Merge pull request #2480 from QuizandSurveyMaster/CU-867968jpx-email-…

…and-result-page-redesign fixed Vulnerability report
QuizandSurveyMaster · Mar 4, 2024 · 23d4e28 · 23d4e28
2 parents a7d1227 + ac0bef3
commit 23d4e28
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 3 deletions.
diff --git a/php/classes/class-qmn-quiz-manager.php b/php/classes/class-qmn-quiz-manager.php
@@ -1979,7 +1979,7 @@ public function submit_results( $qmn_quiz_options, $qmn_array_for_variables ) {
 		// Prepares data to be sent back to front-end.
 		$return_array = array(
 			'quizExpired'   => false,
-			'display'       => htmlspecialchars_decode( $result_display ),
+			'display'       => $result_display,
 			'redirect'      => apply_filters( 'mlw_qmn_template_variable_results_page', $results_pages['redirect'], $qmn_array_for_variables ),
 			'result_status' => array(
 				'save_response' => $qmn_array_for_variables['response_saved'],

diff --git a/php/classes/class-qsm-emails.php b/php/classes/class-qsm-emails.php
@@ -506,8 +506,9 @@ function( $matches ) {
 							$content = '%' . wp_strip_all_tags( preg_replace('/^\s+|\s+$/u', '', $matches[1] ) ) . '%';
 							return $content;
 						},
-						wp_kses_post( $emails[ $i ]['content'] )
+						$emails[ $i ]['content']
 				);
+				$emails[ $i ]['content'] = wp_kses_post( $emails[ $i ]['content'] );
 			}
 			$mlwQuizMasterNext->pluginHelper->qsm_register_language_support( $emails[ $i ]['subject'], "quiz-email-subject-{$i}-{$quiz_id}" );
 			$mlwQuizMasterNext->pluginHelper->qsm_register_language_support( $emails[ $i ]['content'], "quiz-email-content-{$i}-{$quiz_id}" );

diff --git a/php/classes/class-qsm-results-pages.php b/php/classes/class-qsm-results-pages.php
@@ -374,8 +374,9 @@ function( $matches ) {
 							$content = '%' . wp_strip_all_tags( preg_replace('/^\s+|\s+$/u', '', $matches[1] ) ) . '%';
 							return $content;
 						},
-						wp_kses_post( $pages[ $i ]['page'] )
+						$pages[ $i ]['page']
 				);
+				$pages[ $i ]['page']  = wp_kses_post( $pages[ $i ]['page'] );
 			}
 			$pages[ $i ]['default_mark'] = sanitize_text_field( $pages[ $i ]['default_mark'] );