Skip to content

Fix: harden smart tag resolution against post-submission injection #1669

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
deepench merged 5 commits into from
Oct 12, 2026
Merged

Fix: harden smart tag resolution against post-submission injection #1669

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
91438a9
Merge remote-tracking branch 'origin/pre-develop' into develop
rajatgautam755421 Sep 7, 2026
f0fae10
Merge remote-tracking branch 'origin/pre-develop' into develop
rajatgautam755421 Sep 21, 2026
bccac21
Fix: harden smart tag resolution against post-submission injection
lihsaa591 Sep 29, 2026
128c5ee
Add e2e regression spec for the smart tag injection fix
lihsaa591 Sep 29, 2026
4817b80
Fix: exercise real do_task()/entry_save() in the smart-tag security t…
lihsaa591 Sep 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 24 additions & 6 deletions includes/class-evf-form-task.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -722,13 +722,24 @@ public function do_task( $entry ) {
$logger->notice( sprintf( 'Everest Form Process After: %s', evf_print_r( $this->form_fields, true ) ) );

/**
* Apply smart tags to form fields values.
* Apply smart tags to form fields values.
*
* Resolved strictly from the field's own admin-configured default_value
* (the trusted form definition), never from the submitted value, so a
* crafted request body cannot inject arbitrary smart tags such as
* {post_meta key=...}. See https://github.com/themegrill/everest-forms/pull/1667.
*
* @since 3.2.3
*/
foreach ( $this->form_fields as $key => $value ) {
if ( 'hidden' === $value['type'] && ! empty( $value['value'] ) && is_string( $value['value'] ) && strpos( $value['value'], '{' ) !== false ) {
$this->form_fields[ $key ]['value'] = apply_filters( 'everest_forms_process_smart_tags', $value['value'], $this->form_data, $this->form_fields );
if ( 'hidden' !== $value['type'] ) {
continue;
}

$default_value = isset( $this->form_data['form_fields'][ $key ]['default_value'] ) ? $this->form_data['form_fields'][ $key ]['default_value'] : '';

if ( is_string( $default_value ) && '' !== $default_value && strpos( $default_value, '{' ) !== false ) {
$this->form_fields[ $key ]['value'] = apply_filters( 'everest_forms_process_smart_tags', $default_value, $this->form_data, $this->form_fields );
}
}

Expand Down Expand Up @@ -1550,7 +1561,7 @@ public function entry_save( $fields, $entry, $form_id, $form_data = array() ) {

// Create meta data.
if ( $entry_id ) {
foreach ( $fields as $field ) {
foreach ( $fields as $field_key => $field ) {
$field = apply_filters( 'everest_forms_entry_save_fields', $field, $form_data, $entry_id );
// Add only whitelisted fields to entry meta.
if ( in_array( $field['type'], array( 'html', 'title' ), true ) ) {
Expand Down Expand Up @@ -1578,8 +1589,15 @@ public function entry_save( $fields, $entry, $form_id, $form_data = array() ) {
}

if ( isset( $field['meta_key'], $field['value'] ) && '' !== $field['value'] ) {
if ( 'hidden' === $field['type'] && ! empty( $field['value'] ) && is_string( $field['value'] ) && strpos( $field['value'], '{' ) !== false ) {
$field['value'] = apply_filters( 'everest_forms_process_smart_tags', $field['value'], $form_data, $fields, $entry_id );
// Resolved strictly from the field's own admin-configured default_value
// (never the submitted value) -- see the matching fix in do_task().
if ( 'hidden' === $field['type'] ) {
$field_id = isset( $field['id'] ) ? $field['id'] : $field_key;
$default_value = isset( $form_data['form_fields'][ $field_id ]['default_value'] ) ? $form_data['form_fields'][ $field_id ]['default_value'] : '';

if ( is_string( $default_value ) && '' !== $default_value && strpos( $default_value, '{' ) !== false ) {
$field['value'] = apply_filters( 'everest_forms_process_smart_tags', $default_value, $form_data, $fields, $entry_id );
}
}
$entry_metadata = array(
'entry_id' => $entry_id,
Expand Down
276 changes: 143 additions & 133 deletions includes/class-evf-smart-tags.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,139 +215,16 @@ public function regex_expression_lists() {
* @return string
*/
public function process( $content, $form_data, $fields = '', $entry_id = '' ) {
// Field smart tags (settings, etc).
preg_match_all( '/\{field_id="(.+?)"\}/', $content, $ids );

// We can only process field smart tags if we have $fields.
if ( ! empty( $ids[1] ) && ! empty( $fields ) ) {

foreach ( $ids[1] as $key => $field_id ) {
$mixed_field_id = explode( '_', $field_id );
$uploads = wp_upload_dir();

if ( count( $mixed_field_id ) > 1 && 'fullname' !== $field_id && 'email' !== $field_id && 'subject' !== $field_id && 'message' !== $field_id ) {
$value = isset( $fields[ $mixed_field_id[1] ]['value'] ) && ! empty( $fields[ $mixed_field_id[1] ]['value'] ) ? evf_sanitize_textarea_field( $fields[ $mixed_field_id[1] ]['value'] ) : '';
} else {
$value = isset( $fields[ $field_id ]['value'] ) && ! empty( $fields[ $field_id ]['value'] ) ? evf_sanitize_textarea_field( $fields[ $field_id ]['value'] ) : '';
}

$value = apply_filters( 'everest_forms_smart_tags_value', $value, $field_id, $fields, $form_data );

if ( count( $mixed_field_id ) > 1 && ! empty( $fields[ $mixed_field_id[1] ] ) ) {
// Properly display signature field in smart tag.
if ( 'signature' === $fields[ $mixed_field_id[1] ]['type'] ) {
if ( ! is_array( $value ) && false !== strpos( $value, $uploads['basedir'] ) ) {
$value = trailingslashit( content_url() ) . str_replace( str_replace( 'uploads', '', $uploads['basedir'] ), '', $value );
}

if ( ! empty( $value ) ) {
$styles = array(
'width' => '150px',
'height' => '80px',
'max-width' => '100px',
'max-height' => '200px',
);

$styles = apply_filters( 'everest_forms_export_signature_style', $styles, $fields[ $mixed_field_id[1] ] );

// Convert styles array to inline style string
$style_string = '';
foreach ( $styles as $key => $val ) {
$style_string .= $key . ':' . $val . ';';
}

$value = sprintf(
'<img src="%s" style="%s"/>',
esc_url( $value ),
esc_attr( $style_string )
);
}
}

// Properly display Radio field in smart tag.
if ( isset( $value['image'] ) && 'radio' === $fields[ $mixed_field_id[1] ]['type'] ) {
if ( ! is_array( $value ) && false !== strpos( $value['image'], $uploads['basedir'] ) ) {
$value = trailingslashit( content_url() ) . str_replace( str_replace( 'uploads', '', $uploads['basedir'] ), '', $value['image'] );
}

if ( ! empty( $value ) ) {
$value = sprintf(
"\n" . '<img src="%s" style="width:150px;height:80px;max-height:200px;max-width:100px;"/>' . "\n" . '%s',
$value['image'],
$value['label']
);
}
}

// Properly display Checkboxes field in smart tag.
if ( isset( $value['images'] ) && ( 'checkbox' === $fields[ $mixed_field_id[1] ]['type'] ) ) {
$checkbox_images = '';
foreach ( $value['images'] as $image_key => $image_value ) {
if ( ! is_array( $image_value ) && false !== strpos( $image_value, $uploads['basedir'] ) ) {
$value = trailingslashit( content_url() ) . str_replace( str_replace( 'uploads', '', $uploads['basedir'] ), '', $image_value );
}

if ( ! empty( $value ) ) {
$checkbox_images .= sprintf(
"\n" . '<img src="%s" style="width:150px;height:80px;max-height:200px;max-width:100px;"/>' . "\n" . '%s',
$image_value,
$value['label'][ $image_key ]
);
}
}
$value = $checkbox_images;
}

// Properly display Files and Image Upload field in smart tag.
if ( 'image-upload' === $fields[ $mixed_field_id[1] ]['type'] || 'file-upload' === $fields[ $mixed_field_id[1] ]['type'] ) {
$files = '';

if ( ! empty( $fields[ $mixed_field_id[1] ]['value_raw'] ) ) {
foreach ( $fields[ $mixed_field_id[1] ]['value_raw'] as $files_key => $files_value ) {
if ( ! is_array( $files_value['value'] ) && false !== strpos( $files_value['value'], $uploads['basedir'] ) ) {
$value = trailingslashit( content_url() ) . str_replace( str_replace( 'uploads', '', $uploads['basedir'] ), '', $files_value['value'] );
}

if ( ! empty( $value ) ) {
$files .= sprintf(
apply_filters(
'everest_forms_smart_tags_file_upload',
'<a href="%s">%s</a>' . "\n",
$files_value
),
esc_url( $files_value['value'] ),
esc_html( $files_value['name'] )
);
}
}
$value = $files;
}
}
}

if ( ! is_array( $value ) ) {
$content = str_replace( '{field_id="' . $field_id . '"}', $value, $content );
} else {
if ( isset( $value['type'], $value['label'] ) ) {
if ( in_array( $value['type'], array( 'radio', 'payment-multiple' ), true ) ) {
$value = $value['label'];
} elseif ( in_array( $value['type'], array( 'checkbox', 'payment-checkbox' ), true ) ) {
$value = implode( ',', $value['label'] );

}
} elseif ( isset( $value['number_of_rating'], $value['value'] ) ) {
$value = (string) $value['value'] . '/' . (string) $value['number_of_rating'];
} elseif ( isset( $value['type'], $value['country_code'] ) && 'country' === $value['type'] ) {
$value = $value['country_code'];
} else {
$value = $value[0];
}

$content = str_replace( '{field_id="' . $field_id . '"}', $value, $content );
}
}
}

/**
* Other smart tags (post_meta, user_meta, admin_email, etc.) are resolved
* first, against the original admin-authored $content, and {field_id="..."}
* placeholders are substituted last. If field values were merged in first,
* a submitter typing tag syntax (e.g. {post_meta key=...}) into an ordinary
* field referenced by a {field_id} smart tag would get it re-resolved by
* the pass below, letting an unauthenticated submitter read arbitrary
* server-side data back through any notification/confirmation that embeds
* that field. See https://github.com/themegrill/everest-forms/pull/1667.
*/
// Other Smart tags.
preg_match_all( '/\{(.+?)\}/', $content, $other_tags );
if ( ! empty( $other_tags[1] ) ) {
Expand Down Expand Up @@ -581,6 +458,139 @@ public function process( $content, $form_data, $fields = '', $entry_id = '' ) {
}
}

// Field smart tags (settings, etc).
preg_match_all( '/\{field_id="(.+?)"\}/', $content, $ids );

// We can only process field smart tags if we have $fields.
if ( ! empty( $ids[1] ) && ! empty( $fields ) ) {

foreach ( $ids[1] as $key => $field_id ) {
$mixed_field_id = explode( '_', $field_id );
$uploads = wp_upload_dir();

if ( count( $mixed_field_id ) > 1 && 'fullname' !== $field_id && 'email' !== $field_id && 'subject' !== $field_id && 'message' !== $field_id ) {
$value = isset( $fields[ $mixed_field_id[1] ]['value'] ) && ! empty( $fields[ $mixed_field_id[1] ]['value'] ) ? evf_sanitize_textarea_field( $fields[ $mixed_field_id[1] ]['value'] ) : '';
} else {
$value = isset( $fields[ $field_id ]['value'] ) && ! empty( $fields[ $field_id ]['value'] ) ? evf_sanitize_textarea_field( $fields[ $field_id ]['value'] ) : '';
}

$value = apply_filters( 'everest_forms_smart_tags_value', $value, $field_id, $fields, $form_data );

if ( count( $mixed_field_id ) > 1 && ! empty( $fields[ $mixed_field_id[1] ] ) ) {
// Properly display signature field in smart tag.
if ( 'signature' === $fields[ $mixed_field_id[1] ]['type'] ) {
if ( ! is_array( $value ) && false !== strpos( $value, $uploads['basedir'] ) ) {
$value = trailingslashit( content_url() ) . str_replace( str_replace( 'uploads', '', $uploads['basedir'] ), '', $value );
}

if ( ! empty( $value ) ) {
$styles = array(
'width' => '150px',
'height' => '80px',
'max-width' => '100px',
'max-height' => '200px',
);

$styles = apply_filters( 'everest_forms_export_signature_style', $styles, $fields[ $mixed_field_id[1] ] );

// Convert styles array to inline style string
$style_string = '';
foreach ( $styles as $key => $val ) {
$style_string .= $key . ':' . $val . ';';
}

$value = sprintf(
'<img src="%s" style="%s"/>',
esc_url( $value ),
esc_attr( $style_string )
);
}
}

// Properly display Radio field in smart tag.
if ( isset( $value['image'] ) && 'radio' === $fields[ $mixed_field_id[1] ]['type'] ) {
if ( ! is_array( $value ) && false !== strpos( $value['image'], $uploads['basedir'] ) ) {
$value = trailingslashit( content_url() ) . str_replace( str_replace( 'uploads', '', $uploads['basedir'] ), '', $value['image'] );
}

if ( ! empty( $value ) ) {
$value = sprintf(
"\n" . '<img src="%s" style="width:150px;height:80px;max-height:200px;max-width:100px;"/>' . "\n" . '%s',
$value['image'],
$value['label']
);
}
}

// Properly display Checkboxes field in smart tag.
if ( isset( $value['images'] ) && ( 'checkbox' === $fields[ $mixed_field_id[1] ]['type'] ) ) {
$checkbox_images = '';
foreach ( $value['images'] as $image_key => $image_value ) {
if ( ! is_array( $image_value ) && false !== strpos( $image_value, $uploads['basedir'] ) ) {
$value = trailingslashit( content_url() ) . str_replace( str_replace( 'uploads', '', $uploads['basedir'] ), '', $image_value );
}

if ( ! empty( $value ) ) {
$checkbox_images .= sprintf(
"\n" . '<img src="%s" style="width:150px;height:80px;max-height:200px;max-width:100px;"/>' . "\n" . '%s',
$image_value,
$value['label'][ $image_key ]
);
}
}
$value = $checkbox_images;
}

// Properly display Files and Image Upload field in smart tag.
if ( 'image-upload' === $fields[ $mixed_field_id[1] ]['type'] || 'file-upload' === $fields[ $mixed_field_id[1] ]['type'] ) {
$files = '';

if ( ! empty( $fields[ $mixed_field_id[1] ]['value_raw'] ) ) {
foreach ( $fields[ $mixed_field_id[1] ]['value_raw'] as $files_key => $files_value ) {
if ( ! is_array( $files_value['value'] ) && false !== strpos( $files_value['value'], $uploads['basedir'] ) ) {
$value = trailingslashit( content_url() ) . str_replace( str_replace( 'uploads', '', $uploads['basedir'] ), '', $files_value['value'] );
}

if ( ! empty( $value ) ) {
$files .= sprintf(
apply_filters(
'everest_forms_smart_tags_file_upload',
'<a href="%s">%s</a>' . "\n",
$files_value
),
esc_url( $files_value['value'] ),
esc_html( $files_value['name'] )
);
}
}
$value = $files;
}
}
}

if ( ! is_array( $value ) ) {
$content = str_replace( '{field_id="' . $field_id . '"}', $value, $content );
} else {
if ( isset( $value['type'], $value['label'] ) ) {
if ( in_array( $value['type'], array( 'radio', 'payment-multiple' ), true ) ) {
$value = $value['label'];
} elseif ( in_array( $value['type'], array( 'checkbox', 'payment-checkbox' ), true ) ) {
$value = implode( ',', $value['label'] );

}
} elseif ( isset( $value['number_of_rating'], $value['value'] ) ) {
$value = (string) $value['value'] . '/' . (string) $value['number_of_rating'];
} elseif ( isset( $value['type'], $value['country_code'] ) && 'country' === $value['type'] ) {
$value = $value['country_code'];
} else {
$value = $value[0];
}

$content = str_replace( '{field_id="' . $field_id . '"}', $value, $content );
}
}
}

return $content;
}
}
7 changes: 5 additions & 2 deletions includes/evf-core-functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1295,6 +1295,7 @@ function evf_get_browser()
$bname = 'Unknown';
$platform = 'Unknown';
$version = '';
$ub = 'other';

// First get the platform.
if (preg_match('/linux/i', $u_agent)) {
Expand Down Expand Up @@ -1341,13 +1342,15 @@ function evf_get_browser()
// See how many we have.
$i = count($matches['browser']);

if (1 !== $i) {
if (0 === $i) {
$version = '';
} elseif (1 !== $i) {
// we will have two since we are not using 'other' argument yet.
// see if version is before or after the name.
if (strripos($u_agent, 'Version') < strripos($u_agent, $ub)) {
$version = $matches['version'][0];
} else {
$version = $matches['version'][1];
$version = isset($matches['version'][1]) ? $matches['version'][1] : $matches['version'][0];
}
} else {
$version = $matches['version'][0];
Expand Down
Loading
Loading