From 6f1300719618edde22e8ff5dba70b271dc226f23 Mon Sep 17 00:00:00 2001 From: Jon Waldstein Date: Tue, 7 Jan 2025 12:54:23 -0500 Subject: [PATCH] chore: prepare for release 3.19.4 --- readme.txt | 5 +++-- .../Actions/ConvertDonationFormBlocksToFieldsApi.php | 2 +- src/Helpers/Utils.php | 4 ++-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/readme.txt b/readme.txt index 2f7d43a311..d58bf1943c 100644 --- a/readme.txt +++ b/readme.txt @@ -266,8 +266,9 @@ You can report security bugs through the Patchstack Vulnerability Disclosure Pro 10. Use almost any payment gateway integration with GiveWP through our add-ons or by creating your own add-on. == Changelog == -= 3.19.4: January 7th, 2024 = -* Security: Added additional sanitization to the donation form request to prevent malicious serialized data += 3.19.4: January 7th, 2025 = +* Security: Added additional sanitization to the donation form request to prevent malicious encoded data +* Security: Added additional validation to the company field = 3.19.3: December 24th, 2024 = * Security: Added additional sanitization to the donation form request to prevent malicious serialized data (CVE-2024-12877) diff --git a/src/DonationForms/Actions/ConvertDonationFormBlocksToFieldsApi.php b/src/DonationForms/Actions/ConvertDonationFormBlocksToFieldsApi.php index e2e408ac00..7b85700e21 100644 --- a/src/DonationForms/Actions/ConvertDonationFormBlocksToFieldsApi.php +++ b/src/DonationForms/Actions/ConvertDonationFormBlocksToFieldsApi.php @@ -129,7 +129,7 @@ protected function convertInnerBlockToNode(BlockModel $block, int $blockIndex) } /** - * @unreleased add max rule to company field + * @since 3.19.4 add max rule to company field * @since 3.9.0 Add "givewp/donor-phone" block * @since 3.0.0 * diff --git a/src/Helpers/Utils.php b/src/Helpers/Utils.php index 3a1d5d7235..a068f85fd8 100644 --- a/src/Helpers/Utils.php +++ b/src/Helpers/Utils.php @@ -132,7 +132,7 @@ public static function removeBackslashes($data) /** * Decode strings recursively to prevent double (or more) encoded strings * - * @unreleased + * @since 3.19.4 */ public static function recursiveUrlDecode(string $data): string { @@ -144,7 +144,7 @@ public static function recursiveUrlDecode(string $data): string /** * The regular expression attempts to capture the basic structure of all data types that can be serialized by PHP. * - * @unreleased Decode the string and remove any character not allowed in a serialized string + * @since 3.19.4 Decode the string and remove any character not allowed in a serialized string * @since 3.19.3 Support all types of serialized data instead of only objects and arrays * @since 3.17.2 */