Merge branch 'develop' into feature/activecampaign-form-migration-GIV…

…E-452

changelog.txt

@@ -1,4 +1,15 @@
 == Changelog ==
+= 3.7.0: April 10th, 2024 =
+* New: Added pre-requisite form builder compatibility for upcoming constant contact add-on release
+* New: Added phone number field to the donor details page, more updates for this field will come in future releases!
+* Enhancement: Updated the form block option to select more available forms than the original limit of 10
+* Enhancement: Updated the form builder left-side menu to open automatically when entering the build screen
+* Security: Added sanitizing and escaping to shortcodes
+* Fix: Resolved a conflict with GiveWP and WordPress bulk actions functionality
+
+= 3.6.2: April 5th, 2024 =
+* Fix: Resolved an issue with WordPress 6.5 and the visual form builder that was making it difficult to interact with blocks
+
 = 3.6.1: March 21st, 2024 =
 * Fix: Resolved an issue with PayPal donations and currency switcher on donation forms using the visual form builder
 

give.php

@@ -6,8 +6,8 @@
  * Description: The most robust, flexible, and intuitive way to accept donations on WordPress.
  * Author: GiveWP
  * Author URI: https://givewp.com/
- * Version: 3.6.2
- * Requires at least: 6.0
+ * Version: 3.7.0
+ * Requires at least: 6.3
  * Requires PHP: 7.2
  * Text Domain: give
  * Domain Path: /languages
@@ -404,7 +404,7 @@ private function setup_constants()
     {
         // Plugin version.
         if (!defined('GIVE_VERSION')) {
-            define('GIVE_VERSION', '3.6.2');
+            define('GIVE_VERSION', '3.7.0');
         }
 
         // Plugin Root File.

includes/admin/donors/donor-actions.php

@@ -17,7 +17,7 @@
 /**
  * Processes a donor edit.
  *
- * @unreleased Add support to the "phone" field
+ * @since 3.7.0 Add support to the "phone" field
  * @since      1.0
  *
  * @param array $args The $_POST array being passed.
@@ -132,7 +132,7 @@ function give_edit_donor( $args ) {
      * @param array $args     The sanitized data submitted.
      * @param int   $donor_id The donor ID.
      *
-     * @unreleased
+     * @since 3.7.0
      */
     do_action('give_admin_donor_details_updating', $args, $donor->id);
 

includes/admin/donors/donors.php

@@ -300,7 +300,7 @@ function give_render_donor_view( $view, $callbacks ) {
 /**
  * View a donor
  *
- * @unreleased Add "phone" field
+ * @since 3.7.0 Add "phone" field
  * @since  1.0
  *
  * @param  Give_Donor $donor The Donor object being displayed.

includes/class-notices.php

@@ -638,6 +638,7 @@ public static function print_frontend_errors( $errors ) {
 	 * Print frontend notice.
 	 * Notice: notice type can be success/error/warning
 	 *
+     * @since 3.7.0 Escape attributes
 	 * @since  1.8.9
 	 * @access public
 	 *
@@ -691,11 +692,11 @@ public static function print_frontend_notice( $message, $echo = true, $notice_ty
 						</p>
 						%6$s
 					</div>',
-			$notice_type,
-			give_clean( $notice_args['dismissible'] ),
-			absint( $notice_args['dismiss_interval'] ),
-			give_clean( $notice_args['dismiss_type'] ),
-			$message,
+			esc_attr($notice_type),
+			esc_attr( $notice_args['dismissible'] ),
+			esc_attr( $notice_args['dismiss_interval'] ),
+			esc_attr( $notice_args['dismiss_type'] ),
+			esc_html($message),
 			$close_icon
 		);
 

includes/donors/class-give-donor-wall.php

@@ -82,6 +82,7 @@ public function setup_actions() {
 	/**
 	 * Displays donors in a grid layout.
 	 *
+     * @since 3.7.0 Sanitize attributes
      * @since 2.27.0 Moved AJAX nonce verification to ajax_handler method.
 	 * @since  2.2.0
 	 *
@@ -114,6 +115,7 @@ public function setup_actions() {
 	 * @return string|bool The markup of the form grid or false.
 	 */
 	public function render_shortcode( $atts ) {
+        $atts = give_clean($atts);
 
 		$give_settings = give_get_settings();
 

includes/login-register.php

@@ -51,8 +51,8 @@ function give_login_form( $login_redirect = '', $logout_redirect = '' ) {
 	give_get_template(
 		'shortcode-login',
 		array(
-			'give_login_redirect'  => esc_url($login_redirect),
-			'give_logout_redirect' => esc_url($logout_redirect),
+			'give_login_redirect'  => $login_redirect,
+			'give_logout_redirect' => $logout_redirect,
 		)
 	);
 

includes/misc-functions.php

@@ -2628,7 +2628,7 @@ function give_get_page_by_title(string $page_title, string $output = OBJECT, str
  /**
  * @see https://github.com/jackocnr/intl-tel-input
  *
- * @unreleased
+ * @since 3.7.0
  */
 function give_get_intl_tel_input(string $value, string $id, string $class = '', string $name = ''):string {
 
@@ -2719,7 +2719,7 @@ function readyHandler() {
 }
 
 /**
-* @unreleased
+* @since 3.7.0
  */
 function give_get_intl_tel_input_i18n_json_object() {
 

includes/shortcodes.php

@@ -25,6 +25,7 @@
  *
  * Displays a user's donation history.
  *
+ * @since 3.7.0 Sanitize attributes
  * @since 3.1.0 pass form id by reference in give_totals shortcode.
  * @since  1.0
  *
@@ -34,7 +35,7 @@
  * @return string|bool
  */
 function give_donation_history( $atts, $content = false ) {
-
+    $atts = give_clean($atts);
 	$donation_history_args = shortcode_atts(
 		[
 			'id'             => true,
@@ -132,6 +133,7 @@ function give_donation_history( $atts, $content = false ) {
  *
  * Show the Give donation form.
  *
+ * @since 3.7.0 Sanitize attributes
  * @since 3.4.0 Add additional validations to check if the form is valid and has the 'published' status.
  * @since 2.30.0 Add short-circuit filter to allow for custom output.
  * @since  1.0
@@ -142,6 +144,7 @@ function give_donation_history( $atts, $content = false ) {
  * @return string
  */
 function give_form_shortcode( $atts ) {
+    $atts = give_clean($atts);
 	$atts = shortcode_atts( give_get_default_form_shortcode_args(), $atts, 'give_form' );
 
     if('fullForm' === $atts['display_style']) {
@@ -210,6 +213,7 @@ function give_form_shortcode( $atts ) {
  *
  * Show the Give donation form goals.
  *
+ * @since 3.7.0 Sanitize attributes
  * @since 3.4.0 Add additional validations to check if the form is valid and has the 'published' status.
  * @since  1.0
  *
@@ -218,6 +222,7 @@ function give_form_shortcode( $atts ) {
  * @return string
  */
 function give_goal_shortcode( $atts ) {
+    $atts = give_clean($atts);
 	$atts = shortcode_atts(
 		[
 			'id'        => '',
@@ -266,6 +271,7 @@ function give_goal_shortcode( $atts ) {
  * Shows a login form allowing users to users to log in. This function simply
  * calls the give_login_form function to display the login form.
  *
+ * @since 3.7.0 Sanitize attributes
  * @since  1.0
  *
  * @param  array $atts Shortcode attributes.
@@ -275,7 +281,7 @@ function give_goal_shortcode( $atts ) {
  * @return string
  */
 function give_login_form_shortcode( $atts ) {
-
+    $atts = give_clean($atts);
 	$atts = shortcode_atts(
 		[
 			// Add backward compatibility for redirect attribute.
@@ -300,6 +306,7 @@ function give_login_form_shortcode( $atts ) {
  *
  * Shows a registration form allowing users to users to register for the site.
  *
+ * @since 3.7.0 Sanitize attributes
  * @since  1.0
  *
  * @param  array $atts Shortcode attributes.
@@ -309,6 +316,7 @@ function give_login_form_shortcode( $atts ) {
  * @return string
  */
 function give_register_form_shortcode( $atts ) {
+    $atts = give_clean($atts);
 	$atts = shortcode_atts(
 		[
 			'redirect' => '',
@@ -327,6 +335,7 @@ function give_register_form_shortcode( $atts ) {
  *
  * Shows a donation receipt.
  *
+ * @since 3.7.0 Sanitize and escape attributes
  * @since  1.0
  *
  * @param  array $atts Shortcode attributes.
@@ -337,6 +346,8 @@ function give_receipt_shortcode( $atts ) {
 
 	global $give_receipt_args;
 
+    $atts = give_clean($atts);
+
 	$give_receipt_args = shortcode_atts(
 		[
 			'error'          => __( 'You are missing the donation id to view this donation receipt.', 'give' ),
@@ -378,8 +389,8 @@ function give_receipt_shortcode( $atts ) {
 		return sprintf(
 			'<div id="give-receipt" data-shortcode="%1$s" data-receipt-type="%2$s" data-donation-key="%3$s" >%4$s</div>',
 			htmlspecialchars( wp_json_encode( $give_receipt_args ) ),
-			$receipt_type,
-			$donation_id,
+			esc_attr($receipt_type),
+			esc_attr($donation_id),
 			ob_get_clean()
 		);
 	}
@@ -400,6 +411,7 @@ function give_receipt_shortcode( $atts ) {
  * folder. Please visit the Give Documentation for more information on how the
  * templating system is used.
  *
+ * @since 3.7.0 Sanitize attributes
  * @since  1.0
  *
  * @param  array $atts Shortcode attributes.
@@ -408,6 +420,8 @@ function give_receipt_shortcode( $atts ) {
  */
 function give_profile_editor_shortcode( $atts ) {
 
+    $atts = give_clean($atts);
+
 	ob_start();
 
 	// Restrict access to donor profile, if donor and user are disconnected.
@@ -612,6 +626,7 @@ function give_process_profile_editor_updates( $data ) {
  *
  * Shows a donation total.
  *
+ * @since 3.7.0 Sanitize attributes
  * @since  2.1
  *
  * @param  array $atts Shortcode attributes.
@@ -641,6 +656,8 @@ function give_totals_shortcode( $atts ) {
 	// Total Goal.
 	$total_goal = give_maybe_sanitize_amount( $atts['total_goal'] );
 
+    $atts = give_clean($atts);
+
 	/**
 	 * Give Action fire before the shortcode is rendering is started.
 	 *
@@ -818,6 +835,7 @@ static function ($id) {
 /**
  * Displays donation forms in a grid layout.
  *
+ * @since 3.7.0 Sanitize attributes
  * @since  2.1.0
  *
  * @since 3.1.0 Use static function on array_map callback to pass the id as reference for _give_redirect_form_id to prevent warnings on PHP 8.0.1 or plus
@@ -855,7 +873,7 @@ static function ($id) {
  * @return string|bool The markup of the form grid or false.
  */
 function give_form_grid_shortcode( $atts ) {
-
+    $atts = give_clean($atts);
 	$give_settings = give_get_settings();
 
 	$atts = shortcode_atts(

readme.txt

@@ -2,10 +2,10 @@
 Contributors: givewp, dlocc, webdevmattcrom, ravinderk, mehul0810, kevinwhoffman, jason_the_adams, henryholtgeerts, kbjohnson90, alaca, benmeredithgmailcom, jonwaldstein, joshuadinh, glaubersilvawp, pauloiankoski
 Donate link: https://go.givewp.com/home
 Tags: donation, donate, recurring donations, fundraising, crowdfunding
-Requires at least: 6.0
+Requires at least: 6.3
 Tested up to: 6.5
 Requires PHP: 7.2
-Stable tag: 3.6.2
+Stable tag: 3.7.0
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
 
@@ -167,7 +167,7 @@ Here’s a few ways you can contribute to GiveWP:
 
 = Minimum Requirements =
 
-* WordPress 6.0 or greater
+* WordPress 6.3 or greater
 * PHP version 7.2 or greater
 * MySQL version 5.7 or greater
 * MariaDB version 10 or later
@@ -262,6 +262,14 @@ The 2% fee on Stripe donations only applies to donations taken via our free Stri
 10. Use almost any payment gateway integration with GiveWP through our add-ons or by creating your own add-on.
 
 == Changelog ==
+= 3.7.0: April 10th, 2024 =
+* New: Added pre-requisite form builder compatibility for upcoming constant contact add-on release
+* New: Added phone number field to the donor details page, more updates for this field will come in future releases!
+* Enhancement: Updated the form block option to select more available forms than the original limit of 10
+* Enhancement: Updated the form builder left-side menu to open automatically when entering the build screen
+* Security: Added sanitizing and escaping to shortcodes
+* Fix: Resolved a conflict with GiveWP and WordPress bulk actions functionality
+
 = 3.6.2: April 5th, 2024 =
 * Fix: Resolved an issue with WordPress 6.5 and the visual form builder that was making it difficult to interact with blocks
 

src/DonationForms/Blocks/DonationFormBlock/resources/editor/hooks/useFormOptions.ts

@@ -12,6 +12,7 @@ export interface FormOption extends Form {
 }
 
 /**
+ * @since 3.7.0 Increase the per_page attribute to 100 to accommodate for more forms.
  * @since 3.2.0 include isLegacyForm, isLegacyFormTemplate & link.
  * @since 3.0.0
  */
@@ -22,11 +23,16 @@ export default function useFormOptions(): {
     const formOptions = [];
 
     const {forms, isResolving} = useSelect((select) => {
+        const query = {per_page: 100};
         return {
             // @ts-ignore
-            forms: select('core').getEntityRecords<Post[]>('postType', 'give_forms'),
+            forms: select('core').getEntityRecords<Post[]>('postType', 'give_forms', query),
             // @ts-ignore
-            isResolving: select('core/data').getIsResolving('core', 'getEntityRecords', ['postType', 'give_forms']),
+            isResolving: select('core/data').getIsResolving('core', 'getEntityRecords', [
+                'postType',
+                'give_forms',
+                query,
+            ]),
         };
     }, []);
 

src/DonationForms/Properties/FormSettings.php

@@ -230,13 +230,13 @@ class FormSettings implements Arrayable, Jsonable
      */
     public $designSettingsImageOpacity;
 
-    /* @unreleased
+    /* @since 3.7.0
      * @var string
      */
     public $formExcerpt;
 
     /**
-     * @unreleased Added formExcerpt
+     * @since 3.7.0 Added formExcerpt
 
     /**
      * @since 3.2.0 Added registrationNotification