Merge branch 'dev'

includes/settings.php

@@ -48,7 +48,7 @@ function pmpro_courses_settings_save() {
 
 		foreach( $_REQUEST['pmpro_courses_modules'] as $active_module ) {
 			if ( in_array( $active_module, $all_module_slugs, true ) ) {
-				$active_modules[] = $active_module;
+				$active_modules[] = sanitize_text_field( $active_module );
 			}
 		}
 

pmpro-courses.php

@@ -3,7 +3,7 @@
  * Plugin Name: Paid Memberships Pro - Courses for Membership Add On
  * Plugin URI: https://www.paidmembershipspro.com/add-ons/pmpro-courses-lms-integration/
  * Description: Create courses and lessons for members. Integrates LMS plugins with Paid Memberships Pro.
- * Version: 1.2.4
+ * Version: 1.2.5
  * Author: Paid Memberships Pro
  * Author URI: https://www.paidmembershipspro.com
  * Text Domain: pmpro-courses
@@ -12,7 +12,7 @@
 
 defined( 'ABSPATH' ) || die( 'File cannot be accessed directly' );
 
-define( 'PMPRO_COURSES_VERSION', '1.2.4' );
+define( 'PMPRO_COURSES_VERSION', '1.2.5' );
 define( 'PMPRO_COURSES_DIR', dirname( __FILE__ ) );
 define( 'PMPRO_COURSES_BASENAME', plugin_basename( __FILE__ ) );
 

readme.txt

@@ -3,7 +3,7 @@ Contributors: strangerstudios, paidmembershipspro, kimannwall, jarryd-long
 Tags: course, education, elearning, lms, membership, pmpro
 Requires at least: 5.4
 Tested up to: 6.3
-Stable tag: 1.2.3
+Stable tag: 1.2.4
 Requires PHP: 7.0
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -135,6 +135,9 @@ Please visit [our support site at https://www.paidmembershipspro.com](http://www
 4. A course page on the site frontend showing overview content, a registration box with required levels, and a list of lessons.
 
 == Changelog ==
+= 1.2.5 - 2023-08-04 =
+* SECURITY: Sanitizing options when saving to the database for activating modules.
+
 = 1.2.4 - 2023-08-01 =
 * SECURITY: Added nonces to adding/removing lessons from the default courses module. (@andrewlimaza)
 * BUG FIX/ENHANCEMENT: Improved compatibility with auto-enrollment/unenrollment with Multiple Memberships Per User. (@dparker1005)