tonyair/silverstripe-userforms
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-userforms.git synced 2024-10-22 17:05:42 +02:00
Code Issues Projects Releases Wiki Activity

FIX Escape dollar signs in UserForm contents before inserting them with regex (#723)

Browse Source
This commit is contained in:
Scott Hutchinson 2018-02-21 13:52:51 +13:00 committed by Robbie Averill
parent eed799dbd9
commit 0ce8b95546
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
code/model/UserDefinedForm.php
View File

@ -5,7 +5,7 @@
*/ */
class UserDefinedForm extends Page { class UserDefinedForm extends Page {
/** /**
* @var string * @var string
*/ */
@ -370,7 +370,9 @@ class UserDefinedForm_Controller extends Page_Controller {
if($this->Content && $form = $this->Form()) { if($this->Content && $form = $this->Form()) {
$hasLocation = stristr($this->Content, '$UserDefinedForm'); $hasLocation = stristr($this->Content, '$UserDefinedForm');
if($hasLocation) { if($hasLocation) {
$content = preg_replace('/(<p[^>]*>)?\\$UserDefinedForm(<\\/p>)?/i', $form->forTemplate(), $this->Content); /** @see Requirements_Backend::escapeReplacement */
$formEscapedForRegex = addcslashes($form->forTemplate(), '\\$');
$content = preg_replace('/(<p[^>]*>)?\\$UserDefinedForm(<\\/p>)?/i', $formEscapedForRegex, $this->Content);
return array( return array(
'Content' => DBField::create_field('HTMLText', $content), 'Content' => DBField::create_field('HTMLText', $content),
'Form' => "" 'Form' => ""
@ -688,7 +690,7 @@ JS
foreach($recipients as $recipient) { foreach($recipients as $recipient) {
$email = new UserFormRecipientEmail($submittedFields); $email = new UserFormRecipientEmail($submittedFields);
$mergeFields = $this->getMergeFieldsMap($emailData['Fields']); $mergeFields = $this->getMergeFieldsMap($emailData['Fields']);
if($attachments) { if($attachments) {
foreach($attachments as $file) { foreach($attachments as $file) {
if($file->ID != 0) { if($file->ID != 0) {
@ -700,7 +702,7 @@ JS
} }
} }
} }
$parsedBody = SSViewer::execute_string($recipient->getEmailBodyContent(), $mergeFields); $parsedBody = SSViewer::execute_string($recipient->getEmailBodyContent(), $mergeFields);
if (!$recipient->SendPlain && $recipient->emailTemplateExists()) { if (!$recipient->SendPlain && $recipient->emailTemplateExists()) {