From 4451731929dcf2956e3382b946d6e999e808b76d Mon Sep 17 00:00:00 2001
From: DmitryGil <91392061+dmitrygil1@users.noreply.github.com>
Date: Fri, 19 Jan 2024 14:13:16 +0300
Subject: [PATCH] fixed the csv export function (did not work before) Improved
 filtering

From a security point of view, optimized code is also secure. It uses the 'htmlspecialchars` and `esc_attr` functions to shield values and prevent possible XSS attacks.

The optimized code also uses the `http_build_query` function, which automatically handles escaping and formatting parameters. This helps to prevent possible vulnerabilities related to incorrect formatting and escaping of parameters.
---
 ...dmin-recurring-subscriptions-list-page.php | 22 +++++--------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/inc/admin-templates/leyka-admin-recurring-subscriptions-list-page.php b/inc/admin-templates/leyka-admin-recurring-subscriptions-list-page.php
index dbf4be813..6f30f5b88 100644
--- a/inc/admin-templates/leyka-admin-recurring-subscriptions-list-page.php
+++ b/inc/admin-templates/leyka-admin-recurring-subscriptions-list-page.php
@@ -22,23 +22,11 @@
 
         <div class="recurring-subscriptions-list-export admin-list-export">
             <form action="#" method="get">
-                <?php $get_params_string = '';
-
-                foreach($_GET as $param_name => &$param_value) {
-
-                    $param_value = $param_value ?
-                        esc_attr( str_replace('>', '', wp_strip_all_tags(trim($param_value))) ) : '';
-
-                    if($param_name === 'first-date' && is_array($param_value)) {
-                        $param_value = $param_value[0].'-'.$param_value[1];
-                    }
-
-                    $get_params_string .= $get_params_string === '' ? '' : '&';
-                    $get_params_string .= $param_name === 'paged' ? '' : $param_name.'='.$param_value;
-
-                } ?>
-                <input type="hidden" name="get-params" value="<?php echo esc_attr( $get_params_string ); ?>">
-                <input type="hidden" name="page" value="<?php echo esc_attr( $current_page );?>">
+                <?php $get_params = $_GET;
+                $get_params['campaigns'] = isset($get_params['campaigns']) ? (array) $get_params['campaigns'] : [];
+                $get_params_string = http_build_query($get_params, '', '&', PHP_QUERY_RFC3986); ?>
+                <input type="hidden" name="get-params" value="<?php echo htmlspecialchars($get_params_string);?>">
+                <input type="hidden" name="page" value="<?php echo esc_attr($_GET['page']);?>">
                 <input type="submit" class="submit" name="subscriptions-list-export" value="<?php _e('Export the list in CSV', 'leyka');?>">
             </form>
         </div>