Merge pull request #2262 from gocodebox/dev

Release Version 6.10.2

CHANGELOG.md

@@ -1,6 +1,18 @@
 LifterLMS Changelog
 ===================
 
+v6.10.2 - 2022-09-14
+--------------------
+
+##### Updates and Enhancements
+
++ Updated `woocommerce/action-scheduler` to version [3.5.1](https://github.com/woocommerce/action-scheduler/releases/tag/3.5.1).
+
+##### Security Fixes
+
++ Fixed a data sanitization issue related to achievement permalinks.
+
+
 v6.10.1 - 2022-09-07
 --------------------
 

assets/js/app/llms-achievements.js

@@ -4,7 +4,7 @@
  * @package LifterLMS/Scripts
  *
  * @since 3.14.0
- * @version 4.5.1
+ * @version 6.10.2
  */
 
 LLMS.Achievements = {
@@ -15,7 +15,7 @@ LLMS.Achievements = {
 	 * @since 3.14.0
 	 * @since 4.5.1 Fix conditional loading check.
 	 *
-	 * @return void
+	 * @return {void}
 	 */
 	init: function() {
 
@@ -36,7 +36,7 @@ LLMS.Achievements = {
 	 *
 	 * @since 3.14.0
 	 *
-	 * @return void
+	 * @return {void}
 	 */
 	bind: function() {
 
@@ -70,7 +70,7 @@ LLMS.Achievements = {
 	 * @since 3.14.0
 	 *
 	 * @param obj $el The jQuery selector for the modal card.
-	 * @return void
+	 * @return {void}
 	 */
 	create_modal: function( $el ) {
 
@@ -111,16 +111,29 @@ LLMS.Achievements = {
 	 * On page load, opens a modal if the URL contains an achievement in the location hash
 	 *
 	 * @since 3.14.0
+	 * @since 6.10.2 Sanitize achievement IDs before using window.location.hash to trigger the modal open.
 	 *
-	 * @return void
+	 * @return {void}
 	 */
 	maybe_open: function() {
 
-		var hash = window.location.hash;
-		if ( hash && -1 !== hash.indexOf( 'achievement-' ) ) {
-			$( 'a[href="' + hash + '"]' ).first().trigger( 'click' );
+		let hash = window.location.hash.split( '-' );
+		if ( 2 !== hash.length ) {
+			return;
 		}
 
+		hash[1] = parseInt( hash[1] );
+		if ( '#achievement-' !== hash[0] || ! Number.isInteger( hash[1] ) ) {
+			return;
+		}
+
+		const a = document.querySelector( `a[href="${ hash.join( '-' ) }"]` )
+		if ( ! a ) {
+			return;
+		}
+
+		a.click();
+
 	}
 
 };

class-lifterlms.php

@@ -34,7 +34,7 @@ final class LifterLMS {
 	 *
 	 * @var string
 	 */
-	public $version = '6.10.1';
+	public $version = '6.10.2';
 
 	/**
 	 * LLMS_Assets instance

composer.json

@@ -33,7 +33,7 @@
     "lifterlms/lifterlms-cli": "0.0.3",
     "lifterlms/lifterlms-helper": "3.4.2",
     "lifterlms/lifterlms-rest": "1.0.0-beta.25",
-    "woocommerce/action-scheduler": "3.5.0"
+    "woocommerce/action-scheduler": "3.5.1"
   },
   "require-dev": {
     "lifterlms/lifterlms-tests": "^3.3.1",

languages/lifterlms.pot

@@ -2,14 +2,14 @@
 # This file is distributed under the GPLv3.
 msgid ""
 msgstr ""
-"Project-Id-Version: LifterLMS 6.10.1\n"
+"Project-Id-Version: LifterLMS 6.10.2\n"
 "Report-Msgid-Bugs-To: https://lifterlms.com/my-account/my-tickets\n"
 "Last-Translator: Team LifterLMS <[email protected]>\n"
 "Language-Team: Team LifterLMS <[email protected]>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"POT-Creation-Date: 2022-09-07T09:15:44-07:00\n"
+"POT-Creation-Date: 2022-09-14T11:42:42-06:00\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "X-Generator: llms/dev 0.1.0\n"
 "X-Domain: lifterlms\n"
@@ -2509,7 +2509,6 @@ msgstr ""
 msgid "Template"
 msgstr ""
 
-#. Translators: %s: Post title.
 #: includes/admin/post-types/post-tables/class-llms-admin-post-table-awards.php:117
 #: includes/admin/post-types/post-tables/class-llms-admin-post-table-awards.php:325
 msgid "Delete Permanently"
@@ -4038,7 +4037,6 @@ msgstr ""
 msgid "Deletes pending batches generated by LifterLMS background processors."
 msgstr ""
 
-#. Translators: %d = the number of pending batches.
 #: includes/admin/tools/class-llms-admin-tool-batch-eraser.php:44
 msgid "There is currently %d pending batch that will be deleted."
 msgid_plural "There are currently %d pending batches that will be deleted."
@@ -4082,7 +4080,6 @@ msgstr ""
 msgid "The method used to determine when a limited-billing recurring order has completed its payment plan changed during version 5.3.0. This tool provides a report of orders which may been affected by this change. %1$sRead more%2$s about this change."
 msgstr ""
 
-#. Translators: %d = the number of pending batches.
 #: includes/admin/tools/class-llms-admin-tool-limited-billing-order-locator.php:134
 msgid "There is %d order that should be reviewed."
 msgid_plural "There are %d orders that should be reviewed."
@@ -4101,7 +4098,6 @@ msgstr ""
 msgid "Check active recurring orders to ensure their recurring payment action is properly scheduled for the next payment. If a recurring payment is due and not scheduled it will be rescheduled."
 msgstr ""
 
-#. Translators: %d = the number of pending batches.
 #: includes/admin/tools/class-llms-admin-tool-recurring-payment-rescheduler.php:46
 msgid "There is %d order that will be checked."
 msgid_plural "There are %d orders that will be checked in batches of 50."

lifterlms.php

@@ -10,7 +10,7 @@
  * Plugin Name: LifterLMS
  * Plugin URI: https://lifterlms.com/
  * Description: LifterLMS is a powerful WordPress learning management system plugin that makes it easy to create, sell, and protect engaging online courses and training based membership websites.
- * Version: 6.10.1
+ * Version: 6.10.2
  * Author: LifterLMS
  * Author URI: https://lifterlms.com/
  * Text Domain: lifterlms

package.json

@@ -1,6 +1,6 @@
 {
   "name": "lifterlms",
-  "version": "6.10.1",
+  "version": "6.10.2",
   "description": "LifterLMS by codeBOX",
   "repository": {
     "type": "git",

readme.txt

@@ -7,7 +7,7 @@ License URI: https://www.gnu.org/licenses/gpl-3.0.html
 Requires at least: 5.6
 Tested up to: 6.0
 Requires PHP: 7.4
-Stable tag: 6.10.1
+Stable tag: 6.10.2
 
 LifterLMS is a powerful WordPress learning management system plugin that makes it easy to create, sell, and protect engaging online courses and training based membership websites.
 
@@ -540,6 +540,17 @@ You can review our full security policy at [https://lifterlms.com/security-polic
 
 == Changelog ==
 
+= v6.10.2 - 2022-09-14 =
+
+##### Updates and Enhancements
+
++ Updated `woocommerce/action-scheduler` to version [3.5.1](https://github.com/woocommerce/action-scheduler/releases/tag/3.5.1).
+
+##### Security Fixes
+
++ Fixed a data sanitization issue related to achievement permalinks.
+
+
 = v6.10.1 - 2022-09-07 =
 
 ##### Bug Fixes
@@ -722,26 +733,4 @@ You can review our full security policy at [https://lifterlms.com/security-polic
 + Added new filter `llms_buddypress_min_nav_item_position` to control the LifterLMS main BuddyPress' nav item position.
 
 
-= v6.2.0 - 2022-03-30 =
-
-##### Updates and Enhancements
-
-+ Changed the `llmsStudentsSelect2()` JavaScript function to use the LifterLMS REST API "list students" endpoint instead of the `LLMS_AJAX_Handler::query_students()` PHP function.
-+ Upgraded LifterLMS Blocks to [v2.4.1](https://make.lifterlms.com/2022/03/30/lifterlms-blocks-version-2-4-1/).
-
-##### Bug Fixes
-
-+ Fixed issue with hidden checkboxes on LifterLMS forms.
-+ Fixed a compatiblity issue with the Divi Theme Builder ignoring access restrictions when using template with custom body. [#2063](https://github.com/gocodebox/lifterlms/issues/2063)
-+ Fixed an error encountered on the Engagements > Certificates screen when using the BuddyBoss theme. [#2080](https://github.com/gocodebox/lifterlms/issues/2080)
-
-##### Deprecations
-
-+ Deprecated `LLMS_AJAX_Handler::query_students()`. Use the [REST API list students](https://developer.lifterlms.com/rest-api/#tag/Students/paths/~1students/get) endpoint instead.
-
-##### Developer Notes
-
-+ Added new filter `llms_template_loader_priority` to control the priority of the `template_include` hook callback used to load restricted content templates.
-
-
 [Read the full changelog](https://make.lifterlms.com/tag/lifterlms)