Popup Maker – Popup Forms, Optins & More - Version 1.16.9

Version Description

Download this release

Release Info

Developer danieliser
Plugin Icon 128x128 Popup Maker – Popup Forms, Optins & More
Version 1.16.9
Comparing to
See all releases

Code changes from version 1.16.8 to 1.16.9

Files changed (7) hide show
  1. classes/Shortcode/PopupClose.php +22 -10
  2. classes/Shortcode/PopupTrigger.php +17 -10
  3. classes/Shortcode/Subscribe.php +16 -17
  4. includes/functions/popups/getters.php +0 -2
  5. includes/functions/popups/template.php +1 -1
  6. popup-maker.php +2 -2
  7. readme.txt +5 -1
classes/Shortcode/PopupClose.php CHANGED
@@ -112,9 +112,11 @@ class PUM_Shortcode_PopupClose extends PUM_Shortcode {
112
  * @return array
113
  */
114
  public function shortcode_atts( $atts ) {
 
 
115
  $atts = parent::shortcode_atts( $atts );
116
 
117
- if ( empty( $atts['tag'] ) ) {
118
  $atts['tag'] = 'span';
119
  }
120
 
@@ -141,22 +143,32 @@ class PUM_Shortcode_PopupClose extends PUM_Shortcode {
141
  public function handler( $atts, $content = null ) {
142
  $atts = $this->shortcode_atts( $atts );
143
 
144
- $do_default = $atts['do_default'] ? " data-do-default='" . esc_attr( $atts['do_default'] ) . "'" : '';
 
 
145
 
146
  // Sets up our href and target, if the tag is an `a`.
147
- $href = 'a' === $atts['tag'] ? "href='{$atts['href']}'" : '';
148
- $target = 'a' === $atts['tag'] && ! empty( $atts['target'] ) ? "target='{$atts['target']}'" : '';
149
 
150
- $return = "<{$atts['tag']} $href $target class='pum-close popmake-close {$atts['classes']}' {$do_default}>";
151
- $return .= PUM_Helpers::do_shortcode( $content );
152
- $return .= "</{$atts['tag']}>";
153
 
154
  return $return;
155
  }
156
 
157
- public function template() { ?>
158
- <{{{attrs.tag}}} class="pum-close popmake-close <# if (typeof attrs.classes !== 'undefined') print(attrs.classes); #>">{{{attrs._inner_content}}}</{{{attrs.tag}}}><?php
 
 
 
 
 
 
 
 
 
159
  }
160
 
161
  }
162
-
112
  * @return array
113
  */
114
  public function shortcode_atts( $atts ) {
115
+ global $allowedtags;
116
+
117
  $atts = parent::shortcode_atts( $atts );
118
 
119
+ if ( empty( $atts['tag'] ) || ! in_array( $atts['tag'], array_keys( $allowedtags ) ) ) {
120
  $atts['tag'] = 'span';
121
  }
122
 
143
  public function handler( $atts, $content = null ) {
144
  $atts = $this->shortcode_atts( $atts );
145
 
146
+ $tag = esc_attr( $atts['tag'] );
147
+
148
+ $do_default = $atts['do_default'] ? " data-do-default='true'" : '';
149
 
150
  // Sets up our href and target, if the tag is an `a`.
151
+ $href = 'a' === $atts['tag'] ? "href='{" . esc_attr( $atts['href'] ) . "}'" : '';
152
+ $target = 'a' === $atts['tag'] && ! empty( $atts['target'] ) ? "target='" . esc_attr( $atts['target'] ) . "'" : '';
153
 
154
+ $return = "<{$tag} $href $target class='pum-close popmake-close " . esc_attr( $atts['classes'] ) . "' {$do_default}>";
155
+ $return .= esc_html( PUM_Helpers::do_shortcode( $content ) );
156
+ $return .= "</{$tag}>";
157
 
158
  return $return;
159
  }
160
 
161
+ /**
162
+ * NOTE: Data comes here already filtered through shortcode_atts above.
163
+ */
164
+ public function template() {
165
+ global $allowedtags;
166
+ ?>
167
+ <#
168
+ const allowedTags = <?php echo json_encode( array_keys( $allowedtags ) ); ?>;
169
+ const tag = allowedTags.indexOf( attrs.tag ) >= 0 ? attrs.tag : 'span';
170
+ #>
171
+ <{{{tag}}} class="pum-close popmake-close <# if (typeof attrs.classes !== 'undefined') print(attrs.classes); #>">{{{attrs._inner_content}}}</{{{tag}}}><?php
172
  }
173
 
174
  }
 
classes/Shortcode/PopupTrigger.php CHANGED
@@ -142,9 +142,12 @@ class PUM_Shortcode_PopupTrigger extends PUM_Shortcode {
142
  */
143
  public function handler( $atts, $content = null ) {
144
  $atts = $this->shortcode_atts( $atts );
145
- $return = '<' . $atts['tag'] . ' class="pum-trigger popmake-' . $atts['id'] . ' ' . $atts['classes'] . '" data-do-default="' . esc_attr( $atts['do_default'] ) . '">';
146
- $return .= PUM_Helpers::do_shortcode( $content );
147
- $return .= '</' . $atts['tag'] . '>';
 
 
 
148
 
149
  PUM_Site_Popups::preload_popup_by_id_if_enabled( $atts['id'] );
150
 
@@ -161,9 +164,11 @@ class PUM_Shortcode_PopupTrigger extends PUM_Shortcode {
161
  * @return array
162
  */
163
  public function shortcode_atts( $atts ) {
 
 
164
  $atts = parent::shortcode_atts( $atts );
165
 
166
- if ( empty( $atts['tag'] ) ) {
167
  $atts['tag'] = 'span';
168
  }
169
 
@@ -176,15 +181,17 @@ class PUM_Shortcode_PopupTrigger extends PUM_Shortcode {
176
  unset( $atts['class'] );
177
  }
178
 
179
-
180
  return $atts;
181
  }
182
 
183
- /**
184
- *
185
- */
186
- public function template() { ?>
187
- <{{{attrs.tag}}} class="pum-trigger popmake-{{{attrs.id}}} {{{attrs.classes}}}">{{{attrs._inner_content}}}</{{{attrs.tag}}}><?php
 
 
 
188
  }
189
 
190
  }
142
  */
143
  public function handler( $atts, $content = null ) {
144
  $atts = $this->shortcode_atts( $atts );
145
+
146
+ $tag = esc_attr( $atts['tag'] );
147
+
148
+ $return = '<' . $tag . ' class="pum-trigger popmake-' . esc_attr( $atts['id'] ) . ' ' . esc_attr( $atts['classes'] ) . '" data-do-default="' . esc_attr( $atts['do_default'] ) . '">';
149
+ $return .= esc_html( PUM_Helpers::do_shortcode( $content ) );
150
+ $return .= '</' . $tag . '>';
151
 
152
  PUM_Site_Popups::preload_popup_by_id_if_enabled( $atts['id'] );
153
 
164
  * @return array
165
  */
166
  public function shortcode_atts( $atts ) {
167
+ global $allowedtags;
168
+
169
  $atts = parent::shortcode_atts( $atts );
170
 
171
+ if ( empty( $atts['tag'] ) || ! in_array( $atts['tag'], array_keys( $allowedtags ) ) ) {
172
  $atts['tag'] = 'span';
173
  }
174
 
181
  unset( $atts['class'] );
182
  }
183
 
 
184
  return $atts;
185
  }
186
 
187
+ public function template() {
188
+ global $allowedtags;
189
+ ?>
190
+ <#
191
+ const allowedTags = <?php echo json_encode( array_keys( $allowedtags ) ); ?>;
192
+ const tag = allowedTags.indexOf( attrs.tag ) >= 0 ? attrs.tag : 'span';
193
+ #>
194
+ <{{{tag}}} class="pum-trigger popmake-{{{attrs.id}}} {{{attrs.classes}}}">{{{attrs._inner_content}}}</{{{tag}}}><?php
195
  }
196
 
197
  }
classes/Shortcode/Subscribe.php CHANGED
@@ -509,9 +509,9 @@ class PUM_Shortcode_Subscribe extends PUM_Shortcode {
509
 
510
  <div class="pum-form__field pum-form__field--name pum-sub-form-field pum-sub-form-field--name">
511
  <?php if ( ! $atts['disable_labels'] ) : ?>
512
- <label class="pum-form__label pum-sub-form-label"><?php echo $atts['label_name']; ?></label>
513
  <?php endif; ?>
514
- <input type="text" name="name" <?php echo $required; ?> placeholder="<?php echo esc_attr( $atts['placeholder_name'] ); ?>" />
515
  </div>
516
 
517
  <?php
@@ -521,9 +521,9 @@ class PUM_Shortcode_Subscribe extends PUM_Shortcode {
521
 
522
  <div class="pum-form__field pum-form__field--fname pum-sub-form-field pum-sub-form-field--fname">
523
  <?php if ( ! $atts['disable_labels'] ) : ?>
524
- <label class="pum-form__label pum-sub-form-label"><?php echo $atts['label_fname']; ?></label>
525
  <?php endif; ?>
526
- <input type="text" name="fname" <?php echo $required; ?> placeholder="<?php echo esc_attr( $atts['placeholder_fname'] ); ?>" />
527
  </div>
528
 
529
  <?php
@@ -533,16 +533,16 @@ class PUM_Shortcode_Subscribe extends PUM_Shortcode {
533
 
534
  <div class="pum-form__field pum-form__field--fname pum-sub-form-field pum-sub-form-field--fname">
535
  <?php if ( ! $atts['disable_labels'] ) : ?>
536
- <label class="pum-form__label pum-sub-form-label"><?php echo $atts['label_fname']; ?></label>
537
  <?php endif; ?>
538
- <input type="text" name="fname" <?php echo $required; ?> placeholder="<?php echo esc_attr( $atts['placeholder_fname'] ); ?>" />
539
  </div>
540
 
541
  <div class="pum-form__field pum-form__field--lname pum-sub-form-field pum-sub-form-field--lname">
542
  <?php if ( ! $atts['disable_labels'] ) : ?>
543
- <label class="pum-form__label pum-sub-form-label"><?php echo $atts['label_lname']; ?></label>
544
  <?php endif; ?>
545
- <input type="text" name="lname" <?php echo $required; ?> placeholder="<?php echo esc_attr( $atts['placeholder_lname'] ); ?>" />
546
  </div>
547
 
548
  <?php
@@ -553,7 +553,7 @@ class PUM_Shortcode_Subscribe extends PUM_Shortcode {
553
 
554
  <div class="pum-form__field pum-form__field--email pum-sub-form-field pum-sub-form-field--email">
555
  <?php if ( ! $atts['disable_labels'] ) : ?>
556
- <label class="pum-form__label pum-sub-form-label"><?php echo $atts['label_email']; ?></label>
557
  <?php endif; ?>
558
  <input type="email" name="email" required placeholder="<?php echo esc_attr( $atts['placeholder_email'] ); ?>" />
559
  </div>
@@ -562,7 +562,7 @@ class PUM_Shortcode_Subscribe extends PUM_Shortcode {
562
 
563
  <?php do_action( 'pum_newsletter_fields', $atts ); ?>
564
 
565
- <input type="hidden" name="provider" value="<?php echo $atts['provider']; ?>" />
566
 
567
  <?php if ( $atts['privacy_consent_enabled'] == 'yes' ) :
568
  $consent_text = trim( $atts['privacy_consent_label'] );
@@ -585,14 +585,14 @@ class PUM_Shortcode_Subscribe extends PUM_Shortcode {
585
  break;
586
  case 'radio': ?>
587
  <?php if ( ! empty( $consent_text ) ) : ?>
588
- <label class="pum-form__label pum-sub-form-label"><?php echo wp_kses( $consent_text, array() ); ?></label>
589
  <?php endif; ?>
590
  <div class="pum-form__consent-radios pum-form__consent-radios--<?php echo esc_attr( $atts['privacy_consent_radio_layout'] ); ?>">
591
  <label class="pum-form__label pum-sub-form-label">
592
- <input type="radio" value="yes" name="consent" <?php echo $consent_args['required'] ? 'required="required"' : ''; ?> /> <?php echo wp_kses( $atts['privacy_consent_yes_label'], array() ); ?>
593
  </label>
594
  <label class="pum-form__label pum-sub-form-label">
595
- <input type="radio" value="no" name="consent" /> <?php echo wp_kses( $atts['privacy_consent_no_label'], array() ); ?>
596
  </label>
597
  </div>
598
  <?php
@@ -613,14 +613,14 @@ class PUM_Shortcode_Subscribe extends PUM_Shortcode {
613
  }
614
  ?>
615
  <p>
616
- <small><?php echo wp_kses( $usage_text, array( 'a' => array( 'target' => true, 'href' => true ) ) ); ?></small>
617
  </p>
618
  <?php endif; ?>
619
  </div>
620
  <?php endif; ?>
621
 
622
  <div class="pum-form__field pum-form__field--submit pum-sub-form-field pum-sub-form-field--submit">
623
- <button class="pum-form__submit pum-sub-form-submit"><?php echo $atts['label_submit']; ?></button>
624
  </div>
625
 
626
  <?php do_action( 'pum_sub_form_after', $atts ); ?>
@@ -697,7 +697,7 @@ class PUM_Shortcode_Subscribe extends PUM_Shortcode {
697
  $data[ $key ] = $value;
698
 
699
  if ( $key == 'redirect' ) {
700
- $data[ $key ] = base64_encode( $value );
701
  }
702
  }
703
  }
@@ -732,4 +732,3 @@ class PUM_Shortcode_Subscribe extends PUM_Shortcode {
732
  }
733
 
734
  }
735
-
509
 
510
  <div class="pum-form__field pum-form__field--name pum-sub-form-field pum-sub-form-field--name">
511
  <?php if ( ! $atts['disable_labels'] ) : ?>
512
+ <label class="pum-form__label pum-sub-form-label"><?php echo esc_html( $atts['label_name'] ); ?></label>
513
  <?php endif; ?>
514
+ <input type="text" name="name" <?php echo esc_attr( $required ); ?> placeholder="<?php echo esc_attr( $atts['placeholder_name'] ); ?>" />
515
  </div>
516
 
517
  <?php
521
 
522
  <div class="pum-form__field pum-form__field--fname pum-sub-form-field pum-sub-form-field--fname">
523
  <?php if ( ! $atts['disable_labels'] ) : ?>
524
+ <label class="pum-form__label pum-sub-form-label"><?php echo esc_html( $atts['label_fname'] ); ?></label>
525
  <?php endif; ?>
526
+ <input type="text" name="fname" <?php echo esc_attr( $required ); ?> placeholder="<?php echo esc_attr( $atts['placeholder_fname'] ); ?>" />
527
  </div>
528
 
529
  <?php
533
 
534
  <div class="pum-form__field pum-form__field--fname pum-sub-form-field pum-sub-form-field--fname">
535
  <?php if ( ! $atts['disable_labels'] ) : ?>
536
+ <label class="pum-form__label pum-sub-form-label"><?php echo esc_html( $atts['label_fname'] ); ?></label>
537
  <?php endif; ?>
538
+ <input type="text" name="fname" <?php echo esc_attr( $required ); ?> placeholder="<?php echo esc_attr( $atts['placeholder_fname'] ); ?>" />
539
  </div>
540
 
541
  <div class="pum-form__field pum-form__field--lname pum-sub-form-field pum-sub-form-field--lname">
542
  <?php if ( ! $atts['disable_labels'] ) : ?>
543
+ <label class="pum-form__label pum-sub-form-label"><?php echo esc_html( $atts['label_lname'] ); ?></label>
544
  <?php endif; ?>
545
+ <input type="text" name="lname" <?php echo esc_attr( $required ); ?> placeholder="<?php echo esc_attr( $atts['placeholder_lname'] ); ?>" />
546
  </div>
547
 
548
  <?php
553
 
554
  <div class="pum-form__field pum-form__field--email pum-sub-form-field pum-sub-form-field--email">
555
  <?php if ( ! $atts['disable_labels'] ) : ?>
556
+ <label class="pum-form__label pum-sub-form-label"><?php echo esc_html( $atts['label_email'] ); ?></label>
557
  <?php endif; ?>
558
  <input type="email" name="email" required placeholder="<?php echo esc_attr( $atts['placeholder_email'] ); ?>" />
559
  </div>
562
 
563
  <?php do_action( 'pum_newsletter_fields', $atts ); ?>
564
 
565
+ <input type="hidden" name="provider" value="<?php echo esc_attr( $atts['provider'] ); ?>" />
566
 
567
  <?php if ( $atts['privacy_consent_enabled'] == 'yes' ) :
568
  $consent_text = trim( $atts['privacy_consent_label'] );
585
  break;
586
  case 'radio': ?>
587
  <?php if ( ! empty( $consent_text ) ) : ?>
588
+ <label class="pum-form__label pum-sub-form-label"><?php echo esc_html( wp_kses( $consent_text, array() ) ); ?></label>
589
  <?php endif; ?>
590
  <div class="pum-form__consent-radios pum-form__consent-radios--<?php echo esc_attr( $atts['privacy_consent_radio_layout'] ); ?>">
591
  <label class="pum-form__label pum-sub-form-label">
592
+ <input type="radio" value="yes" name="consent" <?php echo $consent_args['required'] ? 'required="required"' : ''; ?> /> <?php echo esc_html( wp_kses( $atts['privacy_consent_yes_label'], array() ) ); ?>
593
  </label>
594
  <label class="pum-form__label pum-sub-form-label">
595
+ <input type="radio" value="no" name="consent" /> <?php echo esc_html( wp_kses( $atts['privacy_consent_no_label'], array() ) ); ?>
596
  </label>
597
  </div>
598
  <?php
613
  }
614
  ?>
615
  <p>
616
+ <small><?php echo esc_html( wp_kses( $usage_text, array( 'a' => array( 'target' => true, 'href' => true ) ) ) ); ?></small>
617
  </p>
618
  <?php endif; ?>
619
  </div>
620
  <?php endif; ?>
621
 
622
  <div class="pum-form__field pum-form__field--submit pum-sub-form-field pum-sub-form-field--submit">
623
+ <button class="pum-form__submit pum-sub-form-submit"><?php echo esc_html( $atts['label_submit'] ); ?></button>
624
  </div>
625
 
626
  <?php do_action( 'pum_sub_form_after', $atts ); ?>
697
  $data[ $key ] = $value;
698
 
699
  if ( $key == 'redirect' ) {
700
+ $data[ $key ] = base64_encode( esc_url( $value ) );
701
  }
702
  }
703
  }
732
  }
733
 
734
  }
 
includes/functions/popups/getters.php CHANGED
@@ -36,8 +36,6 @@ function pum_get_popup_title( $popup_id = null ) {
36
  return "";
37
  }
38
 
39
- $title = $popup->get_title();
40
-
41
  return $popup->get_title();
42
  }
43
 
36
  return "";
37
  }
38
 
 
 
39
  return $popup->get_title();
40
  }
41
 
includes/functions/popups/template.php CHANGED
@@ -22,7 +22,7 @@ function pum_popup_ID( $popup_id = null ) {
22
  * @param null|int $popup_id Popup ID.
23
  */
24
  function pum_popup_title( $popup_id = null ) {
25
- echo pum_get_popup_title( $popup_id );
26
  }
27
 
28
  /**
22
  * @param null|int $popup_id Popup ID.
23
  */
24
  function pum_popup_title( $popup_id = null ) {
25
+ echo esc_html( pum_get_popup_title( $popup_id ) );
26
  }
27
 
28
  /**
popup-maker.php CHANGED
@@ -3,7 +3,7 @@
3
  * Plugin Name: Popup Maker
4
  * Plugin URI: https://wppopupmaker.com/?utm_campaign=plugin-info&utm_source=plugin-header&utm_medium=plugin-uri
5
  * Description: Easily create & style popups with any content. Theme editor to quickly style your popups. Add forms, social media boxes, videos & more.
6
- * Version: 1.16.8
7
  * Author: Popup Maker
8
  * Author URI: https://wppopupmaker.com/?utm_campaign=plugin-info&utm_source=plugin-header&utm_medium=author-uri
9
  * License: GPL2 or later
@@ -93,7 +93,7 @@ class Popup_Maker {
93
  /**
94
  * @var string Plugin Version
95
  */
96
- public static $VER = '1.16.8';
97
 
98
  /**
99
  * @var int DB Version
3
  * Plugin Name: Popup Maker
4
  * Plugin URI: https://wppopupmaker.com/?utm_campaign=plugin-info&utm_source=plugin-header&utm_medium=plugin-uri
5
  * Description: Easily create & style popups with any content. Theme editor to quickly style your popups. Add forms, social media boxes, videos & more.
6
+ * Version: 1.16.9
7
  * Author: Popup Maker
8
  * Author URI: https://wppopupmaker.com/?utm_campaign=plugin-info&utm_source=plugin-header&utm_medium=author-uri
9
  * License: GPL2 or later
93
  /**
94
  * @var string Plugin Version
95
  */
96
+ public static $VER = '1.16.9';
97
 
98
  /**
99
  * @var int DB Version
readme.txt CHANGED
@@ -7,7 +7,7 @@ Tags: marketing, ecommerce, popup, popups, optin, conversion, promotion, pop-up
7
  Requires at least: 4.9
8
  Tested up to: 6.1
9
  Requires PHP: 5.6
10
- Stable tag: 1.16.8
11
  License: GPLv2 or later
12
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
13
 
@@ -181,6 +181,10 @@ There are several common causes for this, check [this guide for help](https://do
181
 
182
  View our [complete changelog](https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.md) for up-to-date information on what has been going on with the development of Popup Maker.
183
 
 
 
 
 
184
  = v1.16.8 - 09/12/2022 =
185
 
186
  * Fix: Error on widgets screen when using the new `Block` based widget editor due to an old script being loaded.
7
  Requires at least: 4.9
8
  Tested up to: 6.1
9
  Requires PHP: 5.6
10
+ Stable tag: 1.16.9
11
  License: GPLv2 or later
12
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
13
 
181
 
182
  View our [complete changelog](https://github.com/PopupMaker/Popup-Maker/blob/master/CHANGELOG.md) for up-to-date information on what has been going on with the development of Popup Maker.
183
 
184
+ = v1.16.9 - 09/23/2022 =
185
+
186
+ * Security: Patched XSS vulnerability allowing contributors to run unfiltered JavaScript.
187
+
188
  = v1.16.8 - 09/12/2022 =
189
 
190
  * Fix: Error on widgets screen when using the new `Block` based widget editor due to an old script being loaded.