Merge pull request #1136 from live-composer/release_1.5.43

Release 1.5.43
live-composer · Jun 24, 2024 · 4b9fa36 · 4b9fa36
2 parents cf361fd + 94fd79b
commit 4b9fa36
Show file tree

Hide file tree

Showing 4 changed files with 165 additions and 21 deletions.
diff --git a/ds-live-composer.php b/ds-live-composer.php
@@ -4,7 +4,7 @@
  * Plugin URI: https://www.livecomposerplugin.com
  * Description: Page builder for WordPress with drag and drop header/footer editing.
  * Author: Live Composer Team
- * Version: 1.5.42
+ * Version: 1.5.43
  * Author URI: https://livecomposerplugin.com
  * License: GPL3
  * License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -41,7 +41,7 @@
 	 * Constants
 	 */
 
-	define( 'DS_LIVE_COMPOSER_VER', '1.5.42' );
+	define( 'DS_LIVE_COMPOSER_VER', '1.5.43' );
 
 	define( 'DS_LIVE_COMPOSER_SHORTNAME', __( 'Live Composer', 'live-composer-page-builder' ) );
 	define( 'DS_LIVE_COMPOSER_BASENAME', plugin_basename( __FILE__ ) );

diff --git a/includes/display-functions.php b/includes/display-functions.php
@@ -961,7 +961,7 @@ function dslc_json_decode( $raw_code, $ignore_migration = false ) {
 
 	}
 	else{
-		$raw_code = maybe_unserialize( maybe_serialize($raw_code) );
+		$raw_code = unserialize( maybe_serialize($raw_code) ,['allowed_classes' => false]);
 
 		// Array already provided. Do nothing.
 		if ( is_array( $raw_code ) ) {
@@ -990,8 +990,8 @@ function dslc_json_decode( $raw_code, $ignore_migration = false ) {
 			} else {
 				// 1. it's old code of the module settings serialized + base64.
 				// Get array out of it.
-				$decoded = maybe_unserialize( $decoded_base64 );
-
+				$decoded = unserialize( $decoded_base64,['allowed_classes' => false] );
+				
 				// Add a marker indicating that this module
 				// was imported from shortcode format.
 				if ( is_array( $decoded ) ) {
@@ -1465,12 +1465,12 @@ function dslc_modules_section_front( $atts, $content = null, $version = 1, $is_h
 
 	// Overlay Color.
 	if ( isset( $atts['bg_video_overlay_color'] ) && ! empty( $atts['bg_video_overlay_color'] ) ) {
-			$overlay_style .= 'background-color:' . $atts['bg_video_overlay_color'] . '; ';
+			$overlay_style .= 'background-color:' . esc_attr($atts['bg_video_overlay_color']) . '; ';
 	}
 
 	// Overlay Opacity.
 	if ( isset( $atts['bg_video_overlay_opacity'] ) && ! empty( $atts['bg_video_overlay_opacity'] ) ) {
-			$overlay_style .= 'opacity:' . $atts['bg_video_overlay_opacity'] . '; ';
+			$overlay_style .= 'opacity:' . esc_attr($atts['bg_video_overlay_opacity']) . '; ';
 	}
 
 	/**
@@ -1813,12 +1813,12 @@ function dslc_modules_area_front( $atts, $content = null, $version = 1, $is_head
 
 	$valign_class = '';
 	if ( isset( $atts['valign'] ) ) {
-		$valign_class = ' dslc-valign-' . $atts['valign'] . ' ';
+		$valign_class = ' dslc-valign-' . esc_attr($atts['valign']) . ' ';
 	} else {
 		$atts['valign'] = '';
 	}
 
-	$output = '<div class="dslc-modules-area dslc-col dslc-' . $atts['size'] . '-col ' . $pos_class . $valign_class . $admin_class . '" data-size="' . $atts['size'] . '" data-valign="' . $atts['valign'] . '">';
+	$output = '<div class="dslc-modules-area dslc-col dslc-' . $atts['size'] . '-col ' . $pos_class . $valign_class . $admin_class . '" data-size="' . $atts['size'] . '" data-valign="' . esc_attr($atts['valign']) . '">';
 
 	if ( $dslc_active && ! $is_header_footer && is_user_logged_in() && current_user_can( DS_LIVE_COMPOSER_CAPABILITY ) ) {
 

diff --git a/modules/navigation/functions.php b/modules/navigation/functions.php
@@ -66,11 +66,11 @@ function dslc_nav_render_menu( $atts, $content = null ) {
 	$menu_class = 'menu';
 
 	if ( isset( $atts['theme_location'] ) ) {
-		$theme_location = $atts['theme_location'];
+		$theme_location = esc_attr($atts['theme_location']);
 	}
 
 	if ( isset( $atts['menu_class'] ) ) {
-		$menu_class = $atts['menu_class'];
+		$menu_class = esc_attr($atts['menu_class']);
 	}
 
 	ob_start();
@@ -94,7 +94,7 @@ function dslc_nav_render_mobile_menu( $atts, $content = null ) {
 	$theme_location = '';
 
 	if ( isset( $atts['theme_location'] ) ) {
-		$theme_location = $atts['theme_location'];
+		$theme_location = esc_attr($atts['theme_location']);
 	}
 
 	ob_start();