Merge branch 'release/1.8.19'

.gitignore

@@ -0,0 +1,7 @@
+# Eclipse
+/.buildpath
+/.project
+/.settings
+
+# Node.js
+/node_modules/

Gruntfile.js

@@ -0,0 +1,24 @@
+module.exports = function( grunt ) {
+	// Project configuration.
+	grunt.initConfig( {
+		// Package
+		pkg: grunt.file.readJSON( 'package.json' ),
+
+		// Make POT
+		makepot: {
+			target: {
+				options: {
+					cwd: '',
+					domainPath: 'languages',
+					type: 'wp-plugin',
+					exclude: [],
+				}
+			}
+		},
+	} );
+
+	grunt.loadNpmTasks( 'grunt-wp-i18n' );
+
+	// Default task(s).
+	grunt.registerTask( 'pot', [ 'makepot' ] );
+};

change_log.txt

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------------------------------------------------------
+Version 1.8.19
+	- Fixed Notices
+	- Fixed issue where entry exports were saved with a .txt extension in Safari
+	- Fixed issue when exporting custom post fields of type "checkbox".
+	- AF: Fixed issue where feed saved successfully message still displayed when fields failed validation.
+
 -------------------------------------------------------------------------------------------------------------------
 Version 1.8.18
 

export.php

@@ -23,7 +23,7 @@ public static function maybe_export(){
             $charset = get_option('blog_charset');
             header('Content-Description: File Transfer');
             header("Content-Disposition: attachment; filename=$filename");
-            header('Content-Type: text/plain; charset=' . $charset, true);
+            header('Content-Type: text/csv; charset=' . $charset, true);
             $buffer_length = ob_get_length(); //length or false if no buffer
             if ($buffer_length > 1){
             	ob_clean();

form_display.php

@@ -1946,13 +1946,13 @@ private static function get_conditional_logic($form, $field_values = array()){
                     $date_info = GFcommon::parse_date($field_val, $format);
                     switch($format){
                         case "mdy":
-                            $field_val = $date_info["month"] . "/" . $date_info["day"] . "/" . $date_info["year"];
+                            $field_val = rgar($date_info, "month") . "/" . rgar($date_info, "day") . "/" . rgar($date_info, "year");
                             break;
                         case "dmy":
-                            $field_val = $date_info["day"] . "/" . $date_info["month"] . "/" . $date_info["year"];
+                            $field_val = rgar($date_info, "day" ) . "/" . rgar($date_info, "month" ) . "/" . rgar($date_info, "year" );
                             break;
                         case "ymd":
-                            $field_val = $date_info["year"] . "/" . $date_info["month"] . "/" . $date_info["day"];
+                            $field_val = rgar($date_info, "year") . "/" . rgar($date_info, "month" ) . "/" . rgar($date_info, "day" );
                             break;
                     }
                 }

forms_model.php

@@ -2079,22 +2079,34 @@ public static function prepare_value($form, $field, $value, $input_name, $lead_i
                 if(rgar($field, "adminOnly") && rgar($field, "allowsPrepopulate"))
                     $value = json_decode($value);
 
-                if(GFCommon::is_empty_array($value))
+                if(GFCommon::is_empty_array($value)){
                     $value = "";
+				}
                 else{
+
+					foreach( $value as &$val ){
+						$val = self::sanitize_entry_value( $field, $val, $input_type, $form_id );
+					}
+
                     $value = self::create_list_array($field, $value);
                     $value = serialize($value);
                 }
             break;
 
             case "radio" :
-                if(rgar($field, 'enableOtherChoice') && $value == 'gf_other_choice')
+                if(rgar($field, 'enableOtherChoice') && $value == 'gf_other_choice'){
                     $value = rgpost("input_{$field['id']}_other");
+				}
+				$value = self::sanitize_entry_value( $field, $value, $input_type, $form_id);
+
                 break;
 
             case "multiselect" :
                 $value = empty($value) ? "" : is_array($value) ? implode(",", $value) : $value;
-                break;
+
+				$value = self::sanitize_entry_value( $field, $value, $input_type, $form_id );
+
+				break;
 
             case "creditcard" :
                 //saving last 4 digits of credit card
@@ -2136,15 +2148,8 @@ public static function prepare_value($form, $field, $value, $input_name, $lead_i
 
                 // only filter HTML on non-array based values
                 if( ! is_array( $value ) ) {
-
-                    //allow HTML for certain field types
-                    $allow_html = in_array($field["type"], array("post_custom_field", "post_title", "post_content", "post_excerpt", "post_tags" )) || in_array($input_type, array("checkbox", "radio")) ? true : false;
-                    $allowable_tags = apply_filters("gform_allowable_tags_{$form_id}", apply_filters("gform_allowable_tags", $allow_html, $field, $form_id), $field, $form_id);
-
-                    if($allowable_tags !== true)
-                        $value = strip_tags($value, $allowable_tags);
-
-                }
+					$value = self::sanitize_entry_value( $field, $value, $input_type, $form_id );
+				}
 
             break;
         }
@@ -2179,6 +2184,14 @@ public static function prepare_value($form, $field, $value, $input_name, $lead_i
         return $value;
     }
 
+	public static function strip_script_tag( $string ){
+		$allowable_tags = '<a><abbr><acronym><address><area><area /><b><base><base /><bdo><big><blockquote><body><br><br /><button><caption><cite><code><col><col /><colgroup><command><command /><dd><del><dfn><div><dl><DOCTYPE><dt><em><fieldset><form><h1><h2><h3><h4><h5><h6><head><html><hr><hr /><i><img><img /><input><input /><ins><kbd><label><legend><li><link><map><meta><meta /><noscript><ol><optgroup><option><p><param><param /><pre><q><samp><select><small><span><strong><style><sub><sup><table><tbody><td><textarea><tfoot><th><thead><title><tr><tt><ul><var><wbr><wbr />';
+
+		$string = strip_tags( $string, $allowable_tags );
+
+		return $string;
+	}
+
     public static function is_checkbox_checked($field_id, $field_label, $lead, $form){
 
         //looping through lead detail values trying to find an item identical to the column label. Mark with a tick if found.
@@ -3551,7 +3564,7 @@ public static function get_grid_columns($form_id, $input_label_only=false){
     public static function get_label($field, $input_id = 0, $input_only = false){
         $field_label = (IS_ADMIN || RG_CURRENT_PAGE == "select_columns.php" || RG_CURRENT_PAGE == "print-entry.php" || rgget("gf_page", $_GET) == "select_columns" || rgget("gf_page", $_GET) == "print-entry") && !rgempty("adminLabel", $field) ? rgar($field,"adminLabel") : rgar($field,"label");
         $input = self::get_input($field, $input_id);
-        if(rgget("type", $field) == "checkbox" && $input != null)
+        if( self::get_input_type($field) == "checkbox" && $input != null)
             return $input["label"];
         else if($input != null)
             return $input_only ? $input["label"] : $field_label . ' (' . $input["label"] . ')';
@@ -4479,6 +4492,31 @@ public static function delete_password( $entry, $form ) {
 
 		return $entry;
 	}
+
+	/**
+	 * @param $field
+	 * @param $value
+	 * @param $input_type
+	 * @param $form_id
+	 *
+	 * @return string
+	 */
+	public static function sanitize_entry_value( $field, $value, $input_type, $form_id ) {
+		//allow HTML for certain field types
+		$allow_html     = in_array( $field["type"], array( "post_custom_field", "post_title", "post_content", "post_excerpt", "post_tags" ) ) || in_array( $input_type, array( "checkbox", "radio" ) ) ? true : false;
+		$allowable_tags = apply_filters( "gform_allowable_tags_{$form_id}", apply_filters( "gform_allowable_tags", $allow_html, $field, $form_id ), $field, $form_id );
+
+		if ( $allowable_tags !== true ) {
+			$value = strip_tags( $value, $allowable_tags );
+
+			return $value;
+		} else {
+			//removing script tags from value if $allowable_tags variable is not specified.
+			$value = self::strip_script_tag( $value );
+
+			return $value;
+		}
+	}
 }
 
 class RGFormsModel extends GFFormsModel { }

gravityforms.php

@@ -3,7 +3,7 @@
 Plugin Name: Gravity Forms
 Plugin URI: http://www.gravityforms.com
 Description: Easily create web forms and manage form entries within the WordPress admin.
-Version: 1.8.18
+Version: 1.8.19
 Author: rocketgenius
 Author URI: http://www.rocketgenius.com
 Text Domain: gravityforms
@@ -107,7 +107,7 @@
 
 class GFForms {
 
-	public static $version = '1.8.18';
+	public static $version = '1.8.19';
 
 	public static function loaded(){
 		do_action( 'gform_loaded' );

includes/addon/class-gf-feed-addon.php

@@ -562,15 +562,18 @@ protected function maybe_save_feed_settings( $feed_id, $form_id ){
         $is_valid = $this->validate_settings( $sections, $settings );
         $result = false;
 
-        if( $is_valid ) {
+		if ( $is_valid ) {
 			$feed_id = $this->save_feed_settings( $feed_id, $form_id, $settings );
+			if ( $feed_id ){
+				GFCommon::add_message( $this->get_save_success_message( $sections ) );
+			}
+			else{
+				GFCommon::add_error_message( $this->get_save_error_message( $sections ) );
+			}
+		}
+		else{
+			GFCommon::add_error_message( $this->get_save_error_message( $sections ) );
 		}
-
-        if( $feed_id ) {
-            GFCommon::add_message( $this->get_save_success_message($sections) );
-        } else {
-            GFCommon::add_error_message( $this->get_save_error_message($sections) );
-        }
 
         return $feed_id;
     }

package.json

@@ -0,0 +1,19 @@
+{
+  "name": "gravityforms",
+  "version": "1.8.18",
+  "description": "Easily create web forms and manage form entries within the WordPress admin.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/gravityforms/gravityforms.git"
+  },
+  "author": "",
+  "license": "GPL",
+  "bugs": {
+    "url": "https://github.com/gravityforms/gravityforms/issues"
+  },
+  "homepage": "https://github.com/gravityforms/gravityforms",
+  "devDependencies": {
+    "grunt": "^0.4.5",
+    "grunt-wp-i18n": "^0.4.9"
+  }
+}