaimer: We have an affiliate link to them to help support our project)
100100
* [Bricks Builder](https://bricksbuilder.io/)
101101
* [Codepress Admin Columns](https://wordpress.org/plugins/codepress-admin-columns/) using premium [Admin Columns Pro](https://www.admincolumns.com/pods/) Pods integration
102102
* [Conductor](https://conductorplugin.com/)
@@ -114,7 +114,7 @@ You can enable some of our included components to extend your WordPress site eve
114114
= Extend Pods with Free Add-Ons =
115115

116116
* [Pods Beaver Themer Add-On](https://wordpress.org/plugins/pods-beaver-builder-themer-add-on/) - Integrates Pods with [Beaver Themer](https://www.wpbeaverbuilder.com/beaver-themer/)
117-
* [Pods Gravity Forms Add-On](https://wordpress.org/plugins/pods-gravity-forms/) - Integrates Pods with [Gravity Forms](https://pods.io/gravityforms/)
117+
* [Pods Gravity Forms Add-On](https://wordpress.org/plugins/pods-gravity-forms/) - Integrates Pods with [Gravity Forms](https://www.gravityforms.com/)
118118
* [Pods Alternative Cache Add-On](https://wordpress.org/plugins/pods-alternative-cache/) - Speed up Pods on servers with limited object caching capabilities
119119
* [Pods SEO Add-On](https://wordpress.org/plugins/pods-seo/) - Integrates Pods Advanced Content Types with Yoast SEO
120120
* [Pods AJAX Views Add-On](https://wordpress.org/plugins/pods-ajax-views/) - Adds new functions you can use to output template parts that load via AJAX after other page elements
@@ -182,6 +182,10 @@ Pods really wouldn't be where it is without all the contributions from our [dono
182182

183183
== Changelog ==
184184

185+
= 3.2.7.1 - October 9th, 2024 =
186+
187+
* Security: Lock down heading field to only specific allowed HTML tags and preventing it from being used to insert malicious scripts. Props to the CleanTalk / Dmitrii Ignatyev for responsibly reporting this. (@sc0ttkclark)
188+
185189
= 3.2.7 - August 28th, 2024 =
186190

187191
* Feature: New Pods Related Item List block that works like a Pods Item List block but uses the Pods Single Item block context where you specify a relationship field name to reference. (@sc0ttkclark)

‎ui/admin/callouts/friends_2023_docs.php renamed to ‎ui/admin/callouts/friends_2024_docs.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@
99
* @var bool $force_callouts Whether to force the callouts.
1010
*/
1111

12-
$callout = 'friends_2023_docs';
12+
$callout = 'friends_2024_docs';
1313

14-
$donor_count = 2768;
14+
$donor_count = 2747;
1515
$donor_goal = 7000;
1616
$progress_width = ( $donor_count / $donor_goal ) * 100;
1717

@@ -60,7 +60,7 @@
6060
<p class="pods-admin_friends-callout_text">
6161
🎉&nbsp;
6262
<?php
63-
esc_html_e( 'Pods 3.2 is out and our goal is to spend 2024 focused on revamping our Documentation, Tutorials, and Video content', 'pods' );
63+
esc_html_e( 'Our goal is to be able to focus on revamping our Documentation, Tutorials, and Video content', 'pods' );
6464

6565
/*printf(
6666
'%1$s: %2$s',

‎ui/forms/div-row.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
<div class="pods-field__container pods-field-option <?php echo esc_attr( $row_classes ); ?>"
1818
style="<?php echo esc_attr( 'hidden' == $field['type'] ? 'display:none;' : '' ); ?>">
1919
<?php if ( 'heading' === $field['type'] ) : ?>
20-
<?php $heading_tag = pods_v( $field['type'] . '_tag', $field, isset( $heading_tag ) ? $heading_tag : 'h2', true ); ?>
20+
<?php $heading_tag = PodsField_Heading::get_heading_tag( $field, 'h2' ); ?>
2121
<<?php echo esc_html( sanitize_key( $heading_tag ) ); ?>
2222
class="pods-form-ui-heading pods-form-ui-heading-<?php echo esc_attr( $field['name'] ); ?>"
2323
id="heading-<?php echo esc_attr( $field['name'] ); ?>">

‎ui/forms/list-row.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
<li class="pods-field__container pods-field-option <?php echo esc_attr( $row_classes ); ?>"
1818
style="<?php echo esc_attr( 'hidden' == $field['type'] ? 'display:none;' : '' ); ?>">
1919
<?php if ( 'heading' === $field['type'] ) : ?>
20-
<?php $heading_tag = pods_v( $field['type'] . '_tag', $field, isset( $heading_tag ) ? $heading_tag : 'h2', true ); ?>
20+
<?php $heading_tag = PodsField_Heading::get_heading_tag( $field, 'h2' ); ?>
2121
<<?php echo esc_html( sanitize_key( $heading_tag ) ); ?>
2222
class="pods-form-ui-heading pods-form-ui-heading-<?php echo esc_attr( $field['name'] ); ?>"
2323
id="heading-<?php echo esc_attr( $field['name'] ); ?>">

‎ui/forms/p-row.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
?>
1717
<div class="pods-field__container pods-field-option" style="<?php echo esc_attr( 'hidden' == $field['type'] ? 'display:none;' : '' ); ?>">
1818
<?php if ( 'heading' === $field['type'] ) : ?>
19-
<?php $heading_tag = pods_v( $field['type'] . '_tag', $field, isset( $heading_tag ) ? $heading_tag : 'h2', true ); ?>
19+
<?php $heading_tag = PodsField_Heading::get_heading_tag( $field, 'h2' ); ?>
2020
<<?php echo esc_html( sanitize_key( $heading_tag ) ); ?>
2121
class="pods-form-ui-heading pods-form-ui-heading-<?php echo esc_attr( $field['name'] ); ?>"
2222
id="heading-<?php echo esc_attr( $field['name'] ); ?>">

‎ui/forms/table-row.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
<tr valign="top" class="pods-field__container pods-field-option <?php echo esc_attr( $row_classes ); ?>"
1919
style="<?php echo esc_attr( 'hidden' == $field['type'] ? 'display:none;' : '' ); ?>">
2020
<?php if ( 'heading' === $field['type'] ) : ?>
21-
<?php $heading_tag = pods_v( $field['type'] . '_tag', $field, isset( $heading_tag ) ? $heading_tag : 'h2', true ); ?>
21+
<?php $heading_tag = PodsField_Heading::get_heading_tag( $field, 'h2' ); ?>
2222
<td colspan="2">
2323
<<?php echo esc_html( sanitize_key( $heading_tag ) ); ?>
2424
class="pods-form-ui-heading pods-form-ui-heading-<?php echo esc_attr( $field['name'] ); ?>"

‎ui/js/dfv/pods-dfv.min.asset.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"dependencies":["lodash","moment","react","react-dom","react-jsx-runtime","regenerator-runtime","wp-api-fetch","wp-autop","wp-components","wp-compose","wp-data","wp-element","wp-hooks","wp-i18n","wp-keycodes","wp-plugins","wp-primitives","wp-url"],"version":"6c3b89ffe8da2dcd1d1f"}
1+
{"dependencies":["lodash","moment","react","react-dom","react-jsx-runtime","regenerator-runtime","wp-api-fetch","wp-autop","wp-components","wp-compose","wp-data","wp-element","wp-hooks","wp-i18n","wp-keycodes","wp-plugins","wp-primitives","wp-url"],"version":"82c8aaf9e4ae1481502c"}

‎ui/js/dfv/pods-dfv.min.js

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ui/js/dfv/src/fields/heading/heading-tag.js

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,18 +11,20 @@ const elements = {
1111
h4: 'h4',
1212
h5: 'h5',
1313
h6: 'h6',
14+
p: 'p',
15+
div: 'div',
1416
};
1517

1618
function HeadingTag( { type, children, ...props } ) {
1719
return React.createElement(
18-
elements[type] || elements.h3,
20+
elements[type] || elements.h2,
1921
props,
2022
children
2123
);
2224
}
2325

2426
HeadingTag.defaultProps = {
25-
type: 'h3',
27+
type: 'h2',
2628
};
2729

2830
export default HeadingTag;

‎ui/js/dfv/src/fields/heading/index.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import './heading.scss';
99
const Heading = ( props ) => {
1010
const {
1111
fieldConfig: {
12-
heading_tag: headingTag = 'h3',
12+
heading_tag: headingTag = 'h2',
1313
helpText,
1414
label,
1515
name,

0 commit comments

Comments
 (0)