Bump version v2.10.1

backend/Actions/BitCrm/BitCrmActionHelper.php

@@ -8,6 +8,14 @@
     exit;
 }
 
+/**
+ * Every do_action() below fires one of Bit CRM's own `bit_crm/*` hooks on its
+ * behalf, because the service methods this helper calls do not fire them
+ * themselves. The names belong to Bit CRM's namespace and must match it exactly
+ * for its listeners to react, so they cannot carry this plugin's prefix.
+ *
+ * phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
+ */
 final class BitCrmActionHelper
 {
     public static function createLead($fieldData)

backend/Actions/ConvertKit/ConvertKitController.php

@@ -18,6 +18,8 @@ class ConvertKitController
     public static array $authConfig = [
         'authType' => AuthorizationType::API_KEY,
         'slug'     => 'convertkit',
+        // Connections store the UI's display name, which carries the Kit rebrand.
+        'aliases'  => ['Kit(ConvertKit)'],
         'fields'   => [
             'api_secret' => 'value',
         ],

backend/Actions/CustomAction/CustomActionController.php

@@ -32,9 +32,15 @@ public static function functionValidateHandler($data)
 
     public function execute($integrationData, $fieldValues)
     {
-        $funcFileLocation = $integrationData->flow_details->funcFileLocation;
         $integId = $integrationData->id;
-        $isExits = file_exists($funcFileLocation);
+
+        // funcFileLocation arrives inside flow_details (caller-supplied JSON), so file_exists()
+        // alone would include any readable PHP on the box. Only ever run a file the plugin
+        // itself wrote into the custom-function directory.
+        $funcFileLocation = CustomFuncValidator::resolveCustomFunctionFile(
+            $integrationData->flow_details->funcFileLocation ?? ''
+        );
+        $isExits = $funcFileLocation !== '';
         $isSuccessfullyRun = true;
         $additionalData = null;
 

backend/Actions/Dropbox/RecordApiHelper.php

@@ -3,6 +3,7 @@
 namespace BitApps\Integrations\Actions\Dropbox;
 
 use BitApps\Integrations\Core\Util\Common;
+use BitApps\Integrations\Core\Util\FileSystem;
 use BitApps\Integrations\Core\Util\HttpHelper;
 use BitApps\Integrations\Log\LogHandler;
 use WP_Error;
@@ -33,7 +34,7 @@ public function uploadFile($folder, $filePath)
             return new WP_Error(423, __('Can\'t open file!', 'bit-integrations'));
         }
 
-        $body = file_get_contents($safeFilePath);
+        $body = FileSystem::read($safeFilePath);
 
         if (!$body) {
             return new WP_Error(423, __('Can\'t open file!', 'bit-integrations'));

backend/Actions/Encharge/RecordApiHelper.php

@@ -47,7 +47,6 @@ public function execute($fieldValues, $fieldMap, $tags)
 
         foreach ($fieldMap as $fieldKey => $fieldPair) {
             if (!empty($fieldPair->enChargeFields)) {
-                // echo $fieldPair->enChargeFields . ' ' . $fieldPair->formField;
                 if ($fieldPair->formField === 'custom' && isset($fieldPair->customValue)) {
                     $fieldData[$fieldPair->enChargeFields] = Common::replaceFieldWithValue($fieldPair->customValue, $fieldValues);
                 } elseif (!\is_null($fieldValues[$fieldPair->formField])) {
@@ -76,7 +75,7 @@ public function execute($fieldValues, $fieldMap, $tags)
 
     private function combineTagsWithExisting($tags, $email)
     {
-        $endpoint = $this->_endpoint . '?people[0][email]=' . urlencode($email);
+        $endpoint = $this->_endpoint . '?people[0][email]=' . rawurlencode($email);
 
         $response = HttpHelper::get($endpoint, null, $this->_defaultHeader);
 

backend/Actions/Fabman/FabmanController.php

@@ -156,7 +156,7 @@ private static function fetchMemberByEmail($apiKey, $email)
             'Content-Type'  => 'application/json'
         ];
 
-        $apiEndpoint = 'https://fabman.io/api/v1/members?q=' . urlencode($email);
+        $apiEndpoint = 'https://fabman.io/api/v1/members?q=' . rawurlencode($email);
         $apiResponse = HttpHelper::get($apiEndpoint, null, $header);
 
         if (is_wp_error($apiResponse) || !\is_array($apiResponse) || empty($apiResponse)) {

backend/Actions/Fabman/RecordApiHelper.php

@@ -160,7 +160,7 @@ private function createMember($data)
     {
         unset($data['memberId']);
         $apiEndpoint = self::API_ENDPOINT . '/members';
-        $apiResponse = HttpHelper::post($apiEndpoint, json_encode($data), $this->setHeaders());
+        $apiResponse = HttpHelper::post($apiEndpoint, wp_json_encode($data), $this->setHeaders());
 
         if (\is_wp_error($apiResponse)) {
             return $apiResponse;
@@ -181,13 +181,13 @@ private function updateMember($data)
             return new WP_Error('MISSING_MEMBER_ID', __('The email provided did not match any existing Fabman member.', 'bit-integrations'));
         }
 
-        $response = Hooks::apply(Config::withPrefix('fabman_update_member'), false, json_encode($data), $this->setHeaders(), self::API_ENDPOINT, $this->memberId);
+        $response = Hooks::apply(Config::withPrefix('fabman_update_member'), false, wp_json_encode($data), $this->setHeaders(), self::API_ENDPOINT, $this->memberId);
 
         /**
          * @deprecated 2.7.8 Use `bit_integrations_fabman_update_member` filter instead.
          * @since 2.7.8
          */
-        $response = Hooks::apply('btcbi_fabman_update_member', $response, json_encode($data), $this->setHeaders(), self::API_ENDPOINT, $this->memberId);
+        $response = Hooks::apply('btcbi_fabman_update_member', $response, wp_json_encode($data), $this->setHeaders(), self::API_ENDPOINT, $this->memberId);
 
         return $this->handleFilterResponse($response);
     }
@@ -212,13 +212,13 @@ private function deleteMember()
     private function createSpace($data)
     {
         unset($data['space']);
-        $response = Hooks::apply(Config::withPrefix('fabman_create_space'), false, json_encode($data), $this->setHeaders(), self::API_ENDPOINT);
+        $response = Hooks::apply(Config::withPrefix('fabman_create_space'), false, wp_json_encode($data), $this->setHeaders(), self::API_ENDPOINT);
 
         /**
          * @deprecated 2.7.8 Use `bit_integrations_fabman_create_space` filter instead.
          * @since 2.7.8
          */
-        $response = Hooks::apply('btcbi_fabman_create_space', $response, json_encode($data), $this->setHeaders(), self::API_ENDPOINT);
+        $response = Hooks::apply('btcbi_fabman_create_space', $response, wp_json_encode($data), $this->setHeaders(), self::API_ENDPOINT);
 
         return $this->handleFilterResponse($response);
     }
@@ -236,13 +236,13 @@ private function updateSpace($data)
 
         $data['lockVersion'] = (int) $this->lockVersion;
 
-        $response = Hooks::apply(Config::withPrefix('fabman_update_space'), false, json_encode($data), $this->setHeaders(), self::API_ENDPOINT, $this->workspaceId);
+        $response = Hooks::apply(Config::withPrefix('fabman_update_space'), false, wp_json_encode($data), $this->setHeaders(), self::API_ENDPOINT, $this->workspaceId);
 
         /**
          * @deprecated 2.7.8 Use `bit_integrations_fabman_update_space` filter instead.
          * @since 2.7.8
          */
-        $response = Hooks::apply('btcbi_fabman_update_space', $response, json_encode($data), $this->setHeaders(), self::API_ENDPOINT, $this->workspaceId);
+        $response = Hooks::apply('btcbi_fabman_update_space', $response, wp_json_encode($data), $this->setHeaders(), self::API_ENDPOINT, $this->workspaceId);
 
         return $this->handleFilterResponse($response);
     }

backend/Actions/GoogleDrive/RecordApiHelper.php

@@ -3,6 +3,7 @@
 namespace BitApps\Integrations\Actions\GoogleDrive;
 
 use BitApps\Integrations\Core\Util\Common;
+use BitApps\Integrations\Core\Util\FileSystem;
 use BitApps\Integrations\Core\Util\HttpHelper;
 use BitApps\Integrations\Log\LogHandler;
 
@@ -95,7 +96,7 @@ protected function getBody($folder, $filePath, $boundary)
         $body .= '{"name": "' . basename($filePath) . '", "parents": ["' . $folder . '"]}' . "\r\n";
         $body .= '--' . $boundary . "\r\n";
         $body .= "Content-Type: application/octet-stream\r\n\r\n";
-        $body .= file_get_contents($filePath) . "\r\n";
+        $body .= FileSystem::read($filePath) . "\r\n";
         $body .= '--' . $boundary . "--\r\n";
 
         return $body;

backend/Actions/LMFWC/LMFWCController.php

@@ -18,6 +18,8 @@ class LMFWCController
     public static array $authConfig = [
         'authType' => AuthorizationType::API_KEY,
         'slug'     => 'lmfwc',
+        // Connections store the UI's display name, which spells the plugin out.
+        'aliases'  => ['License Manager For WooCommerce'],
         'fields'   => [
             'api_key'    => 'value',
             'api_secret' => 'api_secret',

backend/Actions/Line/RecordApiHelper.php

@@ -37,18 +37,18 @@ public function execute($integrationDetails, $fieldValues)
         switch ($type) {
             case 'sendReplyMessage':
                 $data['replyToken'] = $integrationDetails->replyToken ?? '';
-                $response = $this->sendReplyMessage(json_encode($data));
+                $response = $this->sendReplyMessage(wp_json_encode($data));
 
                 break;
 
             case 'sendBroadcastMessage':
-                $response = $this->sendBroadcastMessage(json_encode($data));
+                $response = $this->sendBroadcastMessage(wp_json_encode($data));
 
                 break;
 
             default:
                 $data['to'] = $integrationDetails->recipientId ?? '';
-                $response = $this->sendPushMessage(json_encode($data));
+                $response = $this->sendPushMessage(wp_json_encode($data));
                 $response = HttpHelper::$responseCode === 200 ? 'Push message sent successfully' : 'Failed';
         }
 

backend/Actions/Mail/MailController.php

@@ -78,33 +78,56 @@ public static function filterMailContentType()
         return 'text/html; charset=UTF-8';
     }
 
+    /**
+     * Resolve mapped address values and keep only the ones that are real addresses.
+     *
+     * The scalar branch used to return the interpolated value unchecked, so a submitted
+     * form field became the recipient/header verbatim. Both branches now apply the same
+     * is_email() filter, and anything that fails it is dropped rather than passed on.
+     *
+     * @param array|string $emailAddresses
+     * @param array        $fieldValues
+     *
+     * @return array
+     */
     public function validateAddresses($emailAddresses, $fieldValues)
     {
-        if (!\is_array($emailAddresses)) {
-            return [Common::replaceFieldWithValue($emailAddresses, $fieldValues)];
-        }
-        foreach ($emailAddresses as $key => $email) {
+        $candidates = \is_array($emailAddresses) ? $emailAddresses : [$emailAddresses];
+        $valid = [];
+
+        foreach ($candidates as $email) {
+            if (!\is_scalar($email)) {
+                continue;
+            }
+
+            $email = (string) $email;
+
             if (!is_email($email)) {
                 $email = Common::replaceFieldWithValue($email, $fieldValues);
             }
-            if (is_email($email)) {
-                $emailAddresses[$key] = $email;
+
+            // A single mapped field may resolve to a comma-separated list.
+            foreach (explode(',', (string) $email) as $candidate) {
+                $candidate = sanitize_email(trim($candidate));
+
+                if ($candidate !== '' && is_email($candidate)) {
+                    $valid[] = $candidate;
+                }
             }
         }
 
-        return $emailAddresses;
+        return array_values(array_unique($valid));
     }
 
     public function processHeader($type, $address, $fields)
     {
         $headers = [];
-        $addresses = $this->validateAddresses($address, $fields);
-        if (\is_array($addresses)) {
-            foreach ($addresses as $address) {
-                $headers[] = "{$type}: " . explode('@', $address)[0] . '<' . sanitize_email($address) . '>';
-            }
-        } else {
-            $headers[] = "{$type}: " . explode('@', $addresses)[0] . '<' . sanitize_email($addresses) . '>';
+
+        foreach ($this->validateAddresses($address, $fields) as $validAddress) {
+            // The local part becomes the header display name, so it must be sanitized too —
+            // it is submitter-controlled and lands in a raw header string.
+            $displayName = sanitize_text_field(explode('@', $validAddress)[0]);
+            $headers[] = "{$type}: {$displayName}<{$validAddress}>";
         }
 
         return $headers;

backend/Actions/MailRelay/RecordApiHelper.php

@@ -122,7 +122,7 @@ public function execute($selectedGroups, $fieldValues, $fieldMap, $status)
     public function isExist($baseUrl, $email)
     {
         $queryEndpoints = $baseUrl . 'subscribers?q%5Bemail_eq%5D=';
-        $encodedEmail = urlencode($email);
+        $encodedEmail = rawurlencode($email);
         $apiEndpoints = $queryEndpoints . $encodedEmail;
         $response = HttpHelper::get($apiEndpoints, null, $this->_defaultHeader);
 

backend/Actions/Mailify/MailifyController.php

@@ -11,6 +11,8 @@ class MailifyController
     public static array $authConfig = [
         'authType' => AuthorizationType::BASIC_AUTH,
         'slug'     => 'mailify',
+        // Connections store the UI's display name, which carries the Sarbacane rebrand.
+        'aliases'  => ['Sarbacane(Mailify)'],
         'fields'   => [
             'account_id' => 'username',
             'api_key'    => 'password',

backend/Actions/Mailjet/RecordApiHelper.php

@@ -113,7 +113,7 @@ private function jobMonitoring($response)
 
     private function isExist($email)
     {
-        $encodedEmail = urlencode($email);
+        $encodedEmail = rawurlencode($email);
         $apiEndpoint = 'https://api.mailjet.com/v3/REST/contact/' . $encodedEmail;
         $response = HttpHelper::get($apiEndpoint, null, $this->_defaultHeader);
 

backend/Actions/OneDrive/RecordApiHelper.php

@@ -3,6 +3,7 @@
 namespace BitApps\Integrations\Actions\OneDrive;
 
 use BitApps\Integrations\Core\Util\Common;
+use BitApps\Integrations\Core\Util\FileSystem;
 use BitApps\Integrations\Core\Util\HttpHelper;
 use BitApps\Integrations\Log\LogHandler;
 
@@ -46,7 +47,7 @@ public function uploadFile($folder, $file, $folderId, $parentId)
 
         return HttpHelper::post(
             $apiEndpoint,
-            file_get_contents($filePath),
+            FileSystem::read($filePath),
             $headers
         );
     }

backend/Actions/Salesforce/SalesforceController.php

@@ -306,7 +306,7 @@ public static function selesforceUserList($params)
         $response = self::refreshTokenDetails($params);
         $tokenDetails = $response['tokenDetails'];
 
-        $apiEndpoint = "{$tokenDetails->instance_url}/services/data/v37.0/query/?q=" . urlencode('SELECT Id, Name FROM User');
+        $apiEndpoint = "{$tokenDetails->instance_url}/services/data/v37.0/query/?q=" . rawurlencode('SELECT Id, Name FROM User');
 
         $apiResponse = HttpHelper::get($apiEndpoint, null, self::setHeaders($tokenDetails->access_token));
 

backend/Actions/SendinBlue/SendinBlueController.php

@@ -20,6 +20,8 @@ class SendinBlueController
     public static array $authConfig = [
         'authType' => AuthorizationType::API_KEY,
         'slug'     => 'sendinblue',
+        // Connections store the UI's display name, which carries the Brevo rebrand.
+        'aliases'  => ['Brevo(Sendinblue)'],
         'fields'   => [
             'api_key' => 'value',
         ],