From c49b9a0423cb902012eeb60826171cb358235d77 Mon Sep 17 00:00:00 2001
From: James Rosado <jamesros@boldgrid.com>
Date: Wed, 23 Dec 2020 11:02:44 -0500
Subject: [PATCH 1/6] Escape spreadsheet special characters to prevent formula
 exploits

---
 includes/admin/class-admin.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/includes/admin/class-admin.php b/includes/admin/class-admin.php
index 5049046..6fb3dde 100644
--- a/includes/admin/class-admin.php
+++ b/includes/admin/class-admin.php
@@ -206,8 +206,12 @@ public function export_form_entries() {
 
                     default:
 
-                        $value              = weforms_get_entry_meta( $entry->id, $column_id, true );
-                        $value              = weforms_get_pain_text( $value );
+                        $value = weforms_get_entry_meta( $entry->id, $column_id, true );
+						$value = weforms_get_pain_text( $value );
+
+						// escape spreadsheet special characters to prevent formula exploits.
+						$value = preg_match( '/^[=+@-].*/', $value ) ? '\'' . $value : $value;
+
                         $temp[ $column_id ] = str_replace( WeForms::$field_separator, ' ', $value );
 
                         break;

From 77dc1ba8eec043299b6264e3f0473ffcfa2ae767 Mon Sep 17 00:00:00 2001
From: James Rosado <jamesros@boldgrid.com>
Date: Wed, 23 Dec 2020 12:04:47 -0500
Subject: [PATCH 2/6] moved spreadsheet sanitizing to functions.php

---
 includes/admin/class-admin.php |  8 ++------
 includes/functions.php         | 24 ++++++++++++------------
 2 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/includes/admin/class-admin.php b/includes/admin/class-admin.php
index 6fb3dde..d500f4f 100644
--- a/includes/admin/class-admin.php
+++ b/includes/admin/class-admin.php
@@ -206,12 +206,8 @@ public function export_form_entries() {
 
                     default:
 
-                        $value = weforms_get_entry_meta( $entry->id, $column_id, true );
-						$value = weforms_get_pain_text( $value );
-
-						// escape spreadsheet special characters to prevent formula exploits.
-						$value = preg_match( '/^[=+@-].*/', $value ) ? '\'' . $value : $value;
-
+                        $value              = weforms_get_entry_meta( $entry->id, $column_id, true );
+						$value              = weforms_get_pain_text( $value );
                         $temp[ $column_id ] = str_replace( WeForms::$field_separator, ' ', $value );
 
                         break;
diff --git a/includes/functions.php b/includes/functions.php
index fff7114..a58bfda 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -1204,23 +1204,23 @@ function weforms_get_pain_text( $value ) {
 
     if ( is_array( $value ) ) {
         $string_value = [];
+		foreach ( $value as $key => $single_value ) {
+			if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
+				$single_value = weforms_get_pain_text( $single_value );
+			}
 
-        if ( is_array( $value ) ) {
-            foreach ( $value as $key => $single_value ) {
-                if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
-                    $single_value = weforms_get_pain_text( $single_value );
-                }
-
-                $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
+			$single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
 
-                $string_value[] = $single_value;
-            }
+			$string_value[] = $single_value;
+		}
 
-            $value = implode( WeForms::$field_separator, $string_value );
-        }
+		$value = implode( WeForms::$field_separator, $string_value );
     }
 
-    $value = trim( strip_tags( $value ) );
+	$value = trim( strip_tags( $value ) );
+
+	// escape spreadsheet special characters to prevent formula exploits.
+	$value = preg_match( '/^[=+@-].*/', $value ) ? '\'' . $value : $value;
 
     return $value;
 }

From ce7a2353d53d0cd1ce6551630d4b495ad5db6a5d Mon Sep 17 00:00:00 2001
From: James Rosado <jamesros@boldgrid.com>
Date: Wed, 23 Dec 2020 12:06:10 -0500
Subject: [PATCH 3/6] changed tab to spaces to match rest of file.

---
 includes/admin/class-admin.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/admin/class-admin.php b/includes/admin/class-admin.php
index d500f4f..5049046 100644
--- a/includes/admin/class-admin.php
+++ b/includes/admin/class-admin.php
@@ -207,7 +207,7 @@ public function export_form_entries() {
                     default:
 
                         $value              = weforms_get_entry_meta( $entry->id, $column_id, true );
-						$value              = weforms_get_pain_text( $value );
+                        $value              = weforms_get_pain_text( $value );
                         $temp[ $column_id ] = str_replace( WeForms::$field_separator, ' ', $value );
 
                         break;

From 1de3fbd8bd574bc7b8d9dd2b27a1cef39e0cbe09 Mon Sep 17 00:00:00 2001
From: James Rosado <jamesros@boldgrid.com>
Date: Wed, 23 Dec 2020 12:07:48 -0500
Subject: [PATCH 4/6] change tabs to spaces to match rest of file

---
 includes/functions.php | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/includes/functions.php b/includes/functions.php
index a58bfda..d07e9f8 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -1204,17 +1204,17 @@ function weforms_get_pain_text( $value ) {
 
     if ( is_array( $value ) ) {
         $string_value = [];
-		foreach ( $value as $key => $single_value ) {
-			if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
-				$single_value = weforms_get_pain_text( $single_value );
-			}
+        foreach ( $value as $key => $single_value ) {
+            if ( is_array( $single_value ) || is_serialized( $single_value ) ) {
+                $single_value = weforms_get_pain_text( $single_value );
+            }
 
-			$single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
+            $single_value = ucwords( str_replace( [ '_', '-' ], ' ', $key ) ) . ': ' . ucwords( $single_value );
 
-			$string_value[] = $single_value;
-		}
+            $string_value[] = $single_value;
+        }
 
-		$value = implode( WeForms::$field_separator, $string_value );
+        $value = implode( WeForms::$field_separator, $string_value );
     }
 
 	$value = trim( strip_tags( $value ) );

From 7a6b3f412ba45e4fb7b21d05f6b573c68940e3a5 Mon Sep 17 00:00:00 2001
From: James Rosado <jamesros@boldgrid.com>
Date: Wed, 23 Dec 2020 12:08:32 -0500
Subject: [PATCH 5/6] changed tabs to spaces to match rest of file.

---
 includes/functions.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/includes/functions.php b/includes/functions.php
index d07e9f8..6ee5392 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -1217,10 +1217,10 @@ function weforms_get_pain_text( $value ) {
         $value = implode( WeForms::$field_separator, $string_value );
     }
 
-	$value = trim( strip_tags( $value ) );
+    $value = trim( strip_tags( $value ) );
 
-	// escape spreadsheet special characters to prevent formula exploits.
-	$value = preg_match( '/^[=+@-].*/', $value ) ? '\'' . $value : $value;
+    // escape spreadsheet special characters to prevent formula exploits.
+    $value = preg_match( '/^[=+@-].*/', $value ) ? '\'' . $value : $value;
 
     return $value;
 }

From a480bd28e4e39c6552e29dfc4181ce866ebafeb2 Mon Sep 17 00:00:00 2001
From: James Rosado <jamesros@boldgrid.com>
Date: Wed, 23 Dec 2020 12:10:27 -0500
Subject: [PATCH 6/6] correct regex

---
 includes/functions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/functions.php b/includes/functions.php
index 6ee5392..a9546d4 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -1220,7 +1220,7 @@ function weforms_get_pain_text( $value ) {
     $value = trim( strip_tags( $value ) );
 
     // escape spreadsheet special characters to prevent formula exploits.
-    $value = preg_match( '/^[=+@-].*/', $value ) ? '\'' . $value : $value;
+    $value = preg_match( '/^[=+@-]/', $value ) ? '\'' . $value : $value;
 
     return $value;
 }
