Changeset 3759933

Timestamp:

10/22/2026 12:53:32 PM (3 weeks ago)

Author:

supsystic.com

Message:

Contact Form Free 1.11.1

Location:

contact-form-by-supsystic

Files:

• tags/1.11.1 (copied) (copied from contact-form-by-supsystic/trunk )
• tags/1.11.1/cfs.php (modified) (1 diff)
• tags/1.11.1/classes/controller.php (modified) (5 diffs)
• tags/1.11.1/classes/frame.php (modified) (4 diffs)
• tags/1.11.1/classes/twigSecurityPolicy.php (added)
• tags/1.11.1/classes/utils.php (modified) (1 diff)
• tags/1.11.1/config.php (modified) (1 diff)
• tags/1.11.1/js/core.js (modified) (2 diffs)
• tags/1.11.1/js/core.min.js (modified) (1 diff)
• tags/1.11.1/modules/forms/controller.php (modified) (1 diff)
• tags/1.11.1/modules/forms/models/forms.php (modified) (6 diffs)
• tags/1.11.1/modules/forms/views/forms.php (modified) (11 diffs)
• tags/1.11.1/modules/forms/views/tpl/formsEditFormStatistics.php (modified) (1 diff)
• tags/1.11.1/modules/mail/mod.php (modified) (2 diffs)
• tags/1.11.1/modules/mail/views/tpl/mailAdmin.php (modified) (2 diffs)
• tags/1.11.1/modules/options/models/options.php (modified) (3 diffs)
• tags/1.11.1/modules/statistics/controller.php (modified) (1 diff)
• tags/1.11.1/modules/templates/mod.php (modified) (1 diff)
• tags/1.11.1/readme.txt (modified) (2 diffs)
• trunk/cfs.php (modified) (1 diff)
• trunk/classes/controller.php (modified) (5 diffs)
• trunk/classes/frame.php (modified) (4 diffs)
• trunk/classes/twigSecurityPolicy.php (added)
• trunk/classes/utils.php (modified) (1 diff)
• trunk/config.php (modified) (1 diff)
• trunk/js/core.js (modified) (2 diffs)
• trunk/js/core.min.js (modified) (1 diff)
• trunk/modules/forms/controller.php (modified) (1 diff)
• trunk/modules/forms/models/forms.php (modified) (6 diffs)
• trunk/modules/forms/views/forms.php (modified) (11 diffs)
• trunk/modules/forms/views/tpl/formsEditFormStatistics.php (modified) (1 diff)
• trunk/modules/mail/mod.php (modified) (2 diffs)
• trunk/modules/mail/views/tpl/mailAdmin.php (modified) (2 diffs)
• trunk/modules/options/models/options.php (modified) (3 diffs)
• trunk/modules/statistics/controller.php (modified) (1 diff)
• trunk/modules/templates/mod.php (modified) (1 diff)
• trunk/readme.txt (modified) (2 diffs)

contact-form-by-supsystic/tags/1.11.1/cfs.php

@@ -5 +5 @@
  * Plugin URI: https://supsystic.com/plugins/contact-form-plugin/
  * Description: Drag-and-drop contact form builder with ready templates, 25+ field types, reCAPTCHA, saved submissions and form statistics. No coding needed.
- * Version: 1.10.7
+ * Version: 1.11.1
  * Author: supsystic.com
  * Author URI: https://supsystic.com

contact-form-by-supsystic/tags/1.11.1/classes/controller.php

@@ -104 +104 @@
   public function __call($name, $arguments)
   {
-    // delete()/clear() wipe the entire table when called with no/null arguments,
-    // which is exactly how they get invoked here (AJAX dispatch never actually
-    // passes $arguments through). Neither is reliably listed in every controller's
-    // getPermissions(), and havePermissions() defaults to "allow" for any action
-    // name it doesn't recognize - so without this check, any visitor could delete
-    // all data in a table simply by requesting action=delete or action=clear.
+    // delete()/clear() wipe the entire table when called with no/null arguments.
+    // Request dispatcher never routes actions here (frameCfs::havePermissions() accepts
+    // only real declared controller methods), but keep this guard for any other caller.
     if (in_array(strtolower($name), ['delete', 'clear'], true)) {
       return false;
@@ -136 +133 @@
                 );
          * Can be used on of sub-array - CFS_METHODS or CFS_USERLEVELS
+         * Methods that are not listed here and not listed in getPublicMethods() can not be called by request at all.
          */
   public function getPermissions()
@@ -142 +140 @@
   }
   /**
-   * Methods that require nonce to be generated
+   * Methods that can be called by request from any visitor, including not logged in users.
+   * Each of them must validate request on it's own (own nonce, hash, etc.).
    * If need - should be redefined in each controller where it required.
    * @return array
    */
+  public function getPublicMethods()
+  {
+    return [];
+  }
+  /**
+   * Methods from getPermissions() that are opened by direct links from outside of plugin pages
+   * (for example - OAuth callbacks), so they can not carry plugin nonce.
+   * All other methods from getPermissions() always require valid plugin nonce.
+   * @return array
+   */
+  public function getNonceExemptMethods()
+  {
+    return [];
+  }
+  /**
+   * Public methods that require plugin nonce too.
+   * Methods from getPermissions() require it anyway, @see frameCfs::havePermissions().
+   * @return array
+   */
   public function getNoncedMethods()
   {
     return [];
+  }
+  /**
+   * Check that current request was sent by plugin administrator from plugin pages
+   * @return bool
+   */
+  protected function _isAdminRequest()
+  {
+    return frameCfs::_()->getModule('user')->isAdmin() && frameCfs::_()->verifyNonce();
   }
   public function getModule()
@@ -234 +260 @@
   {
     $res = new responseCfs();
-    if ($this->getModel()->removeGroup(reqCfs::getVar('listIds', 'post'))) {
+    // Inherited by all controllers - so check access here too, not only in request dispatcher
+    if (!$this->_isAdminRequest()) {
+      $res->pushError(__('You have no permissions to do this', CFS_LANG_CODE));
+    } elseif ($this->getModel()->removeGroup(reqCfs::getVar('listIds', 'post'))) {
       $res->addMessage(__('Done', CFS_LANG_CODE));
     } else {
@@ -244 +273 @@
   {
     $res = new responseCfs();
-    if ($this->getModel()->clear()) {
+    if (!$this->_isAdminRequest()) {
+      $res->pushError(__('You have no permissions to do this', CFS_LANG_CODE));
+    } elseif ($this->getModel()->clear()) {
       $res->addMessage(__('Done', CFS_LANG_CODE));
     } else {

contact-form-by-supsystic/tags/1.11.1/classes/frame.php

@@ -23 +23 @@
   private $_mod = '';
   private $_action = '';
+  /**
+   * PRO before 1.5.0 does not declare it's public and nonce exempt methods, @see _isLegacyPro()
+   */
+  private static $_legacyProPublicMethods = [
+    'add_fields' => ['uploadFile', 'getFile', 'removeFile'],
+    'wp_subscribe' => ['confirm'],
+  ];
+  private static $_legacyProNonceExemptMethods = [
+    'campaignmonitor' => ['saveAccessToken'],
+    'constantcontact' => ['saveAccessToken'],
+    'verticalresponse' => ['saveAccessToken'],
+    // Read only exports - old PRO opens them by links without nonce
+    'ab_testing' => ['getListForTbl'],
+    'wp_subscribe' => ['getWpCsvList'],
+    'statistics' => ['getCsv'],
+  ];
+  private static $_legacyPro = null;
   /**
    * Object with result of executing non-ajax module request
@@ -194 +211 @@
   }
   /**
-   * Check permissions for action in controller by $code
+   * Check permissions for action in controller by $code.
+   * Access is denied by default: an action can be dispatched only if its controller declares it,
+   * either as public (getPublicMethods() - such method must validate the request on its own),
+   * or for some user level (getPermissions()). Every action that is not public requires
+   * a valid plugin nonce too, except actions from getNonceExemptMethods().
    * @param string $code Code of controller that need to be checked
    * @param string $action Action that need to be checked
@@ -201 +222 @@
   public function havePermissions($code, $action)
   {
-    $res = true;
+    $controller = $this->_getDispatchController($code, $action);
+    if (!$controller) {
+      return false;
+    }
+    $action = strtolower($action);
+    if ($this->_methodListed($action, $this->_getPublicMethods($code, $controller))) {
+      // Public methods can be additionally enrolled for the plugin nonce
+      return !$this->_methodListed($action, $controller->getNoncedMethods()) || $this->verifyNonce();
+    }
+    $requiredLevels = $this->_getRequiredUserLevels($controller->getPermissions(), $action);
+    if (empty($requiredLevels)) {
+      // Action was not declared by controller - deny it
+      return false;
+    }
+    $currentUserPosition = $this->getModule('user')->getCurrentUserPosition();
+    // For multi-sites network admin role is undefined, let's do this here
+    if (is_multisite() && is_admin() && is_super_admin()) {
+      $currentUserPosition = CFS_ADMIN;
+    }
+    foreach ($requiredLevels as $levels) {
+      if (!in_array($currentUserPosition, $levels, true)) {
+        return false;
+      }
+    }
+    if (!$this->_methodListed($action, $this->_getNonceExemptMethods($code, $controller)) && !$this->verifyNonce()) {
+      return false;
+    }
+    return true;
+  }
+  /**
+   * PRO add-on can be older than this plugin: before 1.5.0 it did not declare access for it's methods
+   * @return bool
+   */
+  protected function _isLegacyPro()
+  {
+    if (self::$_legacyPro === null) {
+      self::$_legacyPro = function_exists('getProPlugCodeCfs') && !defined('CFS_PRO_DECLARES_ACCESS');
+    }
+    return self::$_legacyPro;
+  }
+  protected function _getPublicMethods($code, $controller)
+  {
+    $methods = (array) $controller->getPublicMethods();
+    if ($this->_isLegacyPro() && isset(self::$_legacyProPublicMethods[$code])) {
+      $methods = array_merge($methods, self::$_legacyProPublicMethods[$code]);
+    }
+    return $methods;
+  }
+  protected function _getNonceExemptMethods($code, $controller)
+  {
+    $methods = (array) $controller->getNonceExemptMethods();
+    if ($this->_isLegacyPro() && isset(self::$_legacyProNonceExemptMethods[$code])) {
+      $methods = array_merge($methods, self::$_legacyProNonceExemptMethods[$code]);
+    }
+    return $methods;
+  }
+  /**
+   * Check if action is allowed for any visitor, including not logged in users
+   * @param string $code Code of controller that need to be checked
+   * @param string $action Action that need to be checked
+   * @return bool
+   */
+  public function isPublicAction($code, $action)
+  {
+    $controller = $this->_getDispatchController($code, $action);
+    return $controller && $this->_methodListed(strtolower($action), $this->_getPublicMethods($code, $controller));
+  }
+  /**
+   * Verify plugin nonce from current request
+   * @return bool
+   */
+  public function verifyNonce()
+  {
+    $nonce = isset($_REQUEST['_wpnonce']) && is_string($_REQUEST['_wpnonce']) ? sanitize_text_field(wp_unslash($_REQUEST['_wpnonce'])) : '';
+    if (empty($nonce)) {
+      return false;
+    }
+    return wp_verify_nonce($nonce, 'cfs_nonce') || wp_verify_nonce($nonce, 'cfs_nonce_frontend');
+  }
+  /**
+   * Get controller of module, if action can be dispatched to it: it should be real public controller method,
+   * not some name that will be routed through controllerCfs::__call() to it's model.
+   * @param string $code Module code
+   * @param string $action Action name
+   * @return controllerCfs|null
+   */
+  protected function _getDispatchController($code, $action)
+  {
     $mod = $this->getModule($code);
-    $action = strtolower($action);
-    if ($mod) {
-      $permissions = $mod->getController()->getPermissions();
-      if (!empty($permissions)) {
-        // Special permissions
-        if (isset($permissions[CFS_METHODS]) && !empty($permissions[CFS_METHODS])) {
-          foreach ($permissions[CFS_METHODS] as $method => $permissions) {
-            // Make case-insensitive
-            $permissions[CFS_METHODS][strtolower($method)] = $permissions;
-          }
-          if (array_key_exists($action, $permissions[CFS_METHODS])) {
-            // Permission for this method exists
-            $currentUserPosition = frameCfs::_()->getModule('user')->getCurrentUserPosition();
-            if ((is_array($permissions[CFS_METHODS][$action]) && !in_array($currentUserPosition, $permissions[CFS_METHODS][$action])) || (!is_array($permissions[CFS_METHODS][$action]) && $permissions[CFS_METHODS][$action] != $currentUserPosition)) {
-              $res = false;
-            }
-          }
-        }
-        if (isset($permissions[CFS_USERLEVELS]) && !empty($permissions[CFS_USERLEVELS])) {
-          $currentUserPosition = frameCfs::_()->getModule('user')->getCurrentUserPosition();
-          // For multi-sites network admin role is undefined, let's do this here
-          if (is_multisite() && is_admin() && is_super_admin()) {
-            $currentUserPosition = CFS_ADMIN;
-          }
-          foreach ($permissions[CFS_USERLEVELS] as $userlevel => $methods) {
-            if (is_array($methods)) {
-              $lowerMethods = array_map('strtolower', $methods); // Make case-insensitive
-              if (in_array($action, $lowerMethods)) {
-                // Permission for this method exists
-                if ($currentUserPosition != $userlevel) {
-                  $res = false;
-                }
-                break;
-              }
-            } else {
-              $lowerMethod = strtolower($methods); // Make case-insensitive
-              if ($lowerMethod == $action) {
-                // Permission for this method exists
-                if ($currentUserPosition != $userlevel) {
-                  $res = false;
-                }
-                break;
-              }
-            }
-          }
-        }
-      }
-      if ($res) {
-        // Additional check for nonces
-        $noncedMethods = $mod->getController()->getNoncedMethods();
-        if (!empty($noncedMethods)) {
-          $noncedMethods = array_map('strtolower', $noncedMethods);
-          if (in_array($action, $noncedMethods)) {
-            $nonce = isset($_REQUEST['_wpnonce']) ? $_REQUEST['_wpnonce'] : reqCfs::getVar('_wpnonce');
-            if (is_admin()) {
-              if (!wp_verify_nonce($nonce, 'cfs_nonce')) {
-                $res = false;
-              }
-            } else {
-              if (!wp_verify_nonce($nonce, 'cfs_nonce_frontend')) {
-                $res = false;
-              }
-            }
-          }
+    $controller = $mod ? $mod->getController() : null;
+    if (!$controller || empty($action) || !is_string($action) || !method_exists($controller, $action)) {
+      return null;
+    }
+    $method = new ReflectionMethod($controller, $action);
+    if (!$method->isPublic() || $method->isStatic()) {
+      return null;
+    }
+    return $controller;
+  }
+  protected function _methodListed($action, $methods)
+  {
+    return !empty($methods) && is_array($methods) && in_array($action, array_map('strtolower', $methods), true);
+  }
+  /**
+   * Get user levels required for action from controller permissions
+   * @param array $permissions Result of controllerCfs::getPermissions()
+   * @param string $action Action name in lower case
+   * @return array List of conditions, each one - array of user levels, any of them pass condition. Empty if action is not declared.
+   */
+  protected function _getRequiredUserLevels($permissions, $action)
+  {
+    $res = [];
+    if (empty($permissions) || !is_array($permissions)) {
+      return $res;
+    }
+    if (isset($permissions[CFS_METHODS]) && is_array($permissions[CFS_METHODS])) {
+      foreach ($permissions[CFS_METHODS] as $method => $levels) {
+        if (strtolower($method) == $action) {
+          $res[] = (array) $levels;
+          break;
+        }
+      }
+    }
+    if (isset($permissions[CFS_USERLEVELS]) && is_array($permissions[CFS_USERLEVELS])) {
+      foreach ($permissions[CFS_USERLEVELS] as $userlevel => $methods) {
+        if ($this->_methodListed($action, (array) $methods)) {
+          $res[] = [$userlevel];
+          break;
         }
       }
@@ -335 +418 @@
         case 'ajax':
           add_action('wp_ajax_' . $this->_action, [$mod->getController(), $this->_action]);
-          add_action('wp_ajax_nopriv_' . $this->_action, [$mod->getController(), $this->_action]);
+          // Not logged in visitors can reach only actions that controller declared as public
+          if ($this->isPublicAction($this->_mod, $this->_action)) {
+            add_action('wp_ajax_nopriv_' . $this->_action, [$mod->getController(), $this->_action]);
+          }
           break;
         default:

contact-form-by-supsystic/tags/1.11.1/classes/utils.php

@@ -735 +735 @@
     }
     return $str;
+  }
+  /**
+   * Make value safe to be placed in email header: line breaks there start new header.
+   * @param mixed $value Header value, or array of values
+   * @return mixed
+   */
+  public static function cleanMailHeader($value)
+  {
+    if (is_array($value)) {
+      return array_map([__CLASS__, 'cleanMailHeader'], $value);
+    }
+    if (!is_scalar($value)) {
+      return '';
+    }
+    return trim(preg_replace('/[\r\n\t\0\x0B\x0C]+/', ' ', (string) $value));
+  }
+  /**
+   * Sendmail path is passed to shell by mailer, so allow only absolute path to sendmail-compatible binary,
+   * with few safe flags.
+   * @param string $path
+   * @return bool
+   */
+  public static function isValidSendmailPath($path)
+  {
+    if (!is_string($path)) {
+      return false;
+    }
+    $path = trim($path, ' ');
+    if ($path === '') {
+      return true; // Default from php.ini will be used
+    }
+    // Only printable chars, parts are separated by spaces only
+    if (preg_match('/[^\x20-\x7E]/', $path)) {
+      return false;
+    }
+    $parts = preg_split('/ +/', $path);
+    $bin = array_shift($parts);
+    if (!preg_match('#^(?:[A-Za-z]:)?[\\\\/][A-Za-z0-9._\\\\/-]+$#', $bin) || strpos($bin, '..') !== false) {
+      return false;
+    }
+    $binName = basename(str_replace('\\', '/', $bin));
+    if (!preg_match('/^(sendmail|msmtp|ssmtp|esmtp|exim4?|qmail-inject|mini_sendmail|nullmailer-inject)(\.exe)?$/i', $binName)) {
+      return false;
+    }
+    $emailRe = '/^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+$/';
+    for ($i = 0; $i < count($parts); $i++) {
+      $flag = $parts[$i];
+      if (in_array($flag, ['-t', '-i', '-oi', '-ti'], true)) {
+        continue;
+      }
+      if (strpos($flag, '-f') === 0 && strlen($flag) > 2 && preg_match($emailRe, substr($flag, 2))) {
+        continue;
+      }
+      if ($flag === '-f' && isset($parts[$i + 1]) && preg_match($emailRe, $parts[$i + 1])) {
+        $i++;
+        continue;
+      }
+      return false;
+    }
+    return true;
   }
   public static function encodeArrayTxt($arr, $forceOrd = false)

contact-form-by-supsystic/tags/1.11.1/config.php

@@ -53 +53 @@
 
 define('CFS_PLUGIN_INSTALLED', true);
-define('CFS_VERSION', '1.10.7');
+define('CFS_VERSION', '1.11.1');
 define('CFS_USER', 'user');
 

contact-form-by-supsystic/tags/1.11.1/js/core.js

@@ -84 +84 @@
   var dataType = params.dataType ? params.dataType : 'json';
   // Set plugin orientation
+  // Admin actions require plugin nonce - add it if request does not have it's own one
+  var adminNonce = cfsGetAdminNonce();
   if (typeof data == 'string') {
     data += '&pl=' + CFS_DATA.CFS_CODE;
     data += '&reqType=ajax';
+    if (adminNonce && !/(^|&)_wpnonce=/.test(data)) data += '&_wpnonce=' + encodeURIComponent(adminNonce);
   } else {
     data['pl'] = CFS_DATA.CFS_CODE;
     data['reqType'] = 'ajax';
+    if (adminNonce && typeof data['_wpnonce'] == 'undefined') data['_wpnonce'] = adminNonce;
   }
 
@@ -194 +198 @@
 }
 
+/**
+ * Plugin nonce for admin requests, it is not available on frontend
+ */
+function cfsGetAdminNonce() {
+  if (typeof CFS_NONCE != 'undefined' && CFS_NONCE && CFS_NONCE.cfs_nonce) return CFS_NONCE.cfs_nonce;
+  if (typeof CFS_DATA != 'undefined' && CFS_DATA && CFS_DATA.cfsNonce) return CFS_DATA.cfsNonce;
+  return false;
+}
 function getDialogElementCfs() {
   return jQuery('<div/>').appendTo(jQuery('body'));

contact-form-by-supsystic/tags/1.11.1/js/core.min.js

@@ -1 +1 @@
 
-if(typeof(CFS_DATA)=="undefined"){var CFS_DATA={}}if(isNumber(CFS_DATA.animationSpeed)){CFS_DATA.animationSpeed=parseInt(CFS_DATA.animationSpeed)}else{if(jQuery.inArray(CFS_DATA.animationSpeed,["fast","slow"])==-1){CFS_DATA.animationSpeed="fast"}}CFS_DATA.showSubscreenOnCenter=parseInt(CFS_DATA.showSubscreenOnCenter);var sdLoaderImgCfs='<img src="'+CFS_DATA.loader+'" />';var g_cfsAnimationSpeed=300;jQuery.fn.showLoaderCfs=function(){return jQuery(this).html(sdLoaderImgCfs)};jQuery.fn.appendLoaderCfs=function(){jQuery(this).append(sdLoaderImgCfs)};jQuery.sendFormCfs=function(a){return jQuery("<br />").sendFormCfs(a)};jQuery.fn.sendFormCfs=function(e){var b=null;if(!e){e={fid:false,msgElID:false,onSuccess:false}}if(e.fid){b=jQuery("#"+fid)}else{b=jQuery(this)}var c=(jQuery(b).tagName()=="FORM");var f=new Array();if(e.data){f=e.data}else{if(c){f=jQuery(b).serialize()}}if(e.appendData){var h=typeof(f)=="string";var k=[];for(var g in e.appendData){if(h){k.push(g+"="+e.appendData[g])}else{f[g]=e.appendData[g]}}if(h){f+="&"+k.join("&")}}var d=null;if(e.msgElID){if(e.msgElID=="noMessages"){d=false}else{if(typeof(e.msgElID)=="object"){d=e.msgElID}else{d=jQuery("#"+e.msgElID)}}}if(typeof(e.inputsWraper)=="string"){b=jQuery("#"+e.inputsWraper);c=true}if(c&&b){jQuery(b).find("*").removeClass("cfsInputError")}if(d&&!e.btn){jQuery(d).removeClass("cfsSuccessMsg").removeClass("cfsErrorMsg");if(!e.btn){jQuery(d).showLoaderCfs()}}if(e.btn){jQuery(e.btn).attr("disabled","disabled");e.btnIconElement=jQuery(e.btn).find(".fa").length?jQuery(e.btn).find(".fa"):jQuery(e.btn);if(jQuery(e.btn).find(".fa").length){e.btnIconElement.data("prev-class",e.btnIconElement.attr("class")).attr("class","fa fa-spinner fa-spin")}}var a="";if(typeof(e.url)!="undefined"){a=e.url}else{if(typeof(ajaxurl)=="undefined"){a=CFS_DATA.ajaxurl}else{a=ajaxurl}}jQuery(".cfsErrorForField").hide(CFS_DATA.animationSpeed);var j=e.dataType?e.dataType:"json";if(typeof(f)=="string"){f+="&pl="+CFS_DATA.CFS_CODE;f+="&reqType=ajax"}else{f.pl=CFS_DATA.CFS_CODE;f.reqType="ajax"}jQuery.ajax({url:a,data:f,type:"POST",dataType:j,success:function(i){toeProcessAjaxResponseCfs(i,d,b,c,e);if(e.clearMsg){setTimeout(function(){if(d){jQuery(d).animateClear()}},typeof(e.clearMsg)=="boolean"?5000:e.clearMsg)}}})};jQuery.fn.animateClear=function(){var a=jQuery("<span>"+jQuery(this).html()+"</span>");jQuery(this).html(a);jQuery(a).hide(CFS_DATA.animationSpeed,function(){jQuery(a).remove()})};jQuery.fn.animateRemoveCfs=function(a,b){a=a==undefined?CFS_DATA.animationSpeed:a;jQuery(this).hide(a,function(){jQuery(this).remove();if(typeof(b)==="function"){b()}})};function toeProcessAjaxResponseCfs(h,e,c,d,f){if(typeof(f)=="undefined"){f={}}if(typeof(e)=="string"){e=jQuery("#"+e)}if(e){jQuery(e).html("")}if(f.btn){jQuery(f.btn).removeAttr("disabled");if(f.btnIconElement){f.btnIconElement.attr("class",f.btnIconElement.data("prev-class"))}}if(typeof(h)=="object"){if(h.error){if(e){jQuery(e).removeClass("cfsSuccessMsg").addClass("cfsErrorMsg")}var j=[];for(var a in h.errors){if(d){var b=jQuery(c).find('[name*="'+a+'"]');b.addClass("cfsInputError");if(b.attr("placeholder")){}if(!b.data("keyup-error-remove-binded")){b.keydown(function(){jQuery(this).removeClass("cfsInputError")}).data("keyup-error-remove-binded",1)}}if(jQuery(".cfsErrorForField.toe_"+nameToClassId(a)+"").exists()){jQuery(".cfsErrorForField.toe_"+nameToClassId(a)+"").show().html(h.errors[a])}else{if(e){jQuery(e).append(h.errors[a]).append("<br />")}else{j.push(h.errors[a])}}}if(j.length&&f.btn&&jQuery.fn.dialog&&!e){jQuery('<div title="'+toeLangCfs("Really small warning :)")+'" />').html(j.join("<br />")).appendTo("body").dialog({modal:true,width:"500px"})}}else{if(h.messages.length){if(e){jQuery(e).removeClass("cfsErrorMsg").addClass("cfsSuccessMsg");for(var g=0;g<h.messages.length;g++){jQuery(e).append(h.messages[g]).append("<br />")}}}}}if(f.onSuccess&&typeof(f.onSuccess)=="function"){f.onSuccess(h)}}function getDialogElementCfs(){return jQuery("<div/>").appendTo(jQuery("body"))}function toeOptionCfs(a){if(CFS_DATA.options&&CFS_DATA.options[a]){return CFS_DATA.options[a]}return false}function toeLangCfs(a){if(CFS_DATA.siteLang&&CFS_DATA.siteLang[a]){return CFS_DATA.siteLang[a]}return a}function toePagesCfs(a){if(typeof(CFS_DATA)!="undefined"&&CFS_DATA[a]){return CFS_DATA[a]}return false}function toeOptTimeoutHideDescriptionCfs(){jQuery("#cfsOptDescription").removeAttr("toeFixTip");setTimeout(function(){if(!jQuery("#cfsOptDescription").attr("toeFixTip")){toeOptHideDescriptionCfs()}},500)}function toeOptShowDescriptionCfs(b,a,d,c){if(typeof(b)!="undefined"&&b!=""){if(!jQuery("#cfsOptDescription").length){jQuery("body").append('<div id="cfsOptDescription"></div>')}if(c){jQuery("#cfsOptDescription").css("right",jQuery(window).width()-(a-10))}else{jQuery("#cfsOptDescription").css("left",a+10)}jQuery("#cfsOptDescription").css("top",d);jQuery("#cfsOptDescription").show(200);jQuery("#cfsOptDescription").html(b)}}function toeOptHideDescriptionCfs(){jQuery("#cfsOptDescription").removeAttr("toeFixTip");jQuery("#cfsOptDescription").hide(200)}function toeInArrayCfs(c,b){if(b){for(var a in b){if(b[a]==c){return true}}}return false}function toeShowDialogCustomized(b,a){a=jQuery.extend({resizable:false,width:500,height:300,closeOnEscape:true,open:function(c,d){jQuery(".ui-dialog-titlebar").css({"background-color":"#222222","background-image":"none",border:"none",margin:"0",padding:"0","border-radius":"0",color:"#CFCFCF",height:"27px"});jQuery(".ui-dialog-titlebar-close").css({background:'url("'+CFS_DATA.cssPath+'img/tb-close.png") no-repeat scroll 0 0 transparent',border:"0",width:"15px",height:"15px",padding:"0","border-radius":"0",margin:"7px 7px 0"}).html("");jQuery(".ui-dialog").css({"border-radius":"3px","background-color":"#FFFFFF","background-image":"none",padding:"1px","z-index":"300000",position:"fixed",top:"60px"});jQuery(".ui-dialog-buttonpane").css({"background-color":"#FFFFFF"});jQuery(".ui-dialog-title").css({color:"#CFCFCF",font:"12px sans-serif",padding:"6px 10px 0"});if(a.openCallback&&typeof(a.openCallback)=="function"){a.openCallback(c,d)}jQuery(".ui-widget-overlay").css({"z-index":jQuery(c.target).parents(".ui-dialog:first").css("z-index")-1,"background-image":"none"});if(a.modal&&a.closeOnBg){jQuery(".ui-widget-overlay").unbind("click").bind("click",function(){jQuery(b).dialog("close")})}}},a);return jQuery(b).dialog(a)}function toeSliderMove(a,b){var c=jQuery(a.target).attr("id");jQuery("#toeSliderDisplay_"+c).html(b.value);jQuery("#toeSliderInput_"+c).val(b.value).change()}function cfsCorrectJqueryUsed(){return(typeof(jQuery.fn.sendFormCfs)==="function")}function cfsReloadCoreJs(d,e){var c="",b=["common.js","core.js"];for(var a=0;a<b.length;a++){c+='<script type="text/javascript" class="cfsReloadedScript" src="'+CFS_DATA.jsPath+b[a]+'"><\/script>'}jQuery("head").append(c);if(d){_cfsRunClbAfterCoreReload(d,e)}}function _cfsRunClbAfterCoreReload(a,b){if(cfsCorrectJqueryUsed()){callUserFuncArray(a,b);return}setTimeout(function(){cfsCorrectJqueryUsed(a,b)},500)}function base64_decode(d){var b="";var l,j,g="";var k,h,f,e="";var c=0;var a=/[^A-Za-z0-9\+\/\=]/g;if(a.exec(d)){alert("There were invalid base64 characters in the input text.\nValid base64 characters are A-Z, a-z, 0-9, '+', '/',and '='\nExpect errors in decoding.")}d=d.replace(/[^A-Za-z0-9\+\/\=]/g,"");do{k=keyStr.indexOf(d.charAt(c++));h=keyStr.indexOf(d.charAt(c++));f=keyStr.indexOf(d.charAt(c++));e=keyStr.indexOf(d.charAt(c++));l=(k<<2)|(h>>4);j=((h&15)<<4)|(f>>2);g=((f&3)<<6)|e;b=b+String.fromCharCode(l);if(f!=64){b=b+String.fromCharCode(j)}if(e!=64){b=b+String.fromCharCode(g)}l=j=g="";k=h=f=e=""}while(c<d.length);return unescape(b)};
+if(typeof(CFS_DATA)=="undefined"){var CFS_DATA={}}if(isNumber(CFS_DATA.animationSpeed)){CFS_DATA.animationSpeed=parseInt(CFS_DATA.animationSpeed)}else{if(jQuery.inArray(CFS_DATA.animationSpeed,["fast","slow"])==-1){CFS_DATA.animationSpeed="fast"}}CFS_DATA.showSubscreenOnCenter=parseInt(CFS_DATA.showSubscreenOnCenter);var sdLoaderImgCfs='<img src="'+CFS_DATA.loader+'" />';var g_cfsAnimationSpeed=300;jQuery.fn.showLoaderCfs=function(){return jQuery(this).html(sdLoaderImgCfs)};jQuery.fn.appendLoaderCfs=function(){jQuery(this).append(sdLoaderImgCfs)};jQuery.sendFormCfs=function(a){return jQuery("<br />").sendFormCfs(a)};jQuery.fn.sendFormCfs=function(e){var b=null;if(!e){e={fid:false,msgElID:false,onSuccess:false}}if(e.fid){b=jQuery("#"+fid)}else{b=jQuery(this)}var c=(jQuery(b).tagName()=="FORM");var f=new Array();if(e.data){f=e.data}else{if(c){f=jQuery(b).serialize()}}if(e.appendData){var h=typeof(f)=="string";var k=[];for(var g in e.appendData){if(h){k.push(g+"="+e.appendData[g])}else{f[g]=e.appendData[g]}}if(h){f+="&"+k.join("&")}}var d=null;if(e.msgElID){if(e.msgElID=="noMessages"){d=false}else{if(typeof(e.msgElID)=="object"){d=e.msgElID}else{d=jQuery("#"+e.msgElID)}}}if(typeof(e.inputsWraper)=="string"){b=jQuery("#"+e.inputsWraper);c=true}if(c&&b){jQuery(b).find("*").removeClass("cfsInputError")}if(d&&!e.btn){jQuery(d).removeClass("cfsSuccessMsg").removeClass("cfsErrorMsg");if(!e.btn){jQuery(d).showLoaderCfs()}}if(e.btn){jQuery(e.btn).attr("disabled","disabled");e.btnIconElement=jQuery(e.btn).find(".fa").length?jQuery(e.btn).find(".fa"):jQuery(e.btn);if(jQuery(e.btn).find(".fa").length){e.btnIconElement.data("prev-class",e.btnIconElement.attr("class")).attr("class","fa fa-spinner fa-spin")}}var a="";if(typeof(e.url)!="undefined"){a=e.url}else{if(typeof(ajaxurl)=="undefined"){a=CFS_DATA.ajaxurl}else{a=ajaxurl}}jQuery(".cfsErrorForField").hide(CFS_DATA.animationSpeed);var j=e.dataType?e.dataType:"json";var n=cfsGetAdminNonce();if(typeof(f)=="string"){f+="&pl="+CFS_DATA.CFS_CODE;f+="&reqType=ajax";if(n&&!/(^|&)_wpnonce=/.test(f)){f+="&_wpnonce="+encodeURIComponent(n)}}else{f.pl=CFS_DATA.CFS_CODE;f.reqType="ajax";if(n&&typeof(f._wpnonce)=="undefined"){f._wpnonce=n}}jQuery.ajax({url:a,data:f,type:"POST",dataType:j,success:function(i){toeProcessAjaxResponseCfs(i,d,b,c,e);if(e.clearMsg){setTimeout(function(){if(d){jQuery(d).animateClear()}},typeof(e.clearMsg)=="boolean"?5000:e.clearMsg)}}})};jQuery.fn.animateClear=function(){var a=jQuery("<span>"+jQuery(this).html()+"</span>");jQuery(this).html(a);jQuery(a).hide(CFS_DATA.animationSpeed,function(){jQuery(a).remove()})};jQuery.fn.animateRemoveCfs=function(a,b){a=a==undefined?CFS_DATA.animationSpeed:a;jQuery(this).hide(a,function(){jQuery(this).remove();if(typeof(b)==="function"){b()}})};function toeProcessAjaxResponseCfs(h,e,c,d,f){if(typeof(f)=="undefined"){f={}}if(typeof(e)=="string"){e=jQuery("#"+e)}if(e){jQuery(e).html("")}if(f.btn){jQuery(f.btn).removeAttr("disabled");if(f.btnIconElement){f.btnIconElement.attr("class",f.btnIconElement.data("prev-class"))}}if(typeof(h)=="object"){if(h.error){if(e){jQuery(e).removeClass("cfsSuccessMsg").addClass("cfsErrorMsg")}var j=[];for(var a in h.errors){if(d){var b=jQuery(c).find('[name*="'+a+'"]');b.addClass("cfsInputError");if(b.attr("placeholder")){}if(!b.data("keyup-error-remove-binded")){b.keydown(function(){jQuery(this).removeClass("cfsInputError")}).data("keyup-error-remove-binded",1)}}if(jQuery(".cfsErrorForField.toe_"+nameToClassId(a)+"").exists()){jQuery(".cfsErrorForField.toe_"+nameToClassId(a)+"").show().html(h.errors[a])}else{if(e){jQuery(e).append(h.errors[a]).append("<br />")}else{j.push(h.errors[a])}}}if(j.length&&f.btn&&jQuery.fn.dialog&&!e){jQuery('<div title="'+toeLangCfs("Really small warning :)")+'" />').html(j.join("<br />")).appendTo("body").dialog({modal:true,width:"500px"})}}else{if(h.messages.length){if(e){jQuery(e).removeClass("cfsErrorMsg").addClass("cfsSuccessMsg");for(var g=0;g<h.messages.length;g++){jQuery(e).append(h.messages[g]).append("<br />")}}}}}if(f.onSuccess&&typeof(f.onSuccess)=="function"){f.onSuccess(h)}}function cfsGetAdminNonce(){if(typeof(CFS_NONCE)!="undefined"&&CFS_NONCE&&CFS_NONCE.cfs_nonce){return CFS_NONCE.cfs_nonce}if(typeof(CFS_DATA)!="undefined"&&CFS_DATA&&CFS_DATA.cfsNonce){return CFS_DATA.cfsNonce}return false}function getDialogElementCfs(){return jQuery("<div/>").appendTo(jQuery("body"))}function toeOptionCfs(a){if(CFS_DATA.options&&CFS_DATA.options[a]){return CFS_DATA.options[a]}return false}function toeLangCfs(a){if(CFS_DATA.siteLang&&CFS_DATA.siteLang[a]){return CFS_DATA.siteLang[a]}return a}function toePagesCfs(a){if(typeof(CFS_DATA)!="undefined"&&CFS_DATA[a]){return CFS_DATA[a]}return false}function toeOptTimeoutHideDescriptionCfs(){jQuery("#cfsOptDescription").removeAttr("toeFixTip");setTimeout(function(){if(!jQuery("#cfsOptDescription").attr("toeFixTip")){toeOptHideDescriptionCfs()}},500)}function toeOptShowDescriptionCfs(b,a,d,c){if(typeof(b)!="undefined"&&b!=""){if(!jQuery("#cfsOptDescription").length){jQuery("body").append('<div id="cfsOptDescription"></div>')}if(c){jQuery("#cfsOptDescription").css("right",jQuery(window).width()-(a-10))}else{jQuery("#cfsOptDescription").css("left",a+10)}jQuery("#cfsOptDescription").css("top",d);jQuery("#cfsOptDescription").show(200);jQuery("#cfsOptDescription").html(b)}}function toeOptHideDescriptionCfs(){jQuery("#cfsOptDescription").removeAttr("toeFixTip");jQuery("#cfsOptDescription").hide(200)}function toeInArrayCfs(c,b){if(b){for(var a in b){if(b[a]==c){return true}}}return false}function toeShowDialogCustomized(b,a){a=jQuery.extend({resizable:false,width:500,height:300,closeOnEscape:true,open:function(c,d){jQuery(".ui-dialog-titlebar").css({"background-color":"#222222","background-image":"none",border:"none",margin:"0",padding:"0","border-radius":"0",color:"#CFCFCF",height:"27px"});jQuery(".ui-dialog-titlebar-close").css({background:'url("'+CFS_DATA.cssPath+'img/tb-close.png") no-repeat scroll 0 0 transparent',border:"0",width:"15px",height:"15px",padding:"0","border-radius":"0",margin:"7px 7px 0"}).html("");jQuery(".ui-dialog").css({"border-radius":"3px","background-color":"#FFFFFF","background-image":"none",padding:"1px","z-index":"300000",position:"fixed",top:"60px"});jQuery(".ui-dialog-buttonpane").css({"background-color":"#FFFFFF"});jQuery(".ui-dialog-title").css({color:"#CFCFCF",font:"12px sans-serif",padding:"6px 10px 0"});if(a.openCallback&&typeof(a.openCallback)=="function"){a.openCallback(c,d)}jQuery(".ui-widget-overlay").css({"z-index":jQuery(c.target).parents(".ui-dialog:first").css("z-index")-1,"background-image":"none"});if(a.modal&&a.closeOnBg){jQuery(".ui-widget-overlay").unbind("click").bind("click",function(){jQuery(b).dialog("close")})}}},a);return jQuery(b).dialog(a)}function toeSliderMove(a,b){var c=jQuery(a.target).attr("id");jQuery("#toeSliderDisplay_"+c).html(b.value);jQuery("#toeSliderInput_"+c).val(b.value).change()}function cfsCorrectJqueryUsed(){return(typeof(jQuery.fn.sendFormCfs)==="function")}function cfsReloadCoreJs(d,e){var c="",b=["common.js","core.js"];for(var a=0;a<b.length;a++){c+='<script type="text/javascript" class="cfsReloadedScript" src="'+CFS_DATA.jsPath+b[a]+'"><\/script>'}jQuery("head").append(c);if(d){_cfsRunClbAfterCoreReload(d,e)}}function _cfsRunClbAfterCoreReload(a,b){if(cfsCorrectJqueryUsed()){callUserFuncArray(a,b);return}setTimeout(function(){cfsCorrectJqueryUsed(a,b)},500)}function base64_decode(d){var b="";var l,j,g="";var k,h,f,e="";var c=0;var a=/[^A-Za-z0-9\+\/\=]/g;if(a.exec(d)){alert("There were invalid base64 characters in the input text.\nValid base64 characters are A-Z, a-z, 0-9, '+', '/',and '='\nExpect errors in decoding.")}d=d.replace(/[^A-Za-z0-9\+\/\=]/g,"");do{k=keyStr.indexOf(d.charAt(c++));h=keyStr.indexOf(d.charAt(c++));f=keyStr.indexOf(d.charAt(c++));e=keyStr.indexOf(d.charAt(c++));l=(k<<2)|(h>>4);j=((h&15)<<4)|(f>>2);g=((f&3)<<6)|e;b=b+String.fromCharCode(l);if(f!=64){b=b+String.fromCharCode(j)}if(e!=64){b=b+String.fromCharCode(g)}l=j=g="";k=h=f=e=""}while(c<d.length);return unescape(b)};

contact-form-by-supsystic/tags/1.11.1/modules/forms/controller.php

@@ -622 +622 @@
     return ['save', 'removeGroup', 'getListForTbl', 'saveAsCopy', 'remove', 'createFromTpl', 'changeTpl'];
   }
+  /**
+   * contact() checks it's own per-form nonce, updateNonce() just gives fresh nonce for cached pages
+   */
+  public function getPublicMethods()
+  {
+    return ['contact', 'updateNonce'];
+  }
   public function getPermissions()
   {

contact-form-by-supsystic/tags/1.11.1/modules/forms/models/forms.php

@@ -204 +204 @@
         }
         if (empty($errorMsg)) {
+          // Not mandatory email can be empty, but if it is entered - it must be valid
+          if ($htmlType == 'email' && $value && (!is_string($value) || !is_email($value))) {
+            $errorMsg = empty($formInvalidError) ? __('Invalid value for %s', CFS_LANG_CODE) : $formInvalidError;
+          }
+        }
+        if (empty($errorMsg)) {
           // Start other validation process
           if (!$isDate && isset($f['min_size']) && !empty($f['min_size']) && ($minSize = (int) $f['min_size'])) {
@@ -315 +321 @@
               // This is requiredfor case when you hav select box with vals = mail1@mail.com, ... and names User Name 1, ...
               // To send to it's values, not to it's names
-              $variablesWithSelectVals['user_' . $sendName] = $fieldsData[$sendName];
+              $variablesWithSelectVals['user_' . $sendName] = $this->_getSelectedOptionValue($f, isset($fieldsData[$sendName]) ? $fieldsData[$sendName] : '');
               break;
             default:
@@ -324 +330 @@
         }
       }
+      // Submitted values can be mapped to mail headers - line breaks there would start new headers
+      $headerVariables = utilsCfs::cleanMailHeader($variables);
+      $headerVariablesWithSelectVals = utilsCfs::cleanMailHeader($variablesWithSelectVals);
       $sendForceTo = dispatcherCfs::applyFilters('sendContactTo', '', $fieldsData, $form);
       foreach ($form['params']['submit'] as $s) {
@@ -334 +343 @@
         $additionalHeaders = [];
         if (isset($s['enb_cc']) && (int) $s['enb_cc'] && isset($s['cc']) && !empty($s['cc'])) {
-          $additionalHeaders[] = 'Cc: ' . utilsCfs::replaceVariables($s['cc'], $variables);
+          $additionalHeaders[] = 'Cc: ' . utilsCfs::cleanMailHeader(utilsCfs::replaceVariables($s['cc'], $headerVariables));
         }
         if (isset($s['from']) && !empty($s['from'])) {
-          $additionalHeaders[] = 'From: ' . utilsCfs::replaceVariables($s['from'], $variables);
+          $additionalHeaders[] = 'From: ' . utilsCfs::cleanMailHeader(utilsCfs::replaceVariables($s['from'], $headerVariables));
         }
         if (isset($s['reply']) && !empty($s['reply'])) {
-          $additionalHeaders[] = 'Reply-To: ' . utilsCfs::replaceVariables($s['reply'], $variables);
-        }
-        $to = utilsCfs::replaceVariables($to, $variablesWithSelectVals);
-        $subject = utilsCfs::replaceVariables($s['subject'], $variables);
+          $additionalHeaders[] = 'Reply-To: ' . utilsCfs::cleanMailHeader(utilsCfs::replaceVariables($s['reply'], $headerVariables));
+        }
+        $to = utilsCfs::cleanMailHeader(utilsCfs::replaceVariables($to, $headerVariablesWithSelectVals));
+        if (empty($to)) {
+          continue; // Recipient was taken from submitted data, and it was not valid
+        }
+        $subject = utilsCfs::cleanMailHeader(utilsCfs::replaceVariables($s['subject'], $headerVariables));
         // Let it be only for Message field
         //$msg = nl2br(utilsCfs::replaceVariables($msg, array_merge($variables, array('form_data' => $sendFormDataStr))));
@@ -363 +375 @@
     }
     return true;
+  }
+  /**
+   * Submitted select box value can be used as recipient email, @see sendContact(),
+   * so it is accepted only if it is one of field options
+   * @param array $field Select box field
+   * @param mixed $value Submitted value
+   * @return string Value, or empty string if there is no such option
+   */
+  private function _getSelectedOptionValue($field, $value)
+  {
+    if (!is_string($value) || $value === '' || empty($field['options']) || !is_array($field['options'])) {
+      return '';
+    }
+    // Options are prepared in same way as submitted data, @see contact()
+    foreach (dbCfs::prepareHtmlIn($field['options']) as $opt) {
+      if (isset($opt['name']) && (string) $opt['name'] === $value) {
+        return $value;
+      }
+    }
+    return '';
   }
   private function _generateSendFormData($fieldsData, $form)
@@ -782 +814 @@
       for ($i = 0; $i < (int) $d['params']['opts_attrs']['txt_block_number']; $i++) {
         $sendValKey = 'params_tpl_txt_val_' . $i;
-        if (isset($d[$sendValKey])) {
-          $d['params']['tpl']['txt_' . $i] = urldecode($d[$sendValKey]);
+        if (isset($d[$sendValKey]) && is_string($d[$sendValKey])) {
+          // Text is sent url-encoded, so request filter did not see real value - filter it after decode
+          $d['params']['tpl']['txt_' . $i] = reqCfs::sanitizeString(urldecode($d[$sendValKey]));
         }
       }

contact-form-by-supsystic/tags/1.11.1/modules/forms/views/forms.php

@@ -5 +5 @@
 {
   protected $_twig;
+  /**
+   * Tags values for current render: placeholder => value, @see _addTwigValue()
+   */
+  private $_twigValues = [];
+  private $_twigValuesKey = '';
   private $_renderFormIter = 0;
   private $_lastForm = null;
@@ -14 +19 @@
     frameCfs::_()->addScript('admin.forms', $this->getModule()->getModPath() . 'js/admin.forms.js');
     frameCfs::_()->addScript('admin.forms.list', $this->getModule()->getModPath() . 'js/admin.forms.list.js');
-    frameCfs::_()->addJSVar('admin.forms.list', 'cfsTblDataUrl', uriCfs::mod('forms', 'getListForTbl', ['reqType' => 'ajax']));
+    frameCfs::_()->addJSVar('admin.forms.list', 'cfsTblDataUrl', uriCfs::mod('forms', 'getListForTbl', ['reqType' => 'ajax', '_wpnonce' => wp_create_nonce('cfs_nonce')]));
 
     $this->assign('addNewLink', frameCfs::_()->getModule('options')->getTabUrl('forms_add_new'));
@@ -114 +119 @@
     ];
 
-    $this->assign('csvExportUrl', uriCfs::mod('forms', 'exportCsv', ['id' => $id]));
+    $this->assign('csvExportUrl', uriCfs::mod('forms', 'exportCsv', ['id' => $id, '_wpnonce' => wp_create_nonce('cfs_nonce')]));
 
     $this->assign('adminEmail', get_bloginfo('admin_email'));
@@ -123 +128 @@
     $this->assign('cfsAddNewUrl', $cfsAddNewUrl);
     $this->assign('bgTypes', $bgType);
-    $this->assign('previewUrl', uriCfs::mod('forms', 'getPreviewHtml', ['id' => $id]));
+    $this->assign('previewUrl', uriCfs::mod('forms', 'getPreviewHtml', ['id' => $id, '_wpnonce' => wp_create_nonce('cfs_nonce')]));
     $this->assign('form', $form);
     $this->assign('fieldTypes', $fieldTypes);
@@ -473 +478 @@
   public function adjustOpacity($color, $alpha)
   {
+    $color = $this->_resolveTwigValues($color);
+    $alpha = $this->_resolveTwigValues($alpha);
     $alpha = max(0, min(1, $alpha));
     $rgbColor = utilsCfs::hexToRgb($color);
@@ -478 +485 @@
     return 'rgba(' . implode(',', $rgbColor) . ')';
   }
+  public function hexToRgbaStr($hex, $alpha = 1)
+  {
+    return utilsCfs::hexToRgbaStr($this->_resolveTwigValues($hex), $this->_resolveTwigValues($alpha));
+  }
   public function adjustBrightness($hex, $steps)
   {
+    $hex = $this->_resolveTwigValues($hex);
+    $steps = $this->_resolveTwigValues($steps);
     // Steps should be between -255 and 255. Negative = darker, positive = lighter
     $steps = max(-255, min(255, $steps));
@@ -525 +538 @@
 
     $form['css'] = $this->_replaceTagsWithTwig($form['css'], $form);
+    $htmlValuesFrom = count($this->_twigValues);
     $form['html'] = $this->_replaceTagsWithTwig($form['html'], $form);
 
-    $form['html'] = str_replace('col-md-', 'supMd', $form['html']);
-    $form['html'] = str_replace('col-xs-', 'supXs', $form['html']);
-    $form['html'] = str_replace('col-sm-', 'supSm', $form['html']);
-    $form['html'] = str_replace('col-lg-', 'supLg', $form['html']);
-    $form['html'] = str_replace('row', 'supRow', $form['html']);
+    $colReplaceFrom = ['col-md-', 'col-xs-', 'col-sm-', 'col-lg-', 'row'];
+    $colReplaceTo = ['supMd', 'supXs', 'supSm', 'supLg', 'supRow'];
+    $form['html'] = str_replace($colReplaceFrom, $colReplaceTo, $form['html']);
+    // Values of tags in html were always processed by this replacement too
+    foreach (array_slice(array_keys($this->_twigValues), $htmlValuesFrom) as $valueKey) {
+      $this->_twigValues[$valueKey] = str_replace($colReplaceFrom, $colReplaceTo, $this->_twigValues[$valueKey]);
+    }
 
     $form['html'] .= $this->_generateImgsPreload($form);
@@ -540 +556 @@
     // it will not recognize css in js data as style whye rendering on server side,
     // but will be replaced back to normal <style> tag in JS, @see js/frontend.forms.js
-    return $this->_twig->render(
+    $tpl =
       ($replaceStyleTag ? '<span style="display: none;" id="cfsFormStylesHidden_' . $form['view_id'] . '">' : '<style type="text/css" id="' . $form['view_html_id'] . '_style">') .
-        $form['css'] .
-        ($replaceStyleTag ? '</span>' : '</style>') .
-        '<div id="' .
-        $form['view_html_id'] .
-        '" class="cfsFormShell">' .
-        $form['html'] .
-        '</div>',
-      ['forms' => $form],
-    );
+      $form['css'] .
+      ($replaceStyleTag ? '</span>' : '</style>') .
+      '<div id="' .
+      $form['view_html_id'] .
+      '" class="cfsFormShell">' .
+      $form['html'] .
+      '</div>';
+    $obLevel = ob_get_level();
+    try {
+      $res = $this->_twig->render($tpl, ['forms' => $form]);
+    } catch (Throwable $e) {
+      // Twig cleans own output buffer only for exceptions, not for PHP errors
+      while (ob_get_level() > $obLevel) {
+        ob_end_clean();
+      }
+      // String loader uses whole template as it's name - so full Twig message would contain all template
+      $errorMsg = $e instanceof Twig_Error ? $e->getRawMessage() : $e->getMessage();
+      error_log('Contact Form by Supsystic: can not render form #' . $form['id'] . ': ' . $errorMsg);
+      return frameCfs::_()->getModule('user')->isAdmin() ? esc_html(sprintf(__('Can not render form template: %s', CFS_LANG_CODE), $errorMsg)) : '';
+    }
+    // Put tags values only now - so they are never parsed by template engine
+    return $this->_insertTwigValues($res);
   }
   private function _generateCommonFormCss($form)
   {
     $res = '';
-    $res .= '#[SHELL_ID] { width: ' . $form['params']['tpl']['width'] . $form['params']['tpl']['width_measure'] . '}';
+    // Values go through tags too, @see _replaceTagsWithTwig()
+    $res .= '#[SHELL_ID] { width: ' . (isset($form['params']['tpl']['width']) ? '[width]' : '') . (isset($form['params']['tpl']['width_measure']) ? '[width_measure]' : '') . '}';
     if (isset($form['params'], $form['params']['tpl'], $form['params']['tpl']['form_sent_msg_color']) && !empty($form['params']['tpl']['form_sent_msg_color'])) {
-      $res .= '#[SHELL_ID] .cfsSuccessMsg { color: ' . $form['params']['tpl']['form_sent_msg_color'] . ' !important}';
+      $res .= '#[SHELL_ID] .cfsSuccessMsg { color: [form_sent_msg_color] !important}';
     }
     return $res;
@@ -863 +893 @@
     foreach ($replaceFrom as $i => $v) {
       $replaceFrom[$i] = '[' . $v . ']';
+      // Tags values are users data: put them in template only as placeholders, real values are inserted
+      // after template render, so they are never evaluated by template engine. First 4 tags - are template syntax.
+      if ($i > 3) {
+        $replaceTo[$i] = $this->_addTwigValue($replaceTo[$i]);
+      }
     }
     return str_replace($replaceFrom, $replaceTo, $string);
+  }
+  /**
+   * Register value for template and get it's placeholder
+   * @param mixed $value
+   * @return string Placeholder: it is safe for any template place - text, or string in Twig expression
+   */
+  private function _addTwigValue($value)
+  {
+    if (empty($this->_twigValuesKey)) {
+      // Unpredictable, and contains only chars that will not be changed by any template replacements
+      $this->_twigValuesKey = strtoupper(substr(md5(uniqid('', true) . wp_rand()), 0, 12));
+    }
+    $placeholder = '__CFSV' . $this->_twigValuesKey . '_' . count($this->_twigValues) . '__';
+    // Same line breaks normalization as Twig lexer did, when values were part of template
+    $this->_twigValues[$placeholder] = is_scalar($value) ? str_replace(["\r\n", "\r"], "\n", (string) $value) : '';
+    return $placeholder;
+  }
+  private function _insertTwigValues($str)
+  {
+    // strtr() makes all replacements in one pass, so inserted values are not processed again
+    return empty($this->_twigValues) ? $str : strtr($str, $this->_twigValues);
+  }
+  /**
+   * Template functions get placeholders as arguments, @see adjustBrightness()
+   */
+  private function _resolveTwigValues($value)
+  {
+    return is_string($value) && strpos($value, '__CFSV') !== false ? $this->_insertTwigValues($value) : $value;
   }
   protected function _initTwig()
@@ -873 +936 @@
       }
       Twig_Autoloader::register();
+      importClassCfs('twigSecurityPolicyCfs', CFS_CLASSES_DIR . 'twigSecurityPolicy.php');
       $this->_twig = new Twig_Environment(new Twig_Loader_String(), ['debug' => 0]);
+      // Templates can be edited in admin area - so they are always rendered in sandbox
+      $this->_twig->addExtension(new Twig_Extension_Sandbox(new twigSecurityPolicyCfs(), true));
       $this->_twig->addFunction(new Twig_SimpleFunction('adjust_brightness', [$this, 'adjustBrightness']));
       $this->_twig->addFunction(new Twig_SimpleFunction('adjust_opacity', [$this, 'adjustOpacity']));
-      $this->_twig->addFunction(new Twig_SimpleFunction('hex_to_rgba_str', 'utilsCfs::hexToRgbaStr'));
+      $this->_twig->addFunction(new Twig_SimpleFunction('hex_to_rgba_str', [$this, 'hexToRgbaStr']));
     }
   }
@@ -885 +951 @@
     frameCfs::_()->addScript('admin.forms', $this->getModule()->getModPath() . 'js/admin.forms.js');
     frameCfs::_()->addScript('admin.forms.contacts.list', $this->getModule()->getModPath() . 'js/admin.forms.contacts.list.js');
-    frameCfs::_()->addJSVar('admin.forms.contacts.list', 'cfsTblDataUrl', uriCfs::mod('forms', 'getContactsListForTbl', ['reqType' => 'ajax', 'fid' => $fid]));
+    frameCfs::_()->addJSVar('admin.forms.contacts.list', 'cfsTblDataUrl', uriCfs::mod('forms', 'getContactsListForTbl', ['reqType' => 'ajax', 'fid' => $fid, '_wpnonce' => wp_create_nonce('cfs_nonce')]));
     $allForms = $this->getModel('forms')->getAllFromTbl();
     $allFormsForSelect = [];

contact-form-by-supsystic/tags/1.11.1/modules/forms/views/tpl/formsEditFormStatistics.php

@@ -39 +39 @@
                         <a href="#" class="button cfsStatChartGroupBtn" data-stat-group="month" data-chart="cfsMainStats"><?php _e('Month', CFS_LANG_CODE); ?></a>
                         |
-                        <a href="<?php echo uriCfs::mod('statistics', 'getCsv'); ?>" target="_blank" class="button cfsStatExportCsv" data-chart="cfsMainStats"><?php _e('Export to CSV', CFS_LANG_CODE); ?></a>
+                        <a href="<?php echo uriCfs::mod('statistics', 'getCsv', ['_wpnonce' => wp_create_nonce('cfs_nonce')]); ?>" target="_blank" class="button cfsStatExportCsv" data-chart="cfsMainStats"><?php _e('Export to CSV', CFS_LANG_CODE); ?></a>
                         |
                 </span>

contact-form-by-supsystic/tags/1.11.1/modules/mail/mod.php

@@ -7 +7 @@
   public function send($to, $subject, $message, $fromName = '', $fromEmail = '', $replyToName = '', $replyToEmail = '', $additionalHeaders = [], $additionalParameters = [])
   {
+    // Line breaks in any of header values would inject new mail headers
+    list($to, $subject, $fromName, $fromEmail, $replyToName, $replyToEmail) = utilsCfs::cleanMailHeader([$to, $subject, $fromName, $fromEmail, $replyToName, $replyToEmail]);
+    $additionalHeaders = empty($additionalHeaders) ? [] : array_filter(utilsCfs::cleanMailHeader((array) $additionalHeaders));
     $type = frameCfs::_()->getModule('options')->get('mail_send_engine');
     $res = false;
@@ -69 +72 @@
       $this->_sendMailMailer = new PHPMailer\PHPMailer\PHPMailer(true); // create a new object
       $this->_sendMailMailer->isSendmail(); // enable SendMail
-      $sendMailPath = trim(frameCfs::_()->getModule('options')->get('sendmail_path'));
-      if (!empty($sendMailPath)) {
+      $sendMailPath = trim((string) frameCfs::_()->getModule('options')->get('sendmail_path'));
+      // Value could be saved before validation was added - never pass invalid one to shell
+      if (!empty($sendMailPath) && utilsCfs::isValidSendmailPath($sendMailPath)) {
         $this->_sendMailMailer->Sendmail = $sendMailPath;
       }

contact-form-by-supsystic/tags/1.11.1/modules/mail/views/tpl/mailAdmin.php

@@ -6 +6 @@
         <?php echo htmlCfs::hidden('mod', ['value' => 'mail']); ?>
         <?php echo htmlCfs::hidden('action', ['value' => 'testEmail']); ?>
+        <?php echo htmlCfs::defaultNonceForAdminPanel(); ?>
         <button class="button button-primary">
                 <i class="fa fa-paper-plane"></i>
@@ -63 +64 @@
         <?php echo htmlCfs::hidden('mod', ['value' => 'mail']); ?>
         <?php echo htmlCfs::hidden('action', ['value' => 'saveOptions']); ?>
+        <?php echo htmlCfs::defaultNonceForAdminPanel(); ?>
         <button class="button button-primary">
                 <i class="fa fa-fw fa-save"></i>

contact-form-by-supsystic/tags/1.11.1/modules/options/models/options.php

@@ -22 +22 @@
   {
     if (isset(self::$_restrictedOptionValues[$optKey]) && !in_array($val, self::$_restrictedOptionValues[$optKey], true)) {
+      return;
+    }
+    if (!$this->_isValidOptValue($optKey, $val)) {
       return;
     }
@@ -70 +73 @@
   {
     if (isset($d['opt_values']) && is_array($d['opt_values']) && !empty($d['opt_values'])) {
+      if (isset($d['opt_values']['sendmail_path']) && !$this->_isValidOptValue('sendmail_path', $d['opt_values']['sendmail_path'])) {
+        // Field is always submitted with mail options, but matters only for Sendmail engine
+        if (isset($d['opt_values']['mail_send_engine']) && $d['opt_values']['mail_send_engine'] === 'sendmail') {
+          $this->pushError(__('Invalid Sendmail Path: it should be absolute path to sendmail binary, for example /usr/sbin/sendmail', CFS_LANG_CODE), 'opt_values[sendmail_path]');
+          return false;
+        }
+        unset($d['opt_values']['sendmail_path']);
+      }
       dispatcherCfs::doAction('beforeSaveOpts', $d);
       foreach ($d['opt_values'] as $code => $val) {
@@ -80 +91 @@
     }
     return false;
+  }
+  private function _isValidOptValue($optKey, $val)
+  {
+    switch ($optKey) {
+      case 'sendmail_path':
+        return utilsCfs::isValidSendmailPath($val);
+    }
+    return true;
   }
   private function _updateOptsInDb()

contact-form-by-supsystic/tags/1.11.1/modules/statistics/controller.php

@@ -80 +80 @@
     $res->ajaxExec();
   }
+  /**
+   * add() is called from frontend and checks connect_hash on it's own.
+   * Inherited removeGroup() and clear() are not listed anywhere - so they can not be called by request.
+   */
+  public function getPublicMethods()
+  {
+    return ['add'];
+  }
   public function getPermissions()
   {

contact-form-by-supsystic/tags/1.11.1/modules/templates/mod.php

@@ -96 +96 @@
         }
         $jsData['cfsAcShow'] = $show;
+        // All admin requests require plugin nonce, @see frameCfs::havePermissions()
+        if (frameCfs::_()->getModule('user')->isAdmin()) {
+          $jsData['cfsNonce'] = wp_create_nonce('cfs_nonce');
+        }
       }
       $jsData = dispatcherCfs::applyFilters('jsInitVariables', $jsData);

contact-form-by-supsystic/tags/1.11.1/readme.txt

@@ -4 +4 @@
 Tested up to: 7.1
 Requires PHP: 7.3
-Stable tag: 1.10.7
+Stable tag: 1.11.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -169 +169 @@
 = 2026 =
 
+= 1.11.1 — October 22, 2026 =
+
+* Maintenance release with the latest Contact Form updates.
+
+= 1.11.0 — October 22, 2026 =
+
+* General security hardening and code improvements.
+
 = 1.10.7 — October 16, 2026 =
 

contact-form-by-supsystic/trunk/cfs.php

@@ -5 +5 @@
  * Plugin URI: https://supsystic.com/plugins/contact-form-plugin/
  * Description: Drag-and-drop contact form builder with ready templates, 25+ field types, reCAPTCHA, saved submissions and form statistics. No coding needed.
- * Version: 1.10.7
+ * Version: 1.11.1
  * Author: supsystic.com
  * Author URI: https://supsystic.com

contact-form-by-supsystic/trunk/classes/controller.php

@@ -104 +104 @@
   public function __call($name, $arguments)
   {
-    // delete()/clear() wipe the entire table when called with no/null arguments,
-    // which is exactly how they get invoked here (AJAX dispatch never actually
-    // passes $arguments through). Neither is reliably listed in every controller's
-    // getPermissions(), and havePermissions() defaults to "allow" for any action
-    // name it doesn't recognize - so without this check, any visitor could delete
-    // all data in a table simply by requesting action=delete or action=clear.
+    // delete()/clear() wipe the entire table when called with no/null arguments.
+    // Request dispatcher never routes actions here (frameCfs::havePermissions() accepts
+    // only real declared controller methods), but keep this guard for any other caller.
     if (in_array(strtolower($name), ['delete', 'clear'], true)) {
       return false;
@@ -136 +133 @@
                 );
          * Can be used on of sub-array - CFS_METHODS or CFS_USERLEVELS
+         * Methods that are not listed here and not listed in getPublicMethods() can not be called by request at all.
          */
   public function getPermissions()
@@ -142 +140 @@
   }
   /**
-   * Methods that require nonce to be generated
+   * Methods that can be called by request from any visitor, including not logged in users.
+   * Each of them must validate request on it's own (own nonce, hash, etc.).
    * If need - should be redefined in each controller where it required.
    * @return array
    */
+  public function getPublicMethods()
+  {
+    return [];
+  }
+  /**
+   * Methods from getPermissions() that are opened by direct links from outside of plugin pages
+   * (for example - OAuth callbacks), so they can not carry plugin nonce.
+   * All other methods from getPermissions() always require valid plugin nonce.
+   * @return array
+   */
+  public function getNonceExemptMethods()
+  {
+    return [];
+  }
+  /**
+   * Public methods that require plugin nonce too.
+   * Methods from getPermissions() require it anyway, @see frameCfs::havePermissions().
+   * @return array
+   */
   public function getNoncedMethods()
   {
     return [];
+  }
+  /**
+   * Check that current request was sent by plugin administrator from plugin pages
+   * @return bool
+   */
+  protected function _isAdminRequest()
+  {
+    return frameCfs::_()->getModule('user')->isAdmin() && frameCfs::_()->verifyNonce();
   }
   public function getModule()
@@ -234 +260 @@
   {
     $res = new responseCfs();
-    if ($this->getModel()->removeGroup(reqCfs::getVar('listIds', 'post'))) {
+    // Inherited by all controllers - so check access here too, not only in request dispatcher
+    if (!$this->_isAdminRequest()) {
+      $res->pushError(__('You have no permissions to do this', CFS_LANG_CODE));
+    } elseif ($this->getModel()->removeGroup(reqCfs::getVar('listIds', 'post'))) {
       $res->addMessage(__('Done', CFS_LANG_CODE));
     } else {
@@ -244 +273 @@
   {
     $res = new responseCfs();
-    if ($this->getModel()->clear()) {
+    if (!$this->_isAdminRequest()) {
+      $res->pushError(__('You have no permissions to do this', CFS_LANG_CODE));
+    } elseif ($this->getModel()->clear()) {
       $res->addMessage(__('Done', CFS_LANG_CODE));
     } else {

contact-form-by-supsystic/trunk/classes/frame.php

@@ -23 +23 @@
   private $_mod = '';
   private $_action = '';
+  /**
+   * PRO before 1.5.0 does not declare it's public and nonce exempt methods, @see _isLegacyPro()
+   */
+  private static $_legacyProPublicMethods = [
+    'add_fields' => ['uploadFile', 'getFile', 'removeFile'],
+    'wp_subscribe' => ['confirm'],
+  ];
+  private static $_legacyProNonceExemptMethods = [
+    'campaignmonitor' => ['saveAccessToken'],
+    'constantcontact' => ['saveAccessToken'],
+    'verticalresponse' => ['saveAccessToken'],
+    // Read only exports - old PRO opens them by links without nonce
+    'ab_testing' => ['getListForTbl'],
+    'wp_subscribe' => ['getWpCsvList'],
+    'statistics' => ['getCsv'],
+  ];
+  private static $_legacyPro = null;
   /**
    * Object with result of executing non-ajax module request
@@ -194 +211 @@
   }
   /**
-   * Check permissions for action in controller by $code
+   * Check permissions for action in controller by $code.
+   * Access is denied by default: an action can be dispatched only if its controller declares it,
+   * either as public (getPublicMethods() - such method must validate the request on its own),
+   * or for some user level (getPermissions()). Every action that is not public requires
+   * a valid plugin nonce too, except actions from getNonceExemptMethods().
    * @param string $code Code of controller that need to be checked
    * @param string $action Action that need to be checked
@@ -201 +222 @@
   public function havePermissions($code, $action)
   {
-    $res = true;
+    $controller = $this->_getDispatchController($code, $action);
+    if (!$controller) {
+      return false;
+    }
+    $action = strtolower($action);
+    if ($this->_methodListed($action, $this->_getPublicMethods($code, $controller))) {
+      // Public methods can be additionally enrolled for the plugin nonce
+      return !$this->_methodListed($action, $controller->getNoncedMethods()) || $this->verifyNonce();
+    }
+    $requiredLevels = $this->_getRequiredUserLevels($controller->getPermissions(), $action);
+    if (empty($requiredLevels)) {
+      // Action was not declared by controller - deny it
+      return false;
+    }
+    $currentUserPosition = $this->getModule('user')->getCurrentUserPosition();
+    // For multi-sites network admin role is undefined, let's do this here
+    if (is_multisite() && is_admin() && is_super_admin()) {
+      $currentUserPosition = CFS_ADMIN;
+    }
+    foreach ($requiredLevels as $levels) {
+      if (!in_array($currentUserPosition, $levels, true)) {
+        return false;
+      }
+    }
+    if (!$this->_methodListed($action, $this->_getNonceExemptMethods($code, $controller)) && !$this->verifyNonce()) {
+      return false;
+    }
+    return true;
+  }
+  /**
+   * PRO add-on can be older than this plugin: before 1.5.0 it did not declare access for it's methods
+   * @return bool
+   */
+  protected function _isLegacyPro()
+  {
+    if (self::$_legacyPro === null) {
+      self::$_legacyPro = function_exists('getProPlugCodeCfs') && !defined('CFS_PRO_DECLARES_ACCESS');
+    }
+    return self::$_legacyPro;
+  }
+  protected function _getPublicMethods($code, $controller)
+  {
+    $methods = (array) $controller->getPublicMethods();
+    if ($this->_isLegacyPro() && isset(self::$_legacyProPublicMethods[$code])) {
+      $methods = array_merge($methods, self::$_legacyProPublicMethods[$code]);
+    }
+    return $methods;
+  }
+  protected function _getNonceExemptMethods($code, $controller)
+  {
+    $methods = (array) $controller->getNonceExemptMethods();
+    if ($this->_isLegacyPro() && isset(self::$_legacyProNonceExemptMethods[$code])) {
+      $methods = array_merge($methods, self::$_legacyProNonceExemptMethods[$code]);
+    }
+    return $methods;
+  }
+  /**
+   * Check if action is allowed for any visitor, including not logged in users
+   * @param string $code Code of controller that need to be checked
+   * @param string $action Action that need to be checked
+   * @return bool
+   */
+  public function isPublicAction($code, $action)
+  {
+    $controller = $this->_getDispatchController($code, $action);
+    return $controller && $this->_methodListed(strtolower($action), $this->_getPublicMethods($code, $controller));
+  }
+  /**
+   * Verify plugin nonce from current request
+   * @return bool
+   */
+  public function verifyNonce()
+  {
+    $nonce = isset($_REQUEST['_wpnonce']) && is_string($_REQUEST['_wpnonce']) ? sanitize_text_field(wp_unslash($_REQUEST['_wpnonce'])) : '';
+    if (empty($nonce)) {
+      return false;
+    }
+    return wp_verify_nonce($nonce, 'cfs_nonce') || wp_verify_nonce($nonce, 'cfs_nonce_frontend');
+  }
+  /**
+   * Get controller of module, if action can be dispatched to it: it should be real public controller method,
+   * not some name that will be routed through controllerCfs::__call() to it's model.
+   * @param string $code Module code
+   * @param string $action Action name
+   * @return controllerCfs|null
+   */
+  protected function _getDispatchController($code, $action)
+  {
     $mod = $this->getModule($code);
-    $action = strtolower($action);
-    if ($mod) {
-      $permissions = $mod->getController()->getPermissions();
-      if (!empty($permissions)) {
-        // Special permissions
-        if (isset($permissions[CFS_METHODS]) && !empty($permissions[CFS_METHODS])) {
-          foreach ($permissions[CFS_METHODS] as $method => $permissions) {
-            // Make case-insensitive
-            $permissions[CFS_METHODS][strtolower($method)] = $permissions;
-          }
-          if (array_key_exists($action, $permissions[CFS_METHODS])) {
-            // Permission for this method exists
-            $currentUserPosition = frameCfs::_()->getModule('user')->getCurrentUserPosition();
-            if ((is_array($permissions[CFS_METHODS][$action]) && !in_array($currentUserPosition, $permissions[CFS_METHODS][$action])) || (!is_array($permissions[CFS_METHODS][$action]) && $permissions[CFS_METHODS][$action] != $currentUserPosition)) {
-              $res = false;
-            }
-          }
-        }
-        if (isset($permissions[CFS_USERLEVELS]) && !empty($permissions[CFS_USERLEVELS])) {
-          $currentUserPosition = frameCfs::_()->getModule('user')->getCurrentUserPosition();
-          // For multi-sites network admin role is undefined, let's do this here
-          if (is_multisite() && is_admin() && is_super_admin()) {
-            $currentUserPosition = CFS_ADMIN;
-          }
-          foreach ($permissions[CFS_USERLEVELS] as $userlevel => $methods) {
-            if (is_array($methods)) {
-              $lowerMethods = array_map('strtolower', $methods); // Make case-insensitive
-              if (in_array($action, $lowerMethods)) {
-                // Permission for this method exists
-                if ($currentUserPosition != $userlevel) {
-                  $res = false;
-                }
-                break;
-              }
-            } else {
-              $lowerMethod = strtolower($methods); // Make case-insensitive
-              if ($lowerMethod == $action) {
-                // Permission for this method exists
-                if ($currentUserPosition != $userlevel) {
-                  $res = false;
-                }
-                break;
-              }
-            }
-          }
-        }
-      }
-      if ($res) {
-        // Additional check for nonces
-        $noncedMethods = $mod->getController()->getNoncedMethods();
-        if (!empty($noncedMethods)) {
-          $noncedMethods = array_map('strtolower', $noncedMethods);
-          if (in_array($action, $noncedMethods)) {
-            $nonce = isset($_REQUEST['_wpnonce']) ? $_REQUEST['_wpnonce'] : reqCfs::getVar('_wpnonce');
-            if (is_admin()) {
-              if (!wp_verify_nonce($nonce, 'cfs_nonce')) {
-                $res = false;
-              }
-            } else {
-              if (!wp_verify_nonce($nonce, 'cfs_nonce_frontend')) {
-                $res = false;
-              }
-            }
-          }
+    $controller = $mod ? $mod->getController() : null;
+    if (!$controller || empty($action) || !is_string($action) || !method_exists($controller, $action)) {
+      return null;
+    }
+    $method = new ReflectionMethod($controller, $action);
+    if (!$method->isPublic() || $method->isStatic()) {
+      return null;
+    }
+    return $controller;
+  }
+  protected function _methodListed($action, $methods)
+  {
+    return !empty($methods) && is_array($methods) && in_array($action, array_map('strtolower', $methods), true);
+  }
+  /**
+   * Get user levels required for action from controller permissions
+   * @param array $permissions Result of controllerCfs::getPermissions()
+   * @param string $action Action name in lower case
+   * @return array List of conditions, each one - array of user levels, any of them pass condition. Empty if action is not declared.
+   */
+  protected function _getRequiredUserLevels($permissions, $action)
+  {
+    $res = [];
+    if (empty($permissions) || !is_array($permissions)) {
+      return $res;
+    }
+    if (isset($permissions[CFS_METHODS]) && is_array($permissions[CFS_METHODS])) {
+      foreach ($permissions[CFS_METHODS] as $method => $levels) {
+        if (strtolower($method) == $action) {
+          $res[] = (array) $levels;
+          break;
+        }
+      }
+    }
+    if (isset($permissions[CFS_USERLEVELS]) && is_array($permissions[CFS_USERLEVELS])) {
+      foreach ($permissions[CFS_USERLEVELS] as $userlevel => $methods) {
+        if ($this->_methodListed($action, (array) $methods)) {
+          $res[] = [$userlevel];
+          break;
         }
       }
@@ -335 +418 @@
         case 'ajax':
           add_action('wp_ajax_' . $this->_action, [$mod->getController(), $this->_action]);
-          add_action('wp_ajax_nopriv_' . $this->_action, [$mod->getController(), $this->_action]);
+          // Not logged in visitors can reach only actions that controller declared as public
+          if ($this->isPublicAction($this->_mod, $this->_action)) {
+            add_action('wp_ajax_nopriv_' . $this->_action, [$mod->getController(), $this->_action]);
+          }
           break;
         default:

contact-form-by-supsystic/trunk/classes/utils.php

@@ -735 +735 @@
     }
     return $str;
+  }
+  /**
+   * Make value safe to be placed in email header: line breaks there start new header.
+   * @param mixed $value Header value, or array of values
+   * @return mixed
+   */
+  public static function cleanMailHeader($value)
+  {
+    if (is_array($value)) {
+      return array_map([__CLASS__, 'cleanMailHeader'], $value);
+    }
+    if (!is_scalar($value)) {
+      return '';
+    }
+    return trim(preg_replace('/[\r\n\t\0\x0B\x0C]+/', ' ', (string) $value));
+  }
+  /**
+   * Sendmail path is passed to shell by mailer, so allow only absolute path to sendmail-compatible binary,
+   * with few safe flags.
+   * @param string $path
+   * @return bool
+   */
+  public static function isValidSendmailPath($path)
+  {
+    if (!is_string($path)) {
+      return false;
+    }
+    $path = trim($path, ' ');
+    if ($path === '') {
+      return true; // Default from php.ini will be used
+    }
+    // Only printable chars, parts are separated by spaces only
+    if (preg_match('/[^\x20-\x7E]/', $path)) {
+      return false;
+    }
+    $parts = preg_split('/ +/', $path);
+    $bin = array_shift($parts);
+    if (!preg_match('#^(?:[A-Za-z]:)?[\\\\/][A-Za-z0-9._\\\\/-]+$#', $bin) || strpos($bin, '..') !== false) {
+      return false;
+    }
+    $binName = basename(str_replace('\\', '/', $bin));
+    if (!preg_match('/^(sendmail|msmtp|ssmtp|esmtp|exim4?|qmail-inject|mini_sendmail|nullmailer-inject)(\.exe)?$/i', $binName)) {
+      return false;
+    }
+    $emailRe = '/^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+$/';
+    for ($i = 0; $i < count($parts); $i++) {
+      $flag = $parts[$i];
+      if (in_array($flag, ['-t', '-i', '-oi', '-ti'], true)) {
+        continue;
+      }
+      if (strpos($flag, '-f') === 0 && strlen($flag) > 2 && preg_match($emailRe, substr($flag, 2))) {
+        continue;
+      }
+      if ($flag === '-f' && isset($parts[$i + 1]) && preg_match($emailRe, $parts[$i + 1])) {
+        $i++;
+        continue;
+      }
+      return false;
+    }
+    return true;
   }
   public static function encodeArrayTxt($arr, $forceOrd = false)

contact-form-by-supsystic/trunk/config.php

@@ -53 +53 @@
 
 define('CFS_PLUGIN_INSTALLED', true);
-define('CFS_VERSION', '1.10.7');
+define('CFS_VERSION', '1.11.1');
 define('CFS_USER', 'user');
 

contact-form-by-supsystic/trunk/js/core.js

@@ -84 +84 @@
   var dataType = params.dataType ? params.dataType : 'json';
   // Set plugin orientation
+  // Admin actions require plugin nonce - add it if request does not have it's own one
+  var adminNonce = cfsGetAdminNonce();
   if (typeof data == 'string') {
     data += '&pl=' + CFS_DATA.CFS_CODE;
     data += '&reqType=ajax';
+    if (adminNonce && !/(^|&)_wpnonce=/.test(data)) data += '&_wpnonce=' + encodeURIComponent(adminNonce);
   } else {
     data['pl'] = CFS_DATA.CFS_CODE;
     data['reqType'] = 'ajax';
+    if (adminNonce && typeof data['_wpnonce'] == 'undefined') data['_wpnonce'] = adminNonce;
   }
 
@@ -194 +198 @@
 }
 
+/**
+ * Plugin nonce for admin requests, it is not available on frontend
+ */
+function cfsGetAdminNonce() {
+  if (typeof CFS_NONCE != 'undefined' && CFS_NONCE && CFS_NONCE.cfs_nonce) return CFS_NONCE.cfs_nonce;
+  if (typeof CFS_DATA != 'undefined' && CFS_DATA && CFS_DATA.cfsNonce) return CFS_DATA.cfsNonce;
+  return false;
+}
 function getDialogElementCfs() {
   return jQuery('<div/>').appendTo(jQuery('body'));

contact-form-by-supsystic/trunk/js/core.min.js

@@ -1 +1 @@
 
-if(typeof(CFS_DATA)=="undefined"){var CFS_DATA={}}if(isNumber(CFS_DATA.animationSpeed)){CFS_DATA.animationSpeed=parseInt(CFS_DATA.animationSpeed)}else{if(jQuery.inArray(CFS_DATA.animationSpeed,["fast","slow"])==-1){CFS_DATA.animationSpeed="fast"}}CFS_DATA.showSubscreenOnCenter=parseInt(CFS_DATA.showSubscreenOnCenter);var sdLoaderImgCfs='<img src="'+CFS_DATA.loader+'" />';var g_cfsAnimationSpeed=300;jQuery.fn.showLoaderCfs=function(){return jQuery(this).html(sdLoaderImgCfs)};jQuery.fn.appendLoaderCfs=function(){jQuery(this).append(sdLoaderImgCfs)};jQuery.sendFormCfs=function(a){return jQuery("<br />").sendFormCfs(a)};jQuery.fn.sendFormCfs=function(e){var b=null;if(!e){e={fid:false,msgElID:false,onSuccess:false}}if(e.fid){b=jQuery("#"+fid)}else{b=jQuery(this)}var c=(jQuery(b).tagName()=="FORM");var f=new Array();if(e.data){f=e.data}else{if(c){f=jQuery(b).serialize()}}if(e.appendData){var h=typeof(f)=="string";var k=[];for(var g in e.appendData){if(h){k.push(g+"="+e.appendData[g])}else{f[g]=e.appendData[g]}}if(h){f+="&"+k.join("&")}}var d=null;if(e.msgElID){if(e.msgElID=="noMessages"){d=false}else{if(typeof(e.msgElID)=="object"){d=e.msgElID}else{d=jQuery("#"+e.msgElID)}}}if(typeof(e.inputsWraper)=="string"){b=jQuery("#"+e.inputsWraper);c=true}if(c&&b){jQuery(b).find("*").removeClass("cfsInputError")}if(d&&!e.btn){jQuery(d).removeClass("cfsSuccessMsg").removeClass("cfsErrorMsg");if(!e.btn){jQuery(d).showLoaderCfs()}}if(e.btn){jQuery(e.btn).attr("disabled","disabled");e.btnIconElement=jQuery(e.btn).find(".fa").length?jQuery(e.btn).find(".fa"):jQuery(e.btn);if(jQuery(e.btn).find(".fa").length){e.btnIconElement.data("prev-class",e.btnIconElement.attr("class")).attr("class","fa fa-spinner fa-spin")}}var a="";if(typeof(e.url)!="undefined"){a=e.url}else{if(typeof(ajaxurl)=="undefined"){a=CFS_DATA.ajaxurl}else{a=ajaxurl}}jQuery(".cfsErrorForField").hide(CFS_DATA.animationSpeed);var j=e.dataType?e.dataType:"json";if(typeof(f)=="string"){f+="&pl="+CFS_DATA.CFS_CODE;f+="&reqType=ajax"}else{f.pl=CFS_DATA.CFS_CODE;f.reqType="ajax"}jQuery.ajax({url:a,data:f,type:"POST",dataType:j,success:function(i){toeProcessAjaxResponseCfs(i,d,b,c,e);if(e.clearMsg){setTimeout(function(){if(d){jQuery(d).animateClear()}},typeof(e.clearMsg)=="boolean"?5000:e.clearMsg)}}})};jQuery.fn.animateClear=function(){var a=jQuery("<span>"+jQuery(this).html()+"</span>");jQuery(this).html(a);jQuery(a).hide(CFS_DATA.animationSpeed,function(){jQuery(a).remove()})};jQuery.fn.animateRemoveCfs=function(a,b){a=a==undefined?CFS_DATA.animationSpeed:a;jQuery(this).hide(a,function(){jQuery(this).remove();if(typeof(b)==="function"){b()}})};function toeProcessAjaxResponseCfs(h,e,c,d,f){if(typeof(f)=="undefined"){f={}}if(typeof(e)=="string"){e=jQuery("#"+e)}if(e){jQuery(e).html("")}if(f.btn){jQuery(f.btn).removeAttr("disabled");if(f.btnIconElement){f.btnIconElement.attr("class",f.btnIconElement.data("prev-class"))}}if(typeof(h)=="object"){if(h.error){if(e){jQuery(e).removeClass("cfsSuccessMsg").addClass("cfsErrorMsg")}var j=[];for(var a in h.errors){if(d){var b=jQuery(c).find('[name*="'+a+'"]');b.addClass("cfsInputError");if(b.attr("placeholder")){}if(!b.data("keyup-error-remove-binded")){b.keydown(function(){jQuery(this).removeClass("cfsInputError")}).data("keyup-error-remove-binded",1)}}if(jQuery(".cfsErrorForField.toe_"+nameToClassId(a)+"").exists()){jQuery(".cfsErrorForField.toe_"+nameToClassId(a)+"").show().html(h.errors[a])}else{if(e){jQuery(e).append(h.errors[a]).append("<br />")}else{j.push(h.errors[a])}}}if(j.length&&f.btn&&jQuery.fn.dialog&&!e){jQuery('<div title="'+toeLangCfs("Really small warning :)")+'" />').html(j.join("<br />")).appendTo("body").dialog({modal:true,width:"500px"})}}else{if(h.messages.length){if(e){jQuery(e).removeClass("cfsErrorMsg").addClass("cfsSuccessMsg");for(var g=0;g<h.messages.length;g++){jQuery(e).append(h.messages[g]).append("<br />")}}}}}if(f.onSuccess&&typeof(f.onSuccess)=="function"){f.onSuccess(h)}}function getDialogElementCfs(){return jQuery("<div/>").appendTo(jQuery("body"))}function toeOptionCfs(a){if(CFS_DATA.options&&CFS_DATA.options[a]){return CFS_DATA.options[a]}return false}function toeLangCfs(a){if(CFS_DATA.siteLang&&CFS_DATA.siteLang[a]){return CFS_DATA.siteLang[a]}return a}function toePagesCfs(a){if(typeof(CFS_DATA)!="undefined"&&CFS_DATA[a]){return CFS_DATA[a]}return false}function toeOptTimeoutHideDescriptionCfs(){jQuery("#cfsOptDescription").removeAttr("toeFixTip");setTimeout(function(){if(!jQuery("#cfsOptDescription").attr("toeFixTip")){toeOptHideDescriptionCfs()}},500)}function toeOptShowDescriptionCfs(b,a,d,c){if(typeof(b)!="undefined"&&b!=""){if(!jQuery("#cfsOptDescription").length){jQuery("body").append('<div id="cfsOptDescription"></div>')}if(c){jQuery("#cfsOptDescription").css("right",jQuery(window).width()-(a-10))}else{jQuery("#cfsOptDescription").css("left",a+10)}jQuery("#cfsOptDescription").css("top",d);jQuery("#cfsOptDescription").show(200);jQuery("#cfsOptDescription").html(b)}}function toeOptHideDescriptionCfs(){jQuery("#cfsOptDescription").removeAttr("toeFixTip");jQuery("#cfsOptDescription").hide(200)}function toeInArrayCfs(c,b){if(b){for(var a in b){if(b[a]==c){return true}}}return false}function toeShowDialogCustomized(b,a){a=jQuery.extend({resizable:false,width:500,height:300,closeOnEscape:true,open:function(c,d){jQuery(".ui-dialog-titlebar").css({"background-color":"#222222","background-image":"none",border:"none",margin:"0",padding:"0","border-radius":"0",color:"#CFCFCF",height:"27px"});jQuery(".ui-dialog-titlebar-close").css({background:'url("'+CFS_DATA.cssPath+'img/tb-close.png") no-repeat scroll 0 0 transparent',border:"0",width:"15px",height:"15px",padding:"0","border-radius":"0",margin:"7px 7px 0"}).html("");jQuery(".ui-dialog").css({"border-radius":"3px","background-color":"#FFFFFF","background-image":"none",padding:"1px","z-index":"300000",position:"fixed",top:"60px"});jQuery(".ui-dialog-buttonpane").css({"background-color":"#FFFFFF"});jQuery(".ui-dialog-title").css({color:"#CFCFCF",font:"12px sans-serif",padding:"6px 10px 0"});if(a.openCallback&&typeof(a.openCallback)=="function"){a.openCallback(c,d)}jQuery(".ui-widget-overlay").css({"z-index":jQuery(c.target).parents(".ui-dialog:first").css("z-index")-1,"background-image":"none"});if(a.modal&&a.closeOnBg){jQuery(".ui-widget-overlay").unbind("click").bind("click",function(){jQuery(b).dialog("close")})}}},a);return jQuery(b).dialog(a)}function toeSliderMove(a,b){var c=jQuery(a.target).attr("id");jQuery("#toeSliderDisplay_"+c).html(b.value);jQuery("#toeSliderInput_"+c).val(b.value).change()}function cfsCorrectJqueryUsed(){return(typeof(jQuery.fn.sendFormCfs)==="function")}function cfsReloadCoreJs(d,e){var c="",b=["common.js","core.js"];for(var a=0;a<b.length;a++){c+='<script type="text/javascript" class="cfsReloadedScript" src="'+CFS_DATA.jsPath+b[a]+'"><\/script>'}jQuery("head").append(c);if(d){_cfsRunClbAfterCoreReload(d,e)}}function _cfsRunClbAfterCoreReload(a,b){if(cfsCorrectJqueryUsed()){callUserFuncArray(a,b);return}setTimeout(function(){cfsCorrectJqueryUsed(a,b)},500)}function base64_decode(d){var b="";var l,j,g="";var k,h,f,e="";var c=0;var a=/[^A-Za-z0-9\+\/\=]/g;if(a.exec(d)){alert("There were invalid base64 characters in the input text.\nValid base64 characters are A-Z, a-z, 0-9, '+', '/',and '='\nExpect errors in decoding.")}d=d.replace(/[^A-Za-z0-9\+\/\=]/g,"");do{k=keyStr.indexOf(d.charAt(c++));h=keyStr.indexOf(d.charAt(c++));f=keyStr.indexOf(d.charAt(c++));e=keyStr.indexOf(d.charAt(c++));l=(k<<2)|(h>>4);j=((h&15)<<4)|(f>>2);g=((f&3)<<6)|e;b=b+String.fromCharCode(l);if(f!=64){b=b+String.fromCharCode(j)}if(e!=64){b=b+String.fromCharCode(g)}l=j=g="";k=h=f=e=""}while(c<d.length);return unescape(b)};
+if(typeof(CFS_DATA)=="undefined"){var CFS_DATA={}}if(isNumber(CFS_DATA.animationSpeed)){CFS_DATA.animationSpeed=parseInt(CFS_DATA.animationSpeed)}else{if(jQuery.inArray(CFS_DATA.animationSpeed,["fast","slow"])==-1){CFS_DATA.animationSpeed="fast"}}CFS_DATA.showSubscreenOnCenter=parseInt(CFS_DATA.showSubscreenOnCenter);var sdLoaderImgCfs='<img src="'+CFS_DATA.loader+'" />';var g_cfsAnimationSpeed=300;jQuery.fn.showLoaderCfs=function(){return jQuery(this).html(sdLoaderImgCfs)};jQuery.fn.appendLoaderCfs=function(){jQuery(this).append(sdLoaderImgCfs)};jQuery.sendFormCfs=function(a){return jQuery("<br />").sendFormCfs(a)};jQuery.fn.sendFormCfs=function(e){var b=null;if(!e){e={fid:false,msgElID:false,onSuccess:false}}if(e.fid){b=jQuery("#"+fid)}else{b=jQuery(this)}var c=(jQuery(b).tagName()=="FORM");var f=new Array();if(e.data){f=e.data}else{if(c){f=jQuery(b).serialize()}}if(e.appendData){var h=typeof(f)=="string";var k=[];for(var g in e.appendData){if(h){k.push(g+"="+e.appendData[g])}else{f[g]=e.appendData[g]}}if(h){f+="&"+k.join("&")}}var d=null;if(e.msgElID){if(e.msgElID=="noMessages"){d=false}else{if(typeof(e.msgElID)=="object"){d=e.msgElID}else{d=jQuery("#"+e.msgElID)}}}if(typeof(e.inputsWraper)=="string"){b=jQuery("#"+e.inputsWraper);c=true}if(c&&b){jQuery(b).find("*").removeClass("cfsInputError")}if(d&&!e.btn){jQuery(d).removeClass("cfsSuccessMsg").removeClass("cfsErrorMsg");if(!e.btn){jQuery(d).showLoaderCfs()}}if(e.btn){jQuery(e.btn).attr("disabled","disabled");e.btnIconElement=jQuery(e.btn).find(".fa").length?jQuery(e.btn).find(".fa"):jQuery(e.btn);if(jQuery(e.btn).find(".fa").length){e.btnIconElement.data("prev-class",e.btnIconElement.attr("class")).attr("class","fa fa-spinner fa-spin")}}var a="";if(typeof(e.url)!="undefined"){a=e.url}else{if(typeof(ajaxurl)=="undefined"){a=CFS_DATA.ajaxurl}else{a=ajaxurl}}jQuery(".cfsErrorForField").hide(CFS_DATA.animationSpeed);var j=e.dataType?e.dataType:"json";var n=cfsGetAdminNonce();if(typeof(f)=="string"){f+="&pl="+CFS_DATA.CFS_CODE;f+="&reqType=ajax";if(n&&!/(^|&)_wpnonce=/.test(f)){f+="&_wpnonce="+encodeURIComponent(n)}}else{f.pl=CFS_DATA.CFS_CODE;f.reqType="ajax";if(n&&typeof(f._wpnonce)=="undefined"){f._wpnonce=n}}jQuery.ajax({url:a,data:f,type:"POST",dataType:j,success:function(i){toeProcessAjaxResponseCfs(i,d,b,c,e);if(e.clearMsg){setTimeout(function(){if(d){jQuery(d).animateClear()}},typeof(e.clearMsg)=="boolean"?5000:e.clearMsg)}}})};jQuery.fn.animateClear=function(){var a=jQuery("<span>"+jQuery(this).html()+"</span>");jQuery(this).html(a);jQuery(a).hide(CFS_DATA.animationSpeed,function(){jQuery(a).remove()})};jQuery.fn.animateRemoveCfs=function(a,b){a=a==undefined?CFS_DATA.animationSpeed:a;jQuery(this).hide(a,function(){jQuery(this).remove();if(typeof(b)==="function"){b()}})};function toeProcessAjaxResponseCfs(h,e,c,d,f){if(typeof(f)=="undefined"){f={}}if(typeof(e)=="string"){e=jQuery("#"+e)}if(e){jQuery(e).html("")}if(f.btn){jQuery(f.btn).removeAttr("disabled");if(f.btnIconElement){f.btnIconElement.attr("class",f.btnIconElement.data("prev-class"))}}if(typeof(h)=="object"){if(h.error){if(e){jQuery(e).removeClass("cfsSuccessMsg").addClass("cfsErrorMsg")}var j=[];for(var a in h.errors){if(d){var b=jQuery(c).find('[name*="'+a+'"]');b.addClass("cfsInputError");if(b.attr("placeholder")){}if(!b.data("keyup-error-remove-binded")){b.keydown(function(){jQuery(this).removeClass("cfsInputError")}).data("keyup-error-remove-binded",1)}}if(jQuery(".cfsErrorForField.toe_"+nameToClassId(a)+"").exists()){jQuery(".cfsErrorForField.toe_"+nameToClassId(a)+"").show().html(h.errors[a])}else{if(e){jQuery(e).append(h.errors[a]).append("<br />")}else{j.push(h.errors[a])}}}if(j.length&&f.btn&&jQuery.fn.dialog&&!e){jQuery('<div title="'+toeLangCfs("Really small warning :)")+'" />').html(j.join("<br />")).appendTo("body").dialog({modal:true,width:"500px"})}}else{if(h.messages.length){if(e){jQuery(e).removeClass("cfsErrorMsg").addClass("cfsSuccessMsg");for(var g=0;g<h.messages.length;g++){jQuery(e).append(h.messages[g]).append("<br />")}}}}}if(f.onSuccess&&typeof(f.onSuccess)=="function"){f.onSuccess(h)}}function cfsGetAdminNonce(){if(typeof(CFS_NONCE)!="undefined"&&CFS_NONCE&&CFS_NONCE.cfs_nonce){return CFS_NONCE.cfs_nonce}if(typeof(CFS_DATA)!="undefined"&&CFS_DATA&&CFS_DATA.cfsNonce){return CFS_DATA.cfsNonce}return false}function getDialogElementCfs(){return jQuery("<div/>").appendTo(jQuery("body"))}function toeOptionCfs(a){if(CFS_DATA.options&&CFS_DATA.options[a]){return CFS_DATA.options[a]}return false}function toeLangCfs(a){if(CFS_DATA.siteLang&&CFS_DATA.siteLang[a]){return CFS_DATA.siteLang[a]}return a}function toePagesCfs(a){if(typeof(CFS_DATA)!="undefined"&&CFS_DATA[a]){return CFS_DATA[a]}return false}function toeOptTimeoutHideDescriptionCfs(){jQuery("#cfsOptDescription").removeAttr("toeFixTip");setTimeout(function(){if(!jQuery("#cfsOptDescription").attr("toeFixTip")){toeOptHideDescriptionCfs()}},500)}function toeOptShowDescriptionCfs(b,a,d,c){if(typeof(b)!="undefined"&&b!=""){if(!jQuery("#cfsOptDescription").length){jQuery("body").append('<div id="cfsOptDescription"></div>')}if(c){jQuery("#cfsOptDescription").css("right",jQuery(window).width()-(a-10))}else{jQuery("#cfsOptDescription").css("left",a+10)}jQuery("#cfsOptDescription").css("top",d);jQuery("#cfsOptDescription").show(200);jQuery("#cfsOptDescription").html(b)}}function toeOptHideDescriptionCfs(){jQuery("#cfsOptDescription").removeAttr("toeFixTip");jQuery("#cfsOptDescription").hide(200)}function toeInArrayCfs(c,b){if(b){for(var a in b){if(b[a]==c){return true}}}return false}function toeShowDialogCustomized(b,a){a=jQuery.extend({resizable:false,width:500,height:300,closeOnEscape:true,open:function(c,d){jQuery(".ui-dialog-titlebar").css({"background-color":"#222222","background-image":"none",border:"none",margin:"0",padding:"0","border-radius":"0",color:"#CFCFCF",height:"27px"});jQuery(".ui-dialog-titlebar-close").css({background:'url("'+CFS_DATA.cssPath+'img/tb-close.png") no-repeat scroll 0 0 transparent',border:"0",width:"15px",height:"15px",padding:"0","border-radius":"0",margin:"7px 7px 0"}).html("");jQuery(".ui-dialog").css({"border-radius":"3px","background-color":"#FFFFFF","background-image":"none",padding:"1px","z-index":"300000",position:"fixed",top:"60px"});jQuery(".ui-dialog-buttonpane").css({"background-color":"#FFFFFF"});jQuery(".ui-dialog-title").css({color:"#CFCFCF",font:"12px sans-serif",padding:"6px 10px 0"});if(a.openCallback&&typeof(a.openCallback)=="function"){a.openCallback(c,d)}jQuery(".ui-widget-overlay").css({"z-index":jQuery(c.target).parents(".ui-dialog:first").css("z-index")-1,"background-image":"none"});if(a.modal&&a.closeOnBg){jQuery(".ui-widget-overlay").unbind("click").bind("click",function(){jQuery(b).dialog("close")})}}},a);return jQuery(b).dialog(a)}function toeSliderMove(a,b){var c=jQuery(a.target).attr("id");jQuery("#toeSliderDisplay_"+c).html(b.value);jQuery("#toeSliderInput_"+c).val(b.value).change()}function cfsCorrectJqueryUsed(){return(typeof(jQuery.fn.sendFormCfs)==="function")}function cfsReloadCoreJs(d,e){var c="",b=["common.js","core.js"];for(var a=0;a<b.length;a++){c+='<script type="text/javascript" class="cfsReloadedScript" src="'+CFS_DATA.jsPath+b[a]+'"><\/script>'}jQuery("head").append(c);if(d){_cfsRunClbAfterCoreReload(d,e)}}function _cfsRunClbAfterCoreReload(a,b){if(cfsCorrectJqueryUsed()){callUserFuncArray(a,b);return}setTimeout(function(){cfsCorrectJqueryUsed(a,b)},500)}function base64_decode(d){var b="";var l,j,g="";var k,h,f,e="";var c=0;var a=/[^A-Za-z0-9\+\/\=]/g;if(a.exec(d)){alert("There were invalid base64 characters in the input text.\nValid base64 characters are A-Z, a-z, 0-9, '+', '/',and '='\nExpect errors in decoding.")}d=d.replace(/[^A-Za-z0-9\+\/\=]/g,"");do{k=keyStr.indexOf(d.charAt(c++));h=keyStr.indexOf(d.charAt(c++));f=keyStr.indexOf(d.charAt(c++));e=keyStr.indexOf(d.charAt(c++));l=(k<<2)|(h>>4);j=((h&15)<<4)|(f>>2);g=((f&3)<<6)|e;b=b+String.fromCharCode(l);if(f!=64){b=b+String.fromCharCode(j)}if(e!=64){b=b+String.fromCharCode(g)}l=j=g="";k=h=f=e=""}while(c<d.length);return unescape(b)};

contact-form-by-supsystic/trunk/modules/forms/controller.php

@@ -622 +622 @@
     return ['save', 'removeGroup', 'getListForTbl', 'saveAsCopy', 'remove', 'createFromTpl', 'changeTpl'];
   }
+  /**
+   * contact() checks it's own per-form nonce, updateNonce() just gives fresh nonce for cached pages
+   */
+  public function getPublicMethods()
+  {
+    return ['contact', 'updateNonce'];
+  }
   public function getPermissions()
   {

contact-form-by-supsystic/trunk/modules/forms/models/forms.php

@@ -204 +204 @@
         }
         if (empty($errorMsg)) {
+          // Not mandatory email can be empty, but if it is entered - it must be valid
+          if ($htmlType == 'email' && $value && (!is_string($value) || !is_email($value))) {
+            $errorMsg = empty($formInvalidError) ? __('Invalid value for %s', CFS_LANG_CODE) : $formInvalidError;
+          }
+        }
+        if (empty($errorMsg)) {
           // Start other validation process
           if (!$isDate && isset($f['min_size']) && !empty($f['min_size']) && ($minSize = (int) $f['min_size'])) {
@@ -315 +321 @@
               // This is requiredfor case when you hav select box with vals = mail1@mail.com, ... and names User Name 1, ...
               // To send to it's values, not to it's names
-              $variablesWithSelectVals['user_' . $sendName] = $fieldsData[$sendName];
+              $variablesWithSelectVals['user_' . $sendName] = $this->_getSelectedOptionValue($f, isset($fieldsData[$sendName]) ? $fieldsData[$sendName] : '');
               break;
             default:
@@ -324 +330 @@
         }
       }
+      // Submitted values can be mapped to mail headers - line breaks there would start new headers
+      $headerVariables = utilsCfs::cleanMailHeader($variables);
+      $headerVariablesWithSelectVals = utilsCfs::cleanMailHeader($variablesWithSelectVals);
       $sendForceTo = dispatcherCfs::applyFilters('sendContactTo', '', $fieldsData, $form);
       foreach ($form['params']['submit'] as $s) {
@@ -334 +343 @@
         $additionalHeaders = [];
         if (isset($s['enb_cc']) && (int) $s['enb_cc'] && isset($s['cc']) && !empty($s['cc'])) {
-          $additionalHeaders[] = 'Cc: ' . utilsCfs::replaceVariables($s['cc'], $variables);
+          $additionalHeaders[] = 'Cc: ' . utilsCfs::cleanMailHeader(utilsCfs::replaceVariables($s['cc'], $headerVariables));
         }
         if (isset($s['from']) && !empty($s['from'])) {
-          $additionalHeaders[] = 'From: ' . utilsCfs::replaceVariables($s['from'], $variables);
+          $additionalHeaders[] = 'From: ' . utilsCfs::cleanMailHeader(utilsCfs::replaceVariables($s['from'], $headerVariables));
         }
         if (isset($s['reply']) && !empty($s['reply'])) {
-          $additionalHeaders[] = 'Reply-To: ' . utilsCfs::replaceVariables($s['reply'], $variables);
-        }
-        $to = utilsCfs::replaceVariables($to, $variablesWithSelectVals);
-        $subject = utilsCfs::replaceVariables($s['subject'], $variables);
+          $additionalHeaders[] = 'Reply-To: ' . utilsCfs::cleanMailHeader(utilsCfs::replaceVariables($s['reply'], $headerVariables));
+        }
+        $to = utilsCfs::cleanMailHeader(utilsCfs::replaceVariables($to, $headerVariablesWithSelectVals));
+        if (empty($to)) {
+          continue; // Recipient was taken from submitted data, and it was not valid
+        }
+        $subject = utilsCfs::cleanMailHeader(utilsCfs::replaceVariables($s['subject'], $headerVariables));
         // Let it be only for Message field
         //$msg = nl2br(utilsCfs::replaceVariables($msg, array_merge($variables, array('form_data' => $sendFormDataStr))));
@@ -363 +375 @@
     }
     return true;
+  }
+  /**
+   * Submitted select box value can be used as recipient email, @see sendContact(),
+   * so it is accepted only if it is one of field options
+   * @param array $field Select box field
+   * @param mixed $value Submitted value
+   * @return string Value, or empty string if there is no such option
+   */
+  private function _getSelectedOptionValue($field, $value)
+  {
+    if (!is_string($value) || $value === '' || empty($field['options']) || !is_array($field['options'])) {
+      return '';
+    }
+    // Options are prepared in same way as submitted data, @see contact()
+    foreach (dbCfs::prepareHtmlIn($field['options']) as $opt) {
+      if (isset($opt['name']) && (string) $opt['name'] === $value) {
+        return $value;
+      }
+    }
+    return '';
   }
   private function _generateSendFormData($fieldsData, $form)
@@ -782 +814 @@
       for ($i = 0; $i < (int) $d['params']['opts_attrs']['txt_block_number']; $i++) {
         $sendValKey = 'params_tpl_txt_val_' . $i;
-        if (isset($d[$sendValKey])) {
-          $d['params']['tpl']['txt_' . $i] = urldecode($d[$sendValKey]);
+        if (isset($d[$sendValKey]) && is_string($d[$sendValKey])) {
+          // Text is sent url-encoded, so request filter did not see real value - filter it after decode
+          $d['params']['tpl']['txt_' . $i] = reqCfs::sanitizeString(urldecode($d[$sendValKey]));
         }
       }

contact-form-by-supsystic/trunk/modules/forms/views/forms.php

@@ -5 +5 @@
 {
   protected $_twig;
+  /**
+   * Tags values for current render: placeholder => value, @see _addTwigValue()
+   */
+  private $_twigValues = [];
+  private $_twigValuesKey = '';
   private $_renderFormIter = 0;
   private $_lastForm = null;
@@ -14 +19 @@
     frameCfs::_()->addScript('admin.forms', $this->getModule()->getModPath() . 'js/admin.forms.js');
     frameCfs::_()->addScript('admin.forms.list', $this->getModule()->getModPath() . 'js/admin.forms.list.js');
-    frameCfs::_()->addJSVar('admin.forms.list', 'cfsTblDataUrl', uriCfs::mod('forms', 'getListForTbl', ['reqType' => 'ajax']));
+    frameCfs::_()->addJSVar('admin.forms.list', 'cfsTblDataUrl', uriCfs::mod('forms', 'getListForTbl', ['reqType' => 'ajax', '_wpnonce' => wp_create_nonce('cfs_nonce')]));
 
     $this->assign('addNewLink', frameCfs::_()->getModule('options')->getTabUrl('forms_add_new'));
@@ -114 +119 @@
     ];
 
-    $this->assign('csvExportUrl', uriCfs::mod('forms', 'exportCsv', ['id' => $id]));
+    $this->assign('csvExportUrl', uriCfs::mod('forms', 'exportCsv', ['id' => $id, '_wpnonce' => wp_create_nonce('cfs_nonce')]));
 
     $this->assign('adminEmail', get_bloginfo('admin_email'));
@@ -123 +128 @@
     $this->assign('cfsAddNewUrl', $cfsAddNewUrl);
     $this->assign('bgTypes', $bgType);
-    $this->assign('previewUrl', uriCfs::mod('forms', 'getPreviewHtml', ['id' => $id]));
+    $this->assign('previewUrl', uriCfs::mod('forms', 'getPreviewHtml', ['id' => $id, '_wpnonce' => wp_create_nonce('cfs_nonce')]));
     $this->assign('form', $form);
     $this->assign('fieldTypes', $fieldTypes);
@@ -473 +478 @@
   public function adjustOpacity($color, $alpha)
   {
+    $color = $this->_resolveTwigValues($color);
+    $alpha = $this->_resolveTwigValues($alpha);
     $alpha = max(0, min(1, $alpha));
     $rgbColor = utilsCfs::hexToRgb($color);
@@ -478 +485 @@
     return 'rgba(' . implode(',', $rgbColor) . ')';
   }
+  public function hexToRgbaStr($hex, $alpha = 1)
+  {
+    return utilsCfs::hexToRgbaStr($this->_resolveTwigValues($hex), $this->_resolveTwigValues($alpha));
+  }
   public function adjustBrightness($hex, $steps)
   {
+    $hex = $this->_resolveTwigValues($hex);
+    $steps = $this->_resolveTwigValues($steps);
     // Steps should be between -255 and 255. Negative = darker, positive = lighter
     $steps = max(-255, min(255, $steps));
@@ -525 +538 @@
 
     $form['css'] = $this->_replaceTagsWithTwig($form['css'], $form);
+    $htmlValuesFrom = count($this->_twigValues);
     $form['html'] = $this->_replaceTagsWithTwig($form['html'], $form);
 
-    $form['html'] = str_replace('col-md-', 'supMd', $form['html']);
-    $form['html'] = str_replace('col-xs-', 'supXs', $form['html']);
-    $form['html'] = str_replace('col-sm-', 'supSm', $form['html']);
-    $form['html'] = str_replace('col-lg-', 'supLg', $form['html']);
-    $form['html'] = str_replace('row', 'supRow', $form['html']);
+    $colReplaceFrom = ['col-md-', 'col-xs-', 'col-sm-', 'col-lg-', 'row'];
+    $colReplaceTo = ['supMd', 'supXs', 'supSm', 'supLg', 'supRow'];
+    $form['html'] = str_replace($colReplaceFrom, $colReplaceTo, $form['html']);
+    // Values of tags in html were always processed by this replacement too
+    foreach (array_slice(array_keys($this->_twigValues), $htmlValuesFrom) as $valueKey) {
+      $this->_twigValues[$valueKey] = str_replace($colReplaceFrom, $colReplaceTo, $this->_twigValues[$valueKey]);
+    }
 
     $form['html'] .= $this->_generateImgsPreload($form);
@@ -540 +556 @@
     // it will not recognize css in js data as style whye rendering on server side,
     // but will be replaced back to normal <style> tag in JS, @see js/frontend.forms.js
-    return $this->_twig->render(
+    $tpl =
       ($replaceStyleTag ? '<span style="display: none;" id="cfsFormStylesHidden_' . $form['view_id'] . '">' : '<style type="text/css" id="' . $form['view_html_id'] . '_style">') .
-        $form['css'] .
-        ($replaceStyleTag ? '</span>' : '</style>') .
-        '<div id="' .
-        $form['view_html_id'] .
-        '" class="cfsFormShell">' .
-        $form['html'] .
-        '</div>',
-      ['forms' => $form],
-    );
+      $form['css'] .
+      ($replaceStyleTag ? '</span>' : '</style>') .
+      '<div id="' .
+      $form['view_html_id'] .
+      '" class="cfsFormShell">' .
+      $form['html'] .
+      '</div>';
+    $obLevel = ob_get_level();
+    try {
+      $res = $this->_twig->render($tpl, ['forms' => $form]);
+    } catch (Throwable $e) {
+      // Twig cleans own output buffer only for exceptions, not for PHP errors
+      while (ob_get_level() > $obLevel) {
+        ob_end_clean();
+      }
+      // String loader uses whole template as it's name - so full Twig message would contain all template
+      $errorMsg = $e instanceof Twig_Error ? $e->getRawMessage() : $e->getMessage();
+      error_log('Contact Form by Supsystic: can not render form #' . $form['id'] . ': ' . $errorMsg);
+      return frameCfs::_()->getModule('user')->isAdmin() ? esc_html(sprintf(__('Can not render form template: %s', CFS_LANG_CODE), $errorMsg)) : '';
+    }
+    // Put tags values only now - so they are never parsed by template engine
+    return $this->_insertTwigValues($res);
   }
   private function _generateCommonFormCss($form)
   {
     $res = '';
-    $res .= '#[SHELL_ID] { width: ' . $form['params']['tpl']['width'] . $form['params']['tpl']['width_measure'] . '}';
+    // Values go through tags too, @see _replaceTagsWithTwig()
+    $res .= '#[SHELL_ID] { width: ' . (isset($form['params']['tpl']['width']) ? '[width]' : '') . (isset($form['params']['tpl']['width_measure']) ? '[width_measure]' : '') . '}';
     if (isset($form['params'], $form['params']['tpl'], $form['params']['tpl']['form_sent_msg_color']) && !empty($form['params']['tpl']['form_sent_msg_color'])) {
-      $res .= '#[SHELL_ID] .cfsSuccessMsg { color: ' . $form['params']['tpl']['form_sent_msg_color'] . ' !important}';
+      $res .= '#[SHELL_ID] .cfsSuccessMsg { color: [form_sent_msg_color] !important}';
     }
     return $res;
@@ -863 +893 @@
     foreach ($replaceFrom as $i => $v) {
       $replaceFrom[$i] = '[' . $v . ']';
+      // Tags values are users data: put them in template only as placeholders, real values are inserted
+      // after template render, so they are never evaluated by template engine. First 4 tags - are template syntax.
+      if ($i > 3) {
+        $replaceTo[$i] = $this->_addTwigValue($replaceTo[$i]);
+      }
     }
     return str_replace($replaceFrom, $replaceTo, $string);
+  }
+  /**
+   * Register value for template and get it's placeholder
+   * @param mixed $value
+   * @return string Placeholder: it is safe for any template place - text, or string in Twig expression
+   */
+  private function _addTwigValue($value)
+  {
+    if (empty($this->_twigValuesKey)) {
+      // Unpredictable, and contains only chars that will not be changed by any template replacements
+      $this->_twigValuesKey = strtoupper(substr(md5(uniqid('', true) . wp_rand()), 0, 12));
+    }
+    $placeholder = '__CFSV' . $this->_twigValuesKey . '_' . count($this->_twigValues) . '__';
+    // Same line breaks normalization as Twig lexer did, when values were part of template
+    $this->_twigValues[$placeholder] = is_scalar($value) ? str_replace(["\r\n", "\r"], "\n", (string) $value) : '';
+    return $placeholder;
+  }
+  private function _insertTwigValues($str)
+  {
+    // strtr() makes all replacements in one pass, so inserted values are not processed again
+    return empty($this->_twigValues) ? $str : strtr($str, $this->_twigValues);
+  }
+  /**
+   * Template functions get placeholders as arguments, @see adjustBrightness()
+   */
+  private function _resolveTwigValues($value)
+  {
+    return is_string($value) && strpos($value, '__CFSV') !== false ? $this->_insertTwigValues($value) : $value;
   }
   protected function _initTwig()
@@ -873 +936 @@
       }
       Twig_Autoloader::register();
+      importClassCfs('twigSecurityPolicyCfs', CFS_CLASSES_DIR . 'twigSecurityPolicy.php');
       $this->_twig = new Twig_Environment(new Twig_Loader_String(), ['debug' => 0]);
+      // Templates can be edited in admin area - so they are always rendered in sandbox
+      $this->_twig->addExtension(new Twig_Extension_Sandbox(new twigSecurityPolicyCfs(), true));
       $this->_twig->addFunction(new Twig_SimpleFunction('adjust_brightness', [$this, 'adjustBrightness']));
       $this->_twig->addFunction(new Twig_SimpleFunction('adjust_opacity', [$this, 'adjustOpacity']));
-      $this->_twig->addFunction(new Twig_SimpleFunction('hex_to_rgba_str', 'utilsCfs::hexToRgbaStr'));
+      $this->_twig->addFunction(new Twig_SimpleFunction('hex_to_rgba_str', [$this, 'hexToRgbaStr']));
     }
   }
@@ -885 +951 @@
     frameCfs::_()->addScript('admin.forms', $this->getModule()->getModPath() . 'js/admin.forms.js');
     frameCfs::_()->addScript('admin.forms.contacts.list', $this->getModule()->getModPath() . 'js/admin.forms.contacts.list.js');
-    frameCfs::_()->addJSVar('admin.forms.contacts.list', 'cfsTblDataUrl', uriCfs::mod('forms', 'getContactsListForTbl', ['reqType' => 'ajax', 'fid' => $fid]));
+    frameCfs::_()->addJSVar('admin.forms.contacts.list', 'cfsTblDataUrl', uriCfs::mod('forms', 'getContactsListForTbl', ['reqType' => 'ajax', 'fid' => $fid, '_wpnonce' => wp_create_nonce('cfs_nonce')]));
     $allForms = $this->getModel('forms')->getAllFromTbl();
     $allFormsForSelect = [];

contact-form-by-supsystic/trunk/modules/forms/views/tpl/formsEditFormStatistics.php

@@ -39 +39 @@
                         <a href="#" class="button cfsStatChartGroupBtn" data-stat-group="month" data-chart="cfsMainStats"><?php _e('Month', CFS_LANG_CODE); ?></a>
                         |
-                        <a href="<?php echo uriCfs::mod('statistics', 'getCsv'); ?>" target="_blank" class="button cfsStatExportCsv" data-chart="cfsMainStats"><?php _e('Export to CSV', CFS_LANG_CODE); ?></a>
+                        <a href="<?php echo uriCfs::mod('statistics', 'getCsv', ['_wpnonce' => wp_create_nonce('cfs_nonce')]); ?>" target="_blank" class="button cfsStatExportCsv" data-chart="cfsMainStats"><?php _e('Export to CSV', CFS_LANG_CODE); ?></a>
                         |
                 </span>

contact-form-by-supsystic/trunk/modules/mail/mod.php

@@ -7 +7 @@
   public function send($to, $subject, $message, $fromName = '', $fromEmail = '', $replyToName = '', $replyToEmail = '', $additionalHeaders = [], $additionalParameters = [])
   {
+    // Line breaks in any of header values would inject new mail headers
+    list($to, $subject, $fromName, $fromEmail, $replyToName, $replyToEmail) = utilsCfs::cleanMailHeader([$to, $subject, $fromName, $fromEmail, $replyToName, $replyToEmail]);
+    $additionalHeaders = empty($additionalHeaders) ? [] : array_filter(utilsCfs::cleanMailHeader((array) $additionalHeaders));
     $type = frameCfs::_()->getModule('options')->get('mail_send_engine');
     $res = false;
@@ -69 +72 @@
       $this->_sendMailMailer = new PHPMailer\PHPMailer\PHPMailer(true); // create a new object
       $this->_sendMailMailer->isSendmail(); // enable SendMail
-      $sendMailPath = trim(frameCfs::_()->getModule('options')->get('sendmail_path'));
-      if (!empty($sendMailPath)) {
+      $sendMailPath = trim((string) frameCfs::_()->getModule('options')->get('sendmail_path'));
+      // Value could be saved before validation was added - never pass invalid one to shell
+      if (!empty($sendMailPath) && utilsCfs::isValidSendmailPath($sendMailPath)) {
         $this->_sendMailMailer->Sendmail = $sendMailPath;
       }

contact-form-by-supsystic/trunk/modules/mail/views/tpl/mailAdmin.php

@@ -6 +6 @@
         <?php echo htmlCfs::hidden('mod', ['value' => 'mail']); ?>
         <?php echo htmlCfs::hidden('action', ['value' => 'testEmail']); ?>
+        <?php echo htmlCfs::defaultNonceForAdminPanel(); ?>
         <button class="button button-primary">
                 <i class="fa fa-paper-plane"></i>
@@ -63 +64 @@
         <?php echo htmlCfs::hidden('mod', ['value' => 'mail']); ?>
         <?php echo htmlCfs::hidden('action', ['value' => 'saveOptions']); ?>
+        <?php echo htmlCfs::defaultNonceForAdminPanel(); ?>
         <button class="button button-primary">
                 <i class="fa fa-fw fa-save"></i>

contact-form-by-supsystic/trunk/modules/options/models/options.php

@@ -22 +22 @@
   {
     if (isset(self::$_restrictedOptionValues[$optKey]) && !in_array($val, self::$_restrictedOptionValues[$optKey], true)) {
+      return;
+    }
+    if (!$this->_isValidOptValue($optKey, $val)) {
       return;
     }
@@ -70 +73 @@
   {
     if (isset($d['opt_values']) && is_array($d['opt_values']) && !empty($d['opt_values'])) {
+      if (isset($d['opt_values']['sendmail_path']) && !$this->_isValidOptValue('sendmail_path', $d['opt_values']['sendmail_path'])) {
+        // Field is always submitted with mail options, but matters only for Sendmail engine
+        if (isset($d['opt_values']['mail_send_engine']) && $d['opt_values']['mail_send_engine'] === 'sendmail') {
+          $this->pushError(__('Invalid Sendmail Path: it should be absolute path to sendmail binary, for example /usr/sbin/sendmail', CFS_LANG_CODE), 'opt_values[sendmail_path]');
+          return false;
+        }
+        unset($d['opt_values']['sendmail_path']);
+      }
       dispatcherCfs::doAction('beforeSaveOpts', $d);
       foreach ($d['opt_values'] as $code => $val) {
@@ -80 +91 @@
     }
     return false;
+  }
+  private function _isValidOptValue($optKey, $val)
+  {
+    switch ($optKey) {
+      case 'sendmail_path':
+        return utilsCfs::isValidSendmailPath($val);
+    }
+    return true;
   }
   private function _updateOptsInDb()

contact-form-by-supsystic/trunk/modules/statistics/controller.php

@@ -80 +80 @@
     $res->ajaxExec();
   }
+  /**
+   * add() is called from frontend and checks connect_hash on it's own.
+   * Inherited removeGroup() and clear() are not listed anywhere - so they can not be called by request.
+   */
+  public function getPublicMethods()
+  {
+    return ['add'];
+  }
   public function getPermissions()
   {

contact-form-by-supsystic/trunk/modules/templates/mod.php

@@ -96 +96 @@
         }
         $jsData['cfsAcShow'] = $show;
+        // All admin requests require plugin nonce, @see frameCfs::havePermissions()
+        if (frameCfs::_()->getModule('user')->isAdmin()) {
+          $jsData['cfsNonce'] = wp_create_nonce('cfs_nonce');
+        }
       }
       $jsData = dispatcherCfs::applyFilters('jsInitVariables', $jsData);

contact-form-by-supsystic/trunk/readme.txt

@@ -4 +4 @@
 Tested up to: 7.1
 Requires PHP: 7.3
-Stable tag: 1.10.7
+Stable tag: 1.11.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -169 +169 @@
 = 2026 =
 
+= 1.11.1 — October 22, 2026 =
+
+* Maintenance release with the latest Contact Form updates.
+
+= 1.11.0 — October 22, 2026 =
+
+* General security hardening and code improvements.
+
 = 1.10.7 — October 16, 2026 =