Merge pull request #545 from MultinetInteractive/master

v5.4.3

Author: itssimple

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [5.4.3](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.2...v5.4.3) (2026-09-02)
+
+
+### Security
+
+* **API:** Fixed proper filtering for OData variables to close a report from Patchstack. ([29ed776](https://github.com/MultinetInteractive/EduAdmin-WordPress/commit/29ed776df86d8ea81f5cc450c8d7348b21474d80))
+
 ### [5.4.2](https://github.com/MultinetInteractive/EduAdmin-WordPress/compare/v5.4.0...v5.4.2) (2026-04-30)
 
 

PLUGIN-CHECKSUM

@@ -1 +1 @@
-7728161a3a97dd741671f333b181ab1d
+e0c928c4d26838ef036a5067b4f081b4

class/class-eduadmin-loginhandler.php

@@ -25,7 +25,7 @@ public function process_login() {
 
 				$possible_persons = EDUAPI()->OData->Persons->Search(
 					'PersonId',
-					"CanLogin and $login_field eq '" . sanitize_text_field( wp_unslash( $_POST['eduadminloginEmail'] ) ) . '\'', // Input var okay.
+					"CanLogin and $login_field eq " . edu_odata_quote( sanitize_text_field( wp_unslash( $_POST['eduadminloginEmail'] ) ) ), // Input var okay.
 					'CustomFields($filter=ShowOnWeb;)',
 					null,
 					null,

content/template/bookingTemplate/-login-handler.php

@@ -9,7 +9,7 @@
 
 		$possible_persons = EDUAPI()->OData->Persons->Search(
 			null,
-			"$login_field eq '" . sanitize_text_field( wp_unslash( $_POST['eduadminloginEmail'] ) ) . '\'', // Input var okay.
+			"$login_field eq " . edu_odata_quote( sanitize_text_field( wp_unslash( $_POST['eduadminloginEmail'] ) ) ), // Input var okay.
 			'CustomFields($filter=ShowOnWeb;)'
 		)['value'];
 

content/template/myPagesTemplate/bookings.php

@@ -37,8 +37,8 @@
 
 	$events = EDUAPI()->OData->Events->Search(
 		'EventId,EventName,CourseName,InternalCourseName,OnDemand,StartDate,EndDate',
-		'Bookings/any(b:b/Customer/CustomerId eq ' . $customer->CustomerId . ') and StatusId eq 1',
-		'Bookings($expand=Participants($select=FirstName,LastName,Arrived,GradeName,Canceled,PriceNameId),UnnamedParticipants($select=PriceNameId,Quantity,Canceled);$filter=Customer/CustomerId eq ' . $customer->CustomerId . ' and NumberOfParticipants gt 0;$select=BookingId,Created,NumberOfParticipants,TotalPriceIncVat,TotalPriceExVat)'
+		'Bookings/any(b:b/Customer/CustomerId eq ' . intval( $customer->CustomerId ) . ') and StatusId eq 1',
+		'Bookings($expand=Participants($select=FirstName,LastName,Arrived,GradeName,Canceled,PriceNameId),UnnamedParticipants($select=PriceNameId,Quantity,Canceled);$filter=Customer/CustomerId eq ' . intval( $customer->CustomerId ) . ' and NumberOfParticipants gt 0;$select=BookingId,Created,NumberOfParticipants,TotalPriceIncVat,TotalPriceExVat)'
 	);
 
 	$bookings = array();

content/template/myPagesTemplate/certificates.php

@@ -10,7 +10,7 @@
 if ( $show_company_certificates ) {
 	$certificates = EDUAPI()->OData->Persons->Search(
 		'PersonId,FirstName,LastName,CivicRegistrationNumber',
-		'CustomerId eq ' . $customer->CustomerId,
+		'CustomerId eq ' . intval( $customer->CustomerId ),
 		'Certificates'
 	)["value"];
 } else {

content/template/myPagesTemplate/login-tab-header.php

@@ -15,7 +15,7 @@
 if ( $show_company_certificates ) {
 	$certificates = EDUAPI()->OData->Persons->Search(
 		'PersonId,FirstName,LastName,CivicRegistrationNumber',
-		'CustomerId eq ' . $customer->CustomerId,
+		'CustomerId eq ' . intval( $customer->CustomerId ),
 		'Certificates'
 	)["value"];
 } else {

eduadmin.php

@@ -9,7 +9,7 @@
  * Plugin URI:	https://www.eduadmin.com
  * Description:	EduAdmin plugin to allow visitors to book courses at your website
  * Tags:	booking, participants, courses, events, eduadmin
- * Version:	5.4.2
+ * Version:	5.4.3
  * GitHub Plugin URI: multinetinteractive/eduadmin-wordpress
  * GitHub Plugin URI: https://github.com/multinetinteractive/eduadmin-wordpress
  * Requires at least: 6.0

includes/edu-ajax-functions.php

@@ -43,17 +43,17 @@ function edu_listview_courselist() {
 	}
 
 	if ( ! empty( $category_id ) && ! edu_starts_with( $category_id, 'deep-' ) ) {
-		$filters[] = 'CategoryId eq ' . $category_id;
+		$filters[] = 'CategoryId eq ' . intval( $category_id );
 	} elseif ( ! empty( $category_id ) && edu_starts_with( $category_id, 'deep-' ) ) {
-		$filters[] = 'Categories/any(c:c/CategoryId eq ' . str_replace( 'deep-', '', $category_id ) . ')';
+		$filters[] = 'Categories/any(c:c/CategoryId eq ' . intval( str_replace( 'deep-', '', $category_id ) ) . ')';
 	}
 
 	if ( ! empty( $_POST['city'] ) && is_numeric( $_POST['city'] ) ) {
 		$filters[] = 'Events/any(e:e/LocationId eq ' . intval( $_POST['city'] ) . ')';
 	}
 
 	if ( ! empty( $_POST['subject'] ) ) {
-		$filters[] = 'Subjects/any(s:s/SubjectName eq \'' . sanitize_text_field( $_POST['subject'] ) . '\')';
+		$filters[] = 'Subjects/any(s:s/SubjectName eq ' . edu_odata_quote( sanitize_text_field( wp_unslash( $_POST['subject'] ) ) ) . ')';
 	}
 
 	if ( ! empty( $_POST['subjectid'] ) ) {

includes/edu-login-functions.php

@@ -7,7 +7,7 @@ function edu_send_forgotten_password( $login_value ) {
 
 	$cc = EDUAPI()->OData->Persons->Search(
 		null,
-		"$login_field eq '" . sanitize_text_field( $login_value ) . '\' and CanLogin',
+		"$login_field eq " . edu_odata_quote( sanitize_text_field( wp_unslash( $login_value ) ) ) . ' and CanLogin',
 		null,
 		null,
 		null,