Pods 2.7.20.1

.gitattributes

@@ -27,6 +27,7 @@
 .travis.yml export-ignore
 
 CODEOWNERS export-ignore
+CODE_OF_CONDUCT.md export-ignore
 CONTRIBUTING.md export-ignore
 Gruntfile.js export-ignore
 README.md export-ignore

classes/fields/file.php

@@ -560,12 +560,12 @@ public function build_dfv_field_item_data( $args ) {
 			}
 
 			$data[] = array(
-				'id'        => $id,
-				'icon'      => $icon,
-				'name'      => $title,
-				'edit_link' => $edit_link,
-				'link'      => $link,
-				'download'  => $download,
+				'id'        => esc_html( $id ),
+				'icon'      => esc_attr( $icon ),
+				'name'      => esc_html( $title ),
+				'edit_link' => esc_url( $edit_link ),
+				'link'      => esc_url( $link ),
+				'download'  => esc_url( $download ),
 			);
 		}//end foreach
 

classes/fields/pick.php

@@ -1333,8 +1333,6 @@ public function build_dfv_field_item_data_recurse_item( $item_id, $item_title, $
 		// Parse icon type
 		if ( 'none' === $icon || 'div' === $icon ) {
 			$icon         = '';
-		} elseif ( 0 === strpos( $icon, 'data:image/svg+xml;base64,' ) ) {
-			$icon         = esc_attr( $icon );
 		} elseif ( 0 === strpos( $icon, 'dashicons-' ) ) {
 			$icon         = sanitize_html_class( $icon );
 		}
@@ -1383,11 +1381,11 @@ public function build_dfv_field_item_data_recurse_item( $item_id, $item_title, $
 		}
 
 		$item = array(
-			'id'           => $item_id,
-			'icon'         => $icon,
-			'name'         => $item_title,
-			'edit_link'    => $edit_link,
-			'link'         => $link,
+			'id'           => esc_html( $item_id ),
+			'icon'         => esc_attr( $icon ),
+			'name'         => esc_html( $item_title ),
+			'edit_link'    => esc_url( $edit_link ),
+			'link'         => esc_url( $link ),
 			'selected'     => $selected,
 		);
 

init.php

@@ -3,7 +3,7 @@
 Plugin Name: Pods - Custom Content Types and Fields
 Plugin URI: https://pods.io/
 Description: Pods is a framework for creating, managing, and deploying customized content types and fields
-Version: 2.7.20
+Version: 2.7.20.1
 Author: Pods Framework Team
 Author URI: https://pods.io/about/
 Text Domain: pods
@@ -36,7 +36,7 @@
 	add_action( 'init', 'pods_deactivate_pods_ui' );
 } else {
 	// Current version
-	define( 'PODS_VERSION', '2.7.20' );
+	define( 'PODS_VERSION', '2.7.20.1' );
 
 	// Version tracking between DB updates themselves
 	define( 'PODS_DB_VERSION', '2.3.5' );

readme.txt

@@ -5,7 +5,7 @@ Tags: pods, custom post types, custom taxonomies, content types, custom fields,
 Requires at least: 4.5
 Tested up to: 5.4
 Requires PHP: 5.3
-Stable tag: 2.7.20
+Stable tag: 2.7.20.1
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -190,6 +190,10 @@ We are also available through our [Live Slack Chat](https://pods.io/chat/) to he
 
 == Changelog ==
 
+= 2.7.20.1 - June 4th 2020 =
+
+* Security: Remove deprecated usage of escapeMarkup in selectWoo and tighten JS rendering (@sc0ttkclark, @miha.jirov)
+
 = 2.7.20 - April 5th 2020 =
 
 **Bug Fixes**

ui/js/pods-dfv/_src/pick/views/select-view.js

@@ -22,7 +22,7 @@ export const SelectItem = PodsFieldView.extend( {
 	initialize: function ( options ) {
 		this.$el.val( this.model.get( 'id' ) );
 
-		this.$el.html( this.model.get( 'name' ) );
+		this.$el.text( this.model.get( 'name' ) );
 
 		if ( this.model.get( 'selected' ) ) {
 			this.$el.prop( 'selected', 'selected' );
@@ -339,10 +339,7 @@ export const SelectView = PodsMn.CollectionView.extend( {
 			placeholder: placeholder,
 			allowClear: isSingle,
 			disabled: fieldConfig.limitDisable,
-			tags: fieldConfig.pick_taggable,
-			escapeMarkup: function ( text ) {
-				return text;
-			}
+			tags: fieldConfig.pick_taggable
 		};
 
 		if ( ajaxData.ajax ) {